netsampler-goflow2/pb/flow.proto

syntax = "proto3";
package flowpb;
option go_package = "github.com/netsampler/goflow2/pb;flowpb";

message FlowMessage {

  enum FlowType {
    FLOWUNKNOWN = 0;
    SFLOW_5 = 1;
    NETFLOW_V5 = 2;
    NETFLOW_V9 = 3;
    IPFIX = 4;
  }
  FlowType type = 1;

  uint64 time_received_ns = 110;
  uint32 sequence_num = 4;
  uint64 sampling_rate = 3;

  //uint32 flow_direction = 42;

  // Sampler information
  bytes sampler_address = 11;

  // Found inside packet
  uint64 time_flow_start_ns = 111;
  uint64 time_flow_end_ns = 112;

  // Size of the sampled packet
  uint64 bytes = 9;
  uint64 packets = 10;

  // Source/destination addresses
  bytes src_addr = 6;
  bytes dst_addr = 7;

  // Layer 3 protocol (IPv4/IPv6/ARP/MPLS...)
  uint32 etype = 30;

  // Layer 4 protocol
  uint32 proto = 20;

  // Ports for UDP and TCP
  uint32 src_port = 21;
  uint32 dst_port = 22;

  // Interfaces
  uint32 in_if = 18;
  uint32 out_if = 19;

  // Ethernet information
  uint64 src_mac = 27;
  uint64 dst_mac = 28;

  // Vlan
  uint32 src_vlan = 33;
  uint32 dst_vlan = 34;
  // 802.1q VLAN in sampled packet
  uint32 vlan_id = 29;

  // IP and TCP special flags
  uint32 ip_tos = 23;
  uint32 forwarding_status = 24;
  uint32 ip_ttl = 25;
  uint32 ip_flags = 38;
  uint32 tcp_flags = 26;
  uint32 icmp_type = 31;
  uint32 icmp_code = 32;
  uint32 ipv6_flow_label = 37;
  // Fragments (IPv4/IPv6)
  uint32 fragment_id = 35;
  uint32 fragment_offset = 36;

  // Autonomous system information
  uint32 src_as = 14;
  uint32 dst_as = 15;

  bytes next_hop = 12;
  uint32 next_hop_as = 13;

  // Prefix size
  uint32 src_net = 16;
  uint32 dst_net = 17;

  // BGP information
  bytes bgp_next_hop = 100;
  repeated uint32 bgp_communities = 101;
  repeated uint32 as_path = 102;

  // MPLS information
  repeated uint32 mpls_ttl = 80;
  repeated uint32 mpls_label = 81;
  repeated bytes mpls_ip = 82;

  uint32 observation_domain_id = 70;
  uint32 observation_point_id = 71;
}