Version: 7.3

Netflow IEs

NetObserv Flow supports Netflow versions 1, 5, 6, 7 and 9 records.

Netflow v1

NetObserv Flow supports 14 unique Netflow v1 information elements (IE).

Name	Community	Basic	Standard	Premium
dOctets	✓	✓	✓	✓
dPkts	✓	✓	✓	✓
dstaddr	✓	✓	✓	✓
dstport	✓	✓	✓	✓
First	✓	✓	✓	✓
input	✓	✓	✓	✓
Last	✓	✓	✓	✓
nexthop	✓	✓	✓	✓
output	✓	✓	✓	✓
prot	✓	✓	✓	✓
srcaddr	✓	✓	✓	✓
srcport	✓	✓	✓	✓
tcp_flags	✓	✓	✓	✓
tos	✓	✓	✓	✓

Netflow v5

NetObserv Flow support 18 unique Netflow v5 information elements (IE).

Name	Community	Basic	Standard	Premium
dOctets	✓	✓	✓	✓
dPkts	✓	✓	✓	✓
dst_as	✓	✓	✓	✓
dst_mask	✓	✓	✓	✓
dstaddr	✓	✓	✓	✓
dstport	✓	✓	✓	✓
First	✓	✓	✓	✓
input	✓	✓	✓	✓
Last	✓	✓	✓	✓
nexthop	✓	✓	✓	✓
output	✓	✓	✓	✓
prot	✓	✓	✓	✓
src_as	✓	✓	✓	✓
src_mask	✓	✓	✓	✓
srcaddr	✓	✓	✓	✓
srcport	✓	✓	✓	✓
tcp_flags	✓	✓	✓	✓
tos	✓	✓	✓	✓

Netflow v6

NetObserv Flow support 18 unique Netflow v6 information elements (IE).

Name	Community	Basic	Standard	Premium
dOctets	✓	✓	✓	✓
dPkts	✓	✓	✓	✓
dst_as	✓	✓	✓	✓
dst_mask	✓	✓	✓	✓
dstaddr	✓	✓	✓	✓
dstport	✓	✓	✓	✓
First	✓	✓	✓	✓
input	✓	✓	✓	✓
Last	✓	✓	✓	✓
nexthop	✓	✓	✓	✓
output	✓	✓	✓	✓
prot	✓	✓	✓	✓
src_as	✓	✓	✓	✓
src_mask	✓	✓	✓	✓
srcaddr	✓	✓	✓	✓
srcport	✓	✓	✓	✓
tcp_flags	✓	✓	✓	✓
tos	✓	✓	✓	✓

Netflow v7

NetObserv Flow support 19 unique Netflow v7 information elements (IE).

Name	Community	Basic	Standard	Premium
dOctets	✓	✓	✓	✓
dPkts	✓	✓	✓	✓
dst_as	✓	✓	✓	✓
dst_mask	✓	✓	✓	✓
dstaddr	✓	✓	✓	✓
dstport	✓	✓	✓	✓
First	✓	✓	✓	✓
input	✓	✓	✓	✓
ipv4RouterSc	✓	✓	✓	✓
Last	✓	✓	✓	✓
nexthop	✓	✓	✓	✓
output	✓	✓	✓	✓
prot	✓	✓	✓	✓
src_as	✓	✓	✓	✓
src_mask	✓	✓	✓	✓
srcaddr	✓	✓	✓	✓
srcport	✓	✓	✓	✓
tcp_flags	✓	✓	✓	✓
tos	✓	✓	✓	✓

Netflow v9

NetObserv Flow supports over 1500 unique Netflow v9 information elements (IE).

PEN	Vendor	IEs
0	IANA	462
9	Cisco	581
193	Ericsson	8
4056	StreamCORE	28
4321	Riverbed	12
8712	LANcope (Cisco)	43
25461	Palo Alto Networks	2
33610	FastIP / Boundary	23
35632	ntop	370
40842	A10 Networks	15

Standards-based IEs (PEN: 0)

ID	Name	Community	Basic	Standard	Premium
1	octetDeltaCount	✓	✓	✓	✓
2	packetDeltaCount	✓	✓	✓	✓
3	deltaFlowCount	✓	✓	✓	✓
4	protocolIdentifier	✓	✓	✓	✓
5	ipClassOfService	✓	✓	✓	✓
6	tcpControlBits	✓	✓	✓	✓
7	sourceTransportPort	✓	✓	✓	✓
8	sourceIPv4Address	✓	✓	✓	✓
9	sourceIPv4PrefixLength	✓	✓	✓	✓
10	ingressInterface	✓	✓	✓	✓
11	destinationTransportPort	✓	✓	✓	✓
12	destinationIPv4Address	✓	✓	✓	✓
13	destinationIPv4PrefixLength	✓	✓	✓	✓
14	egressInterface	✓	✓	✓	✓
15	ipNextHopIPv4Address	✓	✓	✓	✓
16	bgpSourceAsNumber	✓	✓	✓	✓
17	bgpDestinationAsNumber	✓	✓	✓	✓
18	bgpNextHopIPv4Address	✓	✓	✓	✓
19	postMCastPacketDeltaCount	✓	✓	✓	✓
20	postMCastOctetDeltaCount	✓	✓	✓	✓
21	flowEndSysUpTime	✓	✓	✓	✓
22	flowStartSysUpTime	✓	✓	✓	✓
23	postOctetDeltaCount	✓	✓	✓	✓
24	postPacketDeltaCount	✓	✓	✓	✓
25	minimumIpTotalLength	✓	✓	✓	✓
26	maximumIpTotalLength	✓	✓	✓	✓
27	sourceIPv6Address	✓	✓	✓	✓
28	destinationIPv6Address	✓	✓	✓	✓
29	sourceIPv6PrefixLength	✓	✓	✓	✓
30	destinationIPv6PrefixLength	✓	✓	✓	✓
31	flowLabelIPv6	✓	✓	✓	✓
32	icmpTypeCodeIPv4	✓	✓	✓	✓
33	igmpType	✓	✓	✓	✓
34	samplingInterval	✓	✓	✓	✓
35	samplingAlgorithm	✓	✓	✓	✓
36	flowActiveTimeout	✓	✓	✓	✓
37	flowIdleTimeout	✓	✓	✓	✓
38	engineType	✓	✓	✓	✓
39	engineId	✓	✓	✓	✓
40	exportedOctetTotalCount	✓	✓	✓	✓
41	exportedMessageTotalCount	✓	✓	✓	✓
42	exportedFlowRecordTotalCount	✓	✓	✓	✓
44	sourceIPv4Prefix	✓	✓	✓	✓
45	destinationIPv4Prefix	✓	✓	✓	✓
46	mplsTopLabelType	✓	✓	✓	✓
47	mplsTopLabelIPv4Address	✓	✓	✓	✓
48	samplerId	✓	✓	✓	✓
49	samplerMode	✓	✓	✓	✓
50	samplerRandomInterval	✓	✓	✓	✓
51	classId	✓	✓	✓	✓
52	minimumTTL	✓	✓	✓	✓
53	maximumTTL	✓	✓	✓	✓
54	fragmentIdentification	✓	✓	✓	✓
55	postIpClassOfService	✓	✓	✓	✓
56	sourceMacAddress	✓	✓	✓	✓
57	postDestinationMacAddress	✓	✓	✓	✓
58	vlanId	✓	✓	✓	✓
59	postVlanId	✓	✓	✓	✓
60	ipVersion	✓	✓	✓	✓
61	flowDirection	✓	✓	✓	✓
62	ipNextHopIPv6Address	✓	✓	✓	✓
63	bgpNextHopIPv6Address	✓	✓	✓	✓
64	ipv6ExtensionHeaders	✓	✓	✓	✓
65	transportPacketLoss `Cisco Legacy`			✓	✓
66	transportUnreachability `Cisco Legacy`			✓	✓
67	transportLatency `Cisco Legacy`			✓	✓
68	dataPoints `Cisco Legacy`			✓	✓
69	variance `Cisco Legacy`			✓	✓
70	mplsTopLabelStackSection		✓	✓	✓
71	mplsLabelStackSection2		✓	✓	✓
72	mplsLabelStackSection3		✓	✓	✓
73	mplsLabelStackSection4		✓	✓	✓
74	mplsLabelStackSection5		✓	✓	✓
75	mplsLabelStackSection6		✓	✓	✓
76	mplsLabelStackSection7		✓	✓	✓
77	mplsLabelStackSection8		✓	✓	✓
78	mplsLabelStackSection9		✓	✓	✓
79	mplsLabelStackSection10		✓	✓	✓
80	destinationMacAddress	✓	✓	✓	✓
81	postSourceMacAddress	✓	✓	✓	✓
82	interfaceName	✓	✓	✓	✓
83	interfaceDescription	✓	✓	✓	✓
84	samplerName	✓	✓	✓	✓
85	octetTotalCount	✓	✓	✓	✓
86	packetTotalCount	✓	✓	✓	✓
87	flagsAndSamplerId	✓	✓	✓	✓
88	fragmentOffset	✓	✓	✓	✓
89	forwardingStatus	✓	✓	✓	✓
90	mplsVpnRouteDistinguisher		✓	✓	✓
91	mplsTopLabelPrefixLength		✓	✓	✓
92	srcTrafficIndex		✓	✓	✓
93	dstTrafficIndex		✓	✓	✓
94	applicationDescription		✓	✓	✓
95	applicationId		✓	✓	✓
96	applicationName		✓	✓	✓
97	subApplicationTag `Cisco Legacy`			✓	✓
98	postIpDiffServCodePoint		✓	✓	✓
99	multicastReplicationFactor		✓	✓	✓
100	className		✓	✓	✓
101	classificationEngineId		✓	✓	✓
102	layer2packetSectionOffset		✓	✓	✓
103	layer2packetSectionSize		✓	✓	✓
104	layer2packetSectionData		✓	✓	✓
105	applicationVersion `Cisco Legacy`			✓	✓
106	applicationVersionName `Cisco Legacy`			✓	✓
107	applicationVendor `Cisco Legacy`			✓	✓
109	subApplicationName `Cisco Legacy`			✓	✓
110	subApplicationDescription `Cisco Legacy`			✓	✓
111	templateParameterRangeEnd `Cisco Legacy`			✓	✓
128	bgpNextAdjacentAsNumber		✓	✓	✓
129	bgpPrevAdjacentAsNumber		✓	✓	✓
130	exporterIPv4Address	✓	✓	✓	✓
131	exporterIPv6Address	✓	✓	✓	✓
132	droppedOctetDeltaCount		✓	✓	✓
133	droppedPacketDeltaCount		✓	✓	✓
134	droppedOctetTotalCount		✓	✓	✓
135	droppedPacketTotalCount		✓	✓	✓
136	flowEndReason		✓	✓	✓
137	commonPropertiesId		✓	✓	✓
138	observationPointId		✓	✓	✓
139	icmpTypeCodeIPv6		✓	✓	✓
140	mplsTopLabelIPv6Address		✓	✓	✓
141	lineCardId		✓	✓	✓
142	portId		✓	✓	✓
143	meteringProcessId		✓	✓	✓
144	exportingProcessId		✓	✓	✓
145	templateId		✓	✓	✓
146	wlanChannelId		✓	✓	✓
147	wlanSSID		✓	✓	✓
148	flowId		✓	✓	✓
149	observationDomainId		✓	✓	✓
150	flowStartSeconds	✓	✓	✓	✓
151	flowEndSeconds	✓	✓	✓	✓
152	flowStartMilliseconds	✓	✓	✓	✓
153	flowEndMilliseconds	✓	✓	✓	✓
154	flowStartMicroseconds	✓	✓	✓	✓
155	flowEndMicroseconds	✓	✓	✓	✓
156	flowStartNanoseconds	✓	✓	✓	✓
157	flowEndNanoseconds	✓	✓	✓	✓
158	flowStartDeltaMicroseconds		✓	✓	✓
159	flowEndDeltaMicroseconds		✓	✓	✓
160	systemInitTimeMilliseconds		✓	✓	✓
161	flowDurationMilliseconds		✓	✓	✓
162	flowDurationMicroseconds		✓	✓	✓
163	observedFlowTotalCount		✓	✓	✓
164	ignoredPacketTotalCount		✓	✓	✓
165	ignoredOctetTotalCount		✓	✓	✓
166	notSentFlowTotalCount		✓	✓	✓
167	notSentPacketTotalCount		✓	✓	✓
168	notSentOctetTotalCount		✓	✓	✓
169	destinationIPv6Prefix		✓	✓	✓
170	sourceIPv6Prefix		✓	✓	✓
171	postOctetTotalCount		✓	✓	✓
172	postPacketTotalCount		✓	✓	✓
173	flowKeyIndicator		✓	✓	✓
174	postMCastPacketTotalCount		✓	✓	✓
175	postMCastOctetTotalCount		✓	✓	✓
176	icmpTypeIPv4		✓	✓	✓
177	icmpCodeIPv4		✓	✓	✓
178	icmpTypeIPv6		✓	✓	✓
179	icmpCodeIPv6		✓	✓	✓
180	udpSourcePort		✓	✓	✓
181	udpDestinationPort		✓	✓	✓
182	tcpSourcePort		✓	✓	✓
183	tcpDestinationPort		✓	✓	✓
184	tcpSequenceNumber		✓	✓	✓
185	tcpAcknowledgementNumber		✓	✓	✓
186	tcpWindowSize		✓	✓	✓
187	tcpUrgentPointer		✓	✓	✓
188	tcpHeaderLength		✓	✓	✓
189	ipHeaderLength		✓	✓	✓
190	totalLengthIPv4		✓	✓	✓
191	payloadLengthIPv6		✓	✓	✓
192	ipTTL		✓	✓	✓
193	nextHeaderIPv6		✓	✓	✓
194	mplsPayloadLength		✓	✓	✓
195	ipDiffServCodePoint		✓	✓	✓
196	ipPrecedence		✓	✓	✓
197	fragmentFlags		✓	✓	✓
198	octetDeltaSumOfSquares		✓	✓	✓
199	octetTotalSumOfSquares		✓	✓	✓
200	mplsTopLabelTTL		✓	✓	✓
201	mplsLabelStackLength		✓	✓	✓
202	mplsLabelStackDepth		✓	✓	✓
203	mplsTopLabelExp		✓	✓	✓
204	ipPayloadLength		✓	✓	✓
205	udpMessageLength		✓	✓	✓
206	isMulticast		✓	✓	✓
207	ipv4IHL		✓	✓	✓
208	ipv4Options		✓	✓	✓
209	tcpOptions		✓	✓	✓
210	paddingOctets		✓	✓	✓
211	collectorIPv4Address		✓	✓	✓
212	collectorIPv6Address		✓	✓	✓
213	exportInterface		✓	✓	✓
214	exportProtocolVersion		✓	✓	✓
215	exportTransportProtocol		✓	✓	✓
216	collectorTransportPort		✓	✓	✓
217	exporterTransportPort		✓	✓	✓
218	tcpSynTotalCount		✓	✓	✓
219	tcpFinTotalCount		✓	✓	✓
220	tcpRstTotalCount		✓	✓	✓
221	tcpPshTotalCount		✓	✓	✓
222	tcpAckTotalCount		✓	✓	✓
223	tcpUrgTotalCount		✓	✓	✓
224	ipTotalLength		✓	✓	✓
225	postNATSourceIPv4Address		✓	✓	✓
226	postNATDestinationIPv4Address		✓	✓	✓
227	postNAPTSourceTransportPort		✓	✓	✓
228	postNAPTDestinationTransportPort		✓	✓	✓
229	natOriginatingAddressRealm		✓	✓	✓
230	natEvent		✓	✓	✓
231	initiatorOctets		✓	✓	✓
232	responderOctets		✓	✓	✓
233	firewallEvent		✓	✓	✓
234	ingressVRFID		✓	✓	✓
235	egressVRFID		✓	✓	✓
236	VRFname		✓	✓	✓
237	postMplsTopLabelExp		✓	✓	✓
238	tcpWindowScale		✓	✓	✓
239	biflowDirection		✓	✓	✓
240	ethernetHeaderLength		✓	✓	✓
241	ethernetPayloadLength		✓	✓	✓
242	ethernetTotalLength		✓	✓	✓
243	dot1qVlanId		✓	✓	✓
244	dot1qPriority		✓	✓	✓
245	dot1qCustomerVlanId		✓	✓	✓
246	dot1qCustomerPriority		✓	✓	✓
247	metroEvcId		✓	✓	✓
248	metroEvcType		✓	✓	✓
249	pseudoWireId		✓	✓	✓
250	pseudoWireType		✓	✓	✓
251	pseudoWireControlWord		✓	✓	✓
252	ingressPhysicalInterface		✓	✓	✓
253	egressPhysicalInterface		✓	✓	✓
254	postDot1qVlanId		✓	✓	✓
255	postDot1qCustomerVlanId		✓	✓	✓
256	ethernetType		✓	✓	✓
257	postIpPrecedence		✓	✓	✓
258	collectionTimeMilliseconds		✓	✓	✓
259	exportSctpStreamId		✓	✓	✓
260	maxExportSeconds		✓	✓	✓
261	maxFlowEndSeconds		✓	✓	✓
262	messageMD5Checksum		✓	✓	✓
263	messageScope		✓	✓	✓
264	minExportSeconds		✓	✓	✓
265	minFlowStartSeconds		✓	✓	✓
266	opaqueOctets		✓	✓	✓
267	sessionScope		✓	✓	✓
268	maxFlowEndMicroseconds		✓	✓	✓
269	maxFlowEndMilliseconds		✓	✓	✓
270	maxFlowEndNanoseconds		✓	✓	✓
271	minFlowStartMicroseconds		✓	✓	✓
272	minFlowStartMilliseconds		✓	✓	✓
273	minFlowStartNanoseconds		✓	✓	✓
274	collectorCertificate		✓	✓	✓
275	exporterCertificate		✓	✓	✓
276	dataRecordsReliability		✓	✓	✓
277	observationPointType		✓	✓	✓
278	newConnectionDeltaCount		✓	✓	✓
279	connectionSumDurationSeconds		✓	✓	✓
280	connectionTransactionId		✓	✓	✓
281	postNATSourceIPv6Address		✓	✓	✓
282	postNATDestinationIPv6Address		✓	✓	✓
283	natPoolId		✓	✓	✓
284	natPoolName		✓	✓	✓
285	anonymizationFlags		✓	✓	✓
286	anonymizationTechnique		✓	✓	✓
287	informationElementIndex		✓	✓	✓
288	p2pTechnology		✓	✓	✓
289	tunnelTechnology		✓	✓	✓
290	encryptedTechnology		✓	✓	✓
294	bgpValidityState		✓	✓	✓
295	IPSecSPI		✓	✓	✓
296	greKey		✓	✓	✓
297	natType		✓	✓	✓
298	initiatorPackets		✓	✓	✓
299	responderPackets		✓	✓	✓
300	observationDomainName		✓	✓	✓
301	selectionSequenceId		✓	✓	✓
302	selectorId		✓	✓	✓
303	informationElementId		✓	✓	✓
304	selectorAlgorithm		✓	✓	✓
305	samplingPacketInterval		✓	✓	✓
306	samplingPacketSpace		✓	✓	✓
307	samplingTimeInterval		✓	✓	✓
308	samplingTimeSpace		✓	✓	✓
309	samplingSize		✓	✓	✓
310	samplingPopulation		✓	✓	✓
311	samplingProbability		✓	✓	✓
312	dataLinkFrameSize		✓	✓	✓
313	ipHeaderPacketSection		✓	✓	✓
314	ipPayloadPacketSection		✓	✓	✓
315	dataLinkFrameSection		✓	✓	✓
316	mplsLabelStackSection		✓	✓	✓
317	mplsPayloadPacketSection		✓	✓	✓
318	selectorIdTotalPktsObserved		✓	✓	✓
319	selectorIdTotalPktsSelected		✓	✓	✓
320	absoluteError		✓	✓	✓
321	relativeError		✓	✓	✓
322	observationTimeSeconds		✓	✓	✓
323	observationTimeMilliseconds		✓	✓	✓
324	observationTimeMicroseconds		✓	✓	✓
325	observationTimeNanoseconds		✓	✓	✓
326	digestHashValue		✓	✓	✓
327	hashIPPayloadOffset		✓	✓	✓
328	hashIPPayloadSize		✓	✓	✓
329	hashOutputRangeMin		✓	✓	✓
330	hashOutputRangeMax		✓	✓	✓
331	hashSelectedRangeMin		✓	✓	✓
332	hashSelectedRangeMax		✓	✓	✓
333	hashDigestOutput		✓	✓	✓
334	hashInitialiserValue		✓	✓	✓
335	selectorName		✓	✓	✓
336	upperCILimit		✓	✓	✓
337	lowerCILimit		✓	✓	✓
338	confidenceLevel		✓	✓	✓
339	informationElementDataType		✓	✓	✓
340	informationElementDescription		✓	✓	✓
341	informationElementName		✓	✓	✓
342	informationElementRangeBegin		✓	✓	✓
343	informationElementRangeEnd		✓	✓	✓
344	informationElementSemantics		✓	✓	✓
345	informationElementUnits		✓	✓	✓
346	privateEnterpriseNumber		✓	✓	✓
347	virtualStationInterfaceId		✓	✓	✓
348	virtualStationInterfaceName		✓	✓	✓
349	virtualStationUUID		✓	✓	✓
350	virtualStationName		✓	✓	✓
351	layer2SegmentId		✓	✓	✓
352	layer2OctetDeltaCount		✓	✓	✓
353	layer2OctetTotalCount		✓	✓	✓
354	ingressUnicastPacketTotalCount		✓	✓	✓
355	ingressMulticastPacketTotalCount		✓	✓	✓
356	ingressBroadcastPacketTotalCount		✓	✓	✓
357	egressUnicastPacketTotalCount		✓	✓	✓
358	egressBroadcastPacketTotalCount		✓	✓	✓
359	monitoringIntervalStartMilliSeconds		✓	✓	✓
360	monitoringIntervalEndMilliSeconds		✓	✓	✓
361	portRangeStart		✓	✓	✓
362	portRangeEnd		✓	✓	✓
363	portRangeStepSize		✓	✓	✓
364	portRangeNumPorts		✓	✓	✓
365	staMacAddress		✓	✓	✓
366	staIPv4Address		✓	✓	✓
367	wtpMacAddress		✓	✓	✓
368	ingressInterfaceType		✓	✓	✓
369	egressInterfaceType		✓	✓	✓
370	rtpSequenceNumber		✓	✓	✓
371	userName		✓	✓	✓
372	applicationCategoryName		✓	✓	✓
373	applicationSubCategoryName		✓	✓	✓
374	applicationGroupName		✓	✓	✓
375	originalFlowsPresent		✓	✓	✓
376	originalFlowsInitiated		✓	✓	✓
377	originalFlowsCompleted		✓	✓	✓
378	distinctCountOfSourceIPAddress		✓	✓	✓
379	distinctCountOfDestinationIPAddress		✓	✓	✓
380	distinctCountOfSourceIPv4Address		✓	✓	✓
381	distinctCountOfDestinationIPv4Address		✓	✓	✓
382	distinctCountOfSourceIPv6Address		✓	✓	✓
383	distinctCountOfDestinationIPv6Address		✓	✓	✓
384	valueDistributionMethod		✓	✓	✓
385	rfc3550JitterMilliseconds		✓	✓	✓
386	rfc3550JitterMicroseconds		✓	✓	✓
387	rfc3550JitterNanoseconds		✓	✓	✓
388	dot1qDEI		✓	✓	✓
389	dot1qCustomerDEI		✓	✓	✓
390	flowSelectorAlgorithm		✓	✓	✓
391	flowSelectedOctetDeltaCount		✓	✓	✓
392	flowSelectedPacketDeltaCount		✓	✓	✓
393	flowSelectedFlowDeltaCount		✓	✓	✓
394	selectorIDTotalFlowsObserved		✓	✓	✓
395	selectorIDTotalFlowsSelected		✓	✓	✓
396	samplingFlowInterval		✓	✓	✓
397	samplingFlowSpacing		✓	✓	✓
398	flowSamplingTimeInterval		✓	✓	✓
399	flowSamplingTimeSpacing		✓	✓	✓
400	hashFlowDomain		✓	✓	✓
401	transportOctetDeltaCount		✓	✓	✓
402	transportPacketDeltaCount		✓	✓	✓
403	originalExporterIPv4Address		✓	✓	✓
404	originalExporterIPv6Address		✓	✓	✓
405	originalObservationDomainId		✓	✓	✓
406	intermediateProcessId		✓	✓	✓
407	ignoredDataRecordTotalCount		✓	✓	✓
408	dataLinkFrameType		✓	✓	✓
409	sectionOffset		✓	✓	✓
410	sectionExportedOctets		✓	✓	✓
411	dot1qServiceInstanceTag		✓	✓	✓
412	dot1qServiceInstanceId		✓	✓	✓
413	dot1qServiceInstancePriority		✓	✓	✓
414	dot1qCustomerSourceMacAddress		✓	✓	✓
415	dot1qCustomerDestinationMacAddress		✓	✓	✓
416	layer2OctetDeltaCount		✓	✓	✓
417	postLayer2OctetDeltaCount		✓	✓	✓
418	postMCastLayer2OctetDeltaCount		✓	✓	✓
419	layer2OctetTotalCount		✓	✓	✓
420	postLayer2OctetTotalCount		✓	✓	✓
421	postMCastLayer2OctetTotalCount		✓	✓	✓
422	minimumLayer2TotalLength		✓	✓	✓
423	maximumLayer2TotalLength		✓	✓	✓
424	droppedLayer2OctetDeltaCount		✓	✓	✓
425	droppedLayer2OctetTotalCount		✓	✓	✓
426	ignoredLayer2OctetTotalCount		✓	✓	✓
427	notSentLayer2OctetTotalCount		✓	✓	✓
428	layer2OctetDeltaSumOfSquares		✓	✓	✓
429	layer2OctetTotalSumOfSquares		✓	✓	✓
430	layer2FrameDeltaCount		✓	✓	✓
431	layer2FrameTotalCount		✓	✓	✓
432	pseudoWireDestinationIPv4Address		✓	✓	✓
433	ignoredLayer2FrameTotalCount		✓	✓	✓
434	mibObjectValueInteger		✓	✓	✓
435	mibObjectValueOctetString		✓	✓	✓
436	mibObjectValueOID		✓	✓	✓
437	mibObjectValueBits		✓	✓	✓
438	mibObjectValueIPAddress		✓	✓	✓
439	mibObjectValueCounter		✓	✓	✓
440	mibObjectValueGauge		✓	✓	✓
441	mibObjectValueTimeTicks		✓	✓	✓
442	mibObjectValueUnsigned		✓	✓	✓
445	mibObjectIdentifier		✓	✓	✓
446	mibSubIdentifier		✓	✓	✓
447	mibIndexIndicator		✓	✓	✓
448	mibCaptureTimeSemantics		✓	✓	✓
449	mibContextEngineID		✓	✓	✓
450	mibContextName		✓	✓	✓
451	mibObjectName		✓	✓	✓
452	mibObjectDescription		✓	✓	✓
453	mibObjectSyntax		✓	✓	✓
454	mibModuleName		✓	✓	✓
455	mobileIMSI		✓	✓	✓
456	mobileMSISDN		✓	✓	✓
457	httpStatusCode		✓	✓	✓
458	sourceTransportPortsLimit		✓	✓	✓
459	httpRequestMethod		✓	✓	✓
460	httpRequestHost		✓	✓	✓
461	httpRequestTarget		✓	✓	✓
462	httpMessageVersion		✓	✓	✓
463	natInstanceID		✓	✓	✓
464	internalAddressRealm		✓	✓	✓
465	externalAddressRealm		✓	✓	✓
466	natQuotaExceededEvent		✓	✓	✓
467	natThresholdEvent		✓	✓	✓
468	httpUserAgent		✓	✓	✓
469	httpContentType		✓	✓	✓
470	httpReasonPhrase		✓	✓	✓
471	maxSessionEntries		✓	✓	✓
472	maxBIBEntries		✓	✓	✓
473	maxEntriesPerUser		✓	✓	✓
474	maxSubscribers		✓	✓	✓
475	maxFragmentsPendingReassembly		✓	✓	✓
476	addressPoolHighThreshold		✓	✓	✓
477	addressPoolLowThreshold		✓	✓	✓
478	addressPortMappingHighThreshold		✓	✓	✓
479	addressPortMappingLowThreshold		✓	✓	✓
480	addressPortMappingPerUserHighThreshold		✓	✓	✓
481	globalAddressMappingHighThreshold		✓	✓	✓
482	vpnIdentifier		✓	✓	✓
483	bgpCommunity		✓	✓	✓
486	bgpExtendedCommunity		✓	✓	✓
489	bgpLargeCommunity		✓	✓	✓

Cisco (PEN: 9)

Name	Basic	Standard	Premium
AAA_USERNAME	✓	✓	✓
application business-relevance	✓	✓	✓
application category name	✓	✓	✓
application delay average	✓	✓	✓
application family name	✓	✓	✓
application group name	✓	✓	✓
application http uri statistics	✓	✓	✓
application media bytes counter	✓	✓	✓
application media bytes counter permanent	✓	✓	✓
application media bytes rate	✓	✓	✓
application media bytes rate per-flow	✓	✓	✓
application media bytes rate per-flow max	✓	✓	✓
application media bytes rate per-flow min	✓	✓	✓
application media event	✓	✓	✓
application media packets counter	✓	✓	✓
application media packets counter permanen	✓	✓	✓
application media packets rate	✓	✓	✓
application media packets rate variation	✓	✓	✓
application media packets rate variation m	✓	✓	✓
application media packets rate variation m	✓	✓	✓
application media packets rate variation s	✓	✓	✓
application set name	✓	✓	✓
application sub category name	✓	✓	✓
application traffic-class	✓	✓	✓
application transaction counter new	✓	✓	✓
application video eMOS compression bitstre	✓	✓	✓
application video eMOS compression network	✓	✓	✓
application video eMOS packet-loss bitstre	✓	✓	✓
application video eMOS packet-loss network	✓	✓	✓
application video frame I counter bytes	✓	✓	✓
application video frame I counter frames	✓	✓	✓
application video frame I counter packets	✓	✓	✓
application video frame I counter packets	✓	✓	✓
application video frame I slice-quantizati	✓	✓	✓
application video frame LTR counter bytes	✓	✓	✓
application video frame LTR counter frames	✓	✓	✓
application video frame LTR counter packet	✓	✓	✓
application video frame LTR counter packet	✓	✓	✓
application video frame LTR slice-quantiza	✓	✓	✓
application video frame NR counter bytes	✓	✓	✓
application video frame NR counter frames	✓	✓	✓
application video frame NR counter packets	✓	✓	✓
application video frame NR counter packets	✓	✓	✓
application video frame NR slice-quantizat	✓	✓	✓
application video frame percentage damaged	✓	✓	✓
application video frame rate	✓	✓	✓
application video frame STR counter bytes	✓	✓	✓
application video frame STR counter frames	✓	✓	✓
application video frame STR counter packet	✓	✓	✓
application video frame STR counter packet	✓	✓	✓
application video frame STR slice-quantiza	✓	✓	✓
application video frame super-P counter by	✓	✓	✓
application video frame super-P counter fr	✓	✓	✓
application video frame super-P counter pa	✓	✓	✓
application video frame super-P counter pa	✓	✓	✓
application video frame super-P slice-quan	✓	✓	✓
application video level-of-motion	✓	✓	✓
application video payload bitrate average	✓	✓	✓
application video payload bitrate fluctuat	✓	✓	✓
application video resolution height last	✓	✓	✓
application video resolution width last	✓	✓	✓
application video scene-complexity	✓	✓	✓
application voice call duration	✓	✓	✓
application voice codec id	✓	✓	✓
application voice concealment-ratio averag	✓	✓	✓
application voice delay end-point	✓	✓	✓
application voice delay round-trip	✓	✓	✓
application voice jitter buffer-overrun	✓	✓	✓
application voice jitter configured initia	✓	✓	✓
application voice jitter configured maximu	✓	✓	✓
application voice jitter configured minimu	✓	✓	✓
application voice jitter configured type	✓	✓	✓
application voice mos conversation	✓	✓	✓
application voice mos listening	✓	✓	✓
application voice number called	✓	✓	✓
application voice number calling	✓	✓	✓
application voice packet conceal-count	✓	✓	✓
application voice play delay current	✓	✓	✓
application voice play delay maximum	✓	✓	✓
application voice play delay minimum	✓	✓	✓
application voice r-factor 1	✓	✓	✓
application voice r-factor 2	✓	✓	✓
application voice router global-call-id	✓	✓	✓
application voice rx bad-packet	✓	✓	✓
application voice rx early-packet count	✓	✓	✓
application voice rx late-packet count	✓	✓	✓
application voice rx out-of-sequence	✓	✓	✓
application voice setup time	✓	✓	✓
application voice sip call-id	✓	✓	✓
appqoe ssl policy action	✓	✓	✓
appqoe ssl service type	✓	✓	✓
appqoe ssl traffic type	✓	✓	✓
art count new connections	✓	✓	✓
art count responses	✓	✓	✓
art count responses histogram bucket1	✓	✓	✓
art count responses histogram bucket2	✓	✓	✓
art count responses histogram bucket3	✓	✓	✓
art count responses histogram bucket4	✓	✓	✓
art count responses histogram bucket5	✓	✓	✓
art count responses histogram bucket6	✓	✓	✓
art count responses histogram bucket7	✓	✓	✓
artClientNetworkTimeLongLivedMaximum	✓	✓	✓
artClientNetworkTimeLongLivedMinimum	✓	✓	✓
artClientpackets	✓	✓	✓
artServerNetworkTimeLongLivedMaximum	✓	✓	✓
artServerNetworkTimeLongLivedMinimum	✓	✓	✓
artServerpackets	✓	✓	✓
audio concealment ratio maximum	✓	✓	✓
audio concealment ratio minimum	✓	✓	✓
audio concealment ratio now	✓	✓	✓
audio concealment time	✓	✓	✓
audio duration clock adjust	✓	✓	✓
audio duration early packet	✓	✓	✓
audio duration late discard	✓	✓	✓
audio duration playout decrease	✓	✓	✓
audio duration playout increase	✓	✓	✓
audio duration receive	✓	✓	✓
audio duration receive voice	✓	✓	✓
audio frame arriving times difference	✓	✓	✓
audio frame arriving times difference vari	✓	✓	✓
audio frame size	✓	✓	✓
audio frames-per-packet	✓	✓	✓
audio g107 codec baseline	✓	✓	✓
audio g107 codec baseline bpl	✓	✓	✓
audio g107 impairment	✓	✓	✓
audio g107 impairment one-way-delay	✓	✓	✓
audio g107 lossRate	✓	✓	✓
audio noise level average	✓	✓	✓
audio noise level configured	✓	✓	✓
audio noise level current	✓	✓	✓
audio noise level maximum	✓	✓	✓
audio noise level minimum	✓	✓	✓
audio packets cs	✓	✓	✓
audio packets ok	✓	✓	✓
audio packets rtp	✓	✓	✓
audio packets scs	✓	✓	✓
audio packets silence	✓	✓	✓
audio rtp fwd out-of-sequence sum	✓	✓	✓
audio rtp jitter ticks	✓	✓	✓
audio rtp packets expected	✓	✓	✓
audio rtp packets lost	✓	✓	✓
audio rtp seconds concealed	✓	✓	✓
audio rtp seconds concealed severe	✓	✓	✓
audio rtp seconds ok	✓	✓	✓
audio snr average	✓	✓	✓
audio snr configured	✓	✓	✓
audio snr current	✓	✓	✓
audio snr maximum	✓	✓	✓
audio snr minimum	✓	✓	✓
audio speech time	✓	✓	✓
AVCSubApplicationValue	✓	✓	✓
bandwidth used	✓	✓	✓
bandwidth used percentage	✓	✓	✓
bgp community	✓	✓	✓
bgp prepend	✓	✓	✓
bw fee	✓	✓	✓
bw percentage	✓	✓	✓
BYTE_RATE	✓	✓	✓
c3pl class cce-id	✓	✓	✓
c3pl class name	✓	✓	✓
c3pl class type	✓	✓	✓
c3pl policy cce-id	✓	✓	✓
c3pl policy name	✓	✓	✓
c3pl policy type	✓	✓	✓
capacity	✓	✓	✓
client network delay average	✓	✓	✓
client throughput average	✓	✓	✓
closed sessions	✓	✓	✓
connection client counter bytes network	✓	✓	✓
connection client counter bytes retransmit	✓	✓	✓
connection client counter packets retransm	✓	✓	✓
connection client ipv4 address	✓	✓	✓
connection client ipv6 address	✓	✓	✓
connection client transport port	✓	✓	✓
connection concurrent-connections	✓	✓	✓
connection delay application max	✓	✓	✓
connection delay application min	✓	✓	✓
connection delay application sum	✓	✓	✓
connection delay network client-to-server	✓	✓	✓
connection delay network client-to-server	✓	✓	✓
connection delay network client-to-server	✓	✓	✓
connection delay network client-to-server	✓	✓	✓
connection delay network long-lived client	✓	✓	✓
connection delay network long-lived to-cli	✓	✓	✓
connection delay network long-lived to-ser	✓	✓	✓
connection delay network to-client max	✓	✓	✓
connection delay network to-client min	✓	✓	✓
connection delay network to-client num-sam	✓	✓	✓
connection delay network to-client sum	✓	✓	✓
connection delay network to-server max	✓	✓	✓
connection delay network to-server min	✓	✓	✓
connection delay network to-server num-sam	✓	✓	✓
connection delay network to-server sum	✓	✓	✓
connection delay response client-to-server	✓	✓	✓
connection delay response client-to-server	✓	✓	✓
connection delay response client-to-server	✓	✓	✓
connection delay response to-server histog	✓	✓	✓
connection delay response to-server max	✓	✓	✓
connection delay response to-server min	✓	✓	✓
connection delay response to-server sum	✓	✓	✓
connection id	✓	✓	✓
connection id long	✓	✓	✓
connection server counter bytes network	✓	✓	✓
connection server counter bytes retransmit	✓	✓	✓
connection server counter packets retransm	✓	✓	✓
connection server ipv4 address	✓	✓	✓
connection server ipv6 address	✓	✓	✓
connection server transport port	✓	✓	✓
connection transaction counter complete	✓	✓	✓
connection transaction duration max	✓	✓	✓
connection transaction duration min	✓	✓	✓
connection transaction duration sum	✓	✓	✓
counter bytes appqoe ssl-de-read	✓	✓	✓
counter bytes appqoe ssl-de-written	✓	✓	✓
counter bytes appqoe ssl-en-read	✓	✓	✓
counter bytes appqoe ssl-en-written	✓	✓	✓
counter bytes appqoe ssl-read	✓	✓	✓
counter bytes appqoe ssl-written	✓	✓	✓
counter bytes rate per-flow	✓	✓	✓
counter bytes rate per-flow max	✓	✓	✓
counter bytes rate per-flow min	✓	✓	✓
counter bytes sdwan dropped long	✓	✓	✓
counter packets appqoe fec-d-pkts	✓	✓	✓
counter packets appqoe fec-r-pkts	✓	✓	✓
counter packets appqoe pkt-dup-d-pkts-dup	✓	✓	✓
counter packets appqoe pkt-dup-d-pkts-orig	✓	✓	✓
counter packets appqoe pkt-dup-r-pkts	✓	✓	✓
counter packets dropped permanent	✓	✓	✓
counter packets rate per-flow	✓	✓	✓
counter packets rate per-flow max	✓	✓	✓
counter packets rate per-flow min	✓	✓	✓
counter packets sdwan pkt-cxp-d-pkts	✓	✓	✓
datalink event	✓	✓	✓
datalink event extended	✓	✓	✓
discard rollup count	✓	✓	✓
drop cause id	✓	✓	✓
drop cause name	✓	✓	✓
egress bw	✓	✓	✓
egress rollup bw	✓	✓	✓
EGRESS_ACL_ID	✓	✓	✓
end timestamp	✓	✓	✓
entrance downgrade	✓	✓	✓
ETAByteDistribution	✓	✓	✓
ETAInitialDataPacketOld	✓	✓	✓
ETASequenceofPktLengthsandTimes	✓	✓	✓
ETTA_INITIAL_DATA_PACKET	✓	✓	✓
ETTA_SEQUENCE_OF_APPLICATION_LENGTHS_AND_TIMES	✓	✓	✓
ETTA_SEQUENCE_OF_PACKET_LENGTHS_AND_TIMES	✓	✓	✓
ETTA_TLS_CIPHER_SUITES	✓	✓	✓
ETTA_TLS_EXTENSION_LENGTHS	✓	✓	✓
ETTA_TLS_EXTENSION_TYPES	✓	✓	✓
ETTA_TLS_EXTENSIONS	✓	✓	✓
ETTA_TLS_KEY_LENGTH	✓	✓	✓
ETTA_TLS_RANDOM	✓	✓	✓
ETTA_TLS_RECORDS	✓	✓	✓
ETTA_TLS_SESSION_ID	✓	✓	✓
ETTA_TLS_VERSION	✓	✓	✓
flow cts switch derived-sgt	✓	✓	✓
flow left time	✓	✓	✓
FW_BLACKOUT_SECS	✓	✓	✓
FW_CONFIGURED_VALUE	✓	✓	✓
FW_ERM_EXT_EVENT	✓	✓	✓
FW_ERM_EXT_EVENT_DESC	✓	✓	✓
FW_EVENT	✓	✓	✓
FW_EVENT_LEVEL	✓	✓	✓
FW_EVENT_LEVEL_ID	✓	✓	✓
FW_EXT_EVENT	✓	✓	✓
FW_EXT_EVENT	✓	✓	✓
FW_EXT_EVENT_DESC	✓	✓	✓
FW_HALFOPEN_CNT	✓	✓	✓
FW_HALFOPEN_HIGH	✓	✓	✓
FW_HALFOPEN_RATE	✓	✓	✓
FW_MAX_SESSIONS	✓	✓	✓
FW_SUMMARY_PKT_CNT	✓	✓	✓
FW_ZONEPAIR_ID	✓	✓	✓
FW_ZONEPAIR_NAME	✓	✓	✓
ingress bw	✓	✓	✓
ingress rollup bw	✓	✓	✓
INGRESS_ACL_ID	✓	✓	✓
interface input fex-node-id	✓	✓	✓
interface output fex-node-id	✓	✓	✓
interface power	✓	✓	✓
iOAM Application metadata	✓	✓	✓
IOAM byte count	✓	✓	✓
IOAM cs0 byte count	✓	✓	✓
IOAM cs0 packet counter	✓	✓	✓
IOAM cs1 byte count	✓	✓	✓
IOAM cs1 packet counter	✓	✓	✓
IOAM cs2 byte count	✓	✓	✓
IOAM cs2 packet counter	✓	✓	✓
IOAM cs3 byte count	✓	✓	✓
IOAM cs3 packet counter	✓	✓	✓
IOAM cs4 byte count	✓	✓	✓
IOAM cs4 packet counter	✓	✓	✓
IOAM cs5 byte count	✓	✓	✓
IOAM cs5 packet counter	✓	✓	✓
IOAM cs6 byte count	✓	✓	✓
IOAM cs6 packet counter	✓	✓	✓
IOAM cs7 byte count	✓	✓	✓
IOAM cs7 packet counter	✓	✓	✓
IOAM duplicate packet counter	✓	✓	✓
iOAM E2E Header	✓	✓	✓
IOAM highest PPC sequence number	✓	✓	✓
IOAM lost packet counter	✓	✓	✓
iOAM my node name	✓	✓	✓
iOAM my node-id	✓	✓	✓
iOAM node-id	✓	✓	✓
iOAM node1 eif id	✓	✓	✓
iOAM node1 id	✓	✓	✓
iOAM node1 in if id	✓	✓	✓
iOAM node2 eif id	✓	✓	✓
iOAM node2 id	✓	✓	✓
iOAM node2 in if id	✓	✓	✓
iOAM node3 eif id	✓	✓	✓
iOAM node3 id	✓	✓	✓
iOAM node3 in if id	✓	✓	✓
iOAM node4 eif id	✓	✓	✓
iOAM node4 id	✓	✓	✓
iOAM node4 in if id	✓	✓	✓
iOAM number of nodes	✓	✓	✓
IOAM packet counter	✓	✓	✓
iOAM Path Map	✓	✓	✓
IOAM reordered packet counter	✓	✓	✓
iOAM sfc invalidated count	✓	✓	✓
iOAM sfc validated count	✓	✓	✓
iOAM sfc-id	✓	✓	✓
IPv4 destination observation node	✓	✓	✓
IPv4 source observation node	✓	✓	✓
IPv6 destination observation node	✓	✓	✓
ipv6 protocol filed	✓	✓	✓
IPv6 source observation node	✓	✓	✓
kth rollup bw	✓	✓	✓
l4r event	✓	✓	✓
l4r event timestamp	✓	✓	✓
l4r server ipv4 address	✓	✓	✓
l4r server ipv6 address	✓	✓	✓
l4r server transport port	✓	✓	✓
link group name	✓	✓	✓
long-term round-trip-time	✓	✓	✓
max egress bw	✓	✓	✓
max ingress bw	✓	✓	✓
metadata clock-rate	✓	✓	✓
metadata global-session-id	✓	✓	✓
metadata multi-party-session-id	✓	✓	✓
misc unsupported	✓	✓	✓
monitor device-type	✓	✓	✓
monitor event	✓	✓	✓
mos below	✓	✓	✓
mos quality	✓	✓	✓
mos total count	✓	✓	✓
mos worst 100	✓	✓	✓
network delay sample	✓	✓	✓
network delay sum	✓	✓	✓
NETWORK_DELAY_AVG network delay average	✓	✓	✓
nvzFlowCoordinatesList	✓	✓	✓
nvzFlowDestinationHostname	✓	✓	✓
nvzFlowDNSSuffix	✓	✓	✓
nvzFlowInterfaceDetailsList	✓	✓	✓
nvzFlowInterfaceIndex	✓	✓	✓
nvzFlowInterfaceInfoUID	✓	✓	✓
nvzFlowInterfaceMac	✓	✓	✓
nvzFlowInterfaceName	✓	✓	✓
nvzFlowInterfaceType	✓	✓	✓
nvzFlowL4ByteCountIn	✓	✓	✓
nvzFlowL4ByteCountOut	✓	✓	✓
nvzFlowLoggedInUser	✓	✓	✓
nvzFlowModuleHashList	✓	✓	✓
nvzFlowModuleNameList	✓	✓	✓
nvzFlowOSEdition	✓	✓	✓
nvzFlowOSName	✓	✓	✓
nvzFlowOSVersion	✓	✓	✓
nvzFlowParentProcessAccount	✓	✓	✓
nvzFlowParentProcessAccountType	✓	✓	✓
nvzFlowParentProcessHash	✓	✓	✓
nvzFlowParentProcessName	✓	✓	✓
nvzFlowProcessAccount	✓	✓	✓
nvzFlowProcessAccountType	✓	✓	✓
nvzFlowProcessHash	✓	✓	✓
nvzFlowProcessName	✓	✓	✓
nvzFlowSystemManufacturer	✓	✓	✓
nvzFlowSystemType	✓	✓	✓
nvzFlowUDID	✓	✓	✓
nvzFlowUserAccountType	✓	✓	✓
ONE_WAY_DELAY pfr one-way-delay	✓	✓	✓
overlay session id input	✓	✓	✓
overlay session id output	✓	✓	✓
packet arrival timestamp	✓	✓	✓
PACKET_RATE	✓	✓	✓
PACKETS_DROPPED	✓	✓	✓
pbhk event	✓	✓	✓
pbhk event timestamp	✓	✓	✓
pbhk mapped ipv4 address	✓	✓	✓
pbhk mapped transport port	✓	✓	✓
pfr br ipv4 address	✓	✓	✓
pfr counter event error traffic-class miti	✓	✓	✓
pfr counter event error traffic-class miti	✓	✓	✓
pfr counter event error traffic-class miti	✓	✓	✓
pfr label identifier	✓	✓	✓
pfr one-way-delay samples	✓	✓	✓
pfr one-way-delay sum	✓	✓	✓
pfr priority	✓	✓	✓
pfr service provider tag identifier	✓	✓	✓
pfr site destination id ipv4	✓	✓	✓
pfr site destination prefix ipv4	✓	✓	✓
pfr site destination prefix ipv6	✓	✓	✓
pfr site destination prefix mask ipv4	✓	✓	✓
pfr site destination prefix mask ipv6	✓	✓	✓
pfr site source id ipv4	✓	✓	✓
pfr site source prefix ipv4	✓	✓	✓
pfr site source prefix ipv6	✓	✓	✓
pfr site source prefix mask ipv4	✓	✓	✓
pfr site source prefix mask ipv6	✓	✓	✓
pfr status	✓	✓	✓
policy qos classification hierarchy	✓	✓	✓
policy qos queue drops	✓	✓	✓
policy qos queue index	✓	✓	✓
reason id	✓	✓	✓
refused sessions	✓	✓	✓
retransmitted packets	✓	✓	✓
routing vrf service	✓	✓	✓
rsvp bw pool	✓	✓	✓
scAccessString	✓	✓	✓
scActiveSubscribers	✓	✓	✓
scAttackId	✓	✓	✓
scAttackIp	✓	✓	✓
scAttackIpProtocol	✓	✓	✓
scAttackMaliciousSessions	✓	✓	✓
scAttackOtherIp	✓	✓	✓
scAttackPortNumber	✓	✓	✓
scAttacks	✓	✓	✓
scAttackSide	✓	✓	✓
scAttackType	✓	✓	✓
scBreachState	✓	✓	✓
scClientPort	✓	✓	✓
scConcurrentSessions	✓	✓	✓
scConfiguredDuration	✓	✓	✓
scDestinationIpSample	✓	✓	✓
scDownstreamVolume	✓	✓	✓
scDuration	✓	✓	✓
scEndTime	✓	✓	✓
scFlavorId	✓	✓	✓
scFlowCloseMode	✓	✓	✓
scFlowContextId	✓	✓	✓
scGeneratorId	✓	✓	✓
scInfoString	✓	✓	✓
scInitiatingSide	✓	✓	✓
scLinkId	✓	✓	✓
scPackageCounterId	✓	✓	✓
scPackageId	✓	✓	✓
scProtocolId	✓	✓	✓
scProtocolSignature	✓	✓	✓
scReason	✓	✓	✓
scReportTime	✓	✓	✓
scSeconds	✓	✓	✓
scServerPort	✓	✓	✓
scServiceGlobalCounterId	✓	✓	✓
scServiceId	✓	✓	✓
scServiceUsageCounterId	✓	✓	✓
scSessionDownstreamVolume	✓	✓	✓
scSessions	✓	✓	✓
scSessionUpstreamVolume	✓	✓	✓
scSkipppedSessions	✓	✓	✓
scSourceIpSample	✓	✓	✓
scSubscriberCounterId	✓	✓	✓
scSubscriberId	✓	✓	✓
scTag	✓	✓	✓
scTimeFrame	✓	✓	✓
scTotalActiveSubscribers	✓	✓	✓
scTrafficProcessorId	✓	✓	✓
scTransactionDurationMillisec	✓	✓	✓
scUpstreamVolume	✓	✓	✓
scZoneId	✓	✓	✓
sdwan preferred-color-not-met	✓	✓	✓
sdwan qos-queue-id	✓	✓	✓
sdwan sla-not-met	✓	✓	✓
server network delay average	✓	✓	✓
server response time average	✓	✓	✓
services pfr class-tag-id	✓	✓	✓
services pfr mc-id	✓	✓	✓
services waas passthrough-reason	✓	✓	✓
services waas segment	✓	✓	✓
session time average	✓	✓	✓
session time maximum	✓	✓	✓
session time minimum	✓	✓	✓
SGT_DESTINATION_NAME	✓	✓	✓
SGT_DESTINATION_TAG	✓	✓	✓
SGT_SOURCE_NAME	✓	✓	✓
SGT_SOURCE_TAG	✓	✓	✓
sip header from uri host ip addr	✓	✓	✓
sip header from uri userinfo user	✓	✓	✓
sip header to uri host ip addr	✓	✓	✓
sip header to uri userinfo user	✓	✓	✓
sip sess duration	✓	✓	✓
sip sess end_reason	✓	✓	✓
sip sess_connected	✓	✓	✓
sip sess_dialed	✓	✓	✓
sip sess_failed	✓	✓	✓
start timestamp	✓	✓	✓
tcpWindowSizeSum	✓	✓	✓
threshold	✓	✓	✓
timestamp interval	✓	✓	✓
timestampAbsoluteMonitoring-intervalEnd	✓	✓	✓
timestampAbsoluteMonitoring-intervalStart	✓	✓	✓
tloc local color	✓	✓	✓
tloc local system ip address	✓	✓	✓
tloc remote color	✓	✓	✓
tloc remote system ip address	✓	✓	✓
tloc table overlay session id	✓	✓	✓
tloc tunnel protocol	✓	✓	✓
transaction time average	✓	✓	✓
transport bytes expected	✓	✓	✓
transport bytes lost	✓	✓	✓
transport bytes lost rate	✓	✓	✓
transport bytes out-of-order	✓	✓	✓
transport destination-port max	✓	✓	✓
transport destination-port min	✓	✓	✓
transport event packet-loss counter	✓	✓	✓
transport event packet-loss counter max	✓	✓	✓
transport event packet-loss counter min	✓	✓	✓
transport event packet-loss counter perman	✓	✓	✓
transport packets expected counter	✓	✓	✓
transport packets expected counter permane	✓	✓	✓
transport packets lost counter	✓	✓	✓
transport packets lost counter max	✓	✓	✓
transport packets lost counter min	✓	✓	✓
transport packets lost counter permanent	✓	✓	✓
transport packets lost rate	✓	✓	✓
transport packets lost rate max	✓	✓	✓
transport packets lost rate min	✓	✓	✓
transport packets out-of-order	✓	✓	✓
transport round-trip-time	✓	✓	✓
transport round-trip-time max	✓	✓	✓
transport round-trip-time min	✓	✓	✓
transport round-trip-time samples	✓	✓	✓
transport round-trip-time sum	✓	✓	✓
transport rtp flow count	✓	✓	✓
transport rtp jitter inter arrival mean	✓	✓	✓
transport rtp jitter inter arrival samples	✓	✓	✓
transport rtp jitter inter arrival sum	✓	✓	✓
transport rtp jitter maximum	✓	✓	✓
transport rtp jitter mean	✓	✓	✓
transport rtp jitter mean sum	✓	✓	✓
transport rtp jitter minimum	✓	✓	✓
transport rtp payload-type	✓	✓	✓
transport rtp sequence-number	✓	✓	✓
transport rtp sequence-number last	✓	✓	✓
transport rtp ssrc	✓	✓	✓
transport source-port max	✓	✓	✓
transport source-port min	✓	✓	✓
transport tcp flow count	✓	✓	✓
transport tcp maximum-segment-size	✓	✓	✓
transport tcp window-size average	✓	✓	✓
transport tcp window-size average sum	✓	✓	✓
transport tcp window-size maximum	✓	✓	✓
transport tcp window-size minimum	✓	✓	✓
transport tcp window-size sum	✓	✓	✓
unresponsive sessions	✓	✓	✓
vxlan flags	✓	✓	✓
vxlan sgt	✓	✓	✓
vxlan vtep input	✓	✓	✓
vxlan vtep output	✓	✓	✓
waas application	✓	✓	✓
waas bytes input	✓	✓	✓
waas bytes output	✓	✓	✓
waas class	✓	✓	✓
waas connection mode	✓	✓	✓
waas dre input	✓	✓	✓
waas dre output	✓	✓	✓
waas lz input	✓	✓	✓
waas lz output	✓	✓	✓
waas optimised bytes	✓	✓	✓
waas original bytes	✓	✓	✓
wireless afd accept bytes	✓	✓	✓
wireless afd accept packets	✓	✓	✓
wireless afd drop bytes	✓	✓	✓
wireless afd drop packets	✓	✓	✓
wlan_id	✓	✓	✓
XLATE_DST_ADDR_IPV4	✓	✓	✓
XLATE_DST_PORT	✓	✓	✓
XLATE_SRC_ADDR_IPV4	✓	✓	✓
XLATE_SRC_PORT	✓	✓	✓

Ericsson (PEN: 193)

Name	Basic	Standard	Premium
NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC	✓	✓	✓
NAT_LOG_FIELD_IDX_CONTEXT_ID	✓	✓	✓
NAT_LOG_FIELD_IDX_CONTEXT_NAME	✓	✓	✓
NAT_LOG_FIELD_IDX_EXT_PORT_FIRST	✓	✓	✓
NAT_LOG_FIELD_IDX_EXT_PORT_LAST	✓	✓	✓
NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR	✓	✓	✓
NAT_LOG_FIELD_IDX_IPV4_INT_ADDR	✓	✓	✓
NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC	✓	✓	✓

StreamCORE (PEN: 4056)

Name	Basic	Standard	Premium
call_direction	✓	✓	✓
codec_in	✓	✓	✓
codec_out	✓	✓	✓
hostname	✓	✓	✓
id_rule_1	✓	✓	✓
id_rule_10	✓	✓	✓
id_rule_2	✓	✓	✓
id_rule_3	✓	✓	✓
id_rule_4	✓	✓	✓
id_rule_5	✓	✓	✓
id_rule_6	✓	✓	✓
id_rule_7	✓	✓	✓
id_rule_8	✓	✓	✓
id_rule_9	✓	✓	✓
mos_lq	✓	✓	✓
net_app_resp_time	✓	✓	✓
net_delay	✓	✓	✓
net_discard	✓	✓	✓
net_jitter	✓	✓	✓
net_loss	✓	✓	✓
rtp_clockrate_in	✓	✓	✓
rtp_clockrate_out	✓	✓	✓
ssl_cn	✓	✓	✓
ssl_org	✓	✓	✓
tcp_retrans_rate	✓	✓	✓
total_app_resp_time	✓	✓	✓
url	✓	✓	✓
wan_rtt	✓	✓	✓

Riverbed (PEN: 4321)

Name	Basic	Standard	Premium
CFE in-path IP Address	✓	✓	✓
CFE TCP Port	✓	✓	✓
FE Type	✓	✓	✓
Outer in-path IP Address	✓	✓	✓
Outer TCP Port	✓	✓	✓
Pass-through Reason	✓	✓	✓
Retransmitted Bytes	✓	✓	✓
Retransmitted Packets	✓	✓	✓
SFE in-path IP Address	✓	✓	✓
SFE TCP Port	✓	✓	✓
TCP Connection RTT	✓	✓	✓
WAN Visibility mode	✓	✓	✓

LANcope, now Cisco (PEN: 8712)

Name	Basic	Standard	Premium
EndpointFlowParentProcessAccount	✓	✓	✓
EndpointFlowParentProcessHash	✓	✓	✓
EndpointFlowParentProcessName	✓	✓	✓
EndpointFlowProcessAccount	✓	✓	✓
EndpointFlowProcessHash	✓	✓	✓
EndpointFlowProcessName	✓	✓	✓
FlowSensorApplicationDetails	✓	✓	✓
FlowSensorApplicationIdentifier	✓	✓	✓
FlowSensorBadFlagBadRST	✓	✓	✓
FlowSensorBadFlagNoACK	✓	✓	✓
FlowSensorBadFlagNoFlag	✓	✓	✓
FlowSensorBadFlagSYNFIN	✓	✓	✓
FlowSensorBadFlagURG	✓	✓	✓
FlowSensorBadFlagXmas	✓	✓	✓
FlowSensorDestinationEmailIn	✓	✓	✓
FlowSensorDestinationEmailInMessages	✓	✓	✓
FlowSensorDestinationEmailInTrys	✓	✓	✓
FlowSensorDestinationEmailOut	✓	✓	✓
FlowSensorDestinationEmailOutMessages	✓	✓	✓
FlowSensorDestinationEmailOutTrys	✓	✓	✓
FlowSensorEmbeddedICMPCode	✓	✓	✓
FlowSensorEmbeddedICMPProtocol	✓	✓	✓
FlowSensorEmbeddedICMPType	✓	✓	✓
FlowSensorFragPacketDifferentSizes	✓	✓	✓
FlowSensorFragPacketTooLong	✓	✓	✓
FlowSensorFragPacketTooShort	✓	✓	✓
FlowSensorInitiator	✓	✓	✓
FlowSensorRetransmits	✓	✓	✓
FlowSensorRoundTripTime	✓	✓	✓
FlowSensorServerResponseTime	✓	✓	✓
FlowSensorShortFragAttack	✓	✓	✓
FlowSensorSourceEmailIn	✓	✓	✓
FlowSensorSourceEmailInMessages	✓	✓	✓
FlowSensorSourceEmailInTrys	✓	✓	✓
FlowSensorSourceEmailOut	✓	✓	✓
FlowSensorSourceEmailOutMessages	✓	✓	✓
FlowSensorSourceEmailOutTrys	✓	✓	✓
FlowSensorTCPBadTotalCount	✓	✓	✓
FlowSensorTCPFragTotalCount	✓	✓	✓
FlowSensorTCPSRSTotalCount	✓	✓	✓
FlowSensorTCPSYNACKTotalCount	✓	✓	✓
FlowSensorTraces	✓	✓	✓
FlowSensorTrustsecSourceIdentifier	✓	✓	✓

Palo Alto (PEN: 25461)

Name	Community	Basic	Standard	Premium
App-ID		✓	✓	✓
User-ID		✓	✓	✓

FastIP/Boundary (PEN: 33610)

Name	Basic	Standard	Premium
APP_RTT_USEC	✓	✓	✓
BOND_INTERFACE_ID	✓	✓	✓
BOND_INTERFACE_MODE	✓	✓	✓
BOND_INTERFACE_PHYSICAL_NIC_COUNT	✓	✓	✓
COLLISIONS	✓	✓	✓
EPOCH_SECOND	✓	✓	✓
ERRORS	✓	✓	✓
METER_OS_DISTRIBUTION_NAME	✓	✓	✓
METER_OS_MACHINE	✓	✓	✓
METER_OS_NODENAME	✓	✓	✓
METER_OS_RELEASE	✓	✓	✓
METER_OS_SYSNAME	✓	✓	✓
METER_OS_VERSION	✓	✓	✓
METER_VERSION	✓	✓	✓
NIC_DRIVER_NAME	✓	✓	✓
NIC_DRIVER_VERSION	✓	✓	✓
NIC_FIRMWARE_VERSION	✓	✓	✓
NIC_ID	✓	✓	✓
NIC_IP	✓	✓	✓
NIC_MAC	✓	✓	✓
NIC_NAME	✓	✓	✓
TCP_FLAGS	✓	✓	✓
TCP_HANDSHAKE_RTT_USEC	✓	✓	✓

ntop (PEN: 35632)

Name	Basic	Standard	Premium
APPL_LATENCY_MS	✓	✓	✓
APPLICATION_NAME	✓	✓	✓
BITTORRENT_HASH	✓	✓	✓
CLIENT_NW_LATENCY_MS	✓	✓	✓
CLIENT_TCP_FLAGS	✓	✓	✓
CUMULATIVE_ICMP_TYPE	✓	✓	✓
DHCP_CLIENT_IP	✓	✓	✓
DHCP_CLIENT_MAC	✓	✓	✓
DHCP_CLIENT_NAME	✓	✓	✓
DHCP_MESSAGE_TYPE	✓	✓	✓
DHCP_REMOTE_ID	✓	✓	✓
DHCP_SUBSCRIBER_ID	✓	✓	✓
DIAMETER_CALLED_PARTY_ADDRESS	✓	✓	✓
DIAMETER_CALLED_STATION_ID	✓	✓	✓
DIAMETER_CALLING_PARTY_ADDRESS	✓	✓	✓
DIAMETER_CALLING_STATION_ID	✓	✓	✓
DIAMETER_CLR_CANCEL_TYPE	✓	✓	✓
DIAMETER_CLR_FLAGS	✓	✓	✓
DIAMETER_EXP_RES_RESULT_CODE	✓	✓	✓
DIAMETER_EXP_RES_VENDOR_ID	✓	✓	✓
DIAMETER_FRAMED_IP_ADDR	✓	✓	✓
DIAMETER_HOP_BY_HOP_ID	✓	✓	✓
DIAMETER_PDP_ADDR	✓	✓	✓
DIAMETER_REQ_MSG_TYPE	✓	✓	✓
DIAMETER_REQ_ORIGIN_HOST	✓	✓	✓
DIAMETER_REQ_USER_NAME	✓	✓	✓
DIAMETER_RSP_MSG_TYPE	✓	✓	✓
DIAMETER_RSP_ORIGIN_HOST	✓	✓	✓
DIAMETER_RSP_RESULT_CODE	✓	✓	✓
DIAMETER_SERVED_IP_ADDR	✓	✓	✓
DIAMETER_SUBSCRIPTION_ID	✓	✓	✓
DICOM_DEVICE_SERIAL	✓	✓	✓
DICOM_IMPL_UID	✓	✓	✓
DICOM_IMPL_VERSION	✓	✓	✓
DICOM_INST_ADDR	✓	✓	✓
DICOM_INST_NAME	✓	✓	✓
DICOM_MANUFACTURER	✓	✓	✓
DICOM_MODALITY	✓	✓	✓
DICOM_STATION_NAME	✓	✓	✓
DICOM_SW_VERSION	✓	✓	✓
DNS_NUM_ANSWERS	✓	✓	✓
DNS_QUERY	✓	✓	✓
DNS_QUERY_ID	✓	✓	✓
DNS_QUERY_TYPE	✓	✓	✓
DNS_RESPONSE	✓	✓	✓
DNS_RET_CODE	✓	✓	✓
DNS_TTL_ANSWER	✓	✓	✓
DOWNSTREAM_SESSION_ID	✓	✓	✓
DOWNSTREAM_TUNNEL_ID	✓	✓	✓
DST_AS_MAP	✓	✓	✓
DST_AS_PATH_1	✓	✓	✓
DST_AS_PATH_10	✓	✓	✓
DST_AS_PATH_2	✓	✓	✓
DST_AS_PATH_3	✓	✓	✓
DST_AS_PATH_4	✓	✓	✓
DST_AS_PATH_5	✓	✓	✓
DST_AS_PATH_6	✓	✓	✓
DST_AS_PATH_7	✓	✓	✓
DST_AS_PATH_8	✓	✓	✓
DST_AS_PATH_9	✓	✓	✓
DST_FATHER_PROC_NAME	✓	✓	✓
DST_FATHER_PROC_PID	✓	✓	✓
DST_FRAGMENTS	✓	✓	✓
DST_HOST_NAME	✓	✓	✓
DST_IP_CITY	✓	✓	✓
DST_IP_COUNTRY	✓	✓	✓
DST_IP_LAT	✓	✓	✓
DST_IP_LONG	✓	✓	✓
DST_PROC_ACTUAL_MEMORY	✓	✓	✓
DST_PROC_AVERAGE_CPU_LOAD	✓	✓	✓
DST_PROC_NAME	✓	✓	✓
DST_PROC_NUM_PAGE_FAULTS	✓	✓	✓
DST_PROC_PCTG_IOWAIT	✓	✓	✓
DST_PROC_PEAK_MEMORY	✓	✓	✓
DST_PROC_PID	✓	✓	✓
DST_PROC_UID	✓	✓	✓
DST_PROC_USER_NAME	✓	✓	✓
DST_TO_SRC_AVG_THROUGHPUT	✓	✓	✓
DST_TO_SRC_MAX_THROUGHPUT	✓	✓	✓
DST_TO_SRC_MIN_THROUGHPUT	✓	✓	✓
DST_TO_SRC_SECOND_BYTES	✓	✓	✓
DURATION_IN	✓	✓	✓
DURATION_OUT	✓	✓	✓
ENTROPY_CLIENT_BYTES	✓	✓	✓
ENTROPY_SERVER_BYTES	✓	✓	✓
EPP_CMD	✓	✓	✓
EPP_CMD_ARGS	✓	✓	✓
EPP_REASON_STR	✓	✓	✓
EPP_REGISTRAR_NAME	✓	✓	✓
EPP_RSP_CODE	✓	✓	✓
EPP_SERVER_NAME	✓	✓	✓
FLOW_PROTO_PORT	✓	✓	✓
FLOW_SERVER_NAME	✓	✓	✓
FLOW_USER_NAME	✓	✓	✓
FTP_COMMAND	✓	✓	✓
FTP_COMMAND_RET_CODE	✓	✓	✓
FTP_LOGIN	✓	✓	✓
FTP_PASSWORD	✓	✓	✓
GTPV0_APN_NAME	✓	✓	✓
GTPV0_END_USER_IP	✓	✓	✓
GTPV0_END_USER_MSISDN	✓	✓	✓
GTPV0_RAI_CELL_LAC	✓	✓	✓
GTPV0_RAI_CELL_RAC	✓	✓	✓
GTPV0_RAI_MCC	✓	✓	✓
GTPV0_RAI_MNC	✓	✓	✓
GTPV0_REQ_MSG_TYPE	✓	✓	✓
GTPV0_RESPONSE_CAUSE	✓	✓	✓
GTPV0_RSP_MSG_TYPE	✓	✓	✓
GTPV0_TID	✓	✓	✓
GTPV1_APN_NAME	✓	✓	✓
GTPV1_C2S_TEID_CTRL	✓	✓	✓
GTPV1_C2S_TEID_DATA	✓	✓	✓
GTPV1_END_USER_IMEI	✓	✓	✓
GTPV1_END_USER_IMSI	✓	✓	✓
GTPV1_END_USER_IP	✓	✓	✓
GTPV1_END_USER_MSISDN	✓	✓	✓
GTPV1_RAI_LAC	✓	✓	✓
GTPV1_RAI_MCC	✓	✓	✓
GTPV1_RAI_MNC	✓	✓	✓
GTPV1_RAI_RAC	✓	✓	✓
GTPV1_RAT_TYPE	✓	✓	✓
GTPV1_REQ_MSG_TYPE	✓	✓	✓
GTPV1_RESPONSE_CAUSE	✓	✓	✓
GTPV1_RSP_MSG_TYPE	✓	✓	✓
GTPV1_S2C_TEID_CTRL	✓	✓	✓
GTPV1_S2C_TEID_DATA	✓	✓	✓
GTPV1_ULI_CELL_CI	✓	✓	✓
GTPV1_ULI_CELL_LAC	✓	✓	✓
GTPV1_ULI_MCC	✓	✓	✓
GTPV1_ULI_MNC	✓	✓	✓
GTPV1_ULI_SAC	✓	✓	✓
GTPV2_APN_NAME	✓	✓	✓
GTPV2_C2S_S1U_GTPU_IP	✓	✓	✓
GTPV2_C2S_S1U_GTPU_TEID	✓	✓	✓
GTPV2_C2S_S5_S8_GTPC_IP	✓	✓	✓
GTPV2_C2S_S5_S8_GTPU_IP	✓	✓	✓
GTPV2_C2S_S5_S8_GTPU_TEID	✓	✓	✓
GTPV2_C2S_S5_S8_SGW_GTPU_IP	✓	✓	✓
GTPV2_C2S_S5_S8_SGW_GTPU_TEID	✓	✓	✓
GTPV2_END_USER_IMEI	✓	✓	✓
GTPV2_END_USER_IMSI	✓	✓	✓
GTPV2_END_USER_MSISDN	✓	✓	✓
GTPV2_PDN_IP	✓	✓	✓
GTPV2_RAT_TYPE	✓	✓	✓
GTPV2_REQ_MSG_TYPE	✓	✓	✓
GTPV2_RESPONSE_CAUSE	✓	✓	✓
GTPV2_RSP_MSG_TYPE	✓	✓	✓
GTPV2_S2C_S1U_GTPU_IP	✓	✓	✓
GTPV2_S2C_S1U_GTPU_TEID	✓	✓	✓
GTPV2_S2C_S5_S8_GTPC_IP	✓	✓	✓
GTPV2_S2C_S5_S8_GTPU_IP	✓	✓	✓
GTPV2_S2C_S5_S8_GTPU_TEID	✓	✓	✓
GTPV2_S2C_S5_S8_SGW_GTPU_IP	✓	✓	✓
GTPV2_S2C_S5_S8_SGW_GTPU_TEID	✓	✓	✓
GTPV2_S5_S8_GTPC_TEID	✓	✓	✓
GTPV2_ULI_CELL_ID	✓	✓	✓
GTPV2_ULI_CELL_TAC	✓	✓	✓
GTPV2_ULI_MCC	✓	✓	✓
GTPV2_ULI_MNC	✓	✓	✓
HASSH_CLIENT	✓	✓	✓
HASSH_SERVER	✓	✓	✓
HTTP_HOST	✓	✓	✓
HTTP_METHOD	✓	✓	✓
HTTP_MIME	✓	✓	✓
HTTP_REFERER	✓	✓	✓
HTTP_RET_CODE	✓	✓	✓
HTTP_SITE	✓	✓	✓
HTTP_UA	✓	✓	✓
HTTP_URL	✓	✓	✓
HTTP_VIA	✓	✓	✓
HTTP_X_FORWARDED_FOR	✓	✓	✓
IMAP_LOGIN	✓	✓	✓
IN_SRC_OSI_SAP	✓	✓	✓
JA3C_HASH	✓	✓	✓
JA3S_HASH	✓	✓	✓
L4_DST_PORT_MAP	✓	✓	✓
L4_SRC_PORT_MAP	✓	✓	✓
L4_SRV_PORT	✓	✓	✓
L4_SRV_PORT_MAP	✓	✓	✓
L7_PROTO	✓	✓	✓
L7_PROTO	✓	✓	✓
L7_PROTO_CATEGORY	✓	✓	✓
L7_PROTO_NAME	✓	✓	✓
LONGEST_FLOW_PKT	✓	✓	✓
MYSQL_APPL_LATENCY_USEC	✓	✓	✓
MYSQL_DB	✓	✓	✓
MYSQL_QUERY	✓	✓	✓
MYSQL_RESPONSE	✓	✓	✓
MYSQL_SERVER_VERSION	✓	✓	✓
MYSQL_USERNAME	✓	✓	✓
NETBIOS_QUERY_NAME	✓	✓	✓
NETBIOS_QUERY_OS	✓	✓	✓
NETBIOS_QUERY_TYPE	✓	✓	✓
NETBIOS_RESPONSE	✓	✓	✓
NPROBE_IPV4_ADDRESS	✓	✓	✓
NUM_PKTS_1024_TO_1514_BYTES	✓	✓	✓
NUM_PKTS_128_TO_256_BYTES	✓	✓	✓
NUM_PKTS_256_TO_512_BYTES	✓	✓	✓
NUM_PKTS_512_TO_1024_BYTES	✓	✓	✓
NUM_PKTS_OVER_1514_BYTES	✓	✓	✓
NUM_PKTS_TTL_128_160	✓	✓	✓
NUM_PKTS_TTL_160_192	✓	✓	✓
NUM_PKTS_TTL_192_224	✓	✓	✓
NUM_PKTS_TTL_2_5	✓	✓	✓
NUM_PKTS_TTL_224_255	✓	✓	✓
NUM_PKTS_TTL_5_32	✓	✓	✓
NUM_PKTS_TTL_64_96	✓	✓	✓
NUM_PKTS_TTL_64_96	✓	✓	✓
NUM_PKTS_TTL_96_128	✓	✓	✓
NUM_PKTS_TTL_EQ_1	✓	✓	✓
NUM_PKTS_UP_TO_128_BYTES	✓	✓	✓
OOORDER_IN_PKTS	✓	✓	✓
OOORDER_OUT_PKTS	✓	✓	✓
ORACLE_QUERY	✓	✓	✓
ORACLE_QUERY_DURATION	✓	✓	✓
ORACLE_RSP_CODE	✓	✓	✓
ORACLE_RSP_STRING	✓	✓	✓
ORACLE_USERNAME	✓	✓	✓
OUT_DST_OSI_SAP	✓	✓	✓
PAYLOAD_HASH	✓	✓	✓
PKT_VECTOR	✓	✓	✓
PLUGIN_NAME	✓	✓	✓
POP_USER	✓	✓	✓
PROTOCOL_MAP	✓	✓	✓
RADIUS_ACCT_IN_OCTETS	✓	✓	✓
RADIUS_ACCT_IN_PKTS	✓	✓	✓
RADIUS_ACCT_OUT_OCTETS	✓	✓	✓
RADIUS_ACCT_OUT_PKTS	✓	✓	✓
RADIUS_ACCT_SESSION_ID	✓	✓	✓
RADIUS_ACCT_STATUS_TYPE	✓	✓	✓
RADIUS_CALLED_STATION_ID	✓	✓	✓
RADIUS_CALLING_STATION_ID	✓	✓	✓
RADIUS_FRAMED_IP_ADDR	✓	✓	✓
RADIUS_NAS_IDENTIFIER	✓	✓	✓
RADIUS_NAS_IP_ADDR	✓	✓	✓
RADIUS_REQ_MSG_TYPE	✓	✓	✓
RADIUS_RSP_MSG_TYPE	✓	✓	✓
RADIUS_USER_IMEI	✓	✓	✓
RADIUS_USER_IMSI	✓	✓	✓
RADIUS_USER_NAME	✓	✓	✓
RETRANSMITTED_IN_BYTES	✓	✓	✓
RETRANSMITTED_IN_PKTS	✓	✓	✓
RETRANSMITTED_OUT_BYTES	✓	✓	✓
RETRANSMITTED_OUT_PKTS	✓	✓	✓
RTP_DTMF_TONES	✓	✓	✓
RTP_FIRST_SEQ	✓	✓	✓
RTP_FIRST_TS	✓	✓	✓
RTP_IN_JITTER	✓	✓	✓
RTP_IN_MAX_DELTA	✓	✓	✓
RTP_IN_MOS	✓	✓	✓
RTP_IN_PAYLOAD_TYPE	✓	✓	✓
RTP_IN_PKT_DROP	✓	✓	✓
RTP_IN_PKT_LOST	✓	✓	✓
RTP_IN_R_FACTOR	✓	✓	✓
RTP_IN_TRANSIT	✓	✓	✓
RTP_LAST_SEQ	✓	✓	✓
RTP_LAST_TS	✓	✓	✓
RTP_MOS	✓	✓	✓
RTP_OUT_JITTER	✓	✓	✓
RTP_OUT_MAX_DELTA	✓	✓	✓
RTP_OUT_MOS	✓	✓	✓
RTP_OUT_PAYLOAD_TYPE	✓	✓	✓
RTP_OUT_PKT_DROP	✓	✓	✓
RTP_OUT_PKT_LOST	✓	✓	✓
RTP_OUT_R_FACTOR	✓	✓	✓
RTP_OUT_TRANSIT	✓	✓	✓
RTP_R_FACTOR	✓	✓	✓
RTP_RTT	✓	✓	✓
RTP_SIP_CALL_ID	✓	✓	✓
RTP_SSRC	✓	✓	✓
S1AP_CAUSE_ENB_TO_MME	✓	✓	✓
S1AP_DETAILED_CAUSE_ENB_TO_MME	✓	✓	✓
S1AP_ENB_UE_S1AP_ID	✓	✓	✓
S1AP_MME_UE_S1AP_ID	✓	✓	✓
S1AP_MSG_EMM_TYPE_ENB_TO_MME	✓	✓	✓
S1AP_MSG_EMM_TYPE_MME_TO_ENB	✓	✓	✓
S1AP_MSG_ESM_TYPE_ENB_TO_MME	✓	✓	✓
S1AP_MSG_ESM_TYPE_MME_TO_ENB	✓	✓	✓
SEQ_PLEN	✓	✓	✓
SEQ_PLEN_HASH	✓	✓	✓
SEQ_TDIFF	✓	✓	✓
SEQ_TDIFF_HASH	✓	✓	✓
SERVER_NW_LATENCY_MS	✓	✓	✓
SERVER_TCP_FLAGS	✓	✓	✓
SHORTEST_FLOW_PKT	✓	✓	✓
SIP_BYE_OK_TIME	✓	✓	✓
SIP_BYE_TIME	✓	✓	✓
SIP_C_IP	✓	✓	✓
SIP_CALL_ID	✓	✓	✓
SIP_CALL_STATE	✓	✓	✓
SIP_CALLED_PARTY	✓	✓	✓
SIP_CALLING_PARTY	✓	✓	✓
SIP_CANCEL_OK_TIME	✓	✓	✓
SIP_CANCEL_TIME	✓	✓	✓
SIP_INVITE_FAILURE_TIME	✓	✓	✓
SIP_INVITE_OK_TIME	✓	✓	✓
SIP_INVITE_TIME	✓	✓	✓
SIP_REASON_CAUSE	✓	✓	✓
SIP_RESPONSE_CODE	✓	✓	✓
SIP_RINGING_TIME	✓	✓	✓
SIP_RTP_CODECS	✓	✓	✓
SIP_RTP_IPV4_DST_ADDR	✓	✓	✓
SIP_RTP_IPV4_SRC_ADDR	✓	✓	✓
SIP_RTP_L4_DST_PORT	✓	✓	✓
SIP_RTP_L4_SRC_PORT	✓	✓	✓
SIP_TRYING_TIME	✓	✓	✓
SIP_UAC	✓	✓	✓
SIP_UAS	✓	✓	✓
SMTP_MAIL_FROM	✓	✓	✓
SMTP_RCPT_TO	✓	✓	✓
SRC_AS_MAP	✓	✓	✓
SRC_AS_PATH_1	✓	✓	✓
SRC_AS_PATH_10	✓	✓	✓
SRC_AS_PATH_2	✓	✓	✓
SRC_AS_PATH_3	✓	✓	✓
SRC_AS_PATH_4	✓	✓	✓
SRC_AS_PATH_5	✓	✓	✓
SRC_AS_PATH_6	✓	✓	✓
SRC_AS_PATH_7	✓	✓	✓
SRC_AS_PATH_8	✓	✓	✓
SRC_AS_PATH_9	✓	✓	✓
SRC_FATHER_PROC_NAME	✓	✓	✓
SRC_FATHER_PROC_PID	✓	✓	✓
SRC_FRAGMENTS	✓	✓	✓
SRC_HOST_NAME	✓	✓	✓
SRC_IP_CITY	✓	✓	✓
SRC_IP_COUNTRY	✓	✓	✓
SRC_IP_LAT	✓	✓	✓
SRC_IP_LONG	✓	✓	✓
SRC_PROC_ACTUAL_MEMORY	✓	✓	✓
SRC_PROC_AVERAGE_CPU_LOAD	✓	✓	✓
SRC_PROC_NAME	✓	✓	✓
SRC_PROC_NUM_PAGE_FAULTS	✓	✓	✓
SRC_PROC_PCTG_IOWAIT	✓	✓	✓
SRC_PROC_PEAK_MEMORY	✓	✓	✓
SRC_PROC_PID	✓	✓	✓
SRC_PROC_UID	✓	✓	✓
SRC_PROC_USER_NAME	✓	✓	✓
SRC_TO_DST_AVG_THROUGHPUT	✓	✓	✓
SRC_TO_DST_MAX_THROUGHPUT	✓	✓	✓
SRC_TO_DST_MIN_THROUGHPUT	✓	✓	✓
SRC_TO_DST_SECOND_BYTES	✓	✓	✓
SSDP_HOST	✓	✓	✓
SSDP_METHOD	✓	✓	✓
SSDP_SERVER	✓	✓	✓
SSDP_TYPE	✓	✓	✓
SSDP_USN	✓	✓	✓
SSL_CIPHER	✓	✓	✓
SSL_SERVER_NAME	✓	✓	✓
SSL_UNSAFE_CIPHER	✓	✓	✓
SSL_VERSION	✓	✓	✓
TCP_WIN_MAX_IN	✓	✓	✓
TCP_WIN_MAX_OUT	✓	✓	✓
TCP_WIN_MIN_IN	✓	✓	✓
TCP_WIN_MIN_OUT	✓	✓	✓
TCP_WIN_MSS_IN	✓	✓	✓
TCP_WIN_MSS_OUT	✓	✓	✓
TCP_WIN_SCALE_IN	✓	✓	✓
TCP_WIN_SCALE_OUT	✓	✓	✓
UNTUNNELED_IPV4_DST_ADDR	✓	✓	✓
UNTUNNELED_IPV4_SRC_ADDR	✓	✓	✓
UNTUNNELED_IPV6_DST_ADDR	✓	✓	✓
UNTUNNELED_IPV6_SRC_ADDR	✓	✓	✓
UNTUNNELED_L4_DST_PORT	✓	✓	✓
UNTUNNELED_L4_SRC_PORT	✓	✓	✓
UNTUNNELED_PROTOCOL	✓	✓	✓
UPSTREAM_SESSION_ID	✓	✓	✓
UPSTREAM_TUNNEL_ID	✓	✓	✓
USER_NAME	✓	✓	✓
WHOIS_DAS_DOMAIN	✓	✓	✓

A10 Networks (PEN: 40842)

Name	Basic	Standard	Premium
cgn-flow-direction	✓	✓	✓
Custom1	✓	✓	✓
Custom2	✓	✓	✓
Custom3	✓	✓	✓
DestZone	✓	✓	✓
flowDurationMilliseconds64	✓	✓	✓
fwDenyReset	✓	✓	✓
fwdTupleType	✓	✓	✓
fwdVNPID	✓	✓	✓
mobileIMEI	✓	✓	✓
revTupleType	✓	✓	✓
revVNPID	✓	✓	✓
RuleName	✓	✓	✓
RuleSetName	✓	✓	✓
SourceZone	✓	✓	✓

Netflow v1​

Netflow v5​

Netflow v6​

Netflow v7​

Netflow v9​

Standards-based IEs (PEN: 0)​

Cisco (PEN: 9)​

Ericsson (PEN: 193)​

StreamCORE (PEN: 4056)​

Riverbed (PEN: 4321)​

LANcope, now Cisco (PEN: 8712)​

Palo Alto (PEN: 25461)​

FastIP/Boundary (PEN: 33610)​

ntop (PEN: 35632)​

A10 Networks (PEN: 40842)​