st | Start time | int | 4 | Start of flow in UNIX time (number of seconds from 1.1.1970). |
bytes | Octects | unsigned bigint | 8 | Number of transferred octets. |
pck | Packets | unsigned bigint | 8 | Number of transferred packets. |
sip | Source IP address | unsigned int | 4 | Source IPv4 address. |
dip | Destination IP address | unsigned int | 4 | Destination IPv4 address. |
proto | IP Protocol | unsigned tinyint | 1 | IP protocol i.e. TCP, UDP, ICMP, ESP etc. |
app | Application | unsigned int | 4 | Detected application ID. See documentation for more information. |
sp | Source port | unsigned smallint | 2 | Source TCP or UDP port number. |
dp | Destination port | unsigned smallint | 2 | Destination TCP or UDP port number. For ICMP protocol there is ICMP_type*256+ICMP_subtype. |
nh | Next hop IP address | unsigned int | 4 | Next hop IPv4 address. |
sif | Source interface | unsigned smallint | 2 | Source interface index. |
dif | Destination interface | unsigned smallint | 2 | Destination interface index. |
flags | TCP flags | unsigned tinyint | 1 | OR'ed TCP flags (i.e. SYN, ACK, RST, FIN). |
tos | Type of Service | unsigned tinyint | 1 | Type of service byte, for more information see DiffServ, Quality of Service etc. |
sas | Source AS | unsigned smallint | 2 | Source autonomous system ID. |
das | Destination AS | unsigned smallint | 2 | Destination autonomous system ID. |
smask | Source network mask | unsigned tinyint | 1 | Source network mask length. |
dmask | Destination network mask | unsigned tinyint | 1 | Destination network mask length. |
ver | NetFlow version | unsigned tinyint | 1 | NetFlow export version (1,5,6,7 or 9). |
rt | Device IP address | unsigned int | 4 | Exporting device IPv4 address. |