Caligare home | What's Netflow | Formats | RFC | Configuration | Applications | Links | Netflow Forum

Netflow packet Version 5 (V5)

version 1 | version 5 | version 6 | version 7 | version 8 | version 9

Flow header format

0-1versionNetFlow export format version number
2-3countNumber of flows exported in this packet (1-30)
4-7sys_uptimeCurrent time in milliseconds since the export device booted
8-11unix_secsCurrent count of seconds since 0000 UTC 1970
12-15unix_nsecsResidual nanoseconds since 0000 UTC 1970
16-19flow_sequenceSequence counter of total flows seen
20engine_typeType of flow-switching engine
21engine_idSlot number of the flow-switching engine
22-23sampling_intervalFirst two bits hold the sampling mode; remaining 14 bits hold value of sampling interval

Flow record format

0-3srcaddrSource IP address
4-7dstaddrDestination IP address
8-11nexthopIP address of next hop router
12-13inputSNMP index of input interface
14-15outputSNMP index of output interface
16-19dPktsPackets in the flow
20-23dOctetsTotal number of Layer 3 bytes in the packets of the flow
24-27firstSysUptime at start of flow
28-31lastSysUptime at the time the last packet of the flow was received
32-33srcportTCP/UDP source port number or equivalent
34-35dstportTCP/UDP destination port number or equivalent
36pad1Unused (zero) bytes
37tcp_flagsCumulative OR of TCP flags
38protIP protocol type (for example, TCP = 6; UDP = 17)
39tosIP type of service (ToS)
40-41src_asAutonomous system number of the source, either origin or peer
42-43dst_asAutonomous system number of the destination, either origin or peer
44src_maskSource address prefix mask bits
45dst_maskDestination address prefix mask bits
46-47pad2Unused (zero) bytes

(c) 2003-2006 Caligare s.r.o.
Last-modified: May 10 2006