how to find my netflow data version number?

359 Views Asked by At

Is there any option to know the version number of my netflow data. I have pcap file generated using tcpdump. Then using some opensource (which depends on tshark) I converted the pcap data into netflow. I am not able to find out which version of netflow it is in? netflow v5 or v7....or IPFIX.
Is there any way to tell netflow version by looking at the data?

1

There are 1 best solutions below

0
On

If you are using the PCAP file to generate and export NetFlow over the wire, then the version number is in the second byte of the payload of the UDP packet. The value will be 5, 7, 9, or 'A' (in case of IPFIX).

However, if you have used a textual format to dump the records to disk, then they are technically not really versioned NetFlow until you export them somehow over the wire.