Fortinet white logo
Fortinet white logo

Administration Guide

NetFlow templates

NetFlow templates

NetFlow uses templates to capture and categorize the data that it collects. FortiOS supports the following NetFlow templates:

Name

Template ID

Description

STAT_OPTIONS

256

Statistics information about exporter

SAMPLER_OPTIONS

257

Sampling information about exporter

APP_ID_OPTIONS

258

Application information

IPV4

259

No NAT IPv4 traffic

IPV6

260

No NAT IPv6 traffic

ICMP4

261

No NAT ICMPv4 traffic

ICMP6

262

No NAT ICMPv6 traffic

IPV4_NAT

263

Source/Destination NAT IPv4 traffic

IPV4_AF_NAT

264

AF NAT IPv4 traffic (4->6)

IPV6_NAT

265

Source/Destination NAT IPv6 traffic

IPV6_AF_NAT

266

AF NAT IPv6 traffic (6->4)

ICMP4_NAT

267

Source/Destination NAT ICMPv4 traffic

ICMP4_AF_NAT

268

AF NAT ICMPv4 traffic (4->6)

ICMP6_NAT

269

Source/Destination NAT ICMPv6 traffic

ICMPv6_AF_NAT

270

AF NAT ICMPv6 traffic (6->4)

256 - STAT_OPTIONS

Description

Statistics information about exporter

Scope Field Count

1

Data Field Count

5

Option Scope Length

4

Option Length

28

Padding

0000

Scope fields

Field #

Field

Type

Length

1

System

System (1)

2

Data fields

Field #

Field

Type

Length

1

TOTAL_BYTES_EXP

TOTAL_BYTES_EXP (40)

8

2

TOTAL_PKTS_EXP

TOTAL_PKTS_EXP (41)

8

3

TOTAL_FLOWS_EXP

TOTAL_FLOWS_EXP (42)

8

4

FLOW_ACTIVE_TIMEOUT

FLOW_ACTIVE_TIMEOUT (36)

2

5

FLOW_INACTIVE_TIMEOUT

FLOW_INACTIVE_TIMEOUT (37)

2

6

SAMPLING_INTERVAL

SAMPLING_INTERVAL (34)

4

7

SAMPLING_ALGORITHM

SAMPLING_ALGORITHM (35)

1

257 - SAMPLER_OPTIONS

Description

Sampling information about exporter

Scope Field Count

1

Data Field Count

6

Option Scope Length

4

Option Length

24

Padding

0000

Scope fields

Field #

Field

Type

Length

1

System

System (1)

2

Data fields

Field #

Field

Type

Length

1

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

2

FLOW_SAMPLER_MODE

FLOW_SAMPLER_MODE (49)

1

3

FLOW_SAMPLER_RANDOM_INTERVAL

FLOW_SAMPLER_RANDOM_INTERVAL (50)

4

4

SAMPLING_INTERVAL

SAMPLING_INTERVAL (34)

4

5

SAMPLING_ALGORITHM

SAMPLING_ALGORITHM (35)

1

6

FLOW_SAMPLER_NAME

FLOW_SAMPLER_NAME (84)

16

258 - APP_ID_OPTIONS

Description

Application information

Scope Field Count

1

Data Field Count

4

Option Scope Length

4

Option Length

16

Padding

0000

Scope fields

Field #

Field

Type

Length

1

System

System (1)

2

Data fields

Field #

Field

Type

Length

1

APPLICATION_ID

APPLICATION_ID (95)

9

2

APPLICATION_NAME

APPLICATION_NAME (96)

64

3

APPLICATION_DESC

APPLICATION_DESC (94)

64

4

applicationCategoryName

applicationCategoryName (372)

32

259 - IPV4

Description

No NAT IPv4 traffic

Data Field Count

22

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

IP_TOS ipClassofService (5)

1

14

DST_TOS postIpClassOfService (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

22

IP_DST_ADDR

IP_DST_ADDR (12)

4

260 - IPV6

Description

No NAT IPv6 traffic

Data Field Count

22

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

IP_TOS

ipClassofService (5)

1

14

DST_TOS

postIpClassOfService (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

22

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

261 - ICMP4

Description

No NAT ICMPv4 traffic

Data Field Count

20

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

20

IP_DST_ADDR

IP_DST_ADDR(12)

4

262 - ICMP6

Description

No NAT ICMPv6 traffic

Data Field Count

20

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

20

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

263 - IPV4_NAT

Description

Source/Destination NAT IPv4 traffic

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

IP_TOS

ipClassofService (5)

1

14

DST_TOS

postIpClassOfService (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID(66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

22

IP_DST_ADDR

IP_DST_ADDR (12)

4

23

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

24

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

264 - IPV4_AF_NAT

Description

AF NAT IPv4 traffic (4->6)

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

SRC_TOS

SRC_TOS (5)

1

14

DST_TOS

DST_TOS (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

22

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

23

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

24

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

265 - IPV6_NAT

Description

Source/Destination NAT IPv6 traffic

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

SRC_TOS

SRC_TOS (5)

1

14

DST_TOS

DST_TOS (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

22

IP_DST_ADDR

IP_DST_ADDR (12)

4

23

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

24

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

266 - IPV6_AF_NAT

Description

AF NAT IPv6 traffic (6->4)

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

SRC_TOS

SRC_TOS (5)

1

14

DST_TOS

DST_TOS (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

22

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

23

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

24

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

267 - ICMPV4_NAT

Description

Source/Destination NAT ICMPv4 traffic

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

20

IP_DST_ADDR

IP_DST_ADDR (12)

4

21

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

22

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

268 - ICMPV4_AF_NAT

Description

AF NAT ICMPv4 traffic (4->6)

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

20

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

21

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

22

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

269 - ICMPV6_NAT

Description

Source/Destination NAT ICMPv6 traffic

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

20

IP_DST_ADDR

IP_DST_ADDR (12)

4

21

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

22

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

270 - ICMPV6_AF_NAT

Description

AF NAT ICMPv6 traffic (6->4)

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

20

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

21

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

22

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

NetFlow templates

NetFlow templates

NetFlow uses templates to capture and categorize the data that it collects. FortiOS supports the following NetFlow templates:

Name

Template ID

Description

STAT_OPTIONS

256

Statistics information about exporter

SAMPLER_OPTIONS

257

Sampling information about exporter

APP_ID_OPTIONS

258

Application information

IPV4

259

No NAT IPv4 traffic

IPV6

260

No NAT IPv6 traffic

ICMP4

261

No NAT ICMPv4 traffic

ICMP6

262

No NAT ICMPv6 traffic

IPV4_NAT

263

Source/Destination NAT IPv4 traffic

IPV4_AF_NAT

264

AF NAT IPv4 traffic (4->6)

IPV6_NAT

265

Source/Destination NAT IPv6 traffic

IPV6_AF_NAT

266

AF NAT IPv6 traffic (6->4)

ICMP4_NAT

267

Source/Destination NAT ICMPv4 traffic

ICMP4_AF_NAT

268

AF NAT ICMPv4 traffic (4->6)

ICMP6_NAT

269

Source/Destination NAT ICMPv6 traffic

ICMPv6_AF_NAT

270

AF NAT ICMPv6 traffic (6->4)

256 - STAT_OPTIONS

Description

Statistics information about exporter

Scope Field Count

1

Data Field Count

5

Option Scope Length

4

Option Length

28

Padding

0000

Scope fields

Field #

Field

Type

Length

1

System

System (1)

2

Data fields

Field #

Field

Type

Length

1

TOTAL_BYTES_EXP

TOTAL_BYTES_EXP (40)

8

2

TOTAL_PKTS_EXP

TOTAL_PKTS_EXP (41)

8

3

TOTAL_FLOWS_EXP

TOTAL_FLOWS_EXP (42)

8

4

FLOW_ACTIVE_TIMEOUT

FLOW_ACTIVE_TIMEOUT (36)

2

5

FLOW_INACTIVE_TIMEOUT

FLOW_INACTIVE_TIMEOUT (37)

2

6

SAMPLING_INTERVAL

SAMPLING_INTERVAL (34)

4

7

SAMPLING_ALGORITHM

SAMPLING_ALGORITHM (35)

1

257 - SAMPLER_OPTIONS

Description

Sampling information about exporter

Scope Field Count

1

Data Field Count

6

Option Scope Length

4

Option Length

24

Padding

0000

Scope fields

Field #

Field

Type

Length

1

System

System (1)

2

Data fields

Field #

Field

Type

Length

1

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

2

FLOW_SAMPLER_MODE

FLOW_SAMPLER_MODE (49)

1

3

FLOW_SAMPLER_RANDOM_INTERVAL

FLOW_SAMPLER_RANDOM_INTERVAL (50)

4

4

SAMPLING_INTERVAL

SAMPLING_INTERVAL (34)

4

5

SAMPLING_ALGORITHM

SAMPLING_ALGORITHM (35)

1

6

FLOW_SAMPLER_NAME

FLOW_SAMPLER_NAME (84)

16

258 - APP_ID_OPTIONS

Description

Application information

Scope Field Count

1

Data Field Count

4

Option Scope Length

4

Option Length

16

Padding

0000

Scope fields

Field #

Field

Type

Length

1

System

System (1)

2

Data fields

Field #

Field

Type

Length

1

APPLICATION_ID

APPLICATION_ID (95)

9

2

APPLICATION_NAME

APPLICATION_NAME (96)

64

3

APPLICATION_DESC

APPLICATION_DESC (94)

64

4

applicationCategoryName

applicationCategoryName (372)

32

259 - IPV4

Description

No NAT IPv4 traffic

Data Field Count

22

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

IP_TOS ipClassofService (5)

1

14

DST_TOS postIpClassOfService (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

22

IP_DST_ADDR

IP_DST_ADDR (12)

4

260 - IPV6

Description

No NAT IPv6 traffic

Data Field Count

22

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

IP_TOS

ipClassofService (5)

1

14

DST_TOS

postIpClassOfService (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

22

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

261 - ICMP4

Description

No NAT ICMPv4 traffic

Data Field Count

20

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

20

IP_DST_ADDR

IP_DST_ADDR(12)

4

262 - ICMP6

Description

No NAT ICMPv6 traffic

Data Field Count

20

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

20

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

263 - IPV4_NAT

Description

Source/Destination NAT IPv4 traffic

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

IP_TOS

ipClassofService (5)

1

14

DST_TOS

postIpClassOfService (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID(66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

22

IP_DST_ADDR

IP_DST_ADDR (12)

4

23

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

24

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

264 - IPV4_AF_NAT

Description

AF NAT IPv4 traffic (4->6)

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

SRC_TOS

SRC_TOS (5)

1

14

DST_TOS

DST_TOS (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

22

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

23

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

24

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

265 - IPV6_NAT

Description

Source/Destination NAT IPv6 traffic

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

SRC_TOS

SRC_TOS (5)

1

14

DST_TOS

DST_TOS (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

22

IP_DST_ADDR

IP_DST_ADDR (12)

4

23

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

24

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

266 - IPV6_AF_NAT

Description

AF NAT IPv6 traffic (6->4)

Data Field Count

26

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

L4_SRC_PORT

L4_SRC_PORT (7)

2

8

L4_DST_PORT

L4_DST_PORT (11)

2

9

INPUT_SNMP

INPUT_SNMP (10)

2

10

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

11

PROTOCOL

PROTOCOL (4)

1

12

postIpDiffServCodePoint

postIpDiffServCodePoint (98)

1

13

SRC_TOS

SRC_TOS (5)

1

14

DST_TOS

DST_TOS (55)

1

15

APPLICATION_ID

APPLICATION_ID (95)

9

16

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

17

FLOW_FLAGS

FLOW_FLAGS (65)

2

18

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

19

flowEndReason

flowEndReason (136)

1

20

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

21

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

22

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

23

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

24

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

25

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

26

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

267 - ICMPV4_NAT

Description

Source/Destination NAT ICMPv4 traffic

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

20

IP_DST_ADDR

IP_DST_ADDR (12)

4

21

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

22

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

268 - ICMPV4_AF_NAT

Description

AF NAT ICMPv4 traffic (4->6)

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

20

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

21

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

22

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

269 - ICMPV6_NAT

Description

Source/Destination NAT ICMPv6 traffic

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IP_SRC_ADDR

IP_SRC_ADDR (8)

4

20

IP_DST_ADDR

IP_DST_ADDR (12)

4

21

postNATSourceIPv6Address

postNATSourceIPv6Address (281)

16

22

postNATDestinationIPv6Address

postNATDestinationIPv6Address (282)

16

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2

270 - ICMPV6_AF_NAT

Description

AF NAT ICMPv6 traffic (6->4)

Data Field Count

24

Data fields

Field #

Field

Type

Length

1

BYTES

BYTES (1)

8

2

OUT_BYTES

OUT_BYTES (23)

8

3

PKTS

PKTS (2)

4

4

OUT_PKTS

OUT_PKTS (24)

4

5

FIRST_SWITCHED

FIRST_SWITCHED (22)

4

6

LAST_SWITCHED

LAST_SWITCHED (21)

4

7

INPUT_SNMP

INPUT_SNMP (10)

2

8

OUTPUT_SNMP

OUTPUT_SNMP (14)

2

9

ICMP_TYPE

ICMP_TYPE (32)

2

10

PROTOCOL

PROTOCOL (4)

1

11

SRC_TOS

SRC_TOS (5)

1

12

DST_TOS

DST_TOS (55)

1

13

APPLICATION_ID

APPLICATION_ID (95)

9

14

INTERNET_APPLICATION_ID

INTERNET_APPLICATION_ID (66)

4

15

FLOW_FLAGS

FLOW_FLAGS (65)

2

16

FORWARDING_STATUS

FORWARDING_STATUS (89)

1

17

flowEndReason

flowEndReason (136)

1

18

FLOW_SAMPLER_ID

FLOW_SAMPLER_ID (48)

1

19

IPV6_SRC_ADDR

IPV6_SRC_ADDR (27)

16

20

IPV6_DST_ADDR

IPV6_DST_ADDR (28)

16

21

postNATSourceIPv4Address

postNATSourceIPv4Address (225)

4

22

postNATDestinationIPv4Address

postNATDestinationIPv4Address (226)

4

23

postNAPTSourceTransportPort

postNAPTSourceTransportPort (227)

2

24

postNAPTDestinationTransportPort

postNAPTDestinationTransportPort (228)

2