Log Types: NetflowV5Log
Overview
Netflow is a protocol used for exporting traffic flow information through UDP datagrams. Parsing Netflow v5 is supported by Reflector.
Reflector generates an event per flow record. Each Netflow packet may contain up to 30 flow records.
Fields
Name | Description |
|---|---|
DATE | Date the Netflow packet is received by Reflector, in the format YYYY-MM-DD |
TIME | Time the Netflow packet is received by Reflector, in the format HH:MM:SS |
SYSTEM | The source system |
TABLE | Constant Value: NetflowV5Log |
DATAGRAM_SYSUPTIME | Current time in milliseconds since the export device booted |
DATAGRAM_DATE | Date indicated by the Netflow packet, in the format YYYY-MM-DD |
DATAGRAM_TIME | Time indicated by the Netflow packet, in the format HH:MM:SS |
FLOW_SEQ | Sequence Number of the flow record |
ENGINE_TYPE | Type of flow-switching engine |
ENGINE_ID | Slot number of the flow-switching engine |
SAMPLING_MODE | Sampling Mode |
SAMPLING_INTERVAL | Sampling Interval |
SRC_IP | Source IP address |
DST_IP | Destination IP address |
NEXT_HOP_IP | IP address of next hop router |
SNMP_INDEX_INPUT | SNMP index of input interface |
SNMP_INDEX_OUTPUT | SNMP index of output interface |
PACKETS | Packets in the flow |
BYTES | Total number of Layer 3 bytes in the packets of the flow |
FIRST_SYSUPTIME | SysUptime at start of flow |
LAST_SYSUPTIME | SysUptime at the time the last packet of the flow was received |
START_TIME | Estimated start time of the flow in RFC3343 format. Calculated by DATAGRAM_DATETIME - (DATAGRAM_SYSUPTIME - FIRST_SYSUPTIME) |
END_TIME | Estimated end time of the flow in RFC3343 format. Calculated by DATAGRAM_DATETIME - (DATAGRAM_SYSUPTIME - LAST_SYSUPTIME) |
SRC_PORT | TCP/UDP source port number or equivalent |
DST_PORT | TCP/UDP destination port number or equivalent |
TCP_FLAGS | Cumulative OR of TCP flags |
PROTOCOL | IP protocol type (for example, TCP = 6; UDP = 17) |
TOS | IP type of service (ToS) |
SRC_AS | Autonomous system number of the source, either origin or peer |
DST_AS | Autonomous system number of the destination, either origin or peer |
SRC_MASK | Source address prefix mask bits |
DST_MASK | Destination address prefix mask bits |
Notes
NetFlow Export Datagram Format Accessed Feb. 3, 2025 UTC+09:30