1-96
Cisco uBR10012 Universal Broadband Router Software Configuration Guide
OL-1520-05
Chapter 1 Overview of Cisco uBR10012 Universal Broadband Router Software
Supported Software Features for the Cisco uBR10012 Router
NetFlow Version 5 Features and Format
NetFlow exports flow information in UDP datagrams in one of two formats. The version 1 format was
the initially released version, and version 5 is a later enhancement to add Border Gateway Protocol
(BGP) autonomous system (AS) information and flow sequence numbers.
In Netflow Version 1 and Version 5 formats, the datagram consists of a header and one or more flow
records. The first field of the header contain the version number of the export datagram. Typically, a
receiving application that accepts either format allocates a buffer big enough for the biggest possible
datagram from either format and uses the version from the header to determine how to interpret the
datagram. The second field in the header is the number of records in the datagram and should be used to
index through the records.
All fields in either version 1 or version 5 formats are in network byte order. Table 5 and Table 6 describe
the data format for version 1, and Table 7 and Table 8 describe the data format for version 5.
We recommend that receiving applications check datagrams to ensure that the datagrams are from a valid
NetFlow source. We recommend you first check the size of the datagram to make sure it is at least long
enough to contain the version and count fields. Next we recommend you verify that the version is valid
(1 or 5) and that the number of received bytes is enough for the header and count flow records (using the
appropriate version).
Because NetFlow export uses UDP to send export datagrams, it is possible for datagrams to be lost. To
determine whether or not flow export information is lost, the version 5 header format contains a flow
sequence number. The sequence number is equal to the sequence number of the previous plus the number
of flows in the previous datagram. After receiving a new datagram, the receiving application can subtract
the expected sequence number from the sequence number in the header to get the number of missed
flows.
Table 1-8
lists the byte definitions for Netflow Version 5 header format.
Table 1-9
lists the byte definitions for Version 5 flow record format.
Table 1-8
Netflow Version 5 Header Format
Bytes
Content
Description
0-3
version and count
Netflow export format version number and number of flows
exported in this packet (1-30).
1
1.
Netflow Version 5 export packets (set with
ip flow-export
command) allow the number of records stored in the datagram to
be a variable between 1 and 30.
4-7
SysUptime
Current time in milliseconds since router booted
8-11
unix_secs
Current seconds since 0000 UTC 1970.
12-15
unix_nsecs
Residual nanoseconds since 0000 UTC 1970.
16-19
flow_sequence
Sequence counter of total flows seen.
20-23
reserved
Unused (zero) bytes.
Table 1-9
Netflow Version 5 Flow Record Format
Bytes
Content
Description
0-3
srcaddr
Source IP address.
4-7
dstaddr
Destination IP address.
8-11
nexthop
Next hop router's IP address.