begin with version-dependent header, that contains at least these fields: Version number (v1, v5, v7, v8, v9) Sequence number to detect loss and duplication Timestamps at the moment of export, as system uptime or absolute time. Number of records (v5 or v8) or list of templates and records (v9) Records A NetFlow record can contain a wide variety of information about the traffic in a given flow. NetFlow version 5 (one of the most commonly used versions, followed by version 9) contains the following: Input interface index used by SNMP (ifIndex in IF-MIB). Output interface index or zero if the packet is dropped. Timestamps for the flow start and finish time, in milliseconds since the last boot. Number of bytes and packets observed in the flow Layer 3 headers: Source & destination IP addresses ICMP Type and Code. IP protocol Type of Service (ToS) value Source and destination port numbers for TCP, UDP, SCTP For TCP flows, the union of all TCP flags observed over the life of the flow. Layer 3 Routing information: IP address of the immediate next-hop (not the BGP nexthop) along the route to the destination Source & destination IP masks (prefix lengths in the CIDR notation) For ICMP flows, the Source Port is zero, and the Destination Port number field codes ICMP message Type and Code (port = ICMP-Type * 256 + ICMP-Code) . The source and destination Autonomous System (AS) number fields can report the destination AS (last AS of AS-Path) or the immediate neighbor AS (first AS of AS-Path) depending on the router configuration. But the AS number will be zero if the feature is not supported, the route is unknown or not announced by BGP, or the AS is the local AS. There is no explicit way to distinguish between these cases. NetFlow version 9 can include all of these fields and can optionally include additional information such as Multiprotocol Label Switching (MPLS) labels and IPv6 addresses and ports, By analyzing flow data, a picture of traffic flow and traffic volume in a network can be built. The NetFlow record format has evolved over time, hence the inclusion of version numbers. Cisco maintains details of the different version numbers and the layout of the packets for each version. Interfaces NetFlow is usually enabled on a per-interface basis to limit load on the router components involved in NetFlow, or to limit the amount