1<METHOD>flat</> 2<#INCLUDE#>ip.map</> 3<FLAT> 4 <NAME>netflow-cflow</> 5 <DESCRIPTION>netflow cflow.</> 6 <IDENT>@(#)$Id: netflow-cflow txt (AT&T Labs Research) 2006-02-07 $</> 7 <LIBRARY>ip_t</> 8 <LIBRARY>time_t</> 9 <PRINT>%(flowid)s %(linkid)s %(src_addr)s %(dst_addr)s %(packets)s %(bytes)s %(start:%K)s %(end:%K)s %(src_port)s %(dst_port)s %(tcpflags)s %(protocol)s</> 10 <FIELD> 11 <NAME>flowid</> 12 <DESCRIPTION>flow identifier</> 13 <TYPE>string</> 14 <PHYSICAL> 15 <DELIMITER>|</> 16 </> 17 </> 18 <FIELD> 19 <NAME>NA_1</> 20 <DESCRIPTION>not used</> 21 <TYPE>string</> 22 <PHYSICAL> 23 <DELIMITER>|</> 24 </> 25 </> 26 <FIELD> 27 <NAME>NA_2</> 28 <DESCRIPTION>not used</> 29 <TYPE>string</> 30 <PHYSICAL> 31 <DELIMITER>|</> 32 </> 33 </> 34 <FIELD> 35 <NAME>linkid</> 36 <DESCRIPTION>link id</> 37 <TYPE>string</> 38 <PHYSICAL> 39 <DELIMITER>|</> 40 </> 41 </> 42 <FIELD> 43 <NAME>src_addr</> 44 <DESCRIPTION>source IP address</> 45 <TYPE>ipaddr_t</> 46 <PHYSICAL> 47 <DELIMITER>|</> 48 </> 49 </> 50 <FIELD> 51 <NAME>dst_addr</> 52 <DESCRIPTION>destination IP address</> 53 <TYPE>ipaddr_t</> 54 <PHYSICAL> 55 <DELIMITER>|</> 56 </> 57 </> 58 <FIELD> 59 <NAME>packets</> 60 <DESCRIPTION>number of packets</> 61 <TYPE>number</> 62 <PHYSICAL> 63 <DELIMITER>|</> 64 </> 65 </> 66 <FIELD> 67 <NAME>bytes</> 68 <DESCRIPTION>number of bytes</> 69 <TYPE>number</> 70 <PHYSICAL> 71 <DELIMITER>|</> 72 </> 73 </> 74 <FIELD> 75 <NAME>start</> 76 <DESCRIPTION>start of the flow in seconds since the epoch</> 77 <TYPE>time_t</> 78 <PHYSICAL> 79 <DELIMITER>|</> 80 </> 81 </> 82 <FIELD> 83 <NAME>end</> 84 <DESCRIPTION>end of the flow in seconds since the epoch</> 85 <TYPE>time_t</> 86 <PHYSICAL> 87 <DELIMITER>|</> 88 </> 89 </> 90 <FIELD> 91 <NAME>src_port</> 92 <DESCRIPTION>source port</> 93 <TYPE>number</> 94 <PHYSICAL> 95 <DELIMITER>|</> 96 </> 97 </> 98 <FIELD> 99 <NAME>dst_port</> 100 <DESCRIPTION>dst_ination IP port</> 101 <TYPE>number</> 102 <PHYSICAL> 103 <DELIMITER>|</> 104 </> 105 </> 106 <FIELD> 107 <NAME>tcpflags</> 108 <DESCRIPTION>tcp flags</> 109 <TYPE>number</> 110 <MAP>ipflags</> 111 <PHYSICAL> 112 <DELIMITER>|</> 113 </> 114 </> 115 <FIELD> 116 <NAME>protocol</> 117 <DESCRIPTION>protocol of the flow</> 118 <TYPE>number</> 119 <MAP>ipprotocol</> 120 <PHYSICAL> 121 <DELIMITER>|</> 122 </> 123 </> 124 <FIELD> 125 <NAME>NA_3</> 126 <DESCRIPTION>not used</> 127 <TYPE>string</> 128 <PHYSICAL> 129 <DELIMITER>|</> 130 </> 131 </> 132 <FIELD> 133 <NAME>NA_4</> 134 <DESCRIPTION>not used</> 135 <TYPE>string</> 136 <PHYSICAL> 137 <DELIMITER>&newline;</> 138 </> 139 </> 140</> 141