cflowd Version 8 Formats and Fields

A detailed explanation of cflowd version 8 packet formats and fields is shown as follows:

• Figure 14, "cflowd Version 8 Flow Header Format" on page 129
• Table 17, "cflowd Version 8 Flow Header Fields"
• Figure 15, "cflowd Version 8 AS Aggregation Flow Entry Format" on page 130
• Table 18, "cflowd Version 8 AS Aggregation Flow Entry Fields"
• Figure 16, "cflowd Version 8 Protocol/Port Aggregation Flow Entry Format" on page 131
• Table 19, "cflowd Version 8 Protocol/Port Aggregation Flow Entry Fields"
• Figure 17, "cflowd Version 8 Prefix Aggregation Flow Entry Format" on page 132
• Table 20, "cflowd Version 8 Prefix Aggregation Flow Entry Fields"
• Figure 18, "cflowd Version 8 Source Prefix Aggregation Flow Entry Format" on page 133
• Table 21, "cflowd Version 8 Source Prefix Aggregation Flow Entry Fields"
• Figure 19, "cflowd Version 8 Destination Prefix Aggregation Flow Entry Format" on page 134
• Table 22, "cflowd Version 8 Destination Prefix Aggregation Flow Entry Fields"

Figure 14: cflowd Version 8 Flow Header Format

Table 17: cflowd Version 8 Flow Header Fields

Field	Description
Version	8
Count	The number of records in the Protocol Data Unit (PDU) or packet
sysUptime	Current time elapsed in milliseconds since the router started
UNIX seconds	Current seconds since 0000 UTC 1970
UNIX nanoseconds	Residual nanoseconds since 0000 UTC 1970
Flow sequence number	Sequence counter of total flows received
Engine type	Type of flow switching engine
Engine ID	ID number of the flow switching engine
Aggregation method	Aggregation method used
Aggregation version	Version of the aggregation export
Reserved	Empty field reserved for future usage

Figure 15: cflowd Version 8 AS Aggregation Flow Entry Format

Table 18: cflowd Version 8 AS Aggregation Flow Entry Fields

Field	Description
Flows	Total number of flows
Packets	Total number of packets received in a flow
Bytes	Total number of bytes received in a flow
Start time of flow	System up time in seconds at the start of the flow
End time of flow	System up time in seconds at the end of the flow
Source AS	AS number of the source address
Destination AS	AS number of the destination address
Input interface	SNMP index value for the input interface where the router receives flows
Output interface	SNMP index value for the output interface where the router forwards flows

Figure 16: cflowd Version 8 Protocol/Port Aggregation Flow Entry Format

Table 19: cflowd Version 8 Protocol/Port Aggregation Flow Entry Fields

Field	Description
Flows	Total number of flows
Packets	Total number of packets received in a flow
Bytes	Total number of bytes received in a flow
Start time of flow	System up time in seconds at the start of the flow
End time of flow	System up time in seconds at the end of the flow
IP protocol	IP protocol number
Padding	Bytes available to ensure a minimum packet length
Reserved	Empty field reserved for future usage
Source port	Source application port
Destination port	Destination application port

Figure 17: cflowd Version 8 Prefix Aggregation Flow Entry Format

Table 20: cflowd Version 8 Prefix Aggregation Flow Entry Fields

Field	Description
Flows	Total number of flows
Packets	Total number of packets received in a flow
Bytes	Total number of bytes received in a flow
Start time of flow	System up time in seconds at the start of the flow
End time of flow	System up time in seconds at the end of the flow
Source prefix	Source IP address prefix
Destination prefix	Destination IP address prefix
Source mask length	Source address network mask length
Dest. mask length	Destination address network mask length
Reserved	Empty field reserved for future usage
Source AS	AS number of the source address
Destination AS	AS number of the destination address
Input interface	SNMP index value for the input interface where the router receives flows
Output interface	SNMP index value for the output interface where the router forwards flows

Figure 18: cflowd Version 8 Source Prefix Aggregation Flow Entry Format

Table 21: cflowd Version 8 Source Prefix Aggregation Flow Entry Fields

Field	Description
Flows	Total number of flows
Packets	Total number of packets received in a flow
Bytes	Total number of bytes received in a flow
Start time of flow	System up time in seconds at the start of the flow
End time of flow	System up time in seconds at the end of the flow
Source prefix	Source IP address prefix
Source mask length	Source address network mask length
Padding	Bytes available to ensure a minimum packet length
Source AS	AS number of the source address
Input interface	SNMP index value for the input interface where the router receives flows
Reserved	Empty field reserved for future usage

Figure 19: cflowd Version 8 Destination Prefix Aggregation Flow Entry Format

Table 22: cflowd Version 8 Destination Prefix Aggregation Flow Entry Fields

Field	Description
Flows	Total number of flows
Packets	Total number of packets received in a flow
Bytes	Total number of bytes received in a flow
Start time of flow	System up time in seconds at the start of the flow
End time of flow	System up time in seconds at the end of the flow
Destination prefix	Destination IP address prefix
Dest. mask length	Destination address network mask length
Padding	Bytes available to ensure a minimum packet length
Destination AS	AS number of the destination address
Output interface	SNMP index value for the output interface where the router forwards flows
Reserved	Empty field reserved for future usage

For more information about cflowd packet formats and fields, see http://www.caida.org.