NetFlow IEs
The Apstra Flow Data Center Director collector supports Netflow v1, v5, v6, v7 and v9 flow records.
NetFlow v1
The collector supports the following Netflow v1 information elements (IEs):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- prot
- tos
- tcp_flags
NetFlow v5
The collector supports the following Netflow v5 information elements (IE):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- tcp_flags
- prot
- tos
- src_as
- dst_as
- src_mask
- dst_mask
NetFlow v6
The collector supports the following Netflow v6 information elements (IE):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- tcp_flags
- prot
- tos
- src_as
- dst_as
- src_mask
- dst_mask
NetFlow v7
The collector supports the following Netflow v7 information elements (IE):
- srcaddr
- dstaddr
- nexthop
- input
- output
- dPkts
- dOctets
- First
- Last
- srcport
- dstport
- tcp_flags
- prot
- tos
- src_as
- dst_as
- src_mask
- dst_mask
- ipv4RouterSc
NetFlow v9
NetFlow v9 supports the following standards-based IEs (PEN: 0):
| ID | Name |
|---|---|
| 1 | octetDeltaCount |
| 2 | packetDeltaCount |
| 3 | deltaFlowCount |
| 4 | protocolIdentifier |
| 5 | ipClassOfService |
| 6 | tcpControlBits |
| 7 | sourceTransportPort |
| 8 | sourceIPv4Address |
| 9 | sourceIPv4PrefixLength |
| 10 | ingressInterface |
| 11 | destinationTransportPort |
| 12 | destinationIPv4Address |
| 13 | destinationIPv4PrefixLength |
| 14 | egressInterface |
| 15 | ipNextHopIPv4Address |
| 16 | bgpSourceAsNumber |
| 17 | bgpDestinationAsNumber |
| 18 | bgpNextHopIPv4Address |
| 19 | postMCastPacketDeltaCount |
| 20 | postMCastOctetDeltaCount |
| 21 | flowEndSysUpTime |
| 22 | flowStartSysUpTime |
| 23 | postOctetDeltaCount |
| 24 | postPacketDeltaCount |
| 25 | minimumIpTotalLength |
| 26 | maximumIpTotalLength |
| 27 | sourceIPv6Address |
| 28 | destinationIPv6Address |
| 29 | sourceIPv6PrefixLength |
| 30 | destinationIPv6PrefixLength |
| 31 | flowLabelIPv6 |
| 32 | icmpTypeCodeIPv4 |
| 33 | igmpType |
| 34 | samplingInterval |
| 35 | samplingAlgorithm |
| 36 | flowActiveTimeout |
| 37 | flowIdleTimeout |
| 38 | engineType |
| 39 | engineId |
| 40 | exportedOctetTotalCount |
| 41 | exportedMessageTotalCount |
| 42 | exportedFlowRecordTotalCount |
| 44 | sourceIPv4Prefix |
| 45 | destinationIPv4Prefix |
| 46 | mplsTopLabelType |
| 47 | mplsTopLabelIPv4Address |
| 48 | samplerId |
| 49 | samplerMode |
| 50 | samplerRandomInterval |
| 51 | classId |
| 52 | minimumTTL |
| 53 | maximumTTL |
| 54 | fragmentIdentification |
| 55 | postIpClassOfService |
| 56 | sourceMacAddress |
| 57 | postDestinationMacAddress |
| 58 | vlanId |
| 59 | postVlanId |
| 60 | ipVersion |
| 61 | flowDirection |
| 62 | ipNextHopIPv6Address |
| 63 | bgpNextHopIPv6Address |
| 64 | ipv6ExtensionHeaders |
| 65 | transportPacketLoss Cisco Legacy |
| 66 | transportUnreachability Cisco Legacy |
| 67 | transportLatency Cisco Legacy |
| 68 | dataPoints Cisco Legacy |
| 69 | variance Cisco Legacy |
| 70 | mplsTopLabelStackSection |
| 71 | mplsLabelStackSection2 |
| 72 | mplsLabelStackSection3 |
| 73 | mplsLabelStackSection4 |
| 74 | mplsLabelStackSection5 |
| 75 | mplsLabelStackSection6 |
| 76 | mplsLabelStackSection7 |
| 77 | mplsLabelStackSection8 |
| 78 | mplsLabelStackSection9 |
| 79 | mplsLabelStackSection10 |
| 80 | destinationMacAddress |
| 81 | postSourceMacAddress |
| 82 | interfaceName |
| 83 | interfaceDescription |
| 84 | samplerName |
| 85 | octetTotalCount |
| 86 | packetTotalCount |
| 87 | flagsAndSamplerId |
| 88 | fragmentOffset |
| 89 | forwardingStatus |
| 90 | mplsVpnRouteDistinguisher |
| 91 | mplsTopLabelPrefixLength |
| 92 | srcTrafficIndex |
| 93 | dstTrafficIndex |
| 94 | applicationDescription |
| 95 | applicationId |
| 96 | applicationName |
| 97 | subApplicationTag Cisco Legacy |
| 98 | postIpDiffServCodePoint |
| 99 | multicastReplicationFactor |
| 100 | className |
| 101 | classificationEngineId |
| 102 | layer2packetSectionOffset |
| 103 | layer2packetSectionSize |
| 104 | layer2packetSectionData |
| 105 | applicationVersion Cisco Legacy |
| 106 | applicationVersionName Cisco Legacy |
| 107 | applicationVendor Cisco Legacy |
| 109 | subApplicationName Cisco Legacy |
| 110 | subApplicationDescription Cisco Legacy |
| 111 | templateParameterRangeEnd Cisco Legacy |
| 128 | bgpNextAdjacentAsNumber |
| 129 | bgpPrevAdjacentAsNumber |
| 130 | exporterIPv4Address |
| 131 | exporterIPv6Address |
| 132 | droppedOctetDeltaCount |
| 133 | droppedPacketDeltaCount |
| 134 | droppedOctetTotalCount |
| 135 | droppedPacketTotalCount |
| 136 | flowEndReason |
| 137 | commonPropertiesId |
| 138 | observationPointId |
| 139 | icmpTypeCodeIPv6 |
| 140 | mplsTopLabelIPv6Address |
| 141 | lineCardId |
| 142 | portId |
| 143 | meteringProcessId |
| 144 | exportingProcessId |
| 145 | templateId |
| 146 | wlanChannelId |
| 147 | wlanSSID |
| 148 | flowId |
| 149 | observationDomainId |
| 150 | flowStartSeconds |
| 151 | flowEndSeconds |
| 152 | flowStartMilliseconds |
| 153 | flowEndMilliseconds |
| 154 | flowStartMicroseconds |
| 155 | flowEndMicroseconds |
| 156 | flowStartNanoseconds |
| 157 | flowEndNanoseconds |
| 158 | flowStartDeltaMicroseconds |
| 159 | flowEndDeltaMicroseconds |
| 160 | systemInitTimeMilliseconds |
| 161 | flowDurationMilliseconds |
| 162 | flowDurationMicroseconds |
| 163 | observedFlowTotalCount |
| 164 | ignoredPacketTotalCount |
| 165 | ignoredOctetTotalCount |
| 166 | notSentFlowTotalCount |
| 167 | notSentPacketTotalCount |
| 168 | notSentOctetTotalCount |
| 169 | destinationIPv6Prefix |
| 170 | sourceIPv6Prefix |
| 171 | postOctetTotalCount |
| 172 | postPacketTotalCount |
| 173 | flowKeyIndicator |
| 174 | postMCastPacketTotalCount |
| 175 | postMCastOctetTotalCount |
| 176 | icmpTypeIPv4 |
| 177 | icmpCodeIPv4 |
| 178 | icmpTypeIPv6 |
| 179 | icmpCodeIPv6 |
| 180 | udpSourcePort |
| 181 | udpDestinationPort |
| 182 | tcpSourcePort |
| 183 | tcpDestinationPort |
| 184 | tcpSequenceNumber |
| 185 | tcpAcknowledgementNumber |
| 186 | tcpWindowSize |
| 187 | tcpUrgentPointer |
| 188 | tcpHeaderLength |
| 189 | ipHeaderLength |
| 190 | totalLengthIPv4 |
| 191 | payloadLengthIPv6 |
| 192 | ipTTL |
| 193 | nextHeaderIPv6 |
| 194 | mplsPayloadLength |
| 195 | ipDiffServCodePoint |
| 196 | ipPrecedence |
| 197 | fragmentFlags |
| 198 | octetDeltaSumOfSquares |
| 199 | octetTotalSumOfSquares |
| 200 | mplsTopLabelTTL |
| 201 | mplsLabelStackLength |
| 202 | mplsLabelStackDepth |
| 203 | mplsTopLabelExp |
| 204 | ipPayloadLength |
| 205 | udpMessageLength |
| 206 | isMulticast |
| 207 | ipv4IHL |
| 208 | ipv4Options |
| 209 | tcpOptions |
| 210 | paddingOctets |
| 211 | collectorIPv4Address |
| 212 | collectorIPv6Address |
| 213 | exportInterface |
| 214 | exportProtocolVersion |
| 215 | exportTransportProtocol |
| 216 | collectorTransportPort |
| 217 | exporterTransportPort |
| 218 | tcpSynTotalCount |
| 219 | tcpFinTotalCount |
| 220 | tcpRstTotalCount |
| 221 | tcpPshTotalCount |
| 222 | tcpAckTotalCount |
| 223 | tcpUrgTotalCount |
| 224 | ipTotalLength |
| 225 | postNATSourceIPv4Address |
| 226 | postNATDestinationIPv4Address |
| 227 | postNAPTSourceTransportPort |
| 228 | postNAPTDestinationTransportPort |
| 229 | natOriginatingAddressRealm |
| 230 | natEvent |
| 231 | initiatorOctets |
| 232 | responderOctets |
| 233 | firewallEvent |
| 234 | ingressVRFID |
| 235 | egressVRFID |
| 236 | VRFname |
| 237 | postMplsTopLabelExp |
| 238 | tcpWindowScale |
| 239 | biflowDirection |
| 240 | ethernetHeaderLength |
| 241 | ethernetPayloadLength |
| 242 | ethernetTotalLength |
| 243 | dot1qVlanId |
| 244 | dot1qPriority |
| 245 | dot1qCustomerVlanId |
| 246 | dot1qCustomerPriority |
| 247 | metroEvcId |
| 248 | metroEvcType |
| 249 | pseudoWireId |
| 250 | pseudoWireType |
| 251 | pseudoWireControlWord |
| 252 | ingressPhysicalInterface |
| 253 | egressPhysicalInterface |
| 254 | postDot1qVlanId |
| 255 | postDot1qCustomerVlanId |
| 256 | ethernetType |
| 257 | postIpPrecedence |
| 258 | collectionTimeMilliseconds |
| 259 | exportSctpStreamId |
| 260 | maxExportSeconds |
| 261 | maxFlowEndSeconds |
| 262 | messageMD5Checksum |
| 263 | messageScope |
| 264 | minExportSeconds |
| 265 | minFlowStartSeconds |
| 266 | opaqueOctets |
| 267 | sessionScope |
| 268 | maxFlowEndMicroseconds |
| 269 | maxFlowEndMilliseconds |
| 270 | maxFlowEndNanoseconds |
| 271 | minFlowStartMicroseconds |
| 272 | minFlowStartMilliseconds |
| 273 | minFlowStartNanoseconds |
| 274 | collectorCertificate |
| 275 | exporterCertificate |
| 276 | dataRecordsReliability |
| 277 | observationPointType |
| 278 | newConnectionDeltaCount |
| 279 | connectionSumDurationSeconds |
| 280 | connectionTransactionId |
| 281 | postNATSourceIPv6Address |
| 282 | postNATDestinationIPv6Address |
| 283 | natPoolId |
| 284 | natPoolName |
| 285 | anonymizationFlags |
| 286 | anonymizationTechnique |
| 287 | informationElementIndex |
| 288 | p2pTechnology |
| 289 | tunnelTechnology |
| 290 | encryptedTechnology |
| 294 | bgpValidityState |
| 295 | IPSecSPI |
| 296 | greKey |
| 297 | natType |
| 298 | initiatorPackets |
| 299 | responderPackets |
| 300 | observationDomainName |
| 301 | selectionSequenceId |
| 302 | selectorId |
| 303 | informationElementId |
| 304 | selectorAlgorithm |
| 305 | samplingPacketInterval |
| 306 | samplingPacketSpace |
| 307 | samplingTimeInterval |
| 308 | samplingTimeSpace |
| 309 | samplingSize |
| 310 | samplingPopulation |
| 311 | samplingProbability |
| 312 | dataLinkFrameSize |
| 313 | ipHeaderPacketSection |
| 314 | ipPayloadPacketSection |
| 315 | dataLinkFrameSection |
| 316 | mplsLabelStackSection |
| 317 | mplsPayloadPacketSection |
| 318 | selectorIdTotalPktsObserved |
| 319 | selectorIdTotalPktsSelected |
| 320 | absoluteError |
| 321 | relativeError |
| 322 | observationTimeSeconds |
| 323 | observationTimeMilliseconds |
| 324 | observationTimeMicroseconds |
| 325 | observationTimeNanoseconds |
| 326 | digestHashValue |
| 327 | hashIPPayloadOffset |
| 328 | hashIPPayloadSize |
| 329 | hashOutputRangeMin |
| 330 | hashOutputRangeMax |
| 331 | hashSelectedRangeMin |
| 332 | hashSelectedRangeMax |
| 333 | hashDigestOutput |
| 334 | hashInitialiserValue |
| 335 | selectorName |
| 336 | upperCILimit |
| 337 | lowerCILimit |
| 338 | confidenceLevel |
| 339 | informationElementDataType |
| 340 | informationElementDescription |
| 341 | informationElementName |
| 342 | informationElementRangeBegin |
| 343 | informationElementRangeEnd |
| 344 | informationElementSemantics |
| 345 | informationElementUnits |
| 346 | privateEnterpriseNumber |
| 347 | virtualStationInterfaceId |
| 348 | virtualStationInterfaceName |
| 349 | virtualStationUUID |
| 350 | virtualStationName |
| 351 | layer2SegmentId |
| 352 | layer2OctetDeltaCount |
| 353 | layer2OctetTotalCount |
| 354 | ingressUnicastPacketTotalCount |
| 355 | ingressMulticastPacketTotalCount |
| 356 | ingressBroadcastPacketTotalCount |
| 357 | egressUnicastPacketTotalCount |
| 358 | egressBroadcastPacketTotalCount |
| 359 | monitoringIntervalStartMilliSeconds |
| 360 | monitoringIntervalEndMilliSeconds |
| 361 | portRangeStart |
| 362 | portRangeEnd |
| 363 | portRangeStepSize |
| 364 | portRangeNumPorts |
| 365 | staMacAddress |
| 366 | staIPv4Address |
| 367 | wtpMacAddress |
| 368 | ingressInterfaceType |
| 369 | egressInterfaceType |
| 370 | rtpSequenceNumber |
| 371 | userName |
| 372 | applicationCategoryName |
| 373 | applicationSubCategoryName |
| 374 | applicationGroupName |
| 375 | originalFlowsPresent |
| 376 | originalFlowsInitiated |
| 377 | originalFlowsCompleted |
| 378 | distinctCountOfSourceIPAddress |
| 379 | distinctCountOfDestinationIPAddress |
| 380 | distinctCountOfSourceIPv4Address |
| 381 | distinctCountOfDestinationIPv4Address |
| 382 | distinctCountOfSourceIPv6Address |
| 383 | distinctCountOfDestinationIPv6Address |
| 384 | valueDistributionMethod |
| 385 | rfc3550JitterMilliseconds |
| 386 | rfc3550JitterMicroseconds |
| 387 | rfc3550JitterNanoseconds |
| 388 | dot1qDEI |
| 389 | dot1qCustomerDEI |
| 390 | flowSelectorAlgorithm |
| 391 | flowSelectedOctetDeltaCount |
| 392 | flowSelectedPacketDeltaCount |
| 393 | flowSelectedFlowDeltaCount |
| 394 | selectorIDTotalFlowsObserved |
| 395 | selectorIDTotalFlowsSelected |
| 396 | samplingFlowInterval |
| 397 | samplingFlowSpacing |
| 398 | flowSamplingTimeInterval |
| 399 | flowSamplingTimeSpacing |
| 400 | hashFlowDomain |
| 401 | transportOctetDeltaCount |
| 402 | transportPacketDeltaCount |
| 403 | originalExporterIPv4Address |
| 404 | originalExporterIPv6Address |
| 405 | originalObservationDomainId |
| 406 | intermediateProcessId |
| 407 | ignoredDataRecordTotalCount |
| 408 | dataLinkFrameType |
| 409 | sectionOffset |
| 410 | sectionExportedOctets |
| 411 | dot1qServiceInstanceTag |
| 412 | dot1qServiceInstanceId |
| 413 | dot1qServiceInstancePriority |
| 414 | dot1qCustomerSourceMacAddress |
| 415 | dot1qCustomerDestinationMacAddress |
| 416 | layer2OctetDeltaCount |
| 417 | postLayer2OctetDeltaCount |
| 418 | postMCastLayer2OctetDeltaCount |
| 419 | layer2OctetTotalCount |
| 420 | postLayer2OctetTotalCount |
| 421 | postMCastLayer2OctetTotalCount |
| 422 | minimumLayer2TotalLength |
| 423 | maximumLayer2TotalLength |
| 424 | droppedLayer2OctetDeltaCount |
| 425 | droppedLayer2OctetTotalCount |
| 426 | ignoredLayer2OctetTotalCount |
| 427 | notSentLayer2OctetTotalCount |
| 428 | layer2OctetDeltaSumOfSquares |
| 429 | layer2OctetTotalSumOfSquares |
| 430 | layer2FrameDeltaCount |
| 431 | layer2FrameTotalCount |
| 432 | pseudoWireDestinationIPv4Address |
| 433 | ignoredLayer2FrameTotalCount |
| 434 | mibObjectValueInteger |
| 435 | mibObjectValueOctetString |
| 436 | mibObjectValueOID |
| 437 | mibObjectValueBits |
| 438 | mibObjectValueIPAddress |
| 439 | mibObjectValueCounter |
| 440 | mibObjectValueGauge |
| 441 | mibObjectValueTimeTicks |
| 442 | mibObjectValueUnsigned |
| 445 | mibObjectIdentifier |
| 446 | mibSubIdentifier |
| 447 | mibIndexIndicator |
| 448 | mibCaptureTimeSemantics |
| 449 | mibContextEngineID |
| 450 | mibContextName |
| 451 | mibObjectName |
| 452 | mibObjectDescription |
| 453 | mibObjectSyntax |
| 454 | mibModuleName |
| 455 | mobileIMSI |
| 456 | mobileMSISDN |
| 457 | httpStatusCode |
| 458 | sourceTransportPortsLimit |
| 459 | httpRequestMethod |
| 460 | httpRequestHost |
| 461 | httpRequestTarget |
| 462 | httpMessageVersion |
| 463 | natInstanceID |
| 464 | internalAddressRealm |
| 465 | externalAddressRealm |
| 466 | natQuotaExceededEvent |
| 467 | natThresholdEvent |
| 468 | httpUserAgent |
| 469 | httpContentType |
| 470 | httpReasonPhrase |
| 471 | maxSessionEntries |
| 472 | maxBIBEntries |
| 473 | maxEntriesPerUser |
| 474 | maxSubscribers |
| 475 | maxFragmentsPendingReassembly |
| 476 | addressPoolHighThreshold |
| 477 | addressPoolLowThreshold |
| 478 | addressPortMappingHighThreshold |
| 479 | addressPortMappingLowThreshold |
| 480 | addressPortMappingPerUserHighThreshold |
| 481 | globalAddressMappingHighThreshold |
| 482 | vpnIdentifier |
| 483 | bgpCommunity |
| 486 | bgpExtendedCommunity |
| 489 | bgpLargeCommunity |
Cisco (Pen: 9)
- scTag
- scTrafficProcessorId
- scSourceIpSample
- scDestinationIpSample
- scFlowContextId
- scSubscriberId
- scPackageId
- scServiceId
- scProtocolId
- scSkipppedSessions
- scInitiatingSide
- scReportTime
- scTransactionDurationMillisec
- scTimeFrame
- scSessionUpstreamVolume
- scSessionDownstreamVolume
- scProtocolSignature
- scZoneId
- scFlavorId
- scFlowCloseMode
- scAccessString
- scInfoString
- scClientPort
- scServerPort
- scSubscriberCounterId
- scServiceUsageCounterId
- scBreachState
- scReason
- scConfiguredDuration
- scDuration
- scEndTime
- scUpstreamVolume
- scDownstreamVolume
- scSessions
- scSeconds
- scPackageCounterId
- scGeneratorId
- scServiceGlobalCounterId
- scConcurrentSessions
- scActiveSubscribers
- scTotalActiveSubscribers
- scLinkId
- scAttackId
- scAttackIp
- scAttackOtherIp
- scAttackPortNumber
- scAttackType
- scAttackSide
- scAttackIpProtocol
- scAttacks
- scAttackMaliciousSessions
- INGRESS_ACL_ID
- EGRESS_ACL_ID
- FW_EXT_EVENT
- FW_EVENT_LEVEL
- FW_EVENT_LEVEL_ID
- FW_CONFIGURED_VALUE
- FW_ERM_EXT_EVENT
- FW_ERM_EXT_EVENT_DESC
- audio rtp packets lost
- audio rtp packets expected
- audio rtp fwd out-of-sequence sum
- audio rtp seconds ok
- audio rtp seconds concealed
- audio rtp seconds concealed severe
- audio rtp jitter ticks
- audio g107 impairment
- audio g107 lossRate
- audio g107 codec baseline
- audio g107 codec baseline bpl
- audio g107 impairment one-way-delay
- audio concealment ratio now
- audio concealment ratio minimum
- audio concealment ratio maximum
- audio concealment time
- audio speech time
- audio packets ok
- audio packets cs
- audio packets scs
- audio packets rtp
- audio packets silence
- audio duration receive
- audio duration receive voice
- audio duration early packet
- audio duration clock adjust
- audio duration playout increase
- audio duration playout decrease
- audio duration late discard
- audio frame size
- audio frames-per-packet
- audio frame arriving times difference
- audio frame arriving times difference vari
- audio noise level current
- audio noise level average
- audio noise level minimum
- audio noise level maximum
- audio noise level configured
- audio snr current
- audio snr average
- audio snr minimum
- audio snr maximum
- audio snr configured
- vxlan sgt
- vxlan flags
- vxlan vtep input
- vxlan vtep output
- SGT_SOURCE_TAG
- SGT_DESTINATION_TAG
- SGT_SOURCE_NAME
- SGT_DESTINATION_NAME
- flow cts switch derived-sgt
- FW_EXT_EVENT
- FW_BLACKOUT_SECS
- FW_HALFOPEN_HIGH
- FW_HALFOPEN_RATE
- FW_ZONEPAIR_ID
- FW_MAX_SESSIONS
- FW_ZONEPAIR_NAME
- FW_EXT_EVENT_DESC
- FW_SUMMARY_PKT_CNT
- FW_HALFOPEN_CNT
- waas dre input
- waas dre output
- waas lz input
- waas lz output
- waas original bytes
- waas optimised bytes
- waas application
- waas class
- waas connection mode
- waas bytes input
- waas bytes output
- PACKETS_DROPPED
- counter packets dropped permanent
- PACKET_RATE
- BYTE_RATE
- application media bytes counter
- application media bytes counter permanent
- application media bytes rate
- application media packets counter
- application media packets counter permanen
- application media packets rate
- application media packets rate variation
- application media event
- monitor event
- timestamp interval
- transport packets expected counter
- transport packets expected counter permane
- transport round-trip-time
- transport event packet-loss counter
- transport event packet-loss counter perman
- transport packets lost counter
- transport packets lost counter permanent
- transport packets lost rate
- transport rtp ssrc
- transport rtp jitter mean
- transport rtp jitter minimum
- transport rtp jitter maximum
- misc unsupported
- counter bytes rate per-flow
- counter bytes rate per-flow min
- counter bytes rate per-flow max
- counter packets rate per-flow
- counter packets rate per-flow min
- counter packets rate per-flow max
- application media bytes rate per-flow
- application media bytes rate per-flow min
- application media bytes rate per-flow max
- application media packets rate variation m
- application media packets rate variation m
- transport rtp flow count
- transport rtp payload-type
- transport packets lost counter min
- transport packets lost counter max
- transport event packet-loss counter min
- transport event packet-loss counter max
- transport packets lost rate min
- transport packets lost rate max
- transport tcp flow count
- transport round-trip-time sum
- transport round-trip-time samples
- transport round-trip-time min
- transport round-trip-time max
- metadata global-session-id
- metadata multi-party-session-id
- metadata clock-rate
- server response time average
- refused sessions
- client network delay average
- server network delay average
- network delay average
- application delay average
- session time minimum
- session time maximum
- session time average
- transaction time average
- closed sessions
- retransmitted packets
- transport bytes out-of-order
- client throughput average
- unresponsive sessions
- transport packets out-of-order
- IPv4 source observation node
- IPv4 destination observation node
- IPv6 source observation node
- IPv6 destination observation node
- pfr one-way-delay sum
- pfr one-way-delay samples
- ONE_WAY_DELAY {pfr one-way-delay
- packet arrival timestamp
- transport tcp window-size minimum
- transport tcp window-size maximum
- transport tcp window-size average
- transport tcp maximum-segment-size
- transport tcp window-size sum
- tcpWindowSizeSum
- transport rtp jitter mean sum
- application media packets rate variation s
- transport tcp window-size average sum
- transport rtp jitter inter arrival sum
- transport rtp jitter inter arrival samples
- transport rtp jitter inter arrival mean
- pfr site source id ipv4
- pfr site destination id ipv4
- transport bytes lost
- transport bytes expected
- transport bytes lost rate
- network delay sum
- network delay sample
- pfr counter event error traffic-class miti
- pfr counter event error traffic-class miti
- pfr counter event error traffic-class miti
- pfr site source prefix ipv4
- pfr site destination prefix ipv4
- pfr site source prefix ipv6
- pfr site destination prefix ipv6
- pfr site source prefix mask ipv4
- pfr site destination prefix mask ipv4
- pfr site source prefix mask ipv6
- pfr site destination prefix mask ipv6
- pfr service provider tag identifier
- pfr label identifier
- application voice number called
- application voice number calling
- application voice setup time
- application voice call duration
- application voice rx bad-packet
- application voice rx out-of-sequence
- application voice codec id
- application voice play delay current
- application voice play delay minimum
- application voice play delay maximum
- application voice sip call-id
- application voice router global-call-id
- application voice delay round-trip
- application voice delay end-point
- application voice r-factor 1
- application voice r-factor 2
- application voice mos conversation
- application voice mos listening
- application voice concealment-ratio averag
- application voice jitter configured type
- application voice jitter configured minimu
- application voice jitter configured maximu
- application voice jitter configured initia
- application voice rx early-packet count
- application voice rx late-packet count
- application voice jitter buffer-overrun
- application voice packet conceal-count
- bandwidth used
- bandwidth used percentage
- application video resolution width last
- application video resolution height last
- application video frame rate
- application video payload bitrate average
- application video payload bitrate fluctuat
- application video frame I counter frames
- application video frame I counter packets
- application video frame I counter bytes
- application video frame STR counter frames
- application video frame STR counter packet
- application video frame STR counter bytes
- application video frame LTR counter frames
- application video frame LTR counter packet
- application video frame LTR counter bytes
- application video frame super-P counter fr
- application video frame super-P counter pa
- application video frame super-P counter by
- application video frame NR counter frames
- application video frame NR counter packets
- application video frame NR counter bytes
- application video frame I slice-quantizati
- application video frame STR slice-quantiza
- application video frame LTR slice-quantiza
- application video frame super-P slice-quan
- application video frame NR slice-quantizat
- application video eMOS compression bitstre
- application video eMOS compression network
- application video frame I counter packets
- application video frame STR counter packet
- application video frame LTR counter packet
- application video frame super-P counter pa
- application video frame NR counter packets
- application video frame percentage damaged
- application video eMOS packet-loss bitstre
- application video eMOS packet-loss network
- application video scene-complexity
- application video level-of-motion
- transport rtp sequence-number
- transport rtp sequence-number last
- iOAM my node-id
- iOAM my node name
- start timestamp
- end timestamp
- IOAM packet counter
- IOAM byte count
- IOAM cs0 packet counter
- IOAM cs0 byte count
- IOAM cs1 packet counter
- IOAM cs1 byte count
- IOAM cs2 packet counter
- IOAM cs2 byte count
- IOAM cs3 packet counter
- IOAM cs3 byte count
- IOAM cs4 packet counter
- IOAM cs4 byte count
- IOAM cs5 packet counter
- IOAM cs5 byte count
- IOAM cs6 packet counter
- IOAM cs6 byte count
- IOAM cs7 packet counter
- IOAM cs7 byte count
- IOAM lost packet counter
- IOAM duplicate packet counter
- IOAM reordered packet counter
- IOAM highest PPC sequence number
- iOAM node-id
- ipv6 protocol filed
- iOAM E2E Header
- iOAM Path Map
- iOAM number of nodes
- iOAM node1 id
- iOAM node1 in if id
- iOAM node1 eif id
- iOAM node2 id
- iOAM node2 in if id
- iOAM node2 eif id
- iOAM node3 id
- iOAM node3 in if id
- iOAM node3 eif id
- iOAM node4 id
- iOAM node4 in if id
- iOAM node4 eif id
- iOAM Application metadata
- iOAM sfc-id
- iOAM sfc validated count
- iOAM sfc invalidated count
- pfr br ipv4 address
- pfr status
- reason id
- threshold
- pfr priority
- long-term round-trip-time
- mos below
- rsvp bw pool
- flow left time
- bw percentage
- bw fee
- transport source-port min
- transport source-port max
- transport destination-port min
- transport destination-port max
- capacity
- ingress bw
- max ingress bw
- egress bw
- max egress bw
- ingress rollup bw
- egress rollup bw
- kth rollup bw
- link group name
- bgp community
- bgp prepend
- entrance downgrade
- discard rollup count
- services pfr class-tag-id
- services pfr mc-id
- sip header from uri host ip addr
- sip header from uri userinfo user
- sip header to uri host ip addr
- sip header to uri userinfo user
- sip sess duration
- sip sess end_reason
- sip sess_dialed
- sip sess_connected
- sip sess_failed
- AAA_USERNAME
- XLATE_SRC_ADDR_IPV4
- XLATE_DST_ADDR_IPV4
- XLATE_SRC_PORT
- XLATE_DST_PORT
- FW_EVENT
- artClientNetworkTimeLongLivedMaximum
- artClientNetworkTimeLongLivedMinimum
- artServerNetworkTimeLongLivedMaximum
- artServerNetworkTimeLongLivedMinimum
- policy qos classification hierarchy
- c3pl class cce-id
- c3pl class name
- c3pl class type
- c3pl policy cce-id
- c3pl policy name
- c3pl policy type
- interface input fex-node-id
- interface output fex-node-id
- interface power
- monitor device-type
- connection server counter bytes network
- connection client counter bytes network
- wireless afd drop packets
- wireless afd accept packets
- wireless afd drop bytes
- wireless afd accept bytes
- connection concurrent-connections
- application transaction counter new
- services waas segment
- services waas passthrough-reason
- connection delay network long-lived to-ser
- connection delay network long-lived to-cli
- connection delay network long-lived client
- connection delay network client-to-server
- connection delay network to-server num-sam
- connection delay network to-client num-sam
- artClientpackets
- artServerpackets
- connection client counter bytes retransmit
- connection client counter packets retransm
- connection server counter bytes retransmit
- connection server counter packets retransm
- connection transaction counter complete
- connection transaction duration sum
- connection transaction duration max
- connection transaction duration min
- art count new connections
- art count responses
- art count responses histogram bucket1
- art count responses histogram bucket2
- art count responses histogram bucket3
- art count responses histogram bucket4
- art count responses histogram bucket5
- art count responses histogram bucket6
- art count responses histogram bucket7
- connection delay response to-server histog
- connection delay response to-server sum
- connection delay response to-server max
- connection delay response to-server min
- connection delay application sum
- connection delay application max
- connection delay application min
- connection delay response client-to-server
- connection delay response client-to-server
- connection delay response client-to-server
- connection delay network client-to-server
- connection delay network client-to-server
- connection delay network client-to-server
- onnection delay network to-client sum
- connection delay network to-client max
- connection delay network to-client min
- connection delay network to-server sum
- connection delay network to-server max
- connection delay network to-server min
- mos worst 100
- mos quality
- mos total count
- application http uri statistics
- policy qos queue index
- policy qos queue drops
- datalink event
- datalink event extended
- l4r server ipv4 address
- l4r server transport port
- l4r server ipv6 address
- l4r event
- l4r event timestamp
- pbhk mapped ipv4 address
- pbhk mapped transport port
- pbhk event
- pbhk event timestamp
- ETTA_INITIAL_DATA_PACKET
- ETTA_SEQUENCE_OF_PACKET_LENGTHS_AND_TIMES
- ETTA_SEQUENCE_OF_APPLICATION_LENGTHS_AND_TIMES
- ETAByteDistribution
- ETTA_TLS_RECORDS
- ETTA_TLS_CIPHER_SUITES
- ETTA_TLS_EXTENSIONS
- ETTA_TLS_VERSION
- ETTA_TLS_KEY_LENGTH
- ETTA_TLS_SESSION_ID
- ETTA_TLS_RANDOM
- ETTA_TLS_EXTENSION_LENGTHS
- ETTA_TLS_EXTENSION_TYPES
- application family name
- application set name
- application category name
- application sub category name
- application group name
- AVCSubApplicationValue
- connection client ipv4 address
- connection server ipv4 address
- connection client ipv6 address
- connection server ipv6 address
- connection client transport port
- connection server transport port
- connection id
- application traffic-class
- application business-relevance
- nvzFlowUDID
- nvzFlowLoggedInUser
- nvzFlowOSName
- nvzFlowOSVersion
- nvzFlowSystemManufacturer
- nvzFlowSystemType
- nvzFlowProcessAccount
- nvzFlowParentProcessAccount
- nvzFlowProcessName
- nvzFlowProcessHash
- nvzFlowParentProcessName
- nvzFlowParentProcessHash
- nvzFlowDNSSuffix
- nvzFlowDestinationHostname
- nvzFlowL4ByteCountIn
- nvzFlowL4ByteCountOut
- nvzFlowOSEdition
- nvzFlowModuleNameList
- nvzFlowModuleHashList
- nvzFlowCoordinatesList
- nvzFlowInterfaceInfoUID
- nvzFlowInterfaceIndex
- nvzFlowInterfaceType
- nvzFlowInterfaceName
- nvzFlowInterfaceDetailsList
- nvzFlowInterfaceMac
- nvzFlowUserAccountType
- nvzFlowProcessAccountType
- nvzFlowParentProcessAccountType
- overlay session id input
- overlay session id output
- routing vrf service
- tloc table overlay session id
- tloc local system ip address
- tloc local color
- tloc remote system ip address
- tloc remote color
- tloc tunnel protocol
- connection id long
- drop cause id
- counter bytes sdwan dropped long
- sdwan sla-not-met
- sdwan preferred-color-not-met
- sdwan qos-queue-id
- drop cause name
- counter packets appqoe fec-d-pkts
- counter packets appqoe fec-r-pkts
- counter packets appqoe pkt-dup-d-pkts-orig
- counter packets appqoe pkt-dup-d-pkts-dup
- counter packets appqoe pkt-dup-r-pkts
- counter packets sdwan pkt-cxp-d-pkts
- counter bytes appqoe ssl-read
- counter bytes appqoe ssl-written
- counter bytes appqoe ssl-en-read
- counter bytes appqoe ssl-en-written
- counter bytes appqoe ssl-de-read
- counter bytes appqoe ssl-de-written
- appqoe ssl service type
- appqoe ssl traffic type
- appqoe ssl policy action
- ETAInitialDataPacketOld
- ETASequenceofPktLengthsandTimes
- wlan_id
- timestampAbsoluteMonitoring-intervalStart
- timestampAbsoluteMonitoring-intervalEnd
LANcope, now Cisco (PEN: 8712)
- FlowSensorInitiator
- FlowSensorTCPSYNACKTotalCount
- FlowSensorTCPSRSTotalCount
- FlowSensorRoundTripTime
- FlowSensorServerResponseTime
- FlowSensorRetransmits
- FlowSensorTCPBadTotalCount
- FlowSensorTCPFragTotalCount
- FlowSensorSourceEmailIn
- FlowSensorSourceEmailOut
- FlowSensorSourceEmailInMessages
- FlowSensorSourceEmailOutMessages
- FlowSensorSourceEmailInTrys
- FlowSensorSourceEmailOutTrys
- FlowSensorDestinationEmailIn
- FlowSensorDestinationEmailOut
- FlowSensorDestinationEmailInMessages
- FlowSensorDestinationEmailOutMessages
- FlowSensorDestinationEmailInTrys
- FlowSensorDestinationEmailOutTrys
- FlowSensorTraces
- FlowSensorEmbeddedICMPProtocol
- FlowSensorEmbeddedICMPType
- FlowSensorEmbeddedICMPCode
- FlowSensorApplicationIdentifier
- FlowSensorBadFlagXmas
- FlowSensorBadFlagSYNFIN
- FlowSensorBadFlagBadRST
- FlowSensorBadFlagNoACK
- FlowSensorBadFlagURG
- FlowSensorBadFlagNoFlag
- FlowSensorShortFragAttack
- FlowSensorFragPacketTooShort
- FlowSensorFragPacketTooLong
- FlowSensorFragPacketDifferentSizes
- FlowSensorApplicationDetails
- FlowSensorTrustsecSourceIdentifier
- EndpointFlowProcessAccount
- EndpointFlowProcessName
- EndpointFlowProcessHash
- EndpointFlowParentProcessAccount
- EndpointFlowParentProcessName
- EndpointFlowParentProcessHash