Skip to main content
Version: Next

NetFlow/IPFIX Data Records (20001)

Description

Original Flow Data Converter for data records translates NetFlow v5, v9, and IPFIX (including Cisco ASA NSEL, Cisco High-Speed Logging (HSL), Cisco Application Visibility and Control (AVC), and Palo Alto Networks NetFlow) records into syslog messages 1-to-1. Each NetFlow record is converted into a syslog message in the “key=value” format. The table below shows a partial list of key values.

Field TypeValueLength (bytes)DescriptionKey
IN_BYTES1N (default is 4)Incoming counter with length N x 8 bits for number of bytes associated with an IP Flow.bytes_in
IN_PKTS2N (default is 4)Incoming counter with length N x 8 bits for the number of packets associated with an IP Flowpackets_in
FLOWS3NNumber of flows that were aggregated; default for N is 4flow_count
PROTOCOL41IP protocol byteprotocol
SRC_TOS51Type of Service byte setting when entering incoming interfacesrc_tos
TCP_FLAGS61Cumulative OR of all the TCP flags seen for this flowtcp_flag
L4_SRC_PORT72TCP/UDP source port number i.e.: FTP, Telnet, or equivalentsrc_port
IPV4_SRC_ADDR84IPv4 source addresssrc_ip
SRC_MASK91The number of contiguous bits in the source address subnet mask i.e.: the submask in slash notationsrc_mask
INPUT_SNMP10NInput interface index; default for N is 2 but higher values could be usedinput_snmp
L4_DST_PORT112TCP/UDP destination port number i.e.: FTP, Telnet, or equivalentdest_port
IPV4_DST_ADDR124IPv4 destination addressdest_ip
DST_MASK131The number of contiguous bits in the destination address subnet mask i.e.: the submask in slash notationdest_mask
OUTPUT_SNMP14NOutput interface index; default for N is 2 but higher values could be usedoutput_snmp
IPV4_NEXT_HOP154IPv4 address of next-hop routernext_hop
SRC_AS16N (default is 2)Source BGP autonomous system number where N could be 2 or 4src_asn
DST_AS17N (default is 2)Destination BGP autonomous system number where N could be 2 or 4dest_asn
BGP_IPV4_NEXT_HOP184Next-hop router's IP in the BGP domainbgp_next_hop
MUL_DST_PKTS19N (default is 4)IP multicast outgoing packet counter with length N x 8 bits for packets associated with the IP Flowmul_dest_packets
MUL_DST_BYTES20N (default is 4)IP multicast outgoing byte counter with length N x 8 bits for bytes associated with the IP Flowmul_dest_bytes
LAST_SWITCHED214System uptime at which the last packet of this flow was switchedlast_time
FIRST_SWITCHED224System uptime at which the first packet of this flow was switchedfirst_time
OUT_BYTES23N (default is 4)Outgoing counter with length N x 8 bits for the number of bytes associated with an IP Flowbytes_out
OUT_PKTS24N (default is 4)Outgoing counter with length N x 8 bits for the number of packets associated with an IP Flow.packets_out

Input

NetFlow v5, NetFlow v9, Cisco ASA NSEL, Cisco HSL, Cisco AVC, Palo Alto Networks.

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier"nfc_id=20001"
...[Varies depending on the template]...