How to view NetFlow in WireShark

Open the packet capture file (.pcap format) in Wireshark

Select menu option Analyze->Decode As:

Select '+' in lower left corner to add an entry to the 'Decode As' window

Select 'none' in the 'current' column then choose 'cflow' from the list:

Select 'OK' to save the selection. Note flow packets are subsequently denoted as CFLOW in the protocol column:

Here is an example of a NetFlow v9 template:

This is an example of NetFlow v9 flow records:

Have more questions?

Was this article helpful?

0 out of 0 found this helpful

Provide feedback for the Documentation team!