Caligare home | What's Netflow | Formats | RFC | Configuration | Applications | Links | Netflow Forum

Netflow packet Version 1 (V1)

version 1 | version 5 | version 6 | version 7 | version 8 | version 9

Flow header format

BytesContentsDescription
0-1versionNetFlow export format version number
2-3countNumber of flows exported in this packet (1-24)
4-7sys_uptimeCurrent time in milliseconds since the export device booted
8-11unix_secsCurrent count of seconds since 0000 UTC 1970
12-16unix_nsecsResidual nanoseconds since 0000 UTC 1970

Flow record format

BytesContentsDescription
0-3srcaddrSource IP address
4-7dstaddrDestination IP address
8-11nexthopIP address of next hop router
12-13inputSNMP index of input interface
14-15outputSNMP index of output interface
16-19dPktsPackets in the flow
20-23dOctetsTotal number of Layer 3 bytes in the packets of the flow
24-27firstSysUptime at start of flow
28-31lastSysUptime at the time the last packet of the flow was received
32-33srcportTCP/UDP source port number or equivalent
34-35dstportTCP/UDP destination port number or equivalent
36-37pad1Unused (zero) bytes
38protIP protocol type (for example, TCP = 6; UDP = 17)
39tosIP type of service (ToS)
40flagsCumulative OR of TCP flags
41-48pad2Unused (zero) bytes


(c) 2003-2006 Caligare s.r.o.
http://www.caligare.com
Last-modified: May 10 2006