IPFIX IEs

NetObserv Flow supports 4284 unique IPFIX information elements (IE).

PEN
Vendor
IEs

0

IANA

462

9

Cisco

581

568

NetQuest

110

637

Nokia (was Alcatel-Lucent)

139

1916

Extreme Networks

13

2428

UNINETT

30

2636

Juniper Networks

5

3054

Ixia Communications

153

5951

Citrix Systems (was Netscaler)

469

6321

Calix Networks

516

6871

CERT Coordination Center

269

6876

VMware

30

8057

CESNET

81

8712

LANcope (Cisco)

43

8741

SonicWALL

160

9789

Sophos (was Astaro AG)

3

10704

Barracuda Networks (was phion)

12

12276

F5 Networks

91

12325

Fraunhofer FOKUS

111

12559

INRIA

10

13745

Plixer

33

15397

Sandvine (was Procera Networks / Netintact)

67

16982

Masaryk University

63

21373

netfilter/iptables project

2

25461

Palo Alto Networks

2

26866

Gigamon Systems

72

29305

IPFIX Reverse Information Elements

409

32182

Cubro

1

32622

CACE Technologies

12

33610

FastIP / Boundary

23

35566

trammell.ch

30

35632

ntop

370

39499

INVEA-TECH / FlowMon Networks

196

40842

A10 Networks

15

41916

vIPtela (Cisco)

2

42359

Versa Networks

4

43874

pmacct

4

44237

Allegro Packets

2

44619

Ziften Technologies

18

44913

RedSocks

9

45346

Velocloud Networks (VMware)

24

45480

Cognitix

27

45956

Juniper Networks (was 128 Technology)

13

47269

Pluribus Networks

1

47729

Niagara Networks

86

51886

Pensando Systems

13

56506

Project Antrea (VMware)

48

Standards-based IEs (PEN: 0)

ID
Name
Community
Basic
Standard
Premium

1

octetDeltaCount

2

packetDeltaCount

3

deltaFlowCount

4

protocolIdentifier

5

ipClassOfService

6

tcpControlBits

7

sourceTransportPort

8

sourceIPv4Address

9

sourceIPv4PrefixLength

10

ingressInterface

11

destinationTransportPort

12

destinationIPv4Address

13

destinationIPv4PrefixLength

14

egressInterface

15

ipNextHopIPv4Address

16

bgpSourceAsNumber

17

bgpDestinationAsNumber

18

bgpNextHopIPv4Address

19

postMCastPacketDeltaCount

20

postMCastOctetDeltaCount

21

flowEndSysUpTime

22

flowStartSysUpTime

23

postOctetDeltaCount

24

postPacketDeltaCount

25

minimumIpTotalLength

26

maximumIpTotalLength

27

sourceIPv6Address

28

destinationIPv6Address

29

sourceIPv6PrefixLength

30

destinationIPv6PrefixLength

31

flowLabelIPv6

32

icmpTypeCodeIPv4

33

igmpType

34

samplingInterval

35

samplingAlgorithm

36

flowActiveTimeout

37

flowIdleTimeout

38

engineType

39

engineId

40

exportedOctetTotalCount

41

exportedMessageTotalCount

42

exportedFlowRecordTotalCount

44

sourceIPv4Prefix

45

destinationIPv4Prefix

46

mplsTopLabelType

47

mplsTopLabelIPv4Address

48

samplerId

49

samplerMode

50

samplerRandomInterval

51

classId

52

minimumTTL

53

maximumTTL

54

fragmentIdentification

55

postIpClassOfService

56

sourceMacAddress

57

postDestinationMacAddress

58

vlanId

59

postVlanId

60

ipVersion

61

flowDirection

62

ipNextHopIPv6Address

63

bgpNextHopIPv6Address

64

ipv6ExtensionHeaders

65

transportPacketLoss Cisco Legacy

66

transportUnreachability Cisco Legacy

67

transportLatency Cisco Legacy

68

dataPoints Cisco Legacy

69

variance Cisco Legacy

70

mplsTopLabelStackSection

71

mplsLabelStackSection2

72

mplsLabelStackSection3

73

mplsLabelStackSection4

74

mplsLabelStackSection5

75

mplsLabelStackSection6

76

mplsLabelStackSection7

77

mplsLabelStackSection8

78

mplsLabelStackSection9

79

mplsLabelStackSection10

80

destinationMacAddress

81

postSourceMacAddress

82

interfaceName

83

interfaceDescription

84

samplerName

85

octetTotalCount

86

packetTotalCount

87

flagsAndSamplerId

88

fragmentOffset

89

forwardingStatus

90

mplsVpnRouteDistinguisher

91

mplsTopLabelPrefixLength

92

srcTrafficIndex

93

dstTrafficIndex

94

applicationDescription

95

applicationId

96

applicationName

97

subApplicationTag Cisco Legacy

98

postIpDiffServCodePoint

99

multicastReplicationFactor

100

className

101

classificationEngineId

102

layer2packetSectionOffset

103

layer2packetSectionSize

104

layer2packetSectionData

105

applicationVersion Cisco Legacy

106

applicationVersionName Cisco Legacy

107

applicationVendor Cisco Legacy

109

subApplicationName Cisco Legacy

110

subApplicationDescription Cisco Legacy

111

templateParameterRangeEnd Cisco Legacy

128

bgpNextAdjacentAsNumber

129

bgpPrevAdjacentAsNumber

130

exporterIPv4Address

131

exporterIPv6Address

132

droppedOctetDeltaCount

133

droppedPacketDeltaCount

134

droppedOctetTotalCount

135

droppedPacketTotalCount

136

flowEndReason

137

commonPropertiesId

138

observationPointId

139

icmpTypeCodeIPv6

140

mplsTopLabelIPv6Address

141

lineCardId

142

portId

143

meteringProcessId

144

exportingProcessId

145

templateId

146

wlanChannelId

147

wlanSSID

148

flowId

149

observationDomainId

150

flowStartSeconds

151

flowEndSeconds

152

flowStartMilliseconds

153

flowEndMilliseconds

154

flowStartMicroseconds

155

flowEndMicroseconds

156

flowStartNanoseconds

157

flowEndNanoseconds

158

flowStartDeltaMicroseconds

159

flowEndDeltaMicroseconds

160

systemInitTimeMilliseconds

161

flowDurationMilliseconds

162

flowDurationMicroseconds

163

observedFlowTotalCount

164

ignoredPacketTotalCount

165

ignoredOctetTotalCount

166

notSentFlowTotalCount

167

notSentPacketTotalCount

168

notSentOctetTotalCount

169

destinationIPv6Prefix

170

sourceIPv6Prefix

171

postOctetTotalCount

172

postPacketTotalCount

173

flowKeyIndicator

174

postMCastPacketTotalCount

175

postMCastOctetTotalCount

176

icmpTypeIPv4

177

icmpCodeIPv4

178

icmpTypeIPv6

179

icmpCodeIPv6

180

udpSourcePort

181

udpDestinationPort

182

tcpSourcePort

183

tcpDestinationPort

184

tcpSequenceNumber

185

tcpAcknowledgementNumber

186

tcpWindowSize

187

tcpUrgentPointer

188

tcpHeaderLength

189

ipHeaderLength

190

totalLengthIPv4

191

payloadLengthIPv6

192

ipTTL

193

nextHeaderIPv6

194

mplsPayloadLength

195

ipDiffServCodePoint

196

ipPrecedence

197

fragmentFlags

198

octetDeltaSumOfSquares

199

octetTotalSumOfSquares

200

mplsTopLabelTTL

201

mplsLabelStackLength

202

mplsLabelStackDepth

203

mplsTopLabelExp

204

ipPayloadLength

205

udpMessageLength

206

isMulticast

207

ipv4IHL

208

ipv4Options

209

tcpOptions

210

paddingOctets

211

collectorIPv4Address

212

collectorIPv6Address

213

exportInterface

214

exportProtocolVersion

215

exportTransportProtocol

216

collectorTransportPort

217

exporterTransportPort

218

tcpSynTotalCount

219

tcpFinTotalCount

220

tcpRstTotalCount

221

tcpPshTotalCount

222

tcpAckTotalCount

223

tcpUrgTotalCount

224

ipTotalLength

225

postNATSourceIPv4Address

226

postNATDestinationIPv4Address

227

postNAPTSourceTransportPort

228

postNAPTDestinationTransportPort

229

natOriginatingAddressRealm

230

natEvent

231

initiatorOctets

232

responderOctets

233

firewallEvent

234

ingressVRFID

235

egressVRFID

236

VRFname

237

postMplsTopLabelExp

238

tcpWindowScale

239

biflowDirection

240

ethernetHeaderLength

241

ethernetPayloadLength

242

ethernetTotalLength

243

dot1qVlanId

244

dot1qPriority

245

dot1qCustomerVlanId

246

dot1qCustomerPriority

247

metroEvcId

248

metroEvcType

249

pseudoWireId

250

pseudoWireType

251

pseudoWireControlWord

252

ingressPhysicalInterface

253

egressPhysicalInterface

254

postDot1qVlanId

255

postDot1qCustomerVlanId

256

ethernetType

257

postIpPrecedence

258

collectionTimeMilliseconds

259

exportSctpStreamId

260

maxExportSeconds

261

maxFlowEndSeconds

262

messageMD5Checksum

263

messageScope

264

minExportSeconds

265

minFlowStartSeconds

266

opaqueOctets

267

sessionScope

268

maxFlowEndMicroseconds

269

maxFlowEndMilliseconds

270

maxFlowEndNanoseconds

271

minFlowStartMicroseconds

272

minFlowStartMilliseconds

273

minFlowStartNanoseconds

274

collectorCertificate

275

exporterCertificate

276

dataRecordsReliability

277

observationPointType

278

newConnectionDeltaCount

279

connectionSumDurationSeconds

280

connectionTransactionId

281

postNATSourceIPv6Address

282

postNATDestinationIPv6Address

283

natPoolId

284

natPoolName

285

anonymizationFlags

286

anonymizationTechnique

287

informationElementIndex

288

p2pTechnology

289

tunnelTechnology

290

encryptedTechnology

294

bgpValidityState

295

IPSecSPI

296

greKey

297

natType

298

initiatorPackets

299

responderPackets

300

observationDomainName

301

selectionSequenceId

302

selectorId

303

informationElementId

304

selectorAlgorithm

305

samplingPacketInterval

306

samplingPacketSpace

307

samplingTimeInterval

308

samplingTimeSpace

309

samplingSize

310

samplingPopulation

311

samplingProbability

312

dataLinkFrameSize

313

ipHeaderPacketSection

314

ipPayloadPacketSection

315

dataLinkFrameSection

316

mplsLabelStackSection

317

mplsPayloadPacketSection

318

selectorIdTotalPktsObserved

319

selectorIdTotalPktsSelected

320

absoluteError

321

relativeError

322

observationTimeSeconds

323

observationTimeMilliseconds

324

observationTimeMicroseconds

325

observationTimeNanoseconds

326

digestHashValue

327

hashIPPayloadOffset

328

hashIPPayloadSize

329

hashOutputRangeMin

330

hashOutputRangeMax

331

hashSelectedRangeMin

332

hashSelectedRangeMax

333

hashDigestOutput

334

hashInitialiserValue

335

selectorName

336

upperCILimit

337

lowerCILimit

338

confidenceLevel

339

informationElementDataType

340

informationElementDescription

341

informationElementName

342

informationElementRangeBegin

343

informationElementRangeEnd

344

informationElementSemantics

345

informationElementUnits

346

privateEnterpriseNumber

347

virtualStationInterfaceId

348

virtualStationInterfaceName

349

virtualStationUUID

350

virtualStationName

351

layer2SegmentId

352

layer2OctetDeltaCount

353

layer2OctetTotalCount

354

ingressUnicastPacketTotalCount

355

ingressMulticastPacketTotalCount

356

ingressBroadcastPacketTotalCount

357

egressUnicastPacketTotalCount

358

egressBroadcastPacketTotalCount

359

monitoringIntervalStartMilliSeconds

360

monitoringIntervalEndMilliSeconds

361

portRangeStart

362

portRangeEnd

363

portRangeStepSize

364

portRangeNumPorts

365

staMacAddress

366

staIPv4Address

367

wtpMacAddress

368

ingressInterfaceType

369

egressInterfaceType

370

rtpSequenceNumber

371

userName

372

applicationCategoryName

373

applicationSubCategoryName

374

applicationGroupName

375

originalFlowsPresent

376

originalFlowsInitiated

377

originalFlowsCompleted

378

distinctCountOfSourceIPAddress

379

distinctCountOfDestinationIPAddress

380

distinctCountOfSourceIPv4Address

381

distinctCountOfDestinationIPv4Address

382

distinctCountOfSourceIPv6Address

383

distinctCountOfDestinationIPv6Address

384

valueDistributionMethod

385

rfc3550JitterMilliseconds

386

rfc3550JitterMicroseconds

387

rfc3550JitterNanoseconds

388

dot1qDEI

389

dot1qCustomerDEI

390

flowSelectorAlgorithm

391

flowSelectedOctetDeltaCount

392

flowSelectedPacketDeltaCount

393

flowSelectedFlowDeltaCount

394

selectorIDTotalFlowsObserved

395

selectorIDTotalFlowsSelected

396

samplingFlowInterval

397

samplingFlowSpacing

398

flowSamplingTimeInterval

399

flowSamplingTimeSpacing

400

hashFlowDomain

401

transportOctetDeltaCount

402

transportPacketDeltaCount

403

originalExporterIPv4Address

404

originalExporterIPv6Address

405

originalObservationDomainId

406

intermediateProcessId

407

ignoredDataRecordTotalCount

408

dataLinkFrameType

409

sectionOffset

410

sectionExportedOctets

411

dot1qServiceInstanceTag

412

dot1qServiceInstanceId

413

dot1qServiceInstancePriority

414

dot1qCustomerSourceMacAddress

415

dot1qCustomerDestinationMacAddress

416

layer2OctetDeltaCount

417

postLayer2OctetDeltaCount

418

postMCastLayer2OctetDeltaCount

419

layer2OctetTotalCount

420

postLayer2OctetTotalCount

421

postMCastLayer2OctetTotalCount

422

minimumLayer2TotalLength

423

maximumLayer2TotalLength

424

droppedLayer2OctetDeltaCount

425

droppedLayer2OctetTotalCount

426

ignoredLayer2OctetTotalCount

427

notSentLayer2OctetTotalCount

428

layer2OctetDeltaSumOfSquares

429

layer2OctetTotalSumOfSquares

430

layer2FrameDeltaCount

431

layer2FrameTotalCount

432

pseudoWireDestinationIPv4Address

433

ignoredLayer2FrameTotalCount

434

mibObjectValueInteger

435

mibObjectValueOctetString

436

mibObjectValueOID

437

mibObjectValueBits

438

mibObjectValueIPAddress

439

mibObjectValueCounter

440

mibObjectValueGauge

441

mibObjectValueTimeTicks

442

mibObjectValueUnsigned

445

mibObjectIdentifier

446

mibSubIdentifier

447

mibIndexIndicator

448

mibCaptureTimeSemantics

449

mibContextEngineID

450

mibContextName

451

mibObjectName

452

mibObjectDescription

453

mibObjectSyntax

454

mibModuleName

455

mobileIMSI

456

mobileMSISDN

457

httpStatusCode

458

sourceTransportPortsLimit

459

httpRequestMethod

460

httpRequestHost

461

httpRequestTarget

462

httpMessageVersion

463

natInstanceID

464

internalAddressRealm

465

externalAddressRealm

466

natQuotaExceededEvent

467

natThresholdEvent

468

httpUserAgent

469

httpContentType

470

httpReasonPhrase

471

maxSessionEntries

472

maxBIBEntries

473

maxEntriesPerUser

474

maxSubscribers

475

maxFragmentsPendingReassembly

476

addressPoolHighThreshold

477

addressPoolLowThreshold

478

addressPortMappingHighThreshold

479

addressPortMappingLowThreshold

480

addressPortMappingPerUserHighThreshold

481

globalAddressMappingHighThreshold

482

vpnIdentifier

483

bgpCommunity

486

bgpExtendedCommunity

489

bgpLargeCommunity

Cisco (PEN: 9)

Name
Community
Basic
Standard
Premium

AAA_USERNAME

application business-relevance

application category name

application delay average

application family name

application group name

application http uri statistics

application media bytes counter

application media bytes counter permanent

application media bytes rate

application media bytes rate per-flow

application media bytes rate per-flow max

application media bytes rate per-flow min

application media event

application media packets counter

application media packets counter permanen

application media packets rate

application media packets rate variation

application media packets rate variation m

application media packets rate variation m

application media packets rate variation s

application set name

application sub category name

application traffic-class

application transaction counter new

application video eMOS compression bitstre

application video eMOS compression network

application video eMOS packet-loss bitstre

application video eMOS packet-loss network

application video frame I counter bytes

application video frame I counter frames

application video frame I counter packets

application video frame I counter packets

application video frame I slice-quantizati

application video frame LTR counter bytes

application video frame LTR counter frames

application video frame LTR counter packet

application video frame LTR counter packet

application video frame LTR slice-quantiza

application video frame NR counter bytes

application video frame NR counter frames

application video frame NR counter packets

application video frame NR counter packets

application video frame NR slice-quantizat

application video frame percentage damaged

application video frame rate

application video frame STR counter bytes

application video frame STR counter frames

application video frame STR counter packet

application video frame STR counter packet

application video frame STR slice-quantiza

application video frame super-P counter by

application video frame super-P counter fr

application video frame super-P counter pa

application video frame super-P counter pa

application video frame super-P slice-quan

application video level-of-motion

application video payload bitrate average

application video payload bitrate fluctuat

application video resolution height last

application video resolution width last

application video scene-complexity

application voice call duration

application voice codec id

application voice concealment-ratio averag

application voice delay end-point

application voice delay round-trip

application voice jitter buffer-overrun

application voice jitter configured initia

application voice jitter configured maximu

application voice jitter configured minimu

application voice jitter configured type

application voice mos conversation

application voice mos listening

application voice number called

application voice number calling

application voice packet conceal-count

application voice play delay current

application voice play delay maximum

application voice play delay minimum

application voice r-factor 1

application voice r-factor 2

application voice router global-call-id

application voice rx bad-packet

application voice rx early-packet count

application voice rx late-packet count

application voice rx out-of-sequence

application voice setup time

application voice sip call-id

appqoe ssl policy action

appqoe ssl service type

appqoe ssl traffic type

art count new connections

art count responses

art count responses histogram bucket1

art count responses histogram bucket2

art count responses histogram bucket3

art count responses histogram bucket4

art count responses histogram bucket5

art count responses histogram bucket6

art count responses histogram bucket7

artClientNetworkTimeLongLivedMaximum

artClientNetworkTimeLongLivedMinimum

artClientpackets

artServerNetworkTimeLongLivedMaximum

artServerNetworkTimeLongLivedMinimum

artServerpackets

audio concealment ratio maximum

audio concealment ratio minimum

audio concealment ratio now

audio concealment time

audio duration clock adjust

audio duration early packet

audio duration late discard

audio duration playout decrease

audio duration playout increase

audio duration receive

audio duration receive voice

audio frame arriving times difference

audio frame arriving times difference vari

audio frame size

audio frames-per-packet

audio g107 codec baseline

audio g107 codec baseline bpl

audio g107 impairment

audio g107 impairment one-way-delay

audio g107 lossRate

audio noise level average

audio noise level configured

audio noise level current

audio noise level maximum

audio noise level minimum

audio packets cs

audio packets ok

audio packets rtp

audio packets scs

audio packets silence

audio rtp fwd out-of-sequence sum

audio rtp jitter ticks

audio rtp packets expected

audio rtp packets lost

audio rtp seconds concealed

audio rtp seconds concealed severe

audio rtp seconds ok

audio snr average

audio snr configured

audio snr current

audio snr maximum

audio snr minimum

audio speech time

AVCSubApplicationValue

bandwidth used

bandwidth used percentage

bgp community

bgp prepend

bw fee

bw percentage

BYTE_RATE

c3pl class cce-id

c3pl class name

c3pl class type

c3pl policy cce-id

c3pl policy name

c3pl policy type

capacity

client network delay average

client throughput average

closed sessions

connection client counter bytes network

connection client counter bytes retransmit

connection client counter packets retransm

connection client ipv4 address

connection client ipv6 address

connection client transport port

connection concurrent-connections

connection delay application max

connection delay application min

connection delay application sum

connection delay network client-to-server

connection delay network client-to-server

connection delay network client-to-server

connection delay network client-to-server

connection delay network long-lived client

connection delay network long-lived to-cli

connection delay network long-lived to-ser

connection delay network to-client max

connection delay network to-client min

connection delay network to-client num-sam

connection delay network to-client sum

connection delay network to-server max

connection delay network to-server min

connection delay network to-server num-sam

connection delay network to-server sum

connection delay response client-to-server

connection delay response client-to-server

connection delay response client-to-server

connection delay response to-server histog

connection delay response to-server max

connection delay response to-server min

connection delay response to-server sum

connection id

connection id long

connection server counter bytes network

connection server counter bytes retransmit

connection server counter packets retransm

connection server ipv4 address

connection server ipv6 address

connection server transport port

connection transaction counter complete

connection transaction duration max

connection transaction duration min

connection transaction duration sum

counter bytes appqoe ssl-de-read

counter bytes appqoe ssl-de-written

counter bytes appqoe ssl-en-read

counter bytes appqoe ssl-en-written

counter bytes appqoe ssl-read

counter bytes appqoe ssl-written

counter bytes rate per-flow

counter bytes rate per-flow max

counter bytes rate per-flow min

counter bytes sdwan dropped long

counter packets appqoe fec-d-pkts

counter packets appqoe fec-r-pkts

counter packets appqoe pkt-dup-d-pkts-dup

counter packets appqoe pkt-dup-d-pkts-orig

counter packets appqoe pkt-dup-r-pkts

counter packets dropped permanent

counter packets rate per-flow

counter packets rate per-flow max

counter packets rate per-flow min

counter packets sdwan pkt-cxp-d-pkts

datalink event

datalink event extended

discard rollup count

drop cause id

drop cause name

egress bw

egress rollup bw

EGRESS_ACL_ID

end timestamp

entrance downgrade

ETAByteDistribution

ETAInitialDataPacketOld

ETASequenceofPktLengthsandTimes

ETTA_INITIAL_DATA_PACKET

ETTA_SEQUENCE_OF_APPLICATION_LENGTHS_AND_TIMES

ETTA_SEQUENCE_OF_PACKET_LENGTHS_AND_TIMES

ETTA_TLS_CIPHER_SUITES

ETTA_TLS_EXTENSION_LENGTHS

ETTA_TLS_EXTENSION_TYPES

ETTA_TLS_EXTENSIONS

ETTA_TLS_KEY_LENGTH

ETTA_TLS_RANDOM

ETTA_TLS_RECORDS

ETTA_TLS_SESSION_ID

ETTA_TLS_VERSION

flow cts switch derived-sgt

flow left time

FW_BLACKOUT_SECS

FW_CONFIGURED_VALUE

FW_ERM_EXT_EVENT

FW_ERM_EXT_EVENT_DESC

FW_EVENT

FW_EVENT_LEVEL

FW_EVENT_LEVEL_ID

FW_EXT_EVENT

FW_EXT_EVENT

FW_EXT_EVENT_DESC

FW_HALFOPEN_CNT

FW_HALFOPEN_HIGH

FW_HALFOPEN_RATE

FW_MAX_SESSIONS

FW_SUMMARY_PKT_CNT

FW_ZONEPAIR_ID

FW_ZONEPAIR_NAME

ingress bw

ingress rollup bw

INGRESS_ACL_ID

interface input fex-node-id

interface output fex-node-id

interface power

iOAM Application metadata

IOAM byte count

IOAM cs0 byte count

IOAM cs0 packet counter

IOAM cs1 byte count

IOAM cs1 packet counter

IOAM cs2 byte count

IOAM cs2 packet counter

IOAM cs3 byte count

IOAM cs3 packet counter

IOAM cs4 byte count

IOAM cs4 packet counter

IOAM cs5 byte count

IOAM cs5 packet counter

IOAM cs6 byte count

IOAM cs6 packet counter

IOAM cs7 byte count

IOAM cs7 packet counter

IOAM duplicate packet counter

iOAM E2E Header

IOAM highest PPC sequence number

IOAM lost packet counter

iOAM my node name

iOAM my node-id

iOAM node-id

iOAM node1 eif id

iOAM node1 id

iOAM node1 in if id

iOAM node2 eif id

iOAM node2 id

iOAM node2 in if id

iOAM node3 eif id

iOAM node3 id

iOAM node3 in if id

iOAM node4 eif id

iOAM node4 id

iOAM node4 in if id

iOAM number of nodes

IOAM packet counter

iOAM Path Map

IOAM reordered packet counter

iOAM sfc invalidated count

iOAM sfc validated count

iOAM sfc-id

IPv4 destination observation node

IPv4 source observation node

IPv6 destination observation node

ipv6 protocol filed

IPv6 source observation node

kth rollup bw

l4r event

l4r event timestamp

l4r server ipv4 address

l4r server ipv6 address

l4r server transport port

link group name

long-term round-trip-time

max egress bw

max ingress bw

metadata clock-rate

metadata global-session-id

metadata multi-party-session-id

misc unsupported

monitor device-type

monitor event

mos below

mos quality

mos total count

mos worst 100

network delay sample

network delay sum

NETWORK_DELAY_AVG network delay average

nvzFlowCoordinatesList

nvzFlowDestinationHostname

nvzFlowDNSSuffix

nvzFlowInterfaceDetailsList

nvzFlowInterfaceIndex

nvzFlowInterfaceInfoUID

nvzFlowInterfaceMac

nvzFlowInterfaceName

nvzFlowInterfaceType

nvzFlowL4ByteCountIn

nvzFlowL4ByteCountOut

nvzFlowLoggedInUser

nvzFlowModuleHashList

nvzFlowModuleNameList

nvzFlowOSEdition

nvzFlowOSName

nvzFlowOSVersion

nvzFlowParentProcessAccount

nvzFlowParentProcessAccountType

nvzFlowParentProcessHash

nvzFlowParentProcessName

nvzFlowProcessAccount

nvzFlowProcessAccountType

nvzFlowProcessHash

nvzFlowProcessName

nvzFlowSystemManufacturer

nvzFlowSystemType

nvzFlowUDID

nvzFlowUserAccountType

ONE_WAY_DELAY pfr one-way-delay

overlay session id input

overlay session id output

packet arrival timestamp

PACKET_RATE

PACKETS_DROPPED

pbhk event

pbhk event timestamp

pbhk mapped ipv4 address

pbhk mapped transport port

pfr br ipv4 address

pfr counter event error traffic-class miti

pfr counter event error traffic-class miti

pfr counter event error traffic-class miti

pfr label identifier

pfr one-way-delay samples

pfr one-way-delay sum

pfr priority

pfr service provider tag identifier

pfr site destination id ipv4

pfr site destination prefix ipv4

pfr site destination prefix ipv6

pfr site destination prefix mask ipv4

pfr site destination prefix mask ipv6

pfr site source id ipv4

pfr site source prefix ipv4

pfr site source prefix ipv6

pfr site source prefix mask ipv4

pfr site source prefix mask ipv6

pfr status

policy qos classification hierarchy

policy qos queue drops

policy qos queue index

reason id

refused sessions

retransmitted packets

routing vrf service

rsvp bw pool

scAccessString

scActiveSubscribers

scAttackId

scAttackIp

scAttackIpProtocol

scAttackMaliciousSessions

scAttackOtherIp

scAttackPortNumber

scAttacks

scAttackSide

scAttackType

scBreachState

scClientPort

scConcurrentSessions

scConfiguredDuration

scDestinationIpSample

scDownstreamVolume

scDuration

scEndTime

scFlavorId

scFlowCloseMode

scFlowContextId

scGeneratorId

scInfoString

scInitiatingSide

scLinkId

scPackageCounterId

scPackageId

scProtocolId

scProtocolSignature

scReason

scReportTime

scSeconds

scServerPort

scServiceGlobalCounterId

scServiceId

scServiceUsageCounterId

scSessionDownstreamVolume

scSessions

scSessionUpstreamVolume

scSkipppedSessions

scSourceIpSample

scSubscriberCounterId

scSubscriberId

scTag

scTimeFrame

scTotalActiveSubscribers

scTrafficProcessorId

scTransactionDurationMillisec

scUpstreamVolume

scZoneId

sdwan preferred-color-not-met

sdwan qos-queue-id

sdwan sla-not-met

server network delay average

server response time average

services pfr class-tag-id

services pfr mc-id

services waas passthrough-reason

services waas segment

session time average

session time maximum

session time minimum

SGT_DESTINATION_NAME

SGT_DESTINATION_TAG

SGT_SOURCE_NAME

SGT_SOURCE_TAG

sip header from uri host ip addr

sip header from uri userinfo user

sip header to uri host ip addr

sip header to uri userinfo user

sip sess duration

sip sess end_reason

sip sess_connected

sip sess_dialed

sip sess_failed

start timestamp

tcpWindowSizeSum

threshold

timestamp interval

timestampAbsoluteMonitoring-intervalEnd

timestampAbsoluteMonitoring-intervalStart

tloc local color

tloc local system ip address

tloc remote color

tloc remote system ip address

tloc table overlay session id

tloc tunnel protocol

transaction time average

transport bytes expected

transport bytes lost

transport bytes lost rate

transport bytes out-of-order

transport destination-port max

transport destination-port min

transport event packet-loss counter

transport event packet-loss counter max

transport event packet-loss counter min

transport event packet-loss counter perman

transport packets expected counter

transport packets expected counter permane

transport packets lost counter

transport packets lost counter max

transport packets lost counter min

transport packets lost counter permanent

transport packets lost rate

transport packets lost rate max

transport packets lost rate min

transport packets out-of-order

transport round-trip-time

transport round-trip-time max

transport round-trip-time min

transport round-trip-time samples

transport round-trip-time sum

transport rtp flow count

transport rtp jitter inter arrival mean

transport rtp jitter inter arrival samples

transport rtp jitter inter arrival sum

transport rtp jitter maximum

transport rtp jitter mean

transport rtp jitter mean sum

transport rtp jitter minimum

transport rtp payload-type

transport rtp sequence-number

transport rtp sequence-number last

transport rtp ssrc

transport source-port max

transport source-port min

transport tcp flow count

transport tcp maximum-segment-size

transport tcp window-size average

transport tcp window-size average sum

transport tcp window-size maximum

transport tcp window-size minimum

transport tcp window-size sum

unresponsive sessions

vxlan flags

vxlan sgt

vxlan vtep input

vxlan vtep output

waas application

waas bytes input

waas bytes output

waas class

waas connection mode

waas dre input

waas dre output

waas lz input

waas lz output

waas optimised bytes

waas original bytes

wireless afd accept bytes

wireless afd accept packets

wireless afd drop bytes

wireless afd drop packets

wlan_id

XLATE_DST_ADDR_IPV4

XLATE_DST_PORT

XLATE_SRC_ADDR_IPV4

XLATE_SRC_PORT

NetQuest (PEN: 568)

Name
Community
Basic
Standard
Premium

bgp_dest_as

bgp_next_hop_ip

bgp_source_as

dlts_not_valid_after

dns_flags_codes

dns_qclass

dns_qtype

dns_query

dns_rcode

dns_response_ipv4_addr

dns_response_ipv6_addr

dns_trans_id

dns_TTLs

dtls_cert_hash

dtls_certificate_issuer_cn

dtls_certificate_subject_key_size

dtls_cipher

dtls_client_subject

dtls_common_name

dtls_issuer

dtls_ja3

dtls_ja3s

dtls_not_valid_before

dtls_server_name

dtls_subject

dtls_version

GRE_packets

GTP_packets

http_host

http_method

http_password

http_proxied

http_referrer

http_request_body_len

http_response_body_len

http_status_code

http_status_msg

http_uri

http_user_agent

http_username

IP-in-IP_packets

JA3C

JA3S

JA4

L2TP_packets

MACSEC_packets

ospf_area_id

ospf_backup_router

ospf_dead_interval

ospf_designated_router

ospf_external_fwd_addr

ospf_external_route_tag

ospf_hello_interval

ospf_link_data

ospf_link_id

ospf_link_type

ospf_ls_adv_router

ospf_ls_age

ospf_ls_attach_router

ospf_ls_flags_b

ospf_ls_flags_e

ospf_ls_flags_v

ospf_ls_id

ospf_ls_metric

ospf_ls_seq_number

ospf_ls_type

ospf_message_type

ospf_neighbor

ospf_netmask

ospf_options

ospf_priority

ospf_router_id

PPTP_packets

PWE3_w_ctrl_word_packets

PWE3_wo_ctrl_word_packets

quic_server_name

quic_user_agent

quic_version

sip_call_id

sip_connection_addr_ipv4

sip_connection_addr_ipv6

sip_from

sip_to

sip_via

ssh_cipher_alg_cts

ssh_cipher_alg_stc

ssh_client

ssh_compression_alg_cts

ssh_compression_alg_stc

ssh_fingerprint_hassh

ssh_fingerprint_hassh_server

ssh_host_key_alg

ssh_kex_alg_cts

ssh_kex_alg_stc

ssh_mac_alg_cts

ssh_mac_alg_stc

ssh_server

ssh_version

ssl_cert_hash

ssl_certificate_subject_key_size

ssl_cipher

ssl_client_issuer

ssl_client_subject

ssl_issuer

ssl_not_valid_after

ssl_not_valid_before

ssl_server_name

ssl_session_id

ssl_subject

ssl_version

Nokia, was Alcatel-Lucent (PEN: 637)

Name
Community
Basic
Standard
Premium

aaApp

aaAppGrp

aaChargingGroup

aaProt

aaRecordType

aaSubTetheringState

aaSubType

anlCongestionState

anlTopology

anlType

apn

avgFrameArrivalDelay

avgGoPLength

avgInterIFrameGap

BFrameImpaired

BFrameReceived

bsid

cellId

chargeId

chargingChar

customerId

deviceId

deviceMfgId

deviceOsId

deviceOsVer1

deviceOsVer2

deviceOsVer3

estimatedPSNR

flowAttr_abr_service

flowAttr_audio

flowAttr_download

flowAttr_encrypted

flowAttr_esni

flowAttr_realtime_communication

flowAttr_upload

flowAttr_video

frameInterArrivalJitter

frameRate

GoPType

hostName

IFrameImpaired

IFrameInterArrivalJitter

IFrameReceived

imageHeight

imageWidth

imei

imsi

ipFamily

MAPDV

mcc

mnc

MOSA

MOSAV

MOSCQ

MOSLQ

MOSNOM

MOSReference

MOSVAbsolute

MOSVRelative

msisdn

natInsideSvcid

natOutsideSvcid

natSubString

PFrameImpaired

PFrameReceived

pgw-ggsnAddr

plmnid

PPDVM

ratType

RBurst

RCQ

regionId

RG107

RGap

RLQ

RNom

roamingStatus

rtpAvgAudioBw

rtpAvgBurstLengthMs

rtpAvgBurstLengthPkts

rtpAvgGapLengthMs

rtpAvgGapLengthPkts

rtpAvgRtDelay

rtpAvgVideoBw

rtpAvgVoiceBw

rtpBurstCount

rtpCodecName

rtpDegAVSync

rtpDegCodecEncBwRestrict

rtpDegCodecQuantize

rtpDegCodecType

rtpDegDelay

rtpDegEcho

rtpDegFramePresentRate

rtpDegFrameRez

rtpDegGoPLength

rtpDegNetBwConstraint

rtpDegNoiseLevel

rtpDegPacketDiscard

rtpDegPacketLoss

rtpDegRecency

rtpDegSignalLevel

rtpDiscardPackets

rtpGapCount

rtpLostPackets

rtpNumAudioChannels

rtpOutOfSeqPackets

rtpPayloadType

rtpPeakAudioBw

rtpPeakVideoBw

rtpReceivedPackets

rtpRefClockRate

rtpRtDelaySrc

sessionDirection

sessionDurationMilliseconds

sessionEndSeconds

sessionStartSeconds

sgw-sgsnAddr

SIFrameImpaired

SIFrameReceived

slicesPerIFrame

SPFrameImpaired

SPFrameReceived

SSRC

tcpDelayAvg

tcpDelayMax

tcpDelayMin

tcpDelaySampleCnt

tcpDelayVariance

tcpRetransmittedBytes

tcpRetransmittedBytes_r

tcpRetransmittedPackets

tcpRetransmittedPackets_r

tcpSessionEstDelay

tcpSessionEstDelay_r

timezone

uli

videoInterlaced

VSTQ

Extreme Networks (PEN: 1916)

Name
Community
Basic
Standard
Premium

appGroupName

appResponseTime

clientLocation

detailedLocation

dstHostName

metaData

nacProfile

netResponseTime

oneSidedFlow

serverAddress

serverLocation

srcHostName

userName

UNINETT (PEN: 2428)

Name
Community
Basic
Standard
Premium

CONN_DIRECTION

EXPVAL_PKT_DIST

EXPVAL_PKT_LENGTH

HIST_PKT_DIST

HIST_PKT_LEN

MAXRATE_100MS

MAXRATE_10MS

MAXRATE_1MS

MAXRATE_1SEC

MINRATE_100MS

MINRATE_10MS

MINRATE_1MS

MINRATE_1SEC

PAYLOAD

PIM_PACKETS

PKT_REORDERED

QSUM_PKT_DIST

QSUM_PKT_LENGTH

RTP_JITTER

RTP_LOSTFRAC

RTP_LOSTPKTS

RTP_SEQCYCLES

SERVICE

SUM_PKT_DIST

SUM_PKT_LENGTH

TCPWIN_EFF

TCPWIN_MAX

TCPWIN_MIN

VAR_PKT_DIST

VAR_PKT_LENGTH

Juniper Networks (PEN: 2636)

Name
Community
Basic
Standard
Premium

Forwarding Class Name

ifa_headers

ifa_metadata

ifa_sampled_packet

Packet Loss Priority

Ixia Communications (PEN: 3054)

Name
Community
Basic
Standard
Premium

BrowserId

BrowserName

ConnAvgRtt

DeviceId

DeviceName

DhcpAgentCircuitId

DhcpClientId

DhcpClientMac

DhcpLeaseDuration

DhcpMessageTimestamp

DhcpMessageType

DhcpServerName

DnsAnCount

DnsAnswer

DnsArCount

DnsAuthAnswer

DnsCanonicalName

DnsClasses

DnsIPv4Address

DNSIPv6Address

DnsMxDomain

DNSName

DnsNsCount

DnsOpcode

DnsPackets

DnsQdCount

DnsQrFlag

DnsQuery

DnsQueryName

DnsQueryType

DnsQuestions

DnsRawRdata

DnsRdataLen

DnsRecordTtl

DnsRecordTxt

DnsRecursionAvail

DnsRecursionDesired

DnsRequestType

DnsResponseCode

DnsResponseType

DnsSectionType

DnsTransactionId

DnsTrucation

DstAsName

DstCityName

DstCountryCode

DstCountryName

DstLatitude

DstLongitude

DstRegionCode

DstRegionNode

EmailMsgAttachments

EmailMsgBcc

EmailMsgCc

EmailMsgDate

EmailMsgFrom

EmailMsgId

EmailMsgSubject

EmailMsgTo

EncryptCipher

EncryptKeyLength

EncryptType

gtp_down_APN_DNN

gtp_down_ipv4_addr

gtp_down_ipv6_addr

gtp_down_QCI_QFI

gtp_down_TEID

gtp_ep_gen

gtp_IMEI

gtp_IMSI

gtp_MSISDN

gtp_RAT_type

gtp_ULI_CELL_ID

gtp_ULI_ECGI_E_NODEB_ID

gtp_ULI_LAC

gtp_ULI_MCC

gtp_ULI_MNC

gtp_ULI_RAI_RAC

gtp_ULI_SAI_SAC

gtp_ULI_TAC

gtp_up_APN_DNN

gtp_up_ipv4_addr

gtp_up_ipv6_addr

gtp_up_QCI_QFI

gtp_up_TEID

HttpAccept

HttpAcceptEncoding

HttpAcceptLanguage

HttpConnection

HttpContentLength

HttpHostName

HttpMessageVersion

HttpReason

HttpReferer

HttpRequestMethod

HttpServer

HttpStatusCode

HttpUri

HttpUserAgent

HttpUseragentCpu

ImsiSubscriber

Ja3FingerprintString

L7AppId

L7AppName

Latency

MatchedFilterName

QuicAppResponseTime

QuicConnRTT

QuicConnSetupTime

RadiusCalledStationId

RadiusCallingStationId

RadiusEventTimestamp

RadiusFilterId

RadiusFramedIp

RadiusFramedProtocol

RadiusNasIPv4

RadiusReplyMessage

RadiusServiceType

RadiusTimestamp

RadiusUsername

RequestTime

RevOctetDeltaCount

RevPacketDeltaCount

Sni

SrcAsName

SrcCityName

SrcCountryCode

SrcCountryName

SrcLatitude

SrcLongitude

SrcRegionCode

SrcRegionName

TcpAppResponseTime

TcpConnSetupTime

TcpRetransPktCount

ThreatIPv4

ThreatIPv6

ThreatType

TlsSrvrCert

TlsSrvrCertAltnames

TlsSrvrCertAltnamesAttr

TlsSrvrCertAltnamesVal

TlsSrvrCertIssuer

TlsSrvrCertIssuerAttr

TlsSrvrCertIssuerVal

TlsSrvrCertSignAlgo

TlsSrvrCertSrlNum

TlsSrvrCertSubject

TlsSrvrCertSubjectAttr

TlsSrvrCertSubjectVal

TlsSrvrCertSubjPkiAlgo

TlsSrvrCertVldNtAftr

TlsSrvrCertVldNtBfr

UdpAppResponseTime

Citrix Systems, was Netscaler (PEN: 5951)

Name
Community
Basic
Standard
Premium

netscaleIcaClientVersion

netscalerAaaUserEmailId

netscalerAaaUsername

netscalerAAAUsername

netscalerAccessInsightFlags

netscalerAccessInsightStatusCode

netscalerAccessInsightTimestamp

netscalerAccessType

netscalerAppFqdn

netscalerAppfwAppNameId

netscalerAppfwAppSafetyIndex

netscalerAppfwAppThreatIndex

netscalerAppfwBlockFlags

netscalerAppfwGeoLocation

netscalerAppfwHttpMethod

netscalerAppfwIncarnationNumber

netscalerAppfwNSLatitude

netscalerAppfwNSLongitude

netscalerAppfwProfileBlockFlags

netscalerAppfwProfileLearnFlags

netscalerAppfwProfileLogFlags

netscalerAppfwProfileName

netscalerAppfwProfileNoneFlags

netscalerAppfwProfileRelaxedFlags

netscalerAppfwProfileSafetyIndex

netscalerAppfwProfileSecChecksSafetyIndex

netscalerAppfwProfileSigAutoUpdate

netscalerAppfwProfileSigBlockCount

netscalerAppfwProfileSigDisabled

netscalerAppfwProfileSigEnabled

netscalerAppfwProfileSigLogCount

netscalerAppfwProfileSignatureSafetyIndex

netscalerAppfwProfileSigStatCount

netscalerAppfwProfileStatsflags

netscalerAppfwProfileType

netscalerAppfwReqUrl

netscalerAppfwSequenceNumber

netscalerAppfwSessionId

netscalerAppfwSigCategory1

netscalerAppfwSigCategory2

netscalerAppfwSigCategory3

netscalerAppfwSigName

netscalerAppfwSigRuleBlockFlags

netscalerAppfwSigRuleCategory1

netscalerAppfwSigRuleCategory2

netscalerAppfwSigRuleCategory3

netscalerAppfwSigRuleCategory4

netscalerAppfwSigRuleCategory5

netscalerAppfwSigRuleEnabledFlags

netscalerAppfwSigRuleFileName

netscalerAppfwSigRuleID1

netscalerAppfwSigRuleID2

netscalerAppfwSigRuleID3

netscalerAppfwSigRuleID4

netscalerAppfwSigRuleID5

netscalerAppfwSigRuleLogFlags

netscalerAppfwSigRuleLogstring1

netscalerAppfwSigRuleLogstring2

netscalerAppfwSigRuleLogstring3

netscalerAppfwSigRuleLogstring4

netscalerAppfwSigRuleLogString5

netscalerAppfwSigRuleStatsFlags

netscalerAppfwTransformFlags

netscalerAppfwViolationLocation

netscalerAppfwViolationNameValue1