NetFlow v9 Template and Data Packet Capture

This packet capture contains two NetFlow version 9 export packets from a Cisco router to a collector. The first one carries a template: a list of field types and lengths, with no traffic data at all. The second one carries a data record that only makes sense with that template.

That split is what makes NetFlow v9 flexible, and it’s also why a collector that misses the template can’t decode anything. The introduction to NetFlow lesson covers the configuration. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	netflow-v9-template-and-data.pcapng
Packets	2
Protocol	NetFlow version 9 (RFC 3954)
Transport	UDP, exporter 192.168.23.3 → collector 192.168.23.2 port 2055
Devices	Cisco IOS router exporting flows
Wireshark filter	cflow. If Wireshark shows plain UDP, use Decode As: UDP port 2055 → CFLOW.

Packets in this capture

No.  Time      Source        Destination   Protocol  Info
1    0.000000  192.168.23.3  192.168.23.2  CFLOW     total: 1 (v9) record Obs-Domain-ID= 0 [Data-Template:256]
2    3.999254  192.168.23.3  192.168.23.2  CFLOW     total: 1 (v9) record Obs-Domain-ID= 0 [Data:256]

Packet walkthrough

Template FlowSet (packet 1)

User Datagram Protocol, Src Port: 53261, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 2 minutes, 50.752000000 seconds
    Timestamp: Oct 29, 2026 14:32:42.000000000 UTC
        CurrentSecs: 1793284362
    FlowSequence: 2
    SourceId: 0
    FlowSet 1 [id=0] (Data Template): 256
        FlowSet Id: Data Template (V9) (0)
        FlowSet Length: 40
        Template (Id = 256, Count = 8)
            Template Id: 256
            Field Count: 8
            Field (1/8): IP_SRC_ADDR
                Type: IP_SRC_ADDR (8)
                Length: 4
            Field (2/8): IP_DST_ADDR
                Type: IP_DST_ADDR (12)
                Length: 4
            Field (3/8): INPUT_SNMP
                Type: INPUT_SNMP (10)
                Length: 4
            Field (4/8): L4_SRC_PORT
                Type: L4_SRC_PORT (7)
                Length: 2
            Field (5/8): L4_DST_PORT
                Type: L4_DST_PORT (11)
                Length: 2
            Field (6/8): PROTOCOL
                Type: PROTOCOL (4)
                Length: 1
            Field (7/8): BYTES
                Type: BYTES (1)
                Length: 8
            Field (8/8): PKTS
                Type: PKTS (2)
                Length: 8

Here’s what this packet tells us:

• Version 9: the header looks like older NetFlow versions, but the records don’t have a fixed format anymore.
• SysUptime and Timestamp: the router’s uptime in milliseconds and the export time. The collector uses them to turn flow start and end times into real times.
• FlowSequence 2: a counter per exported packet. A gap tells the collector it lost export packets.
• SourceId 0: identifies the exporting process on the router. Together with the source IP address, it tells the collector which templates belong to which exporter.
• FlowSet Id 0 means “this FlowSet contains templates”. IDs 0 to 255 are reserved for that kind of control information.
• Template Id 256, 8 fields: source and destination IP address (4 bytes each), input interface (INPUT_SNMP, the ifIndex), source and destination port (2 bytes each), protocol (1 byte), and BYTES and PKTS (8 bytes each). That makes 33 bytes per flow record.

Data FlowSet (packet 2)

Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 2 minutes, 54.751000000 seconds
    Timestamp: Oct 29, 2026 14:32:46.000000000 UTC
        CurrentSecs: 1793284366
    FlowSequence: 3
    SourceId: 0
    FlowSet 1 [id=256] (1 flows)
        FlowSet Id: (Data) (256)
        FlowSet Length: 37
        Flow 1
            SrcAddr: 192.168.34.4
            DstAddr: 192.168.34.3
            InputInt: 2
            SrcPort: 0
            DstPort: 2048
            Protocol: ICMP (1)
            Octets: 1000
            Packets: 10

Let’s walk through the highlighted fields:

• FlowSet Id 256: data records that use template 256. Without the template from packet 1, this FlowSet is just 33 bytes of numbers.
• FlowSet Length 37: 4 bytes of FlowSet header plus one 33-byte record.
• The flow: from 192.168.34.4 to 192.168.34.3, received on interface 2, ICMP, 10 packets and 1000 bytes. That’s ten 100-byte pings.
• DstPort 2048 for an ICMP flow: ICMP has no ports, so NetFlow stores the ICMP type and code in the destination port field: type × 256 + code. 2048 = 8 × 256 + 0, an echo request.
• FlowSequence 3: the next export packet after the template. The router keeps resending the template periodically, so a collector that starts later can still decode the data.