NetFlow

From DocWiki

(Difference between revisions)
Jump to: navigation, search
(→Fields 1-128 (Specific to Cisco))
Line 18: Line 18:
!!!!!!!!! DRAFT !!!!!!!!!!!!
!!!!!!!!! DRAFT !!!!!!!!!!!!
-
<br>
+
<br><br>
-
<br>
+
-
 
+
-
__TOC__
+
-
 
+
-
<br>
+
-
<br>
+
-
 
+
-
 
+
-
= NetFlow DocWiki Navigation =
+
-
 
+
-
*[http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html  NetFlow Version 9 Flow-Record Format]
+
-
*[[NetFlow:PfR | Performance Routing NetFlow]]
+
-
 
+
-
<br>
+
-
<br>
+
-
 
+
-
= Summary =
+
-
 
+
-
* IDs <128 : specific to Cisco and NetFlow v9
+
-
* IDs Range 128 - 32767 : allocated by IANA for IPFIX, in NetFlow v9 for parity
+
-
* IDs > 32768 : IPFIX Enterprise Specific
+
-
 
+
-
<br>
+
-
<br>
+
-
 
+
-
= Fields 1-128 (Specific to Cisco) =
+
-
 
+
-
<br>
+
-
<br>
+
-
Also see: [http://tools.ietf.org/html/draft-yourtchenko-cisco-ies-03 IPFix Information Elements].
+
-
 
+
-
<br>
+
-
<br>
+
-
 
+
{| border="1" cellpadding="1" cellspacing="1"
{| border="1" cellpadding="1" cellspacing="1"
|-
|-
-
! scope="col" bgcolor="#FFE0C8" | Name  
+
! scope="col" bgcolor="#FFE0C8" | Name
! scope="col" bgcolor="#FFE0C8" | Identifier
! scope="col" bgcolor="#FFE0C8" | Identifier
-
! scope="col" bgcolor="#FFE0C8" | Data Type  
+
! scope="col" bgcolor="#FFE0C8" | Data Type
-
! scope="col" bgcolor="#FFE0C8" | Description
+
! scope="col" bgcolor="#FFE0C8" | Semantics
-
! scope="col" bgcolor="#FFE0C8" | Semantics  
+
! scope="col" bgcolor="#FFE0C8" | Status
! scope="col" bgcolor="#FFE0C8" | Status
|-
|-
-
| IN_BYTES
+
|IN_BYTES
-
| 1
+
|1
-
| unsigned64
+
|unsigned64
-
| Incoming counter with length N x 8 bits for number of bytes associated with an IP  Flow. (Default N=8)
+
|quantity
-
|
+
|current
-
| current
+
|-
|-
-
| IN_PKTS
+
|IN_PKTS
-
| 2
+
|2
-
| unsigned64
+
|unsigned64
-
| Incoming counter with length N x 8 bits for the number of packets associated with an IP Flow. (Default N=8)
+
|quantity
-
|
+
|current
-
| current
+
|-
|-
-
| FLOWS
+
|deltaFlowCount
-
| 3
+
|3
-
| unsigned32
+
|unsigned64
-
| Number of flows that were aggregated.
+
|quantity
-
|  
+
|current
-
| current
+
|-
|-
-
| PROTOCOL
+
|protocolIdentifier
-
| 4
+
|4
-
| unsigned8
+
|unsigned8
-
| IP protocol byte
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| SRC_TOS
+
|SRC_TOS
-
| 5
+
|5
-
| unsigned8
+
|unsigned8
-
| Type of Service byte setting when entering incoming interface
+
|flags
-
|
+
|current
-
| current
+
|-
|-
-
| TCP_FLAGS
+
|TCP_FLAGS
-
| 6
+
|6
-
| unsigned8
+
|unsigned8
-
| Cumulative of all the TCP flags seen for this flow
+
|flags
-
|
+
|current
-
| current
+
|-
|-
-
| L4_SRC_PORT
+
|L4_SRC_PORT
-
| 7
+
|7
-
| unsigned16
+
|unsigned16
-
| TCP/UDP source port number e.g. FTP, Telnet, or equivalent
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| IPV4_SRC_ADDR
+
|IPV4_SRC_ADDR
-
| 8
+
|8
-
| ipv4Address
+
|ipv4Address
-
| IPv4 source address
+
|ipv4Address
-
|
+
|current
-
| current
+
|-
|-
-
| SRC_MASK
+
|SRC_MASK
-
| 9
+
|9
-
| unsigned8
+
|unsigned8
-
| The number of contiguous bits in the source address subnet mask i.e. the submask in slash notation
+
|mask
-
|
+
|current
-
| current
+
|-
|-
-
| INPUT_SNMP
+
|INPUT_SNMP
-
| 10
+
|10
-
| unsigned32
+
|unsigned32
-
| Input interface index; default is 4 bytes but higher values could be used
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| L4_DST_PORT
+
|L4_DST_PORT
-
| 11
+
|11
-
| unsigned16
+
|unsigned16
-
| TCP/UDP destination port number e.g. FTP, Telnet, or equivalent
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| IPV4_DST_ADDR
+
|IPV4_DST_ADDR
-
| 12
+
|12
-
| ipv4Address
+
|ipv4Address
-
| IPv4 destination address
+
|ipv4Address
-
|
+
|current
-
| current
+
|-
|-
-
| DST_MASK
+
|DST_MASK
-
| 13
+
|13
-
| unsigned8
+
|unsigned8
-
| The number of contiguous bits in the destination address subnet mask i.e. the submask in slash notation
+
|mask
-
|
+
|current
-
| current
+
|-
|-
-
| OUTPUT_SNMP
+
|OUTPUT_SNMP
-
| 14
+
|14
-
| unsigned32
+
|unsigned32
-
| Output interface index; default is 4 bytes but higher values could be used
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| IPV4_NEXT_HOP
+
|IPV4_NEXT_HOP
-
| 15
+
|15
-
| ipv4Address
+
|ipv4Address
-
| IPv4 address of next-hop router
+
|ipv4Address
-
|
+
|current
-
| current
+
|-
|-
-
| SRC_AS
+
|SRC_AS
-
| 16
+
|16
-
| unsigned16
+
|unsigned16
-
| Source BGP autonomous system number where length could be 2 or 4
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| DST_AS
+
|DST_AS
-
| 17
+
|17
-
| unsigned16
+
|unsigned16
-
| Destination BGP autonomous system number where length could be 2 or 4
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| BGP_IPV4_NEXT_HOP
+
|BGP_IPV4_NEXT_HOP
-
| 18
+
|18
-
| ipv4Address
+
|ipv4Address
-
| Next-hop router's IP in the BGP domain
+
|ipv4Address
-
|
+
|current
-
| current
+
|-
|-
-
| MUL_DST_PKTS
+
|MUL_DST_PKTS
-
| 19
+
|19
-
| unsigned64
+
|unsigned64
-
| IP multicast outgoing packet counter with length N x 8 bits for packets associated with the IP Flow
+
|totalCounter
-
|
+
|current
-
| current
+
|-
|-
-
| MUL_DST_BYTES
+
|MUL_DST_BYTES
-
| 20
+
|20
-
| unsigned64
+
|unsigned64
-
| IP multicast outgoing byte counter with length N x 8 bits for bytes associated with the IP Flow
+
|totalCounter
-
|
+
|current
-
| current
+
|-
|-
-
| LAST_SWITCHED
+
|LAST_SWITCHED
-
| 21
+
|21
-
| unsigned32
+
|unsigned32
-
| System uptime at which the last packet of this flow was switched
+
|quantity
-
|
+
|current
-
| current
+
|-
|-
-
| FIRST_SWITCHED
+
|FIRST_SWITCHED
-
| 22
+
|22
-
| unsigned32
+
|unsigned32
-
| System uptime at which the first packet of this flow was switched
+
|quantity
-
|
+
|current
-
| current
+
|-
|-
-
| OUT_BYTES
+
|OUT_BYTES
-
| 23
+
|23
-
| unsigned64
+
|unsigned64
-
| Outgoing counter with length N x 8 bits for the number of bytes associated with an IP Flow
+
|totalCounter
-
|
+
|current
-
| current
+
|-
|-
-
| OUT_PKTS
+
|OUT_PKTS
-
| 24
+
|24
-
| unsigned64
+
|unsigned64
-
| Outgoing counter with length N x 8 bits for the number of packets associated with an IP Flow.
+
|totalCounter
-
|
+
|current
-
| current
+
|-
|-
-
| MIN_PKT_LNGTH
+
|MIN_PKT_LNGTH
-
| 25
+
|25
-
| unsigned64
+
|unsigned64
-
| Minimum IP packet length on incoming packets of the flow
+
|quantity
-
|
+
|current
-
| current
+
|-
|-
-
| MAX_PKT_LNGTH
+
|MAX_PKT_LNGTH
-
| 26
+
|26
-
| unsigned64
+
|unsigned64
-
| Maximum IP packet length on incoming packets of the flow
+
|quantity
-
|
+
|current
-
| current
+
|-
|-
-
| IPV6_SRC_ADDR
+
|IPV6_SRC_ADDR
-
| 27
+
|27
-
| ipv6Address
+
|ipv6Address
-
| IPv6 Source Address
+
|ipv6Address
-
|
+
|current
-
| current
+
|-
|-
-
| IPV6_DST_ADDR
+
|IPV6_DST_ADDR
-
| 28
+
|28
-
| ipv6Address
+
|ipv6Address
-
| IPv6 Destination Address
+
|ipv6Address
-
|
+
|current
-
| current
+
|-
|-
-
| IPV6_SRC_MASK
+
|IPV6_SRC_MASK
-
| 29
+
|29
-
| unsigned8
+
|unsigned8
-
| Length of the IPv6 source mask in contiguous bits
+
|mask
-
|
+
|current
-
| current
+
|-
|-
-
| IPV6_DST_MASK
+
|IPV6_DST_MASK
-
| 30
+
|30
-
| unsigned8
+
|unsigned8
-
| Length of the IPv6 destination mask in contiguous bits
+
|mask
-
|
+
|current
-
| current
+
|-
|-
-
| IPV6_FLOW_LABEL
+
|IPV6_FLOW_LABEL
-
| 31
+
|31
-
| unsigned32
+
|unsigned32
-
| IPv6 flow label as per RFC 2460 definition
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| ICMP_TYPE_CODE
+
|ICMP_TYPE_CODE
-
| 32
+
|32
-
| unsigned16
+
|unsigned16
-
| Internet Control Message Protocol (ICMP) packet type; reported as ((ICMP Type * 256) + ICMP code)
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| MUL_IGMP_TYPE
+
|MUL_IGMP_TYPE
-
| 33
+
|33
-
| unsigned8
+
|unsigned8
-
| Internet Group Management Protocol (IGMP) packet type
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| SAMPLING_INTERVAL
+
|samplingInterval
-
| 34
+
|34
-
| unsigned32
+
|unsigned32
-
| When using sampled NetFlow, the rate at which packets are sampled e.g. a value of 100 indicates that one of every 100 packets is sampled
+
|quantity
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| SAMPLING_ALGORITHM
+
|samplingAlgorithm
-
| 35
+
|35
-
| unsigned8
+
|unsigned8
-
| The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling ,0x02 Random Sampling
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| FLOW_ACTIVE_TIMEOUT
+
|engineType
-
| 36
+
|38
-
| unsigned16
+
|unsigned8
-
| Timeout value (in seconds) for active flow entries in the NetFlow cache
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| FLOW_INACTIVE_TIMEOUT
+
|engineId
-
| 37
+
|39
-
| unsigned16
+
|unsigned8
-
| Timeout value (in seconds) for inactive flow entries in the NetFlow cache
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| ENGINE_TYPE
+
|ipv4RouterSc
-
| 38
+
|43
-
| unsigned8
+
|ipv4Address
-
| Type of flow switching engine: RP = 0, VIP/Linecard = 1
+
|ipv4Address
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| ENGINE_ID
+
|samplerId
-
| 39
+
|48
-
| unsigned8
+
|unsigned8
-
| ID number of the flow switching engine
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| TOTAL_BYTES_EXP
+
|samplerMode
-
| 40
+
|49
-
| unsigned64
+
|unsigned8
-
| Counter with length N x 8 bits for bytes for the number of bytes exported by the Observation Domain
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| TOTAL_PKTS_EXP
+
|samplerRandomInterval
-
| 41
+
|50
-
| unsigned64
+
|unsigned32
-
| Counter with length N x 8 bits for bytes for the number of packets exported by the Observation Domain
+
|quantity
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| TOTAL_FLOWS_EXP
+
|classId
-
| 42
+
|51
-
| unsigned64
+
|unsigned8
-
| Counter with length N x 8 bits for bytes for the number of flows exported by the Observation Domain
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| IPV4_ROUTER_SC
+
|MIN_TTL
-
| 43
+
|52
-
| ipv4Address
+
|unsigned8
-
| The router shortcut address i.e. address of router bypassed by a switch (specific for Catalyst architecture)
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| IPV4_SRC_PREFIX
+
|MAX_TTL
-
| 44
+
|53
-
| ipv4Address
+
|unsigned8
-
| IPv4 source address prefix. This is a platform-specific field for Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching.
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| IPV4_DST_PREFIX
+
|IPV4_IDENT
-
| 45
+
|54
-
| ipv4Address
+
|ipv4Address
-
| IPv4 destination address prefix. (specific for Catalyst architecture).
+
|ipv4Address
-
|
+
|current
-
| current
+
|-
|-
-
| MPLS_TOP_LABEL_TYPE
+
|DST_TOS
-
| 46
+
|55
-
| unsigned8
+
|unsigned8
-
| MPLS Top Label Type: 0x00 UNKNOWN 0x01 TE-MIDPT 0x02 ATOM 0x03 VPN 0x04 BGP 0x05 LDP
+
|ipv4Address
-
|
+
|current
-
| current
+
|-
|-
-
| MPLS_TOP_LABEL_IP_ADDR
+
|IN_SRC_MAC
-
| 47
+
|56
-
| ipv4Address
+
|macAddress
-
| Forwarding Equivalent Class corresponding to the MPLS Top Label
+
|macAddress
-
|  
+
|current
-
| current
+
|-
|-
-
| FLOW_SAMPLER_ID
+
|OUT_DST_MAC
-
| 48
+
|57
-
| unsigned8
+
|macAddress
-
| Identifier shown in "show flow-sampler"
+
|macAddress
-
|  
+
|current
-
| current
+
|-
|-
-
| FLOW_SAMPLER_MODE
+
|SRC_VLAN
-
| 49
+
|58
-
| unsigned8
+
|unsigned16
-
| The type of algorithm used for sampling data: 0x02 random sampling. Use in connection with FLOW_SAMPLER_MODE
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| FLOW_SAMPLER_RANDOM_INTERVAL
+
|DST_VLAN
-
| 50
+
|59
-
| unsigned32
+
|unsigned16
-
| Packet interval at which to sample. Use in connection with FLOW_SAMPLER_MODE
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| classId
+
|IP_PROTOCOL_VERSION
-
| 51
+
|60
-
| unsigned8
+
|unsigned8
-
| Deprecated in favour of 302 selectorId. Characterizes the traffic class, i.e. QoS treatment.
+
|identifier
-
|
+
|current
-
| current (aspirational: deprecated)
+
|-
|-
-
| MIN_TTL
+
|DIRECTION
-
| 52
+
|61
-
| unsigned8
+
|unsigned8
-
| Minimum TTL on incoming packets of the flow
+
|identifier
-
|
+
|current
-
| current
+
|-
|-
-
| MAX_TTL
+
|IPV6_NEXT_HOP
-
| 53
+
|62
-
| unsigned8
+
|ipv6Address
-
| Maximum TTL on incoming packets of the flow
+
|ipv6Address
-
|  
+
|current
-
| current
+
|-
|-
-
| IPV4_IDENT
+
|BGP_IPV6_NEXT_HOP
-
| 54
+
|63
-
| ipv4Address
+
|ipv6Address
-
| The IPv4 identification field
+
|ipv6Address
-
|  
+
|current
-
| current
+
|-
|-
-
| DST_TOS
+
|IPV6_OPTION_HEADERS
-
| 55
+
|64
-
| unsigned8
+
|unsigned32
-
| Type of Service byte setting when exiting outgoing interface
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| IN_SRC_MAC
+
|PACKET_LOSS
-
| 56
+
|65
-
| macAddress
+
|unsigned32
-
| Incoming source MAC address
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| OUT_DST_MAC
+
|UNREACHABILITY
-
| 57
+
|66
-
| macAddress
+
|unsigned32
-
| Outgoing destination MAC address
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| SRC_VLAN
+
|LATENCY
-
| 58
+
|67
-
| unsigned16
+
|unsigned32
-
| Virtual LAN identifier associated with ingress interface
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| DST_VLAN
+
|DATA_POINTS
-
| 59
+
|68
-
| unsigned16
+
|unsigned32
-
| Virtual LAN identifier associated with egress interface
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| IP_PROTOCOL_VERSION
+
|VARIANCE
-
| 60
+
|69
-
| unsigned8
+
|unsigned32
-
| Internet Protocol Version Set to 4 for IPv4, set to 6 for IPv6. If not present in the template, then version 4 is assumed.
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| DIRECTION
+
|MPLS_LABEL_1
-
| 61
+
|70
-
| unsigned8
+
|unsigned24
-
| Flow direction: 0 - ingress flow, 1 - egress flow
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| IPV6_NEXT_HOP
+
|MPLS_LABEL_2
-
| 62
+
|71
-
| ipv6Address
+
|unsigned24
-
| IPv6 address of the next-hop router
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| BPG_IPV6_NEXT_HOP
+
|MPLS_LABEL_3
-
| 63
+
|72
-
| ipv6Address
+
|unsigned24
-
| Next-hop router in the BGP domain
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| IPV6_OPTION_HEADERS
+
|MPLS_LABEL_4
-
| 64
+
|73
-
| unsigned32
+
|unsigned24
-
| Bit-encoded field identifying IPv6 option headers found in the flow
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| PACKET_LOSS
+
|MPLS_LABEL_5
-
| 65
+
|74
-
| unsigned32
+
|unsigned24
-
| OER: Packet loss can be estimated by tracking the highest TCP sequence number detected for a TCP flow
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| UNREACHABILITY
+
|MPLS_LABEL_6
-
| 66
+
|75
-
| unsigned32
+
|unsigned24
-
| OER: Number of unsuccessful TCP connection attempts/flows for a prefix.
+
-
TCP syn timeout is used to track unreachability of a host.
+
|
|
-
| current
+
|current
|-
|-
-
| LATENCY, DELAY_SUM
+
|MPLS_LABEL_7
-
| 67
+
|76
-
| unsigned32
+
|unsigned24
-
| OER: Average delay for TCP flows within a prefix. Latency is the time between TCP SYN and TCP ACK.  Notice that the TCP SYN and TCP ACK both flow in the same direction.
+
|
|
-
| current
+
|current
|-
|-
-
| DATA_POINTS
+
|MPLS_LABEL_8
-
| 68
+
|77
-
| unsigned32
+
|unsigned24
-
| OER: Number of delay samples collected for a prefix. This is used for calculating average delay to reach a prefix.
+
|
|
-
| current
+
|current
|-
|-
-
| VARIANCE
+
|MPLS_LABEL_9
-
| 69
+
|78
-
| N
+
|unsigned24
-
|
+
-
* tNF: "NF_V9_FIELD_OER_APPL_ID".
+
-
* FNF: "FLOW_FIELD_VARIANCE".
+
-
* PfR: "Jitter"
+
|
|
-
| current
+
|current
|-
|-
-
| MPLS_LABEL_1
+
|MPLS_LABEL_10
-
| 70
+
|79
-
| unsigned24
+
|unsigned24
-
| MPLS label at position 1 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_LABEL_2
+
|IN_DST_MAC
-
| 71
+
|80
-
| unsigned24
+
|macAddress
-
| MPLS label at position 2 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|macAddress
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_LABEL_3
+
|OUT_SRC_MAC
-
| 72
+
|81
-
| unsigned24
+
|macAddress
-
| MPLS label at position 3 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|macAddress
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_LABEL_4
+
|IF_NAME
-
| 73
+
|82
-
| unsigned24
+
|string
-
| MPLS label at position 4 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|name
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_LABEL_5
+
|IF_DESC
-
| 74
+
|83
-
| unsigned24
+
|string
-
| MPLS label at position 5 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|name
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_LABEL_6
+
|samplerName
-
| 75
+
|84
-
| unsigned24
+
|string
-
| MPLS label at position 6 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| MPLS_LABEL_7
+
|IN_PERMANENT_BYTES
-
| 76
+
|85
-
| unsigned24
+
|unsigned64
-
| MPLS label at position 7 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| MPLS_LABEL_8
+
|IN_PERMANENT_PKTS
-
| 77
+
|86
-
| unsigned24
+
|unsigned64
-
| MPLS label at position 8 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| MPLS_LABEL_9
+
|flagsAndSamplerId
-
| 78
+
|87
-
| unsigned24
+
|unsigned32
-
| MPLS label at position 9 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|Identifier
-
|  
+
|private
-
| current
+
|-
|-
-
| MPLS_LABEL_10
+
|FRAGMENT_OFFSET
-
| 79
+
|88
-
| unsigned24
+
|unsigned16
-
| MPLS label at position 10 in the stack. This comprises 20 bits of MPLS label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
+
|identifier
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| IN_DST_MAC
+
|forwardingStatus
-
| 80
+
|89
-
| macAddress
+
|unsigned32
-
| Incoming destination MAC address
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| OUT_SRC_MAC
+
|MPLS_PAL_RD
-
| 81
+
|90
-
| macAddress
+
|octetArray
-
| Outgoing source MAC address
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| IF_NAME
+
|MPLS_PREFIX_LEN
-
| 82
+
|91
-
| string
+
|unsigned8
-
| Shortened interface name e.g. "FE1/0". (Default length specified in template)
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| IF_DESC
+
|srcTrafficIndex
-
| 83
+
|92
-
| string
+
|unsigned32
-
| Full interface name e.g. "'FastEthernet 1/0". (Default length specified in template)
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| SAMPLER_NAME
+
|dstTrafficIndex
-
| 84
+
|93
-
| string
+
|TBD
-
| Name of the flow sampler
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| IN_PERMANENT_BYTES
+
|applicationDescription
-
| 85
+
|94
-
| unsigned64
+
|string
-
| Running byte counter for a permanent flow
+
|name
-
|  
+
|current
-
| current
+
|-
|-
-
| IN_PERMANENT_PKTS
+
|applicationId
-
| 86
+
|95
-
| unsigned64
+
|octetArray
-
| Running packet counter for a permanent flow
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| FRAGMENT_OFFSET
+
|applicationName
-
| 88
+
|96
-
| unsigned16
+
|string
-
| The fragment-offset value from fragmented IP packets
+
|name
-
|  
+
|current
-
| current
+
|-
|-
-
| FORWARDING STATUS
+
|postipDiffServCodePoint
-
| 89
+
|98
-
| unsigned8
+
|unsigned8
-
| Forwarding status. [TBD]
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_PAL_RD
+
|replicationFactor
-
| 90
+
|99
-
| octetArray
+
|unsigned32
-
| MPLS PAL Route Distinguisher.
+
|
-
|  
+
|current
-
| current
+
|-
|-
-
| MPLS_PREFIX_LEN
+
|className
-
| 91
+
|100
-
| unsigned8
+
|string
-
| Number of consecutive bits in the MPLS prefix length.
+
|
-
|  
+
|deprecated
-
| current
+
|-
|-
-
| SRC_TRAFFIC_INDEX
+
|classificationEngineID
-
| 92
+
|101
-
| unsigned32
+
|unsigned8
-
| BGP Policy Accounting Source Traffic Index.
+
|quantity
-
|  
+
|private
-
| current
+
|-
|-
-
| DST_TRAFFIC_INDEX
+
|layer2packetSectionOffset
-
| 93
+
|102
-
| unsigned32
+
|unsigned16
-
| BGP Policy Accounting Destination Traffic Index
+
|quantity
-
|  
+
|current
-
| current
+
|-
|-
-
| applicationDescription
+
|layer2packetSectionSize
-
| 94
+
|103
-
| string
+
|unsigned16
-
| Application description.
+
|quantity
-
|  
+
|current
-
| current
+
|-
|-
-
| applicationId
+
|layer2packetSectionData
-
| 95
+
|104
-
| octetArray
+
|octetArray
-
|  
+
|
-
  1. 8 bits of Classification Engine ID. The
+
|current
-
    Classification Engine can be considered as a
+
-
    specific registry for application assignments.
+
-
  2. m bits of Selector ID. The Selector ID length varies
+
-
    depending on the Classification Engine ID.
+
-
 
+
-
      Classification Engine ID
+
-
   
+
-
        A unique identifier for the engine which determined the
+
-
        Selector ID.  Thus the Classification Engine ID defines
+
-
        the context for the Selector ID.
+
-
   
+
-
        Selector ID
+
-
   
+
-
        A unique identifier of the application for a specific
+
-
        Classification Engine ID.  Note that the Selector ID
+
-
        length varies depending on the Classification Engine ID.
+
-
   
+
-
        The Selector ID term is in sync with the selectorId
+
-
        Information Element, specified in the PSAMP Protocol
+
-
       
+
-
Example: PfR
+
-
* 1 byte: Classification Engine Id = 17
+
-
* 1 byte: Type
+
-
** Passive Update (1)
+
-
** Passive Performance (2),
+
-
** Active Update (3)
+
-
** Active Performance (4)
+
-
** Traffic Class Event (5)
+
-
* 4 bytes: Traffic Class Identifier
+
-
| identifier
+
-
| current
+
|-
|-
-
| applicationName
+
|applicationVersionID
-
| 96
+
|105
-
| string
+
|unsigned32
-
| Specifies the name of an application. Used by NBAR, in the application name option table. The table lists the application ID, application name, and application description.
+
|quantity
-
|  
+
|private
-
| current
+
|-
|-
-
| postipDiffServCodePoint
+
|applicationVersionString
-
| 98
+
|106
-
| unsigned8
+
|string
-
| The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services Field, after modification.
+
|quantity
-
|  
+
|private
-
| current
+
|-
|-
-
| replication factor
+
|applicationVendorID
-
| 99
+
|107
-
| unsigned32
+
|unsigned32
-
| Multicast replication factor.
+
|quantity
-
|  
+
|private
-
| current
+
|-
|-
-
| className
+
|clockFrequency
-
| 100
+
|108
-
| string
+
|TBD
-
| Deprecated in favor of 335 selectorName.
+
|quantity
-
Traffic Class Name, associated with the classId Information Element.
+
|private
-
|  
+
-
| deprecated
+
|-
|-
-
| classificationEngineId
+
|subApplicationName
-
| 101
+
|109
-
! unsigned8
+
|string
-
| A unique identifier for the engine which determined the
+
|description
-
Selector ID.  Thus the Classification Engine ID defines
+
|private
-
the context for the Selector ID. The Classification
+
-
Engine can be considered as a specific registry for
+
-
application assignments.
+
-
| identifier
+
-
| current
+
|-
|-
-
| layer2packetSectionOffset
+
|subApplicationDescr
-
| 102
+
|110
-
| unsigned16
+
|string
-
| Layer 2 packet section offset. Potentially a generic offset.
+
|description
-
| quantity
+
|private
-
| current
+
|-
|-
-
| layer2packetSectionSize
+
|rangeEnd
-
| 103
+
|111
-
| unsigned16
+
|unsigned64
-
| Layer 2 packet section size. Potentially a generic size.
+
|description
-
| quantity
+
|current
-
| current
+
|-
|-
-
| layer2packetSectionData
+
|MIBObjectIdentifierMarker
-
| 104
+
|112
-
| octetArray
+
|TBD
-
| Layer 2 packet section data.
+
|identifier
-
|  
+
|future
-
| current
+
|-
|-
-
| subApplicationName
+
|MIBInstanceIdentifier
-
| 109
+
|113
-
| string [TBD]
+
|TBD
-
| Name of a sub app. See #109.
+
|identifier
-
|  
+
|future
-
| current
+
|-
|-
-
| subApplicationDescr
+
|scTag
-
| 110
+
|32769
-
| string [TBD]
+
|unsigned32
-
| Descr of a sub app. See #109.
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
-
| rangeEnd
+
|scTrafficProcessorId
-
| 111
+
|32770
-
| unsigned64
+
|unsigned8
-
| Range end for describing the parameters needed to interpret a field.
+
|identifier
-
|  
+
|current
-
| current
+
|-
|-
 +
|scSourceIpSample
 +
|32771
 +
|unsigned8
 +
|identifier
 +
|current
 +
|-
 +
|scDestinationIpSample
 +
|32772
 +
|unsigned8
 +
|identifier
 +
|current
 +
|-
 +
|scFlowContextId
 +
|32773
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|scSubscriberId
 +
|32774
 +
|string64
 +
|name
 +
|current
 +
|-
 +
|PolicyID (was scPackageId)
 +
|32775
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scServiceId
 +
|32776
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|scProtocolId
 +
|32777
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scSkipppedSessions
 +
|32778
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scInitiatingSide
 +
|32779
 +
|unsigned8
 +
|flags
 +
|current
 +
|-
 +
|scReportTime
 +
|32780
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scTransactionDurationMillisec
 +
|32781
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scTimeFrame
 +
|32782
 +
|unsigned8
 +
|flags
 +
|current
 +
|-
 +
|scSessionUpstreamVolume
 +
|32783
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scSessionDownstreamVolume
 +
|32784
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scProtocolSignature
 +
|32785
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|scZoneId
 +
|32786
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|scFlavorId
 +
|32787
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|scFlowCloseMode
 +
|32788
 +
|unsigned8
 +
|flags
 +
|current
 +
|-
 +
|scAccessString
 +
|32789
 +
|string
 +
|name
 +
|current
 +
|-
 +
|scInfoString
 +
|32790
 +
|string
 +
|name
 +
|current
 +
|-
 +
|scClientPort
 +
|32791
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scServerPort
 +
|32792
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scSubscriberCounterId
 +
|32793
 +
|unsigned16
 +
|totalCounter
 +
|current
 +
|-
 +
|scServiceUsageCounterId
 +
|32794
 +
|unsigned16
 +
|totalCounter
 +
|current
 +
|-
 +
|scBreachState
 +
|32795
 +
|unsigned8
 +
|flags
 +
|current
 +
|-
 +
|scReason
 +
|32796
 +
|unsigned8
 +
|flags
 +
|current
 +
|-
 +
|scConfiguredDuration
 +
|32797
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scDuration
 +
|32798
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scEndTime
 +
|32799
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scUpstreamVolume
 +
|32800
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scDownstreamVolume
 +
|32801
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scSessions
 +
|32802
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|scSeconds
 +
|32803
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|scPackageCounterId
 +
|32804
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scGeneratorId
 +
|32805
 +
|unsigned8
 +
|identifier
 +
|current
 +
|-
 +
|scServiceGlobalCounterId
 +
|32806
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scConcurrentSessions
 +
|32807
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scActiveSubscribers
 +
|32808
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|scTotalActiveSubscribers
 +
|32809
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|linkId
 +
|32810
 +
|unsigned8
 +
|identifier
 +
|current
 +
|-
 +
|scVirtualLinkId
 +
|32811
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scVirtualLinkDirection
 +
|32812
 +
|unsigned8
 +
|identifier
 +
|current
 +
|-
 +
|scAggregationObjectId
 +
|32813
 +
|unsigned16
 +
|identifier
 +
|current
 +
|-
 +
|scVendorId
 +
|32814
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|scUpstreamPacketLoss
 +
|32815
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|scDownstreamPacketLoss
 +
|32816
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|Reserved
 +
|32817
|
|
|
|
 +
|future
 +
|-
 +
|Reserved
 +
|32818
|
|
|
|
-
|  
+
|future
-
|
+
|-
|-
-
| Reserved
+
|scAttackId
-
| 112 - 127
+
|32819
-
| ?
+
|unsigned32
-
| Reserved for future use by Cisco
+
|identifier
-
|  
+
|current
-
|
+
-
|}
+
-
 
+
-
<br>
+
-
<br>
+
-
 
+
-
= Fields > 32768 (Enterprise Specific Fields) =
+
-
 
+
-
<br>
+
-
 
+
-
The values of the fields listed below are set for compatibility with IPFIX Enterprise Specific numbering.
+
-
 
+
-
There's a difference between NFv9 and IPFIX IDs.
+
-
IPFIX fields consist of an E (Enterprise) bit, followed by a 15-bit ID.
+
-
If topmost bit = "E" then the Field Id is enterprise-specific versus IANA standard.
+
-
 
+
-
FNF treats this as a single 16-bit field ID.
+
-
 
+
-
Example:
+
-
* "waas optimization segment" = IPFIX ID 9252 + enterprise ID 9 -> so the E bit is set.
+
-
* So in NFv9, this is 0x8000 + 9252 = 42020.
+
-
 
+
-
Although it looks different, it's exactly the same bits.
+
-
 
+
-
For simplicity we can consider this as a single 16 bit ID starting with 0x8001 or 32769.
+
-
 
+
-
<br>
+
-
<br>
+
-
 
+
-
== Service Control Solution ==
+
-
 
+
-
<br>
+
-
 
+
-
{| border="1" cellpadding="1" cellspacing="1"
+
|-
|-
-
! scope="col" bgcolor="#FFE0C8" | Field Type
+
|scAttackIp
-
! scope="col" bgcolor="#FFE0C8" | Value
+
|32820
-
! scope="col" bgcolor="#FFE0C8" | Len (bytes)
+
|ipv4Address
-
! scope="col" bgcolor="#FFE0C8" | Description
+
|ipv4Address
 +
|current
|-
|-
-
| scTag
+
|scAttackOtherIp
-
| 32769
+
|32821
-
| 4
+
|ipv4Address
-
| A globally unique value which identifies the type of reporting record.
+
|ipv4Address
 +
|current
|-
|-
-
| scTrafficProcessorId
+
|scAttackPortNumber
-
| 32770
+
|32822
-
| 1
+
|unsigned16
-
| Indicates which processing unit generated reporting record. Used for debug/troubleshooting.
+
|identifier
 +
|current
|-
|-
-
| scSourceIpSample
+
|scAttackType
-
| 32771
+
|32823
-
| 1
+
|unsigned32
-
| The last byte of the source IP of the network flow for which the application generated the report.
+
|identifier
 +
|current
|-
|-
-
| scDestinationIpSample
+
|scAttackSide
-
| 32772
+
|32824
-
| 1
+
|unsigned8
-
| The last byte of the destination IP of the network flow for which the application generated the report.
+
|flags
 +
|current
|-
|-
-
| scFlowContextId
+
|scAttackIpProtocol
-
| 32773
+
|32825
-
| 4
+
|unsigned8
-
| The Flow context ID that the current flow is related to. Used for debug/troubleshooting.
+
|flags
 +
|current
|-
|-
-
| scSubscriberId
+
|scAttacks
-
| 32774
+
|32826
-
| 64
+
|unsigned8
-
| The subscriber identification string, introduced through the subscriber management interfaces. For unknown subscriber this field may contain an empty string. The string may be padded with 0.
+
|flags
 +
|current
|-
|-
-
| POLICY+id (was: scPackageId)
+
|scAttackMaliciousSessions
-
| 32775
+
|32827
-
| 2
+
|unsigned32
-
| A numeric value used as an Identifier for the policy profile assigned to the reported entity. (was: “The ID of the policy package/profile assigned to the subscriber”.)
+
|quantity
 +
|current
|-
|-
-
| scServiceId
+
|scUserAgent
-
| 32776
+
|32828
-
| 4
+
|string64
-
| Indicates the service classification of the reported session
+
|name
 +
|current
|-
|-
-
| scProtocolId
+
|scHttpUrl
-
| 32777
+
|32829
-
| 2
+
|string64
-
| This field contains the unique ID of the protocol associated with the reported session. For port-based protocols (for example, TCP port 666 for DOOM) and IP-protocol-based protocols (for example, IP protocol 1 for ICMP), the PROTOCOL_ID will be the TCP_GENERIC / UDP_GENERIC/ IP_PROTOCOL value, according to the specific base protocol of the transaction. For possible values see SCAS-BB Reference Guide.
+
|name
 +
|current
|-
|-
-
| scSkipppedSessions
+
|scSipDomain
-
| 32778
+
|32830
-
| 4
+
|string64
-
| The number of unreported sessions since the previous reporting record of this kind
+
|name
 +
|current
|-
|-
-
| scInitiatingSide
+
|scSipUserAgent
-
| 32779
+
|32831
-
| 1
+
|string64
-
| On which side of the SCE platform the initiator of the transaction resides: the subscriber side (0) or the network side (1).
+
|name
 +
|current
|-
|-
-
| scReportTime
+
|scFlowStart
-
| 32780
+
|32832
-
| 4
+
|unsigned32
-
| Ending time stamp of this reporting record. The field is in UNIX time_t format, which is the number of seconds since midnight of 1 January 1970.
+
|quantity
 +
|current
|-
|-
-
| scTransactionDurationMillisec
+
|scFlowType
-
| 32781
+
|32833
-
| 4
+
|unsigned8
-
| Duration, in milliseconds, of the transaction reported in this reporting record.
+
|flags
 +
|current
|-
|-
-
| scTimeFrame
+
|scSessionId
-
| 32782
+
|32834
-
| 1
+
|unsigned32
-
| The system supports time-dependent policies, by using different rules for different time frames. This field indicates the time frame during which the reporting record was generated. The field’s value can be in the range 0 to 3, indicating which of the four possible time frames was used.
+
|identifier
 +
|current
|-
|-
-
| scSessionUpstreamVolume
+
|scUpstreamJitter
-
| 32783
+
|32835
-
| 4
+
|unsigned32
-
| Upstream volume of the transaction, in bytes. The volume refers to the aggregated upstream volume on both links of all the flows bundled in the transaction.
+
|quantity
 +
|current
|-
|-
-
| scSessionDownstreamVolume
+
|scDownstreamJitter
-
| 32784
+
|32836
-
| 4
+
|unsigned32
-
| Downstream volume of the transaction, in bytes. The volume refers to the aggregated downstream volume on both links of all the flows bundled in the transaction.
+
|quantity
 +
|current
|-
|-
-
| scProtocolSignature
+
|scUpstreamPayloadType
-
| 32785
+
|32837
-
| 4
+
|unsigned8
-
| This field contains the ID of the protocol signature associated with this session. For possible values see SCAS-BB Reference Guide.
+
|identifier
 +
|current
|-
|-
-
| scZoneId
+
|scDownstreamPayloadType
-
| 32786
+
|32838
-
| 4
+
|unsigned8
-
| This field contains the ID of the zone associated with this session
+
|identifier
 +
|current
|-
|-
-
| scFlavorId
+
|scUpstreamAverageJitter
-
| 32787
+
|32839
-
| 4
+
|unsigned32
-
| For protocol signatures that have flavors, this field contains the ID of the flavor associated with this session.
+
|quantity
 +
|current
|-
|-
-
| scFlowCloseMode
+
|scDownstreamAverageJitter
-
| 32788
+
|32840
-
| 1
+
|unsigned32
-
| The reason for the end of flow.
+
|quantity
 +
|current
|-
|-
-
| scAccessString
+
|scCallDestination
-
| 32789
+
|32841
-
| 128, 256, 512, 1024
+
|string64
-
| A Layer 7 property, extracted from the transaction. The content of this field is record-specific and may include host name, server IP, server name, network name etc. (see Table 2-23 in SCAS-BB 3.0 Reference Guide)
+
|name
 +
|current
|-
|-
-
| scInfoString
+
|scCallSource
-
| 32790
+
|32842
-
| 128, 256, 512, 1024
+
|string64
-
| A Layer 7 property, extracted from the transaction. The content of this field is record-specific and may include URL, sender, login name, group name etc. (see Table 2-23 in SCAS-BB 3.0 Reference Guide)
+
|name
 +
|current
|-
|-
-
| scClientPort
+
|scCallType
-
| 32791
+
|32843
-
| 2
+
|unsigned8
-
| For TCP/UDP-based sessions, the port number of the client side (initiator) of the networking session. For non-TCP/UDP sessions, this field has the value zero (0).
+
|flags
 +
|current
|-
|-
-
| scServerPort
+
|scMediaChannels
-
| 32792
+
|32844
-
| 2
+
|unsigned8
-
| For TCP/UDP-based sessions, this field contains the destination port number of the networking session. For non-TCP/UDP sessions, this field contains the IP protocol number of the session flow.
+
|quantity
 +
|current
|-
|-
-
| scSubscriberCounterId
+
|scBlockReason
-
| 32793
+
|32845
-
| 2
+
|unsigned8
-
| Each service is mapped to a counter. There are 32 subscriber counters.
+
|flags
 +
|current
|-
|-
-
| scServiceUsageCounterId
+
|scBlockRdrCount
-
| 32794
+
|32846
-
| 2
+
|unsigned32
-
| Each service is mapped to a counter. There are 32 counters in the subscriber scope
+
|quantity
 +
|current
|-
|-
-
| scBreachState
+
|scBlockRdrCount
-
| 32795
+
|32847
-
| 1
+
|unsigned8
-
| Indicates whether the subscriber's quota was breached: 0, if the quota was not breached and 1, if the quota was breached.
+
|flags
 +
|current
|-
|-
-
| scReason
+
|IngressACLID
-
| 32796
+
|33000
-
| 1
+
|unsigned96
-
| Reason for generation of reporting record: 0-period time pass, 1-subscriber logout, 2 - package switch, 3 - wraparound, 4 - end of aggregation period
+
|identifier
 +
|private
|-
|-
-
| scConfiguredDuration
+
|EgressACLID
-
| 32797
+
|33001
-
| 4
+
|unsigned96
-
| Configured period, in seconds, between successive reporting records
+
|identifier
 +
|private
|-
|-
-
| scDuration
+
|fwEventDetailed
-
| 32798
+
|33002
-
| 4
+
|unsigned16
-
| Indicates the number of seconds that have passed since the previous reporting record of this type
+
|description
 +
|private
|-
|-
-
| scEndTime
+
|FW_EVENT_LEVEL
-
| 32799
+
|33003
-
| 4
+
|unsigned8
-
| Ending time stamp of this reporting record. The field is in UNIX time_t format, which is the number of seconds since midnight of 1 January 1970
+
|flag
 +
|private
|-
|-
-
| scUpstreamVolume
+
|FW_EVENT_LEVEL_ID
-
| 32800
+
|33004
-
| 4
+
|unsigned32
-
| Aggregated upstream volume on both links of all sessions, in kilobytes, for the current reporting period
+
|identifier
 +
|private
|-
|-
-
| scDownstreamVolume
+
|FW_CONFIGURED_VALUE
-
| 32801
+
|33005
-
| 4
+
|unsigned32
-
| Aggregated downstream volume on both links of all sessions, in kilobytes, for the current reporting period.
+
|identifier
 +
|private
|-
|-
-
| scSessions
+
|FW_ERM_EXT_EVENT
-
| 32802
+
|33006
-
| 2
+
|unsigned16
-
| Aggregated number of sessions for the reported service, for the current reporting period.
+
|identifier
 +
|private
|-
|-
-
| scSeconds
+
|FW_ERM_EXT_EVENT_DESC
-
| 32803
+
|33007
-
| 2
+
|string
-
| Aggregated number of session seconds for the reported service, for the current reporting period.
+
|description
 +
|private
|-
|-
-
| scPackageCounterId
+
|CTS_SRC_GROUP_TAG
-
| 32804
+
|34000
-
| 2
+
|unsigned16
-
| Each package is mapped to a counter and this field contains ID of this counter
+
|description
 +
|private
|-
|-
-
| scGeneratorId
+
|CTS_DST_GROUP_TAG
-
| 32805
+
|34001
-
| 1
+
|unsigned16
-
| A numeric value identifying the processor generating the reporting record.
+
|description
 +
|private
|-
|-
-
| scServiceGlobalCounterId
+
|FW_EXT_EVENT
-
| 32806
+
|35001
-
| 2
+
|unsigned16
-
| Each service is mapped to a counter and this field contains ID of this counter
+
|identifier
 +
|private
|-
|-
-
| scConcurrentSessions
+
|FW_SRC_VRF_ID
-
| 32807
+
|35002
-
| 4
+
|unsigned32
-
| Concurrent number of sessions using the reported service at this point in time.
+
|identifier
 +
|private
|-
|-
-
| scActiveSubscribers
+
|FW_DST_VRF_ID
-
| 32808
+
|35003
-
| 4
+
|unsigned32
-
| Concurrent number of subscribers using the reported service at this point in time.
+
|identifier
 +
|private
|-
|-
-
| scTotalActiveSubscribers
+
|FW_BLACKOUT_SECS
-
| 32809
+
|35004
-
| 4
+
|unsigned32
-
| Concurrent number of subscribers in the system at this point in time.
+
|totalCounter
 +
|private
|-
|-
-
| LINK_ID (was: scLinkId)
+
|FW_HALFOPEN_HIGH
-
| 32810
+
|35005
-
| 1
+
|unsigned32
-
| A numeric value associated with the reported network link. (was: “Possible values are 0 and 1 (referring to physical links 1 and 2 respectively).”)
+
|totalCounter
 +
|private
|-
|-
-
| scVirtualLinkId
+
|FW_HALFOPEN_RATE
-
| 32811
+
|35006
-
| 2
+
|unsigned32
-
| A numeric value associated with the reported virtual network link. Possible values are TBD.
+
|totalCounter
 +
|private
|-
|-
-
| scVirtualLinkDirection
+
|FW_ZONEPAIR_ID
-
| 32812
+
|35007
-
| 1
+
|unsigned32
-
| A numeric value indicating the reported virtual network link direction.
+
|identifier
 +
|private
|-
|-
-
| scAggregationObjectId
+
|FW_MAX_SESSIONS
-
| 32813
+
|35008
-
| 2
+
|unsigned32
-
| Externally assigned: 0 - offline subscriber, 1 - online subscriber. Used in Real Time Subscriber Usage RDR
+
|totalCounter
 +
|private
|-
|-
-
| scVendorId
+
|FW_ZONEPAIR_NAME
-
| 32814
+
|35009
-
| 4
+
|string
-
| The ITU-U vendor ID of the application. A value of 0xFFFFFFFF indicates that this field was not found in the traffic.
+
|name
 +
|private
|-
|-
-
| scUpstreamPacketLoss
+
|FW_EXT_EVENT_DESC
-
| 32815
+
|35010
-
| 2
+
|string
-
| The average fractional upstream packet loss for the session, taken from the RTCP flow. (Refer to the note following this table for an explanation of this value.) A value of 0xFFFF indicates that this field is undefined (no RTCP flows were opened).
+
|description
 +
|private
|-
|-
-
| scDownstreamPacketLoss
+
|FW_SUMMARY_PKT_CNT
-
| 32816
+
|35011
-
| 2
+
|unsigned32
-
| The average fractional downstream packet loss for the session, taken from the RTCP flow. (Refer to the note following this table for an explanation of this value.) A value of 0xFFFF indicates that this field is undefined (no RTCP flows were opened).
+
|totalCounter
 +
|private
|-
|-
-
| RESERVED1
+
|FW_HALFOPEN_CNT
-
| 32817
+
|35012
-
| N/A
+
|unsigned32
-
| Reserved for SCE
+
|totalCounter
 +
|private
|-
|-
-
| RESERVED2
+
|WAAS_DRE_BYTES_INPUT
-
| 32818
+
|36000
-
| N/A
+
|unsigned64
-
| Reserved for SCE
+
|totalCounter
 +
|private
|-
|-
-
| scAttackId
+
|WAAS_DRE_BYTES_OUTPUT
-
| 32819
+
|36001
-
| 4
+
|unsigned64
-
| Unique attack ID.
+
|totalCounter
 +
|private
|-
|-
-
| scAttackIp
+
|WAAS_LZ_BYTES_INPUT
-
| 32820
+
|36002
-
| 4
+
|unsigned64
-
| The IP address related to this attack.
+
|totalCounter
 +
|private
|-
|-
-
| scAttackOtherIp
+
|WAAS_LZ_BYTES_OUTPUT
-
| 32821
+
|36003
-
| 4
+
|unsigned64
-
| The other IP address related to this attack if exists, 0xFFFFFFFF otherwise.
+
|totalCounter
 +
|private
|-
|-
-
| scAttackPortNumber
+
|WAAS_ORIGINAL_BYTES
-
| 32822
+
|36004
-
| 2
+
|unsigned64
-
| The port number related to this attack, if such exists (if this is an IP scan, for example), or 0xFFFF otherwise in case the info is not relevant (certain types of attacks).
+
|totalCounter
 +
|private
|-
|-
-
| scAttackType
+
|WAAS_OPTIMISED_BYTES
-
| 32823
+
|36005
-
| 4
+
|unsigned64
-
| Who attackIp belongs to: 0—Attacked, 1—Attacker
+
|totalCounter
 +
|private
|-
|-
-
| scAttackSide
+
|WAAS_APPLICATION
-
| 32824
+
|36006
-
| 1
+
|unsigned32
-
| The IP address side: 0—Subscriber, 1—Network.
+
|identifier
 +
|private
|-
|-
-
| scAttackIpProtocol
+
|WAAS_CLASS
-
| 32825
+
|36007
-
| 1
+
|unsigned32
-
| IP protocol type: 0—Other, 1—ICMP, 6—TCP, 17—UDP. For possible values see SCAS-BB Reference Guide.
+
|identifier
 +
|private
|-
|-
-
| scAttacks
+
|WAAS_CONNECTION_MODE
-
| 32826
+
|36008
-
| 1
+
|unsigned16
-
| The number of attacks in the current reporting period. Since this report is generated per attack, the value is 0 or 1.
+
|identifier
 +
|private
|-
|-
-
| scAttackMaliciousSessions
+
|WAAS_IN_BYTES
-
| 32827
+
|36009
-
| 4
+
|unsigned64
-
| Aggregated number of sessions for the reported attack, for the current reporting period. If the SCE platform blocks the attack, this field takes the value 0xFFFFFFFF.
+
|totalCounter
 +
|private
|-
|-
-
| scUserAgent
+
|WAAS_OUT_BYTES
-
| 32828
+
|36010
-
| 64
+
|unsigned64
-
| The user agent field extracted from the HTTP transaction.
+
|totalCounter
 +
|private
|-
|-
-
| scHttpUrl
+
|WAAS_IN_PACKETS
-
| 32829
+
|36011
-
| 64
+
|unsigned64
-
| The URL extracted from the HTTP transaction.
+
|totalCounter
 +
|private
|-
|-
-
| scSipDomain
+
|WAAS_OUT_PACKETS
-
| 32830
+
|36012
-
| 64
+
|unsigned64
-
| SIP: Domain name extracted from SIP header.
+
|totalCounter
 +
|private
|-
|-
-
| scSipUserAgent
+
|WAAS_LZ_ENC_AVG_LATENCY
-
| 32831
+
|36013
-
| 64
+
|unsigned64
-
| SIP: User-Agent field extracted from SIP header.
+
|totalCounter
 +
|private
|-
|-
-
| scFlowStart
+
|WAAS_LZ_DEC_AVG_LATENCY
-
| 32832
+
|36014
-
| 4
+
|unsigned64
-
| Flow start time.
+
|totalCounter
 +
|private
|-
|-
-
| scFlowType
+
|WAAS_DRE_ENC_AVG_LATENCY
-
| 32833
+
|36015
-
| 1
+
|unsigned64
-
| 0—All Skype flows
+
|totalCounter
-
1—Audio (SIP)
+
|private
-
2—Video (SIP)
+
|-
|-
-
| scSessionId
+
|WAAS_DRE_DEC_AVG_LATENCY
-
| 32834
+
|36016
-
| 4
+
|unsigned64
-
| SIP: The flow-context ID of the control flow.
+
|totalCounter
-
Skype: The flow-context ID of the flow.
+
|private
|-
|-
-
| scUpstreamJitter
+
|CNT_PKTS_DROP
-
| 32835
+
|37000
-
| 4
+
|unsigned64
-
| SIP: The average upstream jitter for the session, taken from the RTCP flow: N/A (0xFFFFFFFF) if RTCP flow is missing.
+
|totalCounter
-
Skype: N/A (0xFFFFFFFF).
+
|current
|-
|-
-
| scDownstreamJitter
+
|CNT_PKTS_DROP_PERM
-
| 32836
+
|37001
-
| 4
+
|unsigned64
-
| SIP: The average downstream jitter for the session, taken from the RTCP flow: N/A (0xFFFFFFFF) if RTCP flow is missing.
+
|totalCounter
-
Skype: N/A (0xFFFFFFFF).
+
|current
|-
|-
-
| scUpstreamPayloadType
+
|CNT_PKTS_RATE
-
| 32837
+
|37002
-
| 1
+
|unsigned32
-
| SIP: The upstream RTP payload type for the session.
+
|totalCounter
-
Skype: N/A (0xFF). A value of 0xFF indicates that this field was not available (no RTP flows were opened).
+
|current
|-
|-
-
| scDownstreamPayloadType
+
|CNT_BYTE_RATE
-
| 32838
+
|37003
-
| 1
+
|unsigned32
-
| SIP: The downstream RTP payload type for the session.
+
|totalCounter
-
Skype: N/A (0xFF). A value of 0xFF indicates that this field was not available (no RTP flows were opened).
+
|current
|-
|-
-
| scUpstreamAverageJitter
+
|MEDIA_CNT_BYTES
-
| 32839
+
|37004
-
| 4
+
|unsigned64
-
| The average upstream jitter for the session in units of 1/65.535 millisecond, taken from the RTCP flow. (Refer to the note following this table for an explanation of this value.) A value of 0xFFFFFFFF indicates that this field is undefined (no RTCP flows were opened).
+
|totalCounter
 +
|current
|-
|-
-
| scDownstreamAverageJitter
+
|MEDIA_CNT_BYTES_PERM
-
| 32840
+
|37005
-
| 4
+
|unsigned64
-
| The average downstream jitter for the session in units of 1/65.535 millisecond, taken from the RTCP flow. (Refer to the note following this table for an explanation of this value.) A value of 0xFFFFFFFF indicates that this field is undefined (no RTCP flows were opened).
+
|totalCounter
 +
|current
|-
|-
-
| scCallDestination
+
|MEDIA_BYTE_RATE
-
| 32841
+
|37006
-
| 64
+
|unsigned64
-
| The Q931 Alias address of the session destination. A value of N/A indicates that this field was not found in the traffic.
+
|quantity
 +
|current
|-
|-
-
| scCallSource
+
|MEDIA_CNT_PKTS
-
| 32842
+
|37007
-
| 64
+
|unsigned64
-
| The Q931 Alias address of the session source. A value of N/A indicates that this field was not found in the traffic.
+
|deltaCounter
 +
|current
|-
|-
-
| scCallType
+
|MEDIA_CNT_PKTS_PERM
-
| 32843
+
|37008
-
| 1
+
|unsigned64
-
| The call type (taken from H225 packet). A value of 0xFF indicates that this field is undefined (no RTP flows were opened).
+
|totalCounter
 +
|current
|-
|-
-
| scMediaChannels
+
|MEDIA_PKTS_RATE
-
| 32844
+
|37009
-
| 1
+
|unsigned32
-
| The number of data flows that were opened during the session.
+
|totalCounter
 +
|current
|-
|-
-
| scBlockReason
+
|MEDIA_PKTS_RATE_VAR
-
| 32845
+
|37010
-
| 1
+
|unsigned32
-
| Indicates the reason why this session was blocked. For possible values and their interpretation, see Block Reason, page 2-42 of the SCA BB Reference Guide
+
|totalCounter
 +
|current
|-
|-
-
| scBlockRdrCount
+
|MEDIA_EVENT
-
| 32846
+
|37011
-
| 4
+
|unsigned8
-
| Total number of blocked flows reported so far (from the beginning of the current time frame).
+
|flags
 +
|current
|-
|-
-
| scRedirected
+
|[TBD]
-
| 32847
+
|37012
-
| 1
+
|unsigned8
-
| Indicates whether the flow has been redirected after being blocked.
+
|flags
-
0—Not redirected
+
|current
-
1—Redirected
+
|-
|-
-
| RESERVED
+
|monitorStartTime
-
| 32848 to 32999
+
|37013
-
| N/A
+
|unsigned64 [TBD]
-
| Reserved for SCE
+
|quantity
-
|}
+
|current
-
 
+
-
<br>
+
-
<br>
+
-
 
+
-
== Performance Routing ==
+
-
 
+
-
<br>
+
-
 
+
-
Refer to: [[NetFlow:PfR | Performance Routing NetFlow]] for information regarding the use of the fields.
+
-
 
+
-
<br>
+
-
 
+
-
{| border="1" cellpadding="1" cellspacing="1"
+
|-
|-
-
! scope="col" bgcolor="#FFE0C8" | Field Type
+
|TRANS_PKTS_EXPECT
-
! scope="col" bgcolor="#FFE0C8" | Value
+
|37014
-
! scope="col" bgcolor="#FFE0C8" | Len (bytes)
+
|unsigned64
-
! scope="col" bgcolor="#FFE0C8" | Description
+
|totalCounter
 +
|current
|-
|-
-
| IPV4_BR_ADDR
+
|TRANS_PKTS_EXPECT_PERM
-
| 39000
+
|37015
-
| 4
+
|unsigned64
-
| IPv4 border router (BR) address
+
|totalCounter
 +
|current
|-
|-
-
| PFR_STATUS
+
|TRANS_RTT
-
| 39001
+
|37016
-
| 2
+
|unsigned32
-
| state code (state_type: 1 Byte, state_subtype: 1 Byte)
+
|quantity
 +
|current
|-
|-
-
| REASON_ID
+
|TRANS_EVENT_PKT_LOST_CNT
-
| 39002
+
|37017
-
| 4
+
|unsigned32
-
| reason ID
+
|totalCounter
 +
|current
|-
|-
-
| Threshold
+
|AVG_SEQ_DISC_LEN
-
| 39003
+
|37018
-
| 4
+
|unsigned32
-
| policy threshold to which PfR thinks In-Policy
+
|quantity
 +
|current
|-
|-
-
| Priority
+
|TRANS_PKTS_LOST
-
| 39004
+
|37019
-
| 2
+
|unsigned64
-
| policy priority settings.
+
|deltaCounter
 +
|current
|-
|-
-
| LongTermRTT
+
|TRANS_PKTS_LOST_PERM
-
| 39006
+
|37020
-
| 4
+
|unsigned64
-
| average round-trip-time for long-term period
+
|totalCounter
 +
|current
|-
|-
-
| BelowMOSPercentage
+
|TRANS_PKTS_LOST_RATE
-
| 39007
+
|37021
-
| 4
+
|unsigned32
-
| average percentage value below the MOS threshold
+
|totalCounter
 +
|current
|-
|-
-
| RSVPBandWidthPool
+
|RTP_SSRC
-
| 39008
+
|37022
-
| 8
+
|unsigned32
-
| bandwidth pool reserved by RSVP
+
|identifier
 +
|current
|-
|-
-
| RollupCounter
+
|RTP_JITTER
-
| 39009
+
|37023
-
| 2
+
|unsigned32
-
| rollup counter which is expired when it becomes zero.
+
|quantity
 +
|current
|-
|-
-
| BandWidthPercentage
+
|RTP_JITTER_MIN
-
| 39010
+
|37024
-
| 2
+
|unsigned32
-
| bandwidth percentage against the maximum bandwidth
+
|quantity
 +
|current
|-
|-
-
| BandWidthFee
+
|RTP_JITTER_MAX
-
| 39011
+
|37025
-
| 4
+
|unsigned32
-
| fee for a specific bandwidth
+
|quantity
 +
|current
|-
|-
-
| L4_SRC_PORT_MIN
+
|counterFlow
-
| 39012
+
|37026
-
| 2
+
|unsigned32
-
| TCP/UDP source minimum port number
+
|totalCounter
 +
|current
|-
|-
-
| L4_SRC_PORT_MAX
+
|MISC_UNSUPPORTED
-
| 39013
+
|37027
-
| 2
+
|unsigned16
-
| TCP/UDP source maximum port number (we will request a standard number to IANA later)
+
|quantity
 +
|current
|-
|-
-
| L4_DST_PORT_MIN
+
|CNT_BYTES_RATE_FLOW
-
| 39014
+
|37028
-
| 2
+
|unsigned32
-
| TCP/UDP destination minimum port number (we will request a standard number to IANA later)
+
|totalCounter
 +
|current
|-
|-
-
| L4_DST_PORT_MAX
+
|CNT_BYTES_RATE_FLOW_MIN
-
| 39015
+
|37029
-
| 2
+
|unsigned32
-
| TCP/UDP destination maximum port number (we will request a standard number to IANA later)
+
|totalCounter
 +
|current
|-
|-
-
| CAPACITY
+
|CNT_BYTES_RATE_FLOW_MAX
-
| 39016
+
|37030
-
| 8
+
|unsigned32
-
| Link capacity – egress link capacity (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| INGRESS_BW
+
|CNT_PKTS_RATE_FLOW
-
| 39017
+
|37031
-
| 8
+
|unsigned32
-
| Current ingress bandwidth (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| MAX_INGRESS_BW
+
|CNT_PKTS_RATE_FLOW_MIN
-
| 39018
+
|37032
-
| 8
+
|unsigned32
-
| Max ingress bandwidth (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| EGRESS_BW
+
|CNT_PKTS_RATE_FLOW_MAX
-
| 39019
+
|37033
-
| 8
+
|unsigned32
-
| Current egress bandwidth (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| MAX_EGRESS_BW
+
|applicationMediaBytesRatePerFlow
-
| 39020
+
|37034
-
| 8
+
|unsigned32
-
| Max egress bandwidth (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| INGRESS_ROLLUP_BW
+
|applicationMediaBytesRatePerFlowMin
-
| 39021
+
|37035
-
| 8
+
|unsigned32
-
| Ingress rollup bandwidth (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| EGRESS_ROLLUP_BW
+
|applicationMediaBytesRatePerFlowMax
-
| 39022
+
|37036
-
| 8
+
|unsigned32
-
| Egress rollup bandwidth (kbps)
+
|totalCounter
 +
|current
|-
|-
-
| KTH_ROLLUP_BW
+
|RTP_SEQ_CYCLE_COUNT
-
| 39023
+
|37037
-
| 8
+
|unsigned32
 +
|quantity
 +
|current
|-
|-
-
| LINK_GROUP_NAME
+
|application media packets rate variation min
-
| 39024
+
|37038
-
| 48
+
|unsigned32
-
| Link group name assigned to an external interface in the MC configuration
+
|quantity
 +
|current
|-
|-
-
| BGP_COMMUNITY
+
|application media packets rate variation max
-
| 39025
+
|37039
-
| 4
+
|unsigned32
-
| Used for ingress load-balancing using BGP
+
|quantity
 +
|current
|-
|-
-
| BGP_PREPEND
+
|transport rtp flow count
-
| 39026
+
|37040
-
| 1
+
|unsigned32
-
| Used for ingress load-balancing using BGP
+
|quantity
 +
|current
|-
|-
-
| ENTRANCE_DOWNGRADE
+
|transport rtp payload type
-
| 39027
+
|37041
-
|  
+
|unsigned8
-
|  
+
|flags
 +
|current
|-
|-
-
| DISCARD_ROLLUP_COUNT
+
|transport packets lost counter min
-
| 39028
+
|37042
-
| 2
+
|unsigned32
-
|  
+
|totalCounter
 +
|current
|-
|-
-
|}
+
|transport packets lost counter max
-
 
+
|37043
-
<br>
+
|unsigned32
-
<br>
+
|totalCounter
-
 
+
|current
-
 
+
-
 
+
-
 
+
-
 
+
-
== NAM Module ==
+
-
 
+
-
<br>
+
-
 
+
-
{| border="1" cellpadding="1" cellspacing="1"
+
|-
|-
-
! scope="col" bgcolor="#FFE0C8" | Field Type
+
|transport event packet-loss counter min
-
! scope="col" bgcolor="#FFE0C8" | Value
+
|37044
-
! scope="col" bgcolor="#FFE0C8" | Len (bytes)
+
|unsigned32
-
! scope="col" bgcolor="#FFE0C8" | Description
+
|totalCounter
 +
|current
|-
|-
-
| namDataSrc
+
|transport event packet-loss counter max
-
| 42001
+
|37045
-
| 4
+
|unsigned32
-
| NAM’s assigned data source (port, NDE device, VLAN id, etc.), associated with NAM’s input ifIndex
+
|totalCounter
 +
|current
|-
|-
-
| srcSite
+
|RTP_SEQ_RESYNC_COUNT
-
| 42002
+
|37046
-
| 4
+
|unsigned32
-
| NAM’s assigned source site (aggregation of source hosts)
+
|quantity
-
Site is a user–defined grouping of hosts (IP addresses) and (optionally) data-sources (logical channels of ingress traffic, i.e. observation points) according to one the following or similar supported definition methods, for example:
+
|current
-
* Network Prefix(es)
+
-
* Network Prefix(es) + Set of Data Source(s)
+
-
* Network Prefix(es) + Set of Data Source(s) + Set of VLAN(s)
+
-
* WAAS data source
+
-
* NDE/CEF data source + interface(s)
+
|-
|-
-
| dstSite
+
|transport packets lost rate min
-
| 42003
+
|37047
-
| 4
+
|unsigned32
-
| NAM’s assigned destination site (aggregation of destination hosts)
+
|quantity
 +
|current
|-
|-
-
| serverSite
+
|transport packets lost rate max
-
| 42004
+
|37048
-
| 4
+
|unsigned32
-
| NAM’s assigned server site for IAP metrics (can be both traffic source and destination)
+
|quantity
 +
|current
|-
|-
-
| clientSite
+
|transport tcp flow count
-
| 42005
+
|37049
-
| 4
+
|unsigned32
-
| NAM’s assigned client site for IAP metrics (can be both traffic source and destination)
+
|totalCounter
 +
|current
|-
|-
-
| Unused
+
|transport round-trip-time sum
-
| 42006
+
|37050
-
| N/A
+
|unsigned64
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| serverIPv4Address
+
|transport round-trip-time samples
-
| 42007
+
|37051
-
| 4
+
|unsigned32
-
| Server address (IPv4) in IAP metrics (can be both traffic source and destination)
+
|quantity
 +
|current
|-
|-
-
| clientIPv4Address
+
|transport round-trip-time min
-
| 42008
+
|37052
-
| 4
+
|unsigned32
-
| Client address (IPv4) in IAP metrics(can be both traffic source and destination)
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|transport round-trip-time max
-
| 42009
+
|37053
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| netEncap
+
|Global session ID
-
| 42010
+
|37054
-
| 4
+
|string24
-
| Network protocol encapsulation enum
+
|name
 +
|current
|-
|-
-
| serverIPv6Address
+
|Multi-party-session ID
-
| 42011
+
|37055
-
| 16
+
|string16
-
| Server address (IPv6) in IAP metrics (can be both traffic source and destination)
+
|name
 +
|current
|-
|-
-
| clientIPv6Address
+
|Clock frequency
-
| 42012
+
|37056
-
| 16
+
|unsigned32
-
| Client address (IPv6) in IAP metrics (can be both traffic source and destination)
+
|quantity
 +
|current
|-
|-
-
| namSrcDeviceId
+
|monitor end time
-
| 42013
+
|37057
-
| 4
+
|unsigned32
-
| Internal index of the (traffic) source device
+
|quantity
-
* NAM source device fields are keys in the exported flows
+
|deprecated
-
* NAM source device designate the network device sending the traffic to NAM
+
-
* NAM source device may or may not be a NetFlow observation point.
+
|-
|-
-
| namSrcDeviceIPv4Address
+
|Transport packets out-of-ordered counter
-
| 42014
+
|37058
-
| 4
+
|unsigned32
-
| See above
+
|quantity
 +
|current
|-
|-
-
| namSrcDeviceIPv6Address
+
|SERVER_RESPONSE_TIME_AVG
-
| 42015
+
|37059
-
| 16
+
|unsigned32
-
| See above
+
|quantity
 +
|current
|-
|-
-
| siteName
+
|REFUSED_SESSION
-
| 42016
+
|37060
-
| N
+
|unsigned32
-
| Site name
+
|quantity
 +
|current
|-
|-
-
| siteDescription
+
|CLIENT_NETWORK_DELAY_AVG
-
| 42017
+
|37061
-
| N
+
|unsigned32
-
| Site description
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|SERVER_NETWORK_DELAY_AVG
-
| 42018
+
|37062
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|NETWORK_DELAY_AVG
-
| 42019
+
|37063
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| waasOptimizationSegment
+
|APPLICATION_DELAY_AVG
-
| 42020
+
|37064
-
| 1
+
|unsigned32
-
| WAAS optimization "segment" (Client LAN, Client WAN, Server WAN, Server LAN, or Passthrough)
+
|quantity
 +
|current
|-
|-
-
| waasPassThroughReason
+
|SESSION_TIME_MIN
-
| 42021
+
|37065
-
| 1
+
|unsigned32
-
| PT_UNKNOWN 0
+
|quantity
-
 
+
|current
-
PTR indicated by SN
+
-
* PT_NO_PEER 1
+
-
* PT_RJCT_CAP 2
+
-
* PT_RJCT_RSRCS 3
+
-
* PT_RJCT_NO_LICENSE 4
+
-
* PT_APP_CONFIG 5
+
-
* PT_GLB_CONFIG 6
+
-
* PT_ASYMMETRIC 7
+
-
* PT_IN_PROGRESS 8
+
-
* PT_INTERMEDIATE 9
+
-
* PT_OVERLOAD 10
+
-
* PT_INT_ERROR 11
+
-
* PT_APP_OVERRIDE 12
+
-
* PT_SVR_BLACKLIST 13
+
-
* PT_AD_VER_MISMTCH 14
+
-
* PT_AD_AO_INCOMPAT 15
+
-
* PT_AD_AOIM_PROGRESS 16
+
-
* PT_DIRM_VER_MISMTCH 17
+
-
* PT_PEER_OVERRIDE 18
+
-
* PT_AD_OPT_PARSE_FAIL 19
+
-
* PT_AD_PT_SERIAL_MODE 20
+
-
* PT_SN_INTERCEPTION_ACL 21
+
-
* PT_IP_FRAG_UNSUPP_PEER 22
+
-
+
-
PTR collected by SC globally
+
-
* PT_CLUSTER_MEMBER 32
+
-
* PT_FLOW_QUERY_FAIL 33
+
-
* PT_FLOWSW_INT_ACL_DENY 34
+
-
+
-
PTR collected by SC per class
+
-
* PT_FLOWSW_PLCY 40
+
-
* PT_SNG_OVERLOAD 41
+
-
* PT_CLUSTER_DEGRADE 42
+
-
* PT_FLOW_LEARN_FAIL 43
+
-
+
-
PTR specific to Lhotse
+
-
* PT_ZBFW 56
+
-
* PT_RTSP_ALG 57
+
-
* PT_NON_WAN 58
+
|-
|-
-
| initiatorPackets
+
|SESSION_TIME_MAX
-
| 42033
+
|37066
-
| 8
+
|unsigned32
-
| Total packets sent by clients
+
|quantity
 +
|current
|-
|-
-
| responderPackets
+
|SESSION_TIME_AVG
-
| 42034
+
|37067
-
| 8
+
|unsigned32
-
| Total packets sent by servers
+
|quantity
 +
|current
|-
|-
-
| retransOctets
+
|TRANSACTION_TIME_AVG
-
| 42035
+
|37068
-
| 4
+
|unsigned32
-
| Total octets retransmitted
+
|quantity
 +
|current
|-
|-
-
| retransPackets
+
|CLOSED_SESSIONS
-
| 42036
+
|37069
-
| 4
+
|unsigned32
-
| Total IP packets retransmitted by Layer 4 (TCP/SCTP) or application
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|RETRANSMISSION
-
| 42037
+
|37070
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|OUTOFORDER_BYTES
-
| 42038
+
|37071
-
| N/A
+
|unsigned64
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|CLIENT_THROUGHPUT_AVG
-
| 42039
+
|37072
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| transactionCountDelta
+
|UNRESPONSIVE_SESSION
-
| 42040
+
|37073
-
| 4
+
|unsigned32
-
| Number of transactions
+
|quantity
-
Transaction is defined as a pair of an application-layer request from client and the associated response from server.  Each request/response consists of one or multiple packets carrying application data
+
|current
|-
|-
-
| sumTransactionTime
+
|OUTOFORDER_PACKETS
-
| 42041
+
|37074
-
| 4
+
|unsigned32
-
| Sum of transaction time.
+
|quantity
-
Divide by transactionCountDelta for AVG
+
|current
|-
|-
-
| maxTransactionTime
+
|V4_SRC_OBSERVATION_NODE
-
| 42042
+
|37075
-
| 4
+
|ipv4Address
-
| Maximal transaction time in msec
+
|ipv4Address
 +
|current
|-
|-
-
| minTransactionTime
+
|V4_DST_OBSERVATION_NODE
-
| 42043
+
|37076
-
| 4
+
|ipv4Address
-
| Minimal transaction time in msec
+
|ipv4Address
 +
|current
|-
|-
-
| sumDataTransmissionTime
+
|V6_SRC_OBSERVATION_NODE
-
| 42044
+
|37077
-
| 4
+
|ipv6Address
-
| Sum of data transmission time in msec. Transmission is defined as the data transmission of the server response in a transaction
+
|ipv6Address
 +
|current
|-
|-
-
| sumDataRetransmissionTime
+
|V6_DST_OBSERVATION_NODE
-
| 42045
+
|37078
-
| 4
+
|ipv6Address
-
| Sum of data retransmission time in msec
+
|ipv6Address
 +
|current
|-
|-
-
| Unused
+
|ONE_WAY_DELAY_SUM
-
| 42046
+
|37079
-
| N/A
+
|unsigned64
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|ONE_WAY_DELAY_SAMPLES
-
| 42047
+
|37080
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|ONE_WAY_DELAY
-
| 42048
+
|37081
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|PACKET_ARRIVAL_TIMESTAMP
-
| 42049
+
|37082
-
| N/A
+
|unsigned64
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| newConnectionsCountDelta
+
|TCP_WINDOW_SIZE_MIN
-
| 42050
+
|37083
-
| 4
+
|unsigned32
-
| Number of new connections (new sessions)
+
|quantity
 +
|current
|-
|-
-
| completedConnectionsCountDelta
+
|TCP_WINDOW_SIZE_MAX
-
| 42051
+
|37084
-
| 4
+
|unsigned32
-
| Number of completed sessions
+
|quantity
 +
|current
|-
|-
-
| refusedConnectionsCountDelta
+
|TCP_WINDOW_SIZE_AVG
-
| 42052
+
|37085
-
| 4
+
|unsigned32
-
| Number of refused sessions
+
|quantity
 +
|current
|-
|-
-
| unrespConnectionsCountDelta
+
|TCP_MAXIMUM_SEGMENT_SIZE
-
| 42053
+
|37086
-
| 4
+
|unsigned16
-
| Number of unresponsive sessions
+
|quantity
 +
|current
|-
|-
-
| sumSessionDuration
+
|RTP_INVALLID_SEQ_COUNT
-
| 42054
+
|37087
-
| 4
+
|unsigned32
-
| Total session duration in msec. 
+
|quantity
-
Divide by completedConnectionsCountDelta for AVG
+
|current
|-
|-
-
| Unused
+
|LOW_UNAVAILABILITY_MILLISECONDS
-
| 42055
+
|37088
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|MID_PID
-
| 42056
+
|37089
-
| N/A
+
|unsigned16
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|METRIC_TYPE
-
| 42057
+
|37090
-
| N/A
+
|unsigned8
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|TCP_WINDOW_SIZE_SUM
-
| 42058
+
|37091
-
| N/A
+
|unsigned64
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|TIME_INTERVAL_END
-
| 42059
+
|37092
-
| N/A
+
|unsigned64
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| numRespsCountDelta
+
|RTP_JITTER_MEAN_SUM
-
| 42060
+
|37093
-
| 4
+
|unsigned64
-
| Number of responses
+
|quantity
 +
|current
|-
|-
-
| numResps1CountDelta
+
|MEDIA_CNT_PKTS_RATE_VAR_SUM
-
| 42061
+
|37094
-
| 4
+
|unsigned64
-
| Number of responses in bucket 1
+
|quantity
 +
|current
|-
|-
-
| numResps2CountDelta
+
|TCP_WINDOW_SIZE_AVG_SUM
-
| 42062
+
|37095
-
| 4
+
|unsigned32
-
| Number of responses in bucket 2
+
|quantity
 +
|current
|-
|-
-
| numResps3CountDelta
+
|vqmMostRecentResolutionWidth
-
| 42063
+
|37500
-
| 4
+
|unsigned16
-
| Number of responses in bucket 3
+
|totalCounter
 +
|current
|-
|-
-
| numResps4CountDelta
+
|vdsDisplayProtocol
-
| 42064
+
|38000
-
| 4
+
|unsigned16
-
| Number of responses in bucket 4
+
|totalCounter
 +
|current
|-
|-
-
| numResps5CountDelta
+
|IPV4_BR_ADDR
-
| 42065
+
|39000
-
| 4
+
|ipv4Address
-
| Number of responses in bucket 5
+
|ipv4Address
 +
|current
|-
|-
-
| numResps6CountDelta
+
|PFR_STATUS
-
| 42066
+
|39001
-
| 4
+
|unsigned16
-
| Number of responses in bucket 6
+
|ipv4Address
 +
|current
|-
|-
-
| numResps7CountDelta
+
|REASON_ID
-
| 42067
+
|39002
-
| 4
+
|unsigned32
-
| Number of responses in bucket 7
+
|flags
 +
|current
|-
|-
-
| numLateRespsCountDelta
+
|Threshold
-
| 42068
+
|39003
-
| 4
+
|unsigned32
-
| Number of late responses
+
|flags
 +
|current
|-
|-
-
| Unused
+
|Priority
-
| 42069
+
|39004
-
| N/A
+
|unsigned16
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|shortTermRTT
-
| 42070
+
|39005
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| sumRespTime
+
|longTermRTT
-
| 42071
+
|39006
-
| 4
+
|unsigned32
-
| Sum of response time in msec. 
+
|quantity
-
Divide by numRespsCountDelta for AVG
+
|current
|-
|-
-
| maxRespTime
+
|BelowMOSPercentage
-
| 42072
+
|39007
-
| 4
+
|unsigned32
-
| Maximal response time in msec
+
|quantity
 +
|current
|-
|-
-
| minRespTime
+
|RSVPBandWidthPool
-
| 42073
+
|39008
-
| 4
+
|unsigned64
-
| Minimal response time in msec
+
|quantity
 +
|current
|-
|-
-
| sumServerRespTime
+
|RollupCounter
-
| 42074
+
|39009
-
| 4
+
|unsigned16
-
| Sum of application server response time in msec. 
+
|quantity
-
Divide by numRespsCountDelta for AVG
+
|current
|-
|-
-
| maxServerRespTime
+
|BandWidthPercentage
-
| 42075
+
|39010
-
| 4
+
|unsigned16
-
| Maximal application server response time in msec
+
|quantity
 +
|current
|-
|-
-
| minServerRespTime
+
|BandWidthFee
-
| 42076
+
|39011
-
| 4
+
|unsigned32
-
| Minimal application server response time in msec
+
|quantity
 +
|current
|-
|-
-
| sumTotalRespTime
+
|L4_SRC_PORT_MIN
-
| 42077
+
|39012
-
| 4
+
|unsigned16
-
| Sum of total response time in msec. 
+
|quantity
-
Divide by numRespsCountDelta for AVG
+
|current
 +
|-
 +
|L4_SRC_PORT_MAX
 +
|39013
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|L4_DST_PORT_MIN
 +
|39014
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|L4_DST_PORT_MAX
 +
|39015
 +
|unsigned16
 +
|quantity
 +
|current
 +
|-
 +
|CAPACITY
 +
|39016
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|INGRESS_BW
 +
|39017
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|MAX_INGRESS_BW
 +
|39018
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|EGRESS_BW
 +
|39019
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|MAX_EGRESS_BW
 +
|39020
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|INGRESS_ROLLUP_BW
 +
|39021
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|EGRESS_ROLLUP_BW
 +
|39022
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|KTH_ROLLUP_BW
 +
|39023
 +
|unsigned64
 +
|quantity
 +
|current
 +
|-
 +
|LINK_GROUP_NAME
 +
|39024
 +
|string
 +
|name
 +
|current
 +
|-
 +
|BGP_COMMUNITY
 +
|39025
 +
|unsigned32
 +
|name
 +
|current
 +
|-
 +
|BGP_PREPEND
 +
|39026
 +
|unsigned8
 +
|quantity
 +
|current
 +
|-
 +
|ENTRANCE_DOWNGRADE
 +
|39027
 +
|unsigned8
 +
|quantity
 +
|current
 +
|-
 +
|DISCARD_ROLLUP_COUNT
 +
|39028
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|servicesPfrClassTagId
 +
|39029
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|servicesPfrMcId
 +
|39030
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|USER_ID
 +
|40000
 +
|string
 +
|name
 +
|private
 +
|-
 +
|translatedSrcAddr
 +
|40001
 +
|unsigned32
 +
|ipv4Address
 +
|private
 +
|-
 +
|translatedDstAddr
 +
|40002
 +
|unsigned32
 +
|ipv4Address
 +
|private
 +
|-
 +
|translatedSrcPort
 +
|40003
 +
|unsigned16
 +
|identifier
 +
|private
 +
|-
 +
|translatedDstPort
 +
|40004
 +
|unsigned16
 +
|identifier
 +
|private
 +
|-
 +
|translatedDstPort
 +
|40005
 +
|unsigned16
 +
|identifier
 +
|deprecated
 +
|-
 +
|policymapHierarchy
 +
|41000
 +
|[TBD] N*4bytes
 +
|identifier
 +
|future
 +
|-
 +
|classID
 +
|41001
 +
|unsigned32
 +
|identifier
 +
|future
 +
|-
 +
|className
 +
|41002
 +
|string
 +
|name
 +
|future
 +
|-
 +
|classTypeName
 +
|41003
 +
|string
 +
|name
 +
|future
 +
|-
 +
|policyID
 +
|41004
 +
|unsigned32
 +
|identifier
 +
|future
 +
|-
 +
|policyName
 +
|41005
 +
|string
 +
|name
 +
|future
 +
|-
 +
|policyTypeName
 +
|41006
 +
|string
 +
|name
 +
|future
 +
|-
 +
|DCMdataGroupName
 +
|41100
 +
|TBD
 +
|name
 +
|private
 +
|-
 +
|inputFEXnodeID
 +
|41101
 +
|TBD
 +
|identifier
 +
|private
 +
|-
 +
|outputFEXnodeID
 +
|41102
 +
|TBD
 +
|identifier
 +
|private
 +
|-
 +
|portPower
 +
|41103
 +
|Unsigned32
 +
|quantity
 +
|private
 +
|-
 +
|deviceType
 +
|41104
 +
|Unsigned32
 +
|identifier
 +
|private
 +
|-
 +
|namDataSrc
 +
|42001
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|srcSite
 +
|42002
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|dstSite
 +
|42003
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|serverSite
 +
|42004
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|clientSite
 +
|42005
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|Unused
 +
|42006
 +
|
 +
|
 +
|current
 +
|-
 +
|serverIPv4Address
 +
|42007
 +
|ipv4Address
 +
|ipv4Address
 +
|current
 +
|-
 +
|clientIPv4Address
 +
|42008
 +
|ipv4Address
 +
|ipv4Address
 +
|current
 +
|-
 +
|Unused
 +
|42009
 +
|
 +
|
 +
|current
 +
|-
 +
|netEncap
 +
|42010
 +
|unsigned32
 +
|default
 +
|current
 +
|-
 +
|serverIPv6Address
 +
|42011
 +
|ipv6Address
 +
|ipv6Address
 +
|current
 +
|-
 +
|clientIPv6Address
 +
|42012
 +
|ipv6Address
 +
|ipv6Address
 +
|current
 +
|-
 +
|namSrcDeviceId
 +
|42013
 +
|unsigned32
 +
|identifier
 +
|current
 +
|-
 +
|namSrcDeviceIPv4Address
 +
|42014
 +
|ipv4Address
 +
|ipv4Address
 +
|current
 +
|-
 +
|namSrcDeviceIPv6Address
 +
|42015
 +
|ipv6Address
 +
|ipv6Address
 +
|current
 +
|-
 +
|siteName
 +
|42016
 +
|string
 +
|name
 +
|current
 +
|-
 +
|siteDescription
 +
|42017
 +
|string
 +
|name
 +
|current
 +
|-
 +
|unused
 +
|42018
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42019
 +
|
 +
|
 +
|current
 +
|-
 +
|waasOptimizationSegment
 +
|42020
 +
|unsigned8
 +
|default
 +
|current
 +
|-
 +
|waasPassThroughReason
 +
|42021
 +
|unsigned8
 +
|flags
 +
|current
 +
|-
 +
|unused
 +
|42022
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42023
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42024
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42025
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42026
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42027
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42028
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42029
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42030
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42031
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42032
 +
|
 +
|
 +
|current
 +
|-
 +
|initiatorPackets
 +
|42033
 +
|unsigned64
 +
|totalCounter
 +
|current
 +
|-
 +
|responderPackets
 +
|42034
 +
|unsigned64
 +
|totalCounter
 +
|current
 +
|-
 +
|retransOctets
 +
|42035
 +
|unsigned32
 +
|deltaCounter
 +
|current
 +
|-
 +
|retransPackets
 +
|42036
 +
|unsigned32
 +
|deltaCounter
 +
|current
 +
|-
 +
|unused
 +
|42037
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42038
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42039
 +
|
 +
|
 +
|current
 +
|-
 +
|transactionCountDelta
 +
|42040
 +
|unsigned32
 +
|deltaCounter
 +
|current
 +
|-
 +
|sumTransactionTime
 +
|42041
 +
|unsigned32
 +
|totalCounter
 +
|current
 +
|-
 +
|maxTransactionTime
 +
|42042
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minTransactionTime
 +
|42043
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumDataTransmissionTime
 +
|42044
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumDataRetransmissionTime
 +
|42045
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42046
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42047
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42048
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42049
 +
|
 +
|
 +
|current
 +
|-
 +
|newConnectionsCountDelta
 +
|42050
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|completedConnectionsCountDelta
 +
|42051
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|refusedConnectionsCountDelta
 +
|42052
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unrespConnectionsCountDelta
 +
|42053
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumSessionDuration
 +
|42054
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42055
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42056
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42057
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42058
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42059
 +
|
 +
|
 +
|current
 +
|-
 +
|numRespsCountDelta
 +
|42060
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps1CountDelta
 +
|42061
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps2CountDelta
 +
|42062
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps3CountDelta
 +
|42063
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps4CountDelta
 +
|42064
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps5CountDelta
 +
|42065
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps6CountDelta
 +
|42066
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numResps7CountDelta
 +
|42067
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numLateRespsCountDelta
 +
|42068
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42069
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42070
 +
|
 +
|
 +
|current
 +
|-
 +
|sumRespTime
 +
|42071
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|maxRespTime
 +
|42072
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minRespTime
 +
|42073
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumServerRespTime
 +
|42074
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|maxServerRespTime
 +
|42075
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minServerRespTime
 +
|42076
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumTotalRespTime
 +
|42077
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|maxTotalRespTime
 +
|42078
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minTotalRespTime
 +
|42079
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42080
 +
|
 +
|quantity
 +
|current
 +
|-
 +
|sumNwkTime
 +
|42081
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|maxNwkTime
 +
|42082
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minNwkTime
 +
|42083
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumClientNwkTime
 +
|42084
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|maxClientNwkTime
 +
|42085
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minClientNwkTime
 +
|42086
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|sumServerNwkTime
 +
|42087
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|maxServerNwkTime
 +
|42088
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|minServerNwkTime
 +
|42089
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numRoundtripsDeltaCount
 +
|42090
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|numRoundtripsDeltaCount
 +
|42091
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42092
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42093
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42094
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42095
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42096
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42097
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42098
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42099
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42100
 +
|
 +
|
 +
|current
 +
|-
 +
|rtpSsrc
 +
|42101
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|rtpPayloadType
 +
|42102
 +
|unsigned8
 +
|quantity
 +
|current
 +
|-
 +
|rtpCodec
 +
|42103
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42104
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42105
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42106
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42107
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42108
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42109
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42110
 +
|
 +
|
 +
|current
 +
|-
 +
|unused
 +
|42111
 +
|
 +
|
 +
|current
 +
|-
 +
|rtpDuration
 +
|42112
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|rtpAvgMos100
 +
|42113
 +
|unsigned32
 +
|quantity
 +
|current
 +
|-
 +
|unused
 +
|42114
 +
|
 +
|
 +
|current
|-
|-
-
| maxTotalRespTime
+
|rtpWorstMos100
-
| 42078
+
|42115
-
| 4
+
|unsigned32
-
| Maximal total response time in msec
+
|quantity
 +
|current
|-
|-
-
| minTotalRespTime
+
|rtpActualPacketLoss
-
| 42079
+
|42116
-
| 4
+
|unsigned32
-
| Minimal total response time in msec
+
|quantity
 +
|current
|-
|-
-
| Unused
+
|rtpAdjPacketLoss
-
| 42080
+
|42117
-
| N/A
+
|unsigned32
-
| Unused.
+
|quantity
 +
|current
|-
|-
-
| sumNwkTime
+
|rtpJitter100
-
| 42081
+
|42118
-
| 4
+
|unsigned32
-
| Sum of network delay times in msec. 
+
|quantity
-
Divide by newConnectionsCountDelta for AVG
+
|current
|-
|-
-
| maxNwkTime
+
|rtpSoc
-
| 42082
+
|42119
-
| 4
+
|unsigned32
-
| Maximal network time in msec
+
|quantity
 +
|current
|-
|-
-
| minNwkTime
+
|rtpSsc
-
| 42083
+
|42120
-
| 4
+
|unsigned32
-
| Minimal network time in msec
+
|quantity
 +
|current
|-
|-
-
| sumClientNwkTime
+
|rtpMaxPktLoss
-
| 42084
+
|42121
-
| 4
+
|unsigned32
-
| Sum of client network times in msec. 
+
|quantity
-
Divide by newConnectionsCountDelta for AVG
+
|current
|-
|-
-
| maxClientNwkTime
+
|rtpPktToJitter100
-
| 42085
+
|42122
-
| 4
+
|unsigned32
-
| Maximal client network time in msec
+
|quantity
 +
|current
|-
|-
-
| minClientNwkTime
+
|rtpMosQuality
-
| 42086
+
|42123
-
| 4
+
|unsigned32
-
| Minimal client network time in msec
+
|quantity
 +
|current
|-
|-
-
| sumServerNwkTime
+
|rtpConnCountTotal
-
| 42087
+
|42124
-
| 4
+
|unsigned32
-
| Sum of server network times in msec. 
+
|quantity
-
Divide by newConnectionsCountDelta for AVG
+
|current
|-
|-
-
| maxServerNwkTime
+
|httpUriHits
-
| 42088
+
|42125
-
| 4
+
|string
-
| Minimal server network time in msec
+
|name
 +
|current
|-
|-
-
| minServerNwkTime
+
|packetIntervalTimeHistogram
-
| 42089
+
|42126
-
| 4
+
|unsigned64 * N
-
| Maximal server network time in msec
+
|quantity
 +
|current
|-
|-
-
| numRoundtripsDeltaCount
+
|packetIntervalTimeHistogramRevers
-
| 42090
+
|42127
-
| 4
+
|unsigned64 * N
-
| Number of ACK ‘d roundtrips
+
|quantity
 +
|current
|-
|-
-
| sumRoundtripTime
+
|queueIndex
-
| 42091
+
|42128
-
| 4
+
|unsigned32
-
| Total ACK round trip time.
+
|identifier
-
Divide by numRoundtripsDeltaCount for AVG
+
|current
|-
|-
-
| Unused
+
|queueDrops
-
| 42092 to 42100
+
|42129
-
| N/A
+
|unsigned64
-
| Unused
+
|quantity
 +
|current
|-
|-
-
| rtpSsrc
+
|L2L3SwitchEvent
-
| 42101
+
|43000
-
| 4
+
|unsigned8
-
| RTP stream unique id given by sensor
+
|identifier
 +
|private
|-
|-
-
| rtpPayloadType
+
|L2L3SwitchEventDesc
-
| 42102
+
|43001
-
| 1
+
|string
-
| RTP stream payload type
+
|description
-
(http://www.iana.org/assignments/rtp-parameters)
+
|private
|-
|-
-
| rtpCodec
+
|L2L3SwitchExtEvent
-
| 42103
+
|43002
-
| 4
+
|unsigned8
-
| RTP stream’s codec enum
+
|identifier
 +
|private
|-
|-
-
| Unused
+
|L2L3SwitchExtEventDesc
-
| 42104 to 42111
+
|43003
-
| N/A
+
|string
-
| Unused
+
|description
 +
|private
|-
|-
-
| rtpDuration
+
|L2L3SwitchACLName
-
| 42112
+
|43004
-
| 4
+
|string
-
| RTP stream’s duration (total) in sec
+
|name
 +
|private
|-
|-
-
| rtpAvgMos100
+
|L2L3SwitchACLType
-
| 42113
+
|43005
-
| 4
+
|unsigned8
-
| Average MOS value x100
+
|type
 +
|private
|-
|-
-
| Unused
+
|L2L3SwitchACLTypeDesc
-
| 42114
+
|43006
-
| N/A
+
|string
-
| Unused
+
|description
 +
|private
|-
|-
-
| rtpWorstMos100
+
|l4rServerIPv4Address
-
| 42115
+
|44000
-
| 4
+
|ipv4Address
-
| Worst MOS value x100 – for every measurement interval (***) the worst MOS score for 3 seconds granularity
+
|ipv4Address
 +
|private
|-
|-
-
| rtpActualPacketLoss
+
|l4rServerTransportPort
-
| 42116
+
|44001
-
| 4
+
|unsigned16
-
| Actual packet loss
+
|identifier
 +
|private
|-
|-
-
| rtpAdjPacketLoss
+
|l4rServerIPv6Address
-
| 42117
+
|44002
-
| 4
+
|ipv6Address
-
| Adjusted packet loss
+
|ipv6Address
 +
|private
|-
|-
-
| rtpJitter100
+
|l4rEvent
-
| 42118
+
|44003
-
| 4
+
|unsigned8
-
| Stream Jitter value x100
+
|identifier
 +
|private
|-
|-
-
| rtpSoc
+
|l4rEventTimestamp
-
| 42119
+
|44004
-
| 4
+
|unsigned32
-
| Seconds of concealment
+
|totalCounter
 +
|private
|-
|-
-
| rtpSsc
+
|category
-
| 42120
+
|45000
-
| 4
+
|TBD
-
| Seconds of severe concealment
+
|identifier
 +
|current
|-
|-
-
| rtpMaxPktLoss
+
|subCategory
-
| 42121
+
|45001
-
| 4
+
|TBD
-
| Maximal consecutive packet loss
+
|identifier
 +
|current
|-
|-
-
| rtpPktToJitter100
+
|applicationGroup
-
| 42122
+
|45002
-
| 4
+
|string
-
| Packet-to-packet jitter measure x100 peak to peak
+
|identifier
-
Interval for two consecutive packets
+
|current
|-
|-
-
| rtpMosQuality
+
|subApplicationValue
-
| 42123
+
|45003
-
| 4
+
|string
-
| MOS quality  – score as integer value 1,2,3,4
+
|identifier
 +
|current
|-
|-
-
| rtpConnCountTotal
+
|initiatorAddressIPv4
-
| 42124
+
|45004
-
| 4
+
|ipv4Address
-
| Total connection count for the RTP stream
+
|ipv4Address
 +
|current
|-
|-
-
| httpUriHits
+
|responderAddressIPv4
-
| 42125
+
|45005
-
| Var-len
+
|ipv4Address
-
| Export URI and URI-Hits (URI:URI-HITS)
+
|ipv4Address
 +
|current
|-
|-
-
| packetIntervalTimeHistogram
+
|initiatorAddressIPv6
-
| 42126
+
|45006
-
| ?
+
|ipv6Address
-
| A histogram of inter-packet-gaps (time between packets in milliseconds) made up of N x uint64_t.
+
|ipv6Address
 +
|current
|-
|-
-
| packetIntervalTimeHistogramRevers
+
|responderAddressIPv6
-
| 42127
+
|45007
-
| Var-len
+
|ipv6Address
-
| A histogram of inter-packet-gaps (time between packets in milliseconds), for packets in the reverse direction, made up of N x uint64_t.
+
|ipv6Address
 +
|current
|-
|-
-
| queueIndex
+
|initiatorTransportPort
-
| 42128
+
|45008
-
| 4
+
|unsigned16
-
| Id of queue upon which packets were placed.
+
|identifier
 +
|current
|-
|-
-
| queueDrops
+
|responderTransportPort
-
| 42129
+
|45009
-
| 8
+
|unsigned16
-
| Number of packet drops on a particular queue.
+
|identifier
 +
|current
|}
|}
-
 
-
<br>
 
-
<br>
 

Revision as of 12:59, 24 September 2012



NetFlow Home Page
Welcome to NetFlow DocWiki.

Cisco IOS NetFlow efficiently provides a key set of services for IP applications, including network traffic accounting, usage-based network billing, network planning, security, Denial of Service monitoring capabilities, and network monitoring. NetFlow provides valuable information about network users and applications, peak usage times, and traffic routing. Cisco invented NetFlow and is the leader in IP traffic flow technology.
NetFlow version 9, the latest Cisco IOS NetFlow innovation, is a flexible and extensible method to record network performance data. It is the basis of a new IETF standard. Cisco is currently working with a number of partners to provide customers with comprehensive solutions for NetFlow-based, planning, monitoring and billing.




!!!!!!!!! DRAFT !!!!!!!!!!!!



Name Identifier Data Type Semantics Status
IN_BYTES 1 unsigned64 quantity current
IN_PKTS 2 unsigned64 quantity current
deltaFlowCount 3 unsigned64 quantity current
protocolIdentifier 4 unsigned8 identifier current
SRC_TOS 5 unsigned8 flags current
TCP_FLAGS 6 unsigned8 flags current
L4_SRC_PORT 7 unsigned16 identifier current
IPV4_SRC_ADDR 8 ipv4Address ipv4Address current
SRC_MASK 9 unsigned8 mask current
INPUT_SNMP 10 unsigned32 identifier current
L4_DST_PORT 11 unsigned16 identifier current
IPV4_DST_ADDR 12 ipv4Address ipv4Address current
DST_MASK 13 unsigned8 mask current
OUTPUT_SNMP 14 unsigned32 identifier current
IPV4_NEXT_HOP 15 ipv4Address ipv4Address current
SRC_AS 16 unsigned16 identifier current
DST_AS 17 unsigned16 identifier current
BGP_IPV4_NEXT_HOP 18 ipv4Address ipv4Address current
MUL_DST_PKTS 19 unsigned64 totalCounter current
MUL_DST_BYTES 20 unsigned64 totalCounter current
LAST_SWITCHED 21 unsigned32 quantity current
FIRST_SWITCHED 22 unsigned32 quantity current
OUT_BYTES 23 unsigned64 totalCounter current
OUT_PKTS 24 unsigned64 totalCounter current
MIN_PKT_LNGTH 25 unsigned64 quantity current
MAX_PKT_LNGTH 26 unsigned64 quantity current
IPV6_SRC_ADDR 27 ipv6Address ipv6Address current
IPV6_DST_ADDR 28 ipv6Address ipv6Address current
IPV6_SRC_MASK 29 unsigned8 mask current
IPV6_DST_MASK 30 unsigned8 mask current
IPV6_FLOW_LABEL 31 unsigned32 identifier current
ICMP_TYPE_CODE 32 unsigned16 identifier current
MUL_IGMP_TYPE 33 unsigned8 identifier current
samplingInterval 34 unsigned32 quantity deprecated
samplingAlgorithm 35 unsigned8 identifier deprecated
engineType 38 unsigned8 identifier deprecated
engineId 39 unsigned8 identifier deprecated
ipv4RouterSc 43 ipv4Address ipv4Address deprecated
samplerId 48 unsigned8 identifier deprecated
samplerMode 49 unsigned8 identifier deprecated
samplerRandomInterval 50 unsigned32 quantity deprecated
classId 51 unsigned8 identifier deprecated
MIN_TTL 52 unsigned8 identifier current
MAX_TTL 53 unsigned8 identifier current
IPV4_IDENT 54 ipv4Address ipv4Address current
DST_TOS 55 unsigned8 ipv4Address current
IN_SRC_MAC 56 macAddress macAddress current
OUT_DST_MAC 57 macAddress macAddress current
SRC_VLAN 58 unsigned16 identifier current
DST_VLAN 59 unsigned16 identifier current
IP_PROTOCOL_VERSION 60 unsigned8 identifier current
DIRECTION 61 unsigned8 identifier current
IPV6_NEXT_HOP 62 ipv6Address ipv6Address current
BGP_IPV6_NEXT_HOP 63 ipv6Address ipv6Address current
IPV6_OPTION_HEADERS 64 unsigned32 current
PACKET_LOSS 65 unsigned32 current
UNREACHABILITY 66 unsigned32 current
LATENCY 67 unsigned32 current
DATA_POINTS 68 unsigned32 current
VARIANCE 69 unsigned32 current
MPLS_LABEL_1 70 unsigned24 current
MPLS_LABEL_2 71 unsigned24 current
MPLS_LABEL_3 72 unsigned24 current
MPLS_LABEL_4 73 unsigned24 current
MPLS_LABEL_5 74 unsigned24 current
MPLS_LABEL_6 75 unsigned24 current
MPLS_LABEL_7 76 unsigned24 current
MPLS_LABEL_8 77 unsigned24 current
MPLS_LABEL_9 78 unsigned24 current
MPLS_LABEL_10 79 unsigned24 current
IN_DST_MAC 80 macAddress macAddress current
OUT_SRC_MAC 81 macAddress macAddress current
IF_NAME 82 string name current
IF_DESC 83 string name current
samplerName 84 string deprecated
IN_PERMANENT_BYTES 85 unsigned64 deprecated
IN_PERMANENT_PKTS 86 unsigned64 deprecated
flagsAndSamplerId 87 unsigned32 Identifier private
FRAGMENT_OFFSET 88 unsigned16 identifier deprecated
forwardingStatus 89 unsigned32 identifier current
MPLS_PAL_RD 90 octetArray identifier current
MPLS_PREFIX_LEN 91 unsigned8 current
srcTrafficIndex 92 unsigned32 identifier current
dstTrafficIndex 93 TBD identifier current
applicationDescription 94 string name current
applicationId 95 octetArray identifier current
applicationName 96 string name current
postipDiffServCodePoint 98 unsigned8 current
replicationFactor 99 unsigned32 current
className 100 string deprecated
classificationEngineID 101 unsigned8 quantity private
layer2packetSectionOffset 102 unsigned16 quantity current
layer2packetSectionSize 103 unsigned16 quantity current
layer2packetSectionData 104 octetArray current
applicationVersionID 105 unsigned32 quantity private
applicationVersionString 106 string quantity private
applicationVendorID 107 unsigned32 quantity private
clockFrequency 108 TBD quantity private
subApplicationName 109 string description private
subApplicationDescr 110 string description private
rangeEnd 111 unsigned64 description current
MIBObjectIdentifierMarker 112 TBD identifier future
MIBInstanceIdentifier 113 TBD identifier future
scTag 32769 unsigned32 identifier current
scTrafficProcessorId 32770 unsigned8 identifier current
scSourceIpSample 32771 unsigned8 identifier current
scDestinationIpSample 32772 unsigned8 identifier current
scFlowContextId 32773 unsigned32 identifier current
scSubscriberId 32774 string64 name current
PolicyID (was scPackageId) 32775 unsigned16 identifier current
scServiceId 32776 unsigned32 identifier current
scProtocolId 32777 unsigned16 identifier current
scSkipppedSessions 32778 unsigned32 quantity current
scInitiatingSide 32779 unsigned8 flags current
scReportTime 32780 unsigned32 quantity current
scTransactionDurationMillisec 32781 unsigned32 quantity current
scTimeFrame 32782 unsigned8 flags current
scSessionUpstreamVolume 32783 unsigned32 quantity current
scSessionDownstreamVolume 32784 unsigned32 quantity current
scProtocolSignature 32785 unsigned32 identifier current
scZoneId 32786 unsigned32 identifier current
scFlavorId 32787 unsigned32 identifier current
scFlowCloseMode 32788 unsigned8 flags current
scAccessString 32789 string name current
scInfoString 32790 string name current
scClientPort 32791 unsigned16 identifier current
scServerPort 32792 unsigned16 identifier current
scSubscriberCounterId 32793 unsigned16 totalCounter current
scServiceUsageCounterId 32794 unsigned16 totalCounter current
scBreachState 32795 unsigned8 flags current
scReason 32796 unsigned8 flags current
scConfiguredDuration 32797 unsigned32 quantity current
scDuration 32798 unsigned32 quantity current
scEndTime 32799 unsigned32 quantity current
scUpstreamVolume 32800 unsigned32 quantity current
scDownstreamVolume 32801 unsigned32 quantity current
scSessions 32802 unsigned16 quantity current
scSeconds 32803 unsigned16 quantity current
scPackageCounterId 32804 unsigned16 identifier current
scGeneratorId 32805 unsigned8 identifier current
scServiceGlobalCounterId 32806 unsigned16 identifier current
scConcurrentSessions 32807 unsigned32 quantity current
scActiveSubscribers 32808 unsigned32 quantity current
scTotalActiveSubscribers 32809 unsigned32 quantity current
linkId 32810 unsigned8 identifier current
scVirtualLinkId 32811 unsigned16 identifier current
scVirtualLinkDirection 32812 unsigned8 identifier current
scAggregationObjectId 32813 unsigned16 identifier current
scVendorId 32814 unsigned32 identifier current
scUpstreamPacketLoss 32815 unsigned16 quantity current
scDownstreamPacketLoss 32816 unsigned16 quantity current
Reserved 32817 future
Reserved 32818 future
scAttackId 32819 unsigned32 identifier current
scAttackIp 32820 ipv4Address ipv4Address current
scAttackOtherIp 32821 ipv4Address ipv4Address current
scAttackPortNumber 32822 unsigned16 identifier current
scAttackType 32823 unsigned32 identifier current
scAttackSide 32824 unsigned8 flags current
scAttackIpProtocol 32825 unsigned8 flags current
scAttacks 32826 unsigned8 flags current
scAttackMaliciousSessions 32827 unsigned32 quantity current
scUserAgent 32828 string64 name current
scHttpUrl 32829 string64 name current
scSipDomain 32830 string64 name current
scSipUserAgent 32831 string64 name current
scFlowStart 32832 unsigned32 quantity current
scFlowType 32833 unsigned8 flags current
scSessionId 32834 unsigned32 identifier current
scUpstreamJitter 32835 unsigned32 quantity current
scDownstreamJitter 32836 unsigned32 quantity current
scUpstreamPayloadType 32837 unsigned8 identifier current
scDownstreamPayloadType 32838 unsigned8 identifier current
scUpstreamAverageJitter 32839 unsigned32 quantity current
scDownstreamAverageJitter 32840 unsigned32 quantity current
scCallDestination 32841 string64 name current
scCallSource 32842 string64 name current
scCallType 32843 unsigned8 flags current
scMediaChannels 32844 unsigned8 quantity current
scBlockReason 32845 unsigned8 flags current
scBlockRdrCount 32846 unsigned32 quantity current
scBlockRdrCount 32847 unsigned8 flags current
IngressACLID 33000 unsigned96 identifier private
EgressACLID 33001 unsigned96 identifier private
fwEventDetailed 33002 unsigned16 description private
FW_EVENT_LEVEL 33003 unsigned8 flag private
FW_EVENT_LEVEL_ID 33004 unsigned32 identifier private
FW_CONFIGURED_VALUE 33005 unsigned32 identifier private
FW_ERM_EXT_EVENT 33006 unsigned16 identifier private
FW_ERM_EXT_EVENT_DESC 33007 string description private
CTS_SRC_GROUP_TAG 34000 unsigned16 description private
CTS_DST_GROUP_TAG 34001 unsigned16 description private
FW_EXT_EVENT 35001 unsigned16 identifier private
FW_SRC_VRF_ID 35002 unsigned32 identifier private
FW_DST_VRF_ID 35003 unsigned32 identifier private
FW_BLACKOUT_SECS 35004 unsigned32 totalCounter private
FW_HALFOPEN_HIGH 35005 unsigned32 totalCounter private
FW_HALFOPEN_RATE 35006 unsigned32 totalCounter private
FW_ZONEPAIR_ID 35007 unsigned32 identifier private
FW_MAX_SESSIONS 35008 unsigned32 totalCounter private
FW_ZONEPAIR_NAME 35009 string name private
FW_EXT_EVENT_DESC 35010 string description private
FW_SUMMARY_PKT_CNT 35011 unsigned32 totalCounter private
FW_HALFOPEN_CNT 35012 unsigned32 totalCounter private
WAAS_DRE_BYTES_INPUT 36000 unsigned64 totalCounter private
WAAS_DRE_BYTES_OUTPUT 36001 unsigned64 totalCounter private
WAAS_LZ_BYTES_INPUT 36002 unsigned64 totalCounter private
WAAS_LZ_BYTES_OUTPUT 36003 unsigned64 totalCounter private
WAAS_ORIGINAL_BYTES 36004 unsigned64 totalCounter private
WAAS_OPTIMISED_BYTES 36005 unsigned64 totalCounter private
WAAS_APPLICATION 36006 unsigned32 identifier private
WAAS_CLASS 36007 unsigned32 identifier private
WAAS_CONNECTION_MODE 36008 unsigned16 identifier private
WAAS_IN_BYTES 36009 unsigned64 totalCounter private
WAAS_OUT_BYTES 36010 unsigned64 totalCounter private
WAAS_IN_PACKETS 36011 unsigned64 totalCounter private
WAAS_OUT_PACKETS 36012 unsigned64 totalCounter private
WAAS_LZ_ENC_AVG_LATENCY 36013 unsigned64 totalCounter private
WAAS_LZ_DEC_AVG_LATENCY 36014 unsigned64 totalCounter private
WAAS_DRE_ENC_AVG_LATENCY 36015 unsigned64 totalCounter private
WAAS_DRE_DEC_AVG_LATENCY 36016 unsigned64 totalCounter private
CNT_PKTS_DROP 37000 unsigned64 totalCounter current
CNT_PKTS_DROP_PERM 37001 unsigned64 totalCounter current
CNT_PKTS_RATE 37002 unsigned32 totalCounter current
CNT_BYTE_RATE 37003 unsigned32 totalCounter current
MEDIA_CNT_BYTES 37004 unsigned64 totalCounter current
MEDIA_CNT_BYTES_PERM 37005 unsigned64 totalCounter current
MEDIA_BYTE_RATE 37006 unsigned64 quantity current
MEDIA_CNT_PKTS 37007 unsigned64 deltaCounter current
MEDIA_CNT_PKTS_PERM 37008 unsigned64 totalCounter current
MEDIA_PKTS_RATE 37009 unsigned32 totalCounter current
MEDIA_PKTS_RATE_VAR 37010 unsigned32 totalCounter current
MEDIA_EVENT 37011 unsigned8 flags current
[TBD] 37012 unsigned8 flags current
monitorStartTime 37013 unsigned64 [TBD] quantity current
TRANS_PKTS_EXPECT 37014 unsigned64 totalCounter current
TRANS_PKTS_EXPECT_PERM 37015 unsigned64 totalCounter current
TRANS_RTT 37016 unsigned32 quantity current
TRANS_EVENT_PKT_LOST_CNT 37017 unsigned32 totalCounter current
AVG_SEQ_DISC_LEN 37018 unsigned32 quantity current
TRANS_PKTS_LOST 37019 unsigned64 deltaCounter current
TRANS_PKTS_LOST_PERM 37020 unsigned64 totalCounter current
TRANS_PKTS_LOST_RATE 37021 unsigned32 totalCounter current
RTP_SSRC 37022 unsigned32 identifier current
RTP_JITTER 37023 unsigned32 quantity current
RTP_JITTER_MIN 37024 unsigned32 quantity current
RTP_JITTER_MAX 37025 unsigned32 quantity current
counterFlow 37026 unsigned32 totalCounter current
MISC_UNSUPPORTED 37027 unsigned16 quantity current
CNT_BYTES_RATE_FLOW 37028 unsigned32 totalCounter current
CNT_BYTES_RATE_FLOW_MIN 37029 unsigned32 totalCounter current
CNT_BYTES_RATE_FLOW_MAX 37030 unsigned32 totalCounter current
CNT_PKTS_RATE_FLOW 37031 unsigned32 totalCounter current
CNT_PKTS_RATE_FLOW_MIN 37032 unsigned32 totalCounter current
CNT_PKTS_RATE_FLOW_MAX 37033 unsigned32 totalCounter current
applicationMediaBytesRatePerFlow 37034 unsigned32 totalCounter current
applicationMediaBytesRatePerFlowMin 37035 unsigned32 totalCounter current
applicationMediaBytesRatePerFlowMax 37036 unsigned32 totalCounter current
RTP_SEQ_CYCLE_COUNT 37037 unsigned32 quantity current
application media packets rate variation min 37038 unsigned32 quantity current
application media packets rate variation max 37039 unsigned32 quantity current
transport rtp flow count 37040 unsigned32 quantity current
transport rtp payload type 37041 unsigned8 flags current
transport packets lost counter min 37042 unsigned32 totalCounter current
transport packets lost counter max 37043 unsigned32 totalCounter current
transport event packet-loss counter min 37044 unsigned32 totalCounter current
transport event packet-loss counter max 37045 unsigned32 totalCounter current
RTP_SEQ_RESYNC_COUNT 37046 unsigned32 quantity current
transport packets lost rate min 37047 unsigned32 quantity current
transport packets lost rate max 37048 unsigned32 quantity current
transport tcp flow count 37049 unsigned32 totalCounter current
transport round-trip-time sum 37050 unsigned64 quantity current
transport round-trip-time samples 37051 unsigned32 quantity current
transport round-trip-time min 37052 unsigned32 quantity current
transport round-trip-time max 37053 unsigned32 quantity current
Global session ID 37054 string24 name current
Multi-party-session ID 37055 string16 name current
Clock frequency 37056 unsigned32 quantity current
monitor end time 37057 unsigned32 quantity deprecated
Transport packets out-of-ordered counter 37058 unsigned32 quantity current
SERVER_RESPONSE_TIME_AVG 37059 unsigned32 quantity current
REFUSED_SESSION 37060 unsigned32 quantity current
CLIENT_NETWORK_DELAY_AVG 37061 unsigned32 quantity current
SERVER_NETWORK_DELAY_AVG 37062 unsigned32 quantity current
NETWORK_DELAY_AVG 37063 unsigned32 quantity current
APPLICATION_DELAY_AVG 37064 unsigned32 quantity current
SESSION_TIME_MIN 37065 unsigned32 quantity current
SESSION_TIME_MAX 37066 unsigned32 quantity current
SESSION_TIME_AVG 37067 unsigned32 quantity current
TRANSACTION_TIME_AVG 37068 unsigned32 quantity current
CLOSED_SESSIONS 37069 unsigned32 quantity current
RETRANSMISSION 37070 unsigned32 quantity current
OUTOFORDER_BYTES 37071 unsigned64 quantity current
CLIENT_THROUGHPUT_AVG 37072 unsigned32 quantity current
UNRESPONSIVE_SESSION 37073 unsigned32 quantity current
OUTOFORDER_PACKETS 37074 unsigned32 quantity current
V4_SRC_OBSERVATION_NODE 37075 ipv4Address ipv4Address current
V4_DST_OBSERVATION_NODE 37076 ipv4Address ipv4Address current
V6_SRC_OBSERVATION_NODE 37077 ipv6Address ipv6Address current
V6_DST_OBSERVATION_NODE 37078 ipv6Address ipv6Address current
ONE_WAY_DELAY_SUM 37079 unsigned64 quantity current
ONE_WAY_DELAY_SAMPLES 37080 unsigned32 quantity current
ONE_WAY_DELAY 37081 unsigned32 quantity current
PACKET_ARRIVAL_TIMESTAMP 37082 unsigned64 quantity current
TCP_WINDOW_SIZE_MIN 37083 unsigned32 quantity current
TCP_WINDOW_SIZE_MAX 37084 unsigned32 quantity current
TCP_WINDOW_SIZE_AVG 37085 unsigned32 quantity current
TCP_MAXIMUM_SEGMENT_SIZE 37086 unsigned16 quantity current
RTP_INVALLID_SEQ_COUNT 37087 unsigned32 quantity current
LOW_UNAVAILABILITY_MILLISECONDS 37088 unsigned32 quantity current
MID_PID 37089 unsigned16 quantity current
METRIC_TYPE 37090 unsigned8 quantity current
TCP_WINDOW_SIZE_SUM 37091 unsigned64 quantity current
TIME_INTERVAL_END 37092 unsigned64 quantity current
RTP_JITTER_MEAN_SUM 37093 unsigned64 quantity current
MEDIA_CNT_PKTS_RATE_VAR_SUM 37094 unsigned64 quantity current
TCP_WINDOW_SIZE_AVG_SUM 37095 unsigned32 quantity current
vqmMostRecentResolutionWidth 37500 unsigned16 totalCounter current
vdsDisplayProtocol 38000 unsigned16 totalCounter current
IPV4_BR_ADDR 39000 ipv4Address ipv4Address current
PFR_STATUS 39001 unsigned16 ipv4Address current
REASON_ID 39002 unsigned32 flags current
Threshold 39003 unsigned32 flags current
Priority 39004 unsigned16 quantity current
shortTermRTT 39005 unsigned32 quantity current
longTermRTT 39006 unsigned32 quantity current
BelowMOSPercentage 39007 unsigned32 quantity current
RSVPBandWidthPool 39008 unsigned64 quantity current
RollupCounter 39009 unsigned16 quantity current
BandWidthPercentage 39010 unsigned16 quantity current
BandWidthFee 39011 unsigned32 quantity current
L4_SRC_PORT_MIN 39012 unsigned16 quantity current
L4_SRC_PORT_MAX 39013 unsigned16 quantity current
L4_DST_PORT_MIN 39014 unsigned16 quantity current
L4_DST_PORT_MAX 39015 unsigned16 quantity current
CAPACITY 39016 unsigned64 quantity current
INGRESS_BW 39017 unsigned64 quantity current
MAX_INGRESS_BW 39018 unsigned64 quantity current
EGRESS_BW 39019 unsigned64 quantity current
MAX_EGRESS_BW 39020 unsigned64 quantity current
INGRESS_ROLLUP_BW 39021 unsigned64 quantity current
EGRESS_ROLLUP_BW 39022 unsigned64 quantity current
KTH_ROLLUP_BW 39023 unsigned64 quantity current
LINK_GROUP_NAME 39024 string name current
BGP_COMMUNITY 39025 unsigned32 name current
BGP_PREPEND 39026 unsigned8 quantity current
ENTRANCE_DOWNGRADE 39027 unsigned8 quantity current
DISCARD_ROLLUP_COUNT 39028 unsigned32 quantity current
servicesPfrClassTagId 39029 unsigned32 identifier current
servicesPfrMcId 39030 unsigned32 identifier current
USER_ID 40000 string name private
translatedSrcAddr 40001 unsigned32 ipv4Address private
translatedDstAddr 40002 unsigned32 ipv4Address private
translatedSrcPort 40003 unsigned16 identifier private
translatedDstPort 40004 unsigned16 identifier private
translatedDstPort 40005 unsigned16 identifier deprecated
policymapHierarchy 41000 [TBD] N*4bytes identifier future
classID 41001 unsigned32 identifier future
className 41002 string name future
classTypeName 41003 string name future
policyID 41004 unsigned32 identifier future
policyName 41005 string name future
policyTypeName 41006 string name future
DCMdataGroupName 41100 TBD name private
inputFEXnodeID 41101 TBD identifier private
outputFEXnodeID 41102 TBD identifier private
portPower 41103 Unsigned32 quantity private
deviceType 41104 Unsigned32 identifier private
namDataSrc 42001 unsigned32 identifier current
srcSite 42002 unsigned32 identifier current
dstSite 42003 unsigned32 identifier current
serverSite 42004 unsigned32 identifier current
clientSite 42005 unsigned32 identifier current
Unused 42006 current
serverIPv4Address 42007 ipv4Address ipv4Address current
clientIPv4Address 42008 ipv4Address ipv4Address current
Unused 42009 current
netEncap 42010 unsigned32 default current
serverIPv6Address 42011 ipv6Address ipv6Address current
clientIPv6Address 42012 ipv6Address ipv6Address current
namSrcDeviceId 42013 unsigned32 identifier current
namSrcDeviceIPv4Address 42014 ipv4Address ipv4Address current
namSrcDeviceIPv6Address 42015 ipv6Address ipv6Address current
siteName 42016 string name current
siteDescription 42017 string name current
unused 42018 current
unused 42019 current
waasOptimizationSegment 42020 unsigned8 default current
waasPassThroughReason 42021 unsigned8 flags current
unused 42022 current
unused 42023 current
unused 42024 current
unused 42025 current
unused 42026 current
unused 42027 current
unused 42028 current
unused 42029 current
unused 42030 current
unused 42031 current
unused 42032 current
initiatorPackets 42033 unsigned64 totalCounter current
responderPackets 42034 unsigned64 totalCounter current
retransOctets 42035 unsigned32 deltaCounter current
retransPackets 42036 unsigned32 deltaCounter current
unused 42037 current
unused 42038 current
unused 42039 current
transactionCountDelta 42040 unsigned32 deltaCounter current
sumTransactionTime 42041 unsigned32 totalCounter current
maxTransactionTime 42042 unsigned32 quantity current
minTransactionTime 42043 unsigned32 quantity current
sumDataTransmissionTime 42044 unsigned32 quantity current
sumDataRetransmissionTime 42045 unsigned32 quantity current
unused 42046 current
unused 42047 current
unused 42048 current
unused 42049 current
newConnectionsCountDelta 42050 unsigned32 quantity current
completedConnectionsCountDelta 42051 unsigned32 quantity current
refusedConnectionsCountDelta 42052 unsigned32 quantity current
unrespConnectionsCountDelta 42053 unsigned32 quantity current
sumSessionDuration 42054 unsigned32 quantity current
unused 42055 current
unused 42056 current
unused 42057 current
unused 42058 current
unused 42059 current
numRespsCountDelta 42060 unsigned32 quantity current
numResps1CountDelta 42061 unsigned32 quantity current
numResps2CountDelta 42062 unsigned32 quantity current
numResps3CountDelta 42063 unsigned32 quantity current
numResps4CountDelta 42064 unsigned32 quantity current
numResps5CountDelta 42065 unsigned32 quantity current
numResps6CountDelta 42066 unsigned32 quantity current
numResps7CountDelta 42067 unsigned32 quantity current
numLateRespsCountDelta 42068 unsigned32 quantity current
unused 42069 current
unused 42070 current
sumRespTime 42071 unsigned32 quantity current
maxRespTime 42072 unsigned32 quantity current
minRespTime 42073 unsigned32 quantity current
sumServerRespTime 42074 unsigned32 quantity current
maxServerRespTime 42075 unsigned32 quantity current
minServerRespTime 42076 unsigned32 quantity current
sumTotalRespTime 42077 unsigned32 quantity current
maxTotalRespTime 42078 unsigned32 quantity current
minTotalRespTime 42079 unsigned32 quantity current
unused 42080 quantity current
sumNwkTime 42081 unsigned32 quantity current
maxNwkTime 42082 unsigned32 quantity current
minNwkTime 42083 unsigned32 quantity current
sumClientNwkTime 42084 unsigned32 quantity current
maxClientNwkTime 42085 unsigned32 quantity current
minClientNwkTime 42086 unsigned32 quantity current
sumServerNwkTime 42087 unsigned32 quantity current
maxServerNwkTime 42088 unsigned32 quantity current
minServerNwkTime 42089 unsigned32 quantity current
numRoundtripsDeltaCount 42090 unsigned32 quantity current
numRoundtripsDeltaCount 42091 unsigned32 quantity current
unused 42092 current
unused 42093 current
unused 42094 current
unused 42095 current
unused 42096 current
unused 42097 current
unused 42098 current
unused 42099 current
unused 42100 current
rtpSsrc 42101 unsigned32 quantity current
rtpPayloadType 42102 unsigned8 quantity current
rtpCodec 42103 unsigned32 quantity current
unused 42104 current
unused 42105 current
unused 42106 current
unused 42107 current
unused 42108 current
unused 42109 current
unused 42110 current
unused 42111 current
rtpDuration 42112 unsigned32 quantity current
rtpAvgMos100 42113 unsigned32 quantity current
unused 42114 current
rtpWorstMos100 42115 unsigned32 quantity current
rtpActualPacketLoss 42116 unsigned32 quantity current
rtpAdjPacketLoss 42117 unsigned32 quantity current
rtpJitter100 42118 unsigned32 quantity current
rtpSoc 42119 unsigned32 quantity current
rtpSsc 42120 unsigned32 quantity current
rtpMaxPktLoss 42121 unsigned32 quantity current
rtpPktToJitter100 42122 unsigned32 quantity current
rtpMosQuality 42123 unsigned32 quantity current
rtpConnCountTotal 42124 unsigned32 quantity current
httpUriHits 42125 string name current
packetIntervalTimeHistogram 42126 unsigned64 * N quantity current
packetIntervalTimeHistogramRevers 42127 unsigned64 * N quantity current
queueIndex 42128 unsigned32 identifier current
queueDrops 42129 unsigned64 quantity current
L2L3SwitchEvent 43000 unsigned8 identifier private
L2L3SwitchEventDesc 43001 string description private
L2L3SwitchExtEvent 43002 unsigned8 identifier private
L2L3SwitchExtEventDesc 43003 string description private
L2L3SwitchACLName 43004 string name private
L2L3SwitchACLType 43005 unsigned8 type private
L2L3SwitchACLTypeDesc 43006 string description private
l4rServerIPv4Address 44000 ipv4Address ipv4Address private
l4rServerTransportPort 44001 unsigned16 identifier private
l4rServerIPv6Address 44002 ipv6Address ipv6Address private
l4rEvent 44003 unsigned8 identifier private
l4rEventTimestamp 44004 unsigned32 totalCounter private
category 45000 TBD identifier current
subCategory 45001 TBD identifier current
applicationGroup 45002 string identifier current
subApplicationValue 45003 string identifier current
initiatorAddressIPv4 45004 ipv4Address ipv4Address current
responderAddressIPv4 45005 ipv4Address ipv4Address current
initiatorAddressIPv6 45006 ipv6Address ipv6Address current
responderAddressIPv6 45007 ipv6Address ipv6Address current
initiatorTransportPort 45008 unsigned16 identifier current
responderTransportPort 45009 unsigned16 identifier current

Rating: 1.0/5 (1 vote cast)

Retrieved from "http://docwiki.cisco.com/wiki/NetFlow"
Personal tools