The standard TCP handshake goes:

 1. SYN     (client->server)
 2. SYN+ACK (server->client)
 3. ACK     (client->server)

The NetFlow flags are ORed together and comprise of:

URG     ACK     PSH     RST     SYN     FIN
32      16      8       4       2       1

I am assuming that if NetFlow collects a flow during different stages of the handshake then the flow TCP flag would match the following table:

 1. 02 (SYN)
 2. 18 (SYN+ACK)
 3. 16 (ACK)

Is this correct?

  • What makes you think NetFlow uses TCP? – Ron Maupin May 3 '17 at 23:03
  • Huh? I am using NetFlow to monitor IP traffic – djp May 3 '17 at 23:09
  • 1
    OK, but your question is asking about a "Netflow entry as it completes a TCP 3 way handshake?" NetFlow doesn't use TCP, so it doesn't perform the TCP handshake. – Ron Maupin May 3 '17 at 23:11
  • by "Netflow entry" I mean a TCP connection that netflow has logged (I am not talking about the netflow protocol itself, just how netflow describes TCP connections) – djp May 3 '17 at 23:13
  • edited question to make it clearer – djp May 3 '17 at 23:14

Be very careful when looking at this kind of data. There's considerable variation by hardware platform and even software revision that influences whether TCP information is collected and whether that data is actually collected consistently.

When it does work, the TCP information collected by Netflow is a logical AND of the TCP flags seen during that flow interval. Keep in mind that a TCP flow lasting, say, 30 minutes might actually generate between 5-6 and potentially dozens of records as aging timers hit, caches overrun or, indeed, FIN packets are seen (in the case of TCP). As such, unless something is assembling these flow records into some kind of a cohesive whole what you're actually seeing is a bunch of (hopefully) sequential chunks.

If TCP flags are being correctly flagged then you might see an interval from, say, the first 30 seconds of the flow where both SYN and ACK were seen. This would create a value of 010010 (decimal 18). If retransmissions were happening later in the session - say 10 minutes in - then a later record might include 000100 (decimal 4) reflecting that the RST flag was observed. Toward the end of the overall session you might see a final record that included 000001, indicating a FIN flag.

Similarly, if an entire flow occurs within the bounds of a single record then the entries for SYN, ACK, RST and FIN might all be seen (010111). During an uneventful section of the flow there also might be no flags set at all.

FYI - the TCP flags (from most to least significant bits) are URG,ACK,PSH,RST,SYN,FIN.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.