Skip to main content
Version: 2.9.1

Cisco AVC Top Applications Monitor (10434 / 20434)


This Module, based on processing Cisco Application Visibility and Control (AVC) flows (, reports top Applications by bandwidth per exporter. It consolidates NetFlow records over a period of time (Data collection interval) which all have the same combination of the following fields:

  • Exporter IP address
  • Application Tag (Classification Engine ID and Selector ID)

Time trigger (Data collection interval) function – executed every 30 sec (default).

  1. Determine top N Applications by bandwidth consumption
  2. Report all consolidated conversations for top N applications This information is provided per NetFlow exporter


Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
N – number of reported ApplicationsThe number of top Applications reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all Applications are reported)


Cisco AVC NetFlow v9 (including Cisco WLC NetFlow v9) Data and Options.

Required NetFlow Fields

Information Element (IE)IE idIE size, BDescription
applicationId954 or N8 bits of engine ID, followed by n bits of classification.
octetDeltaCount14 or 8The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.
packetDeltaCount24 or 8The number of incoming packets since the previous report (if any) for this Flow at the Observation Point.

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier“nfc_id=20434”
exp_ipNetFlow exporter Ipv4 address<IPv4 address>
protocolTransport Protocol ( TCP = 6, UDP = 17)<number>
app_tagApplication Tag<string>, example “13:1”
app_name [^1]Application Name<string>, example “ftp”
engine_idClassification Engine ID<string>, example “IANA-L3”
bytes_inLayer 3 bytes of ingress flows<number>
packets_inLayer 3 packets of ingress flows<number>
bytes_outLayer 3 bytes of egress flows<number>
packets_out [^2]Layer 3 packets of egress flows<number>
bytesLayer 3 bytes in both directions<number>
packetsPackets in both directions<number>
flow_countNumber of flows<number>
t_intObservation time interval, msec<number>

[^1]: Device must be configured to export Application list in NetFlow Options

[^2]: In/out bytes and packets are not calculated when “flowDirection” field is absent