Question

我在Cisco ASR 1001-X路由器上配置Netflow Flexible使用IPFIX协议，并成功接收来自它的IPFIX数据包。路由器使用导出器（观察域ID = 0）导出数据集，使用另一个导出器导出数据集（观察域ID = 1）。

我之前通过在GNS3上配置路由器进行了测试，但是我从同一个导出器（观察域ID）接收了数据集和模板集。

通过观察域ID和模板ID匹配数据和模板是否重要？或者我应该通过他们的template-id和source-ip匹配数据和模板！

Answer 1

来自https://tools.ietf.org/html/rfc7011（ipfix rfc）：

观察域ID（在邮件标题中）

  A 32-bit identifier of the Observation Domain that is locally
  unique to the Exporting Process.  The Exporting Process uses the
  Observation Domain ID to uniquely identify to the Collecting
  Process the Observation Domain that metered the Flows.  It is
  RECOMMENDED that this identifier also be unique per IPFIX Device.
  Collecting Processes SHOULD use the Transport Session and the
  Observation Domain ID field to separate different export streams
  originating from the same Exporter.  The Observation Domain ID
  SHOULD be 0 when no specific Observation Domain ID is relevant for
  the entire IPFIX Message, for example, when exporting the
  Exporting Process Statistics, or in the case of a hierarchy of
  Collectors when aggregated Data Records are exported.

模板ID（在模板记录中）

  Each Template Record is given a unique Template ID in the range
  256 to 65535.  This uniqueness is local to the Transport Session
  and Observation Domain that generated the Template ID.  Since
  Template IDs are used as Set IDs in the Sets they describe, 
  values 0-255 are reserved for special Set types
  (e.g., Template Sets themselves), and Templates and Options
  Templates cannot share Template IDs within a
  Transport Session and Observation Domain.  There are no
  constraints regarding the order of the Template ID allocation.  As
  Exporting Processes are free to allocate Template IDs as they see
  fit, Collecting Processes MUST NOT assume incremental Template
  IDs, or anything about the contents of a Template based on its
  Template ID alone.

也就是说，＆＃34;观察域名ID＆＃34; （在您的情况下为源ID）和＆＃34;模板ID＆＃34;唯一定义相应的数据记录。因此，通过source-id和template-id匹配数据和模板非常重要。

路由器从两个不同的源ID

1 个答案: