Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

What NetFlow version 9 record field represents the access point of a wireless device connection

We have multiple Cisco AIR type access points that are being controlled by a Cisco 5500 controller (IPV4). We would like to track the users source mac address by the access point. I have been through the Cisco NetFlow V9 spec at:http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html.

Is it right to assume that IN_SRC_MAC is the mac address of the wireless device?

Which NetFlow record field would identify the access point that the wireless device connected to?

TIA

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Purple

Re: What NetFlow version 9 record field represents the access po

WLC Netflow data is not exactly standard Netflow v9 format. It has additional field shown in the below.  In that, wtpMacAddress it the AP Mac Address & staMacAddress is client MAC address.

Refer this reference link for more detail.

http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps12722/qa_c67-722538_ps10315_Products_Q_and_A_Item.html

Q.

What are the supported export formats?

A. AVC currently supports the NetFlow Version 9 export format. The following unique elements are included in the current version of the wireless AVC NetFlow record:

• applicationTag

• ipDiffServCodePoint

• octetDeltaCount

• packetDeltaCount

• postIpDiffServCodePoint

• staIPv4Address

• staMacAddress

• wlanSSID

• wtpMacAddress

Also here is useful post on this topic

http://mrncciew.com/2013/02/12/configuring-netflow-on-wlc-7-4/

HTH

Rasika

*** Pls rate all useful response ****

3 REPLIES
VIP Purple

Re: What NetFlow version 9 record field represents the access po

WLC Netflow data is not exactly standard Netflow v9 format. It has additional field shown in the below.  In that, wtpMacAddress it the AP Mac Address & staMacAddress is client MAC address.

Refer this reference link for more detail.

http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps12722/qa_c67-722538_ps10315_Products_Q_and_A_Item.html

Q.

What are the supported export formats?

A. AVC currently supports the NetFlow Version 9 export format. The following unique elements are included in the current version of the wireless AVC NetFlow record:

• applicationTag

• ipDiffServCodePoint

• octetDeltaCount

• packetDeltaCount

• postIpDiffServCodePoint

• staIPv4Address

• staMacAddress

• wlanSSID

• wtpMacAddress

Also here is useful post on this topic

http://mrncciew.com/2013/02/12/configuring-netflow-on-wlc-7-4/

HTH

Rasika

*** Pls rate all useful response ****

New Member

What NetFlow version 9 record field represents the access point

Thanks for the quick and detailed reply.

VIP Purple

What NetFlow version 9 record field represents the access point

Hi Steve,

Good to see that helps.

Thanks for rating as well

Rasika

399
Views
0
Helpful
3
Replies