I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and a subset of those used for documenting flow records and other events.

Flowset 1 containing Data Templates 256-271

I am finding that it is hard to interpret these records without knowing what each template is named and what its function is. I may see the same flow documented in a template 263 record and a template 265 record in the same packet, for example. Counting all of the packets and octets in all of these flow records results in inflated statistics.

https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/guide/asa_netflow.html#pgfId-1332039 covers 30 different templates, but does not state which templates map to which data template IDs.

Is there a better reference that shows the name and function of these 16 data templates?

Thank you for any guidance you can provide.

  • Unfortunately, off-site resource recommendations are off-topic. Your Cisco representative should be able to point you to any documentations Cisco has on this if you cannot search the Cisco site to find anything else.
    – Ron Maupin
    Sep 28, 2020 at 22:12


Browse other questions tagged or ask your own question.