Skip to main content

FlowGens

Counts the NetFlow, IPFIX and sFlow traffic reported by each flow exporter (router, switch or firewall), keyed by the exporter's IPv4 address.

PropertyValue
GUID{2314BB8E-2BCC-4B86-8AA2-677E5554C0FE}
LayerFlow Record
InputFlows
Key typeIPv4 address of the flow exporter
ImplementationNative C++ — CPICGNetflowGen (trisul_probe/sysplugs/flowhandlers/PICGNetflowGen.cpp); updated by CPINetflowMeter and CPISFlowMeter
Bucket / Topper60 s / 300 s
Enabled by defaultYes

What it measures​

  • NetFlow v1/v5/v9 and IPFIX: the key is the source IP of the UDP export packet. The probe updates the key once per export packet, after it has processed every record in that packet.
  • sFlow: the key is the agent address inside the sFlow datagram, not the UDP source. The probe updates the key once per flow sample.
  • Byte counts are multiplied by the sampling rate. The rate comes from the record, from the SamplingRates section of the NetFlow config, or from the sFlow meanSkipCount.
  • Total, Flow Records and the IPv4/IPv6 meters count only records that pass the corruption check and every configured filter (interface, host, ASN, application). The version and record-type meters (7–14) count every record the probe parses.
  • MeterNetflowSources (default TRUE) in the NetFlow config turns this group on or off. In IPDR mode (AppMode=ipdr) the group is always on.

Keys​

One key per flow exporter.

KeyMeaning
C0.A8.01.01Exporter 192.168.1.1
CB.00.71.01Exporter 203.0.113.1
0A.00.00.FEExporter 10.0.0.254

The UI shows the dotted IPv4 address, or a name if you assign one. To name routers from SNMP, use SNMP resolve router and interface name (see Using SNMP).

The probe sets these key attributes on each exporter key:

AttributeMeaning
netflow.feed_typeComma-separated feed types seen: NFv1, NFv5, NFv9, IPFIX, SFLOW.
netflow.sampling_rateSampling rate learned from template field 34 or 50 (SAMPLING_INTERVAL, FLOW_SAMPLER_RANDOM_INTERVAL).

The SNMP credentials you enter under Netflow → Routers and Interfaces → SNMP Settings are also stored as snmp.* attributes on these keys. The SNMP Poller app reads them from here.

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. Each record updates exactly one exporter key, so Total here equals the flow traffic from all exporters.

Meter list​

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Sum of sampling-adjusted byte counts in the records that passed all filters. For sFlow: frame length × skip count.
1Flow VolumeVT_RATE_COUNTERBps500Size of the export payload itself: NetFlow/IPFIX payload length per packet, or sFlow sample data length. This is the bandwidth of the flow export, not of user traffic.
2Flow RecordsVT_RATE_COUNTERRps500Flow records (sFlow: flow samples) that passed all filters.
3Post Filter Network BWVT_RATE_COUNTERBps500Bytes in records that passed all filters. Updated only when FilterFlowASNInclude or FilterFlowASNExclude is set.
4Post Filter Flow RecordsVT_RATE_COUNTERRps500Records that passed all filters. Updated only when an ASN include or exclude filter is set.
5IPv4 FlowsVT_COUNTERFlows500IPv4 flow records that passed all filters (NetFlow/IPFIX only).
6IPv6 FlowsVT_COUNTERFlows500IPv6 flow records that passed all filters (NetFlow/IPFIX only).
7TemplateVT_COUNTERRecs500v9/IPFIX template records received.
8SFlowVT_COUNTERRecs500sFlow flow samples received.
9v5 FlowsVT_COUNTERRecs500NetFlow v5 records received.
10v9 FlowsVT_COUNTERRecs500NetFlow v9 data records received.
11IPFIX FlowsVT_COUNTERRecs500IPFIX data records received.
12DataVT_COUNTERRecs500v9 plus IPFIX data records received.
13NAT TranslationsVT_COUNTERRecs500NAT event records received.
14Template OptionsVT_COUNTERRecs500v9/IPFIX options template records received.
15SYSLOGVT_COUNTERRecs500Not populated by the current code.
16Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: