Cisco Cisco ASA for Nexus 1000V Series Switch
5
Cisco ASA NetFlow Implementation Guide
About NSEL
NF_F_XLATE_SRC_ADDR_IPV4
225
4
Post NAT Source IPv4 Address
NF_F_XLATE_DST_ADDR_IPV4
226
4
Post NAT Destination IPv4 Address
NF_F_XLATE_SRC_PORT
227
2
Post NATT Source Transport Port
NF_F_XLATE_DST_PORT
228
2
Post NATT Destination Transport Port
Mapped Flow ID Fields (L3 IPv6)
NF_F_XLATE_SRC_ADDR_IPV6
281
16
Post NAT Source IPv6 Address
NF_F_XLATE_DST_ADDR_IPV6
282
16
Post NAT Destination IPv6 Address
Status or Event Fields
NF_F_FW_EVENT
233
1
High-level event code. Values are as follows:
•
0—Default (ignore)
•
1—Flow created
•
2—Flow deleted
•
3—Flow denied
•
4—Flow alert
•
5—Flow update
NF_F_FW_EXT_EVENT
33002
2
Extended event code. These values provide
additional information about the event.
additional information about the event.
Timestamp and Statistics Fields
NF_F_EVENT_TIME_MSEC
323
8
The time that the event occurred, which comes
from IPFIX. Use 324 for time in microseconds,
and 325 for time in nanoseconds. Time has been
counted as milliseconds since 0000 UTC
January 1, 1970.
from IPFIX. Use 324 for time in microseconds,
and 325 for time in nanoseconds. Time has been
counted as milliseconds since 0000 UTC
January 1, 1970.
NF_F_FLOW_CREATE_TIME_MSEC 152
8
The time that the flow was created, which is
included in extended flow-teardown events in
which the flow-create event was not sent earlier.
The flow duration can be determined with the
event time for the flow-teardown and
flow-create times.
included in extended flow-teardown events in
which the flow-create event was not sent earlier.
The flow duration can be determined with the
event time for the flow-teardown and
flow-create times.
NF_F_FWD_FLOW_DELTA_BYTES
231
4
The delta number of bytes from source to
destination.
destination.
NF_F_REV_FLOW_DELTA_BYTES
232
4
The delta number of bytes from destination to
source.
source.
ACL Fields
Table 2
Data Records Exported Through NSEL (continued)
ID TYPE
LEN
DESC