What is "Source ID" in the header of the Netflow V9 package

Hello
 
My question concerns the "Source ID" field that appears in the header of Netflow V.9 package. Following link Cisco (http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_p...) gives the definition of the Source ID-
 
"The ID of the Source field is a 32-bit value that is used to guarantee the character for all flows exported from a particular device. (The ID of the Source field is equivalent to the type of engine and engine identification fields found in the headers NetFlow Version 5 and Version 8). The format of this field is vendor specific. In the implementation of Cisco, the first two bytes are reserved for future expansion and will always be zero. Byte 3 provides the singularity concerning the routing on the exporting aircraft engine. Byte 4 offers a uniqueness in regard to the specific line card or versatile Interface processor on the exporting device. »
 
I use "Source ID" (associated with model id) to identify options models exported by the different routers. Our new lab configuration, where we have several routers configured to export Netflow, I observed that all routers were exporting "Source ID" value as "0" (zero). "." He doesn't have my hypothesis that I had formed based on the definition by top of the doc of Cisco.
 
 
I assumed-
 
SourceID model Id Unique key
------------     ---------------   --------------
Source1 source1 256-256
Source1 source1 257-257
Source2 source2 256-256
source3 source3 258-258
 
 
But, I have observed
 
SourceID model Id Unique key
------------     ---------------   --------------
0                  256              0-256
0                  257              0-257
0                  256              0-256
0                  258              0-258
 
Thus, the same model id (256) different routers (source1, source3) eventually form even unique key and my code breaks.
 
I would like to know if my interpretation that Source ID can be used to identify patterns in this way is correct or not?
Is "Source ID" user configurable attribute? How is it in line with the above definition the doc of Cisco?
 
Thank you
Deepak
 

Deepak,

Consider these quotes from the same RFC 3954:

Section 2: terminology:

 Observation Point An Observation Point is a location in the network where IP packets can be observed; for example, one or a set of interfaces on a network device like a router. Every Observation Point is associated with an Observation Domain. Observation Domain The set of Observation Points that is the largest aggregatable set of flow information at the network device with NetFlow services enabled is termed an Observation Domain. For example, a router line card composed of several interfaces with each interface being an Observation Point.

Article 7: Management of the models:

 A NetFlow Collector that receives Export Packets from several Observation Domains from the same Exporter MUST be aware that the uniqueness of the Template ID is not guaranteed across Observation Domains.

Article 9: The collector side:

 At any given time the Collector SHOULD maintain the following for all the current Template Records and Options Template Records: Exporter, Observation Domain, Template ID, Template Definition, Last Received. Note that the Observation Domain is identified by the Source ID field from the Export Packet.

So in other words, the Source ID is an identifier of the field of Observation (and in fact, the IPFIX RFCS calls this header directly as Observation domain ID field). Model IDS are unique by the exporter and field of Observation, and if only one exporter uses several models in its different areas of Observation, the IDS of these models may overlap even in only one exporter. Observation domain ID (i.e. Source IDs) identify only the internal structure of a single exporter, and no provision is made to preserve their specificity through several exporters - for this, the IP source should be used.

With respect to whether there can be multiple instances of NetFlow on a single router, I get a feeling that with the decentralized platforms and distributed, multiple linecards in only one router can run their own NetFlow analysis for data passing through them, that each provide a selective collection of NetFlow. Thus, map of each line or each sheet features its own NetFlow analysis should be assigned its own unique Observation domain ID.

If this is not configurable by the system user should automatically make the value based on the motor and line card router. But what I observed, with several routers, is that this value is always 0 (zero).

I think that it is dependent on the construction of material of the router. As an example remotely related, old routers 2600 series had two WIC slots. If you have inserted two modules of WIC - 2T in these slots, you would expect that they would be numbered Serial0/0 and Serial0/1, Serial1/0, Serial1/1. Very surprisingly, however, these routers reviewed the two slots to be connected internally to one bus, and interfaces have been appointed Serial0/0 and Serial0/1, Serial0/2 Serial0/3 - as if they were installed in a single '0' location. Something similar can happen to the areas of Observation and their identity papers. You would think that every single line card was a separate field of Observation. However, the reality can be different, and the entire router can act as a single domain of Observation to the outside world. It's just the way it is built - and programmed.

It is unclear why Cisco doc says to use the "Source ID" and '"Source IP address' to correctly distinguish the flow.

I think it's a bad wording in the RFC. I think what they mean is that if you use the duplet distinguish between flows, then you are fine for multiple streams by a same exporter, as well as for multiple streams of different exporters.

On the other hand, is not "Source"IP address"good enough to distinguish between flows from different sources?

If an exporter could really be partitioned into several fields observation the IP source address is not sufficient. I'm just making up examples with no backup of the real life here, but think to, say, a router multi-chassi with each frame being a field of Observation, or virtualized map of each line of a distributed autonomous area of Observation switch, or a router to several different contexts and virtual routers, each of whom is a unique field of Observation reports on flows using the same source IP address... I think you get the point.

I'd put it this way... The existence of Source ID of NetFlow v9 (and the IPFIX Observation domain ID) allows these protocols to do faced with situations in which a single physical device can be partitioned into several fields observation well and make reports using an IP address unique independent source. However, the fact that these protocols have this capacity does not mean that each device, even a router/switch Cisco, must necessarily use.

Best regards
Peter

Tags: Cisco Network

Similar Questions

  • What source address should the NI9862 module CAN be used to send messages j1939?

    I am developing an application that will write and read on vehicle ECU road. I CAN NI9862 module and drivers XNET. I can read an ECU data. I can write a CAN bus frames but the ECU under test does not appear to read the message. I don't get any acknowledgement of bit type and the SHIELD in question (a dashboard) does not change its messages in anyway, nor change the gauges or witnesses.

    Complicating this is the fact that the ecu is 'Brand X' and it is PGNs belong to someone. I tried to send the message of inquiry PGN (PGN59904) but get no response from the ECU. I use the 255 (global) as my source address.

    Is there a source given for the NI9862 in J1939 address?

    Thank you

    There is no specific source for the NI9862 address. It can be used to simulate one of the 256 available addresses. If you try to simulate a test off-board tool, usually has an address of 0xFA.

    I'm afraid that if you do not know the PGNs he expects or addresses that it expects to see, you will have great difficulty to operate.

    Good luck

    Bob Young

  • E-all-in-one S: Jet Office Office Jet 6800 6800 series; What and where is a print head; How should I do?

    Office Jet series 6800 printhead problem watch what and where is a print head. How to fix it.

    The print head is where the ink comes out, it is connected to the assembly that contains the ink cartridges.  The print head is not usable on series Officejet 6800 user, you will need to contact HP for a replacement as described in the document here.

  • Don't know what updates I need through the center of update. And get the following error message popup every minute, wuauclt.exe.

    Please, I beg you, help me please I need this computer for my work and am already 1 day behind by logging into my company to do my job (I have Windows XP Version 2002 service pack 2)

    Not only can't update windows via the update enter but an error message continues to appear every minute that used to go.

    It says "wuauclt.exe has encountered a problem and needs to close. We are sorry for the inconvenience. »

    If I click on th does not send or send error report this message keeps popping up. When I click the to see what data link, he said:

    "Error signature szAppName: wuauclt.exe szAppVer: 7.4.7600.226 szModName: szModVer esent.dll: 5.12600.2180 offset: 005d 424 '  Details of the declaration: this error report includes: observation information covers the status of wuauclt.exe when the problem occurred, the operating system version and used hardware and Protocol address Internet (IP) of your computer. etc, etc, etc.

    When I click on info tech I get

    Content error report the following files should be included in this error report: C:\DOCUME~1\Owner\ LOCALS~1\Temp\WER189a.dir00\wuauclt.exe.mdmp C:\DOCUME~1\Owner\ LOCALS~1\Temp\WER189a.dir00\appcompat.txt WER189a the number changes each time.

    So far, I ran McAfee, Microsoft Security Essentials and it keeps popping up. I still do not know what updates I need through the Update Center but could manually go and get service pack 3 by itself. I need to be able to use the center of update and do not have this message continues to flow upward.

    What I do?   Thank you so much Corina

    Hello
     
     
    Let us make the below listed methods and check if we still get the error message.
     
    Method 1.
    I would ask you to reset the Windows UPdate components and check if you still get this error message.
    Click the Fix It button in the article below to do it automatically or you can do it manually as wel. For more information, refer to the article below.
    How to reset the Windows Update components?
    http://support.Microsoft.com/kb/971058
     
     
    Method 2.
    If the error still persists please provide us with the error log:
    Type eventvwr.msc/s in the address bar.
    The list of all the events that are listed as 'Error' in the main window when you go to 'Newspapers Windows' and 'Application '. There is often a large number of them. Send us any ones you see listed for the last few days. (Please also do it for the log files in 'System'). When you do, provide us the name of the 'Source' and all that is listed in the description below the list of newspapers box when you click on one.
     
    Method 3.
    I would also recommend to install the Windows Update Agent to manage the updates on your computer.
    Download and install the Windows Update Agent to manage updates for your computer.
    Follow the link below to download and install Windows Update Agent:
    http://support.Microsoft.com/kb/949104

    Please let us know if this helps you resolve the problem or if assistance is needed.

    I hope this helps.

    Thank you, and in what concerns:
    Shekhar S - Microsoft technical support.

    Visit our Microsoft answers feedback Forum and let us know what you think.
    If this post can help solve your problem, please click the 'Mark as answer' or 'Useful' at the top of this message. Marking a post as answer, or relatively useful, you help others find the answer more quickly.

  • What processors are compatible with the HP G62-b09SA notebook PC.

    What processors are compatible with the HP G62-b09SA notebook PC. Also I'm under 64-bit Windows, but on the HP website, it indicates that the maximum amount of memory is 4 GB, why?

    Hello

    Here is the link to the service manual for your laptop

    http://h10032.www1.HP.com/CTG/manual/c02542102.PD

    See page 1 for a list of supported and also taken processors on this page under the heading memory, it is said that the laptop can support up to 8 GB of memory.

    Paul

  • WMM edition error message - ' cannot publish to the specified location. Check the source files and the location is still available and that there is enough disk space. »

    I made a movie of 30 minutes or more in WMM, some of the videos that I imported I had to convert to wmv, to import into WMM. Once I went to publish the movie, after the publication of about 1%, an error message pops up saying something like "cannot publish to the specified location. Check the source files and the location is still available and that there is enough disk space. "I have 8 GB of free space on my hard drive and I tried to burn a cd on a dvd, and save to memory stick, none of them have worked, the same message is displayed even if they have sufficient space available. There is no red x in the videos or photos that I imported, so no files are missing. Some files have been moved when they were converted, but the movie plays well in WMM.  I want to export to is in my documents is therefore always available. I spent hours trying to figure this out and I I still don't know what the problem with it! Help! I've also spent a lot of time to their conversion to avi to see if this helped and the same message appeared again.

    What is the format of your source of debtor files and how did you convert
    TO WMV?

    I can only imagine that you are using Vista Movie Maker 6?

    It's not really about the location... error messages can be very cryptic...
    The error that you mentioned usually appears when the source files in the project
    are damaged or are not fully compatible with Movie Maker and made
    in a movie file cannot continue. In addition, large complex projects can cause
    in this issue.

    In some cases, it may be possible to record in DV - AVI, during registration as
    . WMV fails: the following article explains how to save... Publish it in film...
    6 machine and the graphic link shows where the option:

    Windows Vista - publish a movie in Windows Movie Maker
    http://Windows.Microsoft.com/en-us/Windows-Vista/publish-a-movie-in-Windows-Movie-Maker

    The following chart shows where the DV - AVI option.
    http://www.Papajohn.org/IMGs/Vista-PublishToComputerChoices.jpg

    If the recording as long as DV - AVI fails... see the following articles:

    Movie Maker - problem resolution - "cannot record a movie.
    http://www.Papajohn.org/MovieMaker-issues-CantSaveMovie.html

    Windows Movie Maker error
    Cannot complete the Save Movie Wizard
    http://moviemakererror.blogspot.com/

    Several formats are apparently compatible with
    Movie Maker, but the most reliable choices are:

    Photos - bmp
    Video - wmv
    Audio - wav, wma, wmv

    Sometimes, it can help if you are going to... Tools / Options / Compatibility tab...
    and uncheck all filters.

  • What is a connection to the network tunnel adapter local?

    tunnel map

    What is a connection to the network tunnel adapter local?

    Hello, Alan Winwynn,.

    Thanks for your post.  If you have a specific problem you need covered?  In the affirmative, please let us know the issue you are facing, so that we can better help you.

    The tunnel of the card, in short, encapsulates IP6 packages with an IP4 header so that it can be sent over a network, IP4, no problem.

    See you soon

  • Duplicate a project and replace the source PSD of the puppet

    Is it possible to replace the file psd source of the puppet inside a character animation project?

    I created a project with a custom puppet, with my custom settings (dangle, face and so on).

    Now I need another puppet (for a different character) with the same parameters and in the same position as the first puppet to do this, I create a copy of the original project but then I can't replace the source PSD for the puppet (when I right click on my puppet, the only option is to "Reveal in finder").

    If I change the original PSD as the first project is affected, and I lose the ability to edit further.

    I want to keep all my settings and apply them to another puppet PSD, if I start with a new blank project that I have to put all the settings.

    What can I do? Is there a solution for this?

    Thank you

    We hope to have something as EI replace command images to allow you to do this easily.

    For now, if you are brave, try this workaround heavy:

    1 file > Media copies the files in the project folder (then the project will be no longer refer to PSD files outside the project)

    2 file > reveal the project in the Finder Explorer.

    3. two copies of the file of the entire project

    4 file > import... and select the double .chproj

    5 twirl Ouvrezledossier newly imported in the project Panel

    6. right click on the puppet > reveal in Finder/Explorer

    7. now replace this file with your new file (that you need to rename it to match the old file)

    8. go back to Ch and it should be noted that the work has changed (mod date the new file may be more recent than the original)

    You should now have two puppets in your project, each pointing to a different PSD (in two cases different media gathered inside the structure of the project). All other elements will be also duplicated, so you can remove them if you do not want them.

    Behaviors & records applied to the root of the original puppet must be preserved. If the new puppet has the same structure as the old behaviors applied to subpuppets _might_ not sure kept. We need to work on this area. If you try it, please let us know how it goes!

  • Source is taken from another Source of Transaction the assets of RMA with SB

    Hello!

    I created a Type of Transaction to have this attached to a Source of the Transaction to the Type of Transaction Standard column and this and that is attached to the Source column of the invoice of the tab Finance installation of Types of transactions for RMA on the order management program.  Whenever I am billing with this transaction type of RMA RMA, the A.R. transaction created has a different Source of what I put. Is there such a thing as a type of transaction 'by default'? What I'm missing here?

    Thank you.

    Jon

    Hello! Thanks for the reply!

    I saw the problem, the entry in the Type default return line in the Types of transactions OM has entered in the Source of the invoice and is selected as the Source of the AR.

    Thank you.

    Jon

  • Where is the installer for the Source column of the command in other tab of orders?

    Hello!

    I would like to ask where to find the installer for the Source column of the command in other tab of orders. I saw internal and online, I think it's always external.

    Thank you.

    Jon

    Order header Source is the origin of the order-using the OM Super user responsibility, see Setup-> controls-> import Sources.  I think that external is a Source Type on the command line that indicates if the line item will be provided by your org or bought.

  • What does 'Game Frame' in the menu of the sequence?

    I do not see a definition for the function appearing in the 'Séquence' menu called 'Game framework.' Can someone tell me what it does or what it is?

    You might have tried your self... and if you do... it will open the source file in the Source monitor to the position of the image of the clip in the sequence

  • When the copy of my symbols between projects lose their source file after the backup

    Hey,.

    This is my first post here, but I have been struggling with this for a while and have not been able to find a similar position again. So I use Windows 7 and Flash CS 5.5.
    I'm animated short episodes of an animated mini series, with several characters. Our character symbols or organized in folders and then these files are copied to the front she draws from the previous episode at the library of the next episode.

    However, as soon as I save the file all the symbols will empty. Under the symbol properties, they have no source file. The source file disappears. I can re-link but these symbol libraries have more than 100 symbols.

    This only happens to the symbols, I have not placed on the time line yet, but it becomes tedious to hunt endlessly through old projects of re - link or copy symbols that have disappeared.

    My question is why what is happening, and how to avoid it?

    Yes, I think it's a path problem.

    Because you can't have two files with exactly the same name, do a copy/paste changes this way. OK... then how can we cheat/fool Flash using the same path (sort of) for two different folders?

    Thinking about support: you can do tests on a small scale... not the whole project?

    Can you CUT and paste and the destination folder works?

    Use the same folder for both libraries? and the path of the folder root... kinda like an address absolute, but relative to root? This must be done when you make all of the symbols of origin.

    Change the location of each folder in library of sections so that they are not in the same main folder so that you can use the same name of subfolder in the folder of each section? For example:

    section1_library/symbols

    section2_library/symbols

    allows you to use the same folder name exact for the two symbols of the section file. For example, if the path to the symbols in the '1' section is just /symbols, copy/paste in the folder "section 2" gives exactly the same way. Now to really make this work, you will need to introduce as many levels of folders under upward according to the need of separate sections. Therefore to examine the properties of the symbol and determine to what extent raise lever folder, you need to go.

    Or there may be a simple way in Flash to define root relative paths so that the copy/paste works... but I don't quite know.

    Best wishes

    Adninjastrator

  • Where can I see the source code for the controller

    Hi all

    My question is maybe stupid to some gurus of the ADF, but many people have found that R12 Pages have a lot of code and there is not too much documentation on how to customize a controller.

    1. I see the *.class of my controller in the $JAVA_TOP/oracle/apps/ar/cusstd/createcus/webui/ArCreCusCO.class on my server, BUT I don't see that any of the encrypted code when I open up JDeveloper. So I guess I'm doing it wrong.

    2. I want to change ArCreCusCO.class. I see a lot of people say Hey I've customized XYZ controller, but how they found the code and continue to change it is the least of my headaches

    3. do I need to configure something in JDeveloper so I can see Server classes to my JDeveloper - what they do, if so, how you do?

    4. I saw something in the help page saying adding components to the Extension of the OA the devil what?

    Thanks to illuminate some beginners in the ADF.

    With the new philosophy of Java, some of those 12 developers experience that we are not starting from zero because of this new architecture.

    Hector. -.

    p.s. any entry will be taken, but do not refer to the Oracle tutorial, is an example of cake I need some practical examples ;-)

    Hi hbono99

    (1.) you can .class c above java, which is the compiled code as source code is not provided by oracle, if you need this file '.class' to see the source code for decompile, JAD decompiler 1.5.8 version will be newer .well, it would be useful to see the source code, but sometimes decompiled class create problems when trying to compile again.

    2.), you can make changes in the ArCreCusCO.class after that decompilation and compile the same thing again to generate the class file, bcz you can put only class file on the server, BUT that would be fatal to change the standard class and the concept here to come of the Extension in the image, you need to extend this class. «XYZ custom "means the extesión of the class parent and make the extension u don't need not the source.»

    3.) u cannot see the source code of a .class in Jdeveloper, there is no such a parameter.

    (4.) to extend the need to ArCreCusCO.class you to create a workspace followed by creating a project in the workspace Jdeveloper
    process to extend the class

    a.) create workspace and project
    (b) create the same package in which resides the ArCreCusCO.class under the \jdev\myprojects\ in your Jdeveloper
    (c.) right click on the project, go to create the new class, here you will find the option to metion the package where you want to put the superior (normal package starts with a xx.oracle.-) the possibility of mentioning the nmae classs that you want to extend
    (d.) click ok at the end, you will get your extended class

    e.) source code usually has two methods ProcessFormRequest and processRequest, you can add the code according to the requirement.

    extension works bcz inside the method she calls super, so all first it runs all the methods of the parent class in your case ArCreCusCO.class and then control comes in extended class, now, your code will be run, which will be accomliseh your condition

    f.) tranaser the class file file expanded to the server, add this extended class with seeded page you need to customize the page, you will find the option to add your class, mention u your class with package to compete (the way that we import the file with their package names in our source code, here import is not necessary)

    thanx

    Pratap

  • What is a substitute for the migration assistant? I tried in vain for three hours to migrate files from a macbook pro to each other so that even if connected with the ethernet cable the computers never see each other.

    What is a substitute for the migration assistant? I tried in vain for three hours to migrate files from a macbook pro to each other so that even if connected with the ethernet cable the computers never see each other.

    You can connect otherwise?  USB or FireWire or love at first sight?  You can connect both machines and start the one you want to transfer to target disk mode.  If your other machine is up and running with an account on it and you just want to move files, you can simply drag and drop the FRO the machine mounted TDM, or you can use the migration wizard.

    Or, if the other machine still starts and runs, you can start both computers and connect to the same wifi network and share the hard drive like machines on the network.  Access them in the finder on the new machine files and drag-and - drop, or use the wizard migration, on wifi.

  • What apps work best with the pencil

    What apps work best with the pencil. Particularly interested in commenting, highlighting and rating photos and graphics.

    I like 'Fame' for handwritten notes. "Annotable" is good for the annotation of pictures and graphics. Recently, I started using "Ultimate NoteLedge" and learn what it does yet. But so far, I like it, too. And then, everything that made Adobe.

Maybe you are looking for