Submit a ticketCall us

Solarwinds & Cisco Live! Barcelona
Join us from the 29th of January to the 2nd of February at Cisco Live 2018 in Barcelona, where we will continue to show how monitoring the network with SolarWinds will keep you ahead of the game. At our booth (WEP 1A), we will demonstrate how SolarWinds network solutions can help. As a bonus, we are also hosting a pre-event webinar - Blame the Network, Hybrid IT Edition with our SolarWinds Head Geek™, Patrick Hubbard on January 24th - GMT (UTC+0): 10:00 a.m. to 11:00 a.m. There's still time to RSVP.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Required Flow template fields in NTA

Required Flow template fields in NTA

Table of contents

Updated June 22nd, 2016


This article discusses the required Flow template fields in NTA. Flow packets will be ignored if the required fields are not included in the Flow template.


All NTA versions


Field Type Field Type Number Description
IN_BYTES 1 Ingress bytes counter
IN_PKTS 2 Ingress packets counter
PROTOCOL 4 Layer 4 protocol
L4_SRC_PORT 7 Source TCP/UDP port
IPV4_SRC_ADDR 8 Source IP address
INPUT_SNMP 10 SNMP ingress interface index
L4_DST_PORT 11 Destination TCP/UDP port
IPV4_DST_ADDR 12 Destination IP address
OUTPUT_SNMP 14 SNMP egress interface index


  • The NetFlow v9 specification indicates that templates may be configurable on a device-by-device basis. However, most devices have a set of static templates to which exported flows conform. When SolarWinds states that a device is supported by Orion NTA, SolarWinds has determined that at least one of the templates the device is capable of exporting will satisfy the Orion NTA requirements. For more information, see the Cisco white paper, NetFlow Version 9 Flow-Record Format.
  • Only one interface index is absolutely required, but both interface indexes (INPUT_SNMP and OUTPUT_SNMP) should be provided to view accurate statistics for both ingress and egress flows.
  • The SRC_TOS field corresponding to the service type of ingress traffic on an interface (field type number 5) is required to view Type of Service information for your traffic through a Flow source. The templates used by Cisco 4500 series switches and Adaptive Security Appliances (ASA) do not provide information in this field.
  • Cisco 4500 series switches do not provide information for the TCP_FLAGS field (field type number 6) corresponding to a count of all TCP flags seen in the related Flow.
  • Cisco Adaptive Security Appliances (ASA) are capable of providing Flow data using a limited template based on the NetFlow v9 template.


Last modified