Message Types (nfc_id)
Every message NFO sends carries an nfc_id field identifying what kind of message it is. This is the identifier you see at the destination, and what downstream content keys on. The NetFlow and SNMP Analytics App for Splunk, for example, selects data by nfc_id rather than by module.
Where the Values Come From
Messages originate from four places:
- Modules. Each enabled module emits one or more message types. The module is numbered
10xxxand its output is usually the matching20xxx, so module 10062 producesnfc_id=20062. This is a convention rather than a rule: a module that produces more than one kind of message needs more than one identifier, and a few do not follow the digit pattern at all. - Original Flow Data. One-to-one conversion of the flow records NFO receives, sent when that service is enabled. No module is involved.
- Model Driven Telemetry. Telemetry streamed by a device over gRPC dial-out.
- NetFlow Recorder replay. Recorded traffic re-sent from the NetFlow Recorder. The identifier is the original value plus 1000, so a replayed
20001record arrives as21001.
Selecting Message Types on an Output
An output has two filters, and a message must pass both.
The Output filter selects by category: All, Modules Output only, Original NetFlow/IPFIX only, or Original sFlow only.
The Module Filter takes a list of identifiers. For module messages and Model Driven Telemetry, that identifier is the same as the printed nfc_id. For Original Flow Data and NetFlow Recorder replay messages it is not: all of them are selected by 20001, whatever their printed value.
warning
Entering 20800, 30001, 21001 or any other Original Flow Data or replay value in the Module Filter matches nothing. Use 20001 to select them.
Reference
| nfc_id | Source | Description |
|---|---|---|
| 20001 | Original Flow Data | NetFlow v5/v9 or IPFIX data record translated one-to-one into syslog or JSON. |
| 20002 | Sampling Monitor (10002) | Sampling interval and sampling algorithm that one exporter reports for one flow sampler (NetFlow v5/v9, IPFIX or sFlow), sent every collection interval (60 s by default); the module is enabled by default. |
| 20004 | DNS Service Monitor (10004) | Performance of one DNS server per IP protocol over the collection interval: minimum, maximum and average response time, average request and response size, flow and packet counts. |
| 20005 | DNS Users Monitor (10005) | DNS traffic (requests and responses) between one requesting host and one DNS server, per exporter and IP protocol over the collection interval; can be limited to the top N per exporter. |
| 20011 | Network Subnets Monitor (10011) | Traffic between a monitored subnet and one host it communicates with, per exporter and IP protocol over the collection interval; top N hosts per subnet by bytes (50 by default). |
| 20014 | Asset Access Monitor (10014) | Traffic between a monitored service (IP address, port, protocol) and one peer outside the Authorized Peers list (any peer if the list is empty), per exporter over the collection interval. |
| 20017 | Services Performance Monitor (10017) | Performance of one monitored service (IP address, port, protocol) per exporter over the collection interval: minimum, maximum and average response time, bytes in and out, flow count. |
| 20060 | TCP Health Monitor (10060) | Host whose TCP resets over the collection interval reach a configured share of all resets seen by its definitive exporter or of its own connections, with the reset count. |
| 20062 | Network Conversations Monitor (10062) | One enriched conversation (exporter and 5-tuple) over the collection interval, built from NetFlow, IPFIX, sFlow or cloud flow logs and stitched into one bidirectional record if enabled; top N per exporter by bytes (50 by default) plus all threat-list matches. |
| 20065 | CBQoS Monitor (10065) | Traffic of one exporter over the collection interval for one combination of IP protocol and ingress and egress ToS (DSCP) values, with its share of the exporter's bytes. |
| 20067 | Top Traffic Monitor (10067) | One unidirectional flow consolidated over the collection interval (exporter, 5-tuple and interfaces); top N per exporter by bytes (50 by default). |
| 20103 | SNMP Custom OID Sets Monitor (10103) | Values of one OID set from one poll of one device; a set with table OIDs gives one message per table row. |
| 20196 | DDoS Detector (10190) | Events Correlator: correlated DDoS attack alert for an exporter, with the contributing indicators and confidence score; sent each time new indicators bring the combined confidence to the threshold, so it repeats during an attack. |
| 20567 | Cisco AnyConnect Top Traffic (10567) | One Cisco AnyConnect NVM flow consolidated over the collection interval, with the logged-in user, process and endpoint details. |
| 20600 | Model Driven Telemetry | Telemetry that a Cisco device streams over gRPC dial-out in kvGPB encoding, one message per data row or list element (for example one interface's statistics); JSON outputs only. |
| 20700 | SNMP Traps Monitor (10700) | One SNMP trap or inform received from a device, with its variable bindings. |
| 20701 | Auto-discovery Reporter (10701) | One device from the SNMP auto-discovery inventory; the whole inventory is re-sent at the Report devices interval (3600 s by default). |
| 20702 | Auto-discovery Reporter (10701) | One topology link from a device interface to a neighbor or next hop, found by SNMP auto-discovery or derived from flow records (see con_source); the far end need not be a discovered device. |
| 20800 | Original Flow Data | One counter record of an sFlow v5 counter sample (for example interface, CPU, memory or disk counters) translated one-to-one into syslog or JSON; a sample with several records gives several messages. |
| 20900 | Original Flow Data | One flow record of an sFlow v5 flow sample (for example the sampled packet header, or extended switch or router data) translated one-to-one into syslog or JSON; a sample with several records gives several messages. |
| 21001 | NetFlow Recorder replay | Recorded NetFlow v5/v9 or IPFIX data record re-sent in the 20001 format (20001 + 1000). |
| 21800 | NetFlow Recorder replay | Counter record of a recorded sFlow counter sample re-sent in the 20800 format (20800 + 1000). |
| 21900 | NetFlow Recorder replay | Flow record of a recorded sFlow flow sample re-sent in the 20900 format (20900 + 1000). |
| 30001 | Original Flow Data | NetFlow v9 or IPFIX options record (exporter metadata such as interface or sampler tables) translated one-to-one into syslog or JSON. |
| 31001 | NetFlow Recorder replay | Recorded NetFlow v9 or IPFIX options record re-sent in the 30001 format (30001 + 1000). |
note
A module that emits more than one message type has an identifier for each. The Auto-discovery Reporter (10701) is the clearest example, sending discovered devices as 20701 and their topology links as 20702.