["Chris Rutherford" <chrismrutherford@xxxxxxxxxxxxxx>]

Hi All,

I'm experiencing some issues with successfully extracting all netflow 9 data from the export packets.   Im using the following CIL options to decode the data and i get the folowing results, but I don't see all the netflow data.  Ive tried searching but there don't seem to be any clear answers.  Do you know if it is possible to display all netflow 9 data instead of just "Type X".  Ideally I'd be receiving MAC info.

 tshark -ni eth0 -R udp.port==10001 -d udp.port==10001,cflow -V

Cisco NetFlow/IPFIX
    Version: 9
    Count: 19
    SysUptime: 10008984
    Timestamp: May 25, 2007 21:11:02.000000000
        CurrentSecs: 1180123862
    FlowSequence: 2568
    SourceId: 0
    FlowSet 1
        Data FlowSet (Template Id): 256
        FlowSet Length: 1336
        Flow 1
            EndTime: 9993.748000000 seconds
            StartTime: 
9993.748000000 seconds
            Octets: 28
            Packets: 1
            InputInt: 3
            OutputInt: 2
            SrcAddr: 192.168.0.3 (
192.168.0.3)
            DstAddr: 192.168.48.3 (192.168.48.3)
            Protocol: 17
            IP ToS: 0x00
            SrcPort: 3000
            DstPort: 0
            Type 48
            Type 51
            NextHop: 192.168.24.2 (192.168.24.2)
            DstMask: 24
            SrcMask: 24
            TCP Flags: 0x10
            Type 61  /*<----Why??
            Type 25
            Type 26
            Type 32
            Type 52
            Type 53
            Type 54
            Type 56
            Type 57  <----Why?? */
            DstAS: 0
            SrcAS: 0

blade2:chris#  tshark -v                                                        
TShark 0.99.4

Copyright 1998-2006 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.12.4, with libpcap 0.9.5, with libz 1.2.3, with libpcre
6.7, without UCD-SNMP or Net-SNMP, with ADNS, without Lua, with GnuTLS 1.4.4,
with Gcrypt 1.2.3, without Kerberos.

Running on Linux 
2.6.18 , with libpcap version 0.9.5.

Built using gcc 4.1.2 20061028 (prerelease) (Debian 4.1.1-19).