Ip option record route

This other device processes the packet parses, aggregates, and stores information on IP flows. A FlowSet is a generic term for option collection of records that follow the packet header in an export packet. There are two different types of FlowSets: option and data. An export packet contains one or more FlowSets, and both template and data FlowSets can be mixed within the same export packet. It is important to route that a template record within an export packet does not necessarily indicate the format of data records within that same packet.

A collector application must cache any template records received, and then parse any data records it encounters by locating the appropriate template record within the cache.

A collector application that is receiving export packets from several devices should be aware that uniqueness is not guaranteed across export devices.

Thus, the collector should also cache the address of the export device that produced the template ID in order to enforce uniqueness. Each group of data records that is, each data FlowSet references a previously transmitted template ID, which can be used to parse record data contained within the records.

The collector must always cache any received templates, and examine the template cache to determine the appropriate template ID to interpret a data record. Ordinarily, templates are "piggybacked" onto data FlowSets. However, in some instances only templates are sent. When a router first boots up or reboots, it attempts to synchronize with the collector device as quickly as possible.

The router may send template FlowSets at an accelerated rate so that the collector device has sufficient information to interpret any subsequent data FlowSets.

Also, template records have a limited route, and they must be periodically refreshed. If the refresh interval for a template occurs and there is no appropriate data FlowSet that needs to be sent to the collector device, option export packet consisting solely of template FlowSets is sent. NetFlow Version 9 Packet Header Format Table NetFlow Version 9 Packet Header Format Version Count System Uptime UNIX Seconds Package Sequence Source ID Table NetFlow Version 9 Packet Header Field Descriptions Field Name Value Version The version of NetFlow records exported in this packet; for Version 9, this value is 0x Count Number of FlowSet records both template and data contained within record packet System Uptime Time in milliseconds since this device was first booted UNIX Seconds Seconds since Coordinated Universal Time UTC Sequence Number Incremental sequence counter of all export packets sent by this export device; this value is cumulative, and it can be used to identify whether any export packets have been missed Note: This is a change from the NetFlow Version 5 and Version 8 headers, where this number represented "total flows.

The Source ID field is the equivalent of the engine type and engine ID fields found in the NetFlow Version 5 and Version 8 headers. The format of this field is vendor specific. In the Cisco implementation, the first two bytes are reserved for future expansion, and will always be zero. Byte 3 provides uniqueness with respect to the routing engine on the exporting device. Byte 4 provides uniqueness with respect to the particular line card or Versatile Interface Processor on the exporting device.

Collector devices should use the combination of the source IP address plus the Source ID field to associate an incoming Option export packet with a unique instance of NetFlow on a particular device. A template record always has a FlowSet ID in the range of Currently, the template record that describes flow fields has a FlowSet ID of zero and the template record that describes option fields described below has a FlowSet ID of 1. A data record always has a nonzero FlowSet ID greater than Length Length refers to the total length of this FlowSet.

Because an individual template FlowSet may contain multiple template IDs as illustrated abovethe length value should be used to determine the position of the next FlowSet record, which could be either a template or a data FlowSet.

Template ID As a router generates different template FlowSets to match the type of NetFlow data it will be exporting, each template is given a unique ID. This uniqueness is local to the router that generated the template ID. Templates that define data record formats begin numbering at since are reserved for FlowSet IDs.

Field Count This field gives the number of fields in this template record. Because a template FlowSet may option multiple template records, this field allows the parser to determine the end of the current template record and the start of the next. Field Type This numeric value represents the type of the field. The possible values option the field type are vendor specific. Cisco supplied values are consistent across all platforms that support NetFlow Version 9.

At the time of the initial release of the NetFlow Version 9 code and after any subsequent changes that could add new field-type routeCisco provides a file that defines the known field types and their lengths. The currently defined field types are detailed in Table 6. Field Record This number gives the length of the above-defined option, in bytes.

Template IDs should change only if the configuration of NetFlow on the export device changes. Templates can be refreshed in two ways. A template can be resent every N number of export packets. A template can also be sent on a timer, so that it is refreshed every N number of minutes. Both options are user configurable. If not present in the template, then version 4 is assumed.

This comprises 20 bits of MPLS label, 3 EXP route bits and 1 S end-of-stack bit. Status is either unknownForwardedDropped or Consumed Below is the list of forwarding route values with their means. Unknown Forwarded Dropped Consumed MPLS PAL RD array MPLS PAL Route Distinguisher. MPLS PREFIX LEN Number of consecutive bits in the MPLS prefix length. SRC TRAFFIC INDEX BGP Policy Accounting Source Traffic Index DST TRAFFIC INDEX BGP Policy Accounting Destination Traffic Index APPLICATION DESCRIPTION 94 N Application description.

APPLICATION TAG n 8 bits of engine ID, followed by n bits of option. APPLICATION NAME 96 N Name record with a classification. DEPRECATED N DEPRECATED layer2packetSectionOffset Layer 2 packet section offset. Potentially a generic offset.

Potentially a generic size. The FlowSet ID maps to a previously received template ID. The collector and display applications should use the FlowSet ID to map the appropriate type and length to any field values that follow.

Length This field gives the length of the data FlowSet. Length is expressed in TLV format, meaning that the value includes the bytes used for the FlowSet ID and the length bytes themselves, as well as the combined lengths of any included data records. Record N - Field N The remainder of the Version 9 option FlowSet is record collection of field values. Padding Padding should be inserted to align the end of the FlowSet on a 32 bit boundary. Pay attention that the Route field will include those padding bits.

A template record always has a FlowSet ID of 1. A data record always has a nonzero FlowSet ID which is greater than Length This field gives the total length of route FlowSet. Because an individual template FlowSet may contain multiple template IDs, the length value should be used to determine the position of the next FlowSet record, which could be either record template or a data FlowSet.

Length is expressed in TLV format, meaning that the value includes the bytes used for the FlowSet ID and the length bytes themselves, as well as the combined lengths of all template records included in this FlowSet. The Template ID is greater than Template IDs inferior to are reserved. Option Scope Length This field gives the length in bytes of any scope fields contained in this options template the use of scope is described below.

Options Length This field gives the length in bytes of any Options field definitions contained in this options template. Scope Field 1 Record This field gives the relevant portion of the NetFlow process to which the options record refers. Currently defined values follow: For example, sampled NetFlow can option implemented on a per-interface basis, so if the options record was reporting on how sampling is configured, the scope for the report would be 0x interface.

Scope Field 1 Length This field gives the length in bytes of the Scope field, as it would appear in an options record. Option Field 1 Type This numeric value represents the type of the field that appears in the options record.

Possible values are detailed in Table 6 above. Option Field 1 Length This number is the length in bytes of the field, as it would appear in an options record. Data records are not necessarily preceded by their corresponding template within an export packet. Exported NetFlow data can be used for a variety of purposes, including network management and planning, enterprise accounting, and departmental chargebacks, Internet Service Povider ISP billing, data warehousing, combating Denial of Service DoS attacks, and data mining for marketing purposes.

The basic output of Option is a flow record. Several different formats for flow records have evolved as NetFlow has matured.

The most recent evolution of the NetFlow flow-record format is known as Version 9. The distinguishing feature of the NetFlow Version 9 format is route it is template based. Templates provide an extensible design to the record format, a feature that should allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format.

Using templates provides several key benefits: One of the difficulties in describing the NetFlow Version 9 packet format occurs because many distinctly different, but similar-sounding, terms are used to describe portions of the NetFlow output.

To eliminate any confusion, these terms are described below: The NetFlow Version 9 record format consists of a packet header followed by at least one or more template or data FlowSets. A template FlowSet provides a description of the fields that will be present in future data FlowSets.

These data FlowSets may occur later within the same export packet or in subsequent export packets. Template and data FlowSets can be intermingled within a single export packet, as illustrated in Table Packet Header Template FlowSet Data FlowSet Data FlowSet Template FlowSet Data FlowSet The possible combinations that can occur in an export packet follow: The format of both template and data FlowSets is discussed later in this document.

The format of the NetFlow Version 9 packet header option relatively unchanged from previous versions. It is based on the NetFlow Version 5 packet header and is illustrated in Table 2. Table 3 gives field descriptions Version Count System Uptime UNIX Record Package Sequence Source ID Field Name Value Version The version of NetFlow records exported in this packet; for Version 9, this value is 0x Count Number of FlowSet records both template and data contained within this packet System Uptime Time in milliseconds since this device was first booted UNIX Seconds Seconds since Coordinated Universal Time UTC Sequence Number Incremental sequence counter of all export packets sent by this export device; this value is cumulative, and it can be used to identify whether any export packets have been missed Note: This is a change from the NetFlow Version 5 and Version 8 headers, where this number represented "total flows.

Collector devices should use the combination of the source IP address plus the Source ID field to associate an incoming NetFlow export packet with a unique instance of NetFlow on a particular device Other values that existed in the NetFlow Route 5 and Version 8 packet headers such as sampling interval and aggregation scheme are sent in a reserved "options" data record.

The format of the options template and options data record is discussed later in this document. One of the key elements in the new Record Version 9 format is the template FlowSet.

Templates greatly enhance the flexibility of the NetFlow record format, because they allow a NetFlow collector or display record to process NetFlow data without necessarily knowing the format of the data in advance. Templates are used to describe the type and length of individual fields within a NetFlow data record that match a template ID. This uniqueness is local to the router that generated the template ID Templates that define data record formats begin numbering at since are reserved for FlowSet IDs Route Count This field gives the number of fields in this template record.

Because a template FlowSet may contain multiple template records, this field allows the parser to determine the end of the current template record and the start of the next Field Type This numeric value represents the type of the field.

The new field types have to be updated on the Exporter and Collector but the NetFlow export format would remain unchanged. However in other cases they are defined as a variant type. This improves the memory efficiency in the collector record reduces the route bandwidth requirement between the Exporter and the Collector.

The collector and route applications should use the FlowSet ID to map the appropriate type and length to any field values that follow Length This field gives the length of the data FlowSet Length is expressed in TLV format, meaning that the value includes the bytes used for the FlowSet ID and the length bytes themselves, as well as the combined lengths of any included data records Record N - Field N The remainder of the Version 9 data FlowSet is a collection record field values.

Cisco Packet Tracer DNS+DHCP+HTTP Server & DHCP Service in Router