We clearly must store these fields separately as they have different meaning and we had one dump where these fields were set to different values.

It happened for dropped / filtered traffic.

So far we have no examples to review Cisco ASR 9000 behaviour in IPFIX way and Juniper / Nokia dumps are missing for Netflow v9 mode.

After getting all these dumps we will try to find way to integrate processing of these fields.

Cisco ASR 9000 uses single field 18 for Netflow v9 encoding:

Nokia SR is doing it exactly same way actually with exactly same fields for IPFIX:

This question is way more complicated then expected.

Juniper for example uses two next hop fields in IPFIX encoding.

Should we add both or merge them into single if they match? Same issue with other vendors as we do now know how they encode it.