Supported Element Types for NetFlow Integrator Element Mapping
This section outlines the element types (v5, v9, and v10) supported by the AMX application for element mapping from the ingest NetFlow/IPFIX flow records to JSON on the following platforms. These elements are predefined and cannot be configured:
| VMware ESXi |
| VMware NSX-T |
|
Elements |
Description 1 |
Supported for NetFlow v5 |
Supported for NetFlow v9 |
Supported for NetFlow v10/IPFIX |
|||||||||
|
type |
Type of flow message |
ü |
ü |
ü |
|||||||||
|
sampler_address |
Address of the device that generated the packet |
ü |
ü |
ü |
|||||||||
|
sampling_rate |
Sampling rate of the flow |
ü |
ü |
ü |
|||||||||
|
export_time_ns |
Export time in Nano seconds |
ü |
ü |
ü |
|||||||||
|
time_received_ns |
Timestamp in nanoseconds of when the message was received |
ü |
ü |
ü |
|||||||||
|
sequence_num |
Sequence number of the flow packet |
ü |
ü |
ü |
|||||||||
|
source_id |
An identifier that uniquely identifies the flow source. For IPFIX it refers to the observation domain ID. |
û |
ü |
ü |
|||||||||
|
etype |
Ethernet type (0x86dd for IPv6...) |
ü |
ü |
ü |
|||||||||
|
src_addr |
Source address (IP)
|
ü |
ü |
ü |
|||||||||
|
dst_addr |
Destination address (IP)
|
ü |
ü |
ü |
|||||||||
|
ip_tos |
IP Type of Service
|
ü |
ü |
ü |
|||||||||
|
ip_dscp |
Differentiated Services Code Point
|
û |
ü |
ü |
|||||||||
|
ip_precedence |
The value of the IP Precedence
|
û |
ü |
ü |
|||||||||
|
proto |
Protocol (UDP, TCP, ICMP...)
|
ü |
ü |
ü |
|||||||||
|
ip_ttl_max |
Maximum TTL value observed for packets of the flow
|
û |
ü |
ü |
|||||||||
|
src_port |
Source port (when UDP/TCP/SCTP)
|
ü |
ü |
ü |
|||||||||
|
dst_port |
Destination port (when UDP/TCP/SCTP)
|
ü |
ü |
ü |
|||||||||
|
bytes |
Number of bytes in a flow
|
ü |
ü |
ü |
|||||||||
|
packets |
Number of packets in a flow
|
ü |
ü |
ü |
|||||||||
|
bytes_total |
Running byte counter for a permanent flow
|
û |
ü |
ü |
|||||||||
|
packets_total |
Running packet counter for a permanent flow
|
û |
ü |
ü |
|||||||||
|
flow_direction |
Flow direction
|
û |
ü |
ü |
|||||||||
|
in_if |
Input interface
|
ü |
ü |
ü |
|||||||||
|
out_if |
Output interface
|
ü |
ü |
ü |
|||||||||
|
time_flow_start_ns |
Time the flow started in nanoseconds. Refer to Important Notes.
|
ü |
ü |
ü |
|||||||||
|
time_flow_end_ns |
Time the flow ended in nanoseconds. Refer to Important Notes.
|
ü |
ü |
ü |
|||||||||
|
tcp_flags |
TCP flags
|
ü |
ü |
ü |
|||||||||
|
ip_length_min |
Minimum IP packet length
|
û |
ü |
ü |
|||||||||
|
ip_length_max |
Maximum IP packet length
|
û |
ü |
ü |
|||||||||
|
next_hop |
Nexthop IP address
|
ü |
ü |
ü |
|||||||||
|
ipv4_next_hop |
Nexthop IPv4 address
|
û |
ü |
ü |
|||||||||
|
ipv6_next_hop |
Nexthop IPv6 address
|
û |
ü |
ü |
|||||||||
|
flow_id |
An identifier of a flow that is unique within an Observation Domain
|
û |
ü |
ü |
|||||||||
|
firewall_event |
Indicates a firewall event. Allowed values are listed in the firewall Event registry.
|
û |
ü |
ü |
|||||||||
|
icmp_type |
Type of the ICMP message
|
û |
ü |
ü |
|||||||||
|
icmp_code |
Code of the ICMP message
|
û |
ü |
ü |
|||||||||
|
flow_end_reason |
The reason for flow termination. Values are listed in the flowEndReason registry. |
û |
ü |
ü |
|||||||||
|
application_id |
Specifies an Application ID
|
û |
ü |
ü |
|||||||||
|
application_description |
Specifies the description of an application
|
û |
ü |
ü |
|||||||||
|
application_name |
Specifies the name of an application
|
û |
ü |
ü |
|||||||||
|
tcp_window_size |
The window field in the TCP header
|
û |
ü |
ü |
|||||||||
|
viptela_vpn_id |
Private enterprise number for vIPtela Inc. (41916) |
û |
û |
ü |
Important Notes
| NetFlow v9 and v5 Timestamps: |
| The NetFlow header contains system uptime (in seconds) and an export timestamp. |
| Flow start time is derived using the following formula: |
| • | Flow_Start = Export Timestamp - System Uptime + First_Switched |
| Flow end time is derived using the following formula: |
| • | Flow_End = Export Timestamp - System Uptime + Last_Switched |
| The calculated start and end time are converted into nanoseconds. |
| Unsupported attributes such as flow start/end in milliseconds, microseconds, or nanoseconds will be ignored. Instead, the export timestamp is used as both the flow start and end times, which are then converted to nanoseconds. |
| NetFlow v10/IPFIX Timestamps: |
| NetFlow v10/IPFIX directly incorporates timestamps without the need for system uptime. |
| Even if Flow start and end timestamps are available in seconds, milliseconds, microseconds, or nanoseconds, they are always converted to nanoseconds for output. |
| Missing Flow Start/End Attributes - For records that do not include flow start or end attributes, AMX automatically assigns both values to the export timestamp. |
The image below explains how flow start and end times are calculated using system uptime, export timestamp and flow switch times.
