Skip to content

Flows model

Table Structure

SettingValue
Table Nameflows
EngineMergeTree(date, (managed_object, ts), 8192)
FieldData TypeDescription
dateDateDate
tsDateTimeCreated
managed_objectUInt64Object Name
xFloat64Longitude (Coordinates)
yFloat64Latitude (Coordinates)
versionUInt8Flow version
in_bytesUInt64Incoming octets
in_pktsUInt64Incoming packets
flowsUInt16Aggregated flows
protocolUInt8IP protocol type
src_tosUInt8Type of Service byte
tcp_flagsUInt8TCP flags cumulative byte
l4_src_portUInt8TCP/UDP src port number
ipv4_src_addrIPv4IPv4 source address
src_maskUInt8Number of mask bits in src adr
input_snmpUInt16Input interface index
ipv4_dst_portUInt8TCP/UDP dst port number
ipv4_dst_addrIPv4IPv4 destination address
dst_maskUInt8Number of mask bits in dst adr
output_snmpUInt16Output interface index
ipv4_next_hopIPv4IPv4 adr of nexthop router
src_asUInt32Src BGP AS number
dst_asUInt32Dst BGP AS number
bgp_ipv4_next_hopUInt32Nexthop router's IP in BGP domain
mul_dst_pktsUInt64IP multicast outgoing packet counter
mul_dst_bytesUInt64IP multicast outgoing packet counter
last_switchedUInt32System uptime when last pkt of flow was switched
first_switchedUInt32System uptime when last pkt of flow was switched
out_bytesUInt64Outgoing octets
out_pktsUInt64Outgoing packets
min_pkt_lngthUInt16Min IP pkt length on inc packets of flow
max_pkt_lngthUInt16Max IP pkt length on inc packets of flow
ipv6_src_addrIPv6IPv6 source address (disable)
ipv6_dst_addrIPv6IPv6 destination address (disable)
ipv6_src_maskUInt8Length of IPv6 source mask in contiguous bits (disable)
ipv6_dst_maskUInt8Length of IPv6 destination mask in contiguous bits (disable)
ipv6_flow_labelUInt32IPv6 flow label as in RFC2460 (disable)
icmp_typeUInt16ICMP packet type
mul_igmp_typeUInt8IGMP packet type
sampling_intervalUInt32Rate of sampling of packets
sampling_algorithmUInt8Type of algorithm for sampled netflow: 01 deterministic or 02 random sampling
flow_active_timeoutUInt16Timeout value in seconds for active entries in netflow cache
flow_inactive_timeoutUInt16Timeout value in seconds for inactive entries in netflow cache
engine_typeUInt8Type of flow switching engine: RP
engine_idUInt8ID number of flow switching engine
total_bytes_expUInt32Counter for bytes exported
total_pkts_expUInt32Counter for pkts exported
total_flows_expUInt32Counter for flows exported
ipv4_src_prefixUInt32IPv4 source address prefix Catalyst architecture
ipv4_dst_prefixUInt32IPv4 destination address prefix Catalyst architecture
mpls_top_label_typeUInt8MPLS top label type
mpls_top_label_ip_addrUInt32Forwarding equivalent class corresponding to MPLS top label
flow_sampler_idUInt8ID from 'show flow-sampler'
flow_sampler_modeUInt8Type of algorithm used for sampling data
flow_sampler_random_intervalUInt32Packet interval at which to sample
min_ttlUInt8Minimum TTL on incoming packets
max_ttlUInt8Maximum TTL on incoming packets
ipv4_identUInt16IPv4 identification field
dst_tosUInt8Type of Service byte setting when exiting outgoing interface
in_src_macUInt64Incoming source MAC address
out_dst_macUInt64Outcoming destination MAC address
src_vlanUInt16VLAN id associated with ingress interface
dst_vlanUInt16VLAN id associated with egress interface
ip_protocol_versionUInt8IP protocol version for IPv4 is 4 and 6 for IPv6. If none, assumed 4
directionUInt8Flow direction: 0 -- ingress, 1 -- egress flow
ipv6_next_hopIPv6IPv6 address of nexthop router (disable)
bgp_ipv6_next_hopIPv6IPv6 address of nexthop router in BGP domain (disable)
ipv6_option_headersIPv6Bit-encoded field identifying IPv6 option headers found in the flow (disable)
mpls_label1UInt32MPLS label at position 1 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label2UInt32MPLS label at position 2 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label3UInt32MPLS label at position 3 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label4UInt32MPLS label at position 4 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label5UInt32MPLS label at position 5 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label6UInt32MPLS label at position 6 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label7UInt32MPLS label at position 7 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label8UInt32MPLS label at position 8 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label9UInt32MPLS label at position 9 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
mpls_label10UInt32MPLS label at position 10 in the stack. This comprises 20 bits of MPLS label, 3 EXP experimental bits and 1 S end-of-stack bit
in_dst_macUInt64Incoming destination MAC address
out_src_macUInt64Outcoming source MAC address
if_nameStringShortened interface name i.e.: 'FE1/0'
if_descStringFull interface name i.e.: 'FastEthernet 1/0'
sampler_nameStringName of the flow sampler
in_permanent_bytesUInt32Running byte counter for a permanent flow
in_permanent_pktsUInt32Running packet counter for a permanent flow
fragment_offsetUInt16The fragment-offset value from fragmented IP packets
forwarding_statusUInt8Forwarding status is encoded on 1 byte with the 2 left bits giving the status and the 6 remaining bits giving the reason code.
mpls_pal_rdUInt64MPLS PAL Route Distinguisher
mpls_prefix_lenUInt8Number of consecutive bits in the MPLS prefix length
src_traffic_indexUInt32BGP Policy Accounting Source Traffic Index
dst_traffic_indexUInt32BGP Policy Accounting Destination Traffic Index
application_descriptionStringApplication description
application_tagUInt168 bits of engine ID, followed by n bits of classification
application_nameStringName associated with a classification
postipDiffServCodePointUInt8The value of a Differentiated Services Code Point DSCP encoded in the Differentiated Services Field, after modification
replication_factorUInt32Multicast replication factor