Submit a ticketCall us

Announcing NCM 7.7
With NCM 7.7, you can examine the rules that make up an access control list for a Cisco ASA device. Then you can apply filters to display only rules that meet the specified criteria, order the rules by line number or by the hit count, and much more.
See new features and improvements.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA 4.2.3 Administrator Guide > NTA Installation > Sampled flow supported fields

Sampled flow supported fields

If you are using sampled flows, packets need to contain not only the fields mentioned in Required fields on page 1, but also fields supported by SolarWinds NTA for sampled flows. Supported fields depend on the flow version used.

Sampling mode has to be non-zero, otherwise SolarWinds NTA processes flows as non-sampled.

If some of the required fields are missing on your device or contain unexpected values, please contact your device vendor.

NetFlow v5 and J-Flow v5 header format

NTA supports the following bytes in the v5 header format:

Bytes Contents Description
22-23 sampling_interval First two bits hold the sampling mode; remaining 14 bits hold value of sampling interval.

For more information, search for NetFlow export datagram format on www.cisco.com.

NetFlow v9 and J-Flow v9

Supported fields depend on the template you are using:

  • Flow template
  • Option template

Flow template

The following fields are optional for the Flow Template Schema. It is enough if the template includes one of the fields in each group.

If at least one from each group is not included in the template, NTA will still be able to store flows. However, a default value will be stored, and appropriate resources will show the "No Data" message.

Field Type Field Type Number Description

Sampling Interval Group

SamplingInterval 34 When using sampled NetFlow, the rate at which packets are sampled, for example, a value of 100 indicates that one of every 100 packets is sampled.
SamplerInterval 50 Packet interval at which to sample.

Sampling Algorithm Group

SamplingAlgorithm 35 The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling, 0x02 Random Sampling
SamplerMode 49 The type of algorithm used for sampling data: 0x02 random sampling.

Option template

Mandatory fields

If you are using the Option Flow Template, make sure at least one field from each group is included. Otherwise, flow data cannot be stored.

Field Type Field Type Number Description

Sampling Interval Group

SamplingInterval 34 When using sampled NetFlow, the rate at which packets are sampled, for example, a value of 100 indicates that one of every 100 packets is sampled.
SamplerInterval 34 Packet interval at which to sample.

Sampling Algorithm Group

SamplingAlgorithm 35 The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling, 0x02 Random Sampling.
SamplerMode 35 The type of algorithm used for sampling data: 0x02 random sampling.

SamplerID

If the SamplerID isn't included in the options flow template, a default value will be stored, and appropriate resources will display "No Data".

SamplerID 48 Identifier shown in show flow-sampler.

For more information, search for NetFlow version 9 flow record format

 

 
Last modified
07:51, 10 Apr 2017

Tags

Classifications

Public