netsampler-goflow2/cmd/enricher/pb/flowext.proto

syntax = "proto3";
package flowpb;
option go_package = "github.com/netsampler/goflow2/cmd/enricher/pb;flowpb";

message FlowMessageExt {

  enum FlowType {
    FLOWUNKNOWN = 0;
    SFLOW_5 = 1;
    NETFLOW_V5 = 2;
    NETFLOW_V9 = 3;
    IPFIX = 4;
  }
  FlowType type = 1;

  uint64 time_received = 2;
  uint32 sequence_num = 4;
  uint64 sampling_rate = 3;

  uint32 flow_direction = 42;

  // Sampler information
  bytes sampler_address = 11;

  // Found inside packet
  uint64 time_flow_start = 38;
  uint64 time_flow_end = 5;
  uint64 time_flow_start_ms = 63;
  uint64 time_flow_end_ms = 64;

  // Size of the sampled packet
  uint64 bytes = 9;
  uint64 packets = 10;

  // Source/destination addresses
  bytes src_addr = 6;
  bytes dst_addr = 7;

  // Layer 3 protocol (IPv4/IPv6/ARP/MPLS...)
  uint32 etype = 30;

  // Layer 4 protocol
  uint32 proto = 20;

  // Ports for UDP and TCP
  uint32 src_port = 21;
  uint32 dst_port = 22;

  // Interfaces
  uint32 in_if = 18;
  uint32 out_if = 19;

  // Ethernet information
  uint64 src_mac = 27;
  uint64 dst_mac = 28;

  // Vlan
  uint32 src_vlan = 33;
  uint32 dst_vlan = 34;
  // 802.1q VLAN in sampled packet
  uint32 vlan_id = 29;

  // VRF
  uint32 ingress_vrf_id = 39;
  uint32 egress_vrf_id = 40;

  // IP and TCP special flags
  uint32 ip_tos = 23;
  uint32 forwarding_status = 24;
  uint32 ip_ttl = 25;
  uint32 tcp_flags = 26;
  uint32 icmp_type = 31;
  uint32 icmp_code = 32;
  uint32 ipv6_flow_label = 37;
  // Fragments (IPv4/IPv6)
  uint32 fragment_id = 35;
  uint32 fragment_offset = 36;
  uint32 bi_flow_direction = 41;

  // Autonomous system information
  uint32 src_as = 14;
  uint32 dst_as = 15;

  bytes next_hop = 12;
  uint32 next_hop_as = 13;

  // Prefix size
  uint32 src_net = 16;
  uint32 dst_net = 17;

  // BGP information
  bytes bgp_next_hop = 100;
  repeated uint32 bgp_communities = 101;
  repeated uint32 as_path = 102;

  // MPLS information
  bool has_mpls = 53;
  uint32 mpls_count = 54;
  uint32 mpls_1_ttl = 55; // First TTL
  uint32 mpls_1_label = 56; // First Label
  uint32 mpls_2_ttl = 57; // Second TTL
  uint32 mpls_2_label = 58; // Second Label
  uint32 mpls_3_ttl = 59; // Third TTL
  uint32 mpls_3_label = 60; // Third Label
  uint32 mpls_last_ttl = 61; // Last TTL
  uint32 mpls_last_label = 62; // Last Label
  bytes mpls_label_ip = 65; // MPLS TOP Label IP 

  uint32 observation_domain_id = 70;
  uint32 observation_point_id = 71;

  string src_country = 1000;
  string dst_country = 1001;

}