Verify Flow Sensor NetFlow Templates and Information Elements

Available Languages

Download Options

  • PDF     (77.9 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (86.3 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (91.7 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:April 11, 2023
Document ID:220384

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Introduction
Prerequisites
Template IDs
Standard NetFlow Elements
Enterprise-Specific Elements
Template Formats
IPv4 First Flow - Template 317
IPv4 First Flow Deep - Template 318
IPv4 Flow - Template 319
IPv4 Event - Template 320
IPv6 First Flow - Template 321
IPv6 First Flow Deep - Template 322
IPv6 Flow - Template 323
IPv6 Event - Template 324
IPv4 Source Email Counts - Template 325
IPv4 First Flow Response Time Monitoring - Template 326
IPv4 First Flow Deep Response Time Monitoring - Template 327
IPv4 Flow Response Time Monitoring - Template 328
IPv6 First Flow Response Time Monitoring - Template 329
IPv6 First Flow Deep Response Time Monitoring - Template 330
IPv6 Flow Response Time Monitoring - Template 331
IPv4 Destination Email Counts - Template 332
IPv6 Source Email Counts - Template 333
IPv6 Destination Email Counts - Template 334
IPv4 First Flow IPFIX Template 335
IPv4 First Flow Deep IPFIX - Template 336
IPv4 Flow IPFIX - Template 337
IPv4 Event IPFIX - Template 338
IPv6 First Flow IPFIX - Template 339
IPv6 First Flow Deep IPFIX - Template 340
IPv6 Flow IPFIX - Template 341
IPv6 Event IPFIX - Template 342
IPv4 Source Email Counts IPFIX - Template 343
IPv4 First Flow Response Time Monitoring - Template 344
IPv4 First Flow Deep Response Time Monitoring - Template 345
IPv4 Flow Response Time Monitoring IPFIX - Template 346
IPv6 First Flow Response Time Monitoring IPFIX - Template 347
IPv6 First Flow Deep RTM IPFIX - Template 348
IPv6 Flow Response Time Monitoring - Template 349
IPv4 Destination Email Counts IPFIX - Template 350
IPv6 Source Email Counts IPFIX - Template 351
IPv6 Destination Email Counts IPFIX - Template 352

    Introduction

    This document describes the NetFlow templates used by the Flow Sensor, this includes information such as size/format and Enterprise-specific elements

    Prerequisites

    The NetFlow element IDs used here are standard netflow protocol, however the template information and which elements included in each template are subject to change at any time.

    Template IDs

    note-icon

    Note: The templates with an asterisk (*) beside them contain the basic NetFlow v9/IPFIX fields found on the IANA list for standard flow creation and analysis.

    IPV4_FIRST_FLOW_TEMPLATE_ID							317*
IPV4_FIRST_FLOW_DEEP_TEMPLATE_ID					318*
IPV4_FLOW_TEMPLATE_ID								319*
IPV4_EVENT_TEMPLATE_ID								320
IPV6_FIRST_FLOW_TEMPLATE_ID							321*
IPV6_FIRST_FLOW_DEEP_TEMPLATE_ID					322*
IPV6_FLOW_TEMPLATE_ID								323*
IPV6_EVENT_TEMPLATE_ID								324
IPV4_SRC_EMAIL_COUNTS_TEMPLATE_ID					325
IPV4_FIRST_FLOW_RTM_TEMPLATE_ID						326*
IPV4_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID				327*
IPV4_FLOW_RTM_TEMPLATE_ID							328*
IPV6_FIRST_FLOW_RTM_TEMPLATE_ID						329*
IPV6_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID				330*
IPV6_FLOW_RTM_TEMPLATE_ID							331*
IPV4_DST_EMAIL_COUNTS_TEMPLATE_ID					332
IPV6_SRC_EMAIL_COUNTS_TEMPLATE_ID					333
IPV6_DST_EMAIL_COUNTS_TEMPLATE_ID					334
IPV4_FIRST_FLOW_IPFIX_TEMPLATE_ID					335*
IPV4_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID				336*
IPV4_FLOW_IPFIX_TEMPLATE_ID							337*
IPV4_EVENT_IPFIX_TEMPLATE_ID						338
IPV6_FIRST_FLOW_IPFIX_TEMPLATE_ID					339*
IPV6_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID				340*
IPV6_FLOW_IPFIX_TEMPLATE_ID							341*
IPV6_EVENT_IPFIX_TEMPLATE_ID						342
IPV4_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID				343
IPV4_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID				344*
IPV4_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID			345*
IPV4_FLOW_RTM_IPFIX_TEMPLATE_ID						346*
IPV6_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID				347*
IPV6_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID			348*
IPV6_FLOW_RTM_IPFIX_TEMPLATE_ID						349*
IPV4_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID				350
IPV6_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID				351
IPV6_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID				352

    Standard NetFlow Elements

    NF_F_IN_BYTES										1
NF_F_IN_PKTS										2
NF_F_PROTOCOL										4
NF_F_SRC_TOS										5
NF_F_TCP_FLAGS										6
NF_F_L4_SRC_PORT									7
NF_F_SRC_ADDR_IPV4									8
NF_F_SRC_INTF_ID									10
NF_F_L4_DST_PORT									11
NF_F_DST_ADDR_IPV4									12
NF_F_DST_INTF_ID									14
NF_F_LAST_SWITCHED									21
NF_F_FIRST_SWITCHED									22
NF_F_SRC_ADDR_IPV6									27
NF_F_DST_ADDR_IPV6									28
NF_F_MIN_TTL										52
NF_F_IN_SRC_MAC										56
NF_F_OUT_DST_MAC									57
NF_F_SRC_VLAN										58
NF_F_MPLS_LABEL_1									70
NF_F_SYSTEM_INIT_TIME_MILLISECONDS					160
NF_F_TCP_SYN_TOTAL_COUNT							218
NF_F_TCP_FIN_TOTAL_COUNT							219
NF_F_TCP_RST_TOTAL_COUNT							220
NF_F_TCP_ACK_TOTAL_COUNT							222
NF_F_IP_SECTION_HEADER								313
NF_F_IP_SECTION_PAYLOAD								314

    Enterprise-Specific Elements

    note-icon

    Note: The Flow Sensor uses Lancope Information Element Identifier Definitions: Private Enterprise Number (PEN) - 8712

    More information about these elements is available in the Secure Analytics Information Elements guide

    NF_F_FLOWSENSOR_INITIATOR							29794
NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT				29795
NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT					29796
NF_F_FLOWSENSOR_RTT									29797
NF_F_FLOWSENSOR_SVR_RESP							29798
NF_F_FLOWSENSOR_RETRANSMITS							29799
NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT					29800
NF_F_FLOWSENSOR_TCP_FRAG_TOTAL_COUNT				29801
NF_F_FLOWSENSOR_SRC_EMAIL_IN						29802
NF_F_FLOWSENSOR_SRC_EMAIL_OUT						29803
NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS					29804
NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS					29805
NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS					29806
NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS					29807
NF_F_FLOWSENSOR_DST_EMAIL_IN						29808
NF_F_FLOWSENSOR_DST_EMAIL_OUT						29809
NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS					29810
NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS					29811
NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS					29812
NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS					29813
NF_F_FLOWSENSOR_TRACES								29814
NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL					29817
NF_F_FLOWSENSOR_EMB_ICMP_TYPE						29818
NF_F_FLOWSENSOR_EMB_ICMP_CODE						29819
NF_F_FLOWSENSOR_APPLICATION_ID						29820
NF_F_FLOWSENSOR_BAD_FLAG_XMAS						29821
NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN					29822
NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST					29823
NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK						29824
NF_F_FLOWSENSOR_BAD_FLAG_URG						29825
NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG						29826
NF_F_FLOWSENSOR_BAD_TCP_PROBE						29827
NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK					29828
NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT					29829
NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG					29830
NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES				29831
NF_F_FLOWSENSOR_APPLICATION_DETAILS					29832

    Template Formats

    note-icon

    Note: Each template includes the Template Name and field count, followed by the individual NetFlow/IPFIX fields and the size of each field (in bytes).

    Note that Enterprise-specific IPFIX elements are ored with 0x8000 to turn on the high bit, so the collector knows that the Private Enterprise Number (PEN) field is present.

    An example with NetFlow v9 and Enterprise-specific IPFIX elements is included.

    TEMPLATE_NAME, ## <-- Field Count (Total number of NF_F fields in the template)
	FIELD_NAME_V9, # <-- Field size (in bytes)
	ENTERPRISE_FIELD_NAME_IPFIX | 0x8000, # <-- Field size (in bytes)
	0000, 8712 <-- Private Enterprise Number (PEN)

    IPv4 First Flow - Template 317

    note-icon

    Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine.

    IPV4_FIRST_FLOW_TEMPLATE_ID, 31
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv4 First Flow Deep - Template 318

    note-icon

    Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

    IPV4_FIRST_FLOW_DEEP_TEMPLATE_ID, 33
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv4 Flow - Template 319

    note-icon

    Note: This template is used for follow-on v9 exports of IPv4 flow information from a flow slot in the Flow Sensor engine.

    IPV4_FLOW_TEMPLATE_ID, 25
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv4 Event - Template 320

    note-icon

    Note: This template is used for v9 exports of IPv4 bad fragment and flag combination counts detected by the Flow Sensor engine.

    IPV4_EVENT_TEMPLATE_ID, 18
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_PROTOCOL, 1
	NF_F_FLOWSENSOR_BAD_FLAG_XMAS, 2
	NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN, 2
	NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST, 2
	NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK, 2
	NF_F_FLOWSENSOR_BAD_FLAG_URG, 2
	NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG, 2
	NF_F_FLOWSENSOR_BAD_TCP_PROBE, 2
	NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK, 2
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT, 2
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG, 2
	NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES, 2

    IPv6 First Flow - Template 321

    note-icon

    Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine.

    IPV6_FIRST_FLOW_TEMPLATE_ID, 31
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv6 First Flow Deep - Template 322

    note-icon

    Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

    IPV6_FIRST_FLOW_DEEP_TEMPLATE_ID, 33
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv6 Flow - Template 323

    note-icon

    Note: This template is used for follow-on v9 exports of IPv6 flow information from a flow slot in the Flow Sensor engine.

    IPV6_FLOW_TEMPLATE_ID, 25
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv6 Event - Template 324

    note-icon

    Note: This template is used for v9 exports of IPv6 bad fragment and flag combination counts detected by the Flow Sensor engine.

    IPV6_EVENT_TEMPLATE_ID, 18
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_PROTOCOL, 1
	NF_F_FLOWSENSOR_BAD_FLAG_XMAS, 2
	NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN, 2
	NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST, 2
	NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK, 2
	NF_F_FLOWSENSOR_BAD_FLAG_URG, 2
	NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG, 2
	NF_F_FLOWSENSOR_BAD_TCP_PROBE, 2
	NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK, 2
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT, 2
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG, 2
	NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES, 2

    IPv4 Source Email Counts - Template 325

    note-icon

    Note: This template is used for v9 exports of IPv4 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

    IPV4_SRC_EMAIL_COUNTS_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_IN, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS, 4

    IPv4 First Flow Response Time Monitoring - Template 326

    note-icon

    Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV4_FIRST_FLOW_RTM_TEMPLATE_ID, 34
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_RTT, 4
	NF_F_FLOWSENSOR_SVR_RESP, 4
	NF_F_FLOWSENSOR_RETRANSMITS, 2
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv4 First Flow Deep Response Time Monitoring - Template 327

    note-icon

    Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected and RTM data has been computed.

    IPV4_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID, 36
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_RTT, 4
	NF_F_FLOWSENSOR_SVR_RESP, 4
	NF_F_FLOWSENSOR_RETRANSMITS, 2
	NF_F_FLOWSENSOR_APPLICATION_ID, 4


    IPv4 Flow Response Time Monitoring - Template 328

    note-icon

    Note: This template is used for follow-on v9 exports of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV4_FLOW_RTM_TEMPLATE_ID, 28
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_RTT, 4
	NF_F_FLOWSENSOR_SVR_RESP, 4
	NF_F_FLOWSENSOR_RETRANSMITS, 2
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv6 First Flow Response Time Monitoring - Template 329

    note-icon

    Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV6_FIRST_FLOW_RTM_TEMPLATE_ID, 34
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_RTT, 4
	NF_F_FLOWSENSOR_SVR_RESP, 4
	NF_F_FLOWSENSOR_RETRANSMITS, 2
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv6 First Flow Deep Response Time Monitoring - Template 330

    note-icon

    Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected and RTM data has been computed.

    IPV6_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID, 36
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_RTT, 4
	NF_F_FLOWSENSOR_SVR_RESP, 4
	NF_F_FLOWSENSOR_RETRANSMITS, 2
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv6 Flow Response Time Monitoring - Template 331

    note-icon

    Note: This template is used for follow-on v9 exports of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV6_FLOW_RTM_TEMPLATE_ID, 28
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TRACES, 2
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1
	NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1
	NF_F_FLOWSENSOR_RTT, 4
	NF_F_FLOWSENSOR_SVR_RESP, 4
	NF_F_FLOWSENSOR_RETRANSMITS, 2
	NF_F_FLOWSENSOR_APPLICATION_ID, 4

    IPv4 Destination Email Counts - Template 332

    note-icon

    Note: This template is used for v9 exports of IPv4 email counts information received by the destination IP address as detected by the Flow Sensor engine.

    IPV4_DST_EMAIL_COUNTS_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_FLOWSENSOR_DST_EMAIL_IN, 4
	NF_F_FLOWSENSOR_DST_EMAIL_OUT, 4
	NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS, 4
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS, 4
	NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS, 4
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS, 4

    IPv6 Source Email Counts - Template 333

    note-icon

    Note: This template is used for v9 exports of IPv6 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

    IPV6_SRC_EMAIL_COUNTS_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_FLOWSENSOR_SRC_EMAIL_IN, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS, 4

    IPv6 Destination Email Counts - Template 334

    note-icon

    Note: This template is used for v9 exports of IPv6 email counts information received by the destination IP address as detected by the Flow Sensor engine.

    IPV6_DST_EMAIL_COUNTS_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_FLOWSENSOR_DST_EMAIL_IN, 4
	NF_F_FLOWSENSOR_DST_EMAIL_OUT, 4
	NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS, 4
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS, 4
	NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS, 4
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS, 4

    IPv4 First Flow IPFIX Template 335

    note-icon

    Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine.

    IPV4_FIRST_FLOW_IPFIX_TEMPLATE_ID, 33
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv4 First Flow Deep IPFIX - Template 336

    note-icon

    Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

    IPV4_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID, 35
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv4 Flow IPFIX - Template 337

    note-icon

    Note: This template is used for follow-on IPFIX exports of IPv4 flow information from a flow slot in the Flow Sensor engine.

    IPV4_FLOW_IPFIX_TEMPLATE_ID, 27
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv4 Event IPFIX - Template 338

    note-icon

    Note: This template is used for IPFIX exports of IPv4 bad fragment and flag combination counts detected by the Flow Sensor engine.

    IPV4_EVENT_IPFIX_TEMPLATE_ID, 19
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_PROTOCOL, 1
	NF_F_FLOWSENSOR_BAD_FLAG_XMAS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_URG | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_TCP_PROBE | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES | 0x8000, 2
	0000, 8712

    IPv6 First Flow IPFIX - Template 339

    note-icon

    Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine.

    IPV6_FIRST_FLOW_IPFIX_TEMPLATE_ID, 33
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv6 First Flow Deep IPFIX - Template 340

    note-icon

    Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

    IPV6_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID, 35
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv6 Flow IPFIX - Template 341

    note-icon

    Note: This template is used for follow-on IPFIX exports of IPv6 flow information from a flow slot in the Flow Sensor engine.

    IPV6_FLOW_IPFIX_TEMPLATE_ID, 27
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv6 Event IPFIX - Template 342

    note-icon

    Note: This template is used for IPFIX exports of IPv6 bad fragment and flag combination counts detected by the Flow Sensor engine.

    IPV6_EVENT_IPFIX_TEMPLATE_ID, 19
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_PROTOCOL, 1
	NF_F_FLOWSENSOR_BAD_FLAG_XMAS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_URG | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_BAD_TCP_PROBE | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES | 0x8000, 2
	0000, 8712

    IPv4 Source Email Counts IPFIX - Template 343

    note-icon

    Note: This template is used for IPFIX exports of IPv4 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

    IPV4_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_FLOWSENSOR_SRC_EMAIL_IN | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS | 0x8000, 4
	0000, 8712

    IPv4 First Flow Response Time Monitoring - Template 344

    note-icon

    Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV4_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID, 36
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_RTT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv4 First Flow Deep Response Time Monitoring - Template 345

    note-icon

    Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

    IPV4_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID, 38
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_RTT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv4 Flow Response Time Monitoring IPFIX - Template 346

    note-icon

    Note: This template is used for follow-on IPFIX exports of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV4_FLOW_RTM_IPFIX_TEMPLATE_ID, 30
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_RTT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv6 First Flow Response Time Monitoring IPFIX - Template 347

    note-icon

    Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV6_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID, 36
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_RTT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv6 First Flow Deep RTM IPFIX - Template 348

    note-icon

    Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

    IPV6_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID, 38
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_SRC_MAC, 6
	NF_F_OUT_DST_MAC, 6
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_SRC_VLAN, 2
	NF_F_MPLS_LABEL_1, 3
	NF_F_MIN_TTL, 1
	NF_F_SRC_TOS, 1
	NF_F_IP_SECTION_HEADER, 64
	NF_F_IP_SECTION_PAYLOAD, 26
	NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1
	0000, 8712
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_RTT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv6 Flow Response Time Monitoring - Template 349

    note-icon

    Note: This template is used for follow-on IPFIX exports of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

    IPV6_FLOW_RTM_IPFIX_TEMPLATE_ID, 30
	NF_F_FIRST_SWITCHED, 4
	NF_F_LAST_SWITCHED, 4
	NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_L4_SRC_PORT, 2
	NF_F_L4_DST_PORT, 2
	NF_F_IN_BYTES, 4
	NF_F_IN_PKTS, 4
	NF_F_SRC_INTF_ID, 2
	NF_F_DST_INTF_ID, 2
	NF_F_PROTOCOL, 1
	NF_F_TCP_FLAGS, 1
	NF_F_MIN_TTL, 1
	NF_F_TCP_SYN_TOTAL_COUNT, 2
	NF_F_TCP_ACK_TOTAL_COUNT, 2
	NF_F_TCP_FIN_TOTAL_COUNT, 2
	NF_F_TCP_RST_TOTAL_COUNT, 2
	NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_TRACES | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1
	0000, 8712
	NF_F_FLOWSENSOR_RTT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535
	0000, 8712

    IPv4 Destination Email Counts IPFIX - Template 350

    note-icon

    Note: This template is used for IPFIX exports of IPv4 email counts information received by the destination IP address as detected by the Flow Sensor engine.

    IPV4_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV4, 4
	NF_F_DST_ADDR_IPV4, 4
	NF_F_FLOWSENSOR_DST_EMAIL_IN | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_OUT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS | 0x8000, 4
	0000, 8712

    IPv6 Source Email Counts IPFIX - Template 351

    note-icon

    Note: This template is used for IPFIX exports of IPv6 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

    IPV6_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_FLOWSENSOR_SRC_EMAIL_IN | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS | 0x8000, 4
	0000, 8712

    IPv6 Destination Email Counts IPFIX - Template 352

    note-icon

    Note: This template is used for IPFIX exports of IPv6 email counts information received by the destination IP address as detected by the Flow Sensor engine.

    IPV6_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8
	NF_F_SRC_ADDR_IPV6, 16
	NF_F_DST_ADDR_IPV6, 16
	NF_F_FLOWSENSOR_DST_EMAIL_IN | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_OUT | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS | 0x8000, 4
	0000, 8712
	NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS | 0x8000, 4
	0000, 8712

    Revision History

    Revision Publish Date Comments
    1.0
    11-Apr-2023
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • John Henline
      SNA TAC
    • Kevin Bartoletta
      SNA TAC
    • Matthew Robbins
      SNA TAC

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products