I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and a subset of those used for documenting flow records and other events.
I am finding that it is hard to interpret these records without knowing what each template is named and what its function is. I may see the same flow documented in a template 263 record and a template 265 record in the same packet, for example. Counting all of the packets and octets in all of these flow records results in inflated statistics.
https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/guide/asa_netflow.html#pgfId-1332039 covers 30 different templates, but does not state which templates map to which data template IDs.
Is there a better reference that shows the name and function of these 16 data templates?
Thank you for any guidance you can provide.
