draft-claise-netflow-9




    Internet Draft                                                      
    Document: draft-claise-netflow-9-08.txt             Editor B. Claise 
    Category: Informational                                Cisco Systems 
    Expires: October 2004                                     April 2004 
     
    
              Cisco Systems NetFlow Services Export Version 9 
 
    
Status of this Memo 
    
    This document is an Internet-Draft and is in full conformance with 
    all provisions of Section 10 of RFC2026.  
     
    Internet-Drafts are working documents of the Internet Engineering 
    Task Force (IETF), its areas, and its working groups. Note that 
    other groups may also distribute working documents as Internet-
    Drafts. Internet-Drafts are draft documents valid for a maximum of 
    six months and may be updated, replaced, or obsolete by other 
    documents at any time. It is inappropriate to use Internet-Drafts 
    as reference material or to cite them other than as "work in 
    progress."  
     
    The list of current Internet-Drafts can be accessed at 
    http://www.ietf.org/ietf/1id-abstracts.txt  
    The list of Internet-Draft Shadow Directories can be accessed at 
    http://www.ietf.org/shadow.html. 
     
Abstract 
    
    This document specifies the data export format for version 9 of 
    Cisco Systems' NetFlow services, for use by implementations on the 
    network elements and/or matching collector programs. The version 9 
    export format uses templates to provide access to observations 
    of IP packet flows in a flexible and extensible manner. A template 
    defines a collection of fields, with corresponding descriptions of 
    structure and semantics 
 
Conventions used in this document 
    
    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in 
    this document are to be interpreted as described in RFC 2119 
    [RFC2119]. 
    
Table of Contents 
 
   1. Introduction..................................................2 
   2. Terminology...................................................3 
      2.1 Terminology Summary Table.................................5 
   3. NetFlow High-Level Picture on the Exporter....................6 
      3.1 The NetFlow Process on the Exporter.......................6 
      3.2 Flow Expiration...........................................6 
      3.3 Transport Protocol........................................6 
 
 
Claise, et al.              Informational                    [Page 1] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
   4. Packet Layout.................................................7 
   5. Export Packet Format..........................................8 
      5.1 Header Format.............................................8 
      5.2 Template FlowSet Format...................................9 
      5.3 Data FlowSet Format......................................11 
   6. Options......................................................12 
      6.1 Options Template FlowSet Format..........................12 
      6.2 Options Data Record Format...............................14 
   7. Template Management..........................................15 
   8. Field Type Definitions.......................................16 
   9. The Collector Side...........................................22 
   10. Security Considerations.....................................23 
      10.1 Disclosure of Flow Information Data.....................23 
      10.2 Forgery of Flow Records or Template Records.............24 
      10.3 Attacks on the NetFlow Collector........................24 
   11. Examples....................................................24 
      11.1 Packet Header Example...................................25 
      11.2 Template FlowSet Example................................25 
      11.3 Data FlowSet Example....................................26 
      11.4 Options Template FlowSet Example........................27 
      11.5 Data FlowSet with Options Data Records Example..........28 
   12. References..................................................28 
   13. Authors.....................................................29 
   14. Acknowledgments.............................................29 
 
 
1.   Introduction 
 
   Cisco Systems' NetFlow services provide network administrators with 
   access to IP flow information from their data networks. Network 
   elements (routers and switches) gather flow data and export it to 
   collectors. The collected data provides fine-grained metering for 
   highly flexible and detailed resource usage accounting.   
     
   A flow is defined as a unidirectional sequence of packets with some 
   common properties that pass through a network device. These 
   collected flows are exported to an external device, the NetFlow 
   collector. Network flows are highly granular; for example, flow 
   records include details such as IP addresses, packet and byte 
   counts, timestamps, Type of Service (ToS), application ports, input 
   and output interfaces, etc.  
    
   Exported NetFlow data is used for a variety of purposes, including 
   enterprise accounting and departmental chargebacks, ISP billing, 
   data warehousing, network monitoring, capacity planning, application 
   monitoring and profiling, user monitoring and profiling, security 
   analysis, and data mining for marketing purposes. 
     
   This document specifies NetFlow version 9. It describes the 
   implementation specifications both from network element and NetFlow 
   collector points of view. These specifications should help the 
   deployment of NetFlow version 9 across different platforms and 
   different vendors by limiting the interoperability risks. The 
   NetFlow export format version 9 uses templates to provide access to 
   observations of IP packet flows in a flexible and extensible manner. 
 
 
Claise, et al.              Informational                    [Page 2] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
   A template defines a collection of fields, with corresponding 
   descriptions of structure and semantics.  
 
   The template-based approach provides the following advantages: 
    
       - New fields can be added to NetFlow flow records without 
    changing the structure of the export record format. With previous 
    NetFlow versions, adding a new field in the flow record implied a 
    new version of the export protocol format and a new version of the 
    NetFlow collector that supported the parsing of the new export 
    protocol format. 
     
       - Templates that are sent to the NetFlow collector contain the 
    structural information about the exported flow record fields; 
    therefore, if the NetFlow collector does not understand the 
    semantics of new fields, it can still interpret the flow record. 
     
       - Because the template mechanism is flexible, it allows the 
    export of only the required fields from the flows to the NetFlow 
    collector. This helps to reduce the exported flow data volume and 
    provides possible memory savings for the exporter and NetFlow 
    collector. Sending only the required information can also reduce 
    network load. 
 
    The IETF IPFIX Working Group (IP Flow Information eXport) is 
    developing a new protocol, based on the version 9 of Cisco Systems' 
    NetFlow services. Some enhancements in different domains 
    (congestion aware transport protocol, built-in security, etc... ) 
    have been incorporated in this new IPFIX protocol. Refer to the 
    IPFIX Working Group documents for more details. 
    
2.   Terminology 
    
    Various terms used in this document are described in this section. 
    Note that the terminology summary table in Section 2.1 gives a 
    quick overview of the relationships between some of the different 
    terms defined. 
     
    Observation Point 
    An Observation Point is a location in the network where IP packets 
    can be observed; for example, one or a set of interfaces on a 
    network device like a router. Every Observation Point is associated 
    with an Observation Domain.  
     
    Observation Domain 
    The set of Observation Points that is the largest aggregatable set 
    of flow information at the network device with NetFlow services 
    enabled is termed an Observation Domain. For example, a router line 
    card composed of several interfaces with each interface being an 
    Observation Point. 
     
    IP Flow or Flow 

 
 
Claise, et al.              Informational                    [Page 3] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    An IP Flow, also called a Flow, is defined as a set of IP packets 
    passing an Observation Point in the network during a certain time 
    interval. All packets that belong to a particular Flow have a set 
    of common properties derived from the data contained in the packet 
    and from the packet treatment at the Observation Point. 
     
    Flow Record  
    A Flow Record provides information about an IP Flow observed at an 
    Observation Point. In this document, the Flow Data Records are also 
    referred to as NetFlow services data and NetFlow data. 
     
    Exporter 
    A device (for example, a router) with the NetFlow services enabled, 
    the Exporter monitors packets entering an Observation Point and 
    creates Flows from these packets. The information from these Flows 
    is exported in the form of Flow Records to the NetFlow Collector. 
 
    NetFlow Collector 
    The NetFlow Collector receives Flow Records from one or more 
    Exporters. It processes the received Export Packet(s); that is, it 
    parses and stores the Flow Record information. Flow Records can be 
    optionally aggregated before being stored on the hard disk. 
    The NetFlow Collector is also referred to as the Collector in this 
    document. 
 
    Export Packet 
    An Export Packet is a packet originating at the Exporter that 
    carries the Flow Records of this Exporter and whose destination is 
    the NetFlow Collector. 
 
    Packet Header  
    The Packet Header is the first part of an Export Packet. The Packet 
    Header provides basic information about the packet such as the 
    NetFlow version, number of records contained within the packet, and 
    sequence numbering. 
     
    Template Record 
    A Template Record defines the structure and interpretation of 
    fields in a Flow Data Record. 
     
    Flow Data Record 
    A Flow Data Record is a data record that contains values of the 
    Flow parameters corresponding to a Template Record.  
 
    Options Template Record 
    An Options Template Record defines the structure and interpretation 
    of fields in an Options Data Record, including defining the scope 
    within which the Options Data Record is relevant. 
     
    Options Data Record 



 
 
Claise, et al.              Informational                    [Page 4] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    The data record that contains values and scope information of the 
    Flow measurement parameters, corresponding to an Options Template 
    Record. 
 
    FlowSet 
    FlowSet is a generic term for a collection of Flow Records that 
    have a similar structure. In an Export Packet, one or more FlowSets 
    follow the Packet Header. There are three different types of 
    FlowSets: Template FlowSet, Options Template FlowSet, and Data 
    FlowSet. 
     
    Template FlowSet 
    A Template FlowSet is one or more Template Records that have been 
    grouped together in an Export Packet.  
     
    Options Template FlowSet 
    An Options Template FlowSet is one or more Options Template Records 
    that have been grouped together in an Export Packet. 
     
    Data FlowSet 
    A Data FlowSet is one or more records, of the same type, that are 
    grouped together in an Export Packet. Each record is either a Flow 
    Data Record or an Options Data Record previously defined by a 
    Template Record or an Options Template Record. 
 
2.1    Terminology Summary Table 
 
    +------------------+---------------------------------------------+ 
    |                  |                    Contents                 | 
    |                  +--------------------+------------------------+ 
    |     FlowSet      | Template  Record   |    Data Record         | 
    +------------------+--------------------+------------------------+ 
    |                  |                    |  Flow Data Record(s)   | 
    | Data FlowSet     |          /         |          or            | 
    |                  |                    | Options Data Record(s) | 
    +------------------+--------------------+------------------------+ 
    | Template FlowSet | Template Record(s) |           /            | 
    +------------------+--------------------+------------------------+ 
    | Options Template | Options Template   |           /            | 
    | FlowSet          | Record(s)          |                        | 
    +------------------+--------------------+------------------------+ 
     
    A Data FlowSet is composed of an Options Data Record(s) or Flow 
    Data Record(s). No Template Record is included.  
    A Template Record defines the Flow Data Record, and an Options 
    Template Record defines the Options Data Record.  
 
    A Template FlowSet is composed of Template Record(s). No Flow or 
    Options Data Record is included. 
      
    An Options Template FlowSet is composed of Options Template 
    Record(s). No Flow or Options Data Record is included.  

 
 
Claise, et al.              Informational                    [Page 5] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     
3.   NetFlow High-Level Picture on the Exporter 
    
3.1    The NetFlow Process on the Exporter 
     
    The NetFlow process on the Exporter is responsible for the creation 
    of Flows from the observed IP packets. The details of this process 
    are beyond the scope of this document. 
     
3.2    Flow Expiration 
     
    A Flow is considered to be inactive if no packets belonging to the 
    Flow have been observed at the Observation Point for a given 
    timeout. If any packet is seen within the timeout, the flow is 
    considered an active flow. 
    A Flow can be exported under the following conditions: 
     
      1. If the Exporter can detect the end of a Flow. For example, if 
      the FIN or RST bit is detected in a TCP [RFC793] connection, the 
      Flow Record is exported. 
       
      2. If the Flow has been inactive for a certain period of time. 
      This inactivity timeout SHOULD be configurable at the Exporter, 
      with a minimum value of 0 for an immediate expiration. 
       
      3. For long-lasting Flows, the Exporter SHOULD export the Flow 
      Records on a regular basis. This timeout SHOULD be configurable 
      at the Exporter. 
       
      4. If the Exporter experiences internal constraints, a Flow MAY 
      be forced to expire prematurely; for example, counters wrapping 
      or low memory. 
     
3.3    Transport Protocol 
     
    To achieve efficiency in terms of processing at the Exporter while 
    handling high volumes of Export Packets, the NetFlow Export Packets 
    are encapsulated into UDP [RFC768] datagrams for export to the 
    NetFlow Collector. However, NetFlow version 9 has been designed to 
    be transport protocol independent. Hence, it can also operate over 
    congestion-aware protocols such as SCTP [RFC2960].    
     
    Note that the Exporter can export to multiple Collectors, using 
    independent transport protocols. 
     
    UDP [RFC768] is a non congestion-aware protocol, so when deploying 
    NetFlow version 9 in a congestion-sensitive environment, make the 
    connection between Exporter and NetFlow Collector through a 
    dedicated link. This ensures that any burstiness in the NetFlow 
    traffic affects only this dedicated link. When the NetFlow 
    Collector can not be placed within a one-hop distance from the 
    Exporter or when the export path from the Exporter to the NetFlow 
 
 
Claise, et al.              Informational                    [Page 6] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    Collector can not be exclusively used for the NetFlow Export 
    Packets, the export path should be designed so that it can always 
    sustain the maximum burstiness of NetFlow traffic from the 
    Exporter. Note that the congestion can occur on the Exporter in 
    case the export path speed is too low. 
     
4.   Packet Layout 
     
    An Export Packet consists of a Packet Header followed by one or 
    more FlowSets. The FlowSets can be any of the possible three types: 
    Template, Data, or Options Template.  
     
      +--------+-------------------------------------------+ 
      |        | +----------+ +---------+ +----------+     | 
      | Packet | | Template | | Data    | | Options  |     | 
      | Header | | FlowSet  | | FlowSet | | Template | ... | 
      |        | |          | |         | | FlowSet  |     | 
      |        | +----------+ +---------+ +----------+     | 
      +--------+-------------------------------------------+ 
                          Export Packet 
 
    A FlowSet ID is used to distinguish the different types of 
    FlowSets. FlowSet IDs lower than 256 are reserved for special 
    FlowSets, such as the Template FlowSet (ID 0) and the Options 
    Template FlowSet (ID 1). The Data FlowSets have a FlowSet ID 
    greater than 255. 
 
    The format of the Template, Data, and Options Template FlowSets 
    will be discussed later in this document. The Exporter MUST code all 
    binary integers of the Packet Header and the different FlowSets in 
    network byte order (also known as the big-endian byte ordering). 
 
    Following are some examples of export packets: 
     
    1. An Export Packet consisting of interleaved Template, Data, and 
    Options Template FlowSets-A newly created Template is exported as 
    soon as possible. So if there is already an Export Packet with a 
    Data FlowSet that is being prepared for export, the Template and 
    Option FlowSets are also interleaved with this information, subject 
    to availability of space. 
     
    Export Packet: 
    +--------+--------------------------------------------------------+ 
    |        | +----------+ +---------+     +-----------+ +---------+ | 
    | Packet | | Template | | Data    |     | Options   | | Data    | | 
    | Header | | FlowSet  | | FlowSet | ... | Template  | | FlowSet | | 
    |        | |          | |         |     | FlowSet   | |         | | 
    |        | +----------+ +---------+     +-----------+ +---------+ | 
    +--------+--------------------------------------------------------+  
     
    2. An Export Packet consisting entirely of Data FlowSets-After the 
    appropriate Template Records have been defined and transmitted to 

 
 
Claise, et al.              Informational                    [Page 7] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    the NetFlow Collector device, the majority of Export Packets 
    consists solely of Data FlowSets.  
     
    Export Packet: 
    +--------+----------------------------------------------+ 
    |        | +---------+     +---------+      +---------+ | 
    | Packet | | Data    | ... | Data    | ...  | Data    | | 
    | Header | | FlowSet | ... | FlowSet | ...  | FlowSet | | 
    |        | +---------+     +---------+      +---------+ | 
    +--------+----------------------------------------------+   
 
    3. An Export Packet consisting entirely of Template and Options 
    Template FlowSets-The Exporter MAY transmit a packet containing 
    Template and Options Template FlowSets periodically to help ensure 
    that the NetFlow Collector has the correct Template Records and 
    Options Template Records when the corresponding Flow Data records 
    are received.  
     
    Export Packet: 
    +--------+-------------------------------------------------+ 
    |        | +----------+     +----------+      +----------+ | 
    | Packet | | Template |     | Template |      | Options  | | 
    | Header | | FlowSet  | ... | FlowSet  | ...  | Template | | 
    |        | |          |     |          |      | FlowSet  | | 
    |        | +----------+     +----------+      +----------+ | 
    +--------+-------------------------------------------------+ 
    
5.   Export Packet Format 
    
5.1    Header Format 
 
    The Packet Header format in this version is the same as that 
    defined in the previous versions. 
     
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Version Number          |            Count              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           sysUpTime                           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           UNIX Secs                           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                       Sequence Number                         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                        Source ID                              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
    Packet Header Field Descriptions  
     
    Version 


 
 
Claise, et al.              Informational                    [Page 8] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
           Version of Flow Record format exported in this packet. The 
           value of this field is 9 for the current version. 
     
    Count 
           The total number of records in the Export Packet, which is 
           the sum of Options FlowSet records, Template FlowSet 
           records, and Data FlowSet records. 
     
    sysUpTime 
           Time in milliseconds since this device was first booted. 
     
    UNIX Secs 
           Time in seconds  since 0000 UTC 1970, at which the Export 
           Packet leaves the Exporter 
            
    Sequence Number 
           Incremental sequence counter of all Export Packets sent from 
           the current Observation Domain by the Exporter. This value 
           MUST be cumulative, and SHOULD be used by the Collector to 
           identify whether any Export Packets have been missed.  
            
    Source ID 
           A 32-bit value that identifies the Exporter Observation 
           Domain. NetFlow Collectors SHOULD use the combination of the 
           source IP address and the Source ID field to separate 
           different export streams originating from the same Exporter. 
            
5.2    Template FlowSet Format 
    
    One of the essential elements in the NetFlow format is the Template 
    FlowSet. Templates greatly enhance the flexibility of the Flow 
    Record format because they allow the NetFlow Collector to process 
    Flow Records without necessarily knowing the interpretation of all 
    the data in the Flow Record. The format of the Template FlowSet is 
    as follows: 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

 
 
Claise, et al.              Informational                    [Page 9] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       FlowSet ID = 0          |          Length               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Template ID 1           |         Field Count           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Field Type 1           |         Field Length 1        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Field Type 2           |         Field Length 2        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |             ...               |              ...              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Field Type N           |         Field Length N        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Template ID 2           |         Field Count           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Field Type 1           |         Field Length 1        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Field Type 2           |         Field Length 2        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |             ...               |              ...              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Field Type M           |         Field Length M        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |             ...               |              ...              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Template ID K          |         Field Count           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |             ...               |              ...              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
    Template FlowSet Field Descriptions  
            
    FlowSet ID 
           FlowSet ID value of 0 is reserved for the Template FlowSet. 
            
    Length 
           Total length of this FlowSet. Because an individual Template 
           FlowSet MAY contain multiple Template Records, the Length 
           value MUST be used to determine the position of the next 
           FlowSet record, which could be any type of FlowSet. Length 
           is the sum of the lengths of the FlowSet ID, the Length 
           itself, and all Template Records within this FlowSet. 
     
    Template ID 
           Each of the newly generated Template Records is given a 
           unique Template ID. This uniqueness is local to the 
           Observation Domain that generated the Template ID.        
           Template IDs 0-255 are reserved for Template FlowSets, 
           Options FlowSets, and other reserved FlowSets yet to be 


 
 
Claise, et al.              Informational                   [Page 10] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
           created. Template IDs of Data FlowSets are numbered from 256 
           to 65535. 
 
    Field Count 
           Number of fields in this Template Record. Because a Template 
           FlowSet usually contains multiple Template Records, this 
           field allows the Collector to determine the end of the 
           current Template Record and the start of the next. 
  
    Field Type 
           A numeric value that represents the type of the field. Refer 
           to the "Field Type Definitions" section.        
 
    Field Length 
           The length of the corresponding Field Type, in bytes. Refer 
           to the "Field Type Definitions" section.       
 
5.3    Data FlowSet Format 
     
    The format of the Data FlowSet is as follows: 
     
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   FlowSet ID = Template ID    |          Length               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 1 - Field Value 1    |   Record 1 - Field Value 2    | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 1 - Field Value 3    |             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 2 - Field Value 1    |   Record 2 - Field Value 2    | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 2 - Field Value 3    |             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 3 - Field Value 1    |             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |              ...              |            Padding            | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   
     
    Data FlowSet Field Descriptions  
     
    FlowSet ID = Template ID 
           Each Data FlowSet is associated with a FlowSet ID. The 
           FlowSet ID maps to a (previously generated) Template ID. The 
           Collector MUST use the FlowSet ID to find the corresponding 
           Template Record and decode the Flow Records from the 
           FlowSet. 
            
    Length 
           The length of this FlowSet. Length is the sum of the lengths 
           of the FlowSet ID, Length itself, all Flow Records within 
           this FlowSet, and the padding bytes, if any.             

 
 
Claise, et al.              Informational                   [Page 11] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     
    Record N - Field Value M 
           The remainder of the Data FlowSet is a collection of Flow 
           Data Record(s), each containing a set of field values. The 
           Type and Length of the fields have been previously defined 
           in the Template Record referenced by the FlowSet ID or 
           Template ID. 
     
    Padding 
           The Exporter SHOULD insert some padding bytes so that the 
           subsequent FlowSet starts at a 4-byte aligned boundary. It 
           is important to note that the Length field includes the 
           padding bytes. Padding SHOULD be using zeros. 
     
    Interpretation of the Data FlowSet format can be done only if the 
    Template FlowSet corresponding to the Template ID is available at 
    the Collector.    
 
6.   Options 
    
6.1    Options Template FlowSet Format 
     
    The Options Template Record (and its corresponding Options Data 
    Record) is used to supply information about the NetFlow process 
    configuration or NetFlow process specific data, rather than 
    supplying information about IP Flows. 
    For example, the Options Template FlowSet can report the sample 
    rate of a specific interface, if sampling is supported, along with 
    the sampling method used. 
 
    The format of the Options Template FlowSet follows. 
     
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       FlowSet ID = 1          |          Length               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |         Template ID           |      Option Scope Length      | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |        Option Length          |       Scope 1 Field Type      | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     Scope 1 Field Length      |               ...             | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     Scope N Field Length      |      Option 1 Field Type      | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     Option 1 Field Length     |             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     Option M Field Length     |           Padding             | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
    Options Template FlowSet Field Definitions   
     

 
 
Claise, et al.              Informational                   [Page 12] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    FlowSet ID = 1 
           A FlowSet ID value of 1 is reserved for the Options 
           Template. 
     
    Length 
           Total length of this FlowSet. Each Options Template FlowSet 
           MAY contain multiple Options Template Records. Thus, the 
           Length value MUST be used to determine the position of the 
           next FlowSet record, which could be either a Template 
           FlowSet or Data FlowSet.                
           Length is the sum of the lengths of the FlowSet ID, the 
           Length itself, and all Options Template Records within this 
           FlowSet Template ID. 
     
    Template ID 
           Template ID of this Options Template. This value is greater 
           than 255. 
      
    Option Scope Length 
           The length in bytes of any Scope field definition contained 
           in the Options Template Record (The use of "Scope" is 
           described below).  
     
    Option Length 
           The length (in bytes) of any options field definitions 
           contained in this Options Template Record. 
     
    Scope 1 Field Type 
           The relevant portion of the Exporter/NetFlow process to 
           which the Options Template Record refers. 
           Currently defined values are: 
               1 System   
               2 Interface  
               3 Line Card  
               4 Cache  
               5 Template      
           For example, the NetFlow process can be implemented on a 
           per-interface basis, so if the Options Template Record were 
           reporting on how the NetFlow process is configured, the 
           Scope for the report would be 2 (interface). The associated 
           interface ID would then be carried in the associated Options 
           Data FlowSet. The Scope can be limited further by listing 
           multiple scopes that all must match at the same time. Note 
           that the Scope fields always precede the Option fields. 
 
    Scope 1 Field Length 
           The length (in bytes) of the Scope field, as it would appear 
           in an Options Data Record. 
     
    Option 1 Field Type 



 
 
Claise, et al.              Informational                   [Page 13] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
           A numeric value that represents the type of field that would 
           appear in the Options Template Record. Refer to the Field 
           Type Definitions section. 
     
    Option 1 Field Length 
           The length (in bytes) of the Option field. 
     
    Padding 
           The Exporter SHOULD insert some padding bytes so that the 
           subsequent FlowSet starts at a 4-byte aligned boundary. It 
           is important to note that the Length field includes the 
           padding bytes. Padding SHOULD be using zeros. 
     
6.2    Options Data Record Format 
     
    The Options Data Records are sent in Data FlowSets, on a regular 
    basis, but not with every Flow Data Record. How frequently these 
    Options Data Records are exported is configurable. See the 
    "Templates Management" section for more details. 
 
    The format of the Data FlowSet containing Options Data Records 
    follows. 
     
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |    FlowSet ID = Template ID   |          Length               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 1 - Scope 1 Value    |Record 1 - Option Field 1 Value| 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |Record 1 - Option Field 2 Value|             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 2 - Scope 1 Value    |Record 2 - Option Field 1 Value| 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |Record 2 - Option Field 2 Value|             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Record 3 - Scope 1 Value    |Record 3 - Option Field 1 Value| 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |Record 3 - Option Field 2 Value|             ...               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |              ...              |            Padding            | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
    Options Data Records of the Data FlowSet Field Descriptions  
            
    FlowSet ID = Template ID 
           A FlowSet ID precedes each group of Options Data Records 
           within a Data FlowSet. The FlowSet ID maps to a previously 
           generated Template ID corresponding to this Options Template 
           Record. The Collector MUST use the FlowSet ID to map the 
           appropriate type and length to any field values that follow. 
 

 
 
Claise, et al.              Informational                   [Page 14] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    Length 
           The length of this FlowSet.   
           Length is the sum of the lengths of the FlowSet ID, Length 
           itself, all the Options Data Records within this FlowSet, 
           and the padding bytes, if any. 
 
    Record N - Option Field M Value 
           The remainder of the Data FlowSet is a collection of Flow 
           Records, each containing a set of scope and field values. 
           The type and length of the fields were previously defined in 
           the Options Template Record referenced by the FlowSet ID or 
           Template ID. 
     
    Padding 
           The Exporter SHOULD insert some padding bytes so that the 
           subsequent FlowSet starts at a 4-byte aligned boundary. It 
           is important to note that the Length field includes the 
           padding bytes. Padding SHOULD be using zeros. 
     
    The Data FlowSet format can be interpreted only if the Options 
    Template FlowSet corresponding to the Template ID is available at 
    the Collector. 
     
7.   Template Management 
     
    Flow Data records that correspond to a Template Record MAY appear 
    in the same and/or subsequent Export Packets. The Template Record 
    is not necessarily carried in every Export Packet. As such, the 
    NetFlow Collector MUST store the Template Record to interpret the 
    corresponding Flow Data Records that are received in subsequent 
    data packets. 
     
    A NetFlow Collector that receives Export Packets from several 
    Observation Domains from the same Exporter MUST be aware that the 
    uniqueness of the Template ID is not guaranteed across Observation 
    Domains. 
     
    The Template IDs must remain constant for the life of the NetFlow 
    process on the Exporter. If the Exporter or the NetFlow process 
    restarts for any reason, all information about Templates will be 
    lost and new Template IDs will be created. Template IDs are thus 
    not guaranteed to be consistent across an Exporter or NetFlow 
    process restart. 
     
    A newly created Template record is assigned an unused Template ID 
    from the Exporter. If the template configuration is changed, the 
    current Template ID is abandoned and SHOULD NOT be reused until the 
    NetFlow process or Exporter restarts. If a Collector should receive 
    a new definition for an already existing Template ID, it MUST 
    discard the previous template definition and use the new one. 
     


 
 
Claise, et al.              Informational                   [Page 15] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    If a configured Template Record on the Exporter is deleted, and re-
    configured with exactly the same parameters, the same Template ID 
    COULD be reused. 
     
    The Exporter sends the Template FlowSet and Options Template 
    FlowSet under the following conditions: 
     
    1. After a NetFlow process restarts, the Exporter MUST NOT send any 
       Data FlowSet without sending the corresponding Template FlowSet 
       and the required Options Template FlowSet in a previous packet 
       or including it in the same Export Packet. It MAY transmit the 
       Template FlowSet and Options Template FlowSet, without any Data 
       FlowSets, in advance to help ensure that the Collector will have 
       the correct Template Record before receiving the first Flow or 
       Options Data Record. 
     
    2. In the event of configuration changes, the Exporter SHOULD send 
       the new template definitions at an accelerated rate. In such a 
       case, it MAY transmit the changed Template Record(s) and Options 
       Template Record(s), without any data, in advance to help ensure 
       that the Collector will have the correct template information 
       before receiving the first data. 
     
    3. On a regular basis, the Exporter MUST send all the Template 
       Records and Options Template Records to refresh the Collector. 
       Template IDs have a limited lifetime at the Collector and MUST 
       be periodically refreshed. 
       Two approaches are taken to make sure that Templates get 
       refreshed at the Collector: 
          * Every N number of Export Packets. 
          * On a time basis, so every N number of minutes. 
       Both options MUST be configurable by the user on the Exporter. 
       When one of these expiry conditions is met, the Exporter MUST 
       send the Template FlowSet and Options Template. 
        
    4. In the event of a clock configuration change on the Exporter, 
       the Exporter SHOULD send the template definitions at an 
       accelerated rate.  
    
8.   Field Type Definitions 
    
    The following table describes all the field type definitions that 
    an Exporter MAY support. The fields are a selection of Packet 
    Header fields, lookup results (for example, the autonomous system 
    numbers or the subnet masks), and properties of the packet such as 
    length. 
 
    Field Type                Value Length  Description 
                                    (bytes) 
 
                                            Incoming counter with  


 
 
Claise, et al.              Informational                   [Page 16] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
                                            length N x 8 bits for the                
    IN_BYTES                     1    N     number of bytes associated  
                                            with an IP Flow. By default  
                                            N is 4    
 
                                            Incoming counter with  
                                            length N x 8 bits for the 
    IN_PKTS                      2    N     number of packets  
                                            associated with an IP Flow. 
                                            By default N is 4  
 
    FLOWS                        3    N     Number of Flows  
                                            that were aggregated; 
                                            by default N is 4  
 
    PROTOCOL                     4    1     IP protocol byte  
 
                                            Type of service byte 
    TOS                          5    1     setting when entering  
                                            the incoming interface 
 
                                            TCP flags; cumulative of  
    TCP_FLAGS                    6    1     all the TCP flags seen in  
                                            this Flow 
 
                                            TCP/UDP source port number  
    L4_SRC_PORT                  7    2     (for example, FTP, Telnet,  
                                            or equivalent)  
 
    IPV4_SRC_ADDR                8    4     IPv4 source address  
 
                                            The number of contiguous 
                                            bits in the source subnet 
    SRC_MASK                     9    1     mask (i.e. the mask in  
                                            slash notation) 
 
                                            Input interface index. 
    INPUT_SNMP                   10   N     By default N is 2, but  
                                            higher values can be used  
 
                                            TCP/UDP destination port  
    L4_DST_PORT                  11   2     number (for example, FTP,  
                                            Telnet, or equivalent)  
 
    IPV4_DST_ADDR                12   4     IPv4 destination address  
 
                                            The number of contiguous 
                                            bits in the destination  
    DST_MASK                     13   1     subnet mask (i.e. the mask   
                                            in slash notation) 
 
                                            Output interface index. 

 
 
Claise, et al.              Informational                   [Page 17] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    OUTPUT_SNMP                  14   N     By default N is 2, but  
                                            higher values can be used  
 
    IPV4_NEXT_HOP                15   4     IPv4 address of the next- 
                                            hop router    
 
                                            Source BGP autonomous    
    SRC_AS                       16   N     system number where N could  
                                            be 2 or 4. By default N is  
                                            2 
 
                                            Destination BGP autonomous    
    DST_AS                       17   N     system number where N could  
                                            be 2 or 4. By default N is  
                                            2    
 
    BGP_IPV4_NEXT_HOP            18   4     Next-hop router's IP  
                                            address in the BGP domain  
 
                                            IP multicast outgoing  
                                            packet counter with length  
    MUL_DST_PKTS                 19   N     N x 8 bits for packets  
                                            associated with the IP  
                                            Flow. By default N is 4    
 
                                            IP multicast outgoing  
                                            Octet (byte) counter with  
                                            length N x 8 bits for the  
    MUL_DST_BYTES                20   N     number of bytes associated 
                                            with the IP Flow. By  
                                            default N is 4 
 
                                            sysUptime in msec at which  
    LAST_SWITCHED                21   4     the last packet of this  
                                            Flow was switched  
 
                                            sysUptime in msec at which  
    FIRST_SWITCHED               22   4     the first packet of this  
                                            Flow was switched 
 
                                            Outgoing counter with  
                                            length N x 8 bits for the 
    OUT_BYTES                    23   N     number of bytes associated  
                                            with an IP Flow. By  
                                            default N is 4    
 
                                            Outgoing counter with 
                                            length N x 8 bits for the 
    OUT_PKTS                     24   N     number of packets  
                                            associated with an IP Flow.              
                                            By default N is 4     


 
 
Claise, et al.              Informational                   [Page 18] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     
    IPV6_SRC_ADDR                27   16    IPv6 source address  
 
    IPV6_DST_ADDR                28   16    IPv6 destination address  
 
    IPV6_SRC_MASK                29   1     Length of the IPv6 source 
                                            mask in contiguous bits 
 
                                            Length of the IPv6  
    IPV6_DST_MASK                30   1     destination mask in 
                                            contiguous bits 
 
    IPV6_FLOW_LABEL              31   3     IPv6 flow label as per  
                                            RFC 2460 definition  
  
                                            Internet Control Message 
    ICMP_TYPE                    32   2     Protocol (ICMP) packet  
                                            type; reported as  
                                            ICMP Type * 256 + ICMP code 
 
    MUL_IGMP_TYPE                33   1     Internet Group Management  
                                            Protocol (IGMP) packet type 
                                 
                                            When using sampled NetFlow,  
                                            the rate at which packets  
    SAMPLING_INTERVAL            34   4     are sampled; for example, a               
                                            value of 100 indicates that  
                                            one of every hundred  
                                            packets is sampled  
        
                                            For sampled NetFlow  
                                            platform-wide:  
    SAMPLING_ALGORITHM           35   1     0x01 deterministic sampling 
                                            0x02 random sampling  
                                            Use in connection with               
                                            SAMPLING_INTERVAL 
 
                                            Timeout value (in seconds)                
    FLOW_ACTIVE_TIMEOUT          36   2     for active flow entries 
                                            in the NetFlow cache 
 
                                            Timeout value (in seconds) 
    FLOW_INACTIVE_TIMEOUT        37   2     for inactive Flow entries 
                                            in the NetFlow cache 
 
                                            Type of Flow switching  
    ENGINE_TYPE                  38   1     engine (route processor,  
                                            linecard, etc...) 
 
    ENGINE_ID                    39   1     ID number of the Flow  
                                            switching engine 
 

 
 
Claise, et al.              Informational                   [Page 19] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
                                            Counter with length   
                                            N x 8 bits for the number  
    TOTAL_BYTES_EXP              40   N     of bytes exported by the  
                                            Observation Domain. By  
                                            default N is 4     
 
                                            Counter with length  
                                            N x 8 bits for the number   
    TOTAL_PKTS_EXP               41   N     of packets exported by the 
                                            Observation Domain. By  
                                            default N is 4    
 
                                            Counter with length  
                                            N x 8 bits for the number  
    TOTAL_FLOWS_EXP              42   N     of Flows exported by the  
                                            Observation Domain. By  
                                            default N is 4      
 
    MPLS_TOP_LABEL_TYPE          46   1     MPLS Top Label Type:   
                                            0x00 UNKNOWN 
                                            0x01 TE-MIDPT 
                                            0x02 ATOM 
                                            0x03 VPN 
                                            0x04 BGP 
                                            0x05 LDP 
                                     
                                            Forwarding Equivalent Class 
    MPLS_TOP_LABEL_IP_ADDR       47   4     corresponding to the MPLS 
                                            Top Label 
 
    FLOW_SAMPLER_ID              48   1     Identifier shown  
                                            in "show flow-sampler" 

                                            The type of algorithm used  
                                            for sampling data:  
    FLOW_SAMPLER_MODE            49   1     0x02 random sampling 
                                            Use in connection with 
                                            FLOW_SAMPLER_MODE 

                                            Packet interval at which to 
    FLOW_SAMPLER_RANDOM_INTERVAL 50   4     sample. Use in connection  
                                            with FLOW_SAMPLER_MODE 
 
                                            Type of Service byte 
    DST_TOS                      55   1     setting when exiting  
                                            outgoing interface 
 
    SRC_MAC                      56   6     Source MAC Address  
 
    DST_MAC                      57   6     Destination MAC Address 
  
                                            Virtual LAN identifier 
 
 
Claise, et al.              Informational                   [Page 20] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    SRC_VLAN                     58   2     associated with ingress  
                                            interface 
 
                                            Virtual LAN identifier  
    DST_VLAN                     59   2     associated with egress  
                                            interface 
 
                                            Internet Protocol Version   
                                            Set to 4 for IPv4, set to 6 
    IP_PROTOCOL_VERSION          60   1     for IPv6. If not present in  
                                            the template, then version  
                                            4 is assumed 
 
                                            Flow direction:   
    DIRECTION                    61   1     0 - ingress flow 
                                            1 – egress flow 
 
    IPV6_NEXT_HOP                62   16    IPv6 address of the  
                                            next-hop router    
 
    BPG_IPV6_NEXT_HOP            63   16    Next-hop router in the BGP 
                                            domain 
 
                                            Bit-encoded field  
    IPV6_OPTION_HEADERS          64   4     identifying IPv6 option  
                                            headers found in the flow 
 
    MPLS_LABEL_1                 70   3     MPLS label at position 1 in  
                                            the stack  
 
    MPLS_LABEL_2                 71   3     MPLS label at position 2 in  
                                            the stack 
 
    MPLS_LABEL_3                 72   3     MPLS label at position 3 in  
                                            the stack 
 
    MPLS_LABEL_4                 73   3     MPLS label at position 4 in  
                                            the stack 
 
    MPLS_LABEL_5                 74   3     MPLS label at position 5 in  
                                            the stack 
 
    MPLS_LABEL_6                 75   3     MPLS label at position 6 in  
                                            the stack 
 
    MPLS_LABEL_7                 76   3     MPLS label at position 7 in  
                                            the stack 
 
    MPLS_LABEL_8                 77   3     MPLS label at position 8 in  
                                            the stack 
  
    MPLS_LABEL_9                 78   3     MPLS label at position 9 in  

 
 
Claise, et al.              Informational                   [Page 21] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
                                            the stack 
 
    MPLS_LABEL_10                79   3     MPLS label at position 10  
                                            in the stack 
     
    The value field is a numeric identifier for the field type. 
    The following value fields are reserved for proprietary field 
    types: 25, 26, 43 to 45, 51 to 54, and 65 to 69. 
     
    When extensibility is required, the new field types will be added  
    to the list. The new field types have to be updated on the Exporter 
    and Collector but the NetFlow export format would remain unchanged. 
    Refer to the latest documentation at http://www.cisco.com for the 
    newly updated list. 
     
    In some cases the size of a field type is fixed by definition, for 
    example PROTOCOL, or IPV4_SRC_ADDR. However in other cases they are 
    defined as a variant type. This improves the memory efficiency in 
    the collector and reduces the network bandwidth requirement between  
    the Exporter and the Collector. As an example, in the case 
    IN_BYTES, on an access router it might be sufficient to use a 32 
    bit counter (N = 4), whilst on a core router a 64 bit counter (N = 
    8) would be required.  
     
    All counters and counter-like objects are unsigned integers of  
    size N * 8 bits. 
     
9.   The Collector Side 
     
    The Collector receives Template Records from the Exporter, normally 
    before receiving Flow Data Records (or Options Data Records). The 
    Flow Data Records (or Options Data Records) can then be decoded and 
    stored locally on the devices. If the Template Records have not 
    been received at the time Flow Data Records (or Options Data 
    Records) are received, the Collector SHOULD store the Flow Data 
    Records (or Options Data Records) and decode them after the 
    Template Records are received. A Collector device MUST NOT assume 
    that the Data FlowSet and the associated Template FlowSet (or 
    Options Template FlowSet) are exported in the same Export Packet. 
     
    The Collector MUST NOT assume that one and only one Template 
    FlowSet is present in an Export Packet.  
     
    The life of a template at the Collector is limited to a fixed 
    refresh timeout. Templates not refreshed from the Exporter within 
    the timeout are expired at the Collector. The Collector MUST NOT 
    attempt to decode the Flow or Options Data Records with an expired 
    Template. At any given time the Collector SHOULD maintain the 
    following for all the current Template Records and Options Template 
    Records: Exporter, Observation Domain, Template ID, Template 
    Definition, Last Received. 


 
 
Claise, et al.              Informational                   [Page 22] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    Note that the Observation Domain is identified by the Source ID 
    field from the Export Packet. 
    In the event of a clock configuration change on the Exporter, the 
    Collector SHOULD discard all Template Records and Options Template 
    Records associated with that Exporter, in order for Collector to 
    learn the new set of fields: Exporter, Observation Domain, Template 
    ID, Template Definition, Last Received. 
     
    Template IDs are unique per Exporter and per Observation Domain.  
 
    If the Collector receives a new Template Record (for example, in 
    the case of an Exporter restart) it MUST immediately override the 
    existing Template Record. 
     
    Finally, note that the Collector MUST accept padding in the Data 
    FlowSet and Options Template FlowSet, which means for the Flow Data 
    Records, the Options Data Records and the Template Records. 
    Refer to the terminology summary table in Section 2.1. 
     
10.    Security Considerations 
     
    The NetFlow version 9 protocol was designed with the expectation 
    that the Exporter and Collector would remain within a single 
    private network. However the NetFlow version 9 protocol might be 
    used to transport Flow Records over the public Internet which 
    exposes the Flow Records to a number of security risks. For example 
    an attacker might capture, modify or insert Export Packets. There 
    is therefore a risk that IP Flow information might be captured or 
    forged, or that attacks might be directed at the NetFlow Collector. 
     
    The designers of NetFlow Version 9 did not impose any 
    confidentiality, integrity or authentication requirements on the 
    protocol because this reduced the efficiency of the implementation 
    and it was believed at the time that the majority of deployments 
    would confine the Flow Records to private networks, with the 
    Collector(s) and Exporter(s) in close proximity. 
     
    The IPFIX protocol (IP Flow Information eXport), which has chosen 
    the NetFlow version 9 protocol as the base protocol, addresses the 
    security considerations discussed in this section. See the security 
    section of IPFIX requirement draft [IPFIX-REQ] for more 
    information. 
     
10.1     Disclosure of Flow Information Data 
     
    Because the NetFlow Version 9 Export Packets are not encrypted, the 
    observation of Flow Records can give an attacker information about 
    the active flows in the network, communication endpoints and 
    traffic patterns. This information can be used both to spy on user 
    behavior and to plan and conceal future attacks. 
     


 
 
Claise, et al.              Informational                   [Page 23] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    The information that an attacker could derive from the interception 
    of Flow Records depends on the Flow definition. For example, a Flow 
    Record containing the source and destination IP addresses might 
    reveal privacy sensitive information regarding the end user's 
    activities, whilst a Flow Record only containing the source and 
    destination IP network would be less revealing. 
     
10.2     Forgery of Flow Records or Template Records 
     
    If Flow Records are used in accounting and/or security 
    applications, there may be a strong incentive to forge exported 
    Flow Records (for example to defraud the service provider, or to 
    prevent the detection of an attack). This can be done either by 
    altering the Flow Records on the path between the Observer and the 
    Collector, or by injecting forged Flow Records that pretend to be 
    originated by the Exporter. 
     
    An attacker could forge Templates and/or Options Templates and 
    thereby try to confuse the NetFlow Collector, rendering it unable 
    to decode the Export Packets. 
     
10.3     Attacks on the NetFlow Collector 
     
    Denial of service attacks on the NetFlow Collector can consume so 
    many resources from the machine that, the Collector is unable to 
    capture or decode some NetFlow Export Packets. Such hazards are not 
    explicitly addressed by the NetFlow Version 9 protocol, although 
    the normal methods used to protect a server from a DoS attack will 
    mitigate the problem. 
     
11.    Examples 
      
    Let us consider the example of an Export Packet composed of a 
    Template FlowSet, a Data FlowSet (which contains three Flow Data 
    Records), an Options Template FlowSet, and a Data FlowSet (which 
    contains two Options Data Records). 
     
    Export Packet: 
     
     
     
     
     
     
     
     
     
     
     
     
     
     

 
 
Claise, et al.              Informational                   [Page 24] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
    +--------+---------------------------------------------. . . 
    |        | +--------------+ +-----------------------+  
    | Packet | | Template     | | Data                  |  
    | Header | | FlowSet      | | FlowSet               |   . . . 
    |        | | (1 Template) | | (3 Flow Data Records) |  
    |        | +--------------+ +-----------------------+  
    +--------+---------------------------------------------. . . 
 
        . . .+-------------------------------------------------+ 
             +------------------+ +--------------------------+ | 
             | Options          | | Data                     | | 
        . . .| Template FlowSet | | FlowSet                  | | 
             | (1 Template)     | | (2 Options Data Records) | | 
             +------------------+ +--------------------------+ | 
        . . .--------------------------------------------------+ 
    
11.1     Packet Header Example 
     
    The Packet Header is composed of: 
     
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     Version = 9               |          Count = 7            | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           sysUpTime                           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           UNIX Secs                           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                       Sequence Number                         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           Source ID                           | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
11.2     Template FlowSet Example 
     
    We want to report the following Field Types: 
    - The source IP address (IPv4), so the length is 4 
    - The destination IP address (IPv4), so the length is 4 
    - The next-hop IP address (IPv4), so the length is 4 
    - The number of bytes of the Flow 
    - The number of packets of the Flow 
     
    Therefore, the Template FlowSet is composed of the following: 
     
     
     
     
     
     
     
     

 
 
Claise, et al.              Informational                   [Page 25] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       FlowSet ID = 0          |      Length = 28 bytes        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Template ID 256         |       Field Count = 5         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     IP_SRC_ADDR = 8           |       Field Length = 4        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     IP_DST_ADDR = 12          |       Field Length = 4        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |     IP_NEXT_HOP = 15          |       Field Length = 4        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       IN_PKTS = 2             |       Field Length = 4        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       IN_BYTES = 1            |       Field Length = 4        | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
11.3     Data FlowSet Example 
 
    In this example, we report the following three Flow Records: 
     
    Src IP addr. | Dst IP addr. | Next Hop addr. | Packet | Bytes  
                 |              |                | Number | Number 
    --------------------------------------------------------------- 
    198.168.1.12 | 10.5.12.254  | 192.168.1.1    | 5009   | 5344385 
    192.168.1.27 | 10.5.12.23   | 192.168.1.1    | 748    | 388934 
    192.168.1.56 | 10.5.12.65   | 192.168.1.1    | 5      | 6534 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

 
 
Claise, et al.              Informational                   [Page 26] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       FlowSet ID = 256        |          Length = 64          | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                          198.168.1.12                         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                          10.5.12.254                          | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                          192.168.1.1                          | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                             5009                              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                            5344385                            |  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                          192.168.1.27                         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           10.5.12.23                          |  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                          192.168.1.1                          | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                              748                              | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                             388934                            | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                          192.168.1.56                         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           10.5.12.65                          | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                           192.168.1.1                         | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                               5                               | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |                              6534                             | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
    Note that padding was not necessary in this example. 
    
11.4     Options Template FlowSet Example 
     
    Per line card (the Exporter is composed of two line cards), we want 
    to report the following Field Types: 
    - Total number of Export Packets 
    - Total number of exported Flows  
     
    The format of the Options Template FlowSet is as follows: 
 
 
 
 
 
 

 
 
Claise, et al.              Informational                   [Page 27] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     0                   1                   2                   3 
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       FlowSet ID = 1          |          Length = 24          | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Template ID 257         |    Option Scope Length = 4    | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Option Length = 8       |  Scope 1 Field Type = 3       | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |   Scope 1 Field Length = 2    |   TOTAL_EXP_PKTS_SENT = 41    | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Field Length = 2        |     TOTAL_FLOWS_EXP = 42      | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
    |       Field Length = 2        |           Padding             | 
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
     
11.5     Data FlowSet with Options Data Records Example 
     
    In this example, we report the following two records: 
     
    Line Card ID | Export Packet| Export Flow  
    ------------------------------------------ 
    Line Card 1  | 345          | 10201     
    Line Card 2  | 690          | 20402 
     
     0                   1                   2                   3  
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  
    |    FlowSet ID = 257           |         Length = 16           |  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  
    |             1                 |             345               |  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  
    |           10201               |              2                |  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  
    |            690                |            20402              |  
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  
     
12.    References 
    
    [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate 
    Requirement Levels" RFC 2119, March 1997 
     
    [RFC768]  Postel, J., "User Datagram Protocol" RFC 768, August 1980 
     
    [RFC793]  "TRANSMISSION CONTROL PROTOCOL DARPA INTERNET PROGRAM 
    PROTOCOL SPECIFICATION" RFC 793, September 1981 
     
    [RFC2960]  Stewart, R. et al, "Stream Control Transmission 
    Protocol" RFC 2960, October 2000 
     
    [RFC2401]  Kent, S. Atkinson, R. "Security Architecture for the 
    Internet Protocol" RFC 2960, November 1998 

 
 
Claise, et al.              Informational                   [Page 28] 
   Cisco Systems NetFlow Services Export Version 9          April 2004 
 
 
     
    [IPFIX-REQ] Quittek, J, Zseby, T, Claise, B, Zander, S,  
    "Requirements for IP Flow Information Export"  
    draft-ietf-ipfix-reqs-15.txt, January 2004 
 
13.    Authors 
    
    This document was jointly written by Vamsidhar Valluri, Martin 
    Djernaes, Ganesh Sadasivan, and Benoit Claise. 
 
14.    Acknowledgments 
    
   I would like to thank Pritam Shah, Paul Kohler, Dmitri Bouianovski 
   and Stewart Bryant for their valuable technical feedback. 
 
Authors Addresses 
 
    Benoit Claise 
    Cisco Systems 
    De Kleetlaan 6a b1 
    1831 Diegem 
    Belgium 
    Phone: +32 2 704 5622 
    E-mail: bclaise@cisco.com 
     
    Ganesh Sadasivan 
    Cisco Systems, Inc. 
    3750 Cisco Way 
    San Jose, CA 95134 
    USA 
    Phone:  +1 408 527-0251 
    E-mail:  gsadasiv@cisco.com 
     
    Vamsi Valluri 
    Cisco Systems, Inc. 
    510 McCarthy Blvd. 
    San Jose, CA 95035 
    USA 
    Phone:  +1 408 525-1835 
    E-mail:  vvalluri@cisco.com 
     
    Martin Djernaes 
    Cisco Systems, Inc. 
    510 McCarthy Blvd. 
    San Jose, CA 95035 
    USA 
    Phone:  +1 408 853-1676 
    E-mail:  djernaes@cisco.com 





 
 
Claise, et al.              Informational                   [Page 29]