Flow Capture and Replay Data (21001 / 31001 / 21800 / 21900)
These messages enable you to look back in time for security issues and forensic investigations. In Replay mode NFO sends all underlying flow records in Original Flow Data format with nfc_id as follows:
| Flow Record Type | Original Flow Data nfc_id | Replay Data nfc_id |
|---|---|---|
| NetFlow v5/v9/IPFIX data records | nfc_id=20001 | nfc_id=21001 |
| NetFlow v5/v9/IPFIX options records | nfc_id=30001 | nfc_id=31001 |
| sFlow counter records | nfc_id=20800 | nfc_id=21800 |
| sFlow data records | nfc_id=20900 | nfc_id=21900 |