Skip to main content
Version: 7.4

Netflow IEs

NetObserv Flow supports Netflow versions 1, 5, 6, 7 and 9 records.

Netflow v1

NetObserv Flow supports 14 unique Netflow v1 information elements (IE).

NameCommunityBasicStandardPremium
dOctets
dPkts
dstaddr
dstport
First
input
Last
nexthop
output
prot
srcaddr
srcport
tcp_flags
tos

Netflow v5

NetObserv Flow support 18 unique Netflow v5 information elements (IE).

NameCommunityBasicStandardPremium
dOctets
dPkts
dst_as
dst_mask
dstaddr
dstport
First
input
Last
nexthop
output
prot
src_as
src_mask
srcaddr
srcport
tcp_flags
tos

Netflow v6

NetObserv Flow support 18 unique Netflow v6 information elements (IE).

NameCommunityBasicStandardPremium
dOctets
dPkts
dst_as
dst_mask
dstaddr
dstport
First
input
Last
nexthop
output
prot
src_as
src_mask
srcaddr
srcport
tcp_flags
tos

Netflow v7

NetObserv Flow support 19 unique Netflow v7 information elements (IE).

NameCommunityBasicStandardPremium
dOctets
dPkts
dst_as
dst_mask
dstaddr
dstport
First
input
ipv4RouterSc
Last
nexthop
output
prot
src_as
src_mask
srcaddr
srcport
tcp_flags
tos

Netflow v9

NetObserv Flow supports over 1500 unique Netflow v9 information elements (IE).

PENVendorIEs
0IANA462
9Cisco581
193Ericsson8
4056StreamCORE28
4321Riverbed12
8712LANcope (Cisco)43
25461Palo Alto Networks2
33610FastIP / Boundary23
35632ntop370
40842A10 Networks15

Standards-based IEs (PEN: 0)

IDNameCommunityBasicStandardPremium
1octetDeltaCount
2packetDeltaCount
3deltaFlowCount
4protocolIdentifier
5ipClassOfService
6tcpControlBits
7sourceTransportPort
8sourceIPv4Address
9sourceIPv4PrefixLength
10ingressInterface
11destinationTransportPort
12destinationIPv4Address
13destinationIPv4PrefixLength
14egressInterface
15ipNextHopIPv4Address
16bgpSourceAsNumber
17bgpDestinationAsNumber
18bgpNextHopIPv4Address
19postMCastPacketDeltaCount
20postMCastOctetDeltaCount
21flowEndSysUpTime
22flowStartSysUpTime
23postOctetDeltaCount
24postPacketDeltaCount
25minimumIpTotalLength
26maximumIpTotalLength
27sourceIPv6Address
28destinationIPv6Address
29sourceIPv6PrefixLength
30destinationIPv6PrefixLength
31flowLabelIPv6
32icmpTypeCodeIPv4
33igmpType
34samplingInterval
35samplingAlgorithm
36flowActiveTimeout
37flowIdleTimeout
38engineType
39engineId
40exportedOctetTotalCount
41exportedMessageTotalCount
42exportedFlowRecordTotalCount
44sourceIPv4Prefix
45destinationIPv4Prefix
46mplsTopLabelType
47mplsTopLabelIPv4Address
48samplerId
49samplerMode
50samplerRandomInterval
51classId
52minimumTTL
53maximumTTL
54fragmentIdentification
55postIpClassOfService
56sourceMacAddress
57postDestinationMacAddress
58vlanId
59postVlanId
60ipVersion
61flowDirection
62ipNextHopIPv6Address
63bgpNextHopIPv6Address
64ipv6ExtensionHeaders
65transportPacketLoss Cisco Legacy
66transportUnreachability Cisco Legacy
67transportLatency Cisco Legacy
68dataPoints Cisco Legacy
69variance Cisco Legacy
70mplsTopLabelStackSection
71mplsLabelStackSection2
72mplsLabelStackSection3
73mplsLabelStackSection4
74mplsLabelStackSection5
75mplsLabelStackSection6
76mplsLabelStackSection7
77mplsLabelStackSection8
78mplsLabelStackSection9
79mplsLabelStackSection10
80destinationMacAddress
81postSourceMacAddress
82interfaceName
83interfaceDescription
84samplerName
85octetTotalCount
86packetTotalCount
87flagsAndSamplerId
88fragmentOffset
89forwardingStatus
90mplsVpnRouteDistinguisher
91mplsTopLabelPrefixLength
92srcTrafficIndex
93dstTrafficIndex
94applicationDescription
95applicationId
96applicationName
97subApplicationTag Cisco Legacy
98postIpDiffServCodePoint
99multicastReplicationFactor
100className
101classificationEngineId
102layer2packetSectionOffset
103layer2packetSectionSize
104layer2packetSectionData
105applicationVersion Cisco Legacy
106applicationVersionName Cisco Legacy
107applicationVendor Cisco Legacy
109subApplicationName Cisco Legacy
110subApplicationDescription Cisco Legacy
111templateParameterRangeEnd Cisco Legacy
128bgpNextAdjacentAsNumber
129bgpPrevAdjacentAsNumber
130exporterIPv4Address
131exporterIPv6Address
132droppedOctetDeltaCount
133droppedPacketDeltaCount
134droppedOctetTotalCount
135droppedPacketTotalCount
136flowEndReason
137commonPropertiesId
138observationPointId
139icmpTypeCodeIPv6
140mplsTopLabelIPv6Address
141lineCardId
142portId
143meteringProcessId
144exportingProcessId
145templateId
146wlanChannelId
147wlanSSID
148flowId
149observationDomainId
150flowStartSeconds
151flowEndSeconds
152flowStartMilliseconds
153flowEndMilliseconds
154flowStartMicroseconds
155flowEndMicroseconds
156flowStartNanoseconds
157flowEndNanoseconds
158flowStartDeltaMicroseconds
159flowEndDeltaMicroseconds
160systemInitTimeMilliseconds
161flowDurationMilliseconds
162flowDurationMicroseconds
163observedFlowTotalCount
164ignoredPacketTotalCount
165ignoredOctetTotalCount
166notSentFlowTotalCount
167notSentPacketTotalCount
168notSentOctetTotalCount
169destinationIPv6Prefix
170sourceIPv6Prefix
171postOctetTotalCount
172postPacketTotalCount
173flowKeyIndicator
174postMCastPacketTotalCount
175postMCastOctetTotalCount
176icmpTypeIPv4
177icmpCodeIPv4
178icmpTypeIPv6
179icmpCodeIPv6
180udpSourcePort
181udpDestinationPort
182tcpSourcePort
183tcpDestinationPort
184tcpSequenceNumber
185tcpAcknowledgementNumber
186tcpWindowSize
187tcpUrgentPointer
188tcpHeaderLength
189ipHeaderLength
190totalLengthIPv4
191payloadLengthIPv6
192ipTTL
193nextHeaderIPv6
194mplsPayloadLength
195ipDiffServCodePoint
196ipPrecedence
197fragmentFlags
198octetDeltaSumOfSquares
199octetTotalSumOfSquares
200mplsTopLabelTTL
201mplsLabelStackLength
202mplsLabelStackDepth
203mplsTopLabelExp
204ipPayloadLength
205udpMessageLength
206isMulticast
207ipv4IHL
208ipv4Options
209tcpOptions
210paddingOctets
211collectorIPv4Address
212collectorIPv6Address
213exportInterface
214exportProtocolVersion
215exportTransportProtocol
216collectorTransportPort
217exporterTransportPort
218tcpSynTotalCount
219tcpFinTotalCount
220tcpRstTotalCount
221tcpPshTotalCount
222tcpAckTotalCount
223tcpUrgTotalCount
224ipTotalLength
225postNATSourceIPv4Address
226postNATDestinationIPv4Address
227postNAPTSourceTransportPort
228postNAPTDestinationTransportPort
229natOriginatingAddressRealm
230natEvent
231initiatorOctets
232responderOctets
233firewallEvent
234ingressVRFID
235egressVRFID
236VRFname
237postMplsTopLabelExp
238tcpWindowScale
239biflowDirection
240ethernetHeaderLength
241ethernetPayloadLength
242ethernetTotalLength
243dot1qVlanId
244dot1qPriority
245dot1qCustomerVlanId
246dot1qCustomerPriority
247metroEvcId
248metroEvcType
249pseudoWireId
250pseudoWireType
251pseudoWireControlWord
252ingressPhysicalInterface
253egressPhysicalInterface
254postDot1qVlanId
255postDot1qCustomerVlanId
256ethernetType
257postIpPrecedence
258collectionTimeMilliseconds
259exportSctpStreamId
260maxExportSeconds
261maxFlowEndSeconds
262messageMD5Checksum
263messageScope
264minExportSeconds
265minFlowStartSeconds
266opaqueOctets
267sessionScope
268maxFlowEndMicroseconds
269maxFlowEndMilliseconds
270maxFlowEndNanoseconds
271minFlowStartMicroseconds
272minFlowStartMilliseconds
273minFlowStartNanoseconds
274collectorCertificate
275exporterCertificate
276dataRecordsReliability
277observationPointType
278newConnectionDeltaCount
279connectionSumDurationSeconds
280connectionTransactionId
281postNATSourceIPv6Address
282postNATDestinationIPv6Address
283natPoolId
284natPoolName
285anonymizationFlags
286anonymizationTechnique
287informationElementIndex
288p2pTechnology
289tunnelTechnology
290encryptedTechnology
294bgpValidityState
295IPSecSPI
296greKey
297natType
298initiatorPackets
299responderPackets
300observationDomainName
301selectionSequenceId
302selectorId
303informationElementId
304selectorAlgorithm
305samplingPacketInterval
306samplingPacketSpace
307samplingTimeInterval
308samplingTimeSpace
309samplingSize
310samplingPopulation
311samplingProbability
312dataLinkFrameSize
313ipHeaderPacketSection
314ipPayloadPacketSection
315dataLinkFrameSection
316mplsLabelStackSection
317mplsPayloadPacketSection
318selectorIdTotalPktsObserved
319selectorIdTotalPktsSelected
320absoluteError
321relativeError
322observationTimeSeconds
323observationTimeMilliseconds
324observationTimeMicroseconds
325observationTimeNanoseconds
326digestHashValue
327hashIPPayloadOffset
328hashIPPayloadSize
329hashOutputRangeMin
330hashOutputRangeMax
331hashSelectedRangeMin
332hashSelectedRangeMax
333hashDigestOutput
334hashInitialiserValue
335selectorName
336upperCILimit
337lowerCILimit
338confidenceLevel
339informationElementDataType
340informationElementDescription
341informationElementName
342informationElementRangeBegin
343informationElementRangeEnd
344informationElementSemantics
345informationElementUnits
346privateEnterpriseNumber
347virtualStationInterfaceId
348virtualStationInterfaceName
349virtualStationUUID
350virtualStationName
351layer2SegmentId
352layer2OctetDeltaCount
353layer2OctetTotalCount
354ingressUnicastPacketTotalCount
355ingressMulticastPacketTotalCount
356ingressBroadcastPacketTotalCount
357egressUnicastPacketTotalCount
358egressBroadcastPacketTotalCount
359monitoringIntervalStartMilliSeconds
360monitoringIntervalEndMilliSeconds
361portRangeStart
362portRangeEnd
363portRangeStepSize
364portRangeNumPorts
365staMacAddress
366staIPv4Address
367wtpMacAddress
368ingressInterfaceType
369egressInterfaceType
370rtpSequenceNumber
371userName
372applicationCategoryName
373applicationSubCategoryName
374applicationGroupName
375originalFlowsPresent
376originalFlowsInitiated
377originalFlowsCompleted
378distinctCountOfSourceIPAddress
379distinctCountOfDestinationIPAddress
380distinctCountOfSourceIPv4Address
381distinctCountOfDestinationIPv4Address
382distinctCountOfSourceIPv6Address
383distinctCountOfDestinationIPv6Address
384valueDistributionMethod
385rfc3550JitterMilliseconds
386rfc3550JitterMicroseconds
387rfc3550JitterNanoseconds
388dot1qDEI
389dot1qCustomerDEI
390flowSelectorAlgorithm
391flowSelectedOctetDeltaCount
392flowSelectedPacketDeltaCount
393flowSelectedFlowDeltaCount
394selectorIDTotalFlowsObserved
395selectorIDTotalFlowsSelected
396samplingFlowInterval
397samplingFlowSpacing
398flowSamplingTimeInterval
399flowSamplingTimeSpacing
400hashFlowDomain
401transportOctetDeltaCount
402transportPacketDeltaCount
403originalExporterIPv4Address
404originalExporterIPv6Address
405originalObservationDomainId
406intermediateProcessId
407ignoredDataRecordTotalCount
408dataLinkFrameType
409sectionOffset
410sectionExportedOctets
411dot1qServiceInstanceTag
412dot1qServiceInstanceId
413dot1qServiceInstancePriority
414dot1qCustomerSourceMacAddress
415dot1qCustomerDestinationMacAddress
416layer2OctetDeltaCount
417postLayer2OctetDeltaCount
418postMCastLayer2OctetDeltaCount
419layer2OctetTotalCount
420postLayer2OctetTotalCount
421postMCastLayer2OctetTotalCount
422minimumLayer2TotalLength
423maximumLayer2TotalLength
424droppedLayer2OctetDeltaCount
425droppedLayer2OctetTotalCount
426ignoredLayer2OctetTotalCount
427notSentLayer2OctetTotalCount
428layer2OctetDeltaSumOfSquares
429layer2OctetTotalSumOfSquares
430layer2FrameDeltaCount
431layer2FrameTotalCount
432pseudoWireDestinationIPv4Address
433ignoredLayer2FrameTotalCount
434mibObjectValueInteger
435mibObjectValueOctetString
436mibObjectValueOID
437mibObjectValueBits
438mibObjectValueIPAddress
439mibObjectValueCounter
440mibObjectValueGauge
441mibObjectValueTimeTicks
442mibObjectValueUnsigned
445mibObjectIdentifier
446mibSubIdentifier
447mibIndexIndicator
448mibCaptureTimeSemantics
449mibContextEngineID
450mibContextName
451mibObjectName
452mibObjectDescription
453mibObjectSyntax
454mibModuleName
455mobileIMSI
456mobileMSISDN
457httpStatusCode
458sourceTransportPortsLimit
459httpRequestMethod
460httpRequestHost
461httpRequestTarget
462httpMessageVersion
463natInstanceID
464internalAddressRealm
465externalAddressRealm
466natQuotaExceededEvent
467natThresholdEvent
468httpUserAgent
469httpContentType
470httpReasonPhrase
471maxSessionEntries
472maxBIBEntries
473maxEntriesPerUser
474maxSubscribers
475maxFragmentsPendingReassembly
476addressPoolHighThreshold
477addressPoolLowThreshold
478addressPortMappingHighThreshold
479addressPortMappingLowThreshold
480addressPortMappingPerUserHighThreshold
481globalAddressMappingHighThreshold
482vpnIdentifier
483bgpCommunity
486bgpExtendedCommunity
489bgpLargeCommunity

Cisco (PEN: 9)

NameCommunityBasicStandardPremium
AAA_USERNAME
application business-relevance
application category name
application delay average
application family name
application group name
application http uri statistics
application media bytes counter
application media bytes counter permanent
application media bytes rate
application media bytes rate per-flow
application media bytes rate per-flow max
application media bytes rate per-flow min
application media event
application media packets counter
application media packets counter permanen
application media packets rate
application media packets rate variation
application media packets rate variation m
application media packets rate variation m
application media packets rate variation s
application set name
application sub category name
application traffic-class
application transaction counter new
application video eMOS compression bitstre
application video eMOS compression network
application video eMOS packet-loss bitstre
application video eMOS packet-loss network
application video frame I counter bytes
application video frame I counter frames
application video frame I counter packets
application video frame I counter packets
application video frame I slice-quantizati
application video frame LTR counter bytes
application video frame LTR counter frames
application video frame LTR counter packet
application video frame LTR counter packet
application video frame LTR slice-quantiza
application video frame NR counter bytes
application video frame NR counter frames
application video frame NR counter packets
application video frame NR counter packets
application video frame NR slice-quantizat
application video frame percentage damaged
application video frame rate
application video frame STR counter bytes
application video frame STR counter frames
application video frame STR counter packet
application video frame STR counter packet
application video frame STR slice-quantiza
application video frame super-P counter by
application video frame super-P counter fr
application video frame super-P counter pa
application video frame super-P counter pa
application video frame super-P slice-quan
application video level-of-motion
application video payload bitrate average
application video payload bitrate fluctuat
application video resolution height last
application video resolution width last
application video scene-complexity
application voice call duration
application voice codec id
application voice concealment-ratio averag
application voice delay end-point
application voice delay round-trip
application voice jitter buffer-overrun
application voice jitter configured initia
application voice jitter configured maximu
application voice jitter configured minimu
application voice jitter configured type
application voice mos conversation
application voice mos listening
application voice number called
application voice number calling
application voice packet conceal-count
application voice play delay current
application voice play delay maximum
application voice play delay minimum
application voice r-factor 1
application voice r-factor 2
application voice router global-call-id
application voice rx bad-packet
application voice rx early-packet count
application voice rx late-packet count
application voice rx out-of-sequence
application voice setup time
application voice sip call-id
appqoe ssl policy action
appqoe ssl service type
appqoe ssl traffic type
art count new connections
art count responses
art count responses histogram bucket1
art count responses histogram bucket2
art count responses histogram bucket3
art count responses histogram bucket4
art count responses histogram bucket5
art count responses histogram bucket6
art count responses histogram bucket7
artClientNetworkTimeLongLivedMaximum
artClientNetworkTimeLongLivedMinimum
artClientpackets
artServerNetworkTimeLongLivedMaximum
artServerNetworkTimeLongLivedMinimum
artServerpackets
audio concealment ratio maximum
audio concealment ratio minimum
audio concealment ratio now
audio concealment time
audio duration clock adjust
audio duration early packet
audio duration late discard
audio duration playout decrease
audio duration playout increase
audio duration receive
audio duration receive voice
audio frame arriving times difference
audio frame arriving times difference vari
audio frame size
audio frames-per-packet
audio g107 codec baseline
audio g107 codec baseline bpl
audio g107 impairment
audio g107 impairment one-way-delay
audio g107 lossRate
audio noise level average
audio noise level configured
audio noise level current
audio noise level maximum
audio noise level minimum
audio packets cs
audio packets ok
audio packets rtp
audio packets scs
audio packets silence
audio rtp fwd out-of-sequence sum
audio rtp jitter ticks
audio rtp packets expected
audio rtp packets lost
audio rtp seconds concealed
audio rtp seconds concealed severe
audio rtp seconds ok
audio snr average
audio snr configured
audio snr current
audio snr maximum
audio snr minimum
audio speech time
AVCSubApplicationValue
bandwidth used
bandwidth used percentage
bgp community
bgp prepend
bw fee
bw percentage
BYTE_RATE
c3pl class cce-id
c3pl class name
c3pl class type
c3pl policy cce-id
c3pl policy name
c3pl policy type
capacity
client network delay average
client throughput average
closed sessions
connection client counter bytes network
connection client counter bytes retransmit
connection client counter packets retransm
connection client ipv4 address
connection client ipv6 address
connection client transport port
connection concurrent-connections
connection delay application max
connection delay application min
connection delay application sum
connection delay network client-to-server
connection delay network client-to-server
connection delay network client-to-server
connection delay network client-to-server
connection delay network long-lived client
connection delay network long-lived to-cli
connection delay network long-lived to-ser
connection delay network to-client max
connection delay network to-client min
connection delay network to-client num-sam
connection delay network to-client sum
connection delay network to-server max
connection delay network to-server min
connection delay network to-server num-sam
connection delay network to-server sum
connection delay response client-to-server
connection delay response client-to-server
connection delay response client-to-server
connection delay response to-server histog
connection delay response to-server max
connection delay response to-server min
connection delay response to-server sum
connection id
connection id long
connection server counter bytes network
connection server counter bytes retransmit
connection server counter packets retransm
connection server ipv4 address
connection server ipv6 address
connection server transport port
connection transaction counter complete
connection transaction duration max
connection transaction duration min
connection transaction duration sum
counter bytes appqoe ssl-de-read
counter bytes appqoe ssl-de-written
counter bytes appqoe ssl-en-read
counter bytes appqoe ssl-en-written
counter bytes appqoe ssl-read
counter bytes appqoe ssl-written
counter bytes rate per-flow
counter bytes rate per-flow max
counter bytes rate per-flow min
counter bytes sdwan dropped long
counter packets appqoe fec-d-pkts
counter packets appqoe fec-r-pkts
counter packets appqoe pkt-dup-d-pkts-dup
counter packets appqoe pkt-dup-d-pkts-orig
counter packets appqoe pkt-dup-r-pkts
counter packets dropped permanent
counter packets rate per-flow
counter packets rate per-flow max
counter packets rate per-flow min
counter packets sdwan pkt-cxp-d-pkts
datalink event
datalink event extended
discard rollup count
drop cause id
drop cause name
egress bw
egress rollup bw
EGRESS_ACL_ID
end timestamp
entrance downgrade
ETAByteDistribution
ETAInitialDataPacketOld
ETASequenceofPktLengthsandTimes
ETTA_INITIAL_DATA_PACKET
ETTA_SEQUENCE_OF_APPLICATION_LENGTHS_AND_TIMES
ETTA_SEQUENCE_OF_PACKET_LENGTHS_AND_TIMES
ETTA_TLS_CIPHER_SUITES
ETTA_TLS_EXTENSION_LENGTHS
ETTA_TLS_EXTENSION_TYPES
ETTA_TLS_EXTENSIONS
ETTA_TLS_KEY_LENGTH
ETTA_TLS_RANDOM
ETTA_TLS_RECORDS
ETTA_TLS_SESSION_ID
ETTA_TLS_VERSION
flow cts switch derived-sgt
flow left time
FW_BLACKOUT_SECS
FW_CONFIGURED_VALUE
FW_ERM_EXT_EVENT
FW_ERM_EXT_EVENT_DESC
FW_EVENT
FW_EVENT_LEVEL
FW_EVENT_LEVEL_ID
FW_EXT_EVENT
FW_EXT_EVENT
FW_EXT_EVENT_DESC
FW_HALFOPEN_CNT
FW_HALFOPEN_HIGH
FW_HALFOPEN_RATE
FW_MAX_SESSIONS
FW_SUMMARY_PKT_CNT
FW_ZONEPAIR_ID
FW_ZONEPAIR_NAME
ingress bw
ingress rollup bw
INGRESS_ACL_ID
interface input fex-node-id
interface output fex-node-id
interface power
iOAM Application metadata
IOAM byte count
IOAM cs0 byte count
IOAM cs0 packet counter
IOAM cs1 byte count
IOAM cs1 packet counter
IOAM cs2 byte count
IOAM cs2 packet counter
IOAM cs3 byte count
IOAM cs3 packet counter
IOAM cs4 byte count
IOAM cs4 packet counter
IOAM cs5 byte count
IOAM cs5 packet counter
IOAM cs6 byte count
IOAM cs6 packet counter
IOAM cs7 byte count
IOAM cs7 packet counter
IOAM duplicate packet counter
iOAM E2E Header
IOAM highest PPC sequence number
IOAM lost packet counter
iOAM my node name
iOAM my node-id
iOAM node-id
iOAM node1 eif id
iOAM node1 id
iOAM node1 in if id
iOAM node2 eif id
iOAM node2 id
iOAM node2 in if id
iOAM node3 eif id
iOAM node3 id
iOAM node3 in if id
iOAM node4 eif id
iOAM node4 id
iOAM node4 in if id
iOAM number of nodes
IOAM packet counter
iOAM Path Map
IOAM reordered packet counter
iOAM sfc invalidated count
iOAM sfc validated count
iOAM sfc-id
IPv4 destination observation node
IPv4 source observation node
IPv6 destination observation node
ipv6 protocol filed
IPv6 source observation node
kth rollup bw
l4r event
l4r event timestamp
l4r server ipv4 address
l4r server ipv6 address
l4r server transport port
link group name
long-term round-trip-time
max egress bw
max ingress bw
metadata clock-rate
metadata global-session-id
metadata multi-party-session-id
misc unsupported
monitor device-type
monitor event
mos below
mos quality
mos total count
mos worst 100
network delay sample
network delay sum
NETWORK_DELAY_AVG network delay average
nvzFlowCoordinatesList
nvzFlowDestinationHostname
nvzFlowDNSSuffix
nvzFlowInterfaceDetailsList
nvzFlowInterfaceIndex
nvzFlowInterfaceInfoUID
nvzFlowInterfaceMac
nvzFlowInterfaceName
nvzFlowInterfaceType
nvzFlowL4ByteCountIn
nvzFlowL4ByteCountOut
nvzFlowLoggedInUser
nvzFlowModuleHashList
nvzFlowModuleNameList
nvzFlowOSEdition
nvzFlowOSName
nvzFlowOSVersion
nvzFlowParentProcessAccount
nvzFlowParentProcessAccountType
nvzFlowParentProcessHash
nvzFlowParentProcessName
nvzFlowProcessAccount
nvzFlowProcessAccountType
nvzFlowProcessHash
nvzFlowProcessName
nvzFlowSystemManufacturer
nvzFlowSystemType
nvzFlowUDID
nvzFlowUserAccountType
ONE_WAY_DELAY pfr one-way-delay
overlay session id input
overlay session id output
packet arrival timestamp
PACKET_RATE
PACKETS_DROPPED
pbhk event
pbhk event timestamp
pbhk mapped ipv4 address
pbhk mapped transport port
pfr br ipv4 address
pfr counter event error traffic-class miti
pfr counter event error traffic-class miti
pfr counter event error traffic-class miti
pfr label identifier
pfr one-way-delay samples
pfr one-way-delay sum
pfr priority
pfr service provider tag identifier
pfr site destination id ipv4
pfr site destination prefix ipv4
pfr site destination prefix ipv6
pfr site destination prefix mask ipv4
pfr site destination prefix mask ipv6
pfr site source id ipv4
pfr site source prefix ipv4
pfr site source prefix ipv6
pfr site source prefix mask ipv4
pfr site source prefix mask ipv6
pfr status
policy qos classification hierarchy
policy qos queue drops
policy qos queue index
reason id
refused sessions
retransmitted packets
routing vrf service
rsvp bw pool
scAccessString
scActiveSubscribers
scAttackId
scAttackIp
scAttackIpProtocol
scAttackMaliciousSessions
scAttackOtherIp
scAttackPortNumber
scAttacks
scAttackSide
scAttackType
scBreachState
scClientPort
scConcurrentSessions
scConfiguredDuration
scDestinationIpSample
scDownstreamVolume
scDuration
scEndTime
scFlavorId
scFlowCloseMode
scFlowContextId
scGeneratorId
scInfoString
scInitiatingSide
scLinkId
scPackageCounterId
scPackageId
scProtocolId
scProtocolSignature
scReason
scReportTime
scSeconds
scServerPort
scServiceGlobalCounterId
scServiceId
scServiceUsageCounterId
scSessionDownstreamVolume
scSessions
scSessionUpstreamVolume
scSkipppedSessions
scSourceIpSample
scSubscriberCounterId
scSubscriberId
scTag
scTimeFrame
scTotalActiveSubscribers
scTrafficProcessorId
scTransactionDurationMillisec
scUpstreamVolume
scZoneId
sdwan preferred-color-not-met
sdwan qos-queue-id
sdwan sla-not-met
server network delay average
server response time average
services pfr class-tag-id
services pfr mc-id
services waas passthrough-reason
services waas segment
session time average
session time maximum
session time minimum
SGT_DESTINATION_NAME
SGT_DESTINATION_TAG
SGT_SOURCE_NAME
SGT_SOURCE_TAG
sip header from uri host ip addr
sip header from uri userinfo user
sip header to uri host ip addr
sip header to uri userinfo user
sip sess duration
sip sess end_reason
sip sess_connected
sip sess_dialed
sip sess_failed
start timestamp
tcpWindowSizeSum
threshold
timestamp interval
timestampAbsoluteMonitoring-intervalEnd
timestampAbsoluteMonitoring-intervalStart
tloc local color
tloc local system ip address
tloc remote color
tloc remote system ip address
tloc table overlay session id
tloc tunnel protocol
transaction time average
transport bytes expected
transport bytes lost
transport bytes lost rate
transport bytes out-of-order
transport destination-port max
transport destination-port min
transport event packet-loss counter
transport event packet-loss counter max
transport event packet-loss counter min
transport event packet-loss counter perman
transport packets expected counter
transport packets expected counter permane
transport packets lost counter
transport packets lost counter max
transport packets lost counter min
transport packets lost counter permanent
transport packets lost rate
transport packets lost rate max
transport packets lost rate min
transport packets out-of-order
transport round-trip-time
transport round-trip-time max
transport round-trip-time min
transport round-trip-time samples
transport round-trip-time sum
transport rtp flow count
transport rtp jitter inter arrival mean
transport rtp jitter inter arrival samples
transport rtp jitter inter arrival sum
transport rtp jitter maximum
transport rtp jitter mean
transport rtp jitter mean sum
transport rtp jitter minimum
transport rtp payload-type
transport rtp sequence-number
transport rtp sequence-number last
transport rtp ssrc
transport source-port max
transport source-port min
transport tcp flow count
transport tcp maximum-segment-size
transport tcp window-size average
transport tcp window-size average sum
transport tcp window-size maximum
transport tcp window-size minimum
transport tcp window-size sum
unresponsive sessions
vxlan flags
vxlan sgt
vxlan vtep input
vxlan vtep output
waas application
waas bytes input
waas bytes output
waas class
waas connection mode
waas dre input
waas dre output
waas lz input
waas lz output
waas optimised bytes
waas original bytes
wireless afd accept bytes
wireless afd accept packets
wireless afd drop bytes
wireless afd drop packets
wlan_id
XLATE_DST_ADDR_IPV4
XLATE_DST_PORT
XLATE_SRC_ADDR_IPV4
XLATE_SRC_PORT

Ericsson (PEN: 193)

NameCommunityBasicStandardPremium
NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC
NAT_LOG_FIELD_IDX_CONTEXT_ID
NAT_LOG_FIELD_IDX_CONTEXT_NAME
NAT_LOG_FIELD_IDX_EXT_PORT_FIRST
NAT_LOG_FIELD_IDX_EXT_PORT_LAST
NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR
NAT_LOG_FIELD_IDX_IPV4_INT_ADDR
NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC

StreamCORE (PEN: 4056)

NameCommunityBasicStandardPremium
call_direction
codec_in
codec_out
hostname
id_rule_1
id_rule_10
id_rule_2
id_rule_3
id_rule_4
id_rule_5
id_rule_6
id_rule_7
id_rule_8
id_rule_9
mos_lq
net_app_resp_time
net_delay
net_discard
net_jitter
net_loss
rtp_clockrate_in
rtp_clockrate_out
ssl_cn
ssl_org
tcp_retrans_rate
total_app_resp_time
url
wan_rtt

Riverbed (PEN: 4321)

NameCommunityBasicStandardPremium
CFE in-path IP Address
CFE TCP Port
FE Type
Outer in-path IP Address
Outer TCP Port
Pass-through Reason
Retransmitted Bytes
Retransmitted Packets
SFE in-path IP Address
SFE TCP Port
TCP Connection RTT
WAN Visibility mode

LANcope, now Cisco (PEN: 8712)

NameCommunityBasicStandardPremium
EndpointFlowParentProcessAccount
EndpointFlowParentProcessHash
EndpointFlowParentProcessName
EndpointFlowProcessAccount
EndpointFlowProcessHash
EndpointFlowProcessName
FlowSensorApplicationDetails
FlowSensorApplicationIdentifier
FlowSensorBadFlagBadRST
FlowSensorBadFlagNoACK
FlowSensorBadFlagNoFlag
FlowSensorBadFlagSYNFIN
FlowSensorBadFlagURG
FlowSensorBadFlagXmas
FlowSensorDestinationEmailIn
FlowSensorDestinationEmailInMessages
FlowSensorDestinationEmailInTrys
FlowSensorDestinationEmailOut
FlowSensorDestinationEmailOutMessages
FlowSensorDestinationEmailOutTrys
FlowSensorEmbeddedICMPCode
FlowSensorEmbeddedICMPProtocol
FlowSensorEmbeddedICMPType
FlowSensorFragPacketDifferentSizes
FlowSensorFragPacketTooLong
FlowSensorFragPacketTooShort
FlowSensorInitiator
FlowSensorRetransmits
FlowSensorRoundTripTime
FlowSensorServerResponseTime
FlowSensorShortFragAttack
FlowSensorSourceEmailIn
FlowSensorSourceEmailInMessages
FlowSensorSourceEmailInTrys
FlowSensorSourceEmailOut
FlowSensorSourceEmailOutMessages
FlowSensorSourceEmailOutTrys
FlowSensorTCPBadTotalCount
FlowSensorTCPFragTotalCount
FlowSensorTCPSRSTotalCount
FlowSensorTCPSYNACKTotalCount
FlowSensorTraces
FlowSensorTrustsecSourceIdentifier

Palo Alto (PEN: 25461)

NameCommunityBasicStandardPremium
App-ID
User-ID

FastIP/Boundary (PEN: 33610)

NameCommunityBasicStandardPremium
APP_RTT_USEC
BOND_INTERFACE_ID
BOND_INTERFACE_MODE
BOND_INTERFACE_PHYSICAL_NIC_COUNT
COLLISIONS
EPOCH_SECOND
ERRORS
METER_OS_DISTRIBUTION_NAME
METER_OS_MACHINE
METER_OS_NODENAME
METER_OS_RELEASE
METER_OS_SYSNAME
METER_OS_VERSION
METER_VERSION
NIC_DRIVER_NAME
NIC_DRIVER_VERSION
NIC_FIRMWARE_VERSION
NIC_ID
NIC_IP
NIC_MAC
NIC_NAME
TCP_FLAGS
TCP_HANDSHAKE_RTT_USEC

ntop (PEN: 35632)

NameCommunityBasicStandardPremium
APPL_LATENCY_MS
APPLICATION_NAME
BITTORRENT_HASH
CLIENT_NW_LATENCY_MS
CLIENT_TCP_FLAGS
CUMULATIVE_ICMP_TYPE
DHCP_CLIENT_IP
DHCP_CLIENT_MAC
DHCP_CLIENT_NAME
DHCP_MESSAGE_TYPE
DHCP_REMOTE_ID
DHCP_SUBSCRIBER_ID
DIAMETER_CALLED_PARTY_ADDRESS
DIAMETER_CALLED_STATION_ID
DIAMETER_CALLING_PARTY_ADDRESS
DIAMETER_CALLING_STATION_ID
DIAMETER_CLR_CANCEL_TYPE
DIAMETER_CLR_FLAGS
DIAMETER_EXP_RES_RESULT_CODE
DIAMETER_EXP_RES_VENDOR_ID
DIAMETER_FRAMED_IP_ADDR
DIAMETER_HOP_BY_HOP_ID
DIAMETER_PDP_ADDR
DIAMETER_REQ_MSG_TYPE
DIAMETER_REQ_ORIGIN_HOST
DIAMETER_REQ_USER_NAME
DIAMETER_RSP_MSG_TYPE
DIAMETER_RSP_ORIGIN_HOST
DIAMETER_RSP_RESULT_CODE
DIAMETER_SERVED_IP_ADDR
DIAMETER_SUBSCRIPTION_ID
DICOM_DEVICE_SERIAL
DICOM_IMPL_UID
DICOM_IMPL_VERSION
DICOM_INST_ADDR
DICOM_INST_NAME
DICOM_MANUFACTURER
DICOM_MODALITY
DICOM_STATION_NAME
DICOM_SW_VERSION
DNS_NUM_ANSWERS
DNS_QUERY
DNS_QUERY_ID
DNS_QUERY_TYPE
DNS_RESPONSE
DNS_RET_CODE
DNS_TTL_ANSWER
DOWNSTREAM_SESSION_ID
DOWNSTREAM_TUNNEL_ID
DST_AS_MAP
DST_AS_PATH_1
DST_AS_PATH_10
DST_AS_PATH_2
DST_AS_PATH_3
DST_AS_PATH_4
DST_AS_PATH_5
DST_AS_PATH_6
DST_AS_PATH_7
DST_AS_PATH_8
DST_AS_PATH_9
DST_FATHER_PROC_NAME
DST_FATHER_PROC_PID
DST_FRAGMENTS
DST_HOST_NAME
DST_IP_CITY
DST_IP_COUNTRY
DST_IP_LAT
DST_IP_LONG
DST_PROC_ACTUAL_MEMORY
DST_PROC_AVERAGE_CPU_LOAD
DST_PROC_NAME
DST_PROC_NUM_PAGE_FAULTS
DST_PROC_PCTG_IOWAIT
DST_PROC_PEAK_MEMORY
DST_PROC_PID
DST_PROC_UID
DST_PROC_USER_NAME
DST_TO_SRC_AVG_THROUGHPUT
DST_TO_SRC_MAX_THROUGHPUT
DST_TO_SRC_MIN_THROUGHPUT
DST_TO_SRC_SECOND_BYTES
DURATION_IN
DURATION_OUT
ENTROPY_CLIENT_BYTES
ENTROPY_SERVER_BYTES
EPP_CMD
EPP_CMD_ARGS
EPP_REASON_STR
EPP_REGISTRAR_NAME
EPP_RSP_CODE
EPP_SERVER_NAME
FLOW_PROTO_PORT
FLOW_SERVER_NAME
FLOW_USER_NAME
FTP_COMMAND
FTP_COMMAND_RET_CODE
FTP_LOGIN
FTP_PASSWORD
GTPV0_APN_NAME
GTPV0_END_USER_IP
GTPV0_END_USER_MSISDN
GTPV0_RAI_CELL_LAC
GTPV0_RAI_CELL_RAC
GTPV0_RAI_MCC
GTPV0_RAI_MNC
GTPV0_REQ_MSG_TYPE
GTPV0_RESPONSE_CAUSE
GTPV0_RSP_MSG_TYPE
GTPV0_TID
GTPV1_APN_NAME
GTPV1_C2S_TEID_CTRL
GTPV1_C2S_TEID_DATA
GTPV1_END_USER_IMEI
GTPV1_END_USER_IMSI
GTPV1_END_USER_IP
GTPV1_END_USER_MSISDN
GTPV1_RAI_LAC
GTPV1_RAI_MCC
GTPV1_RAI_MNC
GTPV1_RAI_RAC
GTPV1_RAT_TYPE
GTPV1_REQ_MSG_TYPE
GTPV1_RESPONSE_CAUSE
GTPV1_RSP_MSG_TYPE
GTPV1_S2C_TEID_CTRL
GTPV1_S2C_TEID_DATA
GTPV1_ULI_CELL_CI
GTPV1_ULI_CELL_LAC
GTPV1_ULI_MCC
GTPV1_ULI_MNC
GTPV1_ULI_SAC
GTPV2_APN_NAME
GTPV2_C2S_S1U_GTPU_IP
GTPV2_C2S_S1U_GTPU_TEID
GTPV2_C2S_S5_S8_GTPC_IP
GTPV2_C2S_S5_S8_GTPU_IP
GTPV2_C2S_S5_S8_GTPU_TEID
GTPV2_C2S_S5_S8_SGW_GTPU_IP
GTPV2_C2S_S5_S8_SGW_GTPU_TEID
GTPV2_END_USER_IMEI
GTPV2_END_USER_IMSI
GTPV2_END_USER_MSISDN
GTPV2_PDN_IP
GTPV2_RAT_TYPE
GTPV2_REQ_MSG_TYPE
GTPV2_RESPONSE_CAUSE
GTPV2_RSP_MSG_TYPE
GTPV2_S2C_S1U_GTPU_IP
GTPV2_S2C_S1U_GTPU_TEID
GTPV2_S2C_S5_S8_GTPC_IP
GTPV2_S2C_S5_S8_GTPU_IP
GTPV2_S2C_S5_S8_GTPU_TEID
GTPV2_S2C_S5_S8_SGW_GTPU_IP
GTPV2_S2C_S5_S8_SGW_GTPU_TEID
GTPV2_S5_S8_GTPC_TEID
GTPV2_ULI_CELL_ID
GTPV2_ULI_CELL_TAC
GTPV2_ULI_MCC
GTPV2_ULI_MNC
HASSH_CLIENT
HASSH_SERVER
HTTP_HOST
HTTP_METHOD
HTTP_MIME
HTTP_REFERER
HTTP_RET_CODE
HTTP_SITE
HTTP_UA
HTTP_URL
HTTP_VIA
HTTP_X_FORWARDED_FOR
IMAP_LOGIN
IN_SRC_OSI_SAP
JA3C_HASH
JA3S_HASH
L4_DST_PORT_MAP
L4_SRC_PORT_MAP
L4_SRV_PORT
L4_SRV_PORT_MAP
L7_PROTO
L7_PROTO
L7_PROTO_CATEGORY
L7_PROTO_NAME
LONGEST_FLOW_PKT
MYSQL_APPL_LATENCY_USEC
MYSQL_DB
MYSQL_QUERY
MYSQL_RESPONSE
MYSQL_SERVER_VERSION
MYSQL_USERNAME
NETBIOS_QUERY_NAME
NETBIOS_QUERY_OS
NETBIOS_QUERY_TYPE
NETBIOS_RESPONSE
NPROBE_IPV4_ADDRESS
NUM_PKTS_1024_TO_1514_BYTES
NUM_PKTS_128_TO_256_BYTES
NUM_PKTS_256_TO_512_BYTES
NUM_PKTS_512_TO_1024_BYTES
NUM_PKTS_OVER_1514_BYTES
NUM_PKTS_TTL_128_160
NUM_PKTS_TTL_160_192
NUM_PKTS_TTL_192_224
NUM_PKTS_TTL_2_5
NUM_PKTS_TTL_224_255
NUM_PKTS_TTL_5_32
NUM_PKTS_TTL_64_96
NUM_PKTS_TTL_64_96
NUM_PKTS_TTL_96_128
NUM_PKTS_TTL_EQ_1
NUM_PKTS_UP_TO_128_BYTES
OOORDER_IN_PKTS
OOORDER_OUT_PKTS
ORACLE_QUERY
ORACLE_QUERY_DURATION
ORACLE_RSP_CODE
ORACLE_RSP_STRING
ORACLE_USERNAME
OUT_DST_OSI_SAP
PAYLOAD_HASH
PKT_VECTOR
PLUGIN_NAME
POP_USER
PROTOCOL_MAP
RADIUS_ACCT_IN_OCTETS
RADIUS_ACCT_IN_PKTS
RADIUS_ACCT_OUT_OCTETS
RADIUS_ACCT_OUT_PKTS
RADIUS_ACCT_SESSION_ID
RADIUS_ACCT_STATUS_TYPE
RADIUS_CALLED_STATION_ID
RADIUS_CALLING_STATION_ID
RADIUS_FRAMED_IP_ADDR
RADIUS_NAS_IDENTIFIER
RADIUS_NAS_IP_ADDR
RADIUS_REQ_MSG_TYPE
RADIUS_RSP_MSG_TYPE
RADIUS_USER_IMEI
RADIUS_USER_IMSI
RADIUS_USER_NAME
RETRANSMITTED_IN_BYTES
RETRANSMITTED_IN_PKTS
RETRANSMITTED_OUT_BYTES
RETRANSMITTED_OUT_PKTS
RTP_DTMF_TONES
RTP_FIRST_SEQ
RTP_FIRST_TS
RTP_IN_JITTER
RTP_IN_MAX_DELTA
RTP_IN_MOS
RTP_IN_PAYLOAD_TYPE
RTP_IN_PKT_DROP
RTP_IN_PKT_LOST
RTP_IN_R_FACTOR
RTP_IN_TRANSIT
RTP_LAST_SEQ
RTP_LAST_TS
RTP_MOS
RTP_OUT_JITTER
RTP_OUT_MAX_DELTA
RTP_OUT_MOS
RTP_OUT_PAYLOAD_TYPE
RTP_OUT_PKT_DROP
RTP_OUT_PKT_LOST
RTP_OUT_R_FACTOR
RTP_OUT_TRANSIT
RTP_R_FACTOR
RTP_RTT
RTP_SIP_CALL_ID
RTP_SSRC
S1AP_CAUSE_ENB_TO_MME
S1AP_DETAILED_CAUSE_ENB_TO_MME
S1AP_ENB_UE_S1AP_ID
S1AP_MME_UE_S1AP_ID
S1AP_MSG_EMM_TYPE_ENB_TO_MME
S1AP_MSG_EMM_TYPE_MME_TO_ENB
S1AP_MSG_ESM_TYPE_ENB_TO_MME
S1AP_MSG_ESM_TYPE_MME_TO_ENB
SEQ_PLEN
SEQ_PLEN_HASH
SEQ_TDIFF
SEQ_TDIFF_HASH
SERVER_NW_LATENCY_MS
SERVER_TCP_FLAGS
SHORTEST_FLOW_PKT
SIP_BYE_OK_TIME
SIP_BYE_TIME
SIP_C_IP
SIP_CALL_ID
SIP_CALL_STATE
SIP_CALLED_PARTY
SIP_CALLING_PARTY
SIP_CANCEL_OK_TIME
SIP_CANCEL_TIME
SIP_INVITE_FAILURE_TIME
SIP_INVITE_OK_TIME
SIP_INVITE_TIME
SIP_REASON_CAUSE
SIP_RESPONSE_CODE
SIP_RINGING_TIME
SIP_RTP_CODECS
SIP_RTP_IPV4_DST_ADDR
SIP_RTP_IPV4_SRC_ADDR
SIP_RTP_L4_DST_PORT
SIP_RTP_L4_SRC_PORT
SIP_TRYING_TIME
SIP_UAC
SIP_UAS
SMTP_MAIL_FROM
SMTP_RCPT_TO
SRC_AS_MAP
SRC_AS_PATH_1
SRC_AS_PATH_10
SRC_AS_PATH_2
SRC_AS_PATH_3
SRC_AS_PATH_4
SRC_AS_PATH_5
SRC_AS_PATH_6
SRC_AS_PATH_7
SRC_AS_PATH_8
SRC_AS_PATH_9
SRC_FATHER_PROC_NAME
SRC_FATHER_PROC_PID
SRC_FRAGMENTS
SRC_HOST_NAME
SRC_IP_CITY
SRC_IP_COUNTRY
SRC_IP_LAT
SRC_IP_LONG
SRC_PROC_ACTUAL_MEMORY
SRC_PROC_AVERAGE_CPU_LOAD
SRC_PROC_NAME
SRC_PROC_NUM_PAGE_FAULTS
SRC_PROC_PCTG_IOWAIT
SRC_PROC_PEAK_MEMORY
SRC_PROC_PID
SRC_PROC_UID
SRC_PROC_USER_NAME
SRC_TO_DST_AVG_THROUGHPUT
SRC_TO_DST_MAX_THROUGHPUT
SRC_TO_DST_MIN_THROUGHPUT
SRC_TO_DST_SECOND_BYTES
SSDP_HOST
SSDP_METHOD
SSDP_SERVER
SSDP_TYPE
SSDP_USN
SSL_CIPHER
SSL_SERVER_NAME
SSL_UNSAFE_CIPHER
SSL_VERSION
TCP_WIN_MAX_IN
TCP_WIN_MAX_OUT
TCP_WIN_MIN_IN
TCP_WIN_MIN_OUT
TCP_WIN_MSS_IN
TCP_WIN_MSS_OUT
TCP_WIN_SCALE_IN
TCP_WIN_SCALE_OUT
UNTUNNELED_IPV4_DST_ADDR
UNTUNNELED_IPV4_SRC_ADDR
UNTUNNELED_IPV6_DST_ADDR
UNTUNNELED_IPV6_SRC_ADDR
UNTUNNELED_L4_DST_PORT
UNTUNNELED_L4_SRC_PORT
UNTUNNELED_PROTOCOL
UPSTREAM_SESSION_ID
UPSTREAM_TUNNEL_ID
USER_NAME
WHOIS_DAS_DOMAIN

A10 Networks (PEN: 40842)

NameCommunityBasicStandardPremium
cgn-flow-direction
Custom1
Custom2
Custom3
DestZone
flowDurationMilliseconds64
fwDenyReset
fwdTupleType
fwdVNPID
mobileIMEI
revTupleType
revVNPID
RuleName
RuleSetName
SourceZone