Caligare home | What's Netflow | Formats | RFC | Configuration | Applications | Links | Netflow Forum

Netflow packet Version 7 (V7)

version 1 | version 5 | version 6 | version 7 | version 8 | version 9

Flow header format

0-1versionNetFlow export format version number
2-3countNumber of flows exported in this packet (1-30)
4-7sys_uptimeCurrent time in milliseconds since the export device booted
8-11unix_secsCurrent count of seconds since 0000 UTC 1970
12-15unix_nsecsResidual nanoseconds since 0000 UTC 1970
16-19flow_sequenceSequence counter of total flows seen
20-23reservedUnused (zero) bytes

Flow record format

0-3srcaddrSource IP address
4-7dstaddrDestination IP address
8-11nexthopIP address of next hop router
12-13inputSNMP index of input interface
14-15outputSNMP index of output interface
16-19dPktsPackets in the flow
20-23dOctetsTotal number of Layer 3 bytes in the packets of the flow
24-27firstSysUptime at start of flow
28-31lastSysUptime at the time the last packet of the flow was received
32-33srcportTCP/UDP source port number or equivalent
34-35dstportTCP/UDP destination port number or equivalent
36pad1Unused (zero) bytes
37tcp_flagsCumulative OR of TCP flags
38protIP protocol type (for example, TCP = 6; UDP = 17)
39tosIP type of service (ToS)
40-41src_asAutonomous system number of the source, either origin or peer
42-43dst_asAutonomous system number of the destination, either origin or peer
44src_maskSource address prefix mask bits
45dst_maskDestination address prefix mask bits
46-47flagsFlags indicating, among other things, what flows are invalid
48-51router_scIP address of the router that is bypassed by the Catalyst 5000 series switch. This is the same address the router uses when it sends NetFlow export packets. This IP address is propagated to all switches bypassing the router through the FCP protocol.

(c) 2003-2006 Caligare s.r.o.
Last-modified: May 10 2006