This is an old revision of the document!
3 Configuring export in IPFIX (Netflow 10)
NetFlow control can be changed by next setting:
netflow_full_collector_type=1
here:
- "0" - export NetFlow5 ( default ).
- "1" - export UDP IPFIX.
- "2" - export TCP IPFIX.
| Export template for IPFIX format (Netflow v10) | |||||
|---|---|---|---|---|---|
| № | Size | Type | IANA | Description | Note |
| 1 | 8 | int64 | 0 | OCTET_DELTA_COUNT | NetFlow v9 analogy IN_BYTES |
| 2 | 8 | int64 | 0 | PACKET_DELTA_COUNT | NetFlow v9 analogy IN_PKTS |
| 4 | 1 | int8 | 0 | PROTOCOL_IDENTIFIER | NetFlow v9 analogy PROTOCOL |
| 5 | 1 | int8 | 0 | IP_CLASS_OF_SERVICE | NetFlow v9 analogy TOS |
| 7 | 2 | int16 | 0 | SOURCE_TRANSPORT_PORT | NetFlow v9 analogy L4_SRC_PORT |
| 8 | 4 | int32 | 0 | SOURCE_IPV4_ADDRESS | NetFlow v9 analogy IPV4_SRC_ADDR |
| 11 | 2 | int16 | 0 | DESTINATION_TRANSPORT_PORT | NetFlow v9 analogy L4_DST_PORT |
| 12 | 4 | int32 | 0 | DESTINATION_IPV4_ADDRESS | NetFlow v9 analogy IPV4_DST_ADDR |
| 16 | 4 | int32 | 0 | BGP_SOURCE_AS_NUMBER | NetFlow v9 analogy SRC_AS |
| 17 | 4 | int32 | 0 | BGP_DESTINATION_AS_NUMBER | NetFlow v9 analogy DST_AS |
| 152 | 8 | int64 | 0 | FLOW_START_MILLISECOND | |
| 153 | 8 | int64 | 0 | FLOW_END_MILLISECOND | |
| 10 | 2 | int16 | 0 | INPUT_SNMP | NetFlow v9 analogy ingressInterface |
| 14 | 2 | int16 | 0 | OUTPUT_SNMP | NetFlow v9 analogy egressInterface |
| 60 | 1 | int8 | 0 | IP_VERSION | NetFlow v9 analogy IP_PROTOCOL_VERSION |
| 2000 | 8 | int64 | 43823 | SESSION_ID | |
| 2001 | - | string | 43823 | HTTP_HOST or CN_HTTPS | |
| 2002 | 2 | int16 | 43823 | DPI_PROTOCOL | |
| 2003 | - | string | 43823 | LOGIN | Radius UserName |
| 225 | 4 | int32 | 0 | POST_NAT_SOURCE_IPV4_ADDRESS | |
| 227 | 2 | int16 | 0 | POST_NAT_SOURCE_TRANSPORT_PORT | |
| 2010 | 2 | int16 | 43823 | FRGMT_DELTA_PACKS | Fragmented packets delta. Used in QoEStor. |
| 2011 | 2 | int16 | 43823 | REPEAT_DELTA_PACK | Retransmissions delta. Used in QoEStor. |
| 2012 | 4 | int32 | 43823 | PACKET_DELIVER_TIME | Latency (RTT/2), ms (RTT = Round Trip Time). Used in QoEStor. |
| 2016 | 2 | int16 | 43823 | BRIDGE_CHANNEL_NUM | Channel number (vchannel) or bridge. If vchannel is configured in the DPI configuration, then the channel number will be transmitted, otherwise the bridge number. Used in QoEStor. |
The export pattern in IPFIX format for IPv6 differs only in the absence of the fields: sourceIPv4Address, destinationIPv4Address, postNATsourceIPv4Address, postNAPTsourceTransportPort, and the presence of the following fields:
| № | Num of bytes | Data type | IANA | Description | Note |
|---|---|---|---|---|---|
| 27 | 16 | int128 | 0 | SOURCE_IPV6_ADDRESS | NetFlow v9 analogy IPV6_SRC_ADDR |
| 28 | 16 | int128 | 0 | DESTINATION_IPV6_ADDRESS | NetFlow v9 analogy IPV6_DST_ADDR |
To collect, process and store IPFIX we suggest using the QoE Store statistics module and DPIUI2 graphical interface.
For extended information in IPFIX format can be used any universal IPFIX collector, for instance - CESNET ipfixcol or our utility IPFIX Receiver