NetFlow v9

[anandmirasdar]

Hi,

I am trying to use NetFlow v9 to analyze traffic between two servers. Where are the source and destination ip addresses stored in the v9 packets ?

Is this information part of the template or the flow record ?

Thanks in advance.

[yjdabear]

http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00808c2833.html#wp1052564

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_feature_guide09186a00801b0696.html

[Jan Nejman]

Hello,

IP addresses are part of flow record. But you need also parse a template. In the template you will find a structure of flow record... See http://netflow.caligare.com/netflow_v9.htm for more information about NetFlow version 9.

Kind regards,

Jan Nejman

Caligare, Co.

http://www.caligare.com/

[paitken]

Netflow v9 (and IPFIX) are different from the previous netflow export formats, in that they're template based.

So the data records are no longer in a fixed format - which is which prevented previous formats (eg, v5) from being extensible.

Now the templates tell you which fields are available in the data records, and what the size of each field is. From this, you can work out where each field can be found.

So you have to parse each template before you begin to look at the data..