Flow NetStream Log Format

Both centralized and distributed CGN devices support flow NetStream logs. Flow NetStream logs are sent to a log server in binary format.

Only NAT444 scenario support flow NetStream log format.

**Table 1** Description of log syntax fields
Field	Description	Length in Bytes	Remarks
version	Version number. The value is fixed at 9.	2	It is carried in the header of a flow NetStream log packet.
count	Sum of the number of template FlowSet records and the number of data FlowSet records.	2
sysUpTime	Time used since the service board is powered on, in milliseconds.	4
UNIX Secs	Number of seconds since January 1, 1970, 00:00 (UTC).	4
Sequence Number	Sequence number of a packet.	4
Source ID	Instance ID (8 bits) + CPU ID (8 bits) + Slot ID (8 bits) + Scenario (4 bits) + Instance ID (4 bits)	4
FlowSet ID	The value of this field is 0.	2	It identifies a NetStream log template.
Length	Length of a NetStream log template. It is expressed in bytes.	2
Template ID	ID of a NetStream log template: In a session creation scenario, the value is 259. In a session deletion scenario, the value is 260.	2
Field Count	The value of this field is 13.	2
timeStamp	Timestamp of a packet.	2
Length	Length of the timestamp.	2
vlanID	VPN ID	2
Length	Length of the VPN ID.	2
Source IPv4 Address	Source IPv4 address.	2
Length	Length of the source IPv4 address.	2
Post NAT Source IPv4 Address	Source IPv4 address after NAT is implemented.	2
Length	Length of the source IPv4 address after NAT is implemented.	2
Protocol Identifier	Identifier of an IP protocol.	2
Length	Length of the IP protocol.	2
Source Transport Port	Source port number.	2
Length	Length of the source port number.	2
Post NAT source Transport Port	Source port number after NAT is implemented.	2
Length	Length of the source port number after NAT is implemented.	2
Destination IPv4 Address	Destination IPv4 address.	2
Length	Length of the destination IPv4 address.	2
Post NAT Destination IPv4 Address	Destination IPv4 address after NAT is implemented.	2
Length	Length of the destination IPv4 address after NAT is implemented.	2
Destination Transport Port	Destination port number.	2
Length	Length of the destination port number.	2
Post NAT destination Transport Port	Destination port number after NAT is implemented.	2
Length	Length of the destination port number after NAT is implemented.	2
Nat Originating Address Realm	Initiator of a session: For an access from a private network to a public network, the value is 1. For an access from a public network to a private network, the value is 2.	2
Length	Length of the initiator of a session.	2
Nat Event	Type of a NAT event. 1: Newly created session 2: Non-new session	2
Length	Length of the type of a NAT event.	2
FlowSet ID	ID of a FlowSet record.	2	Body of a NetStream log
Length	Length of the sum of data FlowSet records.	2
timeStamp	Timestamp of a packet.	8
vlanID	VPN ID	4
Source IPv4 Address	Source IPv4 address.	4
Post NAT Source IPv4 Address	Source IPv4 address after NAT is implemented.	4
Protocol Identifier	Identifier of an IP protocol.	1
Source Transport Port	Source port number.	2
Post NAT source Transport Port	Source port number after NAT is implemented.	2
Destination IPv4 Address	Destination IPv4 address.	4
Post NAT Destination IPv4 Address	Destination IPv4 address after NAT is implemented.	4
Destination Transport Port	Destination port number.	2
Post NAT destination Transport Port	Destination port number after NAT is implemented.	2
Nat Originating Address Realm	Initiator of a session: For an access from a private network to a public network, the value is 1. For an access from a public network to a private network, the value is 2.	1
Nat Event	Type of a NAT event.	1