I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128.
I got the above information from
- (79) - NetFlow v9 has a set of 79 field types defined, whereas IPFIX has the same 79, for backwards compatibility, but then goes all the way from there up to 238. (https://www.ittsystems.com/netflow-vs-ipfix/)
- (87) - https://www.plixer.com/support/netflow-v9/
- (127) - There are 1 to 127 fields listed here https://www.ibm.com/support/knowledgecenter/en/SSCVHB_1.1.0/collector/cnpi_collector_v9_fiels_types.html.
- (128) - Values 0-127: NFv9-compatible https://www.iana.org/assignments/ipfix/ipfix.xhtml
A customer using cisco ASA said netflow-v9 supports field 233 (FW_EVENT) and wanted to check if our flow format supports that.
- As a developer, What range of fields (numbers) can I use in netflow-v9?
- Can I use anything above 128? How is cisco doing this?