Log Types: NetflowV5Log

Log Types: NetflowV5Log

Overview

Netflow is a protocol used for exporting traffic flow information through UDP datagrams. Parsing Netflow v5 is supported by Reflector.

Reflector generates an event per flow record. Each Netflow packet may contain up to 30 flow records.

Fields

Name

Description

Name

Description

DATE

Date the Netflow packet is received by Reflector, in the format YYYY-MM-DD

TIME

Time the Netflow packet is received by Reflector, in the format HH:MM:SS

SYSTEM

The source system

TABLE

Constant Value: NetflowV5Log

DATAGRAM_SYSUPTIME

Current time in milliseconds since the export device booted

DATAGRAM_DATE

Date indicated by the Netflow packet, in the format YYYY-MM-DD

DATAGRAM_TIME

Time indicated by the Netflow packet, in the format HH:MM:SS

FLOW_SEQ

Sequence Number of the flow record

ENGINE_TYPE

Type of flow-switching engine

ENGINE_ID

Slot number of the flow-switching engine

SAMPLING_MODE

Sampling Mode

SAMPLING_INTERVAL

Sampling Interval

SRC_IP

Source IP address

DST_IP

Destination IP address

NEXT_HOP_IP

IP address of next hop router

SNMP_INDEX_INPUT

SNMP index of input interface

SNMP_INDEX_OUTPUT

SNMP index of output interface

PACKETS

Packets in the flow

BYTES

Total number of Layer 3 bytes in the packets of the flow

FIRST_SYSUPTIME

SysUptime at start of flow

LAST_SYSUPTIME

SysUptime at the time the last packet of the flow was received

START_TIME

Estimated start time of the flow in RFC3343 format. Calculated by DATAGRAM_DATETIME - (DATAGRAM_SYSUPTIME - FIRST_SYSUPTIME)

END_TIME

Estimated end time of the flow in RFC3343 format. Calculated by DATAGRAM_DATETIME - (DATAGRAM_SYSUPTIME - LAST_SYSUPTIME)

SRC_PORT

TCP/UDP source port number or equivalent

DST_PORT

TCP/UDP destination port number or equivalent

TCP_FLAGS

Cumulative OR of TCP flags

PROTOCOL

IP protocol type (for example, TCP = 6; UDP = 17)

TOS

IP type of service (ToS)

SRC_AS

Autonomous system number of the source, either origin or peer

DST_AS

Autonomous system number of the destination, either origin or peer

SRC_MASK

Source address prefix mask bits

DST_MASK

Destination address prefix mask bits

Notes

NetFlow Export Datagram Format Accessed Feb. 3, 2025 UTC+09:30