Flow statistics
Overview
This section describes the format of the CGNAT Cflowd records that an NSP Flow Collector generates using 7750 SR Cflowd IPFIX data as input.
For each IPFIX CGNAT session record, an NSP Flow Collector produces a raw output record in CSV format. The input IPFIX records have varying numbers of fields, depending on the format; a CSV-formatted output record includes all fields from all formats. A field that is absent from an input record is treated as follows in the associated CSV record:
CSV file naming convention
A CGNAT Cflowd CSV file is named as follows, using hyphen-separated elements:
MODE-NAT_SESSION_TYPE-AGG_RAW-Nsource_IP-internal_ID-template-IPv-Iinterval-Ttimestamp-V7.csv
where
MODE is the Flow Collector mode, which is SYS or AA
TYPE is the NAT data type, which is START or END
source_IP is the system IP address of the source NE
internal_ID is an internal identifier that is not relevant to third-party processing
template is the template ID
v is the flow IP version
interval is the collection interval, in seconds
timestamp is the UNIX time of the collection interval start, in seconds
Filename examples
The following is a session-start filename example:
SYS-NAT_SESSION_START-AGG_RAW-N203.0.113.3-Og0s0m0x2-X256-IP4-I60-T1555440480-V7.csv
The following is a session-end filename example:
SYS-NAT_SESSION_END-AGG_RAW-N203.0.113.3-Og0s0m0x2-X257-IP4-I60-T1555440480-V7.csv
CSV record format
The following subsections describe the NAT session-start and session-end CSV record formats, which are the following:
Each record includes all fields from each format. A Comment entry states which formats include a field; no comment means that the field is present in each format.
Note: A numeric field that is absent from a format is populated with a zero value, and a string field that is absent contains no value.
CGNAT session-start record
The following table lists, in sequential order, the fields in a CGNAT session-start CSV record.
|
Field |
IPFIX field |
Data type |
Comment |
|---|---|---|---|
|
1 |
FLOW_ID |
Long integer |
— |
|
2 |
SOURCE_IPV4_ADDRESS |
IPv4 address |
Format 1 |
|
3 |
POST_NAT_SOURCE_IPV4_ADDRESS |
IPv4 address |
Format 2; replaces Format 1 SOURCE_IPV4_ADDRESS |
|
4 |
DESTINATION_IPV4_ADDRESS |
IPv4 address |
— |
|
5 |
SOURCE_TRANSPORT_PORT |
Unsigned short integer |
— |
|
6 |
POST_NAPT_SOURCE_TRANSPORT_PORT |
Unsigned short integer |
Format 2 |
|
7 |
DESTINATION_TRANSPORT_PORT |
Unsigned short integer |
— |
|
8 |
FLOW_START_MILLISECONDS |
Long integer |
— |
|
9 |
PROTOCOL_IDENTIFIER |
Unsigned byte |
— |
|
10 |
NAT_INSIDE_SVC_ID |
Unsigned short integer |
— |
|
11 |
NAT_OUTSIDE_SVC_ID |
Unsigned short integer |
— |
|
12 |
NAT_SUBSTRING |
String |
— |
CGNAT session-end record
The following table lists, in sequential order, the fields in a CGNAT session-end CSV record.
|
Field |
IPFIX field |
Data type |
Comment |
|---|---|---|---|
|
1 |
FLOW_ID |
Long integer |
— |
|
2 |
SOURCE_IPV4_ADDRESS |
IPv4 address |
Format 1 |
|
3 |
POST_NAT_SOURCE_IPV4_ADDRESS |
IPv4 address |
Format 2; replaces Format 1 SOURCE_IPV4_ADDRESS |
|
4 |
DESTINATION_IPV4_ADDRESS |
IPv4 address |
— |
|
5 |
SOURCE_TRANSPORT_PORT |
Unsigned short integer |
— |
|
6 |
POST_NAPT_SOURCE_TRANSPORT_PORT |
Unsigned short integer |
Format 2 |
|
7 |
DESTINATION_TRANSPORT_PORT |
Unsigned short integer |
— |
|
8 |
FLOW_END_MILLISECONDS |
Long integer |
— |
|
9 |
PROTOCOL_IDENTIFIER |
Unsigned byte |
— |
|
10 |
FLOW_END_REASON |
Unsigned byte |
— |
|
11 |
NAT_INSIDE_SVC_ID |
Unsigned short integer |
— |
|
12 |
NAT_OUTSIDE_SVC_ID |
Unsigned short integer |
— |
|
13 |
NAT_SUBSTRING |
String |
— |