1

I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128.

I got the above information from

  1. (79) - NetFlow v9 has a set of 79 field types defined, whereas IPFIX has the same 79, for backwards compatibility, but then goes all the way from there up to 238. (https://www.ittsystems.com/netflow-vs-ipfix/)
  2. (87) - https://www.plixer.com/support/netflow-v9/
  3. (127) - There are 1 to 127 fields listed here https://www.ibm.com/support/knowledgecenter/en/SSCVHB_1.1.0/collector/cnpi_collector_v9_fiels_types.html.
  4. (128) - Values 0-127: NFv9-compatible https://www.iana.org/assignments/ipfix/ipfix.xhtml

A customer using cisco ASA said netflow-v9 supports field 233 (FW_EVENT) and wanted to check if our flow format supports that.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/15-mt/sec-data-zbf-15-mt-book/sec-data-zbf-log.pdf

My question:

  1. As a developer, What range of fields (numbers) can I use in netflow-v9?
  2. Can I use anything above 128? How is cisco doing this?
Improve this question
4
  • 1
    The Field Type is a 16-bit number, so the possible values are 0 to 65535. Whether or not a specific value is used will depend on the vendor of the device. Some values are defined by standard.
    – Ron Maupin ♦
    Commented Jan 31, 2019 at 21:04
  • @RonMaupin : Given that different vendors choose different fields in their V9 format, and it has the capability to support 0 to 65535 , why do articles above point to a specific range of field ids supported by V9?
    – Kingkong Jnr
    Commented Jan 31, 2019 at 21:11
  • As I explained, some values are defined by standard. Cisco created NetFlow, and it was later standardized. IPFIX was an effort to open it up more.
    – Ron Maupin ♦
    Commented Jan 31, 2019 at 21:15
  • Did any answer help you? If so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Mar 20, 2021 at 14:54

1 Answer 1

Reset to default
3

Cisco Netflow V9 and IPFIX are largely the same and differ only in minor details. Both represent the field ID ('Field Type' if NFV9 and 'Field Specifier') with a 16 bit field. All 16 bit values (65536) may be considered valid.

The original NFV9 RFC gave specifications of the first 79 values, and states that Cisco website will provide provide more details. Quote:

When extensibility is required, the new field types will be added to the list. The new field types have to be updated on the Exporter and Collector but the NetFlow export format would remain unchanged. Refer to the latest documentation at http://www.cisco.com for the newly updated list.

The Cisco website provides specifications for field IDs up to 128 and then states that field IDs 128 to 32768 match those in the IANA IPFIX field registry.

The IANA IPFIX registry currently lists specifications of approximately 500 fields.

The definition of the IPFIX Field Specifier provides that values with the top 'Enterprise' bit set (values 32768 and greater) are 'enterprise-specific' and the authority for the specifications of those will be given the following Enterprise number.

From a pragmatic point of view, in the case of Netflow V9, you are unlikely to see values greater than 500 in flow records.

If none of the approx 500 fields already defined in the IANA IPIFX registry meet your use case, you can submit new field specifications for consideration.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.