Flow statistics

Overview

This section describes the format of the CGNAT Cflowd records that an NSP Flow Collector generates using 7750 SR Cflowd IPFIX data as input.

For each IPFIX CGNAT session record, an NSP Flow Collector produces a raw output record in CSV format. The input IPFIX records have varying numbers of fields, depending on the format; a CSV-formatted output record includes all fields from all formats. A field that is absent from an input record is treated as follows in the associated CSV record:

CSV file naming convention

A CGNAT Cflowd CSV file is named as follows, using hyphen-separated elements:

MODE-NAT_SESSION_TYPE-AGG_RAW-Nsource_IP-internal_ID-template-IPv-Iinterval-Ttimestamp-V7.csv

where

MODE is the Flow Collector mode, which is SYS or AA

TYPE is the NAT data type, which is START or END

source_IP is the system IP address of the source NE

internal_ID is an internal identifier that is not relevant to third-party processing

template is the template ID

v is the flow IP version

interval is the collection interval, in seconds

timestamp is the UNIX time of the collection interval start, in seconds

Filename examples

The following is a session-start filename example:

SYS-NAT_SESSION_START-AGG_RAW-N203.0.113.3-Og0s0m0x2-X256-IP4-I60-T1555440480-V7.csv

The following is a session-end filename example:

SYS-NAT_SESSION_END-AGG_RAW-N203.0.113.3-Og0s0m0x2-X257-IP4-I60-T1555440480-V7.csv

CSV record format

The following subsections describe the NAT session-start and session-end CSV record formats, which are the following:

Each record includes all fields from each format. A Comment entry states which formats include a field; no comment means that the field is present in each format.

Note: A numeric field that is absent from a format is populated with a zero value, and a string field that is absent contains no value.

CGNAT session-start record

The following table lists, in sequential order, the fields in a CGNAT session-start CSV record.

Field

IPFIX field

Data type

Comment

1

FLOW_ID

Long integer

2

SOURCE_IPV4_ADDRESS

IPv4 address

Format 1

3

POST_NAT_SOURCE_IPV4_ADDRESS

IPv4 address

Format 2; replaces Format 1 SOURCE_IPV4_ADDRESS

4

DESTINATION_IPV4_ADDRESS

IPv4 address

5

SOURCE_TRANSPORT_PORT

Unsigned short integer

6

POST_NAPT_SOURCE_TRANSPORT_PORT

Unsigned short integer

Format 2

7

DESTINATION_TRANSPORT_PORT

Unsigned short integer

8

FLOW_START_MILLISECONDS

Long integer

9

PROTOCOL_IDENTIFIER

Unsigned byte

10

NAT_INSIDE_SVC_ID

Unsigned short integer

11

NAT_OUTSIDE_SVC_ID

Unsigned short integer

12

NAT_SUBSTRING

String

CGNAT session-end record

The following table lists, in sequential order, the fields in a CGNAT session-end CSV record.

Field

IPFIX field

Data type

Comment

1

FLOW_ID

Long integer

2

SOURCE_IPV4_ADDRESS

IPv4 address

Format 1

3

POST_NAT_SOURCE_IPV4_ADDRESS

IPv4 address

Format 2; replaces Format 1 SOURCE_IPV4_ADDRESS

4

DESTINATION_IPV4_ADDRESS

IPv4 address

5

SOURCE_TRANSPORT_PORT

Unsigned short integer

6

POST_NAPT_SOURCE_TRANSPORT_PORT

Unsigned short integer

Format 2

7

DESTINATION_TRANSPORT_PORT

Unsigned short integer

8

FLOW_END_MILLISECONDS

Long integer

9

PROTOCOL_IDENTIFIER

Unsigned byte

10

FLOW_END_REASON

Unsigned byte

11

NAT_INSIDE_SVC_ID

Unsigned short integer

12

NAT_OUTSIDE_SVC_ID

Unsigned short integer

13

NAT_SUBSTRING

String