cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
291
Views
0
Helpful
1
Replies
Highlighted
Beginner

About Clien IP details in Cisco WLC NetFlow Export

Hi , 

I recently found that the Cisco WLC is sending the netflow information Source and Destination IP and not included the Client IP address in the flow. 

 

Can someone help to understand which IP address can be considered as the Client IP address in the new WLC netflow export format.

 

Regards, 

Senthil.n

1 REPLY 1
Highlighted
Collaborator
Collaborator

Hi 

I flow record consists of below fields .. these dont include client IP specifically. 

Flow Record Field

Value

Source IP address

192.168.10.1

Destination IP address

93.184.216.34

Source port

17238

Destination port

80

Protocol

TCP

Depending on the version of NetFlow, the router can also gather additional information, such as type of service (ToS) byte, differentiated services code point (DSCP), the device’s input interface, TCP flags, byte counters, and start and end times.

Flexible NetFlow, Cisco’s next-generation NetFlow, can track a wide range of Layer 2, IPv4, and IPv6 flow information, such as the following:

  • Source and destination MAC addresses

  • Source and destination IPv4 or IPv6 addresses

  • Source and destination ports

  • ToS

  • DSCP

  • Packet and byte counts

  • Flow timestamps

  • Input and output interface numbers

  • TCP flags and encapsulated protocol (TCP/UDP) and individual TCP flags

  • Sections of a packet for deep packet inspection

  • All fields in an IPv4 header, including IP-ID and TTL

  • All fields in an IPv6 header, including Flow Label and Option Header

  • Routing information, such as next-hop address, source autonomous system number (ASN), destination ASN, source prefix mask, destination prefix mask, Border Gateway Protocol (BGP) next hop, and BGP policy accounting traffic index

NetFlow protocol data units (PDUs), also referred to as flow records, are generated and sent to a NetFlow collector after the flow concludes or expires (times out).

http://www.ciscopress.com/articles/article.asp?p=2812391&seqNum=2

 

 

Hope that helps.