NetFlow/IPFIX interface

The Allegro Network Multimeter can generate NetFlow/IPFIX message for the traffic it anlayses. The Settings allows to configure the IPFIX output. The IPFIX output can be configure to use a TCP or UDP connection to send IPFIX messages to a specific IP and port. See the Settings for detailed information about how to set the correct values.

IPFIX settings

It is possible to export standard IPFIX records as well as Allegro-specific interface statistics.

IPFIX flow export

The settings dialog allows to specify an active flow timeout. Even if a flow is active, the Allegro Network Multimeter will generate and send a flow record in the specified amount of time.

The flow export contains the following data:

• Start and end timestamp in nanoseconds (start can be time of last export)
• Source and destination IP address
• Source and destination port
• Layer 4 protocol (TCP, UDP, ...)
• ingress and egress network interface
• IP DSCP class
• VLAN IDs, if applicable
• Number of bytes and packets per direction

Instead of the ingress/egress network interface, it is possible to report the Virtual Link Group of the flow by enabling the corresponding option in the IPFIX settings.

Interface throughput measurement

The Allegro Network Multimeter is able to measure the throughput of interfaces on a millisecond basis to identify micro bursts in network connections. If the Allegro-specific interface statistics is enabled in the :ref:ipfix_settings, regular messages are sent containing the number of packets and bytes within a configurable time interval. The Allegro Network Multimeter can measure time intervals as small as one millisecond, the exact value can be chosen in the Interface and MAC throughput configuration section.

The message format is described as follows.

IPFIX message content

The IPFIX message contains the following fields:

allegroMessageType = 5

ingressInterface = ...

packetDeltaCount = ...

octetDeltaCount = ...

allegroUpdateIntervalMilliseconds = ...

observationTimeMilliseconds = ...

• message type 5 is the "interface throughput update" message.
• the ingress interface describes the corresponding network interface on which the packets have been receveived. The value corresponds to the interface ID in the interface stats web page.
• the packet delta count describes the number of packets within the specificied interval.
• the octet delta count describes the number of bytes of layer 2 within the specificied interval.
• the update interval describes the duration of the reported interval in milliseconds.
• the ovservation timestamp describes the UTC timestamp of the reported interval in milliseconds.

To calculate the (extrapolated) Bit/s throughput in the interval, the following formula can be used:

bps = octectDeltaCount * 8 * 1000000 / updateInterval

Detailed IPFIX message description

The IPFIX module sends IPFIX templates for all its message which is needed to decode the message. As reference, the format of the interface throughput updates is as follows:

Byte offset	Size	Meaning
0	1	message type (allegro packets enterprise field, field key 0)
1	4	ingress interface (predefined IPFIX field, field key 10)
5	8	packet delta count (predefined IPFIX field, field key 2)
13	8	octet delta count (predefined IPFIX field, field key 1)
21	8	update interval (allegro packets enterprise field, field key 13)
29	8	observation timestamp (predefined IPFIX field, field key 323)