Flow Protocols
If you configure traffic with VLAN-ID, you must configure for both traffic directions. Otherwise you may experience a mismatch of VLANs in the TCP streams, which can cause queue overflow errors and traffic loss.
NetFlow
Name | Description | Term |
---|---|---|
app | Specifies the name of an application | netflow.app-name |
app_tag | Application ID | netflow.app-tag |
bgp_nxt_hop_ip | IP address of the next (adjacent) BGP hop | netflow.bgp-nexthop-address |
bytes | Total number of Layer 3 bytes in the flow | netflow.bytes |
bytes_in | Incoming counter for number of bytes associated with an IP Flow | netflow.cs-bytes |
bytes_out | Outgoing counter for number of bytes associated with an IP Flow | netflow.sc-bytes |
channel | Identifier of the 802.11 (Wi-Fi) channel | netflow.wlanChannelId |
dest_ip | Destination address of flow | flow.s-ip |
dest_ip_prefix | Destination address prefix | netflow.destinationIPPrefix |
dest_mac | Server packets MAC address in hexadecimal format | flow.s-mac |
dest_mask | Number of contiguous bits that are relevant in the destination ip prefix | netflow.dest-mask |
dest_port | Destination port number of flow | flow.s-port |
dest_sysnum | System number of destination for this flow | netflow.s-sysnum |
drop_octet_count | Number of octets since the previous report (if any) of this Flow dropped by packet treatment | netflow.droppedOctetDeltaCount |
drop_octet_total_count | Number of octets of this Flow dropped by packet treatment | netflow.droppedOctetTotalCount |
drop_packet_count | Number of packets since the previous report (if any) of this Flow dropped by packet treatment | netflow.droppedPacketDeltaCount |
drop_pkt_total_count | Number of packets of this Flow dropped by packet treatment | netflow.droppedPacketTotalCount |
egress_broadcast_pkt_count | Total number of outgoing unicast packets | netflow.egressBroadcastPacketTotalCount |
egress_interface | Networking device's physical interface (example, a switch port) where packets of this flow are being sent | netflow.egressPhysicalInterface |
egress_itf_type | Type of interface where packets of this Flow are being sent | netflow.egressInterfaceType |
egress_unicast_pkt_count | Total number of outgoing unicast packets | netflow.egressUnicastPacketTotalCount |
egress_vlan | Virtual LAN identifier associated with egress interface | netflow.dest-vlan |
event_name | Name of event | flow.event-name |
export_process_id | Identifier of an Exporting Process that is unique per IPFIX Device | netflow.exportingProcessId |
exporter_ip | IP address of device that generated flow | netflow.exporterIPAddress |
firewall_event | Indicates a firewall event | netflow.firewallEvent |
flow_dir | The direction of the Flow at observation point | flow.direction |
flow_duration_micro | The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. | netflow.flowDurationMicroseconds |
flow_duration_milli | The difference in time between the first observed packet of this Flow and the last observed packet of this Flow | netflow.flowDurationMilliseconds |
flow_end_reason | Reason for Flow termination | flow.end-reason |
flow_end_time | The absolute timestamp of the last packet of this Flow. | time.epoch-time-end |
flow_end_time_micro | The absolute timestamp of the last packet of this Flow. | netflow.flowEndMicroseconds |
flow_end_time_milli | The absolute timestamp of the last packet of this Flow. | netflow.flowEndMilliseconds |
flow_end_time_nano | The absolute timestamp of the last packet of this Flow. | netflow.flowEndNanoseconds |
flow_id | Identifier of a Flow that is unique within an Observation Domain | netflow.flowId |
flow_label_ipv6 | IPv6 Flow Label field | flow.ipv6-flow-label |
flow_start_time | The absolute timestamp of the first packet of this Flow | time.epoch-time |
flow_start_time_micro | The absolute timestamp of the first packet of this Flow | netflow.flowStartMicroseconds |
flow_start_time_milli | The absolute timestamp of the first packet of this Flow | netflow.flowStartMilliseconds |
flow_start_time_nano | The absolute timestamp of the first packet of this Flow | netflow.flowStartNanoseconds |
fwd_status | Forwarding status of the flow | netflow.forward-status |
gre_key | GRE key, identifying an individual traffic flow within a tunnel | netflow.greKey |
ignored_octet_count | Total number of octets that the Metering Process did not process since the Metering Process (re-)initialization | netflow.ignoredOctetTotalCount |
ignored_pkt_count | Total number of observed IP packets that the Metering Process did not process since the Metering Process (re-)initialization | netflow.ignoredPacketTotalCount |
ingress_broadcast_pkt_count | Total number of incoming broadcast packets | netflow.ingressBroadcastPacketTotalCount |
ingress_interface | Networking device's physical interface (example, a switch port) where packets of this Flow are being received | netflow.ingressPhysicalInterface |
ingress_itf_type | Type of interface where packets of this Flow are being received | netflow.ingressInterfaceType |
ingress_multicast_pkt_count | Total number of incoming multicast packets | netflow.ingressMulticastPacketTotalCount |
ingress_unicast_pkt_count | Total number of incoming unicast packets | netflow.ingressUnicastPacketTotalCount |
ingress_vlan | Virtual LAN identifier associated with ingress interface | netflow.src-vlan |
input_snmpidx | SNMP index of input interface for this Flow | netflow.input-snmpidx |
interface_name | Short name uniquely describing an interface | netflow.if-name |
ip_frag_flags | Fragmentation properties indicated by flags | ip.fragment-flags |
ip_frag_id | Value of the Identification field in the IP packet header | ip.id |
ipsec_spi | IPSec Security Parameters Index (SPI) | netflow.IPSecSPI |
is_encrypted | Specifies if Application ID is an encrypted networking protocol | netflow.encryptedTechnology |
is_p2p | Specifies if Application ID is based on peer-to-peer technology | netflow.p2pTechnology |
is_tunnel | Specifies if Application ID is used as a tunnel technology | netflow.tunnelTechnology |
layer2_segment_id | Identifier of a layer 2 network segment in an overlay network | netflow.layer2SegmentId |
linecard_id | Identifier of a line card that is unique per IPFIX Device hosting an Observation Point | netflow.lineCardId |
max_ttl | Max TTL value observed for any packet in this Flow | netflow-max-ttl |
metering_process_id | Identifier of a Metering Process that is unique per IPFIX Device | netflow.meteringProcessId |
min_ttl | Minimum TTL value observed for any packet in this Flow | netflow-min-ttl |
mpls_top_label_type | Control protocol that allocated the top-of-stack label | netflow.mpls-top-label-type |
msg_md5_chksum | MD5 checksum of the IPFIX Message containing this record | netflow.messageMD5Checksum |
multicast_flags | Flags to indicate multicast | netflow.isMulticast |
multicast_out_bytes | Outgoing multicast bytes | netflow.multicast-out-bytes |
multicast_out_pkts | Outgoing multicast packets | netflow.multicast-out-packets |
name | desc | term |
nat_event | Indicates a NAT event | netflow.natEvent |
nat_type | Type of NAT treatment | netflow.natType |
netflow_elements | Key Value pairs | netflow.elements |
netflow_version | Netflow Version | netflow.version |
nexthop_addr | Address of the next hop | netflow.nexthop-address |
not_sent_flow_count | Total number of Flow Records dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process | netflow.notSentFlowTotalCount |
not_sent_octet_count | Total number of octets dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process | netflow.notSentOctetTotalCount |
not_sent_pkt_count | Total number of packets dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process | netflow.notSentPacketTotalCount |
num_flows | Netflow number of Flows | netflow.num-flows |
observation_domain_id | Identifier of Observation Domain that is locally unique to an Exporting Process | netflow.observationDomainId |
observation_point_id | Identifier of an Observation Point that is unique per Observation Domain | netflow.observationPointId |
obsv_flow_count | Total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization | netflow.observedFlowTotalCount |
output_snmpidx | SNMP index of output interface for this Flow | netflow.output-snmpidx |
packets | Total number of packets in the Flow | flow.packets |
packets_in | Incoming counter for number of packets associated with an IP Flow | netflow.cs-packets |
packets_out | Outgoing counter for number of packets associated with an IP Flow | netflow.sc-packets |
perm_cs_bytes | Running byte counter for a permanent Flow(incoming) | netflow.perm-bytes |
perm_cs_pkts | Running packet counter for a permanent Flow(incoming) | netflow.perm-packets |
port_id | Identifier of line port that is unique per IPFIX Device hosting an Observation Point | netflow.portId |
post_dest_mac | Modified destination mac address caused by a middlebox function | netflow.post-dest-mac |
post_octet_count | Modified total octet count caused by a middlebox function after the packet passed the Observation Point. | netflow.postOctetTotalCount |
post_pkt_count | Modified total packet count caused by a middlebox function after the packet passed the Observation Point. | netflow.postPacketTotalCount |
post_src_mac | Modified source mac address caused by a middlebox function | netflow.post-src-mac |
protoid | IP protocol type | ip.protoid |
sampling_pkt_interval | Number of packets that are consecutively sampled | netflow.samplingPacketInterval |
selector_algorithm | Packet selection methods applied | netflow.selectorAlgorithm |
selector_id | Unique identifier associated with Selector | netflow.selectorId |
selector_name | Name of a selector identified by a selectorID | netflow.selectorName |
seqnumber | Netflow sequence number | netflow.flow-sequence |
src_ip | Source address of Flow | flow.c-ip |
src_ip_prefix | Source address prefix | netflow.sourceIPPrefix |
src_mac | Client packets MAC address in hexadecimal format | flow.c-mac |
src_mask | Number of contiguous bits that are relevant in the source IP prefix | netflow.src-mask |
src_port | Source port number of Flow | flow.c-port |
src_sysnum | System number of source for this Flow | netflow.c-sysnum |
ssid | Service Set Identifier of 802.11 (Wi-Fi) network | netflow.wlanSSID |
sta_ip_addr | IP address of a wireless station | netflow.staIPAddress |
sta_mac_addr | IEEE 802 MAC address of a wireless station (STA). | netflow.staMacAddress |
sys_init_time_milli | The absolute timestamp of the last (re-)initialization of the IPFIX Device. | netflow.systemInitTimeMilliseconds |
tcp_ack_num | The acknowledgement number in the TCP header | netflow.tcpAcknowledgementNumber |
tcp_flags | Cumulative OR of TCP flags for this Flow | netflow.tcp-flags |
tcp_seq_num | The sequence number in the TCP header | netflow.tcpSequenceNumber |
tcp_total_ack_count | Number of packets of this Flow with TCP ACK flag set | netflow.tcpAckTotalCount |
tcp_total_fin_count | Number of packets of this Flow with TCP FIN flag set | netflow.tcpFinTotalCount |
tcp_total_psh_count | Number of packets of this Flow with TCP PSH flag set | netflow.tcpPshTotalCount |
tcp_total_rst_count | Number of packets of this Flow with TCP RST flag set | netflow.tcpRstTotalCount |
tcp_total_syn_count | Number of packets of this Flow with TCP SYN flag set | netflow.tcpSynTotalCount |
tcp_total_urg_count | Number of packets of this Flow with TCP URG flag set | netflow.tcpUrgTotalCount |
tcp_win_size | The window field in the TCP header | netflow.tcpWindowSize |
tcp_window_scale | The scale of the window field in the TCP header | netflow.tcpWindowScale |
template_id | Identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain | netflow.templateId |
time_taken | Duration of Flow | flow.time-taken |
top_label_ip | IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to | netflow.mplsTopLabelIPAddress |
tos | Type of Service | ip.tos |
txn_id | Identifies a transaction within a connection | netflow.connectionTransactionId |
user_name | User name associated with the Flow | netflow.userName |
version | IP version | ip.version |
virtual_station_itf_id | Instance Identifier of the interface to a Virtual Station | netflow.virtualStationInterfaceId |
virtual_station_itf_name | Name of the interface to a Virtual Station | netflow.virtualStationInterfaceName |
virtual_station_name | Name of a Virtual Station | netflow.virtualStationName |
virtual_station_uuid | Unique Identifier of a Virtual Station | netflow.virtualStationUUID |
wtp_mac_addr | IEEE 802 MAC address of a wireless access point | netflow.wtpMacAddress |
sFlow
Name | Description | Term | ||
---|---|---|---|---|
code | ICMP message code | icmp.code | ||
cpu_util_1m | 1 minute average CPU utilization | sflow.cpu_percent_1m | ||
cpu_util_5m | 5 minute average CPU utilization | sflow.cpu_percent_5m | ||
cpu_util_5s | 5 second average CPU utilization | sflow.cpu_percent_5s | ||
dest_charset | Destination character set | sflow.dest-charset | ||
dest_ip | Destination address of flow | flow.s-ip | ||
dest_mac | Server packets MAC address in hexadecimal format | flow.s-mac | ||
dest_path_as_nums | Destination path AS numbers | sflow.dest-path-as-nums | ||
dest_port | Destination port number of flow | flow.s-port | ||
dest_sysnum | System number of destination for this flow | netflow.s-sysnum | ||
dest_user | Destination User | sflow.dest-user | ||
dest_vlan | VLAN identifier of outgoing frame | netflow.dest-vlan | ||
dest_vlan_priority | 802.ip priority of outgoing frame | netflow.dest-vlan_priority | ||
dot12_hc_in_high_priority_octets | Count of the number of octets contained in high priority frames that have been received on this interface | sflow.dot12HCInHighPriorityOctets | ||
dot12_hc_in_norm_priority_octets | Count of the number of octets contained in normal priority frames that have been received on this interface | sflow.dot12HCInNormPriorityOctets | ||
dot12_hc_out_high_priority_octets | Count of the number of octets contained in high priority frames that have been send out of this interface | sflow.dot12HCOutHighPriorityOctets | ||
dot12_in_data_errs | Count of oversize frames received on this interface | sflow.dot12InDataErrors | ||
dot12_in_high_priority_frames | Count of high priority frames that have been received on this interface | sflow.dot12InHighPriorityFrames | ||
dot12_in_high_priority_octets | Count of number of octets contained in high priority frames that have been received on this interface | sflow.dot12InHighPriorityOctets | ||
dot12_in_ipm_errs | Count of number of frames that have been received on this interface with an invalid packet marker and no PMI errors | sflow.dot12InIPMErrors | ||
dot12_in_norm_priority_frames | Count of normal priority frames that have been received on this interface | sflow.dot12InNormPriorityFrames | ||
dot12_in_norm_priority_octets | Count of number of octets contained in normal priority frames that have been received on this interface | sflow.dot12InNormPriorityOctets | ||
dot12_in_null_address_frames | Count of null addressed frames received on this interface | sflow.dot12InNullAddressedFrames | ||
dot12_in_oversize_frames_errs | Count of oversize frames received on this interface | sflow.dot12InOversizeFrameErrors | ||
dot12_out_high_priority_frames | Count of high priority frames successfully transmitted out | sflow.dot12OutHighPriorityFrames | ||
dot12_out_high_priority_octets | Count of octets of high priority frames successfully transmitted out | sflow.dot12OutHighPriorityOctetss | ||
dot12_transition_trainings | Count of the number of times this interface has entered the training state | sflow.dot12TransitionIntoTrainings | ||
dot3_stats_alignment_errs | Frames received that are not an integral number of octets in length and do not pass the FCS check | sflow.dot3StatsAlignmentErrors | ||
dot3_stats_carrier_sense_errors | Number of times that the carrier sense condition was lost or never asserted when attempting to transmit a frame | sflow.dot3StatsCarrierSenseErrors | ||
dot3_stats_deferred_transmissions | Count of frames for which the first transmission attempt on a particular interface is delayed because the medium is busy | sflow.dot3StatsDeferredTransmissions | ||
dot3_stats_excessive_collisions | Count of frames for which transmission on a particular interface fails due to excessive collisions | sflow.dot3StatsExcessiveCollisions | ||
dot3_stats_fcs_errs | Frames received that are an integral number of octets in length but do not pass the FCS check | sflow.dot3StatsFCSErrors | ||
dot3_stats_frame_too_longs | Count of frames received on a particular interface that exceed the maximum permitted frame size | sflow.dot3StatsFrameTooLongs | ||
dot3_stats_internal_mac_receive_errors | Count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error | sflow.dot3StatsInternalMacReceiveErrors | ||
dot3_stats_internal_mac_tranmit_errors | Count of frames for which transmission on a particular interface fails due to an internal MAC sublayer transmit error | sflow.dot3StatsInternalMacTransmitErrors | ||
dot3_stats_late_collisions | Number of times that a collision is detected on a particular interface later than 512 bit-times into the transmission of a packet | sflow.dot3StatsLateCollisions | ||
dot3_stats_multi_collision_frames | Count of transmitted frames on a particular interface for which transmission is inhibited by more than one collision | sflow.dot3StatsMultipleCollisionFrames | ||
dot3_stats_single_collision_frames | Count of transmitted frames on a particular interface for which transmission is inhibited by exactly one collision | sflow.dot3StatsSingleCollisionFrames | ||
dot3_stats_sqe_test_errors | Count of times that the SQE TEST ERROR message is generated by the PLS sublayer for a particular interface | sflow.dot3StatsSQETestErrors | ||
dot3_stats_symbol_errors | Number of times there was an invalid data symbol when a valid carrier was present on a particular interface | sflow.dot3StatsSymbolErrors | ||
dot5_stats_abort_trans_errors | Count of errors resulting from an abort delimiter while transmitting | sflow.dot5StatsAbortTransErrors | ||
dot5_stats_ac_errors | Count of errors resulted by station that cannot set the AC bits properly | sflow.dot5StatsACErrors | ||
dot5_stats_burst_errors | Count of absence of transitions for five half-bit timers | sflow.dot5StatsBurstErrors | ||
dot5_stats_frame_copy_errs | Count of errors resulting from FS field A bits set to 1 | sflow.dot5StatsFrameCopiedErrors | ||
dot5_stats_freq_errs | Number of times the interface has detected that the frequency of the incoming signal differs from the expected frequency by more than that specified by the IEEE 802.5 standard | sflow.dot5StatsFreqErrors | ||
dot5_stats_hard_errs | Number of times this interface has detected an immediately recoverable fatal error | sflow.dot5StatsHardErrors | ||
dot5_stats_internal_errors | Count of internal errors | sflow.dot5StatsInternalErrors | ||
dot5_stats_line_errors | Count of tokens or frames with E bit set to zero and there is J or K bit between the SD and the ED or there is an FCS error | sflow.dot5StatsLineErrors | ||
dot5_stats_lobe_wires | Number of times times the interface has detected an open or short circuit in the lobe data path | sflow.dot5StatsLobeWires | ||
dot5_stats_lost_frame_errors | Count of errors resulting from TRR timer expiry | sflow.dot5StatsLostFrameErrors | ||
dot5_stats_recoverys | Number of Claim Token MAC frames received or transmitted after the interface has received a Ring Purge MAC frame | sflow.dot5StatsRecoverys | ||
dot5_stats_recv_congestion | Count of errors resulting from no available buffer space or congestion | sflow.dot5StatsReceiveCongestions | ||
dot5_stats_removes | Number of times the interface has received a Remove Ring Station MAC frame request | sflow.dot5StatsRemoves | ||
dot5_stats_signal_loss | Number of times this interface has detected the loss of signal condition from the ring | sflow.dot5StatsSignalLoss | ||
dot5_stats_singles | Number of times the interface has sensed that it is the only station on the ring | sflow.dot5StatsSingles | ||
dot5_stats_soft_errs | Count of Soft Errors the interface has detected | sflow.dot5StatsSoftErrors | ||
dot5_stats_token_errs | Count of errors resulting from a condition that needs a token transmitted | sflow.dot5StatsTokenErrors | ||
dot5_stats_transmit_beacons | Number of times this interface has transmitted a beacon frame | sflow.dot5StatsTransmitBeacons | ||
ethernet_pkt_type | Ethernet packet type | sflow.ethernet-packet-type | ||
event_name | Name of event | flow.event-name | ||
exporter_ip | IP address of device that generated flow | netflow.exporterIPAddress | ||
free_mem | Free memory(in bytes) | sflow.free-mem | ||
gateway_communities | Gateway communities | sflow.gateway-communities | ||
http_host | Host field for HTTP | http.host | ||
http_url | URL associated with the flow | http.uri | ||
input_snmpidx | SNMP index of input interface for this flow | netflow.input-snmpidx | ||
interface_direction | Interface Direction | flow.interface-direction | ||
interface_index | Network interface index | flow.interface-index | ||
interface_input_broad_pkts | Interface broadcast packets | flow.interface-input-broad-pkts | ||
interface_input_discard_pkts | Interface discarded packets | flow.interface-input-discard-pkts | ||
interface_input_errors | Interface input errors | flow.interface-input-errors | ||
interface_input_multi_pkts | Interface multicast packets | flow.interface-input-multi-pkts | ||
interface_input_octets | Interface input octets | flow.interface-input-octets | ||
interface_input_pkts | Interface input packets | flow.interface-input-pkts | ||
interface_input_unk_proto_pkts | Interface input unknown protocol packets | flow.interface-input-unk-protos | ||
interface_name | Name of network interface | flow.interface-name | ||
interface_output_broad_pkts | Interface broadcast packets | flow.interface-output-broad-pkts | ||
interface_output_discard_pkts | Interface discarded packets | flow.interface-output-discard-pkts | ||
interface_output_errors | Interface output errors | flow.interface-output-errors | ||
interface_output_multi_pkts | Interface multicast packets | flow.interface-output-multi-pkts | ||
interface_output_octets | Interface output octets | flow.interface-output-octets | ||
interface_output_pkts | Interface output packets | flow.interface-output-pkts | ||
interface_promiscuous_mode | Interface promiscuous mode | flow.interface-promiscuous | ||
interface_speed | Network interface speed | flow.interface-speed | ||
interface_status | Interface status | flow.interface-status | ||
interface_type | Network interface type | flow.interface-type | ||
ip_len | Length of the IP packet | ip.packet-len | ||
mpls_ftn_desc | MPLS FTN description | sflow.mpls-ftn-desc | ||
mpls_ftn_mask | MPLS FTN mask | sflow.mpls-ftn-mask | ||
mpls_in_label | Entries for MPLS label stack | sflow.in-mpls-label | ||
mpls_out_label | Entries for MPLS label stack | sflow.out-mpls-label | ||
name | desc | term | ||
nat_dest_ip | Modified ip address value caused by NAT | netflow.postNATDestinationIPAddress | ||
nat_src_ip | Modified ip address value caused by NAT | netflow.postNATSourceIPAddress | ||
next_hop_address | IP address of the next hop router | netflow.nexthop-address | ||
orig_frame_len | sFlow Original length of packet before sampling | sflow.frame-length | ||
output_snmpidx | SNMP index of output interface for this flow | netflow.output-snmpidx | ||
packets | Total number of packets in the flow | flow.packets | ||
peer_as_num | Autonomous system (AS) number of source peer | sflow.peer-as-num | ||
protoid | IP protocol type | ip.protoid | ||
route_local_pref | Local Pref | sflow.route-localpref | ||
router_as_num | Autonomous system (AS) number of the Router | sflow.router-as-num | ||
seqnumber | sFlow sequence number | sflow.flow-sequence | ||
sflow_dropped_pkts | Dropped packets | sflow.dropped-pkts | ||
sflow_elements | Key Value pairs | sflow.elements | ||
sflow_header_protocol | sFlow raw packet header protocol | sflow.header-protocol | ||
sflow_input_itf_index | Interface packet was received on | sflow.input-interface-index | ||
sflow_output_itf_index | Interface packet was sent on | sflow.output-interface-index | ||
sflow_sample_pool | Number of packets sampled | sflow.sample-pool | ||
sflow_sampling_rate | sFlow sampling rate | sflow.sampling-rate | ||
sflow_version | sFlow Version | sflow.version | ||
src_charset | Source character set | sflow.src-charset | ||
src_ip | Source address of flow | flow.c-ip | ||
src_mac | Client packets MAC address in hexadecimal format | flow.c-mac | ||
src_port | Source port number of flow | flow.c-port | ||
src_sysnum | System number of source for this flow | netflow.c-sysnum | ||
src_user | Source User | sflow.src-user | ||
src_vlan | VLAN identifier of incoming frame | netflow.src-vlan | ||
src_vlan_priority | 802.ip priority of incoming frame | netflow.src-vlan_priority | ||
stripped_octets | Number of octets removed | sflow.stripped-octets | ||
stripped_vlan_tags | List of stripped 802.1Q TPID/TCI layers | sflow.vlan-tags | ||
tcp_flags | Cumulative OR of TCP flags for this flow | netflow.tcp-flags | ||
time_taken | Duration of flow | flow.time-taken | ||
tos | Type of Service | ip.tos | ||
total_mem | Total memory(in bytes) | sflow.total-mem | ||
tunnel_cos | Tunnel COS value | sflow.tunnel-cos | ||
tunnel_id | Tunnel Identifier | sflow.tunnel-id | ||
tunnel_name | Tunnel name | sflow.tunnel-name | ||
type | ICMP message type | icmp.type | ||
url_direction | Direction associated with the URL 0 - source / 1 - destination | flow.direction | ||
vc_inst_id | VC instance identifier | sflow.vc-id | ||
vc_inst_name | VC instance name | sflow.vc-instance-name | ||
vc_label_cos | VC label COS value | sflow.vc-label-cos | ||
vlan_broad_cast_pkts | Count of broadcast packets | sflow.vlan-broadcast-packets | ||
vlan_discards | Count of discards | sflow.vlanDiscards | ||
vlan_id | Vlan Id, with multiple vlan tags, vlan_id is the outermost tag. | flow.vlan-id | ||
vlad_tags | All VLAN tags collected from 802.1Q and 802.1ad headers. | flow.vlan-tags | ||
vlan_multi_cast_pkts | Count of multi-cast packets | sflow.vlan-multicast-packets | ||
vlan_octets | Count of octets | sflow.vlanOctets | ||
vlan_ucast_pkts | Count of uni-cast packets | sflow.vlan-ucast-packets |
File Service |
This documentation applies to the following versions of Splunk Stream™: 8.0.1, 8.0.2, 8.1.0, 8.1.1, 8.1.3
Feedback submitted, thanks!