| st | Start time | int | 4 | Start of flow in UNIX time (number of seconds from 1.1.1970). |
| bytes | Octects | unsigned bigint | 8 | Number of transferred octets. |
| pck | Packets | unsigned bigint | 8 | Number of transferred packets. |
| sip | Source IP address | unsigned int | 4 | Source IPv4 address. |
| dip | Destination IP address | unsigned int | 4 | Destination IPv4 address. |
| proto | IP Protocol | unsigned tinyint | 1 | IP protocol i.e. TCP, UDP, ICMP, ESP etc. |
| app | Application | unsigned int | 4 | Detected application ID. See documentation for more information. |
| sp | Source port | unsigned smallint | 2 | Source TCP or UDP port number. |
| dp | Destination port | unsigned smallint | 2 | Destination TCP or UDP port number. For ICMP protocol there is ICMP_type*256+ICMP_subtype. |
| nh | Next hop IP address | unsigned int | 4 | Next hop IPv4 address. |
| sif | Source interface | unsigned smallint | 2 | Source interface index. |
| dif | Destination interface | unsigned smallint | 2 | Destination interface index. |
| flags | TCP flags | unsigned tinyint | 1 | OR'ed TCP flags (i.e. SYN, ACK, RST, FIN). |
| tos | Type of Service | unsigned tinyint | 1 | Type of service byte, for more information see DiffServ, Quality of Service etc. |
| sas | Source AS | unsigned smallint | 2 | Source autonomous system ID. |
| das | Destination AS | unsigned smallint | 2 | Destination autonomous system ID. |
| smask | Source network mask | unsigned tinyint | 1 | Source network mask length. |
| dmask | Destination network mask | unsigned tinyint | 1 | Destination network mask length. |
| ver | NetFlow version | unsigned tinyint | 1 | NetFlow export version (1,5,6,7 or 9). |
| rt | Device IP address | unsigned int | 4 | Exporting device IPv4 address. |