ON THIS PAGE
Point-to-Point Protocol over Ethernet (PPPoE) Discovery (ether_type: 0x8863)
Point-to-Point Protocol over Ethernet (PPPoE) Session (ether_type: 0x8864)
extended_ipv4_tunnel_ingress (enterprise = 0, format = 1024)
extended_ipv6_tunnel_ingress (enterprise = 0, format = 1026)
extended_decapsulate_ingress (enterprise = 0, format = 1028)
extended_nfs_storage_transaction (enterprise = 0, format = 2001)
extended_scsi_storage_transaction (enterprise = 0, format = 2002)
sFlow IEs (Flow Samples)
The Flow Data collector supports the following sFlow information elements (IE):
flow_sample
- sample_sequence
- source_id_type
- source_id
- sampling_rate
- sample_pool
- drops
- interface_format_input
- interface_input
- interface_format_output
- interface_output
sampled_header (enterprise = 0, format = 1)
- header_protocol
- frame_length
- stripped
- length
- header
Ethernet
- destination_mac_addr
- source_mac_addr
VLAN C-Tag "inner tag"
- c_vlan_pcp
- c_vlan_dei
- c_vlan_id
VLAN S-Tag "outer tag"
- s_vlan_pcp
- s_vlan_dei
- s_vlan_id
Internet Protocol version 4 (IPv4) (ether_type: 0x0800)
- version
- dscp
- ecn
- total_length
- flags
- ttl
- protocol
- source_ipaddr
- destination_ipaddr
- options
Internet Protocol version 6 (IPv6) (ether_type: 0x86dd)
- version
- dscp
- ecn
- flow_label
- payload_length
- next_header
- hop_limit
- source_ipaddr
- destination_ipaddr
- ext_route_type
- ext_route_hops
Point-to-Point Protocol over Ethernet (PPPoE) Discovery (ether_type: 0x8863)
- code
- session_id
- ddl_proto
- type
- version
Point-to-Point Protocol over Ethernet (PPPoE) Session (ether_type: 0x8864)
- code
- session_id
- ddl_proto
- type
- version
Transmission Control Protocol (TCP)
- header_size
- source port
- destination port
- flags
- seq
- ack
- window
- urgent_pointer
- options
User Datagram Protocol (UDP)
- source_port
- destination_port
- pdu_length
Authentication Header (AH)
- icv
- spi
Address Resolution Protocol (ARP)
- dst_hw_addr
- dst_proto_addr
- hw_type
- op_code
- proto_type
- src_hw_addr
- src_proto_addr
Border Gateway Protocol (BGP)
- error_code
- error_subcode
- hold_time
- msg_type
- route_afi
- route_safi
- router_as
- router_ip
- version
Encapsulating Security Payload (ESP)
- spi
Generic Routing Encapsulation (GRE)
- flow_id
- key
- pptp_call_id
- pptp_payload_size
- version
- vsid
Internet Control Message Protocol (ICMP)
- v4_code
- v4_type
- v6_code
- v6_type
- conv_error_pointer
- dns_names
- dns_ttl
- echo_ext_req_flags
- echo_ext_resp_flags
- echo_ext_state
- id
- mobile_subtype
- param_error_pointer
- photuris_pointer
- redirect_next_hop
- router_advert_addrs
- router_advert_size
- router_advert_lifetime
- seq_num
- subnet_mask
- timestamp_origin
- timestamp_rx
- timestamp_tx
- traceroute_id
- traceroute_hops_out
- traceroute_hops_in
- traceroute_bandwidth_out
- traceroute_mtu_out
Inband Flow Analyzer (IFA)
- flags
- gns
- metadata_action
- metadata_frag_id
- metadata_frag_last
- metadata_frag_packet_id
- metadata_size_max
- metadata_req
- metadata_size
- metadata_ttl
Internet Group Management Protocol (IGMP)
- group
- max_resp_time
- type
Logical Link Control (LLC)
- dsap
- dsap_u
- dsap_ig
- lpdu_frame_type
- lpdu_info_seq_curr
- lpdu_info_seq_next
- lpdu_pf
- lpdu_super_frame_type
- lpdu_super_seq_next
- lpdu_unnum_frame_type
- ssap
- ssap_u
- ssap_cr
Multi-Protocol Label Switching (MPLS)
- mpls_label
- mpls_tc
- mpls_ttl
Network Service Header (NSH)
- flag_oam_bit
- metadata_type
- sfp_si
- sfp_spi
- ttl
- version
- opt_metadata_class
- opt_metadata_type
- opt_payload
Open Shortest Path First (OSPF)
- version
- router_ip
- area
- auth_code
- msg_type
- inst_id
Point-to-Point Protocol (PPP)
- addr
- cntrl_value
- dll_proto
Pseudowire
- pwe3_seq
Subnetwork Access Protocol (SNAP)
- oui
Virtual Extensible LAN (VXLAN)
- flags
- vni
sampled_ethernet (enterprise = 0, format = 2)
- source_mac_addr
- destination_mac_addr
- eth_type
sampled_ipv4 (enterprise = 0, format = 3)
- ip_protocol
- src_ip
- dst_ip
- src_port
- dst_port
- tcp_flags
- tos
sampled_ipv6 (enterprise = 0, format = 4)
- ip_protocol
- src_ip
- dst_ip
- src_port
- dst_port
- tcp_flags
- ip_priority
extended_switch (enterprise = 0, format = 1001)
- src_vlan
- src_priority
- dst_vlan
- dst_priority
extended_router (enterprise = 0, format = 1002)
- next_hop
- src_mask_len
- dst_mask_len
extended_gateway (enterprise = 0, format = 1003)
- next_hop
- router_as
- source_as
- source_peer_as
- destination_count
- destinations
- community_count
- communities
- localpref
extended_user (enterprise = 0, format = 1004)
- src_charset
- src_user
- dst_charset
- dst_user
extended_url (enterprise = 0, format = 1005)
- direction
- url
- host
extended_mpls (enterprise = 0, format = 1006
- nexthop
- in_stack
- out_stack
extended_nat (enterprise = 0, format = 1007)
- src_address
- dst_address
extended_mpls_tunnel (enterprise = 0, format = 1008)
- tunnel_lsp_name
- tunnel_id
- tunnel_cos
extended_mpls_vc (enterprise = 0, format = 1009)
- vc_instance_name
- vll_vc_id
- vc_label_cos
extended_mpls_FTN (enterprise = 0, format = 1010)
- mplsFTNDescr
- mplsFTNMask
extended_mpls_LDP_FEC (enterprise = 0, format = 1011)
- mplsFecAddrPrefixLength
extended_vlantunnel (enterprise = 0, format = 1012)
- stack
extended_80211_payload (enterprise = 0, format = 1013)
- ciphersuite
- data
extended_80211_rx (enterprise = 0, format = 1014)
- ssid
- bssid
- version
- channel
- speed
- rsni
- rcpi
- packet_duration
extended_80211_tx (enterprise = 0, format = 1015)
- ssid
- bssid
- version
- transmissions
- packet_duration
- retrans_duration
- channel
- speed
- power
extended_openflow_v1 (enterprise = 0, format = 1017)
- flow_cookie
- flow_match
- flow_actions
extended_fc (enterprise = 0, format = 1018)
- t11FcRouteSrcMask
- t11FcRouteDestMask
- next_hop_t11FcRouteDomainId
- t11FcRouteType
- t11FcRouteProto
- t11FcRouteMetric
extended_queue_length (enterprise = 0, format = 1019)
- queueIndex
- queueLength
extended_nat_port (enterprise = 0, format = 1020
- src_port
- dst_port
extended_L2_tunnel_egress (enterprise = 0, format = 1021
- source_mac_addr
- destination_mac_addr
- eth_type
extended_L2_tunnel_ingresss (enterprise = 0, format = 1022
- source_mac_addr
- destination_mac_addr
- eth_type
extended_ipv4_tunnel_egress (enterprise = 0, format = 1023)
- ip_protocol
- src_ip
- dst_ip
- src_port
- dst_port
- tcp_flags
- tos
extended_ipv4_tunnel_ingress (enterprise = 0, format = 1024)
- ip_protocol
- src_ip
- dst_ip
- src_port
- dst_port
- tcp_flags
- tos
extended_ipv6_tunnel_egress (enterprise = 0, format = 1025)
- ip_protocol
- src_ip
- dst_ip
- src_port
- dst_port
- tcp_flags
- ip_priority
extended_ipv6_tunnel_ingress (enterprise = 0, format = 1026)
- ip_protocol
- src_ip
- dst_ip
- src_port
- dst_port
- tcp_flags
- ip_priority
extended_decapsulate_egress (enterprise = 0, format = 1027)
- inner_header_offset
extended_decapsulate_ingress (enterprise = 0, format = 1028)
- inner_header_offset
extended_vni_egress (enterprise = 0, format = 1029)
- vni
extended_vni_ingress (enterprise = 0, format = 1030)
- vni
extended_ib_lrh enterprise = 0, format = 1031)
- src_vl
- src_sl
- src_dlid
- src_slid
- src_lnh
- dst_vl
- dst_sl
- dst_dlid
- dst_slid
- dest_lnh
extended_ib_grh (enterprise = 0, format = 1032)
- flow_label
- tc
- s_gid
- d_gid
extended_ib_brh (enterprise = 0, format = 1033)
- pky
- dst_qp
extended_vlanin (enterprise = 0, format = 1034)
- tpid
- tci
extended_vlanout (enterprise = 0, format = 1035)
- tpid
- tci
extended_egress_queue (enterprise = 0, format = 1036)
- queue
extended_acl (enterprise = 0, format = 1037)
- acl_number
- acl_name
- direction
extended_function (enterprise = 0, format = 1038)
- symbol
extended_transit (enterprise = 0, format = 1039)
- delay
extended_queue (enterprise = 0, format = 1040)
- depth
transaction (enterprise = 0, format = 2000)
- direction
- wait
- duration
- status
- bytes_received
- bytes_send
extended_nfs_storage_transaction (enterprise = 0, format = 2001)
- path
- operation
- status
extended_scsi_storage_transaction (enterprise = 0, format = 2002)
- lun
- operation
- status
extended_http_transaction (enterprise = 0, format = 2003)
- url
- host
- referer
- useragent
- user
- status
extended_socket_ipv4 (enterprise = 0, format = 2100)
- protocol
- local_ip
- remote_ip
- local_port
- remote_port
extended_socket_ipv6 (enterprise = 0, format = 2101)
- protocol
- local_ip
- remote_ip
- local_port
- remote_port
extended_proxy_socket_ipv4 (enterprise = 0, format = 2102)
- extended_socket_ipv4
extended_proxy_socket_ipv6 (enterprise = 0, format = 2103)
- extended_socket_ipv6
memcached_operation (enterprise = 0, format = 2200)
- protocol
- cmd
- key
- nkeys
- value_bytes
- uS
- status
http_request (enterprise = 0, format = 2201)
- method
- uri
- host
- referer
- useragent
- authuser
- bytes
- duration
- status
app_operation (enterprise = 0, format = 2202)
- application
- operation
- attributes
- status_descr
- req_bytes
- resp_bytes
- duration
- status
app_parent_context (enterprise = 0, format = 2203)
- application
- operation
- attributes
app_initiator (enterprise = 0, format = 2204)
- actor
app_target (enterprise = 0, format = 2205)
- actor
http_request (enterprise = 0, format = 2206)
- method
- protocol
- uri
- host
- referer
- useragent
- xff
- authuser
- mime-type
- req_bytes
- resp_bytes
- duration
- status
extended_proxy_request (enterprise = 0, format = 2207)
- uri
extended_nav_timing (enterprise = 0, format = 2208)
- type
- redirectCount
- navigationStart
- unloadEventStart
- unloadEventEnd
- redirectStart
- redirectEnd
- fetchStart
- domainLookupStart
- domainLookupEnd
- connectStart
- connectEnd
- secureConnectionStart
- requestStart
- responseStart
- responseEnd
- domLoading
- domInteractive
- domContentLoadedEventStart
- domContentLoadedEventEnd
- domComplete
- loadEventStart
- loadEventEnd
extended_tcp_info (enterprise = 0, format = 2209)
- direction
- snd_mss
- rcv_mss
- unacked
- lost
- retrans
- pmtu
- rtt
- rttvar
- snd_cwnd
- reordering
- min_rtt
extended_entities (enterprise = 0, format = 2210)
- src_ds
- dst_ds
bst_egress_queue (enterprise = 4413, format = 1)
- queue