Flow Protocols

NetFlow

Name	Description	Term
event_name	Name of event	flow.event-name
netflow_version	Netflow Version	netflow.version
seqnumber	Netflow sequence number	netflow.flow-sequence
num_flows	Netflow number of flows	netflow.num-flows
exporter_ip	IP address of device that generated flow	netflow.exporterIPAddress
src_ip	Source address of flow	flow.c-ip
dest_ip	Destination address of flow	flow.s-ip
src_port	Source port number of flow	flow.c-port
dest_port	Destination port number of flow	flow.s-port
dest_mac	Server packets MAC address in hexadecimal format	flow.s-mac
src_mac	Client packets MAC address in hexadecimal format	flow.c-mac
protoid	IP protocol type	ip.protoid
tos	Type of Service	ip.tos
bytes	Total number of Layer 3 bytes in the flow	netflow.bytes
packets	Total number of packets in the flow	flow.packets
time_taken	Duration of flow	flow.time-taken
tcp_flags	Cumulative OR of TCP flags for this flow	netflow.tcp-flags
src_sysnum	System number of source for this flow	netflow.c-sysnum
dest_sysnum	System number of destination for this flow	netflow.s-sysnum
name	desc	netflow.input-snmpidx
event_name	Name of event	netflow.output-snmpidx
netflow_version	Netflow Version	netflow.bgp-nexthop-address
name	desc	netflow.multicast-out-packets
event_name	Name of event	netflow.multicast-out-bytes
netflow_version	Netflow Version	netflow.sc-bytes
seqnumber	Netflow sequence number	netflow.sc-packets
num_flows	Netflow number of flows	netflow.cs-packets
exporter_ip	IP address of device that generated flow	netflow.cs-bytes
src_ip	Source address of flow	netflow.src-mask
dest_ip	Destination address of flow	netflow.dest-mask
src_port	Source port number of flow	flow.ipv6-flow-label
dest_port	Destination port number of flow	netflow.mpls-top-label-type
dest_mac	Server packets MAC address in hexadecimal format	netflow.mplsTopLabelIPAddress
src_mac	Client packets MAC address in hexadecimal format	netflow.selectorId
protoid	IP protocol type	netflow.selectorAlgorithm
tos	Type of Service	netflow.samplingPacketInterval
bytes	Total number of Layer 3 bytes in the flow	netflow-min-ttl
packets	Total number of packets in the flow	netflow-max-ttl
time_taken	Duration of flow	ip.id
tcp_flags	Cumulative OR of TCP flags for this flow	netflow.post-dest-mac
src_sysnum	System number of source for this flow	netflow.src-vlan
dest_sysnum	System number of destination for this flow	netflow.dest-vlan
name	desc	ip.version
event_name	Name of event	flow.direction
netflow_version	Netflow Version	netflow.nexthop-address
name	desc	netflow.post-src-mac
event_name	Name of event	netflow.if-name
netflow_version	Netflow Version	netflow.perm-bytes
seqnumber	Netflow sequence number	netflow.perm-packets
num_flows	Netflow number of flows	netflow.forward-status
exporter_ip	IP address of device that generated flow	netflow.app-tag
app	Specifies the name of an application	netflow.app-name
drop_octet_count	Number of octets since the previous report (if any) of this Flow dropped by packet treatment	netflow.droppedOctetDeltaCount
drop_packet_count	Number of packets since the previous report (if any) of this Flow dropped by packet treatment	netflow.droppedPacketDeltaCount
drop_octet_total_count	Number of octets of this Flow dropped by packet treatment	netflow.droppedOctetTotalCount
drop_pkt_total_count	Number of packets of this Flow dropped by packet treatment	netflow.droppedPacketTotalCount
flow_end_reason	Reason for Flow termination	flow.end-reason
observation_point_id	Identifier of an Observation Point that is unique per Observation Domain	netflow.observationPointId
linecard_id	Identifier of a line card that is unique per IPFIX Device hosting an Observation Point	netflow.lineCardId
port_id	Identifier of line port that is unique per IPFIX Device hosting an Observation Point	netflow.portId
metering_process_id	Identifier of a Metering Process that is unique per IPFIX Device	netflow.meteringProcessId
export_process_id	Identifier of an Exporting Process that is unique per IPFIX Device	netflow.exportingProcessId
template_id	Identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain	netflow.templateId
channel	Identifier of the 802.11 (Wi-Fi) channel	netflow.wlanChannelId
ssid	Service Set Identifier of 802.11 (Wi-Fi) network	netflow.wlanSSID
flow_id	Identifier of a Flow that is unique within an Observation Domain	netflow.flowId
observation_domain_id	Identifier of Observation Domain that is locally unique to an Exporting Process	netflow.observationDomainId
flow_start_time	The absolute timestamp of the first packet of this Flow	time.epoch-time
flow_end_time	The absolute timestamp of the last packet of this Flow.	time.epoch-time-end
flow_start_time_milli	The absolute timestamp of the first packet of this Flow	netflow.flowStartMilliseconds
flow_end_time_milli	The absolute timestamp of the last packet of this Flow.	netflow.flowEndMilliseconds
flow_start_time_micro	The absolute timestamp of the first packet of this Flow	netflow.flowStartMicroseconds
flow_end_time_micro	The absolute timestamp of the last packet of this Flow.	netflow.flowEndMicroseconds
flow_start_time_nano	The absolute timestamp of the first packet of this Flow	netflow.flowStartNanoseconds
flow_end_time_nano	The absolute timestamp of the last packet of this Flow.	netflow.flowEndNanoseconds
sys_init_time_milli	The absolute timestamp of the last (re-)initialization of the IPFIX Device.	netflow.systemInitTimeMilliseconds
flow_duration_milli	The difference in time between the first observed packet of this Flow and the last observed packet of this Flow	netflow.flowDurationMilliseconds
flow_duration_micro	The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.	netflow.flowDurationMicroseconds
obsv_flow_count	Total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization	netflow.observedFlowTotalCount
ignored_pkt_count	Total number of observed IP packets that the Metering Process did not process since the Metering Process (re-)initialization	netflow.ignoredPacketTotalCount
ignored_octet_count	Total number of octets that the Metering Process did not process since the Metering Process (re-)initialization	netflow.ignoredOctetTotalCount
not_sent_flow_count	Total number of Flow Records dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process	netflow.notSentFlowTotalCount
not_sent_pkt_count	Total number of packets dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process	netflow.notSentPacketTotalCount
not_sent_octet_count	Total number of octets dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process	netflow.notSentOctetTotalCount
src_ip_prefix	Source address prefix	netflow.sourceIPPrefix
dest_ip_prefix	Destination address prefix	netflow.destinationIPPrefix
post_octet_count	Modified total octet count caused by a middlebox function after the packet passed the Observation Point.	netflow.postOctetTotalCount
post_pkt_count	Modified total packet count caused by a middlebox function after the packet passed the Observation Point.	netflow.postPacketTotalCount
tcp_seq_num	The sequence number in the TCP header	netflow.tcpSequenceNumber
tcp_ack_num	The acknowledgement number in the TCP header	netflow.tcpAcknowledgementNumber
tcp_win_size	The window field in the TCP header	netflow.tcpWindowSize
ip_frag_flags	Fragmentation properties indicated by flags	ip.fragment-flags
tcp_total_syn_count	Number of packets of this Flow with TCP SYN flag set	netflow.tcpSynTotalCount
tcp_total_fin_count	Number of packets of this Flow with TCP FIN flag set	netflow.tcpFinTotalCount
tcp_total_rst_count	Number of packets of this Flow with TCP RST flag set	netflow.tcpRstTotalCount
tcp_total_psh_count	Number of packets of this Flow with TCP PSH flag set	netflow.tcpPshTotalCount
tcp_total_ack_count	Number of packets of this Flow with TCP ACK flag set	netflow.tcpAckTotalCount
tcp_total_urg_count	Number of packets of this Flow with TCP URG flag set	netflow.tcpUrgTotalCount
nat_event	Indicates a NAT event	netflow.natEvent
multicast_flags	Flags to indicate multicast	netflow.isMulticast
firewall_event	Indicates a firewall event	netflow.firewallEvent
tcp_window_scale	The scale of the window field in the TCP header	netflow.tcpWindowScale
ingress_interface	Networking device's physical interface (example, a switch port) where packets of this flow are being received	netflow.ingressPhysicalInterface
egress_interface	Networking device's physical interface (example, a switch port) where packets of this flow are being sent	netflow.egressPhysicalInterface
msg_md5_chksum	MD5 checksum of the IPFIX Message containing this record	netflow.messageMD5Checksum
txn_id	Identifies a transaction within a connection	netflow.connectionTransactionId
is_p2p	Specifies if Application ID is based on peer-to-peer technology	netflow.p2pTechnology
is_tunnel	Specifies if Application ID is used as a tunnel technology	netflow.tunnelTechnology
is_encrypted	Specifies if Application ID is an encrypted networking protocol	netflow.encryptedTechnology
ipsec_spi	IPSec Security Parameters Index (SPI)	netflow.IPSecSPI
gre_key	GRE key, identifying an individual traffic flow within a tunnel	netflow.greKey
nat_type	Type of NAT treatment	netflow.natType
selector_name	Name of a selector identified by a selectorID	netflow.selectorName
virtual_station_itf_id	Instance Identifier of the interface to a Virtual Station	netflow.virtualStationInterfaceId
virtual_station_itf_name	Name of the interface to a Virtual Station	netflow.virtualStationInterfaceName
virtual_station_uuid	Unique Identifier of a Virtual Station	netflow.virtualStationUUID
virtual_station_name	Name of a Virtual Station	netflow.virtualStationName
layer2_segment_id	Identifier of a layer 2 network segment in an overlay network	netflow.layer2SegmentId
ingress_unicast_pkt_count	Total number of incoming unicast packets	netflow.ingressUnicastPacketTotalCount
ingress_multicast_pkt_count	Total number of incoming multicast packets	netflow.ingressMulticastPacketTotalCount
ingress_broadcast_pkt_count	Total number of incoming broadcast packets	netflow.ingressBroadcastPacketTotalCount
egress_unicast_pkt_count	Total number of outgoing unicast packets	netflow.egressUnicastPacketTotalCount
egress_broadcast_pkt_count	Total number of outgoing unicast packets	netflow.egressBroadcastPacketTotalCount
sta_mac_addr	IEEE 802 MAC address of a wireless station (STA).	netflow.staMacAddress
sta_ip_addr	IP address of a wireless station	netflow.staIPAddress
wtp_mac_addr	IEEE 802 MAC address of a wireless access point	netflow.wtpMacAddress
ingress_itf_type	Type of interface where packets of this Flow are being received	netflow.ingressInterfaceType
egress_itf_type	Type of interface where packets of this Flow are being sent	netflow.egressInterfaceType
user_name	User name associated with the flow	netflow.userName
netflow_elements	Key Value pairs	netflow.elements

sFlow

Name	Description	Term
sflow_version	sFlow Version	sflow.version
seqnumber	sFlow sequence number	sflow.flow-sequence
exporter_ip	IP address of device that generated flow	netflow.exporterIPAddress
src_ip	Source address of flow	flow.c-ip
dest_ip	Destination address of flow	flow.s-ip
src_port	Source port number of flow	flow.c-port
dest_port	Destination port number of flow	flow.s-port
dest_mac	Server packets MAC address in hexadecimal format	flow.s-mac
src_mac	Client packets MAC address in hexadecimal format	flow.c-mac
protoid	IP protocol type	ip.protoid
ip_len	Length of the IP packet	ip.packet-len
tcp_flags	Cumulative OR of TCP flags for this flow	netflow.tcp-flags
tos	Type of Service	ip.tos
packets	Total number of packets in the flow	flow.packets
time_taken	Duration of flow	flow.time-taken
src_sysnum	System number of source for this flow	netflow.c-sysnum
dest_sysnum	System number of destination for this flow	netflow.s-sysnum
input_snmpidx	SNMP index of input interface for this flow	netflow.input-snmpidx
output_snmpidx	SNMP index of output interface for this flow	netflow.output-snmpidx
sflow_sampling_rate	sFlow sampling rate	sflow.sampling-rate
sflow_sample_pool	Number of packets sampled	sflow.sample-pool
sflow_dropped_pkts	Dropped packets	sflow.dropped-pkts
sflow_input_itf_index	Interface packet was received on	sflow.input-interface-index
sflow_output_itf_index	Interface packet was sent on	sflow.output-interface-index
sflow_header_protocol	sFlow raw packet header protocol	sflow.header-protocol
orig_frame_len	sFlow Original length of packet before sampling	sflow.frame-length
stripped_octets	Number of octets removed	sflow.stripped-octets
ethernet_pkt_type	Ethernet packet type	sflow.ethernet-packet-type
interface_name	Name of network interface	flow.interface-name
interface_index	Network interface index	flow.interface-index
interface_type	Network interface type	flow.interface-type
interface_speed	Network interface speed	flow.interface-speed
interface_direction	Interface Direction	flow.interface-direction
interface_status	Interface status	flow.interface-status
interface_input_octets	Interface input octets	flow.interface-input-octets
interface_input_pkts	Interface input packets	flow.interface-input-pkts
interface_input_multi_pkts	Interface multicast packets	flow.interface-input-multi-pkts
interface_input_broad_pkts	Interface broadcast packets	flow.interface-input-broad-pkts
interface_input_discard_pkts	Interface discarded packets	flow.interface-input-discard-pkts
interface_input_errors	Interface input errors	flow.interface-input-errors
interface_input_unk_proto_pkts	Interface input unknown protocol packets	flow.interface-input-unk-protos
interface_output_octets	Interface output octets	flow.interface-output-octets
interface_output_pkts	Interface output packets	flow.interface-output-pkts
interface_output_multi_pkts	Interface multicast packets	flow.interface-output-multi-pkts
interface_output_broad_pkts	Interface broadcast packets	flow.interface-output-broad-pkts
interface_output_discard_pkts	Interface discarded packets	flow.interface-output-discard-pkts
interface_output_errors	Interface output errors	flow.interface-output-errors
interface_promiscuous_mode	Interface promiscuous mode	flow.interface-promiscuous
dot3_stats_alignment_errs	Frames received that are not an integral number of octets in length and do not pass the FCS check	sflow.dot3StatsAlignmentErrors
dot3_stats_fcs_errs	Frames received that are an integral number of octets in length but do not pass the FCS check	sflow.dot3StatsFCSErrors
dot3_stats_single_collision_frames	Count of transmitted frames on a particular interface for which transmission is inhibited by exactly one collision	sflow.dot3StatsSingleCollisionFrames
dot3_stats_multi_collision_frames	Count of transmitted frames on a particular interface for which transmission is inhibited by more than one collision	sflow.dot3StatsMultipleCollisionFrames
dot3_stats_sqe_test_errors	Count of times that the SQE TEST ERROR message is generated by the PLS sublayer for a particular interface	sflow.dot3StatsSQETestErrors
dot3_stats_deferred_transmissions	Count of frames for which the first transmission attempt on a particular interface is delayed because the medium is busy	sflow.dot3StatsDeferredTransmissions
dot3_stats_late_collisions	Number of times that a collision is detected on a particular interface later than 512 bit-times into the transmission of a packet	sflow.dot3StatsLateCollisions
dot3_stats_excessive_collisions	Count of frames for which transmission on a particular interface fails due to excessive collisions	sflow.dot3StatsExcessiveCollisions
dot3_stats_internal_mac_tranmit_errors	Count of frames for which transmission on a particular interface fails due to an internal MAC sublayer transmit error	sflow.dot3StatsInternalMacTransmitErrors
dot3_stats_carrier_sense_errors	Number of times that the carrier sense condition was lost or never asserted when attempting to transmit a frame	sflow.dot3StatsCarrierSenseErrors
dot3_stats_frame_too_longs	Count of frames received on a particular interface that exceed the maximum permitted frame size	sflow.dot3StatsFrameTooLongs
dot3_stats_internal_mac_receive_errors	Count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error	sflow.dot3StatsInternalMacReceiveErrors
dot3_stats_symbol_errors	Number of times there was an invalid data symbol when a valid carrier was present on a particular interface	sflow.dot3StatsSymbolErrors
dot5_stats_line_errors	Count of tokens or frames with E bit set to zero and there is J or K bit between the SD and the ED or there is an FCS error	sflow.dot5StatsLineErrors
dot5_stats_burst_errors	Count of absence of transitions for five half-bit timers	sflow.dot5StatsBurstErrors
dot5_stats_ac_errors	Count of errors resulted by station that cannot set the AC bits properly	sflow.dot5StatsACErrors
dot5_stats_abort_trans_errors	Count of errors resulting from an abort delimiter while transmitting	sflow.dot5StatsAbortTransErrors
dot5_stats_internal_errors	Count of internal errors	sflow.dot5StatsInternalErrors
dot5_stats_lost_frame_errors	Count of errors resulting from TRR timer expiry	sflow.dot5StatsLostFrameErrors
dot5_stats_recv_congestion	Count of errors resulting from no available buffer space or congestion	sflow.dot5StatsReceiveCongestions
dot5_stats_frame_copy_errs	Count of errors resulting from FS field A bits set to 1	sflow.dot5StatsFrameCopiedErrors
dot5_stats_token_errs	Count of errors resulting from a condition that needs a token transmitted	sflow.dot5StatsTokenErrors
dot5_stats_soft_errs	Count of Soft Errors the interface has detected	sflow.dot5StatsSoftErrors
dot5_stats_hard_errs	Number of times this interface has detected an immediately recoverable fatal error	sflow.dot5StatsHardErrors
dot5_stats_signal_loss	Number of times this interface has detected the loss of signal condition from the ring	sflow.dot5StatsSignalLoss
dot5_stats_transmit_beacons	Number of times this interface has transmitted a beacon frame	sflow.dot5StatsTransmitBeacons
dot5_stats_recoverys	Number of Claim Token MAC frames received or transmitted after the interface has received a Ring Purge MAC frame	sflow.dot5StatsRecoverys
dot5_stats_lobe_wires	Number of times times the interface has detected an open or short circuit in the lobe data path	sflow.dot5StatsLobeWires
dot5_stats_removes	Number of times the interface has received a Remove Ring Station MAC frame request	sflow.dot5StatsRemoves
dot5_stats_singles	Number of times the interface has sensed that it is the only station on the ring	sflow.dot5StatsSingles
dot5_stats_freq_errs	Number of times the interface has detected that the frequency of the incoming signal differs from the expected frequency by more than that specified by the IEEE 802.5 standard	sflow.dot5StatsFreqErrors
dot12_in_high_priority_frames	Count of high priority frames that have been received on this interface	sflow.dot12InHighPriorityFrames
dot12_in_high_priority_octets	Count of number of octets contained in high priority frames that have been received on this interface	sflow.dot12InHighPriorityOctets
dot12_in_norm_priority_frames	Count of normal priority frames that have been received on this interface	sflow.dot12InNormPriorityFrames
dot12_in_norm_priority_octets	Count of number of octets contained in normal priority frames that have been received on this interface	sflow.dot12InNormPriorityOctets
dot12_in_ipm_errs	Count of number of frames that have been received on this interface with an invalid packet marker and no PMI errors	sflow.dot12InIPMErrors
dot12_in_oversize_frames_errs	Count of oversize frames received on this interface	sflow.dot12InOversizeFrameErrors
dot12_in_data_errs	Count of oversize frames received on this interface	sflow.dot12InDataErrors
dot12_in_null_address_frames	Count of null addressed frames received on this interface	sflow.dot12InNullAddressedFrames
dot12_out_high_priority_frames	Count of high priority frames successfully transmitted out	sflow.dot12OutHighPriorityFrames
dot12_out_high_priority_octets	Count of octets of high priority frames successfully transmitted out	sflow.dot12OutHighPriorityOctetss
dot12_transition_trainings	Count of the number of times this interface has entered the training state	sflow.dot12TransitionIntoTrainings
dot12_hc_in_high_priority_octets	Count of the number of octets contained in high priority frames that have been received on this interface	sflow.dot12HCInHighPriorityOctets
dot12_hc_in_norm_priority_octets	Count of the number of octets contained in normal priority frames that have been received on this interface	sflow.dot12HCInNormPriorityOctets
dot12_hc_out_high_priority_octets	Count of the number of octets contained in high priority frames that have been send out of this interface	sflow.dot12HCOutHighPriorityOctets
vlan_id	Vlan Id	flow.vlan-id
vlan_octets	Count of octets	sflow.vlanOctets
vlan_ucast_pkts	Count of uni-cast packets	sflow.vlan-ucast-packets
vlan_multi_cast_pkts	Count of multi-cast packets	sflow.vlan-multicast-packets
vlan_broad_cast_pkts	Count of broadcast packets	sflow.vlan-broadcast-packets
vlan_discards	Count of discards	sflow.vlanDiscards
cpu_util_5s	5 second average CPU utilization	sflow.cpu_percent_5s
cpu_util_1m	1 minute average CPU utilization	sflow.cpu_percent_1m
cpu_util_5m	5 minute average CPU utilization	sflow.cpu_percent_5m
total_mem	Total memory(in bytes)	sflow.total-mem
free_mem	Free memory(in bytes)	sflow.free-mem
dest_vlan	VLAN identifier of outgoing frame	netflow.dest-vlan
dest_vlan_priority	802.ip priority of outgoing frame	netflow.dest-vlan_priority
src_vlan	VLAN identifier of incoming frame	netflow.src-vlan
src_vlan_priority	802.ip priority of incoming frame	netflow.src-vlan_priority
sflow_elements	Key Value pairs	sflow.elements
event_name	Name of event	flow.event-name