Appendix 1 - NetFlow v5 - NetFlow v9 Field Types Mapping

NetFlow v5 Fields

FIELD2

NetFlow v9 Representation

FIELD4

FIELD5

Contents

Description

Contents

Description

Contents

srcaddr

Source IP address

IPV4_SRC_ADDR

8

4

dstaddr

Destination IP address

IPV4_DST_ADDR

12

4

nexthop

IP address of next hop router

IPV4_NEXT_HOP

15

4

input

SNMP index of input interface

INPUT_SNMP

10

4

output

SNMP index of output interface

OUTPUT_SNMP

14

4

dPkts

Packets in the flow

IN_PKTS

2

4

dOctets

Total number of Layer 3 bytes in the packets of the flow

IN_BYTES

1

4

first

SysUptime at start of flow

FIRST_SWITCHED

22

4

last

SysUptime at the time the last packet of the flow was received

LAST_SWITCHED

21

4

srcport

TCP/UDP source port number or equivalent

L4_SRC_PORT

7

2

dstport

TCP/UDP destination port number or equivalent

L4_DST_PORT

11

2

pad1

Unused (zero) bytes

Not converted

N/A

N/A

tcp_flags

Cumulative OR of TCP flags

TCP_FLAGS

6

1

prot

IP protocol type (for example, TCP = 6; UDP = 17)

PROTOCOL

4

1

tos

IP type of service (ToS)

SRC_TOS

5

1

src_as

Autonomous system number of the source, either origin or peer

SRC_AS

16

2

dst_as

Autonomous system number of the destination, either origin or peer

DST_AS

17

2

src_mask

Source address prefix mask bits

SRC_MASK

9

1

dst_mask

Destination address prefix mask bits

DST_MASK

13

1

pad2

Unused (zero) bytes

Not converted

N/A

N/A