Netflow IP accounting and IP protocol numbers

Thu Nov 20 15:22:17 UTC 1997

The other day we started using Cisco netflow accounting software
together with IP flow export feature of recent Cisco IOS versions.

What we found was that although we put a lot of protocols in the
nfknown.protocols file of the accounting software (everywthing we
could find in the /etc/services file of Solaris and Linux), there
is still a lot of traffic under TCP-Other and UDP-Other. This
indicated that traffic is going over our network using ports that
the software doesn't know about.

This could for example be Real-audio, Cuseeme, Pointcast, Backweb
etc traffic. Unfortunately, I don't have a list of these newer
protocols together with their port numbers. Has anyone compiled
such a list? There's the Assigned numbers RFC but the last version
of it is RFC 1700 of October 1994.

-- Steven