2

In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX?

I'm shipping IPFIX data with softflowd and I'm getting these fields:

destinationIPv4Address
destinationTransportPort
egressInterface
flowEndMilliseconds
flowStartMilliseconds
icmpTypeCodeIPv4
ingressInterface
ipClassOfService
ipVersion
octetDeltaCount
packetDeltaCount
protocolIdentifier
sourceIPv4Address
sourceTransportPort
tcpControlBits
version
vlanId

Is octetDeltaCount and packetDeltaCount the equivalent of in_bytes and in_pkts?

Improve this question

1 Answer 1

Reset to default
1

IPFIX is defined in RFC 7011, Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. Much of what you do or do not have in your records is up to the specific implementation. Your application is off-topic, but if you look at Appendix A. IPFIX Encoding Examples, it will give you some example templates, and the meanings of the fields for those templates. For example:

A.2. Template Set Examples

A.2.1. Template Set Using IANA Information Elements

We want to report the following Information Elements:

  • IPv4 source IP address: sourceIPv4Address [IANA-IPFIX], with a length of 4 octets

  • IPv4 destination IP address: destinationIPv4Address [IANA-IPFIX], with a length of 4 octets

  • Next-hop IP address (IPv4): ipNextHopIPv4Address [IANA-IPFIX], with a length of 4 octets

  • Number of packets of the Flow: packetDeltaCount [IANA-IPFIX], with a length of 4 octets

  • Number of octets of the Flow: octetDeltaCount [IANA-IPFIX], with a length of 4 octets

Therefore, the Template Set will be composed of the following:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         Set ID = 2            |      Length = 28 octets       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       Template ID 256         |       Field Count = 5         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    sourceIPv4Address = 8    |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0| destinationIPv4Address = 12 |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|  ipNextHopIPv4Address = 15  |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    packetDeltaCount = 2     |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|    octetDeltaCount = 1      |       Field Length = 4        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Improve this answer
3
  • yeah so octetDeltaCount and packetDeltaCount is the equivalent of in_bytes and in_pkts?
    – red888
    Jul 14, 2017 at 0:35
  • That depends completely on the template your application is using. Most likely it is, but templates can be custom, and the names of the fields in your template could be misleading. You really need to check the documentation of your application.
    – Ron Maupin ♦
    Jul 14, 2017 at 0:36
  • ah ok so using a custom template my application could be calling the fields whatever it wants? Thats interesting I'll have to look at the docs
    – red888
    Jul 14, 2017 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.