MAC addresses (IN_SRC_MAC and OUT_DST_MAC fields) are omitted in NetFlow v9 exports. Packet capture of sent Netflow template: Cisco NetFlow/IPFIX Version: 9 Count: 23 SysUptime: 1117945.000000000 seconds Timestamp: Jun 28, 2017 09:12:41.000000000 Central Europe Daylight Time FlowSequence: 11272 SourceId: 0 FlowSet 1 [id=0] (Data Template): 256,259 FlowSet Id: Data Template (V9) (0) FlowSet Length: 172 Template (Id = 256, Count = 20) Template Id: 256 Field Count: 20 Field (1/20): IP_SRC_ADDR Field (2/20): IP_DST_ADDR Field (3/20): IP_NEXT_HOP Field (4/20): INPUT_SNMP Field (5/20): OUTPUT_SNMP Field (6/20): PKTS Field (7/20): BYTES Field (8/20): OUT_PKTS Field (9/20): OUT_BYTES Field (10/20): FIRST_SWITCHED Field (11/20): LAST_SWITCHED Field (12/20): L4_SRC_PORT Field (13/20): L4_DST_PORT Field (14/20): TCP_FLAGS Field (15/20): PROTOCOL Field (16/20): IP_TOS Field (17/20): SRC_AS Field (18/20): DST_AS Field (19/20): SRC_MASK Field (20/20): DST_MASK