Flow Protocols

Note: If you configure traffic with VLAN-ID, you must configure for both traffic directions. Otherwise you may experience a mismatch of VLANs in the TCP streams, which can cause queue overflow errors and traffic loss.

NetFlow

Name Description Term
app Specifies the name of an application netflow.app-name
app_tag Application ID netflow.app-tag
bgp_nxt_hop_ip IP address of the next (adjacent) BGP hop netflow.bgp-nexthop-address
bytes Total number of Layer 3 bytes in the flow netflow.bytes
bytes_in Incoming counter for number of bytes associated with an IP Flow netflow.cs-bytes
bytes_out Outgoing counter for number of bytes associated with an IP Flow netflow.sc-bytes
channel Identifier of the 802.11 (Wi-Fi) channel netflow.wlanChannelId
dest_ip Destination address of flow flow.s-ip
dest_ip_prefix Destination address prefix netflow.destinationIPPrefix
dest_mac Server packets MAC address in hexadecimal format flow.s-mac
dest_mask Number of contiguous bits that are relevant in the destination ip prefix netflow.dest-mask
dest_port Destination port number of flow flow.s-port
dest_sysnum System number of destination for this flow netflow.s-sysnum
drop_octet_count Number of octets since the previous report (if any) of this Flow dropped by packet treatment netflow.droppedOctetDeltaCount
drop_octet_total_count Number of octets of this Flow dropped by packet treatment netflow.droppedOctetTotalCount
drop_packet_count Number of packets since the previous report (if any) of this Flow dropped by packet treatment netflow.droppedPacketDeltaCount
drop_pkt_total_count Number of packets of this Flow dropped by packet treatment netflow.droppedPacketTotalCount
egress_broadcast_pkt_count Total number of outgoing unicast packets netflow.egressBroadcastPacketTotalCount
egress_interface Networking device's physical interface (example, a switch port) where packets of this flow are being sent netflow.egressPhysicalInterface
egress_itf_type Type of interface where packets of this Flow are being sent netflow.egressInterfaceType
egress_unicast_pkt_count Total number of outgoing unicast packets netflow.egressUnicastPacketTotalCount
egress_vlan Virtual LAN identifier associated with egress interface netflow.dest-vlan
event_name Name of event flow.event-name
export_process_id Identifier of an Exporting Process that is unique per IPFIX Device netflow.exportingProcessId
exporter_ip IP address of device that generated flow netflow.exporterIPAddress
firewall_event Indicates a firewall event netflow.firewallEvent
flow_dir The direction of the Flow at observation point flow.direction
flow_duration_micro The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. netflow.flowDurationMicroseconds
flow_duration_milli The difference in time between the first observed packet of this Flow and the last observed packet of this Flow netflow.flowDurationMilliseconds
flow_end_reason Reason for Flow termination flow.end-reason
flow_end_time The absolute timestamp of the last packet of this Flow. time.epoch-time-end
flow_end_time_micro The absolute timestamp of the last packet of this Flow. netflow.flowEndMicroseconds
flow_end_time_milli The absolute timestamp of the last packet of this Flow. netflow.flowEndMilliseconds
flow_end_time_nano The absolute timestamp of the last packet of this Flow. netflow.flowEndNanoseconds
flow_id Identifier of a Flow that is unique within an Observation Domain netflow.flowId
flow_label_ipv6 IPv6 Flow Label field flow.ipv6-flow-label
flow_start_time The absolute timestamp of the first packet of this Flow time.epoch-time
flow_start_time_micro The absolute timestamp of the first packet of this Flow netflow.flowStartMicroseconds
flow_start_time_milli The absolute timestamp of the first packet of this Flow netflow.flowStartMilliseconds
flow_start_time_nano The absolute timestamp of the first packet of this Flow netflow.flowStartNanoseconds
fwd_status Forwarding status of the flow netflow.forward-status
gre_key GRE key, identifying an individual traffic flow within a tunnel netflow.greKey
ignored_octet_count Total number of octets that the Metering Process did not process since the Metering Process (re-)initialization netflow.ignoredOctetTotalCount
ignored_pkt_count Total number of observed IP packets that the Metering Process did not process since the Metering Process (re-)initialization netflow.ignoredPacketTotalCount
ingress_broadcast_pkt_count Total number of incoming broadcast packets netflow.ingressBroadcastPacketTotalCount
ingress_interface Networking device's physical interface (example, a switch port) where packets of this Flow are being received netflow.ingressPhysicalInterface
ingress_itf_type Type of interface where packets of this Flow are being received netflow.ingressInterfaceType
ingress_multicast_pkt_count Total number of incoming multicast packets netflow.ingressMulticastPacketTotalCount
ingress_unicast_pkt_count Total number of incoming unicast packets netflow.ingressUnicastPacketTotalCount
ingress_vlan Virtual LAN identifier associated with ingress interface netflow.src-vlan
input_snmpidx SNMP index of input interface for this Flow netflow.input-snmpidx
interface_name Short name uniquely describing an interface netflow.if-name
ip_frag_flags Fragmentation properties indicated by flags ip.fragment-flags
ip_frag_id Value of the Identification field in the IP packet header ip.id
ipsec_spi IPSec Security Parameters Index (SPI) netflow.IPSecSPI
is_encrypted Specifies if Application ID is an encrypted networking protocol netflow.encryptedTechnology
is_p2p Specifies if Application ID is based on peer-to-peer technology netflow.p2pTechnology
is_tunnel Specifies if Application ID is used as a tunnel technology netflow.tunnelTechnology
layer2_segment_id Identifier of a layer 2 network segment in an overlay network netflow.layer2SegmentId
linecard_id Identifier of a line card that is unique per IPFIX Device hosting an Observation Point netflow.lineCardId
max_ttl Max TTL value observed for any packet in this Flow netflow-max-ttl
metering_process_id Identifier of a Metering Process that is unique per IPFIX Device netflow.meteringProcessId
min_ttl Minimum TTL value observed for any packet in this Flow netflow-min-ttl
mpls_top_label_type Control protocol that allocated the top-of-stack label netflow.mpls-top-label-type
msg_md5_chksum MD5 checksum of the IPFIX Message containing this record netflow.messageMD5Checksum
multicast_flags Flags to indicate multicast netflow.isMulticast
multicast_out_bytes Outgoing multicast bytes netflow.multicast-out-bytes
multicast_out_pkts Outgoing multicast packets netflow.multicast-out-packets
name desc term
nat_event Indicates a NAT event netflow.natEvent
nat_type Type of NAT treatment netflow.natType
netflow_elements Key Value pairs netflow.elements
netflow_version Netflow Version netflow.version
nexthop_addr Address of the next hop netflow.nexthop-address
not_sent_flow_count Total number of Flow Records dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process netflow.notSentFlowTotalCount
not_sent_octet_count Total number of octets dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process netflow.notSentOctetTotalCount
not_sent_pkt_count Total number of packets dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process netflow.notSentPacketTotalCount
num_flows Netflow number of Flows netflow.num-flows
observation_domain_id Identifier of Observation Domain that is locally unique to an Exporting Process netflow.observationDomainId
observation_point_id Identifier of an Observation Point that is unique per Observation Domain netflow.observationPointId
obsv_flow_count Total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization netflow.observedFlowTotalCount
output_snmpidx SNMP index of output interface for this Flow netflow.output-snmpidx
packets Total number of packets in the Flow flow.packets
packets_in Incoming counter for number of packets associated with an IP Flow netflow.cs-packets
packets_out Outgoing counter for number of packets associated with an IP Flow netflow.sc-packets
perm_cs_bytes Running byte counter for a permanent Flow(incoming) netflow.perm-bytes
perm_cs_pkts Running packet counter for a permanent Flow(incoming) netflow.perm-packets
port_id Identifier of line port that is unique per IPFIX Device hosting an Observation Point netflow.portId
post_dest_mac Modified destination mac address caused by a middlebox function netflow.post-dest-mac
post_octet_count Modified total octet count caused by a middlebox function after the packet passed the Observation Point. netflow.postOctetTotalCount
post_pkt_count Modified total packet count caused by a middlebox function after the packet passed the Observation Point. netflow.postPacketTotalCount
post_src_mac Modified source mac address caused by a middlebox function netflow.post-src-mac
protoid IP protocol type ip.protoid
sampling_pkt_interval Number of packets that are consecutively sampled netflow.samplingPacketInterval
selector_algorithm Packet selection methods applied netflow.selectorAlgorithm
selector_id Unique identifier associated with Selector netflow.selectorId
selector_name Name of a selector identified by a selectorID netflow.selectorName
seqnumber Netflow sequence number netflow.flow-sequence
src_ip Source address of Flow flow.c-ip
src_ip_prefix Source address prefix netflow.sourceIPPrefix
src_mac Client packets MAC address in hexadecimal format flow.c-mac
src_mask Number of contiguous bits that are relevant in the source IP prefix netflow.src-mask
src_port Source port number of Flow flow.c-port
src_sysnum System number of source for this Flow netflow.c-sysnum
ssid Service Set Identifier of 802.11 (Wi-Fi) network netflow.wlanSSID
sta_ip_addr IP address of a wireless station netflow.staIPAddress
sta_mac_addr IEEE 802 MAC address of a wireless station (STA). netflow.staMacAddress
sys_init_time_milli The absolute timestamp of the last (re-)initialization of the IPFIX Device. netflow.systemInitTimeMilliseconds
tcp_ack_num The acknowledgement number in the TCP header netflow.tcpAcknowledgementNumber
tcp_flags Cumulative OR of TCP flags for this Flow netflow.tcp-flags
tcp_seq_num The sequence number in the TCP header netflow.tcpSequenceNumber
tcp_total_ack_count Number of packets of this Flow with TCP ACK flag set netflow.tcpAckTotalCount
tcp_total_fin_count Number of packets of this Flow with TCP FIN flag set netflow.tcpFinTotalCount
tcp_total_psh_count Number of packets of this Flow with TCP PSH flag set netflow.tcpPshTotalCount
tcp_total_rst_count Number of packets of this Flow with TCP RST flag set netflow.tcpRstTotalCount
tcp_total_syn_count Number of packets of this Flow with TCP SYN flag set netflow.tcpSynTotalCount
tcp_total_urg_count Number of packets of this Flow with TCP URG flag set netflow.tcpUrgTotalCount
tcp_win_size The window field in the TCP header netflow.tcpWindowSize
tcp_window_scale The scale of the window field in the TCP header netflow.tcpWindowScale
template_id Identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain netflow.templateId
time_taken Duration of Flow flow.time-taken
top_label_ip IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to netflow.mplsTopLabelIPAddress
tos Type of Service ip.tos
txn_id Identifies a transaction within a connection netflow.connectionTransactionId
user_name User name associated with the Flow netflow.userName
version IP version ip.version
virtual_station_itf_id Instance Identifier of the interface to a Virtual Station netflow.virtualStationInterfaceId
virtual_station_itf_name Name of the interface to a Virtual Station netflow.virtualStationInterfaceName
virtual_station_name Name of a Virtual Station netflow.virtualStationName
virtual_station_uuid Unique Identifier of a Virtual Station netflow.virtualStationUUID
wtp_mac_addr IEEE 802 MAC address of a wireless access point netflow.wtpMacAddress

sFlow

Name Description Term
code ICMP message code icmp.code
cpu_util_1m 1 minute average CPU utilization sflow.cpu_percent_1m
cpu_util_5m 5 minute average CPU utilization sflow.cpu_percent_5m
cpu_util_5s 5 second average CPU utilization sflow.cpu_percent_5s
dest_charset Destination character set sflow.dest-charset
dest_ip Destination address of flow flow.s-ip
dest_mac Server packets MAC address in hexadecimal format flow.s-mac
dest_path_as_nums Destination path AS numbers sflow.dest-path-as-nums
dest_port Destination port number of flow flow.s-port
dest_sysnum System number of destination for this flow netflow.s-sysnum
dest_user Destination User sflow.dest-user
dest_vlan VLAN identifier of outgoing frame netflow.dest-vlan
dest_vlan_priority 802.ip priority of outgoing frame netflow.dest-vlan_priority
dot12_hc_in_high_priority_octets Count of the number of octets contained in high priority frames that have been received on this interface sflow.dot12HCInHighPriorityOctets
dot12_hc_in_norm_priority_octets Count of the number of octets contained in normal priority frames that have been received on this interface sflow.dot12HCInNormPriorityOctets
dot12_hc_out_high_priority_octets Count of the number of octets contained in high priority frames that have been send out of this interface sflow.dot12HCOutHighPriorityOctets
dot12_in_data_errs Count of oversize frames received on this interface sflow.dot12InDataErrors
dot12_in_high_priority_frames Count of high priority frames that have been received on this interface sflow.dot12InHighPriorityFrames
dot12_in_high_priority_octets Count of number of octets contained in high priority frames that have been received on this interface sflow.dot12InHighPriorityOctets
dot12_in_ipm_errs Count of number of frames that have been received on this interface with an invalid packet marker and no PMI errors sflow.dot12InIPMErrors
dot12_in_norm_priority_frames Count of normal priority frames that have been received on this interface sflow.dot12InNormPriorityFrames
dot12_in_norm_priority_octets Count of number of octets contained in normal priority frames that have been received on this interface sflow.dot12InNormPriorityOctets
dot12_in_null_address_frames Count of null addressed frames received on this interface sflow.dot12InNullAddressedFrames
dot12_in_oversize_frames_errs Count of oversize frames received on this interface sflow.dot12InOversizeFrameErrors
dot12_out_high_priority_frames Count of high priority frames successfully transmitted out sflow.dot12OutHighPriorityFrames
dot12_out_high_priority_octets Count of octets of high priority frames successfully transmitted out sflow.dot12OutHighPriorityOctetss
dot12_transition_trainings Count of the number of times this interface has entered the training state sflow.dot12TransitionIntoTrainings
dot3_stats_alignment_errs Frames received that are not an integral number of octets in length and do not pass the FCS check sflow.dot3StatsAlignmentErrors
dot3_stats_carrier_sense_errors Number of times that the carrier sense condition was lost or never asserted when attempting to transmit a frame sflow.dot3StatsCarrierSenseErrors
dot3_stats_deferred_transmissions Count of frames for which the first transmission attempt on a particular interface is delayed because the medium is busy sflow.dot3StatsDeferredTransmissions
dot3_stats_excessive_collisions Count of frames for which transmission on a particular interface fails due to excessive collisions sflow.dot3StatsExcessiveCollisions
dot3_stats_fcs_errs Frames received that are an integral number of octets in length but do not pass the FCS check sflow.dot3StatsFCSErrors
dot3_stats_frame_too_longs Count of frames received on a particular interface that exceed the maximum permitted frame size sflow.dot3StatsFrameTooLongs
dot3_stats_internal_mac_receive_errors Count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error sflow.dot3StatsInternalMacReceiveErrors
dot3_stats_internal_mac_tranmit_errors Count of frames for which transmission on a particular interface fails due to an internal MAC sublayer transmit error sflow.dot3StatsInternalMacTransmitErrors
dot3_stats_late_collisions Number of times that a collision is detected on a particular interface later than 512 bit-times into the transmission of a packet sflow.dot3StatsLateCollisions
dot3_stats_multi_collision_frames Count of transmitted frames on a particular interface for which transmission is inhibited by more than one collision sflow.dot3StatsMultipleCollisionFrames
dot3_stats_single_collision_frames Count of transmitted frames on a particular interface for which transmission is inhibited by exactly one collision sflow.dot3StatsSingleCollisionFrames
dot3_stats_sqe_test_errors Count of times that the SQE TEST ERROR message is generated by the PLS sublayer for a particular interface sflow.dot3StatsSQETestErrors
dot3_stats_symbol_errors Number of times there was an invalid data symbol when a valid carrier was present on a particular interface sflow.dot3StatsSymbolErrors
dot5_stats_abort_trans_errors Count of errors resulting from an abort delimiter while transmitting sflow.dot5StatsAbortTransErrors
dot5_stats_ac_errors Count of errors resulted by station that cannot set the AC bits properly sflow.dot5StatsACErrors
dot5_stats_burst_errors Count of absence of transitions for five half-bit timers sflow.dot5StatsBurstErrors
dot5_stats_frame_copy_errs Count of errors resulting from FS field A bits set to 1 sflow.dot5StatsFrameCopiedErrors
dot5_stats_freq_errs Number of times the interface has detected that the frequency of the incoming signal differs from the expected frequency by more than that specified by the IEEE 802.5 standard sflow.dot5StatsFreqErrors
dot5_stats_hard_errs Number of times this interface has detected an immediately recoverable fatal error sflow.dot5StatsHardErrors
dot5_stats_internal_errors Count of internal errors sflow.dot5StatsInternalErrors
dot5_stats_line_errors Count of tokens or frames with E bit set to zero and there is J or K bit between the SD and the ED or there is an FCS error sflow.dot5StatsLineErrors
dot5_stats_lobe_wires Number of times times the interface has detected an open or short circuit in the lobe data path sflow.dot5StatsLobeWires
dot5_stats_lost_frame_errors Count of errors resulting from TRR timer expiry sflow.dot5StatsLostFrameErrors
dot5_stats_recoverys Number of Claim Token MAC frames received or transmitted after the interface has received a Ring Purge MAC frame sflow.dot5StatsRecoverys
dot5_stats_recv_congestion Count of errors resulting from no available buffer space or congestion sflow.dot5StatsReceiveCongestions
dot5_stats_removes Number of times the interface has received a Remove Ring Station MAC frame request sflow.dot5StatsRemoves
dot5_stats_signal_loss Number of times this interface has detected the loss of signal condition from the ring sflow.dot5StatsSignalLoss
dot5_stats_singles Number of times the interface has sensed that it is the only station on the ring sflow.dot5StatsSingles
dot5_stats_soft_errs Count of Soft Errors the interface has detected sflow.dot5StatsSoftErrors
dot5_stats_token_errs Count of errors resulting from a condition that needs a token transmitted sflow.dot5StatsTokenErrors
dot5_stats_transmit_beacons Number of times this interface has transmitted a beacon frame sflow.dot5StatsTransmitBeacons
ethernet_pkt_type Ethernet packet type sflow.ethernet-packet-type
event_name Name of event flow.event-name
exporter_ip IP address of device that generated flow netflow.exporterIPAddress
free_mem Free memory(in bytes) sflow.free-mem
gateway_communities Gateway communities sflow.gateway-communities
http_host Host field for HTTP http.host
http_url URL associated with the flow http.uri
input_snmpidx SNMP index of input interface for this flow netflow.input-snmpidx
interface_direction Interface Direction flow.interface-direction
interface_index Network interface index flow.interface-index
interface_input_broad_pkts Interface broadcast packets flow.interface-input-broad-pkts
interface_input_discard_pkts Interface discarded packets flow.interface-input-discard-pkts
interface_input_errors Interface input errors flow.interface-input-errors
interface_input_multi_pkts Interface multicast packets flow.interface-input-multi-pkts
interface_input_octets Interface input octets flow.interface-input-octets
interface_input_pkts Interface input packets flow.interface-input-pkts
interface_input_unk_proto_pkts Interface input unknown protocol packets flow.interface-input-unk-protos
interface_name Name of network interface flow.interface-name
interface_output_broad_pkts Interface broadcast packets flow.interface-output-broad-pkts
interface_output_discard_pkts Interface discarded packets flow.interface-output-discard-pkts
interface_output_errors Interface output errors flow.interface-output-errors
interface_output_multi_pkts Interface multicast packets flow.interface-output-multi-pkts
interface_output_octets Interface output octets flow.interface-output-octets
interface_output_pkts Interface output packets flow.interface-output-pkts
interface_promiscuous_mode Interface promiscuous mode flow.interface-promiscuous
interface_speed Network interface speed flow.interface-speed
interface_status Interface status flow.interface-status
interface_type Network interface type flow.interface-type
ip_len Length of the IP packet ip.packet-len
mpls_ftn_desc MPLS FTN description sflow.mpls-ftn-desc
mpls_ftn_mask MPLS FTN mask sflow.mpls-ftn-mask
mpls_in_label Entries for MPLS label stack sflow.in-mpls-label
mpls_out_label Entries for MPLS label stack sflow.out-mpls-label
name desc term
nat_dest_ip Modified ip address value caused by NAT netflow.postNATDestinationIPAddress
nat_src_ip Modified ip address value caused by NAT netflow.postNATSourceIPAddress
next_hop_address IP address of the next hop router netflow.nexthop-address
orig_frame_len sFlow Original length of packet before sampling sflow.frame-length
output_snmpidx SNMP index of output interface for this flow netflow.output-snmpidx
packets Total number of packets in the flow flow.packets
peer_as_num Autonomous system (AS) number of source peer sflow.peer-as-num
protoid IP protocol type ip.protoid
route_local_pref Local Pref sflow.route-localpref
router_as_num Autonomous system (AS) number of the Router sflow.router-as-num
seqnumber sFlow sequence number sflow.flow-sequence
sflow_dropped_pkts Dropped packets sflow.dropped-pkts
sflow_elements Key Value pairs sflow.elements
sflow_header_protocol sFlow raw packet header protocol sflow.header-protocol
sflow_input_itf_index Interface packet was received on sflow.input-interface-index
sflow_output_itf_index Interface packet was sent on sflow.output-interface-index
sflow_sample_pool Number of packets sampled sflow.sample-pool
sflow_sampling_rate sFlow sampling rate sflow.sampling-rate
sflow_version sFlow Version sflow.version
src_charset Source character set sflow.src-charset
src_ip Source address of flow flow.c-ip
src_mac Client packets MAC address in hexadecimal format flow.c-mac
src_port Source port number of flow flow.c-port
src_sysnum System number of source for this flow netflow.c-sysnum
src_user Source User sflow.src-user
src_vlan VLAN identifier of incoming frame netflow.src-vlan
src_vlan_priority 802.ip priority of incoming frame netflow.src-vlan_priority
stripped_octets Number of octets removed sflow.stripped-octets
stripped_vlan_tags List of stripped 802.1Q TPID/TCI layers sflow.vlan-tags
tcp_flags Cumulative OR of TCP flags for this flow netflow.tcp-flags
time_taken Duration of flow flow.time-taken
tos Type of Service ip.tos
total_mem Total memory(in bytes) sflow.total-mem
tunnel_cos Tunnel COS value sflow.tunnel-cos
tunnel_id Tunnel Identifier sflow.tunnel-id
tunnel_name Tunnel name sflow.tunnel-name
type ICMP message type icmp.type
url_direction Direction associated with the URL 0 - source / 1 - destination flow.direction
vc_inst_id VC instance identifier sflow.vc-id
vc_inst_name VC instance name sflow.vc-instance-name
vc_label_cos VC label COS value sflow.vc-label-cos
vlan_broad_cast_pkts Count of broadcast packets sflow.vlan-broadcast-packets
vlan_discards Count of discards sflow.vlanDiscards
vlan_id Vlan Id, with multiple vlan tags, vlan_id is the outermost tag. flow.vlan-id
vlad_tags All VLAN tags collected from 802.1Q and 802.1ad headers. flow.vlan-tags
vlan_multi_cast_pkts Count of multi-cast packets sflow.vlan-multicast-packets
vlan_octets Count of octets sflow.vlanOctets
vlan_ucast_pkts Count of uni-cast packets sflow.vlan-ucast-packets