Traffic Flow (NetFLow) question

RouterOS General
1

I’m looking at using the Traffic Flow to transmit data for usage based billing. I have inspected the Traffic Flow streams coming from my MT router and it seems to have a pretty limited field set. Right now I’m getting these fields:
1 - In Bytes
2 - InPkts
4 - Protocol
5 - SrcTOS
6 - TCPFlags
7 - Src Port
8 - Src Address
10 - InputSNMP
11 - L4 Dst Port
12 - Dst Addr
13 - Dst Mask
14 - Output SNMP
15 - IPV4 Next Hop
21 - last switched
22 - first switched

These are a nice start, but I would also like some more…espcially 9 - Src MAC. Since I run DHCP, it is difficult to track usage simply by IP. It would be better to track by MAC. Any chance of including some more fields in the NetFlow stream coming out?

2

Fields exist for MAC addresses but sadly RouterOS doesn’t let you edit templates used.

Maybe email support@mikrotik.com for an official feature request.

3

Same question! I need src_mac and dst_mac.

Any ideas?

I see these fields:
Template (Id = 256, Count = 16)
Template Id: 256
Field Count: 16
Field (1/16)
Type: LAST_SWITCHED (21)
Length: 4
Field (2/16)
Type: FIRST_SWITCHED (22)
Length: 4
Field (3/16)
Type: PKTS (2)
Length: 4
Field (4/16)
Type: BYTES (1)
Length: 4
Field (5/16)
Type: INPUT_SNMP (10)
Length: 4
Field (6/16)
Type: OUTPUT_SNMP (14)
Length: 4
Field (7/16)
Type: IP_SRC_ADDR (8)
Length: 4
Field (8/16)
Type: IP_DST_ADDR (12)
Length: 4
Field (9/16)
Type: PROTOCOL (4)
Length: 1
Field (10/16)
Type: IP_TOS (5)
Length: 1
Field (11/16)
Type: L4_SRC_PORT (7)
Length: 2
Field (12/16)
Type: L4_DST_PORT (11)
Length: 2
Field (13/16)
Type: IP_NEXT_HOP (15)
Length: 4
Field (14/16)
Type: DST_MASK (13)
Length: 1
Field (15/16)
Type: SRC_MASK (9)
Length: 1
Field (16/16)
Type: TCP_FLAGS (6)
Length: 1
Template (Id = 257, Count = 19)
Template Id: 257
Field Count: 19
Field (1/19)
Type: IP_PROTOCOL_VERSION (60)
Length: 1
Field (2/19)
Type: IPV6_SRC_ADDR (27)
Length: 16
Field (3/19)
Type: IPV6_SRC_MASK (29)
Length: 1
Field (4/19)
Type: INPUT_SNMP (10)
Length: 4
Field (5/19)
Type: IPV6_DST_ADDR (28)
Length: 16
Field (6/19)
Type: IPV6_DST_MASK (30)
Length: 1
Field (7/19)
Type: OUTPUT_SNMP (14)
Length: 4
Field (8/19)
Type: IPV6_NEXT_HOP (62)
Length: 16
Field (9/19)
Type: PROTOCOL (4)
Length: 1
Field (10/19)
Type: TCP_FLAGS (6)
Length: 1
Field (11/19)
Type: IP_TOS (5)
Length: 1
Field (12/19)
Type: L4_SRC_PORT (7)
Length: 2
Field (13/19)
Type: L4_DST_PORT (11)
Length: 2
Field (14/19)
Type: FLOW_LABEL (31)
Length: 4
Field (15/19)
Type: IPV6_OPTION_HEADERS (64)
Length: 4
Field (16/19)
Type: LAST_SWITCHED (21)
Length: 4
Field (17/19)
Type: FIRST_SWITCHED (22)
Length: 4
Field (18/19)
Type: BYTES (1)
Length: 4
Field (19/19)
Type: PKTS (2)
Length: 4

4

Has this been solved???

I too need the SCR_MAC address in traffic flow