Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

NetFlow v9

Hi,

I am trying to use NetFlow v9 to analyze traffic between two servers. Where are the source and destination ip addresses stored in the v9 packets ?

Is this information part of the template or the flow record ?

Thanks in advance.

3 REPLIES
Bronze

Re: NetFlow v9

Hello,

IP addresses are part of flow record. But you need also parse a template. In the template you will find a structure of flow record... See http://netflow.caligare.com/netflow_v9.htm for more information about NetFlow version 9.

Kind regards,

Jan Nejman

Caligare, Co.

http://www.caligare.com/

New Member

Re: NetFlow v9

Netflow v9 (and IPFIX) are different from the previous netflow export formats, in that they're template based.

So the data records are no longer in a fixed format - which is which prevented previous formats (eg, v5) from being extensible.

Now the templates tell you which fields are available in the data records, and what the size of each field is. From this, you can work out where each field can be found.

So you have to parse each template before you begin to look at the data..

127
Views
0
Helpful
3
Replies
CreatePlease to create content