Cisco Systems WSC4500X16SFP Information Derived from Hardware

38-3
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter38 Configuring NetFlow
Overview of NetFlow Statistics Collection
Information Derived from Hardware
Information available in a typical NetFlow record from hardware includes the following:
•the packet and byte counts
•start and end timestamps
Table38-2 NDE Version 5 Flow Record Format
Bytes Content Description
Flow masks:
• X=Populated
• A=Additional field
Source Destination Destination Source Destination Source Interface Full Full Interface
0–3 srcaddr Source IP address XXXXX
4–7 dstaddr Destination IP address XXXXX
8–11 nexthop Next hop router’s IP address A1
1. With the destination flow mask, the “Next hop router’s IP address” field and the “Output interface’s SNMP ifIndex” field might not contain information
that is accurate for all flows.
AAAA
12–13 input Ingress interface SNMP ifIndex XX
14–15 output Egress interface SNMP ifIndex A1AAAA
16��19 dPkts Packets in the flow XXXXXX
20–23 dOctets Octets (bytes) in the flow XXXXXX
24–27 first SysUptime at start of the flow XXXXXX
28–31 last SysUptime at the time the
last packetof the flow was received
XXXXXX
32–33 srcport Layer 4 source port number or equivalent X2
2. In PFC3BXL or PFC3B mode, ICMP traffic contains the ICMP code and type values.
X2
34–35 dstport L ayer 4 destination port number or equivalent XX
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
38 prot Layer 4 protocol
(forexample, 6=TCP, 17=UDP)
XX
39 tos IP type-of-service byte
40–41 src_as Autonomous system number of the source,
either origin or peer
XXXXX
42–43 dst_as Autonomous system number of the
destination, either origin or peer
XXXXX
44–45 src_mask Source address prefix mask bits XXXXX
46–47 dst_mask Destination address prefix mask bits XXXXX
48 pad2 Pad 2 is unused (zero) bytes