Re: NetFlow export packet formats

From: Mark Fullmer (maf@eng.oar.net)
Date: Wed Jun 13 2001 - 11:40:06 EDT


On Tue, Jun 12, 2001 at 09:00:12PM -0500, Stephen Gill wrote:
> I believe each vendor may use their own implementation of cflowd v8
> aggregates to conserve output. From Cisco's website at:
> http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm

What you're calling cflowd8 v8 aggregates are really Cisco NetFlow
packet formats.

With an export version 8 (aggregated flows) method 1 (AS aggregation) packet
Cisco sets the agg_version field to 2. Juniper sets it to 0.

What I need to know is if Juniper is really using exactly the same
export formats as Cisco has defined and just forgot to set the
agg_version to 2, or if Juniper's agg_version 0 is different from
Cisco's agg_version 2.

mark



This archive was generated by hypermail 2b29 : Mon Aug 05 2002 - 10:42:36 EDT