Message Types (nfc_id)
Every message NFO sends carries an nfc_id field identifying what kind of message it is. This is the identifier you see at the destination, the value you enter in an output's nfc_id filter, and what downstream content keys on. The NetFlow and SNMP Analytics App for Splunk, for example, selects data by nfc_id rather than by module.
Where the Values Come From
Messages originate from four places:
- Modules. Each enabled module emits one or more message types. The module is numbered
10xxxand its output is usually the matching20xxx, so module 10062 producesnfc_id=20062. This is a convention rather than a rule: a module that produces more than one kind of message needs more than one identifier, and a few do not follow the digit pattern at all. - Original Flow Data. One-to-one conversion of the flow records NFO receives, sent when that service is enabled. No module is involved.
- Model Driven Telemetry. Telemetry streamed by a device over gRPC dial-out.
- NetFlow Recorder replay. Recorded traffic re-sent from the NetFlow Recorder. The identifier is the original value plus 1000, so a replayed
20001record arrives as21001.
Reference
| nfc_id | Source | Description |
|---|---|---|
| 20001 | Original Flow Data | NetFlow v5/v9 or IPFIX data record translated one-to-one into syslog or JSON. |
| 20002 | Sampling Monitor (10002) | Sampling interval and sampling algorithm that one exporter reports for one flow sampler (NetFlow v5/v9, IPFIX or sFlow), sent every collection interval (60 s by default); the module is enabled by default. |
| 20004 | DNS Service Monitor (10004) | Performance of one DNS server per IP protocol over the collection interval: minimum, maximum and average response time, average request and response size, flow and packet counts. |
| 20005 | DNS Users Monitor (10005) | DNS traffic (requests and responses) between one requesting host and one DNS server, per exporter and IP protocol over the collection interval; can be limited to the top N per exporter. |
| 20010 | Original Flow Data | Packeteer-2 flow detail record from a Blue Coat PacketShaper translated one-to-one into syslog or JSON. |
| 20011 | Network Subnets Monitor (10011) | Traffic between a monitored subnet and one host it communicates with, per exporter and IP protocol over the collection interval; top N hosts per subnet by bytes (50 by default). |
| 20014 | Asset Access Monitor (10014) | Traffic between a monitored service (IP address, port, protocol) and one peer outside the Authorized Peers list (any peer if the list is empty), per exporter over the collection interval. |
| 20017 | Services Performance Monitor (10017) | Performance of one monitored service (IP address, port, protocol) per exporter over the collection interval: minimum, maximum and average response time, bytes in and out, flow count. |
| 20060 | TCP Health Monitor (10060) | Host whose TCP resets over the collection interval reach a configured share of all resets seen by its definitive exporter or of its own connections, with the reset count. |
| 20062 | Network Conversations Monitor (10062) | One enriched conversation (exporter and 5-tuple) over the collection interval, built from NetFlow, IPFIX, sFlow or cloud flow logs and stitched into one bidirectional record if enabled; top N per exporter by bytes (50 by default) plus all threat-list matches. |
| 20065 | CBQoS Monitor (10065) | Traffic of one exporter over the collection interval for one combination of IP protocol and ingress and egress ToS (DSCP) values, with its share of the exporter's bytes. |
| 20067 | Top Traffic Monitor (10067) | One unidirectional flow consolidated over the collection interval (exporter, 5-tuple and interfaces); top N per exporter by bytes (50 by default). |
| 20103 | SNMP Custom OID Sets Monitor (10103) | Values of one OID set from one poll of one device; a set with table OIDs gives one message per table row. |
| 20196 | DDoS Detector (10190) | Events Correlator: correlated DDoS attack alert for an exporter, with the contributing indicators and confidence score; sent each time new indicators bring the combined confidence to the threshold, so it repeats during an attack. |
| 20567 | Cisco AnyConnect Top Traffic (10567) | One Cisco AnyConnect NVM flow consolidated over the collection interval, with the logged-in user, process and endpoint details. |
| 20600 | Model Driven Telemetry | Telemetry that a Cisco device streams over gRPC dial-out in kvGPB encoding, one message per data row or list element (for example one interface's statistics); JSON outputs only. |
| 20700 | SNMP Traps Monitor (10700) | One SNMP trap or inform received from a device, with its variable bindings. |
| 20701 | Auto-discovery Reporter (10701) | One device from the SNMP auto-discovery inventory; the whole inventory is re-sent at the Report devices interval (3600 s by default). |
| 20702 | Auto-discovery Reporter (10701) | One topology link from a device interface to a neighbor or next hop, found by SNMP auto-discovery or derived from flow records (see con_source); the far end need not be a discovered device. |
| 20800 | Original Flow Data | One counter record of an sFlow v5 counter sample (for example interface, CPU, memory or disk counters) translated one-to-one into syslog or JSON; a sample with several records gives several messages. |
| 20900 | Original Flow Data | One flow record of an sFlow v5 flow sample (for example the sampled packet header, or extended switch or router data) translated one-to-one into syslog or JSON; a sample with several records gives several messages. |
| 21001 | NetFlow Recorder replay | Recorded NetFlow v5/v9 or IPFIX data record re-sent in the 20001 format (20001 + 1000). |
| 21010 | NetFlow Recorder replay | Recorded Packeteer-2 flow detail record re-sent in the 20010 format (20010 + 1000). |
| 21800 | NetFlow Recorder replay | Counter record of a recorded sFlow counter sample re-sent in the 20800 format (20800 + 1000). |
| 21900 | NetFlow Recorder replay | Flow record of a recorded sFlow flow sample re-sent in the 20900 format (20900 + 1000). |
| 30001 | Original Flow Data | NetFlow v9 or IPFIX options record (exporter metadata such as interface or sampler tables) translated one-to-one into syslog or JSON. |
| 31001 | NetFlow Recorder replay | Recorded NetFlow v9 or IPFIX options record re-sent in the 30001 format (30001 + 1000). |
note
A module that emits more than one message type has an identifier for each. The Auto-discovery Reporter (10701) is the clearest example, sending discovered devices as 20701 and the connections between them as 20702.