https://www.iana.org/assignments/ipfix/ipfix.xhtml. This is an aggregated flow. Keys for this flow record are: sourceIPv4Addres, destinationIPv4Address, destinationTransportPort, ingressVRFID, ApplicationID, protocolIdentifier. Source port is aggregated out.
Template ID: 256
The Non-NAT template is the common Netflow template.
|Element ID||Name||Type||Description||Recommended Implementation||Applicable Edge Release|
|1||octetDeltaCount||unsigned64||The number of octets includes IP header(s) and IP payload.||Used to report on total bytes (aggregate of bytesTX and bytesRx) and BytesRX.||3.3.0|
|2||packetDeltaCount||unsigned64||The number of incoming packets since the previous report (if any) for this flow at the observation point.||Used to report on total packet (aggregate of packetTX and packetRX) and packetRX.||3.3.0|
|32769||octetDeltaCount_rev||unsigned64||Biflow RFC 5103. The number of outgoing byte.||Used to report on total bytes (aggregate of bytesTX and bytesRX) and BytesTX.||3.3.0|
|32770||packetDeltaCount_rev||unsigned64||Biflow RFC 5103. The number of outgoing packets.||Used to report on total packet (aggregate of packetTX and packetRx) and packetTX.||3.3.0|
|3||deltaFlowCount||unsigned64||The conservative count of original flows contributing to this aggregated flow; may be distributed via any of the methods expressed by the valueDistributionMethod Information Element.||See IPFIX Information Element Definitions.||3.3.0|
|4||protocolIdentifier||unsigned8||The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.||Implement as per description.||3.3.0|
|5||ipClassOfService||unsigned8||For IPv4 packets, this is the value of the TOS field in the IPv4 packet header.||Implement as per description.||3.3.0|
|8||sourceIPv4Address||ipv4Address||The IPv4 source address in the IP packet header.||Implement as per description.||3.3.0|
|10||ingressInterface||unsigned32||The index of the IP interface where packets of this flow are being received. The value matches the value of managed object 'ifIndex' as defined in RFC2863.||This value maps to Interface option template 272 ‘ingressInterface’ value where to map the flow to SD-WAN link interface number.||3.3.0|
|11||destinationTransportPort||unsigned16||The destination port identifier in the transport header.||Implement as per description.||3.3.0|
|12||destinationIPv4Address||ipv4Address||The IPv4 destination address in the IP packet header.||Implement as per description.||3.3.0|
|14||egressInterface||unsigned32||The index of the IP interface where packets of this flow are being sent. The value matches the value of managed object 'ifIndex' as defined in RFC2863.||Egress interface||3.3.0|
|15||ipNextHopIPv4Address||ipv4Address||The IPv4 address of the next IPv4 hop. http://www.iana.org/go/rfc2863||This IP address identifies the next hop device when there is no SD-WAN overlay (underlay next hop).||3.3.0|
|56||sourceMacAddress||macAddress||The IEEE 802 source MAC address field.||Implement as per description.||3.3.0|
|239||biflowDirection||unsigned8||A description of the direction assignment method used to assign the biflow Ssurce and destination. This Information element may be present in a flow data record or applied to all flows exported from an exporting process or observation domain using IPFIX options. If this Information element is not present in a flow record or associated with a biflow via scope, it is assumed that the configuration of the direction assignment method is done out-of-band.
Note: When using IPFIX options to apply this Information element to all flows within an observation domain or from an exporting process, the option should be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information element should appear in each flow record.
|See IPFIX Information Element Definitions.||3.3.0|
|95||applicationId||octetArray(8)||Specifies an application ID. RFC6759. For details, see Application Option Template.||Implement to recognize L7 app signature.||3.3.0|
|148||flowID||unsigned64||An identifier of a flow that is unique within an observation domain. This Information element can be used to distinguish between different flows if flow keys such as IP addresses and port numbers are not reported or are reported in separate records.||Unique flow ID maps to flow links stats option template 257.||3.3.0|
|152||flowStartMilliseconds||dateTimeMilliseconds||The absolute timestamp of the first packet of this flow.||Implement as per description.||3.3.0|
|153||flowEndMilliseconds||dateTimeMilliseconds||The absolute timestamp of the last packet of this flow.||Implement as per description.||3.3.0|
|136||flowEndReason||unsigned8||The reason for flow termination. The range of values includes the following:
||Implement as per description.||3.3.0|
|234||ingressVRFID||unsigned32||A unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per metering process.||This maps to the VMware SD-WAN Orchestrator segments. A segment should be visualized and reported as a segregated L3 domain within the Edge.||3.3.0|