https://www.iana.org/assignments/ipfix/ipfix.xhtml. This is an aggregated flow. Keys for this flow record are: sourceIPv4Addres, destinationIPv4Address, destinationTransportPort, ingressVRFID, ApplicationID, protocolIdentifier. Source port is aggregated out.

Template ID: 256

The Non-NAT template is the common Netflow template.

Element ID Name Type Description Recommended Implementation Applicable Edge Release
1 octetDeltaCount unsigned64 The number of octets includes IP header(s) and IP payload. Used to report on total bytes (aggregate of bytesTX and bytesRx) and BytesRX. 3.3.0
2 packetDeltaCount unsigned64 The number of incoming packets since the previous report (if any) for this flow at the observation point. Used to report on total packet (aggregate of packetTX and packetRX) and packetRX. 3.3.0
32769 octetDeltaCount_rev unsigned64 Biflow RFC 5103. The number of outgoing byte. Used to report on total bytes (aggregate of bytesTX and bytesRX) and BytesTX. 3.3.0
32770 packetDeltaCount_rev unsigned64 Biflow RFC 5103. The number of outgoing packets. Used to report on total packet (aggregate of packetTX and packetRx) and packetTX. 3.3.0
3 deltaFlowCount unsigned64 The conservative count of original flows contributing to this aggregated flow; may be distributed via any of the methods expressed by the valueDistributionMethod Information Element. See IPFIX Information Element Definitions. 3.3.0
4 protocolIdentifier unsigned8 The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. Implement as per description. 3.3.0
5 ipClassOfService unsigned8 For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. Implement as per description. 3.3.0
8 sourceIPv4Address ipv4Address The IPv4 source address in the IP packet header. Implement as per description. 3.3.0
10 ingressInterface unsigned32 The index of the IP interface where packets of this flow are being received. The value matches the value of managed object 'ifIndex' as defined in RFC2863. This value maps to Interface option template 272 ‘ingressInterface’ value where to map the flow to SD-WAN link interface number. 3.3.0
11 destinationTransportPort unsigned16 The destination port identifier in the transport header. Implement as per description. 3.3.0
12 destinationIPv4Address ipv4Address The IPv4 destination address in the IP packet header. Implement as per description. 3.3.0
14 egressInterface unsigned32 The index of the IP interface where packets of this flow are being sent. The value matches the value of managed object 'ifIndex' as defined in RFC2863. Egress interface 3.3.0
15 ipNextHopIPv4Address ipv4Address The IPv4 address of the next IPv4 hop. http://www.iana.org/go/rfc2863 This IP address identifies the next hop device when there is no SD-WAN overlay (underlay next hop). 3.3.0
56 sourceMacAddress macAddress The IEEE 802 source MAC address field. Implement as per description. 3.3.0
239 biflowDirection unsigned8 A description of the direction assignment method used to assign the biflow Source and destination. This Information element may be present in a flow data record or applied to all flows exported from an exporting process or observation domain using IPFIX options. If this Information element is not present in a flow record or associated with a biflow via scope, it is assumed that the configuration of the direction assignment method is done out-of-band.
Note: When using IPFIX options to apply this Information element to all flows within an observation domain or from an exporting process, the option should be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information element should appear in each flow record.
See IPFIX Information Element Definitions. 3.3.0
95 applicationId octetArray(8) Specifies an application ID. RFC6759. For details, see Application Option Template. Implement to recognize L7 app signature. 3.3.0
148 flowID unsigned64 An identifier of a flow that is unique within an observation domain. This Information element can be used to distinguish between different flows if flow keys such as IP addresses and port numbers are not reported or are reported in separate records. Unique flow ID maps to flow links stats option template 257. 3.3.0
152 flowStartMilliseconds dateTimeMilliseconds The absolute timestamp of the first packet of this flow. Implement as per description. 3.3.0
153 flowEndMilliseconds dateTimeMilliseconds The absolute timestamp of the last packet of this flow. Implement as per description. 3.3.0
136 flowEndReason unsigned8 The reason for flow termination. The range of values includes the following:
  • 0x01: idle timeout - The flow was terminated because it was considered to be idle.
  • 0x02: active timeout - The flow was terminated for reporting purposes while it was still active, for example, after the maximum lifetime of unreported Flows was reached.
  • 0x03: end of flow detected - The flow was terminated because the metering process detected signals indicating the end of the flow, for example, the TCP FIN flag.
  • 0x04: forced end - The flow was terminated because of some external event, for example, a shutdown of the metering process initiated by a network management application.
  • 0x05: lack of resources - The flow was terminated because of lack of resources available to the metering process and/or the exporting process.
 Implement as per description. 3.3.0
234 ingressVRFID unsigned32 A unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per metering process. This maps to the VMware SASE Orchestrator segments. A segment should be visualized and reported as a separated L3 domain within the Edge. 3.3.0