I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128.

I got the above information from

  1. (79) - NetFlow v9 has a set of 79 field types defined, whereas IPFIX has the same 79, for backwards compatibility, but then goes all the way from there up to 238. (https://www.ittsystems.com/netflow-vs-ipfix/)
  2. (87) - https://www.plixer.com/support/netflow-v9/
  3. (127) - There are 1 to 127 fields listed here https://www.ibm.com/support/knowledgecenter/en/SSCVHB_1.1.0/collector/cnpi_collector_v9_fiels_types.html.
  4. (128) - Values 0-127: NFv9-compatible https://www.iana.org/assignments/ipfix/ipfix.xhtml

A customer using cisco ASA said netflow-v9 supports field 233 (FW_EVENT) and wanted to check if our flow format supports that.


My question:

  1. As a developer, What range of fields (numbers) can I use in netflow-v9?
  2. Can I use anything above 128? How is cisco doing this?
  • The Field Type is a 16-bit number, so the possible values are 0 to 65535. Whether or not a specific value is used will depend on the vendor of the device. Some values are defined by standard. – Ron Maupin Jan 31 '19 at 21:04
  • @RonMaupin : Given that different vendors choose different fields in their V9 format, and it has the capability to support 0 to 65535 , why do articles above point to a specific range of field ids supported by V9? – Kingkong Jnr Jan 31 '19 at 21:11
  • As I explained, some values are defined by standard. Cisco created NetFlow, and it was later standardized. IPFIX was an effort to open it up more. – Ron Maupin Jan 31 '19 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.