flow_export.h File Reference

Flow-record export codec (DETWS_ENABLE_FLOW_EXPORT) - zero-heap exporter-side builders for NetFlow v5, NetFlow v9 (RFC 3954), and IPFIX (RFC 7011), so a device can ship on-device flow accounting to a collector over the existing UDP transport. More...

#include "ServerConfig.h"

Go to the source code of this file.

Detailed Description

Flow-record export codec (DETWS_ENABLE_FLOW_EXPORT) - zero-heap exporter-side builders for NetFlow v5, NetFlow v9 (RFC 3954), and IPFIX (RFC 7011), so a device can ship on-device flow accounting to a collector over the existing UDP transport.

Three formats, all big-endian on the wire:

• NetFlow v5: a fixed legacy layout - a 24-octet header then N fixed 48-octet records.
• NetFlow v9 / IPFIX: the template-then-data model - the exporter sends Template records describing a record's field layout, then Data records that match a template by id.

The v9 / IPFIX side is a small cursor (FlowWriter): begin the message, emit a template, open a data set, append records, then finish (which patches the message length for IPFIX or the record count for v9). Field offsets verified against RFC 7011 (IPFIX), RFC 3954 (NetFlow v9), and the published v5 record layout.

This is the wire codec only; the flow cache (the 5-tuple + counters) is the app's, and the datagram send is det_udp_sendto.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file flow_export.h.