NetFlow V9 formats

V9 format is template-based. Templates provide an extensible design to the record format.

V9 packet layout

The NetFlow V9 record format consists of a packet header and at least one or more template or data FlowSets. A template FlowSet provides a description of the fields that will be present in future data FlowSets. These data FlowSets might occur later within the same export packet or in subsequent export packets.

V9 packet header format

V9 packet header fields

Fields	Description
`version`	The version of NetFlow records exported in this packet; for Version 9, this value is 0x0009
`count`	Number of FlowSet records (both template and data) contained within this packet
`SysUptime`	Current time in milliseconds since the export device is started.
`UNIX seconds`	Current time in seconds that have elapsed since 00:00:00 Coordinated Universal Time, Thursday, 1 January 1970.
`Sequence number`	Incremental sequence counter of all export packets that are sent by this export device; this value is cumulative, and it can be used to identify any missed export packets. Note: This is a change from the NetFlow Version 5 and Version 8 headers, where this number represented “total flows.”
`Source ID`	The `Source ID` field is a 32-bit value that is used to guarantee uniqueness for all flows that are exported from a particular device. (The `Source ID` field is the equivalent of the engine type and engine ID fields that are found in the NetFlow Version 5 and Version 8 headers). The format of this field is vendor-specific. In the Cisco implementation, the first two bytes are reserved for future expansion, and is always zero. Byte 3 provides uniqueness about the routing engine on the exporting device. Byte 4 provides uniqueness about the particular line card or Versatile Interface processor on the exporting device. Collector devices must use the combination of the source IP address plus the `Source ID` field to associate an incoming NetFlow export packet with a unique instance of NetFlow on a particular device.