Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

netflow v9 packet format

I am writing my own netflow collector to run as a windows service and do fancy things with the data it collects. one of the first issues i am running into is this.

in the netflow format PDF i obtain from ciscos site. it says that the packet header is 20bytes long. bits 0-159. one of the questions i had is this. for example i parse out the first field which is the version field. this is 2 bytes long. according to documentation bits 0 -

15 hold this value with bit 15 in the picture having a value of 2^0 and bit 0 having a value of 2^15. after rasing the bits to the correct powers and adding up the values i do obtain the decimal 9 which is what i expected. once i try to parse out a field outside of the header is where i run into problems. the header ends at bit 159 is it correct for me to assume that the FLOWSETID field starts at bit position 160 and goes to 175 (2bytes)? i think my bit positions are off or something because i was getting 14483 as a field type number. and thats not listen anywhere in the table 6 of field types in the PDF. does anyone have an idea if there is padding in between the header and where the flowset data begins?

1 REPLY
Silver

Re: netflow v9 packet format

There is no such zeros added inbetween.The NetFlow Version 9 record format consists of a packet header immediately followed by at least one or more template or data FlowSets.Refer the following URL

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_white_paper09186a00800a3db9.shtml

205
Views
0
Helpful
1
Replies
CreatePlease to create content