Skip to main content
Version: 6.4

Netflow IEs

The ElastiFlow Unified Flow Collector supports Netflow versions 1, 5, 6, 7 and 9 records.

Netflow v1

The ElastiFlow Unified Flow Collector supports 14 unique Netflow v1 information elements (IE).

NameCommunityBasicStandardPremium
srcaddr
dstaddr
nexthop
input
output
dPkts
dOctets
First
Last
srcport
dstport
prot
tos
tcp_flags

Netflow v5

The ElastiFlow Unified Flow Collector support 18 unique Netflow v5 information elements (IE).

NameCommunityBasicStandardPremium
srcaddr
dstaddr
nexthop
input
output
dPkts
dOctets
First
Last
srcport
dstport
tcp_flags
prot
tos
src_as
dst_as
src_mask
dst_mask

Netflow v6

The ElastiFlow Unified Flow Collector support 18 unique Netflow v6 information elements (IE).

NameCommunityBasicStandardPremium
srcaddr
dstaddr
nexthop
input
output
dPkts
dOctets
First
Last
srcport
dstport
tcp_flags
prot
tos
src_as
dst_as
src_mask
dst_mask

Netflow v7

The ElastiFlow Unified Flow Collector support 19 unique Netflow v7 information elements (IE).

NameCommunityBasicStandardPremium
srcaddr
dstaddr
nexthop
input
output
dPkts
dOctets
First
Last
srcport
dstport
tcp_flags
prot
tos
src_as
dst_as
src_mask
dst_mask
ipv4RouterSc

Netflow v9

The ElastiFlow Unified Flow Collector supports over 1500 unique Netflow v9 information elements (IE).

PENVendorIEs
0IANA462
9Cisco581
193Ericsson8
4056StreamCORE28
4321Riverbed12
8712LANcope (Cisco)43
25461Palo Alto Networks2
33610FastIP / Boundary23
35632ntop370
40842A10 Networks15

Standards-based IEs (PEN: 0)

IDNameCommunityBasicStandardPremium
1octetDeltaCount
2packetDeltaCount
3deltaFlowCount
4protocolIdentifier
5ipClassOfService
6tcpControlBits
7sourceTransportPort
8sourceIPv4Address
9sourceIPv4PrefixLength
10ingressInterface
11destinationTransportPort
12destinationIPv4Address
13destinationIPv4PrefixLength
14egressInterface
15ipNextHopIPv4Address
16bgpSourceAsNumber
17bgpDestinationAsNumber
18bgpNextHopIPv4Address
19postMCastPacketDeltaCount
20postMCastOctetDeltaCount
21flowEndSysUpTime
22flowStartSysUpTime
23postOctetDeltaCount
24postPacketDeltaCount
25minimumIpTotalLength
26maximumIpTotalLength
27sourceIPv6Address
28destinationIPv6Address
29sourceIPv6PrefixLength
30destinationIPv6PrefixLength
31flowLabelIPv6
32icmpTypeCodeIPv4
33igmpType
34samplingInterval
35samplingAlgorithm
36flowActiveTimeout
37flowIdleTimeout
38engineType
39engineId
40exportedOctetTotalCount
41exportedMessageTotalCount
42exportedFlowRecordTotalCount
44sourceIPv4Prefix
45destinationIPv4Prefix
46mplsTopLabelType
47mplsTopLabelIPv4Address
48samplerId
49samplerMode
50samplerRandomInterval
51classId
52minimumTTL
53maximumTTL
54fragmentIdentification
55postIpClassOfService
56sourceMacAddress
57postDestinationMacAddress
58vlanId
59postVlanId
60ipVersion
61flowDirection
62ipNextHopIPv6Address
63bgpNextHopIPv6Address
64ipv6ExtensionHeaders
65transportPacketLoss Cisco Legacy
66transportUnreachability Cisco Legacy
67transportLatency Cisco Legacy
68dataPoints Cisco Legacy
69variance Cisco Legacy
70mplsTopLabelStackSection
71mplsLabelStackSection2
72mplsLabelStackSection3
73mplsLabelStackSection4
74mplsLabelStackSection5
75mplsLabelStackSection6
76mplsLabelStackSection7
77mplsLabelStackSection8
78mplsLabelStackSection9
79mplsLabelStackSection10
80destinationMacAddress
81postSourceMacAddress
82interfaceName
83interfaceDescription
84samplerName
85octetTotalCount
86packetTotalCount
87flagsAndSamplerId
88fragmentOffset
89forwardingStatus
90mplsVpnRouteDistinguisher
91mplsTopLabelPrefixLength
92srcTrafficIndex
93dstTrafficIndex
94applicationDescription
95applicationId
96applicationName
97subApplicationTag Cisco Legacy
98postIpDiffServCodePoint
99multicastReplicationFactor
100className
101classificationEngineId
102layer2packetSectionOffset
103layer2packetSectionSize
104layer2packetSectionData
105applicationVersion Cisco Legacy
106applicationVersionName Cisco Legacy
107applicationVendor Cisco Legacy
109subApplicationName Cisco Legacy
110subApplicationDescription Cisco Legacy
111templateParameterRangeEnd Cisco Legacy
128bgpNextAdjacentAsNumber
129bgpPrevAdjacentAsNumber
130exporterIPv4Address
131exporterIPv6Address
132droppedOctetDeltaCount
133droppedPacketDeltaCount
134droppedOctetTotalCount
135droppedPacketTotalCount
136flowEndReason
137commonPropertiesId
138observationPointId
139icmpTypeCodeIPv6
140mplsTopLabelIPv6Address
141lineCardId
142portId
143meteringProcessId
144exportingProcessId
145templateId
146wlanChannelId
147wlanSSID
148flowId
149observationDomainId
150flowStartSeconds
151flowEndSeconds
152flowStartMilliseconds
153flowEndMilliseconds
154flowStartMicroseconds
155flowEndMicroseconds
156flowStartNanoseconds
157flowEndNanoseconds
158flowStartDeltaMicroseconds
159flowEndDeltaMicroseconds
160systemInitTimeMilliseconds
161flowDurationMilliseconds
162flowDurationMicroseconds
163observedFlowTotalCount
164ignoredPacketTotalCount
165ignoredOctetTotalCount
166notSentFlowTotalCount
167notSentPacketTotalCount
168notSentOctetTotalCount
169destinationIPv6Prefix
170sourceIPv6Prefix
171postOctetTotalCount
172postPacketTotalCount
173flowKeyIndicator
174postMCastPacketTotalCount
175postMCastOctetTotalCount
176icmpTypeIPv4
177icmpCodeIPv4
178icmpTypeIPv6
179icmpCodeIPv6
180udpSourcePort
181udpDestinationPort
182tcpSourcePort
183tcpDestinationPort
184tcpSequenceNumber
185tcpAcknowledgementNumber
186tcpWindowSize
187tcpUrgentPointer
188tcpHeaderLength
189ipHeaderLength
190totalLengthIPv4
191payloadLengthIPv6
192ipTTL
193nextHeaderIPv6
194mplsPayloadLength
195ipDiffServCodePoint
196ipPrecedence
197fragmentFlags
198octetDeltaSumOfSquares
199octetTotalSumOfSquares
200mplsTopLabelTTL
201mplsLabelStackLength
202mplsLabelStackDepth
203mplsTopLabelExp
204ipPayloadLength
205udpMessageLength
206isMulticast
207ipv4IHL
208ipv4Options
209tcpOptions
210paddingOctets
211collectorIPv4Address
212collectorIPv6Address
213exportInterface
214exportProtocolVersion
215exportTransportProtocol
216collectorTransportPort
217exporterTransportPort
218tcpSynTotalCount
219tcpFinTotalCount
220tcpRstTotalCount
221tcpPshTotalCount
222tcpAckTotalCount
223tcpUrgTotalCount
224ipTotalLength
225postNATSourceIPv4Address
226postNATDestinationIPv4Address
227postNAPTSourceTransportPort
228postNAPTDestinationTransportPort
229natOriginatingAddressRealm
230natEvent
231initiatorOctets
232responderOctets
233firewallEvent
234ingressVRFID
235egressVRFID
236VRFname
237postMplsTopLabelExp
238tcpWindowScale
239biflowDirection
240ethernetHeaderLength
241ethernetPayloadLength
242ethernetTotalLength
243dot1qVlanId
244dot1qPriority
245dot1qCustomerVlanId
246dot1qCustomerPriority
247metroEvcId
248metroEvcType
249pseudoWireId
250pseudoWireType
251pseudoWireControlWord
252ingressPhysicalInterface
253egressPhysicalInterface
254postDot1qVlanId
255postDot1qCustomerVlanId
256ethernetType
257postIpPrecedence
258collectionTimeMilliseconds
259exportSctpStreamId
260maxExportSeconds
261maxFlowEndSeconds
262messageMD5Checksum
263messageScope
264minExportSeconds
265minFlowStartSeconds
266opaqueOctets
267sessionScope
268maxFlowEndMicroseconds
269maxFlowEndMilliseconds
270maxFlowEndNanoseconds
271minFlowStartMicroseconds
272minFlowStartMilliseconds
273minFlowStartNanoseconds
274collectorCertificate
275exporterCertificate
276dataRecordsReliability
277observationPointType
278newConnectionDeltaCount
279connectionSumDurationSeconds
280connectionTransactionId
281postNATSourceIPv6Address
282postNATDestinationIPv6Address
283natPoolId
284natPoolName
285anonymizationFlags
286anonymizationTechnique
287informationElementIndex
288p2pTechnology
289tunnelTechnology
290encryptedTechnology
294bgpValidityState
295IPSecSPI
296greKey
297natType
298initiatorPackets
299responderPackets
300observationDomainName
301selectionSequenceId
302selectorId
303informationElementId
304selectorAlgorithm
305samplingPacketInterval
306samplingPacketSpace
307samplingTimeInterval
308samplingTimeSpace
309samplingSize
310samplingPopulation
311samplingProbability
312dataLinkFrameSize
313ipHeaderPacketSection
314ipPayloadPacketSection
315dataLinkFrameSection
316mplsLabelStackSection
317mplsPayloadPacketSection
318selectorIdTotalPktsObserved
319selectorIdTotalPktsSelected
320absoluteError
321relativeError
322observationTimeSeconds
323observationTimeMilliseconds
324observationTimeMicroseconds
325observationTimeNanoseconds
326digestHashValue
327hashIPPayloadOffset
328hashIPPayloadSize
329hashOutputRangeMin
330hashOutputRangeMax
331hashSelectedRangeMin
332hashSelectedRangeMax
333hashDigestOutput
334hashInitialiserValue
335selectorName
336upperCILimit
337lowerCILimit
338confidenceLevel
339informationElementDataType
340informationElementDescription
341informationElementName
342informationElementRangeBegin
343informationElementRangeEnd
344informationElementSemantics
345informationElementUnits
346privateEnterpriseNumber
347virtualStationInterfaceId
348virtualStationInterfaceName
349virtualStationUUID
350virtualStationName
351layer2SegmentId
352layer2OctetDeltaCount
353layer2OctetTotalCount
354ingressUnicastPacketTotalCount
355ingressMulticastPacketTotalCount
356ingressBroadcastPacketTotalCount
357egressUnicastPacketTotalCount
358egressBroadcastPacketTotalCount
359monitoringIntervalStartMilliSeconds
360monitoringIntervalEndMilliSeconds
361portRangeStart
362portRangeEnd
363portRangeStepSize
364portRangeNumPorts
365staMacAddress
366staIPv4Address
367wtpMacAddress
368ingressInterfaceType
369egressInterfaceType
370rtpSequenceNumber
371userName
372applicationCategoryName
373applicationSubCategoryName
374applicationGroupName
375originalFlowsPresent
376originalFlowsInitiated
377originalFlowsCompleted
378distinctCountOfSourceIPAddress
379distinctCountOfDestinationIPAddress
380distinctCountOfSourceIPv4Address
381distinctCountOfDestinationIPv4Address
382distinctCountOfSourceIPv6Address
383distinctCountOfDestinationIPv6Address
384valueDistributionMethod
385rfc3550JitterMilliseconds
386rfc3550JitterMicroseconds
387rfc3550JitterNanoseconds
388dot1qDEI
389dot1qCustomerDEI
390flowSelectorAlgorithm
391flowSelectedOctetDeltaCount
392flowSelectedPacketDeltaCount
393flowSelectedFlowDeltaCount
394selectorIDTotalFlowsObserved
395selectorIDTotalFlowsSelected
396samplingFlowInterval
397samplingFlowSpacing
398flowSamplingTimeInterval
399flowSamplingTimeSpacing
400hashFlowDomain
401transportOctetDeltaCount
402transportPacketDeltaCount
403originalExporterIPv4Address
404originalExporterIPv6Address
405originalObservationDomainId
406intermediateProcessId
407ignoredDataRecordTotalCount
408dataLinkFrameType
409sectionOffset
410sectionExportedOctets
411dot1qServiceInstanceTag
412dot1qServiceInstanceId
413dot1qServiceInstancePriority
414dot1qCustomerSourceMacAddress
415dot1qCustomerDestinationMacAddress
416layer2OctetDeltaCount
417postLayer2OctetDeltaCount
418postMCastLayer2OctetDeltaCount
419layer2OctetTotalCount
420postLayer2OctetTotalCount
421postMCastLayer2OctetTotalCount
422minimumLayer2TotalLength
423maximumLayer2TotalLength
424droppedLayer2OctetDeltaCount
425droppedLayer2OctetTotalCount
426ignoredLayer2OctetTotalCount
427notSentLayer2OctetTotalCount
428layer2OctetDeltaSumOfSquares
429layer2OctetTotalSumOfSquares
430layer2FrameDeltaCount
431layer2FrameTotalCount
432pseudoWireDestinationIPv4Address
433ignoredLayer2FrameTotalCount
434mibObjectValueInteger
435mibObjectValueOctetString
436mibObjectValueOID
437mibObjectValueBits
438mibObjectValueIPAddress
439mibObjectValueCounter
440mibObjectValueGauge
441mibObjectValueTimeTicks
442mibObjectValueUnsigned
445mibObjectIdentifier
446mibSubIdentifier
447mibIndexIndicator
448mibCaptureTimeSemantics
449mibContextEngineID
450mibContextName
451mibObjectName
452mibObjectDescription
453mibObjectSyntax
454mibModuleName
455mobileIMSI
456mobileMSISDN
457httpStatusCode
458sourceTransportPortsLimit
459httpRequestMethod
460httpRequestHost
461httpRequestTarget
462httpMessageVersion
463natInstanceID
464internalAddressRealm
465externalAddressRealm
466natQuotaExceededEvent
467natThresholdEvent
468httpUserAgent
469httpContentType
470httpReasonPhrase
471maxSessionEntries
472maxBIBEntries
473maxEntriesPerUser
474maxSubscribers
475maxFragmentsPendingReassembly
476addressPoolHighThreshold
477addressPoolLowThreshold
478addressPortMappingHighThreshold
479addressPortMappingLowThreshold
480addressPortMappingPerUserHighThreshold
481globalAddressMappingHighThreshold
482vpnIdentifier
483bgpCommunity
486bgpExtendedCommunity
489bgpLargeCommunity

Cisco (PEN: 9)

NameCommunityBasicStandardPremium
scTag
scTrafficProcessorId
scSourceIpSample
scDestinationIpSample
scFlowContextId
scSubscriberId
scPackageId
scServiceId
scProtocolId
scSkipppedSessions
scInitiatingSide
scReportTime
scTransactionDurationMillisec
scTimeFrame
scSessionUpstreamVolume
scSessionDownstreamVolume
scProtocolSignature
scZoneId
scFlavorId
scFlowCloseMode
scAccessString
scInfoString
scClientPort
scServerPort
scSubscriberCounterId
scServiceUsageCounterId
scBreachState
scReason
scConfiguredDuration
scDuration
scEndTime
scUpstreamVolume
scDownstreamVolume
scSessions
scSeconds
scPackageCounterId
scGeneratorId
scServiceGlobalCounterId
scConcurrentSessions
scActiveSubscribers
scTotalActiveSubscribers
scLinkId
scAttackId
scAttackIp
scAttackOtherIp
scAttackPortNumber
scAttackType
scAttackSide
scAttackIpProtocol
scAttacks
scAttackMaliciousSessions
INGRESS_ACL_ID
EGRESS_ACL_ID
FW_EXT_EVENT
FW_EVENT_LEVEL
FW_EVENT_LEVEL_ID
FW_CONFIGURED_VALUE
FW_ERM_EXT_EVENT
FW_ERM_EXT_EVENT_DESC
audio rtp packets lost
audio rtp packets expected
audio rtp fwd out-of-sequence sum
audio rtp seconds ok
audio rtp seconds concealed
audio rtp seconds concealed severe
audio rtp jitter ticks
audio g107 impairment
audio g107 lossRate
audio g107 codec baseline
audio g107 codec baseline bpl
audio g107 impairment one-way-delay
audio concealment ratio now
audio concealment ratio minimum
audio concealment ratio maximum
audio concealment time
audio speech time
audio packets ok
audio packets cs
audio packets scs
audio packets rtp
audio packets silence
audio duration receive
audio duration receive voice
audio duration early packet
audio duration clock adjust
audio duration playout increase
audio duration playout decrease
audio duration late discard
audio frame size
audio frames-per-packet
audio frame arriving times difference
audio frame arriving times difference vari
audio noise level current
audio noise level average
audio noise level minimum
audio noise level maximum
audio noise level configured
audio snr current
audio snr average
audio snr minimum
audio snr maximum
audio snr configured
vxlan sgt
vxlan flags
vxlan vtep input
vxlan vtep output
SGT_SOURCE_TAG
SGT_DESTINATION_TAG
SGT_SOURCE_NAME
SGT_DESTINATION_NAME
flow cts switch derived-sgt
FW_EXT_EVENT
FW_BLACKOUT_SECS
FW_HALFOPEN_HIGH
FW_HALFOPEN_RATE
FW_ZONEPAIR_ID
FW_MAX_SESSIONS
FW_ZONEPAIR_NAME
FW_EXT_EVENT_DESC
FW_SUMMARY_PKT_CNT
FW_HALFOPEN_CNT
waas dre input
waas dre output
waas lz input
waas lz output
waas original bytes
waas optimised bytes
waas application
waas class
waas connection mode
waas bytes input
waas bytes output
PACKETS_DROPPED
counter packets dropped permanent
PACKET_RATE
BYTE_RATE
application media bytes counter
application media bytes counter permanent
application media bytes rate
application media packets counter
application media packets counter permanen
application media packets rate
application media packets rate variation
application media event
monitor event
timestamp interval
transport packets expected counter
transport packets expected counter permane
transport round-trip-time
transport event packet-loss counter
transport event packet-loss counter perman
transport packets lost counter
transport packets lost counter permanent
transport packets lost rate
transport rtp ssrc
transport rtp jitter mean
transport rtp jitter minimum
transport rtp jitter maximum
misc unsupported
counter bytes rate per-flow
counter bytes rate per-flow min
counter bytes rate per-flow max
counter packets rate per-flow
counter packets rate per-flow min
counter packets rate per-flow max
application media bytes rate per-flow
application media bytes rate per-flow min
application media bytes rate per-flow max
application media packets rate variation m
application media packets rate variation m
transport rtp flow count
transport rtp payload-type
transport packets lost counter min
transport packets lost counter max
transport event packet-loss counter min
transport event packet-loss counter max
transport packets lost rate min
transport packets lost rate max
transport tcp flow count
transport round-trip-time sum
transport round-trip-time samples
transport round-trip-time min
transport round-trip-time max
metadata global-session-id
metadata multi-party-session-id
metadata clock-rate
server response time average
refused sessions
client network delay average
server network delay average
NETWORK_DELAY_AVG network delay average
application delay average
session time minimum
session time maximum
session time average
transaction time average
closed sessions
retransmitted packets
transport bytes out-of-order
client throughput average
unresponsive sessions
transport packets out-of-order
IPv4 source observation node
IPv4 destination observation node
IPv6 source observation node
IPv6 destination observation node
pfr one-way-delay sum
pfr one-way-delay samples
ONE_WAY_DELAY pfr one-way-delay
packet arrival timestamp
transport tcp window-size minimum
transport tcp window-size maximum
transport tcp window-size average
transport tcp maximum-segment-size
transport tcp window-size sum
tcpWindowSizeSum
transport rtp jitter mean sum
application media packets rate variation s
transport tcp window-size average sum
transport rtp jitter inter arrival sum
transport rtp jitter inter arrival samples
transport rtp jitter inter arrival mean
pfr site source id ipv4
pfr site destination id ipv4
transport bytes lost
transport bytes expected
transport bytes lost rate
network delay sum
network delay sample
pfr counter event error traffic-class miti
pfr counter event error traffic-class miti
pfr counter event error traffic-class miti
pfr site source prefix ipv4
pfr site destination prefix ipv4
pfr site source prefix ipv6
pfr site destination prefix ipv6
pfr site source prefix mask ipv4
pfr site destination prefix mask ipv4
pfr site source prefix mask ipv6
pfr site destination prefix mask ipv6
pfr service provider tag identifier
pfr label identifier
application voice number called
application voice number calling
application voice setup time
application voice call duration
application voice rx bad-packet
application voice rx out-of-sequence
application voice codec id
application voice play delay current
application voice play delay minimum
application voice play delay maximum
application voice sip call-id
application voice router global-call-id
application voice delay round-trip
application voice delay end-point
application voice r-factor 1
application voice r-factor 2
application voice mos conversation
application voice mos listening
application voice concealment-ratio averag
application voice jitter configured type
application voice jitter configured minimu
application voice jitter configured maximu
application voice jitter configured initia
application voice rx early-packet count
application voice rx late-packet count
application voice jitter buffer-overrun
application voice packet conceal-count
bandwidth used
bandwidth used percentage
application video resolution width last
application video resolution height last
application video frame rate
application video payload bitrate average
application video payload bitrate fluctuat
application video frame I counter frames
application video frame I counter packets
application video frame I counter bytes
application video frame STR counter frames
application video frame STR counter packet
application video frame STR counter bytes
application video frame LTR counter frames
application video frame LTR counter packet
application video frame LTR counter bytes
application video frame super-P counter fr
application video frame super-P counter pa
application video frame super-P counter by
application video frame NR counter frames
application video frame NR counter packets
application video frame NR counter bytes
application video frame I slice-quantizati
application video frame STR slice-quantiza
application video frame LTR slice-quantiza
application video frame super-P slice-quan
application video frame NR slice-quantizat
application video eMOS compression bitstre
application video eMOS compression network
application video frame I counter packets
application video frame STR counter packet
application video frame LTR counter packet
application video frame super-P counter pa
application video frame NR counter packets
application video frame percentage damaged
application video eMOS packet-loss bitstre
application video eMOS packet-loss network
application video scene-complexity
application video level-of-motion
transport rtp sequence-number
transport rtp sequence-number last
iOAM my node-id
iOAM my node name
start timestamp
end timestamp
IOAM packet counter
IOAM byte count
IOAM cs0 packet counter
IOAM cs0 byte count
IOAM cs1 packet counter
IOAM cs1 byte count
IOAM cs2 packet counter
IOAM cs2 byte count
IOAM cs3 packet counter
IOAM cs3 byte count
IOAM cs4 packet counter
IOAM cs4 byte count
IOAM cs5 packet counter
IOAM cs5 byte count
IOAM cs6 packet counter
IOAM cs6 byte count
IOAM cs7 packet counter
IOAM cs7 byte count
IOAM lost packet counter
IOAM duplicate packet counter
IOAM reordered packet counter
IOAM highest PPC sequence number
iOAM node-id
ipv6 protocol filed
iOAM E2E Header
iOAM Path Map
iOAM number of nodes
iOAM node1 id
iOAM node1 in if id
iOAM node1 eif id
iOAM node2 id
iOAM node2 in if id
iOAM node2 eif id
iOAM node3 id
iOAM node3 in if id
iOAM node3 eif id
iOAM node4 id
iOAM node4 in if id
iOAM node4 eif id
iOAM Application metadata
iOAM sfc-id
iOAM sfc validated count
iOAM sfc invalidated count
pfr br ipv4 address
pfr status
reason id
threshold
pfr priority
long-term round-trip-time
mos below
rsvp bw pool
flow left time
bw percentage
bw fee
transport source-port min
transport source-port max
transport destination-port min
transport destination-port max
capacity
ingress bw
max ingress bw
egress bw
max egress bw
ingress rollup bw
egress rollup bw
kth rollup bw
link group name
bgp community
bgp prepend
entrance downgrade
discard rollup count
services pfr class-tag-id
services pfr mc-id
sip header from uri host ip addr
sip header from uri userinfo user
sip header to uri host ip addr
sip header to uri userinfo user
sip sess duration
sip sess end_reason
sip sess_dialed
sip sess_connected
sip sess_failed
AAA_USERNAME
XLATE_SRC_ADDR_IPV4
XLATE_DST_ADDR_IPV4
XLATE_SRC_PORT
XLATE_DST_PORT
FW_EVENT
artClientNetworkTimeLongLivedMaximum
artClientNetworkTimeLongLivedMinimum
artServerNetworkTimeLongLivedMaximum
artServerNetworkTimeLongLivedMinimum
policy qos classification hierarchy
c3pl class cce-id
c3pl class name
c3pl class type
c3pl policy cce-id
c3pl policy name
c3pl policy type
interface input fex-node-id
interface output fex-node-id
interface power
monitor device-type
connection server counter bytes network
connection client counter bytes network
wireless afd drop packets
wireless afd accept packets
wireless afd drop bytes
wireless afd accept bytes
connection concurrent-connections
application transaction counter new
services waas segment
services waas passthrough-reason
connection delay network long-lived to-ser
connection delay network long-lived to-cli
connection delay network long-lived client
connection delay network client-to-server
connection delay network to-server num-sam
connection delay network to-client num-sam
artClientpackets
artServerpackets
connection client counter bytes retransmit
connection client counter packets retransm
connection server counter bytes retransmit
connection server counter packets retransm
connection transaction counter complete
connection transaction duration sum
connection transaction duration max
connection transaction duration min
art count new connections
art count responses
art count responses histogram bucket1
art count responses histogram bucket2
art count responses histogram bucket3
art count responses histogram bucket4
art count responses histogram bucket5
art count responses histogram bucket6
art count responses histogram bucket7
connection delay response to-server histog
connection delay response to-server sum
connection delay response to-server max
connection delay response to-server min
connection delay application sum
connection delay application max
connection delay application min
connection delay response client-to-server
connection delay response client-to-server
connection delay response client-to-server
connection delay network client-to-server
connection delay network client-to-server
connection delay network client-to-server
connection delay network to-client sum
connection delay network to-client max
connection delay network to-client min
connection delay network to-server sum
connection delay network to-server max
connection delay network to-server min
mos worst 100
mos quality
mos total count
application http uri statistics
policy qos queue index
policy qos queue drops
datalink event
datalink event extended
l4r server ipv4 address
l4r server transport port
l4r server ipv6 address
l4r event
l4r event timestamp
pbhk mapped ipv4 address
pbhk mapped transport port
pbhk event
pbhk event timestamp
ETTA_INITIAL_DATA_PACKET
ETTA_SEQUENCE_OF_PACKET_LENGTHS_AND_TIMES
ETTA_SEQUENCE_OF_APPLICATION_LENGTHS_AND_TIMES
ETAByteDistribution
ETTA_TLS_RECORDS
ETTA_TLS_CIPHER_SUITES
ETTA_TLS_EXTENSIONS
ETTA_TLS_VERSION
ETTA_TLS_KEY_LENGTH
ETTA_TLS_SESSION_ID
ETTA_TLS_RANDOM
ETTA_TLS_EXTENSION_LENGTHS
ETTA_TLS_EXTENSION_TYPES
application family name
application set name
application category name
application sub category name
application group name
AVCSubApplicationValue
connection client ipv4 address
connection server ipv4 address
connection client ipv6 address
connection server ipv6 address
connection client transport port
connection server transport port
connection id
application traffic-class
application business-relevance
nvzFlowUDID
nvzFlowLoggedInUser
nvzFlowOSName
nvzFlowOSVersion
nvzFlowSystemManufacturer
nvzFlowSystemType
nvzFlowProcessAccount
nvzFlowParentProcessAccount
nvzFlowProcessName
nvzFlowProcessHash
nvzFlowParentProcessName
nvzFlowParentProcessHash
nvzFlowDNSSuffix
nvzFlowDestinationHostname
nvzFlowL4ByteCountIn
nvzFlowL4ByteCountOut
nvzFlowOSEdition
nvzFlowModuleNameList
nvzFlowModuleHashList
nvzFlowCoordinatesList
nvzFlowInterfaceInfoUID
nvzFlowInterfaceIndex
nvzFlowInterfaceType
nvzFlowInterfaceName
nvzFlowInterfaceDetailsList
nvzFlowInterfaceMac
nvzFlowUserAccountType
nvzFlowProcessAccountType
nvzFlowParentProcessAccountType
overlay session id input
overlay session id output
routing vrf service
tloc table overlay session id
tloc local system ip address
tloc local color
tloc remote system ip address
tloc remote color
tloc tunnel protocol
connection id long
drop cause id
counter bytes sdwan dropped long
sdwan sla-not-met
sdwan preferred-color-not-met
sdwan qos-queue-id
drop cause name
counter packets appqoe fec-d-pkts
counter packets appqoe fec-r-pkts
counter packets appqoe pkt-dup-d-pkts-orig
counter packets appqoe pkt-dup-d-pkts-dup
counter packets appqoe pkt-dup-r-pkts
counter packets sdwan pkt-cxp-d-pkts
counter bytes appqoe ssl-read
counter bytes appqoe ssl-written
counter bytes appqoe ssl-en-read
counter bytes appqoe ssl-en-written
counter bytes appqoe ssl-de-read
counter bytes appqoe ssl-de-written
appqoe ssl service type
appqoe ssl traffic type
appqoe ssl policy action
ETAInitialDataPacketOld
ETASequenceofPktLengthsandTimes
wlan_id
timestampAbsoluteMonitoring-intervalStart
timestampAbsoluteMonitoring-intervalEnd

Ericsson (PEN: 193)

NameCommunityBasicStandardPremium
NAT_LOG_FIELD_IDX_CONTEXT_ID
NAT_LOG_FIELD_IDX_CONTEXT_NAME
NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC
NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC
NAT_LOG_FIELD_IDX_IPV4_INT_ADDR
NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR
NAT_LOG_FIELD_IDX_EXT_PORT_FIRST
NAT_LOG_FIELD_IDX_EXT_PORT_LAST

StreamCORE (PEN: 4056)

NameCommunityBasicStandardPremium
wan_rtt
net_app_resp_time
total_app_resp_time
tcp_retrans_rate
call_direction
hostname
url
ssl_cn
ssl_org
mos_lq
net_delay
net_loss
net_jitter
net_discard
rtp_clockrate_in
rtp_clockrate_out
codec_in
codec_out
id_rule_1
id_rule_2
id_rule_3
id_rule_4
id_rule_5
id_rule_6
id_rule_7
id_rule_8
id_rule_9
id_rule_10

Riverbed (PEN: 4321)

NameCommunityBasicStandardPremium
Pass-through Reason
WAN Visibility mode
CFE in-path IP Address
SFE in-path IP Address
CFE TCP Port
SFE TCP Port
Outer in-path IP Address
Outer TCP Port
Retransmitted Packets
Retransmitted Bytes
TCP Connection RTT
FE Type

LANcope, now Cisco (PEN: 8712)

NameCommunityBasicStandardPremium
FlowSensorInitiator
FlowSensorTCPSYNACKTotalCount
FlowSensorTCPSRSTotalCount
FlowSensorRoundTripTime
FlowSensorServerResponseTime
FlowSensorRetransmits
FlowSensorTCPBadTotalCount
FlowSensorTCPFragTotalCount
FlowSensorSourceEmailIn
FlowSensorSourceEmailOut
FlowSensorSourceEmailInMessages
FlowSensorSourceEmailOutMessages
FlowSensorSourceEmailInTrys
FlowSensorSourceEmailOutTrys
FlowSensorDestinationEmailIn
FlowSensorDestinationEmailOut
FlowSensorDestinationEmailInMessages
FlowSensorDestinationEmailOutMessages
FlowSensorDestinationEmailInTrys
FlowSensorDestinationEmailOutTrys
FlowSensorTraces
FlowSensorEmbeddedICMPProtocol
FlowSensorEmbeddedICMPType
FlowSensorEmbeddedICMPCode
FlowSensorApplicationIdentifier
FlowSensorBadFlagXmas
FlowSensorBadFlagSYNFIN
FlowSensorBadFlagBadRST
FlowSensorBadFlagNoACK
FlowSensorBadFlagURG
FlowSensorBadFlagNoFlag
FlowSensorShortFragAttack
FlowSensorFragPacketTooShort
FlowSensorFragPacketTooLong
FlowSensorFragPacketDifferentSizes
FlowSensorApplicationDetails
FlowSensorTrustsecSourceIdentifier
EndpointFlowProcessAccount
EndpointFlowProcessName
EndpointFlowProcessHash
EndpointFlowParentProcessAccount
EndpointFlowParentProcessName
EndpointFlowParentProcessHash

Palo Alto (PEN: 25461)

NameCommunityBasicStandardPremium
App-ID
User-ID

FastIP/Boundary (PEN: 33610)

NameCommunityBasicStandardPremium
METER_VERSION
METER_OS_SYSNAME
METER_OS_NODENAME
METER_OS_RELEASE
METER_OS_VERSION
METER_OS_MACHINE
TCP_FLAGS
EPOCH_SECOND
NIC_NAME
NIC_ID
NIC_MAC
NIC_IP
COLLISIONS
ERRORS
NIC_DRIVER_NAME
NIC_DRIVER_VERSION
NIC_FIRMWARE_VERSION
METER_OS_DISTRIBUTION_NAME
BOND_INTERFACE_MODE
BOND_INTERFACE_PHYSICAL_NIC_COUNT
BOND_INTERFACE_ID
TCP_HANDSHAKE_RTT_USEC
APP_RTT_USEC

ntop (PEN: 35632)

NameCommunityBasicStandardPremium
CLIENT_TCP_FLAGS
SERVER_TCP_FLAGS
SRC_FRAGMENTS
DST_FRAGMENTS
SRC_TO_DST_MAX_THROUGHPUT
SRC_TO_DST_MIN_THROUGHPUT
SRC_TO_DST_AVG_THROUGHPUT
DST_TO_SRC_MAX_THROUGHPUT
DST_TO_SRC_MIN_THROUGHPUT
DST_TO_SRC_AVG_THROUGHPUT
NUM_PKTS_UP_TO_128_BYTES
NUM_PKTS_128_TO_256_BYTES
NUM_PKTS_256_TO_512_BYTES
NUM_PKTS_512_TO_1024_BYTES
NUM_PKTS_1024_TO_1514_BYTES
NUM_PKTS_OVER_1514_BYTES
CUMULATIVE_ICMP_TYPE
SRC_IP_COUNTRY
SRC_IP_CITY
DST_IP_COUNTRY
DST_IP_CITY
FLOW_PROTO_PORT
UPSTREAM_TUNNEL_ID
LONGEST_FLOW_PKT
SHORTEST_FLOW_PKT
RETRANSMITTED_IN_PKTS
RETRANSMITTED_OUT_PKTS
OOORDER_IN_PKTS
OOORDER_OUT_PKTS
UNTUNNELED_PROTOCOL
UNTUNNELED_IPV4_SRC_ADDR
UNTUNNELED_L4_SRC_PORT
UNTUNNELED_IPV4_DST_ADDR
UNTUNNELED_L4_DST_PORT
L7_PROTO
L7_PROTO_NAME
DOWNSTREAM_TUNNEL_ID
FLOW_USER_NAME
FLOW_SERVER_NAME
CLIENT_NW_LATENCY_MS
SERVER_NW_LATENCY_MS
APPL_LATENCY_MS
PLUGIN_NAME
RETRANSMITTED_IN_BYTES
RETRANSMITTED_OUT_BYTES
SIP_CALL_ID
SIP_CALLING_PARTY
SIP_CALLED_PARTY
SIP_RTP_CODECS
SIP_INVITE_TIME
SIP_TRYING_TIME
SIP_RINGING_TIME
SIP_INVITE_OK_TIME
SIP_INVITE_FAILURE_TIME
SIP_BYE_TIME
SIP_BYE_OK_TIME
SIP_CANCEL_TIME
SIP_CANCEL_OK_TIME
SIP_RTP_IPV4_SRC_ADDR
SIP_RTP_L4_SRC_PORT
SIP_RTP_IPV4_DST_ADDR
SIP_RTP_L4_DST_PORT
SIP_RESPONSE_CODE
SIP_REASON_CAUSE
RTP_FIRST_SEQ
RTP_FIRST_TS
RTP_LAST_SEQ
RTP_LAST_TS
RTP_IN_JITTER
RTP_OUT_JITTER
RTP_IN_PKT_LOST
RTP_OUT_PKT_LOST
RTP_OUT_PAYLOAD_TYPE
RTP_IN_MAX_DELTA
RTP_OUT_MAX_DELTA
RTP_IN_PAYLOAD_TYPE
L7_PROTO
SRC_PROC_PID
SRC_PROC_NAME
HTTP_URL
HTTP_RET_CODE
HTTP_REFERER
HTTP_UA
HTTP_MIME
SMTP_MAIL_FROM
SMTP_RCPT_TO
HTTP_HOST
SSL_SERVER_NAME
BITTORRENT_HASH
MYSQL_SERVER_VERSION
MYSQL_USERNAME
MYSQL_DB
MYSQL_QUERY
MYSQL_RESPONSE
ORACLE_USERNAME
ORACLE_QUERY
ORACLE_RSP_CODE
ORACLE_RSP_STRING
ORACLE_QUERY_DURATION
DNS_QUERY
DNS_QUERY_ID
DNS_QUERY_TYPE
DNS_RET_CODE
DNS_NUM_ANSWERS
POP_USER
GTPV1_REQ_MSG_TYPE
GTPV1_RSP_MSG_TYPE
GTPV1_C2S_TEID_DATA
GTPV1_C2S_TEID_CTRL
GTPV1_S2C_TEID_DATA
GTPV1_S2C_TEID_CTRL
GTPV1_END_USER_IP
GTPV1_END_USER_IMSI
GTPV1_END_USER_MSISDN
GTPV1_END_USER_IMEI
GTPV1_APN_NAME
GTPV1_RAI_MCC
GTPV1_RAI_MNC
GTPV1_ULI_CELL_LAC
GTPV1_ULI_CELL_CI
GTPV1_ULI_SAC
GTPV1_RAT_TYPE
RADIUS_REQ_MSG_TYPE
RADIUS_RSP_MSG_TYPE
RADIUS_USER_NAME
RADIUS_CALLING_STATION_ID
RADIUS_CALLED_STATION_ID
RADIUS_NAS_IP_ADDR
RADIUS_NAS_IDENTIFIER
RADIUS_USER_IMSI
RADIUS_USER_IMEI
RADIUS_FRAMED_IP_ADDR
RADIUS_ACCT_SESSION_ID
RADIUS_ACCT_STATUS_TYPE
RADIUS_ACCT_IN_OCTETS
RADIUS_ACCT_OUT_OCTETS
RADIUS_ACCT_IN_PKTS
RADIUS_ACCT_OUT_PKTS
IMAP_LOGIN
DIAMETER_FRAMED_IP_ADDR
DIAMETER_SERVED_IP_ADDR
DIAMETER_CALLING_STATION_ID
DIAMETER_CALLED_STATION_ID
DIAMETER_SUBSCRIPTION_ID
DIAMETER_CALLING_PARTY_ADDRESS
DIAMETER_CALLED_PARTY_ADDRESS
DIAMETER_PDP_ADDR
GTPV2_REQ_MSG_TYPE
GTPV2_RSP_MSG_TYPE
GTPV2_C2S_S1U_GTPU_TEID
GTPV2_C2S_S1U_GTPU_IP
GTPV2_S2C_S1U_GTPU_TEID
GTPV2_S2C_S1U_GTPU_IP
GTPV2_END_USER_IMSI
GTPV2_END_USER_MSISDN
GTPV2_APN_NAME
GTPV2_ULI_MCC
GTPV2_ULI_MNC
GTPV2_ULI_CELL_TAC
GTPV2_ULI_CELL_ID
GTPV2_RAT_TYPE
GTPV2_PDN_IP
GTPV2_END_USER_IMEI
SRC_AS_PATH_1
SRC_AS_PATH_2
SRC_AS_PATH_3
SRC_AS_PATH_4
SRC_AS_PATH_5
SRC_AS_PATH_6
SRC_AS_PATH_7
SRC_AS_PATH_8
SRC_AS_PATH_9
SRC_AS_PATH_10
DST_AS_PATH_1
DST_AS_PATH_2
DST_AS_PATH_3
DST_AS_PATH_4
DST_AS_PATH_5
DST_AS_PATH_6
DST_AS_PATH_7
DST_AS_PATH_8
DST_AS_PATH_9
DST_AS_PATH_10
SIP_UAC
SIP_UAS
MYSQL_APPL_LATENCY_USEC
GTPV0_REQ_MSG_TYPE
GTPV0_RSP_MSG_TYPE
GTPV0_TID
GTPV0_END_USER_IP
GTPV0_END_USER_MSISDN
GTPV0_APN_NAME
GTPV0_RAI_MCC
GTPV0_RAI_MNC
GTPV0_RAI_CELL_LAC
GTPV0_RAI_CELL_RAC
GTPV0_RESPONSE_CAUSE
GTPV1_RESPONSE_CAUSE
GTPV2_RESPONSE_CAUSE
NUM_PKTS_TTL_5_32
NUM_PKTS_TTL_64_96
NUM_PKTS_TTL_64_96
NUM_PKTS_TTL_96_128
NUM_PKTS_TTL_128_160
NUM_PKTS_TTL_160_192
NUM_PKTS_TTL_192_224
NUM_PKTS_TTL_224_255
GTPV1_RAI_LAC
GTPV1_RAI_RAC
GTPV1_ULI_MCC
GTPV1_ULI_MNC
NUM_PKTS_TTL_2_5
NUM_PKTS_TTL_EQ_1
RTP_SIP_CALL_ID
IN_SRC_OSI_SAP
OUT_DST_OSI_SAP
WHOIS_DAS_DOMAIN
DNS_TTL_ANSWER
DHCP_CLIENT_MAC
DHCP_CLIENT_IP
DHCP_CLIENT_NAME
FTP_LOGIN
FTP_PASSWORD
FTP_COMMAND
FTP_COMMAND_RET_CODE
HTTP_METHOD
HTTP_SITE
SIP_C_IP
SIP_CALL_STATE
EPP_REGISTRAR_NAME
EPP_CMD
EPP_CMD_ARGS
EPP_RSP_CODE
EPP_REASON_STR
EPP_SERVER_NAME
RTP_IN_MOS
RTP_IN_R_FACTOR
SRC_PROC_USER_NAME
SRC_FATHER_PROC_PID
SRC_FATHER_PROC_NAME
DST_PROC_PID
DST_PROC_NAME
DST_PROC_USER_NAME
DST_FATHER_PROC_PID
DST_FATHER_PROC_NAME
RTP_RTT
RTP_IN_TRANSIT
RTP_OUT_TRANSIT
SRC_PROC_ACTUAL_MEMORY
SRC_PROC_PEAK_MEMORY
SRC_PROC_AVERAGE_CPU_LOAD
SRC_PROC_NUM_PAGE_FAULTS
DST_PROC_ACTUAL_MEMORY
DST_PROC_PEAK_MEMORY
DST_PROC_AVERAGE_CPU_LOAD
DST_PROC_NUM_PAGE_FAULTS
DURATION_IN
DURATION_OUT
SRC_PROC_PCTG_IOWAIT
DST_PROC_PCTG_IOWAIT
RTP_DTMF_TONES
UNTUNNELED_IPV6_SRC_ADDR
UNTUNNELED_IPV6_DST_ADDR
DNS_RESPONSE
DIAMETER_REQ_MSG_TYPE
DIAMETER_RSP_MSG_TYPE
DIAMETER_REQ_ORIGIN_HOST
DIAMETER_RSP_ORIGIN_HOST
DIAMETER_REQ_USER_NAME
DIAMETER_RSP_RESULT_CODE
DIAMETER_EXP_RES_VENDOR_ID
DIAMETER_EXP_RES_RESULT_CODE
S1AP_ENB_UE_S1AP_ID
S1AP_MME_UE_S1AP_ID
S1AP_MSG_EMM_TYPE_MME_TO_ENB
S1AP_MSG_ESM_TYPE_MME_TO_ENB
S1AP_MSG_EMM_TYPE_ENB_TO_MME
S1AP_MSG_ESM_TYPE_ENB_TO_MME
S1AP_CAUSE_ENB_TO_MME
S1AP_DETAILED_CAUSE_ENB_TO_MME
TCP_WIN_MIN_IN
TCP_WIN_MAX_IN
TCP_WIN_MSS_IN
TCP_WIN_SCALE_IN
TCP_WIN_MIN_OUT
TCP_WIN_MAX_OUT
TCP_WIN_MSS_OUT
TCP_WIN_SCALE_OUT
DHCP_REMOTE_ID
DHCP_SUBSCRIBER_ID
SRC_PROC_UID
DST_PROC_UID
APPLICATION_NAME
USER_NAME
DHCP_MESSAGE_TYPE
RTP_IN_PKT_DROP
RTP_OUT_PKT_DROP
RTP_OUT_MOS
RTP_OUT_R_FACTOR
RTP_MOS
GTPV2_S5_S8_GTPC_TEID
RTP_R_FACTOR
RTP_SSRC
PAYLOAD_HASH
GTPV2_C2S_S5_S8_GTPU_TEID
GTPV2_S2C_S5_S8_GTPU_TEID
GTPV2_C2S_S5_S8_GTPU_IP
GTPV2_S2C_S5_S8_GTPU_IP
SRC_AS_MAP
DST_AS_MAP
DIAMETER_HOP_BY_HOP_ID
UPSTREAM_SESSION_ID
DOWNSTREAM_SESSION_ID
SRC_IP_LONG
SRC_IP_LAT
DST_IP_LONG
DST_IP_LAT
DIAMETER_CLR_CANCEL_TYPE
DIAMETER_CLR_FLAGS
GTPV2_C2S_S5_S8_GTPC_IP
GTPV2_S2C_S5_S8_GTPC_IP
GTPV2_C2S_S5_S8_SGW_GTPU_TEID
GTPV2_S2C_S5_S8_SGW_GTPU_TEID
GTPV2_C2S_S5_S8_SGW_GTPU_IP
GTPV2_S2C_S5_S8_SGW_GTPU_IP
HTTP_X_FORWARDED_FOR
HTTP_VIA
SSDP_HOST
SSDP_USN
NETBIOS_QUERY_NAME
NETBIOS_QUERY_TYPE
NETBIOS_RESPONSE
NETBIOS_QUERY_OS
SSDP_SERVER
SSDP_TYPE
SSDP_METHOD
NPROBE_IPV4_ADDRESS
SRC_TO_DST_SECOND_BYTES
DST_TO_SRC_SECOND_BYTES
DICOM_IMPL_UID
DICOM_IMPL_VERSION
DICOM_MODALITY
DICOM_MANUFACTURER
DICOM_INST_NAME
DICOM_INST_ADDR
DICOM_STATION_NAME
DICOM_DEVICE_SERIAL
DICOM_SW_VERSION
JA3C_HASH
JA3S_HASH
SRC_HOST_NAME
DST_HOST_NAME
SSL_CIPHER
SSL_UNSAFE_CIPHER
SSL_VERSION
HASSH_CLIENT
HASSH_SERVER
L7_PROTO_CATEGORY
SEQ_PLEN
ENTROPY_CLIENT_BYTES
ENTROPY_SERVER_BYTES
SEQ_TDIFF
SEQ_PLEN_HASH
SEQ_TDIFF_HASH
PKT_VECTOR
PROTOCOL_MAP
L4_SRC_PORT_MAP
L4_DST_PORT_MAP
L4_SRV_PORT
L4_SRV_PORT_MAP

A10 Networks (PEN: 40842)

NameCommunityBasicStandardPremium
fwdTupleType
revTupleType
fwdVNPID
revVNPID
mobileIMEI
Custom1
Custom2
Custom3
RuleName
RuleSetName
SourceZone
DestZone
fwDenyReset
flowDurationMilliseconds64
cgn-flow-direction