Cisco Systems WSC4500X16SFP Manual De Usuario
38-3
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter 38 Configuring NetFlow
Overview of NetFlow Statistics Collection
Information Derived from Hardware
Information available in a typical NetFlow record from hardware includes the following:
•
the packet and byte counts
•
start and end timestamps
Table 38-2 NDE Version 5 Flow Record Format
Bytes
Content
Description
Flow masks:
• X=Populated
• A=Additional field
• X=Populated
• A=Additional field
S
o
ur
ce
D
e
stin
a
tio
n
D
e
stin
a
tio
n
S
o
ur
ce
De
stin
a
tio
n
S
o
ur
ce
In
te
rf
a
c
e
Fu
ll
Fu
ll
In
te
rf
a
c
e
0–3
srcaddr
Source IP address
X
X
X
X
X
4–7
dstaddr
Destination IP address
X
X
X
X
X
8–11
nexthop
Next hop router’s IP address
A
1
1.
With the destination flow mask, the “Next hop router’s IP address” field and the “Output interface’s SNMP ifIndex” field might not contain information
that is accurate for all flows.
that is accurate for all flows.
A
A
A
A
12–13 input
Ingress interface SNMP ifIndex
X
X
14–15 output
Egress interface SNMP ifIndex
A
A
A
A
A
16–19 dPkts
Packets in the flow
X
X
X
X
X
X
20–23 dOctets
Octets (bytes) in the flow
X
X
X
X
X
X
24–27 first
SysUptime at start of the flow
X
X
X
X
X
X
28–31 last
SysUptime at the time the
last packet of the flow was received
last packet of the flow was received
X
X
X
X
X
X
32–33 srcport
Layer 4 source port number or equivalent
X
2
2.
In PFC3BXL or PFC3B mode, ICMP traffic contains the ICMP code and type values.
X
34–35 dstport
Layer 4 destination port number or equivalent
X
X
36 pad1 Unused
(zero)
byte
37
tcp_flags Cumulative OR of TCP flags
38
prot Layer
4
protocol
(for example, 6=TCP, 17=UDP)
X
X
39
tos
IP type-of-service byte
40–41 src_as
Autonomous system number of the source,
either origin or peer
either origin or peer
X
X
X
X
X
42–43 dst_as
Autonomous system number of the
destination, either origin or peer
destination, either origin or peer
X
X
X
X
X
44–45 src_mask Source address prefix mask bits
X
X
X
X
X
46–47 dst_mask Destination address prefix mask bits
X
X
X
X
X
48
pad2
Pad 2 is unused (zero) bytes