Skip to main content
Version: Next

sFlow Data (20800, 20900)


sFlow Data Converter translates sFlow records into syslog messages 1-to-1. Each sFlow record is converted into a syslog message in the “key=value” format. sFlow Counter syslogs are identified by nfc_id=20800. sFlow Data records have nfc_id=20900. The following configuration is available in NetFlow Optimizer:

  • Include sFlow Counter records (default is not to include)
  • Included headerLen and headerBytes fields in the syslog output (default is not to include)

Additional information on sFlow specifications could be found here:

See Appendix 2 for details on what sFlow structures are supported in the current release.

The table below shows a partial list of key values.



Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier“nfc_id=20800” or “nfc_id=20900”
entEnterprise ID<number>
exp_ipsFlow exporter IP address<IPv4_address>
samplingRateSampling rate<number>
inputPortSNMP index of input interface<number>
outputPortSNMP index of output interface<number>
[headerLen](1)Length of Header included in the sample<number>
[headerBytes](1)Header bytes included in the sample<string>
srcIPSource IP address<IPv4_address>
dstIPDestination IP address<IPv4_address>
IPProtocolTransport Protocol ( TCP = 6, UDP = 17)<number>
IPTOSIP type of service<number>
TCPSrcPortSource port number<number>
TCPDstPortDestination port number<number>
[Varies depending on the record type]

(1) This field is optional, and should be enabled in NetFlow Optimizer to be included in the syslog.