NetFlow v5/7
- Last Updated: April 5, 2026
- 2 minute read
- Flowmon Products
- Flowmon
- Documentation
Note:
When you configure a monitoring port to use NetFlow version 5 as its export protocol, fields marked as "Exported by default" are automatically included in the export.
| Name | Description | Input Length (bytes) | Probe Configuration | Collector Configuration |
|---|---|---|---|---|
| srcaddr | Source IP address. | 4 | Exported by default | Collected by default |
| dstaddr | Destination IP address. | 4 | Exported by default | Collected by default |
| nexthop | IP address of next hop router. | 4 | Not applicable | Enabled by Next HOP IP address |
| input | SNMP index of input interface. | 2 | Exported by default | Collected by default |
| output | SNMP index of output interface. | 2 | Exported by default Always set to 0 |
Collected by default |
| dPkts | Packets in the flow. | 4 | Exported by default | Collected by default |
| dOctets | Total number of Layer 3 bytes in the packets of the flow. | 4 | Exported by default | Collected by default |
| First | SysUptime at start of flow. | 4 | Exported by default | Collected by default |
| Last | SysUptime at the time the last packet of the flow was received. | 4 | Exported by default | Collected by default |
| srcport | TCP/UDP source port number or equivalent. | 2 | Exported by default | Collected by default |
| dstport | TCP/UDP destination port number or equivalent. | 2 | Exported by default | Collected by default |
| tcp_flags | Cumulative OR of TCP flags. | 1 | Exported by default | Collected by default |
| prot | IP protocol type (for example, TCP = 6; UDP = 17). | 1 | Exported by default | Collected by default |
| tos | IP type of service (ToS). | 1 | Exported by default | Collected by default |
| src_as | Autonomous system number of the source, either origin or peer. | 2 | Enabled by Use autonomous system list |
Collected by default |
| dst_as | Autonomous system number of the destination, either origin or peer. | 2 | Enabled by Use autonomous system list |
Collected by default |
| src_mask | Source address prefix mask bits. | 1 | Not supported | Enabled by SRC/DST mask, (dst) TOS, Direction |
| dst_mask | Destination address prefix mask bits. | 1 | Not supported | Enabled by SRC/DST mask, (dst) TOS, Direction |
router_sc (NetFlow v7 only) |
IP address of the router that is bypassed by the Catalyst 5000 series switch. This is the same address the router uses when it sends NetFlow export packets. This IP address is propagated to all switches bypassing the router through the FCP protocol. | 4 | Not applicable | Collected by default |