16-5
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 16 Configuring NDE
Understanding How NDE Works
34–35 dstport Layer 4 destination port number
or equivalent
00 XX
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
00 00
38 prot Layer 4 protocol
(for example, 6=TCP, 17=UDP)
00 XX
39 tos IP type-of-service byte
XX XX
40–41 src_as Autonomous system number of the source,
either origin or peer
00 00
42–43 dst_as Autonomous system number of the
destination, either origin or peer
00 00
44–45 src_mask Source address prefix mask bits
00 00
46–47 dst_mask Destination address prefix mask bits
00 00
48 pad2 Pad 2 is unused (zero) bytes
1. This flow mask is not configurable from the CLI. It is only turned on if certain features, such as reflexive ACLs, are set up.
2. This feature is not supported on Supervisor Engine 1 or 1A.
Table 16-3 NDE Version 7 Header Format
Bytes Content Description
0–1 version NetFlow export format version number
2–3 count Number of flows exported in this packet (1–30)
4–7 SysUptime Current time in milliseconds since router booted
8–11 unix_secs Current seconds since 0000 UTC 1970
12–15 unix_nsecs Residual nanoseconds since 0000 UTC 1970
16–19 flow_sequence Sequence counter of total flows seen
20–24 reserved Unused (zero) bytes
Table 16-4 NDE Version 7 Flow Record Format
Bytes Content Description
Flow masks: X=Populated
Destination
Destination
Source Full Full VLAN
1
0–3 srcaddr Source IP address
0XXX
4–7 dstaddr Destination IP address
XXXX
8–11 nexthop Next-hop router’s IP address
XXXX
12–13 input Ingress interface SNMP ifIndex
2
0XXX
Table 16-2 NDE Version 5 Flow Record Format (continued)
Bytes Content Description
Flow masks: X=Populated
Destination
Destination
Source Full Full VLAN
1
To Next Page
Loading...
Need help?
General