Supported Information Elements
NetFlow connector only supports the following information elements in NetFlow v9 and IPFIX protocols. For more information, see IP Flow Information Export (IPFIX) Entities.
|
Element ID |
Name |
Description |
Mandatory |
|---|---|---|---|
|
1 |
octetDeltaCount |
Number of octets in incoming packets for this flow. |
Yes |
|
2 |
packetDeltaCount |
Number of incoming packets for this flow. |
Yes |
|
4 |
protocolIdentifier |
The value of the protocol number in the IP packet header. |
Yes |
|
6 |
tcpControlBits |
TCP control bits observed for packets of this flow. The agent handles FIN, SYN, RST, PSH, ACK, and URG flags. |
No |
|
7 |
sourceTransportPort |
The source port identifier in the transport header. |
Yes |
|
8 |
sourceIPv4Address |
The IPv4 source address in the IP packet header. |
Either 8 or 27 |
|
11 |
destinationTransportPort |
The destination port identifier in the transport header. |
Yes |
|
12 |
destinationIPv4Address |
The IPv4 destination address in the IP packet header. |
Either 12 or 28 |
|
27 |
sourceIPv6Address |
The IPv6 source address in the IP packet header. |
Either 8 or 27 |
|
28 |
destinationIPv6Address |
The IPv6 destination address in the IP packet header. |
Either 12 or 28 |
|
150 |
flowStartSeconds |
The absolute timestamp of the first packet of the flow (in seconds). |
No |
|
151 |
flowEndSeconds |
The absolute timestamp of the last packet of the flow (in seconds). |
No |
|
152 |
flowStartMilliseconds |
The absolute timestamp of the first packet of the flow (in milliseconds). |
No |
|
153 |
flowEndMilliseconds |
The absolute timestamp of the last packet of the flow (in milliseconds). |
No |
|
154 |
flowStartMicroseconds |
The absolute timestamp of the first packet of the flow (in microseconds). |
No |
|
155 |
flowEndMicroseconds |
The absolute timestamp of the last packet of the flow (in microseconds). |
No |
|
156 |
flowStartNanoseconds |
The absolute timestamp of the first packet of the flow (in nanoseconds). |
No |
|
157 |
flowEndNanoseconds |
The absolute timestamp of the last packet of the flow (in nanoseconds). |
No |