NetFlow IEs
The Flow Data collector supports Netflow v1, v5, v6, v7 and v9 flow records.
NetFlow v1
The collector supports the following Netflow v1 information elements (IEs):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- prot
- tos
- tcp_flags
NetFlow v5
The collector supports the following Netflow v5 information elements (IE):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- tcp_flags
- prot
- tos
- src_as
- dst_as
- src_mask
- dst_mask
NetFlow v6
The collector supports the following Netflow v6 information elements (IE):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- tcp_flags
- prot
- tos
- src_as
- dst_as
- src_mask
- dst_mask
NetFlow v7
The collector supports the following Netflow v7 information elements (IE):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- tcp_flags
- prot
- tos
- src_as
- dst_as
- src_mask
- dst_mask
- ipv4RouterSc
NetFlow v9
NetFlow v9 supports the following standards-based IEs (PEN: 0):
| ID | Name |
|---|---|
| 1 | octetDeltaCount |
| 2 | packetDeltaCount |
| 3 | deltaFlowCount |
| 4 | protocolIdentifier |
| 5 | ipClassOfService |
| 6 | tcpControlBits |
| 7 | sourceTransportPort |
| 8 | sourceIPv4Address |
| 9 | sourceIPv4PrefixLength |
| 10 | ingressInterface |
| 11 | destinationTransportPort |
| 12 | destinationIPv4Address |
| 13 | destinationIPv4PrefixLength |
| 14 | egressInterface |
| 15 | ipNextHopIPv4Address |
| 16 | bgpSourceAsNumber |
| 17 | bgpDestinationAsNumber |
| 18 | bgpNextHopIPv4Address |
| 19 | postMCastPacketDeltaCount |
| 20 | postMCastOctetDeltaCount |
| 21 | flowEndSysUpTime |
| 22 | flowStartSysUpTime |
| 23 | postOctetDeltaCount |
| 24 | postPacketDeltaCount |
| 25 | minimumIpTotalLength |
| 26 | maximumIpTotalLength |
| 27 | sourceIPv6Address |
| 28 | destinationIPv6Address |
| 29 | sourceIPv6PrefixLength |
| 30 | destinationIPv6PrefixLength |
| 31 | flowLabelIPv6 |
| 32 | icmpTypeCodeIPv4 |
| 33 | igmpType |
| 34 | samplingInterval |
| 35 | samplingAlgorithm |
| 36 | flowActiveTimeout |
| 37 | flowIdleTimeout |
| 38 | engineType |
| 39 | engineId |
| 40 | exportedOctetTotalCount |
| 41 | exportedMessageTotalCount |
| 42 | exportedFlowRecordTotalCount |
| 44 | sourceIPv4Prefix |
| 45 | destinationIPv4Prefix |
| 46 | mplsTopLabelType |
| 47 | mplsTopLabelIPv4Address |
| 48 | samplerId |
| 49 | samplerMode |
| 50 | samplerRandomInterval |
| 51 | classId |
| 52 | minimumTTL |
| 53 | maximumTTL |
| 54 | fragmentIdentification |
| 55 | postIpClassOfService |
| 56 | sourceMacAddress |
| 57 | postDestinationMacAddress |
| 58 | vlanId |
| 59 | postVlanId |
| 60 | ipVersion |
| 61 | flowDirection |
| 62 | ipNextHopIPv6Address |
| 63 | bgpNextHopIPv6Address |
| 64 | ipv6ExtensionHeaders |
| 65 | transportPacketLoss Cisco Legacy |
| 66 | transportUnreachability Cisco Legacy |
| 67 | transportLatency Cisco Legacy |
| 68 | dataPoints Cisco Legacy |
| 69 | variance Cisco Legacy |
| 70 | mplsTopLabelStackSection |
| 71 | mplsLabelStackSection2 |
| 72 | mplsLabelStackSection3 |
| 73 | mplsLabelStackSection4 |
| 74 | mplsLabelStackSection5 |
| 75 | mplsLabelStackSection6 |
| 76 | mplsLabelStackSection7 |
| 77 | mplsLabelStackSection8 |
| 78 | mplsLabelStackSection9 |
| 79 | mplsLabelStackSection10 |
| 80 | destinationMacAddress |
| 81 | postSourceMacAddress |
| 82 | interfaceName |
| 83 | interfaceDescription |
| 84 | samplerName |
| 85 | octetTotalCount |
| 86 | packetTotalCount |
| 87 | flagsAndSamplerId |
| 88 | fragmentOffset |
| 89 | forwardingStatus |
| 90 | mplsVpnRouteDistinguisher |
| 91 | mplsTopLabelPrefixLength |
| 92 | srcTrafficIndex |
| 93 | dstTrafficIndex |
| 94 | applicationDescription |
| 95 | applicationId |
| 96 | applicationName |
| 97 | subApplicationTag Cisco Legacy |
| 98 | postIpDiffServCodePoint |
| 99 | multicastReplicationFactor |
| 100 | className |
| 101 | classificationEngineId |
| 102 | layer2packetSectionOffset |
| 103 | layer2packetSectionSize |
| 104 | layer2packetSectionData |
| 105 | applicationVersion Cisco Legacy |
| 106 | applicationVersionName Cisco Legacy |
| 107 | applicationVendor Cisco Legacy |
| 109 | subApplicationName Cisco Legacy |
| 110 | subApplicationDescription Cisco Legacy |
| 111 | templateParameterRangeEnd Cisco Legacy |
| 128 | bgpNextAdjacentAsNumber |
| 129 | bgpPrevAdjacentAsNumber |
| 130 | exporterIPv4Address |
| 131 | exporterIPv6Address |
| 132 | droppedOctetDeltaCount |
| 133 | droppedPacketDeltaCount |
| 134 | droppedOctetTotalCount |
| 135 | droppedPacketTotalCount |
| 136 | flowEndReason |
| 137 | commonPropertiesId |
| 138 | observationPointId |
| 139 | icmpTypeCodeIPv6 |
| 140 | mplsTopLabelIPv6Address |
| 141 | lineCardId |
| 142 | portId |
| 143 | meteringProcessId |
| 144 | exportingProcessId |
| 145 | templateId |
| 146 | wlanChannelId |
| 147 | wlanSSID |
| 148 | flowId |
| 149 | observationDomainId |
| 150 | flowStartSeconds |
| 151 | flowEndSeconds |
| 152 | flowStartMilliseconds |
| 153 | flowEndMilliseconds |
| 154 | flowStartMicroseconds |
| 155 | flowEndMicroseconds |
| 156 | flowStartNanoseconds |
| 157 | flowEndNanoseconds |
| 158 | flowStartDeltaMicroseconds |
| 159 | flowEndDeltaMicroseconds |
| 160 | systemInitTimeMilliseconds |
| 161 | flowDurationMilliseconds |
| 162 | flowDurationMicroseconds |
| 163 | observedFlowTotalCount |
| 164 | ignoredPacketTotalCount |
| 165 | ignoredOctetTotalCount |
| 166 | notSentFlowTotalCount |
| 167 | notSentPacketTotalCount |
| 168 | notSentOctetTotalCount |
| 169 | destinationIPv6Prefix |
| 170 | sourceIPv6Prefix |
| 171 | postOctetTotalCount |
| 172 | postPacketTotalCount |
| 173 | flowKeyIndicator |
| 174 | postMCastPacketTotalCount |
| 175 | postMCastOctetTotalCount |
| 176 | icmpTypeIPv4 |
| 177 | icmpCodeIPv4 |
| 178 | icmpTypeIPv6 |
| 179 | icmpCodeIPv6 |
| 180 | udpSourcePort |
| 181 | udpDestinationPort |
| 182 | tcpSourcePort |
| 183 | tcpDestinationPort |
| 184 | tcpSequenceNumber |
| 185 | tcpAcknowledgementNumber |
| 186 | tcpWindowSize |
| 187 | tcpUrgentPointer |
| 188 | tcpHeaderLength |
| 189 | ipHeaderLength |
| 190 | totalLengthIPv4 |
| 191 | payloadLengthIPv6 |
| 192 | ipTTL |
| 193 | nextHeaderIPv6 |
| 194 | mplsPayloadLength |
| 195 | ipDiffServCodePoint |
| 196 | ipPrecedence |
| 197 | fragmentFlags |
| 198 | octetDeltaSumOfSquares |
| 199 | octetTotalSumOfSquares |
| 200 | mplsTopLabelTTL |
| 201 | mplsLabelStackLength |
| 202 | mplsLabelStackDepth |
| 203 | mplsTopLabelExp |
| 204 | ipPayloadLength |
| 205 | udpMessageLength |
| 206 | isMulticast |
| 207 | ipv4IHL |
| 208 | ipv4Options |
| 209 | tcpOptions |
| 210 | paddingOctets |
| 211 | collectorIPv4Address |
| 212 | collectorIPv6Address |
| 213 | exportInterface |
| 214 | exportProtocolVersion |
| 215 | exportTransportProtocol |
| 216 | collectorTransportPort |
| 217 | exporterTransportPort |
| 218 | tcpSynTotalCount |
| 219 | tcpFinTotalCount |
| 220 | tcpRstTotalCount |
| 221 | tcpPshTotalCount |
| 222 | tcpAckTotalCount |
| 223 | tcpUrgTotalCount |
| 224 | ipTotalLength |
| 225 | postNATSourceIPv4Address |
| 226 | postNATDestinationIPv4Address |
| 227 | postNAPTSourceTransportPort |
| 228 | postNAPTDestinationTransportPort |
| 229 | natOriginatingAddressRealm |
| 230 | natEvent |
| 231 | initiatorOctets |
| 232 | responderOctets |
| 233 | firewallEvent |
| 234 | ingressVRFID |
| 235 | egressVRFID |
| 236 | VRFname |
| 237 | postMplsTopLabelExp |
| 238 | tcpWindowScale |
| 239 | biflowDirection |
| 240 | ethernetHeaderLength |
| 241 | ethernetPayloadLength |
| 242 | ethernetTotalLength |
| 243 | dot1qVlanId |
| 244 | dot1qPriority |
| 245 | dot1qCustomerVlanId |
| 246 | dot1qCustomerPriority |
| 247 | metroEvcId |
| 248 | metroEvcType |
| 249 | pseudoWireId |
| 250 | pseudoWireType |
| 251 | pseudoWireControlWord |
| 252 | ingressPhysicalInterface |
| 253 | egressPhysicalInterface |
| 254 | postDot1qVlanId |
| 255 | postDot1qCustomerVlanId |
| 256 | ethernetType |
| 257 | postIpPrecedence |
| 258 | collectionTimeMilliseconds |
| 259 | exportSctpStreamId |
| 260 | maxExportSeconds |
| 261 | maxFlowEndSeconds |
| 262 | messageMD5Checksum |
| 263 | messageScope |
| 264 | minExportSeconds |
| 265 | minFlowStartSeconds |
| 266 | opaqueOctets |
| 267 | sessionScope |
| 268 | maxFlowEndMicroseconds |
| 269 | maxFlowEndMilliseconds |
| 270 | maxFlowEndNanoseconds |
| 271 | minFlowStartMicroseconds |
| 272 | minFlowStartMilliseconds |
| 273 | minFlowStartNanoseconds |
| 274 | collectorCertificate |
| 275 | exporterCertificate |
| 276 | dataRecordsReliability |
| 277 | observationPointType |
| 278 | newConnectionDeltaCount |
| 279 | connectionSumDurationSeconds |
| 280 | connectionTransactionId |
| 281 | postNATSourceIPv6Address |
| 282 | postNATDestinationIPv6Address |
| 283 | natPoolId |
| 284 | natPoolName |
| 285 | anonymizationFlags |
| 286 | anonymizationTechnique |
| 287 | informationElementIndex |
| 288 | p2pTechnology |
| 289 | tunnelTechnology |
| 290 | encryptedTechnology |
| 294 | bgpValidityState |
| 295 | IPSecSPI |
| 296 | greKey |
| 297 | natType |
| 298 | initiatorPackets |
| 299 | responderPackets |
| 300 | observationDomainName |
| 301 | selectionSequenceId |
| 302 | selectorId |
| 303 | informationElementId |
| 304 | selectorAlgorithm |
| 305 | samplingPacketInterval |
| 306 | samplingPacketSpace |
| 307 | samplingTimeInterval |
| 308 | samplingTimeSpace |
| 309 | samplingSize |
| 310 | samplingPopulation |
| 311 | samplingProbability |
| 312 | dataLinkFrameSize |
| 313 | ipHeaderPacketSection |
| 314 | ipPayloadPacketSection |
| 315 | dataLinkFrameSection |
| 316 | mplsLabelStackSection |
| 317 | mplsPayloadPacketSection |
| 318 | selectorIdTotalPktsObserved |
| 319 | selectorIdTotalPktsSelected |
| 320 | absoluteError |
| 321 | relativeError |
| 322 | observationTimeSeconds |
| 323 | observationTimeMilliseconds |
| 324 | observationTimeMicroseconds |
| 325 | observationTimeNanoseconds |
| 326 | digestHashValue |
| 327 | hashIPPayloadOffset |
| 328 | hashIPPayloadSize |
| 329 | hashOutputRangeMin |
| 330 | hashOutputRangeMax |
| 331 | hashSelectedRangeMin |
| 332 | hashSelectedRangeMax |
| 333 | hashDigestOutput |
| 334 | hashInitialiserValue |
| 335 | selectorName |
| 336 | upperCILimit |
| 337 | lowerCILimit |
| 338 | confidenceLevel |
| 339 | informationElementDataType |
| 340 | informationElementDescription |
| 341 | informationElementName |
| 342 | informationElementRangeBegin |
| 343 | informationElementRangeEnd |
| 344 | informationElementSemantics |
| 345 | informationElementUnits |
| 346 | privateEnterpriseNumber |
| 347 | virtualStationInterfaceId |
| 348 | virtualStationInterfaceName |
| 349 | virtualStationUUID |
| 350 | virtualStationName |
| 351 | layer2SegmentId |
| 352 | layer2OctetDeltaCount |
| 353 | layer2OctetTotalCount |
| 354 | ingressUnicastPacketTotalCount |
| 355 | ingressMulticastPacketTotalCount |
| 356 | ingressBroadcastPacketTotalCount |
| 357 | egressUnicastPacketTotalCount |
| 358 | egressBroadcastPacketTotalCount |
| 359 | monitoringIntervalStartMilliSeconds |
| 360 | monitoringIntervalEndMilliSeconds |
| 361 | portRangeStart |
| 362 | portRangeEnd |
| 363 | portRangeStepSize |
| 364 | portRangeNumPorts |
| 365 | staMacAddress |
| 366 | staIPv4Address |
| 367 | wtpMacAddress |
| 368 | ingressInterfaceType |
| 369 | egressInterfaceType |
| 370 | rtpSequenceNumber |
| 371 | userName |
| 372 | applicationCategoryName |
| 373 | applicationSubCategoryName |
| 374 | applicationGroupName |
| 375 | originalFlowsPresent |
| 376 | originalFlowsInitiated |
| 377 | originalFlowsCompleted |
| 378 | distinctCountOfSourceIPAddress |
| 379 | distinctCountOfDestinationIPAddress |
| 380 | distinctCountOfSourceIPv4Address |
| 381 | distinctCountOfDestinationIPv4Address |
| 382 | distinctCountOfSourceIPv6Address |
| 383 | distinctCountOfDestinationIPv6Address |
| 384 | valueDistributionMethod |
| 385 | rfc3550JitterMilliseconds |
| 386 | rfc3550JitterMicroseconds |
| 387 | rfc3550JitterNanoseconds |
| 388 | dot1qDEI |
| 389 | dot1qCustomerDEI |
| 390 | flowSelectorAlgorithm |
| 391 | flowSelectedOctetDeltaCount |
| 392 | flowSelectedPacketDeltaCount |
| 393 | flowSelectedFlowDeltaCount |
| 394 | selectorIDTotalFlowsObserved |
| 395 | selectorIDTotalFlowsSelected |
| 396 | samplingFlowInterval |
| 397 | samplingFlowSpacing |
| 398 | flowSamplingTimeInterval |
| 399 | flowSamplingTimeSpacing |
| 400 | hashFlowDomain |
| 401 | transportOctetDeltaCount |
| 402 | transportPacketDeltaCount |
| 403 | originalExporterIPv4Address |
| 404 | originalExporterIPv6Address |
| 405 | originalObservationDomainId |
| 406 | intermediateProcessId |
| 407 | ignoredDataRecordTotalCount |
| 408 | dataLinkFrameType |
| 409 | sectionOffset |
| 410 | sectionExportedOctets |
| 411 | dot1qServiceInstanceTag |
| 412 | dot1qServiceInstanceId |
| 413 | dot1qServiceInstancePriority |
| 414 | dot1qCustomerSourceMacAddress |
| 415 | dot1qCustomerDestinationMacAddress |
| 416 | layer2OctetDeltaCount |
| 417 | postLayer2OctetDeltaCount |
| 418 | postMCastLayer2OctetDeltaCount |
| 419 | layer2OctetTotalCount |
| 420 | postLayer2OctetTotalCount |
| 421 | postMCastLayer2OctetTotalCount |
| 422 | minimumLayer2TotalLength |
| 423 | maximumLayer2TotalLength |
| 424 | droppedLayer2OctetDeltaCount |
| 425 | droppedLayer2OctetTotalCount |
| 426 | ignoredLayer2OctetTotalCount |
| 427 | notSentLayer2OctetTotalCount |
| 428 | layer2OctetDeltaSumOfSquares |
| 429 | layer2OctetTotalSumOfSquares |
| 430 | layer2FrameDeltaCount |
| 431 | layer2FrameTotalCount |
| 432 | pseudoWireDestinationIPv4Address |
| 433 | ignoredLayer2FrameTotalCount |
| 434 | mibObjectValueInteger |
| 435 | mibObjectValueOctetString |
| 436 | mibObjectValueOID |
| 437 | mibObjectValueBits |
| 438 | mibObjectValueIPAddress |
| 439 | mibObjectValueCounter |
| 440 | mibObjectValueGauge |
| 441 | mibObjectValueTimeTicks |
| 442 | mibObjectValueUnsigned |
| 445 | mibObjectIdentifier |
| 446 | mibSubIdentifier |
| 447 | mibIndexIndicator |
| 448 | mibCaptureTimeSemantics |
| 449 | mibContextEngineID |
| 450 | mibContextName |
| 451 | mibObjectName |
| 452 | mibObjectDescription |
| 453 | mibObjectSyntax |
| 454 | mibModuleName |
| 455 | mobileIMSI |
| 456 | mobileMSISDN |
| 457 | httpStatusCode |
| 458 | sourceTransportPortsLimit |
| 459 | httpRequestMethod |
| 460 | httpRequestHost |
| 461 | httpRequestTarget |
| 462 | httpMessageVersion |
| 463 | natInstanceID |
| 464 | internalAddressRealm |
| 465 | externalAddressRealm |
| 466 | natQuotaExceededEvent |
| 467 | natThresholdEvent |
| 468 | httpUserAgent |
| 469 | httpContentType |
| 470 | httpReasonPhrase |
| 471 | maxSessionEntries |
| 472 | maxBIBEntries |
| 473 | maxEntriesPerUser |
| 474 | maxSubscribers |
| 475 | maxFragmentsPendingReassembly |
| 476 | addressPoolHighThreshold |
| 477 | addressPoolLowThreshold |
| 478 | addressPortMappingHighThreshold |
| 479 | addressPortMappingLowThreshold |
| 480 | addressPortMappingPerUserHighThreshold |
| 481 | globalAddressMappingHighThreshold |
| 482 | vpnIdentifier |
| 483 | bgpCommunity |
| 486 | bgpExtendedCommunity |
| 489 | bgpLargeCommunity |
Cisco (Pen: 9)
- scTag
- scTrafficProcessorId
- scSourceIpSample
- scDestinationIpSample
- scFlowContextId
- scSubscriberId
- scPackageId
- scServiceId
- scProtocolId
- scSkipppedSessions
- scInitiatingSide
- scReportTime
- scTransactionDurationMillisec
- scTimeFrame
- scSessionUpstreamVolume
- scSessionDownstreamVolume
- scProtocolSignature
- scZoneId
- scFlavorId
- scFlowCloseMode
- scAccessString
- scInfoString
- scClientPort
- scServerPort
- scSubscriberCounterId
- scServiceUsageCounterId
- scBreachState
- scReason
- scConfiguredDuration
- scDuration
- scEndTime
- scUpstreamVolume
- scDownstreamVolume
- scSessions
- scSeconds
- scPackageCounterId
- scGeneratorId
- scServiceGlobalCounterId
- scConcurrentSessions
- scActiveSubscribers
- scTotalActiveSubscribers
- scLinkId
- scAttackId
- scAttackIp
- scAttackOtherIp
- scAttackPortNumber
- scAttackType
- scAttackSide
- scAttackIpProtocol
- scAttacks
- scAttackMaliciousSessions
- INGRESS_ACL_ID
- EGRESS_ACL_ID
- FW_EXT_EVENT
- FW_EVENT_LEVEL
- FW_EVENT_LEVEL_ID
- FW_CONFIGURED_VALUE
- FW_ERM_EXT_EVENT
- FW_ERM_EXT_EVENT_DESC
- audio rtp packets lost
- audio rtp packets expected
- audio rtp fwd out-of-sequence sum
- audio rtp seconds ok
- audio rtp seconds concealed
- audio rtp seconds concealed severe
- audio rtp jitter ticks
- audio g107 impairment
- audio g107 lossRate
- audio g107 codec baseline
- audio g107 codec baseline bpl
- audio g107 impairment one-way-delay
- audio concealment ratio now
- audio concealment ratio minimum
- audio concealment ratio maximum
- audio concealment time
- audio speech time
- audio packets ok
- audio packets cs
- audio packets scs
- audio packets rtp
- audio packets silence
- audio duration receive
- audio duration receive voice
- audio duration early packet
- audio duration clock adjust
- audio duration playout increase
- audio duration playout decrease
- audio duration late discard
- audio frame size
- audio frames-per-packet
- audio frame arriving times difference
- audio frame arriving times difference vari
- audio noise level current
- audio noise level average
- audio noise level minimum
- audio noise level maximum
- audio noise level configured
- audio snr current
- audio snr average
- audio snr minimum
- audio snr maximum
- audio snr configured
- vxlan sgt
- vxlan flags
- vxlan vtep input
- vxlan vtep output
- SGT_SOURCE_TAG
- SGT_DESTINATION_TAG
- SGT_SOURCE_NAME
- SGT_DESTINATION_NAME
- flow cts switch derived-sgt
- FW_EXT_EVENT
- FW_BLACKOUT_SECS
- FW_HALFOPEN_HIGH
- FW_HALFOPEN_RATE
- FW_ZONEPAIR_ID
- FW_MAX_SESSIONS
- FW_ZONEPAIR_NAME
- FW_EXT_EVENT_DESC
- FW_SUMMARY_PKT_CNT
- FW_HALFOPEN_CNT
- waas dre input
- waas dre output
- waas lz input
- waas lz output
- waas original bytes
- waas optimised bytes
- waas application
- waas class
- waas connection mode
- waas bytes input
- waas bytes output
- PACKETS_DROPPED
- counter packets dropped permanent
- PACKET_RATE
- BYTE_RATE
- application media bytes counter
- application media bytes counter permanent
- application media bytes rate
- application media packets counter
- application media packets counter permanen
- application media packets rate
- application media packets rate variation
- application media event
- monitor event
- timestamp interval
- transport packets expected counter
- transport packets expected counter permane
- transport round-trip-time
- transport event packet-loss counter
- transport event packet-loss counter perman
- transport packets lost counter
- transport packets lost counter permanent
- transport packets lost rate
- transport rtp ssrc
- transport rtp jitter mean
- transport rtp jitter minimum
- transport rtp jitter maximum
- misc unsupported
- counter bytes rate per-flow
- counter bytes rate per-flow min
- counter bytes rate per-flow max
- counter packets rate per-flow
- counter packets rate per-flow min
- counter packets rate per-flow max
- application media bytes rate per-flow
- application media bytes rate per-flow min
- application media bytes rate per-flow max
- application media packets rate variation m
- application media packets rate variation m
- transport rtp flow count
- transport rtp payload-type
- transport packets lost counter min
- transport packets lost counter max
- transport event packet-loss counter min
- transport event packet-loss counter max
- transport packets lost rate min
- transport packets lost rate max
- transport tcp flow count
- transport round-trip-time sum
- transport round-trip-time samples
- transport round-trip-time min
- transport round-trip-time max
- metadata global-session-id
- metadata multi-party-session-id
- metadata clock-rate
- server response time average
- refused sessions
- client network delay average
- server network delay average
- network delay average
- application delay average
- session time minimum
- session time maximum
- session time average
- transaction time average
- closed sessions
- retransmitted packets
- transport bytes out-of-order
- client throughput average
- unresponsive sessions
- transport packets out-of-order
- IPv4 source observation node
- IPv4 destination observation node
- IPv6 source observation node
- IPv6 destination observation node
- pfr one-way-delay sum
- pfr one-way-delay samples
- ONE_WAY_DELAY {pfr one-way-delay
- packet arrival timestamp
- transport tcp window-size minimum
- transport tcp window-size maximum
- transport tcp window-size average
- transport tcp maximum-segment-size
- transport tcp window-size sum
- tcpWindowSizeSum
- transport rtp jitter mean sum
- application media packets rate variation s
- transport tcp window-size average sum
- transport rtp jitter inter arrival sum
- transport rtp jitter inter arrival samples
- transport rtp jitter inter arrival mean
- pfr site source id ipv4
- pfr site destination id ipv4
- transport bytes lost
- transport bytes expected
- transport bytes lost rate
- network delay sum
- network delay sample
- pfr counter event error traffic-class miti
- pfr counter event error traffic-class miti
- pfr counter event error traffic-class miti
- pfr site source prefix ipv4
- pfr site destination prefix ipv4
- pfr site source prefix ipv6
- pfr site destination prefix ipv6
- pfr site source prefix mask ipv4
- pfr site destination prefix mask ipv4
- pfr site source prefix mask ipv6
- pfr site destination prefix mask ipv6
- pfr service provider tag identifier
- pfr label identifier
- application voice number called
- application voice number calling
- application voice setup time
- application voice call duration
- application voice rx bad-packet
- application voice rx out-of-sequence
- application voice codec id
- application voice play delay current
- application voice play delay minimum
- application voice play delay maximum
- application voice sip call-id
- application voice router global-call-id
- application voice delay round-trip
- application voice delay end-point
- application voice r-factor 1
- application voice r-factor 2
- application voice mos conversation
- application voice mos listening
- application voice concealment-ratio averag
- application voice jitter configured type
- application voice jitter configured minimu
- application voice jitter configured maximu
- application voice jitter configured initia
- application voice rx early-packet count
- application voice rx late-packet count
- application voice jitter buffer-overrun
- application voice packet conceal-count
- bandwidth used
- bandwidth used percentage
- application video resolution width last
- application video resolution height last
- application video frame rate
- application video payload bitrate average
- application video payload bitrate fluctuat
- application video frame I counter frames
- application video frame I counter packets
- application video frame I counter bytes
- application video frame STR counter frames
- application video frame STR counter packet
- application video frame STR counter bytes
- application video frame LTR counter frames
- application video frame LTR counter packet
- application video frame LTR counter bytes
- application video frame super-P counter fr
- application video frame super-P counter pa
- application video frame super-P counter by
- application video frame NR counter frames
- application video frame NR counter packets
- application video frame NR counter bytes
- application video frame I slice-quantizati
- application video frame STR slice-quantiza
- application video frame LTR slice-quantiza
- application video frame super-P slice-quan
- application video frame NR slice-quantizat
- application video eMOS compression bitstre
- application video eMOS compression network
- application video frame I counter packets
- application video frame STR counter packet
- application video frame LTR counter packet
- application video frame super-P counter pa
- application video frame NR counter packets
- application video frame percentage damaged
- application video eMOS packet-loss bitstre
- application video eMOS packet-loss network
- application video scene-complexity
- application video level-of-motion
- transport rtp sequence-number
- transport rtp sequence-number last
- iOAM my node-id
- iOAM my node name
- start timestamp
- end timestamp
- IOAM packet counter
- IOAM byte count
- IOAM cs0 packet counter
- IOAM cs0 byte count
- IOAM cs1 packet counter
- IOAM cs1 byte count
- IOAM cs2 packet counter
- IOAM cs2 byte count
- IOAM cs3 packet counter
- IOAM cs3 byte count
- IOAM cs4 packet counter
- IOAM cs4 byte count
- IOAM cs5 packet counter
- IOAM cs5 byte count
- IOAM cs6 packet counter
- IOAM cs6 byte count
- IOAM cs7 packet counter
- IOAM cs7 byte count
- IOAM lost packet counter
- IOAM duplicate packet counter
- IOAM reordered packet counter
- IOAM highest PPC sequence number
- iOAM node-id
- ipv6 protocol filed
- iOAM E2E Header
- iOAM Path Map
- iOAM number of nodes
- iOAM node1 id
- iOAM node1 in if id
- iOAM node1 eif id
- iOAM node2 id
- iOAM node2 in if id
- iOAM node2 eif id
- iOAM node3 id
- iOAM node3 in if id
- iOAM node3 eif id
- iOAM node4 id
- iOAM node4 in if id
- iOAM node4 eif id
- iOAM Application metadata
- iOAM sfc-id
- iOAM sfc validated count
- iOAM sfc invalidated count
- pfr br ipv4 address
- pfr status
- reason id
- threshold
- pfr priority
- long-term round-trip-time
- mos below
- rsvp bw pool
- flow left time
- bw percentage
- bw fee
- transport source-port min
- transport source-port max
- transport destination-port min
- transport destination-port max
- capacity
- ingress bw
- max ingress bw
- egress bw
- max egress bw
- ingress rollup bw
- egress rollup bw
- kth rollup bw
- link group name
- bgp community
- bgp prepend
- entrance downgrade
- discard rollup count
- services pfr class-tag-id
- services pfr mc-id
- sip header from uri host ip addr
- sip header from uri userinfo user
- sip header to uri host ip addr
- sip header to uri userinfo user
- sip sess duration
- sip sess end_reason
- sip sess_dialed
- sip sess_connected
- sip sess_failed
- AAA_USERNAME
- XLATE_SRC_ADDR_IPV4
- XLATE_DST_ADDR_IPV4
- XLATE_SRC_PORT
- XLATE_DST_PORT
- FW_EVENT
- artClientNetworkTimeLongLivedMaximum
- artClientNetworkTimeLongLivedMinimum
- artServerNetworkTimeLongLivedMaximum
- artServerNetworkTimeLongLivedMinimum
- policy qos classification hierarchy
- c3pl class cce-id
- c3pl class name
- c3pl class type
- c3pl policy cce-id
- c3pl policy name
- c3pl policy type
- interface input fex-node-id
- interface output fex-node-id
- interface power
- monitor device-type
- connection server counter bytes network
- connection client counter bytes network
- wireless afd drop packets
- wireless afd accept packets
- wireless afd drop bytes
- wireless afd accept bytes
- connection concurrent-connections
- application transaction counter new
- services waas segment
- services waas passthrough-reason
- connection delay network long-lived to-ser
- connection delay network long-lived to-cli
- connection delay network long-lived client
- connection delay network client-to-server
- connection delay network to-server num-sam
- connection delay network to-client num-sam
- artClientpackets
- artServerpackets
- connection client counter bytes retransmit
- connection client counter packets retransm
- connection server counter bytes retransmit
- connection server counter packets retransm
- connection transaction counter complete
- connection transaction duration sum
- connection transaction duration max
- connection transaction duration min
- art count new connections
- art count responses
- art count responses histogram bucket1
- art count responses histogram bucket2
- art count responses histogram bucket3
- art count responses histogram bucket4
- art count responses histogram bucket5
- art count responses histogram bucket6
- art count responses histogram bucket7
- connection delay response to-server histog
- connection delay response to-server sum
- connection delay response to-server max
- connection delay response to-server min
- connection delay application sum
- connection delay application max
- connection delay application min
- connection delay response client-to-server
- connection delay response client-to-server
- connection delay response client-to-server
- connection delay network client-to-server
- connection delay network client-to-server
- connection delay network client-to-server
- onnection delay network to-client sum
- connection delay network to-client max
- connection delay network to-client min
- connection delay network to-server sum
- connection delay network to-server max
- connection delay network to-server min
- mos worst 100
- mos quality
- mos total count
- application http uri statistics
- policy qos queue index
- policy qos queue drops
- datalink event
- datalink event extended
- l4r server ipv4 address
- l4r server transport port
- l4r server ipv6 address
- l4r event
- l4r event timestamp
- pbhk mapped ipv4 address
- pbhk mapped transport port
- pbhk event
- pbhk event timestamp
- ETTA_INITIAL_DATA_PACKET
- ETTA_SEQUENCE_OF_PACKET_LENGTHS_AND_TIMES
- ETTA_SEQUENCE_OF_APPLICATION_LENGTHS_AND_TIMES
- ETAByteDistribution
- ETTA_TLS_RECORDS
- ETTA_TLS_CIPHER_SUITES
- ETTA_TLS_EXTENSIONS
- ETTA_TLS_VERSION
- ETTA_TLS_KEY_LENGTH
- ETTA_TLS_SESSION_ID
- ETTA_TLS_RANDOM
- ETTA_TLS_EXTENSION_LENGTHS
- ETTA_TLS_EXTENSION_TYPES
- application family name
- application set name
- application category name
- application sub category name
- application group name
- AVCSubApplicationValue
- connection client ipv4 address
- connection server ipv4 address
- connection client ipv6 address
- connection server ipv6 address
- connection client transport port
- connection server transport port
- connection id
- application traffic-class
- application business-relevance
- nvzFlowUDID
- nvzFlowLoggedInUser
- nvzFlowOSName
- nvzFlowOSVersion
- nvzFlowSystemManufacturer
- nvzFlowSystemType
- nvzFlowProcessAccount
- nvzFlowParentProcessAccount
- nvzFlowProcessName
- nvzFlowProcessHash
- nvzFlowParentProcessName
- nvzFlowParentProcessHash
- nvzFlowDNSSuffix
- nvzFlowDestinationHostname
- nvzFlowL4ByteCountIn
- nvzFlowL4ByteCountOut
- nvzFlowOSEdition
- nvzFlowModuleNameList
- nvzFlowModuleHashList
- nvzFlowCoordinatesList
- nvzFlowInterfaceInfoUID
- nvzFlowInterfaceIndex
- nvzFlowInterfaceType
- nvzFlowInterfaceName
- nvzFlowInterfaceDetailsList
- nvzFlowInterfaceMac
- nvzFlowUserAccountType
- nvzFlowProcessAccountType
- nvzFlowParentProcessAccountType
- overlay session id input
- overlay session id output
- routing vrf service
- tloc table overlay session id
- tloc local system ip address
- tloc local color
- tloc remote system ip address
- tloc remote color
- tloc tunnel protocol
- connection id long
- drop cause id
- counter bytes sdwan dropped long
- sdwan sla-not-met
- sdwan preferred-color-not-met
- sdwan qos-queue-id
- drop cause name
- counter packets appqoe fec-d-pkts
- counter packets appqoe fec-r-pkts
- counter packets appqoe pkt-dup-d-pkts-orig
- counter packets appqoe pkt-dup-d-pkts-dup
- counter packets appqoe pkt-dup-r-pkts
- counter packets sdwan pkt-cxp-d-pkts
- counter bytes appqoe ssl-read
- counter bytes appqoe ssl-written
- counter bytes appqoe ssl-en-read
- counter bytes appqoe ssl-en-written
- counter bytes appqoe ssl-de-read
- counter bytes appqoe ssl-de-written
- appqoe ssl service type
- appqoe ssl traffic type
- appqoe ssl policy action
- ETAInitialDataPacketOld
- ETASequenceofPktLengthsandTimes
- wlan_id
- timestampAbsoluteMonitoring-intervalStart
- timestampAbsoluteMonitoring-intervalEnd
LANcope, now Cisco (PEN: 8712)
- FlowSensorInitiator
- FlowSensorTCPSYNACKTotalCount
- FlowSensorTCPSRSTotalCount
- FlowSensorRoundTripTime
- FlowSensorServerResponseTime
- FlowSensorRetransmits
- FlowSensorTCPBadTotalCount
- FlowSensorTCPFragTotalCount
- FlowSensorSourceEmailIn
- FlowSensorSourceEmailOut
- FlowSensorSourceEmailInMessages
- FlowSensorSourceEmailOutMessages
- FlowSensorSourceEmailInTrys
- FlowSensorSourceEmailOutTrys
- FlowSensorDestinationEmailIn
- FlowSensorDestinationEmailOut
- FlowSensorDestinationEmailInMessages
- FlowSensorDestinationEmailOutMessages
- FlowSensorDestinationEmailInTrys
- FlowSensorDestinationEmailOutTrys
- FlowSensorTraces
- FlowSensorEmbeddedICMPProtocol
- FlowSensorEmbeddedICMPType
- FlowSensorEmbeddedICMPCode
- FlowSensorApplicationIdentifier
- FlowSensorBadFlagXmas
- FlowSensorBadFlagSYNFIN
- FlowSensorBadFlagBadRST
- FlowSensorBadFlagNoACK
- FlowSensorBadFlagURG
- FlowSensorBadFlagNoFlag
- FlowSensorShortFragAttack
- FlowSensorFragPacketTooShort
- FlowSensorFragPacketTooLong
- FlowSensorFragPacketDifferentSizes
- FlowSensorApplicationDetails
- FlowSensorTrustsecSourceIdentifier
- EndpointFlowProcessAccount
- EndpointFlowProcessName
- EndpointFlowProcessHash
- EndpointFlowParentProcessAccount
- EndpointFlowParentProcessName
- EndpointFlowParentProcessHash