[Motonori Shindo <mshindo@xxxxxxxxxxx>]

Nadeem,

From: "Nadeem Lughmani" <nlughman@xxxxxxxxxxxxxxxxxxx>
Subject: [Ethereal-users] sinffing NetFlow Packets
Date: Mon, 26 Jan 2004 19:48:02 -0800

> I am using ethereal version 0.9.16. When I capture NetFlow packets , they are not decoded , they 
> are simply shown as udp packets. I have read that ethereal supports NetFlow packets.
> Any idea what is going on here..?

Cisco's NetFlow doesn't have a standard port number. Instead, it is
usually configured on both probe device (i.e. routers, switches, etc.)
and the collector explicitly.

To have Ethereal to dissect the packet as NetFlow, you have to
instruct Ethereal which port number is being used as NetFlow. You can
do this by selecting CFLOW from protocols listed in 'Analyze' ->
'Decode As' (this menu item may not exist in the location as described
in Ethereal you're using, but you can easily find the it at somewhere
else in the menu).

Regards,