Trivial File Transfer Protocol (TFTP) is indicated in this flow. The device at 10.1.1.36 has sent a User Datagram Protocol (UDP) TFTP packet to the device at 10.2.1.74.

The show ip cache flow command is used to display a summary of NetFlow statistics. The DstP field indicates the destination port field and is displayed in hexadecimal. The hexadecimal value 45 converts to the decimal value 69, which is the port number used by TFTP.

The Pr field is used to indicate the IP protocol number and is displayed in hexadecimal. The Pr field is set to a hexadecimal value of 06 for Transmission Control Protocol (TCP) and to a hexadecimal value of 11 for UDP.

Domain Name System (DNS) communicates over TCP and UDP port 53. The decimal value53 converts to a hexadecimal value of 35. Therefore, the destination port field in the output of the show ip cache flow command would display a value of 0035 for DNS traffic.

File Transfer Protocol (FTP) communicates over TCP ports 20 and 21. The decimal values20 and 21 convert to hexadecimal values of 14 and 15, respectively. Therefore, the destination port field in the output of the show ip cache flow command would display a value of 0014 or 0015 for FTP traffic.

Hypertext Transfer Protocol (HTTP) communicates over TCP port 80. The decimal value 80converts to a hexadecimal value of 50. Therefore, the destination port field in the output of the show ip cache flow command would display a value of 0050 for HTTP traffic.

HTTP Secure (HTTPS) communicates over TCP port 443. The decimal value 443 converts toa hexadecimal value of 1BB. Therefore, the destination port field in the output of the show ip cache flow command would display a value of 01BB for HTTPS traffic.

Telnet communicates over TCP port 23. The decimal value 23 converts to a hexadecimal value of 17. Therefore, the destination port field in the output of the show ip cache flow command would display a value of 0017 for Telnet traffic.