Cisco Support Community
Community Member

netflow v9 packet.

I am writing my own netflow collector to run as a windows service and do fancy things with the data it collects. one of the first issues i am running into is this.

in the netflow format PDF i obtain from ciscos site. it says that the packet header is 20bytes long. bits 0-159. one of the questions i had is this. for example i parse out the first field which is the version field. this is 2 bytes long. according to documentation bits 0 -

15 hold this value with bit 15 in the picture having a value of 2^0 and bit 0 having a value of 2^15. after rasing the bits to the correct powers and adding up the values i do obtain the decimal 9 which is what i expected. once i try to parse out a field outside of the header is where i run into problems. the header ends at bit 159 is it correct for me to assume that the FLOWSETID field starts at bit position 160 and goes to 175 (2bytes)? i think my bit positions are off or something because i was getting 14483 as a field type number. and thats not listen anywhere in the table 6 of field types in the PDF. does anyone have an idea if there is padding in between the header and where the flowset data begins? (btw as far as i know, everything is un-signed)

CreatePlease to create content