In NetFlow v9 and IPFIX, templates are used instead of a fixed set of fields (like PROTO). version = 5 # NetFlow v5 packet assert p. Or from hex dump: import netflow p = netflow. parse_packet ( payload ) # Test result: print ( p. recvfrom ( 4096 ) # experimental, tested with 1464 bytes p = netflow. Call the netflow.parse_packet() function with the payload as first argument (takes string, bytes string and hex'd bytes).Įxample UDP collector server (receiving exports on port 2055): import netflow import socket sock = socket.For NetFlow v5 it should begin with bytes 0005 for example. Inside the UDP packets, the NetFlow payload is contained.It should then receive UDP packets from exporters. Create a collector which listens for exported packets on some UDP port.If you chose to use the classes provided by this library directly, here's an example for a NetFlow v5 export packet:

All related classes are contained in netflow.ipfix.Ĭopyright 2016-2021 Dominik Pataky under MIT License.

IPFIX (IP Flow Information Export) is based on NetFlow v9 and standardized by the IETF. By importing netflow.v1, netflow.v5 or netflow.v9 you have direct access to the respective parsing objects, but at the beginning you probably will have more success by running the reference collector (example below) and look into its code. The library provides the netflow.parse_packet() function as the main API point (see below). Templates make dynamically sized and configured NetFlow data flowsets possible, which makes the collector's job harder. Version 9 is the first NetFlow version using templates. This package contains libraries and tools for NetFlow versions 1, 5 and 9, and IPFIX.

Netflow analysis