Appendix D. Data table format

FieldNameDatabase typeSize in bytesDescription
stStart timeint4Start of flow in UNIX time (number of seconds from 1.1.1970).
bytesOctectsunsigned bigint8Number of transferred octets.
pckPacketsunsigned bigint8Number of transferred packets.
sipSource IP addressunsigned int4Source IPv4 address.
dipDestination IP addressunsigned int4Destination IPv4 address.
protoIP Protocolunsigned tinyint1IP protocol i.e. TCP, UDP, ICMP, ESP etc.
appApplicationunsigned int4Detected application ID. See documentation for more information.
spSource portunsigned smallint2Source TCP or UDP port number.
dpDestination portunsigned smallint2Destination TCP or UDP port number. For ICMP protocol there is ICMP_type*256+ICMP_subtype.
nhNext hop IP addressunsigned int4Next hop IPv4 address.
sifSource interfaceunsigned smallint2Source interface index.
difDestination interfaceunsigned smallint2Destination interface index.
flagsTCP flagsunsigned tinyint1OR'ed TCP flags (i.e. SYN, ACK, RST, FIN).
tosType of Serviceunsigned tinyint1Type of service byte, for more information see DiffServ, Quality of Service etc.
sasSource ASunsigned smallint2Source autonomous system ID.
dasDestination ASunsigned smallint2Destination autonomous system ID.
smaskSource network maskunsigned tinyint1Source network mask length.
dmaskDestination network maskunsigned tinyint1Destination network mask length.
verNetFlow versionunsigned tinyint1NetFlow export version (1,5,6,7 or 9).
rtDevice IP addressunsigned int4Exporting device IPv4 address.