Cisco Cisco IOS Software Release 12.0(15)S

Six new aggregation export records are defined, one for each new aggregation scheme. The new 
aggregation export records also use the Version 8 datagram format (just like the current aggregation 
export records do). The Version 8 datagram consists of a header with the version number (which is 8) 
and time stamp information, followed by one or more records corresponding to individual entries in the 
flow cache. Figure 1 displays the Version 8 header format followed by the six new export formats.

Version: Flow export format version number. In this case 8.

Count: Number of export records contained in the datagram.

Sys Up Time: Current time in milliseconds since router booted.

UNIX Seconds: Current seconds since 0000 UTC 1970.

UNIX Nanoseconds: Residual nanoseconds since 0000 UTC 1970.

Sequence Number: Sequence counter of total flows sent for this export stream.

Engine Type: Type of flow switching engine. (RP, VIP, and so on.)

Engine ID: ID number of the flow switching engine.

Aggregation: Aggregation method being used.

Agg Version: Version of the aggregation export sub format.

Sampling Interval: Interval value used if Sampled NetFlow is configured.

Reserved: Zero field.

The AS-ToS aggregation scheme groups together flows that have the same source and destination BGP 
autonomous system, source and destination interfaces, and ToS byte. The aggregated NetFlow Export 
record reports the following:

Source BGP autonomous system

0

Version

Count

Sys Up Time

UNIX Seconds

UNIX Nanoseconds

Sequence Number

Engine Type

Engine ID

Aggregation

Agg Version

4

8

12

16

20

24

Sampling Interval

Reserved