In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX?
I'm shipping IPFIX data with softflowd and I'm getting these fields:
destinationIPv4Address
destinationTransportPort
egressInterface
flowEndMilliseconds
flowStartMilliseconds
icmpTypeCodeIPv4
ingressInterface
ipClassOfService
ipVersion
octetDeltaCount
packetDeltaCount
protocolIdentifier
sourceIPv4Address
sourceTransportPort
tcpControlBits
version
vlanId
Is octetDeltaCount and packetDeltaCount the equivalent of in_bytes and in_pkts?
Best Answer
IPFIX is defined in RFC 7011, Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. Much of what you do or do not have in your records is up to the specific implementation. Your application is off-topic, but if you look at Appendix A. IPFIX Encoding Examples, it will give you some example templates, and the meanings of the fields for those templates. For example: