# ElastiFlow Documentation

### Welcome to the ElastiFlow Docs page!

ElastiFlow offers comprehensive network observability and security analytics by collecting and analyzing network flow & telemetry data. It provides deep insights into network performance, reliability, and security across your infrastructure by acting as a high-performance flow collector that processes data from various sources like NetFlow, IPFIX, and sFlow. This unified approach gives you a single, contextualized view of all network activity, helping you understand what's truly happening on your network.

### Helpful links

Get started with ElastiFlow using our new virtual appliance: [Quickstart Guide](/flowcoll/quickstart-guide)

Join our community to engage with other users and the ElastiFlow team.

* [ElastiFlow Community Forum](https://forum.elastiflow.com/)
* [ElastiFlow Community Slack](https://join.slack.com/t/elastiflowcommunity/shared_invite/zt-3ua41906f-5uM4aJSXO5vpJHlq4j8xhQ)

ElastiFlow instantly transforms your Open Data Platform into a powerful network observability platform.

<figure><img src="/files/DGxNrc1e1cKkbwXeaAJZ" alt=""><figcaption></figcaption></figure>


# Changelog

## 7.26.3 - Aug 14, 2026

#### Fixes

* **NetObserv SNMP** - fixed an issue where NetObserv SNMP would not output to Elasticsearch correctly.

## 7.26.2 - June 30, 2026

#### Fixes

* **NetObserv** - `Strict-Transport-Security` header present in API server whenever `EF_API_TLS_ENABLE` is true.
* **Elasticsearch Output** - additional error logging added.

## 7.26.1 - June 23, 2026

#### Fixes

* **NetObserv Flow** - fixed an issue in the processor which could cause a panic in some scenarios

## 7.26.0 - May 29, 2026

#### Features

* **NetObserv SNMP** - Add support for CISCO-RTTMON-MIB objects

#### Fixes

* **NetObserv Flow** - fixed an issue in the option record cache which could cause a panic in some scenarios.

## 7.25.0 - May 7, 2026

#### Features

* **Elasticsearch Output** - Added `ignore_malformed` to index templates for TSDS output.

#### Fixes

* **NetObserv Flow** - fix sample rate determination for all scenarios.
* **Elasticsearch Output** - log an additional error when the bulk api returns 200 but has error in response payload.

## 7.24.0 - Apr 28, 2026

#### Features

* **NetObserv Flow** - For userdefined metadata feature ([User-Defined Metadata (UDM) for Addresses](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_udm)), added 'contexts' support. Now you can configure NetObserv Flow, for example, to only add some enrichment to the 'exporter' fields.

#### Fixes

* **NetObserv Flow** - improved error logging for Azure VNET input.

## 7.23.0 - Apr 17, 2026

#### Features

* **NetObserv Flow** - packet parser supports ERSPAN headers.
* **NetObserv Flow** - supports latest Calix information elements.

#### Fixes

* **NetObserv SNMP** - fixed IP metadata enrichment.

## 7.22.0 - Mar 20, 2026

{% hint style="info" %}
NetObserv SNMP changed and improved how polling intervals work. The new `poll_intervals` configuration option will override `poll_interval` .

If you have customized any `snmp` definition files, you should consider updating them to include the new `type` object attribute.
{% endhint %}

#### Features

* **NetObserv SNMP: Smart Object Polling** - NetObserv SNMP allows collection to be fine-tuned by setting polling intervals for different types of SNMP objects. Instead of using the same polling interval for all SNMP objects, NetObserv can poll less frequently for object types that do not change as frequently.
  * See the configuration documentation for more details: <https://docs.elastiflow.com/snmpcoll/configuration/def_devices#poll_interval-optional>
  * No action should be required. Starting with `7.22.0`, NetObserv will automatically use the smarter polling defaults.
* **NetObserv (All) -** New fields added: `collector.host.name` and `collector.ip.addr` .
  * `collector.host.name` is the hostname of the system running the NetObserv collector.
  * `collector.ip.addr` is the IP address of the system running the NetObserv collector. For systems with multiple IP addresses, it will be the IP of the interface through which the system reaches its default gateway.
* **NetObserv SNMP -** Added additional SNMP MIB support: <https://github.com/elastiflow/snmp/releases/tag/v1.23.0>

#### Fixes

* **NetObserv Flow -** NetIntel enrichment no longer overrides `app.name`, `app.category.name`, and `app.subcategory.name` when those fields are already set from the received flow records.
* **NetObserv SNMP -** Fixed an issue where "degraded" device status checks did not always work. Also added error and warning logs so that any underlying errors (such as socket permission errors) are displayed in logs for troubleshooting.
  * This issue was resolved by adding the CAP\_NET\_RAW permission to the service file. NetObserv SNMP must have permission to create/send ping requests to detect 'degraded' status. In some Linux distributions, that permission is not automatic. CAP\_NET\_RAW grants the process the capability to use RAW and PACKET sockets and to bind to any address for transparent proxying.

## 7.21.4 - Mar 13, 2026

#### Features

* **NetObserv Flow -** Added support for additional IPFIX information elements.

## 7.21.3 - Mar 13, 2026

#### Fixes

* **OTel Trace Input -** Fixed flow\.direction.id and flow\.direction.name fields to be correct.

## 7.21.2 - Mar 12, 2026

#### Fixes

* **Azure VNet Input -** Export type labels for Azure VNet Logs are now correctly set, resolving an issue where the "Flow Records" dashboard failed to render the flow record source for this input.
* **OTel Trace Input -** Spans received by the OTel Trace Input are now attributed with an export type of "OTel Flow Span", resolving an issue where the "Flow Records" dashboard failed to render the flow record source for this input.
* **OTel Trace Input -** Host metadata is now resolved from OTLP resource attributes for records sourced by the OTel Trace Input, fixing a number of display issues across several dashboards when viewing these records.

## 7.21.1 - Feb 9, 2026

#### Fixes

* **OTLP Input -** Resolved an issue where the readiness endpoint would incorrectly report a failure when the OTLP input was enabled.

## 7.21.0 - Feb 3, 2026

{% hint style="warning" %}

#### Warning

If you use the [namespace ability in your configuration](https://docs.elastiflow.com/flowcoll/configuration/outputs#namespace-configuration), you can no longer use namespaced output instances *and* non-namespaced output instances at the same time. For example, if you are using Elasticsearch output, and you have configuration that looks like this:

```
EF_OUTPUT_ELASTICSEARCH_ENABLE=true # global configuration
EF_NAMESPACE1_OUTPUT_ELASTICSEARCH_ENABLE=true # namespace configuration
```

NetObserv will throw an error now. Previously there was a bug that allowed this invalid configuration.
{% endhint %}

#### Features

* **NetObserv Configuration -** You can now encrypt some NetObserv configuration files on disk; for full details see [Encrypting Configuration Files](/flowcoll/configuration/encrypting-configuration-files).
* **OTel Trace Input -** Added support for OpenTelemetry Protocol (OTLP) trace ingestion with namespace-based configuration. Supports both gRPC and HTTP ingestion; for full details on configuration see  [Trace](/flowcoll/configuration/inputs/otel/trace).
* **OTel Trace Output -** Added support for OpenTelemetry Protocol (OTLP) trace exporting with namespace-based configuration. Supports exporting in both gRPC and HTTP formats; for full details on configuration see  [Trace](/flowcoll/configuration/inputs/otel/trace).
* **NetObserv Flow** **-** added support for deriving flow records from dataLinkFrameSection (IANA IE 315)
* **NetObserv Flow** **-** added support for GENEVE tunnels when parsing sFlow, IFA and dataLinkFrameSection sampled headers.

#### Updates

* **Kafka Output** - corrected a possible deadlock condition when using a TLS connection to brokers.
* **OTLP Output -** some fields (like 'container.name') are replaced with source/destination fields (like 'source.container.name' and 'destination.container.name').

#### Fixes

* **Outputs -** NetObserv will correctly throw an error if you misconfigure namespaces in configuration.
* **NetObserv Flow** **-** Fixed an issue with the caching of some option data templates which could cause a panic in some scenarios.
* **NetObserv Flow -** NetObserv will now ignore, within flow records, extra fields where ip address is set to "zero value" (0.0.0.0 or ::0). Previously it would set an ip address field to the zero address and ignore real values.

## 7.20.0 - December 11, 2025

#### Updates

* **Kafka Output** - Added support for encrypted private keys when using mTLS. See EF\_OUTPUT\_KAFKA\_TLS\_KEY\_PASSPHRASE for usage.
* **SNMP Definitions** - Released [snmp v1.21.0](https://github.com/elastiflow/snmp/releases/tag/v1.21.0) for additional MIB support (PowerNet-MIB::upsAdvTest).

#### Fixes

* **NetObserv Flow** - Fixed a bug where ports 9411 and 9412 were claimed by NetObserv process when they should not have been.

#### Notes

If you are upgrading NetObserv SNMP, you will need to follow the Manual Upgrade Steps for SNMP definition files.

## 7.19.3 - November 21, 2025

#### Updates

* **SNMP Trap Rules** - Released [snmp v1.20.0](https://github.com/elastiflow/snmp/releases/tag/v1.20.0) for additional SNMP Trap support.

#### Fixes

* **SNMP Poll Schedule Persistence** - Fixed an issue where poll schedules were not correctly persisted across collector restarts when persistence was enabled (`EF_INPUT_SNMP_PERSIST_ENABLE=true`).
* **Collector Process Exit** - Fixed an issue where pressing Ctrl+C did not properly exit the NetObserv collector process.

## 7.19.2 - November 6, 2025

#### Fixes

* **OpenSearch Output** - Fixed an issue where unused and unnecessary indices were being created on startup.

## 7.19.1 - November 4, 2025

#### Fixes

* **NetObserv** - Fixed an issue which could prevent NetObserv from booting correctly.
* **OpenSearch Output** - Fixed an issue where retry configuration was not respected.

## 7.19.0 - October 31, 2025

#### Updates

* **SNMP Trap Rules** - Released [snmp v1.19.0](https://github.com/elastiflow/snmp/releases/tag/v1.19.0) for additional SNMP Trap support.

#### Fixes

* **Metadata Enrichment** - Fixed an issue where the API to manage user-defined metadata would panic.

#### Notes

If you are upgrading NetObserv SNMP Trap, you will need to follow the [Manual Upgrade Steps for SNMP definition files.](/additional-resources-reference-articles/faq/def_download)

## 7.18.1 - October 17, 2025

#### Fixes

* **OpenSearch Output** - Improved logging. Whenever username/password is incorrect, you will now see a more full message saying 'Unauthorized'.

## 7.18.0 - October 15, 2025

#### New Features

* **NetObserv SNMP Trap** - Added support for rules that handle traps where the enterprise of the trap is unsupported by any other rules.
* **NetObserv SNMP Trap** - Added bloblang functions `snmp_int_display_hint()` and `snmp_octet_display_hint()` for transforming raw integer-based and `OCTET STRING`-based varbind values, respectively.

#### Updates

* **SNMP Trap Rules** - Released [snmp v1.18.0](https://github.com/elastiflow/snmp/releases/tag/v1.18.0) for additional SNMP Trap support. Includes the following:
  * FORTINET-CORE-MIB
  * FORTINET-FORTIANALYZER-MIB
  * FORTINET-FORTIGATE-MIB
  * FORTINET-FORTIMAIL-MIB
  * FORTINET-TRAP-MIB (incl. FORTIOS-300-MIB as both send same enterprise)
  * JUNIPER-DOM-MIB
  * JUNIER-LDP-MIB
  * STORMSHIELD-ALARM-MIB
  * UCD-SNMP-MIB

#### Fixes

* **Elasticsearch Output** - Fixed issue where the configuration options for max retries and retry backoff were swapped.

#### Notes

If you are upgrading NetObserv SNMP Trap, you will need to follow the [Manual Upgrade Steps for SNMP definition files](https://www.elastiflow.com/docs/kb/install/def_download).

## 7.17.0 - October 2, 2025

#### New Features

* **NetObserv SNMP** - Availability checks have been updated to include the round-trip latency between the collector and the device. Additionally availability testing is now based on the devices defined in the SNMP configuration definitions, instead of the devices which have been successfuly polled during object discovery. This ensures that devices that are down during object discovery will still be polled with availability checks.
* **NetObserv SNMP** - When polling the `IF-MIB:ifEntry` SNMP definition, the collector will now calculate the bandwidth utilization of the network interface and add this to the records. These fields are `netif.bandwidth.util.in`, `netif.bandwidth.util.out` and `netif.bandwidth.util.total` and contain a 0-100 percentage value as a 64-bit floating point number.

#### Updates

* **Kafka Output** - Flush-related configuration options have been adjusted for better throughput. The minimum allowed value of these options has been decreased to `0` (unlimited) for improved configuration flexibility.
* **SNMP Trap Rules** - Released [snmp v1.16.0](https://github.com/elastiflow/snmp/releases/tag/v1.16.0) for additional SNMP Trap support.

#### Notes

If you are upgrading NetObserv SNMP Trap, you will need to follow the [manual upgrade steps](/additional-resources-reference-articles/faq/def_download) to ensure that the additional SNMP Trap support is included.

## 7.16.0 - September 25, 2025

#### New Features

* **Metadata Enrichment** - Added a REST/gRPC/connectrpc API for managing [user-defined metadata](https://www.elastiflow.com/docs/flowcoll/enrich_ip_udm). See the [API spec](https://www.elastiflow.com/docs/api_ref/enrich_ip_udm_api) for more details. This feature is *disabled* by default and can be enabled by setting the following configuration: EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_ENABLE.

#### Updates

* **Metadata Enrichment** - Improved the performance and scalability of metadata enrichment, allowing for a larger number of [user-defined metadata](https://www.elastiflow.com/docs/flowcoll/enrich_ip_udm).
* **SNMP Definitions** - Released [snmp v1.15.0](https://github.com/elastiflow/snmp/releases/tag/v1.15.0) for additional MIB support.

#### Fixes

* **SNMP Device Autodiscovery** - Fixed a data race condition.

#### Notes

If you are upgrading NetObserv SNMP, you will need to follow the [Manual Upgrade Steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).

## 7.15.0 - September 18, 2025 <a href="#id-7150---september-18-2025" id="id-7150---september-18-2025"></a>

#### Updates

* **SNMP Trap Collector** - Added custom Bloblang functions for extracting SNMP fields from traps (see all custom functions [here](/trapcoll/configuration/processing-traps#custom-functions)).

#### Fixes

* **SNMP Trap Collector** - Fixed an issue where non-YAML files were being processed during definition validation.

## 7.14.1 - September 11, 2025 <a href="#id-7141---september-11-2025" id="id-7141---september-11-2025"></a>

#### Fixes

* **SNMP Device Autodiscovery** - Fixed an issue where the discovery process panics when a device is missing the `sysObjectID`.

## 7.14.0 - September 4, 2025 <a href="#id-7140---september-4-2025" id="id-7140---september-4-2025"></a>

#### New Features

* **NetObserv Flow** - Some flow sources will use the source or destination layer-4 port IEs to carry the combined ICMP Type/Code value when the layer-4 protocol is ICMP or IPv6-ICMP. If the flow records for ICMP traffic do not otherwise contain the ICMP Type and Code directly, the layer-4 source and destination ports will be checked to see if they contain these values.
* **SNMP Definitions** - Released [snmp v1.14.0](https://github.com/elastiflow/snmp/releases/tag/v1.14.0) to add additional MIB support: Bluecat, Digi, and Ubiquiti.

#### Fixes

* **SNMP Device Autodiscovery** - Fixed an issue where devices with more than one IP address associated with it were discovered multiple times.
* **/livez** - Fixed /livez status API for all NetObserv products. It will correctly return 200 when the process starts
* **/readyz** - Fixed /readyz status API for all NetObserv products. It will correctly return 200 when the process is ready to receive input, and it will remain 200 thereafter.

#### Notes

If you are upgrading NetObserv SNMP, you will need to follow the [Manual Upgrade Steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).

## 7.13.1 - August 13, 2025

#### Fixes

* **NetObserv SNMP** - Improved handling of scenarios where the configured `syntax` of an object attribute doesn't match the data type of values returned by the device. This avoids possible panic conditions.

#### Security

* **CVE-2025-54801** - Updated `github.com/gofiber/fiber/v2` from `2.52.6` to `2.52.9`.
* **CVE-2025-22868** - Updated `golang.org/x/oauth2` from `0.25.0` to `0.27.0`.
* **CVE-2025-8556** - Updated `github.com/cloudflare/circl` from `1.3.9` to `1.6.1`.

## 7.13.0 - August 6, 2025

#### New Features

* **NetObserv SNMP TSDS Support** - NetObserv SNMP's Elasticsearch output now supports TSDS. See [TSDS configuration docs](/flowcoll/configuration/outputs/output_elasticsearch/elastic-configuration-options) for more details.

#### Fixes

* **NetObserv Flow** - IP enrichment will now ignore empty IP addresses (`0.0.0.0` and `::`) instead of outputting incorrect values.

## 7.12.0 - July 25, 2025

#### New Features

* **SNMP Device Autodiscovery (TECHNOLOGY PREVIEW)** - Added device autodiscovery feature. You can view more info in our [*Autodiscovery for Devices* guide](/snmpcoll/configuration/def_devices/autodiscovery)
* **Storage Optimization** - Added storage optimization support for NetObserv SNMP when using Elasticsearch or OpenSearch outputs. This feature is enabled by default and can be toggled using the following configurations: EF\_OUTPUT\_ELASTICSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE and EF\_OUTPUT\_OPENSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE. See [this guide](/additional-resources-reference-articles/faq/storage_optimization) for more information on how to set up storage optimization.

#### Updates

* **AWS VPC Flow Logs** - Added AWS VPC Flow Log support to include all flow records through v8.

#### Fixes

* **SNMP Definitions** - Released [snmp v1.12.0](https://github.com/elastiflow/snmp/releases/tag/v1.12.0) to add definition validation via the `make validate` command.
* **NetObserv Flow** - Updated the default value for `EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_AS_PREFIX_PRECISION` previously this was set to `all`, which allowed for all AS summary routes to be added during enrichment. The new default value is `exact`, which only adds the most specific AS summary route for each IP address. This change improves performance and reduces the size of the enriched data. If you want to revert to the previous behavior, you can set `EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_AS_PREFIX_PRECISION` to `all`.

#### Notes

If you are upgrading NetObserv SNMP, you will need to follow the [Manual Upgrade Steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).

## 7.11.1 - June 12, 2025

#### Fixes

* **Kafka Output** - Fixed an issue where the collector would fail to send records to a Kafka output that has mTLS authentication enabled.

## 7.11.0 - June 10, 2025

#### New Features

* **Storage Optimization** - Added support for a new storage optimization and query performance improvement feature for Elasticsearch and OpenSearch outputs when running the **NetObserv Flow**. This feature is enabled by default and can be toggled using the following configurations: EF\_OUTPUT\_ELASTICSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE and EF\_OUTPUT\_OPENSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE. See [this guide](/additional-resources-reference-articles/faq/storage_optimization) for more information on how to set up storage optimization.

#### Updates

* **NetObserv SNMP** - Added support for processing object indexes that may have Route Distinguisher (RD) information prefixed to an IPv4 or IPv6 address. This update adds `IpAddressRoutePrefix` as a [supported syntax](/snmpcoll/configuration/snmp-definition-files/def_objects#snmpv2-smi-rfc-2578-types) in the SNMP object definition.
* **NetObserv Flow** - Updated support for the Pensando DPU to include the latest IEs.
* **NetObserv Flow** - Enhanced the `tcpOptions` (IE 209) translator to handle encoding for both RFC 1502 and RFC Errata 2946.
* **Elasticsearch/OpenSearch Output** - Updated the default value for index refresh interval to `20s` (see the EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL and EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL configurations). This update improves the efficiency of the index refresh process with the new storage optimization feature.
* **OpenSearch Output** - Updated the default value for index period to `rollover` (see the EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PERIOD configuration). This update aligns the index period with the default value for Elasticsearch.
* **SNMP Definitions** - Released version 1.9 of [snmp](https://github.com/elastiflow/snmp) to support the following object definitions:
  * Cisco UCS
  * Riverbed
  * PowerNet-MIB
  * NETAPP-MIB
  * CISCO-VTP-MIB
  * CloudGenix
  * Isilon
  * Rubrik
  * Pure Storage
  * IETF and Cisco dial control

If you are upgrading NetObserv SNMP, you will need to follow the [Manual Upgrade Steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).

If you are upgrading NetObserv SNMP Trap, and you also use our [Kibana SNMP Trap dashboard](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/refs/heads/master/kibana/snmp_traps/kibana-8.14.x-snmp-traps-codex.ndjson), you will need to reimport the dashboard. You can follow our instructions for [dashboard import.](/trapcoll/configuration/outputs/output_elasticsearch)

#### Fixes

* **OpenSearch Output** - Fixed an issue where the OpenSearch output was not correctly handling the EF\_OUTPUT\_OPENSEARCH\_INDEX\_SUFFIX configuration, which would lead to incorrect index template naming.
* **NetObserv Flow** - Fixed an issue with the flow throttler (that limits flows per second to the licensed maximum) using too much CPU when you exceed your licensed maximum while in recovery mode after a burst.

## 7.10.3 - May 16, 2025

#### Fixes

* **TSDS** - Fixed an issue where non TSDS indexes were being created when TSDS was enabled for Elasticsearch.
* **Elasticsearch Output** - The configuration EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_SUFFIX no longer breaks rollovers in Elasticsearch.
  * NOTICE: if you have some NetObserv instances that use a suffix *and* some that do not, you might have to set EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_OVERWRITE to 'true' when upgrading NetObserv to guarantee that the bugfix takes effect.
  * If you use `EF_OUTPUT_ELASTICSEARCH_INDEX_SUFFIX`, any index templates NetObserv creates now will now have a priority of 101.
* **SNMP Definitions** - Released version 1.8 of [snmp definition files](https://github.com/elastiflow/snmp).
  * Added support for Cisco SIP MIBs.
  * Added support for Netscaler MIBs.

If you are upgrading NetObserv SNMP or NetObserv SNMP Trap, you will need to follow the [Manual Upgrade Steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).

#### Security

* **CVE-2024-40635** - Updated `github.com/containerd/containerd` from `1.7.18` to `1.7.27`.
* **CVE-2025-22869** - Updated `golang.org/x/crypto` from `0.31.0` to `0.36.0`.
* **CVE-2025-22870** - Updated `golang.org/x/net` from `0.33.0` to `0.38.0`.
* **CVE-2025-22872** - Updated `golang.org/x/net` from `0.33.0` to `0.38.0`.
* **CVE-2025-27144** - Updated `github.com/go-jose/go-jose/v3` from `3.0.3` to `3.0.4`.
* **CVE-2025-30204** - Updated `github.com/golang-jwt/jwt/v4` from `4.5.1` to `4.5.2`.
* **CVE-2025-30204** - Updated `github.com/golang-jwt/jwt/v5` from `5.2.1` to `5.2.2`.

## 7.10.2 - May 2, 2025

#### Fixes

* **SNMP Collector** - Fixed an issue where the SNMP Collector used a significant amount of memory when polling a large number of devices.

## 7.10.1 - April 25, 2025

#### Fixes

* **SNMP Trap Device Licensing** - Fixed an issue where the SNMP Trap Collector was counting devices by IP and port instead of by IP only. This caused the device count to be higher than expected, potentially leading to licensing issues.
* **SNMP Trap Listener** - Fixed an issue where the SNMP Trap Collector was not correctly handling the Agent Address field in the SNMPv1 trap header. This led to incorrect IP addresses being recorded in the trap records.
* **SNMP Definitions** - Released version 1.7 of [snmp](https://github.com/elastiflow/snmp) to address the following fixes
  * **SNMP** - Fixed various `dot3Stats` OIDs.
  * **SNMP Trap** - Updated a parsing rule in `ciscoConfigManMIBNotifications`. A variable binding is optional, but was treated as mandatory.

If you are upgrading NetObserv SNMP or NetObserv SNMP Trap, you will need to follow the [Manual Upgrade Steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).

## 7.10.0 - April 17, 2025

#### Updates

* **SNMP Polling** - Added support for limiting the number of concurrent polls to a device. This can be configured for each device by setting the max\_concurrent\_polls field in the device definition file to the desired value.

#### Security

* **CWE-25** - Updated `filippo.io/age` from `1.2.0` to `1.2.1`.

## 7.9.0 - March 27, 2025

#### Updates

* **SNMP Polling** - Added support for enriching Cisco QoS policy objects with the following fields: `ifName`, `cbQosPolicyMapName`, `cbQosCMName`, and `cbQosMatchStmtName`. Enable this enrichment by setting the cisco\_qos\_enabled field to `true` in the device's definition.

#### Fixes

* **Azure VNet Flow Logs** - Fixed an issue where the flow collector would not process Azure flow logs if the user had configured a different Resource Group than the default.
* **Azure VNet Flow Logs** - Fixed an issue where Blob events were not being able to be processed by ignoring all events that are not `Microsoft.Storage.BlobCreated`.
* **SNMP Polling** - Fixed an issue where Error Index was not being interpreted correctly as a 1-based index.

## 7.8.0 - March 12, 2025

#### New Features

* **Azure VNet Flow Logs** - Added support for collecting VNet flow logs from Azure. See [configuration guide](/flowcoll/configuration/inputs/input_azure_vnet) for more details.

#### Updates

* **Autonomous System Enrichment** - Added further Autonomous system (AS) field indexing and the EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_AS\_PREFIX\_PRECISION configuration to allow greater enrichment controls.
* **NetIntel Enrichment** - Updated NetObserv flow to download a compressed version of the NetIntel database for greater efficiency.
* **Public GPG Key Update** - ElastiFlow's public GPG key has been replaced, using SHA‑256 instead of SHA‑1. Existing installations remain compatible, but users in environments that disable SHA‑1 (e.g., FIPS environments or Rocky 9 installations) should reimport the new key to enable support for the updated algorithm. To reimport the new key, follow the same steps as before provided in the [installation documentation](/flowcoll/installation/install_linux#verify-the-package).

## 7.7.2 - February 18, 2025

#### Fixes

* **SNMP Collector** - Fixed an issue where the SNMP collector would panic when polling objects with `ObjectIdentifier` syntaxes.

## 7.7.1 - February 14, 2025

#### Updates

* **AWS VPC Flow Logs via AWS Firehose** - Added a new configuration, EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_HTTP\_PORT, to customize the HTTP port that the flow collector listens on for incoming flow logs from Amazon Firehose.

#### Fixes

* **Flow Collector** - Fixed an issue where path and telemetry indices were not being created correctly when TSDS was enabled for Elasticsearch.
* **Splunk Output** - Fixed an issue where the EF\_OUTPUT\_SPLUNK\_HEC\_CIM\_ENABLE configuration was not being respected and Splunk CIM fields were not used.
* **Flow Collector** - Fixed an issue where flows were not being enriched correctly with AS fields.

#### Security

* **CVE-2022-28948** - Updated `gopkg.in/yaml.v3` from `3.0.0-20210107192922-496545a6307b` to `3.0.0`.
* **CVE-2023-48795** - Updated `golang.org/x/crypto` from `0.11.0` to `0.31.0`.
* **CVE-2024-45337** - Updated `golang.org/x/crypto` from `0.11.0` to `0.31.0`.
* **CVE-2023-3978** - Updated `golang.org/x/net` from `0.12.0` to `0.33.0`.
* **CVE-2023-39325** - Updated `golang.org/x/net` from `0.12.0` to `0.33.0`.
* **CVE-2023-44487** - Updated `golang.org/x/net` from `0.12.0` to `0.33.0`.
* **CVE-2023-45288** - Updated `golang.org/x/net` from `0.12.0` to `0.33.0`.
* **CVE-2024-45338** - Updated `golang.org/x/net` from `0.12.0` to `0.33.0`.

## 7.7.0 - February 3, 2025

#### New Features

* **NetObserv SNMP Trap Collector** - Added a new SNMP Trap Collector to the NetObserv suite. The SNMP Trap Collector is a turnkey solution for collecting, processing, and enriching SNMP traps from network devices. For more information, see the [SNMP Trap Collector Introduction](/trapcoll).

#### Updates

* **Maxmind Enrichment** - Improved the performance of Maxmind GeoIP and ASN enrichment.
* **TSDS** - Added metric support for TSDS data streams in Elasticsearch outputs. To enable sending metrics to TSDS data streams ensure EF\_OUTPUT\_ELASTICSEARCH\_TSDS\_ENABLE is set to true and EF\_OUTPUT\_ELASTICSEARCH\_ALLOWED\_RECORD\_TYPES includes `metric`.

## 7.6.0 - January 21, 2025

#### Updates

* **License** - Added the following license related configurations:
  * [EF\_LICENSE\_KEY](/flowcoll/configuration/config_gen/license#ef_license_key) (replaces `EF_FLOW_LICENSE_KEY` and `EF_SNMP_LICENSE_KEY`, marked for deprecation).
  * [EF\_LICENSE\_FLOW\_RECORDS\_PER\_SECOND](broken://pages/M4KHqREHB94D8jMwCIZx#ef_license_flow_records_per_second) (replaces `EF_FLOW_LICENSED_UNITS`, marked for deprecation).
  * [EF\_LICENSE\_TELEMETRY\_HOSTS](/snmpcoll/configuration/general-configuration/license#ef_license_telemetry_hosts).
* **Flow Collector Metrics** - Added a new informational metric to the flow collector to provide clarity on the maximum flow records per second that the collector is provisioned for according to the license: [license\_flow\_records\_per\_second](/flowcoll/overview/metrics#license_flow_records_per_second).
* **SNMP Collector Metrics** - Added two new informational metrics to the SNMP collector to provide clarity on the maximum number of SNMP devices and objects that can be polled according to the license: [license\_telemetry\_hosts](/snmpcoll/api-reference-overview/metrics#license_telemetry_hosts) and [license\_telemetry\_objects](/snmpcoll/api-reference-overview/metrics#license_telemetry_objects).
* **Metrics** - Renamed the `license_units` metric to `license_info` to better reflect the information it provides: license\_info.
* **Outputs** - Introduced the following configurations for Splunk, Cribl, and generic http outputs to control which record types are sent to stdout. Supported values include: `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, and `log`. If left empty, all record types will be sent to the output.
  * [EF\_OUTPUT\_SPLUNK\_HEC\_ALLOWED\_RECORD\_TYPES](/flowcoll/configuration/outputs/output_splunk_hec#ef_output_splunk_hec_allowed_record_types)
  * [EF\_OUTPUT\_CRIBL\_ALLOWED\_RECORD\_TYPES](/flowcoll/configuration/outputs/output_cribl#ef_output_cribl_allowed_record_types)
  * [EF\_OUTPUT\_GENERIC\_HTTP\_ALLOWED\_RECORD\_TYPES](/flowcoll/configuration/outputs/output_http#ef_output_generic_http_allowed_record_types)

#### Fixes

* **RPM and FIPs** - RPM package for NetObserv will now work correctly on FIPs compliant RHEL machines.
* **sFlow** - Fixed an issue that could cause fields to not be successfully parsed from an sFlow `sampled_header` depending on where the packet sample was truncated.
* **SNMP Poller** - Fixed an issue where collectors would start without users accepting our license agreement. When you upgrade and have not accepted the license agreement, you may encounter the following error:

  ```shell
  snmpcoll/main.go:62 exiting because of a license error {"code": "license/error", "reason": "license configuration: license agreement not accepted. Please update 'EF_LICENSE_ACCEPTED'"}
  ```

  To resolve this, ensure `EF_LICENSE_ACCEPTED` is set to `true` in your configuration.

## 7.5.3 - December 4, 2024

#### Fixes

* **Metrics collection** - Reduced log level from `error` to `debug` if NetObserv can't access system metrics like CPU or available hard drive space.
* **SNMP poller panic** - Fixed a bug that had SNMP poller stop working when some SNMPv2 devices sent their DisplayString in an unexpected format.
* **API\_IP configuration** - Fixed a bug where NetObserv was still listening on all interfaces even though a specific IP address is set in the EF\_API\_IP configuration.
* **Container** - Flow Collector container no longer requires mounting /var/lib/elastiflow/flowcoll just to run.

## 7.5.2 - November 22, 2024

#### Updates

* **AWS VPC Flow Logs** - Added AWS VPC Flow Log support to include all flow records through v7.

#### Fixes

* **SNMP Enrichment** - Fixed an issue where the Flow Collector could fail to enrich flow records with SNMP data from SNMPv3 devices.
* **NetIntel -** Fixed an issue where downloading the NetIntel dataset could fail due to insufficient timeout.

## 7.5.1 - November 15, 2024

#### Fixes

* **Metrics** - Fixed an issue where duplicate metric registration can cause a panic in the NetObserv Flow collector.

## 7.5.0 - November 8, 2024

#### Updates

* **Docker Installation** - Added a new volume mount point to support data persistence for Docker installations. This enables the NetObserv Flow Collector to retain data across container restarts. For more information, see the [Upgrade to 7.5](/additional-resources-reference-articles/faq/upgrade_7.5#docker-installation) guide.
* **Sample Rate** - Added support for calculating flow sample rate from sampling packet interval and space found in an option record.
* **Flow Data Path** - Added a new configuration, [EF\_FLOW\_DATA\_PATH](/flowcoll/configuration/config_gen/data_path#ef_flow_data_path), to specify the path where NetObserv Flow will store data files that need to be persisted between runs.
* **Autonomous System Enrichment** - Added support enriching Autonomous System data from the NetIntel dataset.

#### Fixes

* **Metadata Enrichment** - Fixed an issue where flows were not being consistently enriched with metadata associated to the most specific IP CIDR or range.
* **Support Bundle** - Fixed an issue where the original file modification date was not preserved when creating support bundles.
* **Versa AppID** - Fixed an issue where application information from Versa devices were not enriched correctly.

## 7.4.0 - October 25, 2024

#### Updates

* **Sample Rate** - Added IP CIDR and range support for user-defined [sample rates](/flowcoll/configuration/flow-processing/sampling#ef_processor_enrich_samplerate_userdef_path).
* **Metrics** - Added system-level and process-level Prometheus metrics for memory, CPU, and disk usage.
* **CLI Tool** - Allow netobserv commands to read license parameters from the configuration file.
* **stdout Output** - Introduced a new configuration, [EF\_OUTPUT\_STDOUT\_ALLOWED\_RECORD\_TYPES](/flowcoll/configuration/outputs/output_stdout#ef_output_stdout_allowed_record_types), to control which record types are sent to stdout. Supported values include: `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, and `metric`. If left empty, all types will be allowed by default.

#### Fixes

* **SNMP Enrichment** - Fixed a panic condition that could occur when enriching flows with SNMP data.
* Fixed an issue where logs were dropped when the app panics and restarts.

## 7.3.2 - October 11, 2024

#### Updates

* **Extended field support** - Added support for NetQuest JA4 IPFIX records

## 7.3.1 - October 1, 2024

#### Fixes

* **AS Enrichment** - Fixed potential panic if Autonomous System data was enriched as an array instead of single value.

## 7.3.0 - September 24, 2024

#### Updates

* **Packet Parser** - Flow Collector: Improved Infiniband support to handle additional OpCodes.

#### Fixes

* **Packet Parser** - Flow Collector: Fixed an issue that cause Infiniband-related boolean values to be indexed incorrectly.
* **sFlow** - Flow Collector: `system.ip.addr` not set correctly for sFlow records.
* **Elasticsearch Output** - SNMP Collector: Auto-generated component template now has the correct "version" value.
* **Logging** - The warning for RiskIQ-related environment variable no longer triggers for non-ElastiFlow RiskIQ environment variables.

## 7.2.2 - September 6, 2024

#### Fixes

* Fixed a panic condition that could happen if IPFIX or sFlow packets contained incorrect payload length values.

## 7.2.1 - August 21, 2024

#### Fixes

* **Output** - Fixed a race condition which would cause a concurrent map write issue and stop the collector when there was high throughput.

## 7.2.0 - August 16, 2024

#### New Features

* **Metrics** - Added new functionality to gather and send all Prometheus metrics to outputs. This feature can be enabled by adding `metric` to EF\_OUTPUT\_ELASTICSEARCH\_ALLOWED\_RECORD\_TYPES, EF\_OUTPUT\_OPENSEARCH\_ALLOWED\_RECORD\_TYPES, or EF\_OUTPUT\_KAFKA\_ALLOWED\_RECORD\_TYPES.
* **RoCEv2 support (TECHNOLOGY PREVIEW)** - Added support for ingesting `RoCEv2` flow data.

#### Updates

* **Metrics** - Added a `record_type` label to output metrics in order to provide more granularity into the records being pushed to downstream outputs.
* **Docker Container** - Upgraded base image to `ubuntu:24.04`.

#### Fixes

* **Docker Container** - The Docker container now includes default configuration files and directories.
* Fixed an issue where inconsistent attribute tagging occurred in flow records when using nested rules in the EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_USERDEF\_PATH file.
* Fixed an issue where sFlow counter records were processed despite EF\_PROCESSOR\_DECODE\_SFLOW\_COUNTERS\_ENABLE being set to false.
* Fixed an issue where sFlow counter records were returning a `sample type not supported` error for valid counter samples when EF\_PROCESSOR\_DECODE\_SFLOW\_COUNTERS\_ENABLE was being set to false.
* Fixed an issue where proxy settings within NetObserv were not applied correctly, resulting in failed downloads of the NetIntel data set for flow enrichment when a proxy is being used.

## 7.1.2 - August 8, 2024

#### Fixes

* Fixed an issue where all data was being written to one TSDS datastream when TSDS is enabled for Elasticsearch.
* Fixed an issue where the SNMP poller ignores EF\_INPUT\_SNMP\_POLLER\_ERROR\_HANDLING and stops object polling when a device returns an empty object.

## 7.1.1 - July 17, 2024

#### Fixes

* Fixed an issue where NetIntel environment variables were not being passed down correctly.

## 7.1.0 - July 16, 2024

#### New Features

* **NetIntel dataset for air-gapped environments** - A new cli tool to download the NetIntel dataset for use in air-gapped environments is available for [download](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_netintel).
* **SNMP Device File Encryption** - Added support for encrypting SNMP device files. This will protect device file credentials using age encryption while offering a secure user-friendly interface for managing said files. For more information about configuring this, please see [Device File Encryption](/snmpcoll/configuration/def_devices/device-file-encryption).

#### Updates

* **NetObserv Flow Logging** - Improved log message for when a IPFIX or NetFlow9 template is not found.
* **NetObserv SNMP Metrics** - New Prometheus metrics provide deeper insight into internal collector processes ([SNMP metrics](/snmpcoll/api-reference-overview/metrics)).

#### Fixes

* Fixed an issue where the same reference of a record could be mutated by multiple namespaced outputs.

## 7.0.2 - June 28, 2024

#### Fixes

* Fixed an issue where the flow collector would not start if port 443 was blocked, even if the Amazon Firehose HTTP Endpoint was not enabled.

## 7.0.1 - June 21, 2024

#### New Features

* **AWS VPC Flow Logs via AWS Firehose** - A new HTTP endpoint has been added to collect VPC flow logs directly from Amazon Firehose. For more information about configuring this, please see [AWS Firehose Input](/flowcoll/configuration/inputs/input_aws_firehose).
* **NetObserv SNMP Device Status** - The availability of devices is evaluated based on the combination of ICMP and SNMP reachability. A new field, `system.avail.state.name`, has been added which indicates the result of this evaluation.

#### Updates

* **Community License** - The Community tier license now supports application identifies provided in the flow records from devices with such capabilities.

#### Fixes

* The SNMP Definitions tar file is no longer truncated. This addresses the enum error occurring when `EF_INPUT_SNMP_PERSIST_ENABLE` is set to `true`.
* A panic condition has been fixed, which occurred when devices had been removed from the configuration definitions and `/snmp/apply-definitions` was called.
* A panic condition has been fixed, which occurred when devices reported an unsigned integer value instead of the expected signed integer for certain SNMP data types.

#### Security

* **Security Upgrade** - Updated `libc` from `5.15.0-107.117` to `5.15.0-112.122` to patch "High" CVEs.

## 7.0.0 - June 4, 2024

#### Breaking Changes

* **RiskIQ EOL** - Since RiskIQ will reach its end-of-life on June 30th 2024, NetObserv v7 will no longer support threat enrichment through RiskIQ. NetIntel threat enrichment will replace RiskIQ and is enabled by default.
* **Licensing** - The NetObserv Basic License now supports all 7400+ vendor specific flow fields (previously only supported 1020 fields). The Community License now supports 500 flow records/second per organization. If you are using a Community License and need a higher flow rate, please use [this form](https://elastiflow.com/basic-license) to sign up for a free 1-year Basic License.
* **AWS VPC Flow logs** - To set us up to deliver more flexible ways to retrieve flow logs (e.g. through Firehose) we needed to make some changes to the config fields for AWS VPC flow log enrichment. You need to change your configuration options to the new format to ensure you continue to receive VPC flow logs.

#### New Features

* **NetIntel Threat Intelligence** - NetObserv now uses ElastiFlow NetIntel for populating the information on the IP Reputation dashboard.
* **NetIntel Online Application and Cloud Service Identity** - NetObserv now uses ElastiFlow NetIntel to enrich public IP addresses with online application and Cloud Service Identity information on the Top-N -> Apps dashboard.
* **AWS VPC Flow Logs** - Added support for S3 buckets using data sent from Amazon Firehose, as well as custom log formats when using Firehose data. For more information about configuring this, please see [AWS VPC Flow logs](/flowcoll/configuration/inputs/input_aws_s3).
* **User-defined mapping for IPs used for SNMP polling** - Allows users to poll SNMP info for a device on a different IP address than it sends flow records from.

#### Updates

* **Product Naming** - The ElastiFlow Unified Flow Collector is now called NetObserv Flow
* **Product Naming** - The ElastiFlow Unified SNMP Collector is now called NetObserv SNMP
* **Product Naming** - For anything that applies to both flow and snmp, we will simply refer to NetObserv


# NetObserv Flow

### ElastiFlow NetObserv

ElastiFlow NetObserv receives, decodes, transforms, normalizes, translates and enriches network flow records and telemetry sent from network devices and applications using SNMP, IPFIX, Netflow, sFlow and Cloud Flow Logs. The resulting records can be sent to various platforms and services, including:

* Elasticsearch & Elastic Cloud
* OpenSearch & AWS OpenSearch service
* Apache Kafka
* Confluent Platform
* Redpanda
* Splunk
* Cribl Stream

{% hint style="info" %}
Support for additional data platforms is planned for future releases. Please reach out to <info@elastiflow.com> if you have specific requirements that you would like to discuss.
{% endhint %}

Additionally flow records can be enriched with threat information and IP reputation tags provided via the ElastiFlow NetIntel service. This allows for suspicious network activity and at-risk resources to be easily identified and mitigated.

<figure><img src="/files/SjUiXILcks1fmmAymS9F" alt=""><figcaption></figcaption></figure>

The provided dashboards and additional features are easily imported to provide a turnkey solution, which delivers instant insights into network traffic.

### Getting Started

To get started and install NetObserv, please follow the install procedures for installing on [Linux](/flowcoll/installation/install_linux) or using [Docker](/flowcoll/installation/install_docker).


# Quickstart Guide

### Getting Started

Follow this guide to get immediate insights into your network. This is an opinionated, non-production installation option that gets you set up with NetObserv and OpenSearch on a single virtual machine. Refer to the [Installation section](/flowcoll/installation) for production-grade deployments and setup.

The ElastiFlow Virtual Appliance provides a pre-configured virtual machine with Ubuntu 24.04 LTS, NetObserv Flow, and OpenSearch pre-installed. This is an ideal solution for proof-of-concept (PoC) and lab environments.

{% hint style="info" %}
The virtual appliance is designed to get you up and running quickly. It includes a single-node OpenSearch cluster with a pre-configured NetObserv Flow instance. For production deployments, consider installing NetObserv Flow on dedicated infrastructure using Docker or native packages.
{% endhint %}

### System Requirements

| Requirement | Minimum                                                              |
| ----------- | -------------------------------------------------------------------- |
| Hypervisor  | VMware ESXi 6.7+, VMware Workstation, VMware Fusion, Proxmox VE 8.3+ |
| vCPUs       | 4                                                                    |
| Memory      | 16 GB                                                                |
| Disk        | 128 GB (expandable)                                                  |

### Download the OVA

```
wget https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova
```

```
curl -O https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova
```

### Deploying the OVA

#### VMware ESXi / vCenter

1. Log into the vSphere Client or ESXi Host Client.
2. Navigate to **Virtual Machines** → **Create/Register VM**.
3. Select **Deploy a virtual machine from an OVF or OVA file**.
4. Browse to and select the downloaded OVA file.
5. Follow the deployment wizard (name, compute, storage).
6. Complete [Initial Configuration (VMware ESXi)](#vmware-esxi-initial-configuration) before powering on the VM.

#### VMware Workstation / Fusion

1. Select **File** → **Open** and choose the downloaded OVA.
2. Click **Import** and adjust VM settings as needed (at least 4 vCPUs / 16 GB RAM).
3. Complete [Initial Configuration (VMware Workstation / Fusion)](#vmware-workstation--fusion-initial-configuration) **before** powering on the VM. Do not power on until the cloud-init seed ISO is attached.

#### Proxmox

1. In **Storage**, edit your target storage (e.g. local) and enable **Disk image** and **Import** content types.
2. Select that storage → **Import** → **Download from URL** and paste:

```
https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova
```

3. Click **Query URL**, then **Download**.
4. Select the imported OVA and click **Import**. Adjust VM settings as needed.
5. Complete [Initial Configuration (Proxmox)](#proxmox-initial-configuration) before powering on the VM.

### Initial Configuration

Configure cloud-init before the first power-on. On first boot, cloud-init expands the disk, applies network settings, creates the `elastiflow` user, and enables SSH. First boot may take several minutes.

{% hint style="info" %}
This appliance uses the network interface name **`eth0`** (predictable names like `ens160` are disabled). Use `eth0` in any static IP configuration.
{% endhint %}

#### Proxmox initial configuration

1. Select the imported VM. If you do not see a **Cloud-Init** tab, open **Hardware** → **Add** → **CloudInit Drive**.
2. On the **Cloud-Init** tab, set **User** (`elastiflow`), **Password**, and **IP Config** (DHCP or static).
3. Click **Regenerate Image**, then power on the VM.

#### VMware ESXi initial configuration

Choose one method below, not both.

**Option 1: VM configuration parameters (guestinfo)**

The VM reads configuration via the VMware GuestInfo datasource on first boot.

**user-data**

Create a file named `user-data`:

```yaml
#cloud-config
hostname: elastiflow
users:
  - name: elastiflow
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    lock_passwd: false
chpasswd:
  list: |
    elastiflow:your-password
  expire: false
ssh_pwauth: true
package_upgrade: false
growpart:
  mode: auto
  devices: ['/']
resize_rootfs: true
```

**meta-data (static IP only)**

For a static IP on vSphere, create a file named `meta-data`:

```yaml
instance-id: elastiflow-vm
local-hostname: elastiflow
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 8.8.4.4
```

1. Create `user-data` using the template above. Add `meta-data` too if you need a static IP.
2. Base64-encode each file: `base64 user-data | tr -d '\n'` (repeat for `meta-data` if used).
3. With the VM powered off, go to **VM Options** → **Advanced** → **Configuration Parameters** → **Edit Configuration**.
4. Add `guestinfo.userdata` (paste the base64 output) and `guestinfo.userdata.encoding` (value: `base64`).
5. If using a static IP, also add `guestinfo.metadata` (paste the base64 output) and `guestinfo.metadata.encoding` (value: `base64`).
6. Power on the VM.

**Option 2: Cloud-init ISO**

Use the same seed-ISO steps as [VMware Workstation / Fusion](#vmware-workstation--fusion-initial-configuration) (create `user-data`, `meta-data`, and optional `network-config`, build a `cidata` ISO, attach it as a CD/DVD with **Connect at power on**).

#### VMware Workstation / Fusion initial configuration

Workstation and Fusion need a **NoCloud seed ISO** attached before first power-on (no vSphere cloud-init UI).

{% hint style="warning" %}
Password goes in `user-data`. Static IP goes in a separate `network-config` file — not in `user-data`. Without `network-config`, the VM uses DHCP.
{% endhint %}

**1. Create the seed files**

**`user-data`** (required):

```yaml
#cloud-config
hostname: elastiflow
users:
  - name: elastiflow
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    lock_passwd: false
chpasswd:
  list: |
    elastiflow:your-password
  expire: false
ssh_pwauth: true
```

**`meta-data`** (required):

```yaml
instance-id: elastiflow-vm
local-hostname: elastiflow
```

**`network-config`** (optional, static IP only). Do not add a `network:` wrapper or `#cloud-config` header:

```yaml
version: 2
ethernets:
  eth0:
    dhcp4: false
    addresses:
      - 192.168.1.100/24
    routes:
      - to: default
        via: 192.168.1.1
    nameservers:
      addresses:
        - 8.8.8.8
        - 8.8.4.4
```

**2. Build the seed ISO**

The volume label must be `cidata` or `CIDATA`. On Linux/macOS:

```
# DHCP
genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data

# Static IP
genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data network-config
```

On Windows, use WSL (`sudo apt install genisoimage`) or have someone on Linux/macOS build the ISO.

**3. Attach the ISO and power on**

1. With the VM powered off, open **Settings** → add a **CD/DVD** drive → **Use ISO image file** → select `cloud-init.iso`.
2. Enable **Connected** / **Connect at power on**, then power on. First boot may take several minutes.

### Finding the VM IP Address

Open the VM console or run `ip -br addr` / `ip addr show eth0` after login. Connect with `ssh elastiflow@<vm-ip>` using the password from `user-data`.

### Accessing the Services

| Service               | URL                    | Credentials         | Port | Protocol |
| --------------------- | ---------------------- | ------------------- | ---- | -------- |
| OpenSearch Dashboards | `https://<vm-ip>:5601` | admin / Elast1flow! | 5601 | TCP      |
| Flow Collector API    | `http://<vm-ip>:8080`  | -                   | 8080 | TCP      |
| Flow ingestion        | `<vm-ip>`              | -                   | 9995 | UDP      |
| SSH                   | `<vm-ip>`              | cloud-init password | 22   | TCP      |

{% hint style="warning" %}
Change the OpenSearch Dashboards password after first login. Your SSH password is the one you set during cloud-init.
{% endhint %}

### Next Steps

1. Configure your network devices or cloud VPCs/VNets to send NetFlow, IPFIX, or sFlow data to your VM IP on UDP port `9995`.
2. Open OpenSearch Dashboards at `https://<vm-ip>:5601`. Flow data may take a few minutes to appear after exporters are pointed at the VM.
3. To apply your ElastiFlow license, which is required for the collector to process more than 500 events per second, do the following:
   1. Request a free [Basic License](https://www.elastiflow.com/basic-license) (valid for 1 year) or a [30-day Trial](https://www.elastiflow.com/trial) of NetObserv Premium.
   2. SSH to the VM (`ssh elastiflow@<vm-ip>`).
   3. Edit `/etc/elastiflow/flowcoll.yml` (this is how you make all future config changes of NetObserv).
   4. Navigate to `EF_ACCOUNT_ID` and enter your account ID. Navigate to `EF_LICENSE_KEY` and enter your license key. Then run `sudo systemctl restart flowcoll.service` to restart NetObserv. For more details on licenses, please refer to the [license configuration](/flowcoll/configuration/config_gen/license) page.

### Troubleshooting

#### VM won't start

* Verify the OVA imported cleanly and the host meets the [system requirements](#system-requirements).
* **Proxmox.** Add a **CloudInit Drive** if the Cloud-Init tab is missing. Click **Regenerate Image** before first boot.
* **VMware ESXi.** Use guestinfo or a cloud-init ISO, not both. Set guestinfo while the VM is powered off.
* **VMware Workstation / Fusion.** Ensure the cloud-init ISO is attached, **Connected**, and set to **Connect at power on** before the first boot.

#### Cloud-init didn't apply

* **Proxmox.** Re-check the Cloud-Init tab and click **Regenerate Image**. Cloud-init only runs on first boot.
* **VMware guestinfo.** Verify parameter names, YAML syntax, and base64 encoding (no line breaks in the pasted value).
* **Seed ISO.** Confirm the ISO volume label is `cidata` / `CIDATA`, that `user-data` and `meta-data` are at the root of the ISO (not in a subfolder), and that the CD/DVD was connected at first power-on.
* Check the VM console for cloud-init errors. After login you can also inspect `/var/log/cloud-init.log` and `/var/log/cloud-init-output.log`.

#### Password worked, but static IP did not

* Put static IP in `network-config` on the seed ISO (or in guestinfo `metadata` `network:` on ESXi) — not in `user-data`.
* Rebuild with volume label `cidata` / `CIDATA` and interface **`eth0`**.
* Prefer a fresh OVA deploy. To retry an existing VM: attach a corrected ISO, run `sudo cloud-init clean --logs --seed`, and reboot.

#### Cannot access services or no flow data

* Confirm the VM has a valid IP and required [ports](#accessing-the-services) are open.
* Allow a few minutes after first boot for services to start.
* For missing flow data, verify exporters target UDP `9995` and run `sudo systemctl status flowcoll.service`.

#### Running out of disk space

Expand the VM disk in your hypervisor, then resize the filesystem from within the VM.


# Docker Compose Quickstart Guide for ElastiFlow with Elasticsearch

### Getting Started

Follow this guide to get immediate insights into your network. This is an opinionated, non-production installation option that gets you set up with NetObserv and Elasticsearch on a single server using an installation and docker compose scripts. Refer to the [Installation section](/flowcoll/installation) for production-grade deployments and setup.

{% hint style="info" %}
This is the quickstart guide for installing the ElastiFlow NetObserv flow collector, Elasticsearch, and Kibana dashboards on **a SINGLE server** using Docker compose on a linux server. This is designed to get you up and running quickly.  For production deployments, consider installing NetObserv flow collector and Elasticsearch on dedicated infrastructure using Docker or native packages.
{% endhint %}

#### Technical Recommendations

POC Recommended Server specs:

|        | CPU      | RAM   | STORAGE |
| ------ | -------- | ----- | ------- |
| Good   | 16 Cores | 64GB  | 1TB SSD |
| Better | 24 Cores | 128GB | 2TB SSD |

Linux distributions:

* debian-based: debian, ubuntu, etc.
* redhat-based: rocky, alma, fedora, centos, etc.
* to reduce resource overhead, please use server-based install options (headless, without a GUI desktop).

### Quickstart Guide

The following general procedure should get you going in less than 30 minutes!

A video overview of this quickstart installation is available here: [Installation example video](https://youtu.be/2XU1eLSoOAk)

#### Step 1 - Download the docker compose installation zip file

The docker compose script is part of a zip file. This zip file includes the docker-compose.yml, .env, and initial\_installation.sh scripts. &#x20;

Download the zip fle here:

{% file src="/files/iZSz5NPrQx7toUqg8EwR" %}

#### Step 2 - Copy the zip file to your server

Copy the Elastiflow docker zip file to your server using secure copy (or other method):

```
scp elastiflow_elasticsearch_certs.zip <username>@<server ip or hostname>:~
```

#### Step 3 - ssh to server and verify docker is installed

ssh into the server:

```
ssh <username>@<server ip or hostname>
```

Check to see if docker/docker compose is installed:

```
sudo docker compose version
```

<mark style="color:red;">**If there was an error because docker or docker compose was not found:**</mark>

* Refer to the official Docker documentation to install docker: [Install Docker Engine on Linux](https://docs.docker.com/engine/install)&#x20;
* Please follow the instructions to install docker and docker compose on your version of Linux.
* Once docker and docker compose are installed, proceed to Step 4.

#### Step 4 - Unzip and setup the .env configuration file

Unzip the Elastiflow docker zip file:

```
unzip elastiflow_elasticsearch_certs.zip 
```

If unzip is not found, install it:

* debian-based installs: `sudo apt install unzip`
* rehat-based installs: `sudo dnf install unzip`

Change into the new directory:

```
cd elastiflow_elasticsearch_certs/
```

Verify the IP address of the server with the ip addr command:

```
ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: ens18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether bc:24:11:3e:06:20 brd ff:ff:ff:ff:ff:ff
    altname enp0s18
    altname enxbc24113e0620
    inet 192.168.0.226/24 brd 192.168.0.255 scope global dynamic noprefixroute ens18
       valid_lft 3138sec preferred_lft 2638sec
    inet6 fe80::8536:a8b8:bdf7:f8b6/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether ee:97:b8:e3:5a:66 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
        valid_lft forever preferred_lft forever
```

Edit the .env file and set variables for install.

* Set the SERVER\_IP with the IP address you verified above.
* Set the ES\_DATA\_DIRECTORY to a directory that maps to your largest storage partition.
* view the readme.txt file in this directory for more details.

```
vi .env or nano .env

# assigned ip address of the server
SERVER_IP=192.168.0.226 

# elastic user's password
ES_ELASTIC_PASSWORD=elastic1234

# kibana_system's password
ES_KIBANA_PASSWORD=kibana1234

# version of elasticsearch and kibana to install
ES_STACK_VERSION=9.3.1

# elasticsearch persistant local data store on the host
ES_DATA_DIR=/var/lib/elasticsearch

# version of ElastiFlow flow collector to install
EF_FLOWCOLL_VERSION=7.25.0

# DNS server for elastiflow enrichment. keep blank to use OS defined DNS server(s)
EF_DNS=

# Add the account ID and license key provided to you via email.
EF_ACCOUNT_ID= 
EF_LICENSE_KEY=

```

#### Step 5 - Run install script and import dashboards

Run the initial install as root to start the installation.

```
sudo ./initial_install.sh
```

This script will take care of the initial installation and detect when all 3 systems (ElastiFlow flow collector, Elasticsearch, and Kibana) are up and ready to serve. It may take several minutes to complete.

When complete the details to access the server will be provided (see example below).  Open a new web browser tab to the provided ip address, and login with the given credentials:

```
rich@docker$ sudo ./initial_install.sh 
[sudo] password for rich: 

creating elasticsearch data directory on host.
creating elastiflow system directory on host.
starting up docker containers.
[+] up 5/5
 ✔ Network elastiflow_elasticsearch_certs_default Created                                                         0.2sss
 ✔ Container elasticsearch                        Healthy                                                         136.6s
 ✔ Container es_setup                             Started                                                         3.3sss
 ✔ Container flow-collector                       Started                                                         137.9s
 ✔ Container kibana                               Started                                                         138.0s
waiting for kibana to come online.
................................................

done!

-> open a web browser to https://192.168.0.226:5601
-> username: elastic
-> password: elastic1234

-> configure your network devices to send netflow/ipfix flows to:
-> 192.168.123.58 to any of these udp ports: 2055, 4739, 6343, or 9995

-> You do not need to use this install script again, please manage
-> the elastiflow stack using standard 'docker' and 'docker compose' commands.
-> see readme.txt file for more details.
rich@docker:~/elastiflow_elasticsearch_certs$
```

Open a second web browser tab, and download the kibana dashboards for elasticsearch

&#x20;[Kibana Dashboards for Elasticsearch](https://docs.elastiflow.com/flowcoll/configuration/outputs/output_elasticsearch)&#x20;

Please select the **codex** version of the dashboards.

Important: Right click the link and Save Link As... to your local computer.

<figure><img src="/files/goRv4NIFxQ7HXlZAEkGj" alt=""><figcaption></figcaption></figure>

From Elasticsearch, click on the 3 line (hamburger) menu at the top left, the scroll down the mento and click on 'Stack Management'

Under the 'Kibana' section, click on 'Saved Objects'

<figure><img src="/files/niD4ZmLMxUvW8rSTMpNO" alt=""><figcaption></figcaption></figure>

Click 'Import' at the top right.

Click the Import box to select the dashboard file you just saved on your computer.

Once that is done, click 'Import' at the bottom right to import all of the dashboards.

<figure><img src="/files/jfhCbr1mJCwQu91UEYBE" alt=""><figcaption></figcaption></figure>

Under Advanced Settings, search for "pin" and enable pinned filters by default and click save.

<figure><img src="/files/DdGbKKctWgwAwA9yYPEu" alt=""><figcaption></figcaption></figure>

Navigate to the 3 line (hamburger) menu.

Under the Analytics section, click on Dashboards

And search for "overview".&#x20;

Click on the "ElastiFlow (flow): Overview" dashboard.

<figure><img src="/files/23SwcY3tXp60sjUh3RWW" alt=""><figcaption></figcaption></figure>

#### Step 6 - Configure your devices to send Netflow/IPFIX data to collector

You should now configure network devices to send flow data to the flow collector using the server IP address to any of the following UDP ports:

* 2055, 4739, 6343, 9995

Please reference the vendor's documentation for specific device configuration for fllow data output.

You can find a limited collection of example configurations in the [ElastiFlow Knowledge Base](/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices).

Once this is complete, the dashboards will populate with data after a few minutes.&#x20;

<figure><img src="/files/32dF5mpF5gyrRujLQfMU" alt=""><figcaption></figcaption></figure>

### Troubleshooting

**Cannot connect to the Dashboard at port 5601 on my web browser**

* Make sure you are connecting via https and not http: https\://\<server ip>:5601
* The local firewall on the server may be blocking access from your host. To **temporarily** disable the firewall to verify if that is the problem:
  * debian-based: `sudo systemctl stop ufw`&#x20;
  * rehat-based: `sudo systemctl stop firewalld`
  * If disabling the firewall allows connection, you will need to create firewall rules to permit traffic to port 5601 or disable the firewall permanently.
* Check status of Kibana for more details: `sudo docker compose logs kibana -f`

**How do I restart the the stack or a service in the stack?**

* change in the elastiflow\_elasticsearch\_certs/ folder, where the docker-compose.yml file is located
* to restart the entire stack: `sudo docker compose down` and then: `sudo docker compose up -d`
* to restart a specific service: `sudo docker stop <service_name>` and then: `sudo docker start <service_name>`
  * replace \<service\_name> with any of the following: flow-collector, elasticsearch, kibana

**How do I view the logs to troubleshoot an issue?**

* cd into the elastiflow\_elasticsearch\_certs/ directory, where the docker-compose.yml file is located
* To view and follow the logs for a service: `sudo docker compose logs <service_name> -f`&#x20;
* To view the last 50 log lines: `sudo docker compose logs <service_name> --tail=50`&#x20;
  * replace \<service\_name> with any of the following: flow-collector, elasticsearch, kibana

**How do I modify the ElastiFlow configuration and enable changes?**

* cd into the elastiflow\_elasticsearch\_certs/ directory, where the docker-compose.yml file is located
* Since we will be editing the docker compose file, first make a back up:
  * `cp docker-compose.yml docker-compose.yml_backup`
* Edit the docker-compose.yml file with vi, nano, or some other editor
  * At the end of the file, under the flow-collector service, find the environment: section
  * These are the environmental variables that you can set to modify the flow collector
    * These variables begin with 'EF\_'
  * Uncomment lines, to enable them, by removing the # character at the beginning of the line
  * Comment lines, to disable them, by adding a # character at the beginning of the line
  * Add new lines anywhere in the environment section
  * Make sure that spacing is lined up with the existing lines, or the change could generate an error!
  * Save the file when you complete the changes&#x20;
* Restart the flow-collector service with the new settings:
  * `sudo docker stop flow-collector` and then: `sudo docker compose up -d`

**I changed the password for the 'elastic' user  in the web interface, and now the flow collector is not working/processing flows.**

* In this docker installation, the flow collector uses the elastic user account to update the elasticsearch back-end and it uses the password stored in the .env docker compose file. If you change the elastic password in the elasticsearch gui, the flow collector will now use the older, now incorrect, password. Therefore for this POC docker install, changes to the elastic(and kibana\_system) user, should be made directly to the .env file, and then restart the entire docker stack which will automatically update the passwords and enable the flow collector to stay in sync.
* Edit the .env file with vi or nano, and update the line 'ES\_ELASTIC\_PASSWORD=' removing the old elastic user password and updating it with the new one. If you wish to change the kibana\_system password, you can modify the 'ES\_KIBANA\_PASSWORD' line.
* Bring down the stack: `sudo docker compose down`&#x20;
* And then bring it back up: `sudo docker compose up -d`


# Supported Information Elements / Fields

ElastiFlow NetObserv receives, decodes, transforms, normalizes, translates and enriches network flow records and telemetry sent from network devices, cloud services and applications using SNMP, IPFIX, Netflow, sFlow and Cloud Flow Logs. These records are composed of information elements (IEs), which contain attribute values related to the observed network traffic. NetObserv supports 7400+ information elements (IEs) from many vendors and multiple networking technologies.

| Record Type                                                  | Community |   Basic  | Standard |  Premium |
| ------------------------------------------------------------ | :-------: | :------: | :------: | :------: |
| [IPFIX](/flowcoll/supported_ie/supported_ie_ipfix)           |     83    |    450   |   4835   |   4835   |
| [Netflow](/flowcoll/supported_ie/supported_ie_netflow)       |    152    |    519   |   1613   |   1613   |
| [sFlow](/flowcoll/supported_ie/supported_ie_sflow)           |    187    |    206   |    939   |    939   |
| [AWS VPC Flow Logs](/flowcoll/supported_ie/supported_ie_aws) |     37    |    37    |    37    |    37    |
| **TOTAL**                                                    |  **459**  | **1212** | **7424** | **7424** |

{% hint style="info" %}
For the complete set of IEs supported by each license tier, see the record type specific lists of IEs.
{% endhint %}


# AWS VPC Flow Log IEs

NetObserv Flow supports the following AWS VPC Flow Log information elements (IE).

| Name                       | Community | Basic | Standard | Premium |
| -------------------------- | :-------: | :---: | :------: | :-----: |
| version                    |     ✓     |   ✓   |     ✓    |    ✓    |
| region                     |     ✓     |   ✓   |     ✓    |    ✓    |
| az-id                      |     ✓     |   ✓   |     ✓    |    ✓    |
| account-id                 |     ✓     |   ✓   |     ✓    |    ✓    |
| vpc-id                     |     ✓     |   ✓   |     ✓    |    ✓    |
| subnet-id                  |     ✓     |   ✓   |     ✓    |    ✓    |
| instance-id                |     ✓     |   ✓   |     ✓    |    ✓    |
| interface-id               |     ✓     |   ✓   |     ✓    |    ✓    |
| sublocation-type           |     ✓     |   ✓   |     ✓    |    ✓    |
| sublocation-id             |     ✓     |   ✓   |     ✓    |    ✓    |
| srcaddr                    |     ✓     |   ✓   |     ✓    |    ✓    |
| dstaddr                    |     ✓     |   ✓   |     ✓    |    ✓    |
| srcport                    |     ✓     |   ✓   |     ✓    |    ✓    |
| dstport                    |     ✓     |   ✓   |     ✓    |    ✓    |
| protocol                   |     ✓     |   ✓   |     ✓    |    ✓    |
| start                      |     ✓     |   ✓   |     ✓    |    ✓    |
| end                        |     ✓     |   ✓   |     ✓    |    ✓    |
| type                       |     ✓     |   ✓   |     ✓    |    ✓    |
| packets                    |     ✓     |   ✓   |     ✓    |    ✓    |
| bytes                      |     ✓     |   ✓   |     ✓    |    ✓    |
| action                     |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp-flags                  |     ✓     |   ✓   |     ✓    |    ✓    |
| pkt-srcaddr                |     ✓     |   ✓   |     ✓    |    ✓    |
| pkt-dstaddr                |     ✓     |   ✓   |     ✓    |    ✓    |
| pkt-src-aws-service        |     ✓     |   ✓   |     ✓    |    ✓    |
| pkt-dst-aws-service        |     ✓     |   ✓   |     ✓    |    ✓    |
| traffic-path               |     ✓     |   ✓   |     ✓    |    ✓    |
| flow-direction             |     ✓     |   ✓   |     ✓    |    ✓    |
| log-status                 |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-cluster-name           |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-cluster-arn            |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-container-instance-id  |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-container-instance-arn |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-task-id                |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-task-arn               |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-container-id           |     ✓     |   ✓   |     ✓    |    ✓    |
| ecs-second-container-id    |     ✓     |   ✓   |     ✓    |    ✓    |


# Azure VNET Flow Log IEs

NetObserv Flow supports the following Azure VNet Flow Log information elements (IE).

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| time              |     ✓     |   ✓   |     ✓    |    ✓    |
| macAddress        |     ✓     |   ✓   |     ✓    |    ✓    |
| flowLogGUID       |     ✓     |   ✓   |     ✓    |    ✓    |
| flowLogResourceID |     ✓     |   ✓   |     ✓    |    ✓    |
| targetResourceID  |     ✓     |   ✓   |     ✓    |    ✓    |
| flowLogVersion    |     ✓     |   ✓   |     ✓    |    ✓    |
| category          |     ✓     |   ✓   |     ✓    |    ✓    |
| operationName     |     ✓     |   ✓   |     ✓    |    ✓    |
| aclID             |     ✓     |   ✓   |     ✓    |    ✓    |
| Time stamp        |     ✓     |   ✓   |     ✓    |    ✓    |
| Flow direction    |     ✓     |   ✓   |     ✓    |    ✓    |
| Source IP         |     ✓     |   ✓   |     ✓    |    ✓    |
| Source port       |     ✓     |   ✓   |     ✓    |    ✓    |
| Destination IP    |     ✓     |   ✓   |     ✓    |    ✓    |
| Destination port  |     ✓     |   ✓   |     ✓    |    ✓    |
| Packets sent      |     ✓     |   ✓   |     ✓    |    ✓    |
| Bytes sent        |     ✓     |   ✓   |     ✓    |    ✓    |
| Packets received  |     ✓     |   ✓   |     ✓    |    ✓    |
| Bytes received    |     ✓     |   ✓   |     ✓    |    ✓    |
| Protocol          |     ✓     |   ✓   |     ✓    |    ✓    |
| Flow State        |     ✓     |   ✓   |     ✓    |    ✓    |
| Flow Encryption   |     ✓     |   ✓   |     ✓    |    ✓    |


# Netflow IEs

NetObserv Flow supports Netflow versions 1, 5, 6, 7 and 9 records.

### Netflow v1

NetObserv Flow supports 14 unique Netflow v1 information elements (IE).

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| dOctets    |     ✓     |   ✓   |     ✓    |    ✓    |
| dPkts      |     ✓     |   ✓   |     ✓    |    ✓    |
| dstaddr    |     ✓     |   ✓   |     ✓    |    ✓    |
| dstport    |     ✓     |   ✓   |     ✓    |    ✓    |
| First      |     ✓     |   ✓   |     ✓    |    ✓    |
| input      |     ✓     |   ✓   |     ✓    |    ✓    |
| Last       |     ✓     |   ✓   |     ✓    |    ✓    |
| nexthop    |     ✓     |   ✓   |     ✓    |    ✓    |
| output     |     ✓     |   ✓   |     ✓    |    ✓    |
| prot       |     ✓     |   ✓   |     ✓    |    ✓    |
| srcaddr    |     ✓     |   ✓   |     ✓    |    ✓    |
| srcport    |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp\_flags |     ✓     |   ✓   |     ✓    |    ✓    |
| tos        |     ✓     |   ✓   |     ✓    |    ✓    |

### Netflow v5

NetObserv Flow support 18 unique Netflow v5 information elements (IE).

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| dOctets    |     ✓     |   ✓   |     ✓    |    ✓    |
| dPkts      |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_as    |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_mask  |     ✓     |   ✓   |     ✓    |    ✓    |
| dstaddr    |     ✓     |   ✓   |     ✓    |    ✓    |
| dstport    |     ✓     |   ✓   |     ✓    |    ✓    |
| First      |     ✓     |   ✓   |     ✓    |    ✓    |
| input      |     ✓     |   ✓   |     ✓    |    ✓    |
| Last       |     ✓     |   ✓   |     ✓    |    ✓    |
| nexthop    |     ✓     |   ✓   |     ✓    |    ✓    |
| output     |     ✓     |   ✓   |     ✓    |    ✓    |
| prot       |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_as    |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_mask  |     ✓     |   ✓   |     ✓    |    ✓    |
| srcaddr    |     ✓     |   ✓   |     ✓    |    ✓    |
| srcport    |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp\_flags |     ✓     |   ✓   |     ✓    |    ✓    |
| tos        |     ✓     |   ✓   |     ✓    |    ✓    |

### Netflow v6

NetObserv Flow support 18 unique Netflow v6 information elements (IE).

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| dOctets    |     ✓     |   ✓   |     ✓    |    ✓    |
| dPkts      |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_as    |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_mask  |     ✓     |   ✓   |     ✓    |    ✓    |
| dstaddr    |     ✓     |   ✓   |     ✓    |    ✓    |
| dstport    |     ✓     |   ✓   |     ✓    |    ✓    |
| First      |     ✓     |   ✓   |     ✓    |    ✓    |
| input      |     ✓     |   ✓   |     ✓    |    ✓    |
| Last       |     ✓     |   ✓   |     ✓    |    ✓    |
| nexthop    |     ✓     |   ✓   |     ✓    |    ✓    |
| output     |     ✓     |   ✓   |     ✓    |    ✓    |
| prot       |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_as    |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_mask  |     ✓     |   ✓   |     ✓    |    ✓    |
| srcaddr    |     ✓     |   ✓   |     ✓    |    ✓    |
| srcport    |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp\_flags |     ✓     |   ✓   |     ✓    |    ✓    |
| tos        |     ✓     |   ✓   |     ✓    |    ✓    |

### Netflow v7

NetObserv Flow support 19 unique Netflow v7 information elements (IE).

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| dOctets      |     ✓     |   ✓   |     ✓    |    ✓    |
| dPkts        |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_as      |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_mask    |     ✓     |   ✓   |     ✓    |    ✓    |
| dstaddr      |     ✓     |   ✓   |     ✓    |    ✓    |
| dstport      |     ✓     |   ✓   |     ✓    |    ✓    |
| First        |     ✓     |   ✓   |     ✓    |    ✓    |
| input        |     ✓     |   ✓   |     ✓    |    ✓    |
| ipv4RouterSc |     ✓     |   ✓   |     ✓    |    ✓    |
| Last         |     ✓     |   ✓   |     ✓    |    ✓    |
| nexthop      |     ✓     |   ✓   |     ✓    |    ✓    |
| output       |     ✓     |   ✓   |     ✓    |    ✓    |
| prot         |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_as      |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_mask    |     ✓     |   ✓   |     ✓    |    ✓    |
| srcaddr      |     ✓     |   ✓   |     ✓    |    ✓    |
| srcport      |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |     ✓     |   ✓   |     ✓    |    ✓    |
| tos          |     ✓     |   ✓   |     ✓    |    ✓    |

### Netflow v9

NetObserv Flow supports over 1500 unique Netflow v9 information elements (IE).

|   PEN | Vendor             | IEs |
| ----: | ------------------ | --: |
|     0 | IANA               | 462 |
|     9 | Cisco              | 581 |
|   193 | Ericsson           |   8 |
|  4056 | StreamCORE         |  28 |
|  4321 | Riverbed           |  12 |
|  8712 | LANcope (Cisco)    |  43 |
| 25461 | Palo Alto Networks |   2 |
| 33610 | FastIP / Boundary  |  23 |
| 35632 | ntop               | 370 |
| 40842 | A10 Networks       |  15 |

#### Standards-based IEs (PEN: 0)

|  ID | Name                                     | Community | Basic | Standard | Premium |
| --: | ---------------------------------------- | :-------: | :---: | :------: | :-----: |
|   1 | octetDeltaCount                          |     ✓     |   ✓   |     ✓    |    ✓    |
|   2 | packetDeltaCount                         |     ✓     |   ✓   |     ✓    |    ✓    |
|   3 | deltaFlowCount                           |     ✓     |   ✓   |     ✓    |    ✓    |
|   4 | protocolIdentifier                       |     ✓     |   ✓   |     ✓    |    ✓    |
|   5 | ipClassOfService                         |     ✓     |   ✓   |     ✓    |    ✓    |
|   6 | tcpControlBits                           |     ✓     |   ✓   |     ✓    |    ✓    |
|   7 | sourceTransportPort                      |     ✓     |   ✓   |     ✓    |    ✓    |
|   8 | sourceIPv4Address                        |     ✓     |   ✓   |     ✓    |    ✓    |
|   9 | sourceIPv4PrefixLength                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  10 | ingressInterface                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  11 | destinationTransportPort                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  12 | destinationIPv4Address                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  13 | destinationIPv4PrefixLength              |     ✓     |   ✓   |     ✓    |    ✓    |
|  14 | egressInterface                          |     ✓     |   ✓   |     ✓    |    ✓    |
|  15 | ipNextHopIPv4Address                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  16 | bgpSourceAsNumber                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  17 | bgpDestinationAsNumber                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  18 | bgpNextHopIPv4Address                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  19 | postMCastPacketDeltaCount                |     ✓     |   ✓   |     ✓    |    ✓    |
|  20 | postMCastOctetDeltaCount                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  21 | flowEndSysUpTime                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  22 | flowStartSysUpTime                       |     ✓     |   ✓   |     ✓    |    ✓    |
|  23 | postOctetDeltaCount                      |     ✓     |   ✓   |     ✓    |    ✓    |
|  24 | postPacketDeltaCount                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  25 | minimumIpTotalLength                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  26 | maximumIpTotalLength                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  27 | sourceIPv6Address                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  28 | destinationIPv6Address                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  29 | sourceIPv6PrefixLength                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  30 | destinationIPv6PrefixLength              |     ✓     |   ✓   |     ✓    |    ✓    |
|  31 | flowLabelIPv6                            |     ✓     |   ✓   |     ✓    |    ✓    |
|  32 | icmpTypeCodeIPv4                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  33 | igmpType                                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  34 | samplingInterval                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  35 | samplingAlgorithm                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  36 | flowActiveTimeout                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  37 | flowIdleTimeout                          |     ✓     |   ✓   |     ✓    |    ✓    |
|  38 | engineType                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  39 | engineId                                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  40 | exportedOctetTotalCount                  |     ✓     |   ✓   |     ✓    |    ✓    |
|  41 | exportedMessageTotalCount                |     ✓     |   ✓   |     ✓    |    ✓    |
|  42 | exportedFlowRecordTotalCount             |     ✓     |   ✓   |     ✓    |    ✓    |
|  44 | sourceIPv4Prefix                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  45 | destinationIPv4Prefix                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  46 | mplsTopLabelType                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  47 | mplsTopLabelIPv4Address                  |     ✓     |   ✓   |     ✓    |    ✓    |
|  48 | samplerId                                |     ✓     |   ✓   |     ✓    |    ✓    |
|  49 | samplerMode                              |     ✓     |   ✓   |     ✓    |    ✓    |
|  50 | samplerRandomInterval                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  51 | classId                                  |     ✓     |   ✓   |     ✓    |    ✓    |
|  52 | minimumTTL                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  53 | maximumTTL                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  54 | fragmentIdentification                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  55 | postIpClassOfService                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  56 | sourceMacAddress                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  57 | postDestinationMacAddress                |     ✓     |   ✓   |     ✓    |    ✓    |
|  58 | vlanId                                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  59 | postVlanId                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  60 | ipVersion                                |     ✓     |   ✓   |     ✓    |    ✓    |
|  61 | flowDirection                            |     ✓     |   ✓   |     ✓    |    ✓    |
|  62 | ipNextHopIPv6Address                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  63 | bgpNextHopIPv6Address                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  64 | ipv6ExtensionHeaders                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  65 | transportPacketLoss `Cisco Legacy`       |           |       |     ✓    |    ✓    |
|  66 | transportUnreachability `Cisco Legacy`   |           |       |     ✓    |    ✓    |
|  67 | transportLatency `Cisco Legacy`          |           |       |     ✓    |    ✓    |
|  68 | dataPoints `Cisco Legacy`                |           |       |     ✓    |    ✓    |
|  69 | variance `Cisco Legacy`                  |           |       |     ✓    |    ✓    |
|  70 | mplsTopLabelStackSection                 |           |   ✓   |     ✓    |    ✓    |
|  71 | mplsLabelStackSection2                   |           |   ✓   |     ✓    |    ✓    |
|  72 | mplsLabelStackSection3                   |           |   ✓   |     ✓    |    ✓    |
|  73 | mplsLabelStackSection4                   |           |   ✓   |     ✓    |    ✓    |
|  74 | mplsLabelStackSection5                   |           |   ✓   |     ✓    |    ✓    |
|  75 | mplsLabelStackSection6                   |           |   ✓   |     ✓    |    ✓    |
|  76 | mplsLabelStackSection7                   |           |   ✓   |     ✓    |    ✓    |
|  77 | mplsLabelStackSection8                   |           |   ✓   |     ✓    |    ✓    |
|  78 | mplsLabelStackSection9                   |           |   ✓   |     ✓    |    ✓    |
|  79 | mplsLabelStackSection10                  |           |   ✓   |     ✓    |    ✓    |
|  80 | destinationMacAddress                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  81 | postSourceMacAddress                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  82 | interfaceName                            |     ✓     |   ✓   |     ✓    |    ✓    |
|  83 | interfaceDescription                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  84 | samplerName                              |     ✓     |   ✓   |     ✓    |    ✓    |
|  85 | octetTotalCount                          |     ✓     |   ✓   |     ✓    |    ✓    |
|  86 | packetTotalCount                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  87 | flagsAndSamplerId                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  88 | fragmentOffset                           |     ✓     |   ✓   |     ✓    |    ✓    |
|  89 | forwardingStatus                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  90 | mplsVpnRouteDistinguisher                |           |   ✓   |     ✓    |    ✓    |
|  91 | mplsTopLabelPrefixLength                 |           |   ✓   |     ✓    |    ✓    |
|  92 | srcTrafficIndex                          |           |   ✓   |     ✓    |    ✓    |
|  93 | dstTrafficIndex                          |           |   ✓   |     ✓    |    ✓    |
|  94 | applicationDescription                   |           |   ✓   |     ✓    |    ✓    |
|  95 | applicationId                            |           |   ✓   |     ✓    |    ✓    |
|  96 | applicationName                          |           |   ✓   |     ✓    |    ✓    |
|  97 | subApplicationTag `Cisco Legacy`         |           |       |     ✓    |    ✓    |
|  98 | postIpDiffServCodePoint                  |           |   ✓   |     ✓    |    ✓    |
|  99 | multicastReplicationFactor               |           |   ✓   |     ✓    |    ✓    |
| 100 | className                                |           |   ✓   |     ✓    |    ✓    |
| 101 | classificationEngineId                   |           |   ✓   |     ✓    |    ✓    |
| 102 | layer2packetSectionOffset                |           |   ✓   |     ✓    |    ✓    |
| 103 | layer2packetSectionSize                  |           |   ✓   |     ✓    |    ✓    |
| 104 | layer2packetSectionData                  |           |   ✓   |     ✓    |    ✓    |
| 105 | applicationVersion `Cisco Legacy`        |           |       |     ✓    |    ✓    |
| 106 | applicationVersionName `Cisco Legacy`    |           |       |     ✓    |    ✓    |
| 107 | applicationVendor `Cisco Legacy`         |           |       |     ✓    |    ✓    |
| 109 | subApplicationName `Cisco Legacy`        |           |       |     ✓    |    ✓    |
| 110 | subApplicationDescription `Cisco Legacy` |           |       |     ✓    |    ✓    |
| 111 | templateParameterRangeEnd `Cisco Legacy` |           |       |     ✓    |    ✓    |
| 128 | bgpNextAdjacentAsNumber                  |           |   ✓   |     ✓    |    ✓    |
| 129 | bgpPrevAdjacentAsNumber                  |           |   ✓   |     ✓    |    ✓    |
| 130 | exporterIPv4Address                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 131 | exporterIPv6Address                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 132 | droppedOctetDeltaCount                   |           |   ✓   |     ✓    |    ✓    |
| 133 | droppedPacketDeltaCount                  |           |   ✓   |     ✓    |    ✓    |
| 134 | droppedOctetTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 135 | droppedPacketTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| 136 | flowEndReason                            |           |   ✓   |     ✓    |    ✓    |
| 137 | commonPropertiesId                       |           |   ✓   |     ✓    |    ✓    |
| 138 | observationPointId                       |           |   ✓   |     ✓    |    ✓    |
| 139 | icmpTypeCodeIPv6                         |           |   ✓   |     ✓    |    ✓    |
| 140 | mplsTopLabelIPv6Address                  |           |   ✓   |     ✓    |    ✓    |
| 141 | lineCardId                               |           |   ✓   |     ✓    |    ✓    |
| 142 | portId                                   |           |   ✓   |     ✓    |    ✓    |
| 143 | meteringProcessId                        |           |   ✓   |     ✓    |    ✓    |
| 144 | exportingProcessId                       |           |   ✓   |     ✓    |    ✓    |
| 145 | templateId                               |           |   ✓   |     ✓    |    ✓    |
| 146 | wlanChannelId                            |           |   ✓   |     ✓    |    ✓    |
| 147 | wlanSSID                                 |           |   ✓   |     ✓    |    ✓    |
| 148 | flowId                                   |           |   ✓   |     ✓    |    ✓    |
| 149 | observationDomainId                      |           |   ✓   |     ✓    |    ✓    |
| 150 | flowStartSeconds                         |     ✓     |   ✓   |     ✓    |    ✓    |
| 151 | flowEndSeconds                           |     ✓     |   ✓   |     ✓    |    ✓    |
| 152 | flowStartMilliseconds                    |     ✓     |   ✓   |     ✓    |    ✓    |
| 153 | flowEndMilliseconds                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 154 | flowStartMicroseconds                    |     ✓     |   ✓   |     ✓    |    ✓    |
| 155 | flowEndMicroseconds                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 156 | flowStartNanoseconds                     |     ✓     |   ✓   |     ✓    |    ✓    |
| 157 | flowEndNanoseconds                       |     ✓     |   ✓   |     ✓    |    ✓    |
| 158 | flowStartDeltaMicroseconds               |           |   ✓   |     ✓    |    ✓    |
| 159 | flowEndDeltaMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| 160 | systemInitTimeMilliseconds               |           |   ✓   |     ✓    |    ✓    |
| 161 | flowDurationMilliseconds                 |           |   ✓   |     ✓    |    ✓    |
| 162 | flowDurationMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| 163 | observedFlowTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 164 | ignoredPacketTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| 165 | ignoredOctetTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 166 | notSentFlowTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 167 | notSentPacketTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| 168 | notSentOctetTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 169 | destinationIPv6Prefix                    |           |   ✓   |     ✓    |    ✓    |
| 170 | sourceIPv6Prefix                         |           |   ✓   |     ✓    |    ✓    |
| 171 | postOctetTotalCount                      |           |   ✓   |     ✓    |    ✓    |
| 172 | postPacketTotalCount                     |           |   ✓   |     ✓    |    ✓    |
| 173 | flowKeyIndicator                         |           |   ✓   |     ✓    |    ✓    |
| 174 | postMCastPacketTotalCount                |           |   ✓   |     ✓    |    ✓    |
| 175 | postMCastOctetTotalCount                 |           |   ✓   |     ✓    |    ✓    |
| 176 | icmpTypeIPv4                             |           |   ✓   |     ✓    |    ✓    |
| 177 | icmpCodeIPv4                             |           |   ✓   |     ✓    |    ✓    |
| 178 | icmpTypeIPv6                             |           |   ✓   |     ✓    |    ✓    |
| 179 | icmpCodeIPv6                             |           |   ✓   |     ✓    |    ✓    |
| 180 | udpSourcePort                            |           |   ✓   |     ✓    |    ✓    |
| 181 | udpDestinationPort                       |           |   ✓   |     ✓    |    ✓    |
| 182 | tcpSourcePort                            |           |   ✓   |     ✓    |    ✓    |
| 183 | tcpDestinationPort                       |           |   ✓   |     ✓    |    ✓    |
| 184 | tcpSequenceNumber                        |           |   ✓   |     ✓    |    ✓    |
| 185 | tcpAcknowledgementNumber                 |           |   ✓   |     ✓    |    ✓    |
| 186 | tcpWindowSize                            |           |   ✓   |     ✓    |    ✓    |
| 187 | tcpUrgentPointer                         |           |   ✓   |     ✓    |    ✓    |
| 188 | tcpHeaderLength                          |           |   ✓   |     ✓    |    ✓    |
| 189 | ipHeaderLength                           |           |   ✓   |     ✓    |    ✓    |
| 190 | totalLengthIPv4                          |           |   ✓   |     ✓    |    ✓    |
| 191 | payloadLengthIPv6                        |           |   ✓   |     ✓    |    ✓    |
| 192 | ipTTL                                    |           |   ✓   |     ✓    |    ✓    |
| 193 | nextHeaderIPv6                           |           |   ✓   |     ✓    |    ✓    |
| 194 | mplsPayloadLength                        |           |   ✓   |     ✓    |    ✓    |
| 195 | ipDiffServCodePoint                      |           |   ✓   |     ✓    |    ✓    |
| 196 | ipPrecedence                             |           |   ✓   |     ✓    |    ✓    |
| 197 | fragmentFlags                            |           |   ✓   |     ✓    |    ✓    |
| 198 | octetDeltaSumOfSquares                   |           |   ✓   |     ✓    |    ✓    |
| 199 | octetTotalSumOfSquares                   |           |   ✓   |     ✓    |    ✓    |
| 200 | mplsTopLabelTTL                          |           |   ✓   |     ✓    |    ✓    |
| 201 | mplsLabelStackLength                     |           |   ✓   |     ✓    |    ✓    |
| 202 | mplsLabelStackDepth                      |           |   ✓   |     ✓    |    ✓    |
| 203 | mplsTopLabelExp                          |           |   ✓   |     ✓    |    ✓    |
| 204 | ipPayloadLength                          |           |   ✓   |     ✓    |    ✓    |
| 205 | udpMessageLength                         |           |   ✓   |     ✓    |    ✓    |
| 206 | isMulticast                              |           |   ✓   |     ✓    |    ✓    |
| 207 | ipv4IHL                                  |           |   ✓   |     ✓    |    ✓    |
| 208 | ipv4Options                              |           |   ✓   |     ✓    |    ✓    |
| 209 | tcpOptions                               |           |   ✓   |     ✓    |    ✓    |
| 210 | paddingOctets                            |           |   ✓   |     ✓    |    ✓    |
| 211 | collectorIPv4Address                     |           |   ✓   |     ✓    |    ✓    |
| 212 | collectorIPv6Address                     |           |   ✓   |     ✓    |    ✓    |
| 213 | exportInterface                          |           |   ✓   |     ✓    |    ✓    |
| 214 | exportProtocolVersion                    |           |   ✓   |     ✓    |    ✓    |
| 215 | exportTransportProtocol                  |           |   ✓   |     ✓    |    ✓    |
| 216 | collectorTransportPort                   |           |   ✓   |     ✓    |    ✓    |
| 217 | exporterTransportPort                    |           |   ✓   |     ✓    |    ✓    |
| 218 | tcpSynTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 219 | tcpFinTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 220 | tcpRstTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 221 | tcpPshTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 222 | tcpAckTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 223 | tcpUrgTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 224 | ipTotalLength                            |           |   ✓   |     ✓    |    ✓    |
| 225 | postNATSourceIPv4Address                 |           |   ✓   |     ✓    |    ✓    |
| 226 | postNATDestinationIPv4Address            |           |   ✓   |     ✓    |    ✓    |
| 227 | postNAPTSourceTransportPort              |           |   ✓   |     ✓    |    ✓    |
| 228 | postNAPTDestinationTransportPort         |           |   ✓   |     ✓    |    ✓    |
| 229 | natOriginatingAddressRealm               |           |   ✓   |     ✓    |    ✓    |
| 230 | natEvent                                 |           |   ✓   |     ✓    |    ✓    |
| 231 | initiatorOctets                          |           |   ✓   |     ✓    |    ✓    |
| 232 | responderOctets                          |           |   ✓   |     ✓    |    ✓    |
| 233 | firewallEvent                            |           |   ✓   |     ✓    |    ✓    |
| 234 | ingressVRFID                             |           |   ✓   |     ✓    |    ✓    |
| 235 | egressVRFID                              |           |   ✓   |     ✓    |    ✓    |
| 236 | VRFname                                  |           |   ✓   |     ✓    |    ✓    |
| 237 | postMplsTopLabelExp                      |           |   ✓   |     ✓    |    ✓    |
| 238 | tcpWindowScale                           |           |   ✓   |     ✓    |    ✓    |
| 239 | biflowDirection                          |           |   ✓   |     ✓    |    ✓    |
| 240 | ethernetHeaderLength                     |           |   ✓   |     ✓    |    ✓    |
| 241 | ethernetPayloadLength                    |           |   ✓   |     ✓    |    ✓    |
| 242 | ethernetTotalLength                      |           |   ✓   |     ✓    |    ✓    |
| 243 | dot1qVlanId                              |           |   ✓   |     ✓    |    ✓    |
| 244 | dot1qPriority                            |           |   ✓   |     ✓    |    ✓    |
| 245 | dot1qCustomerVlanId                      |           |   ✓   |     ✓    |    ✓    |
| 246 | dot1qCustomerPriority                    |           |   ✓   |     ✓    |    ✓    |
| 247 | metroEvcId                               |           |   ✓   |     ✓    |    ✓    |
| 248 | metroEvcType                             |           |   ✓   |     ✓    |    ✓    |
| 249 | pseudoWireId                             |           |   ✓   |     ✓    |    ✓    |
| 250 | pseudoWireType                           |           |   ✓   |     ✓    |    ✓    |
| 251 | pseudoWireControlWord                    |           |   ✓   |     ✓    |    ✓    |
| 252 | ingressPhysicalInterface                 |           |   ✓   |     ✓    |    ✓    |
| 253 | egressPhysicalInterface                  |           |   ✓   |     ✓    |    ✓    |
| 254 | postDot1qVlanId                          |           |   ✓   |     ✓    |    ✓    |
| 255 | postDot1qCustomerVlanId                  |           |   ✓   |     ✓    |    ✓    |
| 256 | ethernetType                             |           |   ✓   |     ✓    |    ✓    |
| 257 | postIpPrecedence                         |           |   ✓   |     ✓    |    ✓    |
| 258 | collectionTimeMilliseconds               |           |   ✓   |     ✓    |    ✓    |
| 259 | exportSctpStreamId                       |           |   ✓   |     ✓    |    ✓    |
| 260 | maxExportSeconds                         |           |   ✓   |     ✓    |    ✓    |
| 261 | maxFlowEndSeconds                        |           |   ✓   |     ✓    |    ✓    |
| 262 | messageMD5Checksum                       |           |   ✓   |     ✓    |    ✓    |
| 263 | messageScope                             |           |   ✓   |     ✓    |    ✓    |
| 264 | minExportSeconds                         |           |   ✓   |     ✓    |    ✓    |
| 265 | minFlowStartSeconds                      |           |   ✓   |     ✓    |    ✓    |
| 266 | opaqueOctets                             |           |   ✓   |     ✓    |    ✓    |
| 267 | sessionScope                             |           |   ✓   |     ✓    |    ✓    |
| 268 | maxFlowEndMicroseconds                   |           |   ✓   |     ✓    |    ✓    |
| 269 | maxFlowEndMilliseconds                   |           |   ✓   |     ✓    |    ✓    |
| 270 | maxFlowEndNanoseconds                    |           |   ✓   |     ✓    |    ✓    |
| 271 | minFlowStartMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| 272 | minFlowStartMilliseconds                 |           |   ✓   |     ✓    |    ✓    |
| 273 | minFlowStartNanoseconds                  |           |   ✓   |     ✓    |    ✓    |
| 274 | collectorCertificate                     |           |   ✓   |     ✓    |    ✓    |
| 275 | exporterCertificate                      |           |   ✓   |     ✓    |    ✓    |
| 276 | dataRecordsReliability                   |           |   ✓   |     ✓    |    ✓    |
| 277 | observationPointType                     |           |   ✓   |     ✓    |    ✓    |
| 278 | newConnectionDeltaCount                  |           |   ✓   |     ✓    |    ✓    |
| 279 | connectionSumDurationSeconds             |           |   ✓   |     ✓    |    ✓    |
| 280 | connectionTransactionId                  |           |   ✓   |     ✓    |    ✓    |
| 281 | postNATSourceIPv6Address                 |           |   ✓   |     ✓    |    ✓    |
| 282 | postNATDestinationIPv6Address            |           |   ✓   |     ✓    |    ✓    |
| 283 | natPoolId                                |           |   ✓   |     ✓    |    ✓    |
| 284 | natPoolName                              |           |   ✓   |     ✓    |    ✓    |
| 285 | anonymizationFlags                       |           |   ✓   |     ✓    |    ✓    |
| 286 | anonymizationTechnique                   |           |   ✓   |     ✓    |    ✓    |
| 287 | informationElementIndex                  |           |   ✓   |     ✓    |    ✓    |
| 288 | p2pTechnology                            |           |   ✓   |     ✓    |    ✓    |
| 289 | tunnelTechnology                         |           |   ✓   |     ✓    |    ✓    |
| 290 | encryptedTechnology                      |           |   ✓   |     ✓    |    ✓    |
| 294 | bgpValidityState                         |           |   ✓   |     ✓    |    ✓    |
| 295 | IPSecSPI                                 |           |   ✓   |     ✓    |    ✓    |
| 296 | greKey                                   |           |   ✓   |     ✓    |    ✓    |
| 297 | natType                                  |           |   ✓   |     ✓    |    ✓    |
| 298 | initiatorPackets                         |           |   ✓   |     ✓    |    ✓    |
| 299 | responderPackets                         |           |   ✓   |     ✓    |    ✓    |
| 300 | observationDomainName                    |           |   ✓   |     ✓    |    ✓    |
| 301 | selectionSequenceId                      |           |   ✓   |     ✓    |    ✓    |
| 302 | selectorId                               |           |   ✓   |     ✓    |    ✓    |
| 303 | informationElementId                     |           |   ✓   |     ✓    |    ✓    |
| 304 | selectorAlgorithm                        |           |   ✓   |     ✓    |    ✓    |
| 305 | samplingPacketInterval                   |           |   ✓   |     ✓    |    ✓    |
| 306 | samplingPacketSpace                      |           |   ✓   |     ✓    |    ✓    |
| 307 | samplingTimeInterval                     |           |   ✓   |     ✓    |    ✓    |
| 308 | samplingTimeSpace                        |           |   ✓   |     ✓    |    ✓    |
| 309 | samplingSize                             |           |   ✓   |     ✓    |    ✓    |
| 310 | samplingPopulation                       |           |   ✓   |     ✓    |    ✓    |
| 311 | samplingProbability                      |           |   ✓   |     ✓    |    ✓    |
| 312 | dataLinkFrameSize                        |           |   ✓   |     ✓    |    ✓    |
| 313 | ipHeaderPacketSection                    |           |   ✓   |     ✓    |    ✓    |
| 314 | ipPayloadPacketSection                   |           |   ✓   |     ✓    |    ✓    |
| 315 | dataLinkFrameSection                     |           |   ✓   |     ✓    |    ✓    |
| 316 | mplsLabelStackSection                    |           |   ✓   |     ✓    |    ✓    |
| 317 | mplsPayloadPacketSection                 |           |   ✓   |     ✓    |    ✓    |
| 318 | selectorIdTotalPktsObserved              |           |   ✓   |     ✓    |    ✓    |
| 319 | selectorIdTotalPktsSelected              |           |   ✓   |     ✓    |    ✓    |
| 320 | absoluteError                            |           |   ✓   |     ✓    |    ✓    |
| 321 | relativeError                            |           |   ✓   |     ✓    |    ✓    |
| 322 | observationTimeSeconds                   |           |   ✓   |     ✓    |    ✓    |
| 323 | observationTimeMilliseconds              |           |   ✓   |     ✓    |    ✓    |
| 324 | observationTimeMicroseconds              |           |   ✓   |     ✓    |    ✓    |
| 325 | observationTimeNanoseconds               |           |   ✓   |     ✓    |    ✓    |
| 326 | digestHashValue                          |           |   ✓   |     ✓    |    ✓    |
| 327 | hashIPPayloadOffset                      |           |   ✓   |     ✓    |    ✓    |
| 328 | hashIPPayloadSize                        |           |   ✓   |     ✓    |    ✓    |
| 329 | hashOutputRangeMin                       |           |   ✓   |     ✓    |    ✓    |
| 330 | hashOutputRangeMax                       |           |   ✓   |     ✓    |    ✓    |
| 331 | hashSelectedRangeMin                     |           |   ✓   |     ✓    |    ✓    |
| 332 | hashSelectedRangeMax                     |           |   ✓   |     ✓    |    ✓    |
| 333 | hashDigestOutput                         |           |   ✓   |     ✓    |    ✓    |
| 334 | hashInitialiserValue                     |           |   ✓   |     ✓    |    ✓    |
| 335 | selectorName                             |           |   ✓   |     ✓    |    ✓    |
| 336 | upperCILimit                             |           |   ✓   |     ✓    |    ✓    |
| 337 | lowerCILimit                             |           |   ✓   |     ✓    |    ✓    |
| 338 | confidenceLevel                          |           |   ✓   |     ✓    |    ✓    |
| 339 | informationElementDataType               |           |   ✓   |     ✓    |    ✓    |
| 340 | informationElementDescription            |           |   ✓   |     ✓    |    ✓    |
| 341 | informationElementName                   |           |   ✓   |     ✓    |    ✓    |
| 342 | informationElementRangeBegin             |           |   ✓   |     ✓    |    ✓    |
| 343 | informationElementRangeEnd               |           |   ✓   |     ✓    |    ✓    |
| 344 | informationElementSemantics              |           |   ✓   |     ✓    |    ✓    |
| 345 | informationElementUnits                  |           |   ✓   |     ✓    |    ✓    |
| 346 | privateEnterpriseNumber                  |           |   ✓   |     ✓    |    ✓    |
| 347 | virtualStationInterfaceId                |           |   ✓   |     ✓    |    ✓    |
| 348 | virtualStationInterfaceName              |           |   ✓   |     ✓    |    ✓    |
| 349 | virtualStationUUID                       |           |   ✓   |     ✓    |    ✓    |
| 350 | virtualStationName                       |           |   ✓   |     ✓    |    ✓    |
| 351 | layer2SegmentId                          |           |   ✓   |     ✓    |    ✓    |
| 352 | layer2OctetDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| 353 | layer2OctetTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 354 | ingressUnicastPacketTotalCount           |           |   ✓   |     ✓    |    ✓    |
| 355 | ingressMulticastPacketTotalCount         |           |   ✓   |     ✓    |    ✓    |
| 356 | ingressBroadcastPacketTotalCount         |           |   ✓   |     ✓    |    ✓    |
| 357 | egressUnicastPacketTotalCount            |           |   ✓   |     ✓    |    ✓    |
| 358 | egressBroadcastPacketTotalCount          |           |   ✓   |     ✓    |    ✓    |
| 359 | monitoringIntervalStartMilliSeconds      |           |   ✓   |     ✓    |    ✓    |
| 360 | monitoringIntervalEndMilliSeconds        |           |   ✓   |     ✓    |    ✓    |
| 361 | portRangeStart                           |           |   ✓   |     ✓    |    ✓    |
| 362 | portRangeEnd                             |           |   ✓   |     ✓    |    ✓    |
| 363 | portRangeStepSize                        |           |   ✓   |     ✓    |    ✓    |
| 364 | portRangeNumPorts                        |           |   ✓   |     ✓    |    ✓    |
| 365 | staMacAddress                            |           |   ✓   |     ✓    |    ✓    |
| 366 | staIPv4Address                           |           |   ✓   |     ✓    |    ✓    |
| 367 | wtpMacAddress                            |           |   ✓   |     ✓    |    ✓    |
| 368 | ingressInterfaceType                     |           |   ✓   |     ✓    |    ✓    |
| 369 | egressInterfaceType                      |           |   ✓   |     ✓    |    ✓    |
| 370 | rtpSequenceNumber                        |           |   ✓   |     ✓    |    ✓    |
| 371 | userName                                 |           |   ✓   |     ✓    |    ✓    |
| 372 | applicationCategoryName                  |           |   ✓   |     ✓    |    ✓    |
| 373 | applicationSubCategoryName               |           |   ✓   |     ✓    |    ✓    |
| 374 | applicationGroupName                     |           |   ✓   |     ✓    |    ✓    |
| 375 | originalFlowsPresent                     |           |   ✓   |     ✓    |    ✓    |
| 376 | originalFlowsInitiated                   |           |   ✓   |     ✓    |    ✓    |
| 377 | originalFlowsCompleted                   |           |   ✓   |     ✓    |    ✓    |
| 378 | distinctCountOfSourceIPAddress           |           |   ✓   |     ✓    |    ✓    |
| 379 | distinctCountOfDestinationIPAddress      |           |   ✓   |     ✓    |    ✓    |
| 380 | distinctCountOfSourceIPv4Address         |           |   ✓   |     ✓    |    ✓    |
| 381 | distinctCountOfDestinationIPv4Address    |           |   ✓   |     ✓    |    ✓    |
| 382 | distinctCountOfSourceIPv6Address         |           |   ✓   |     ✓    |    ✓    |
| 383 | distinctCountOfDestinationIPv6Address    |           |   ✓   |     ✓    |    ✓    |
| 384 | valueDistributionMethod                  |           |   ✓   |     ✓    |    ✓    |
| 385 | rfc3550JitterMilliseconds                |           |   ✓   |     ✓    |    ✓    |
| 386 | rfc3550JitterMicroseconds                |           |   ✓   |     ✓    |    ✓    |
| 387 | rfc3550JitterNanoseconds                 |           |   ✓   |     ✓    |    ✓    |
| 388 | dot1qDEI                                 |           |   ✓   |     ✓    |    ✓    |
| 389 | dot1qCustomerDEI                         |           |   ✓   |     ✓    |    ✓    |
| 390 | flowSelectorAlgorithm                    |           |   ✓   |     ✓    |    ✓    |
| 391 | flowSelectedOctetDeltaCount              |           |   ✓   |     ✓    |    ✓    |
| 392 | flowSelectedPacketDeltaCount             |           |   ✓   |     ✓    |    ✓    |
| 393 | flowSelectedFlowDeltaCount               |           |   ✓   |     ✓    |    ✓    |
| 394 | selectorIDTotalFlowsObserved             |           |   ✓   |     ✓    |    ✓    |
| 395 | selectorIDTotalFlowsSelected             |           |   ✓   |     ✓    |    ✓    |
| 396 | samplingFlowInterval                     |           |   ✓   |     ✓    |    ✓    |
| 397 | samplingFlowSpacing                      |           |   ✓   |     ✓    |    ✓    |
| 398 | flowSamplingTimeInterval                 |           |   ✓   |     ✓    |    ✓    |
| 399 | flowSamplingTimeSpacing                  |           |   ✓   |     ✓    |    ✓    |
| 400 | hashFlowDomain                           |           |   ✓   |     ✓    |    ✓    |
| 401 | transportOctetDeltaCount                 |           |   ✓   |     ✓    |    ✓    |
| 402 | transportPacketDeltaCount                |           |   ✓   |     ✓    |    ✓    |
| 403 | originalExporterIPv4Address              |           |   ✓   |     ✓    |    ✓    |
| 404 | originalExporterIPv6Address              |           |   ✓   |     ✓    |    ✓    |
| 405 | originalObservationDomainId              |           |   ✓   |     ✓    |    ✓    |
| 406 | intermediateProcessId                    |           |   ✓   |     ✓    |    ✓    |
| 407 | ignoredDataRecordTotalCount              |           |   ✓   |     ✓    |    ✓    |
| 408 | dataLinkFrameType                        |           |   ✓   |     ✓    |    ✓    |
| 409 | sectionOffset                            |           |   ✓   |     ✓    |    ✓    |
| 410 | sectionExportedOctets                    |           |   ✓   |     ✓    |    ✓    |
| 411 | dot1qServiceInstanceTag                  |           |   ✓   |     ✓    |    ✓    |
| 412 | dot1qServiceInstanceId                   |           |   ✓   |     ✓    |    ✓    |
| 413 | dot1qServiceInstancePriority             |           |   ✓   |     ✓    |    ✓    |
| 414 | dot1qCustomerSourceMacAddress            |           |   ✓   |     ✓    |    ✓    |
| 415 | dot1qCustomerDestinationMacAddress       |           |   ✓   |     ✓    |    ✓    |
| 416 | layer2OctetDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| 417 | postLayer2OctetDeltaCount                |           |   ✓   |     ✓    |    ✓    |
| 418 | postMCastLayer2OctetDeltaCount           |           |   ✓   |     ✓    |    ✓    |
| 419 | layer2OctetTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 420 | postLayer2OctetTotalCount                |           |   ✓   |     ✓    |    ✓    |
| 421 | postMCastLayer2OctetTotalCount           |           |   ✓   |     ✓    |    ✓    |
| 422 | minimumLayer2TotalLength                 |           |   ✓   |     ✓    |    ✓    |
| 423 | maximumLayer2TotalLength                 |           |   ✓   |     ✓    |    ✓    |
| 424 | droppedLayer2OctetDeltaCount             |           |   ✓   |     ✓    |    ✓    |
| 425 | droppedLayer2OctetTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 426 | ignoredLayer2OctetTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 427 | notSentLayer2OctetTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 428 | layer2OctetDeltaSumOfSquares             |           |   ✓   |     ✓    |    ✓    |
| 429 | layer2OctetTotalSumOfSquares             |           |   ✓   |     ✓    |    ✓    |
| 430 | layer2FrameDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| 431 | layer2FrameTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 432 | pseudoWireDestinationIPv4Address         |           |   ✓   |     ✓    |    ✓    |
| 433 | ignoredLayer2FrameTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 434 | mibObjectValueInteger                    |           |   ✓   |     ✓    |    ✓    |
| 435 | mibObjectValueOctetString                |           |   ✓   |     ✓    |    ✓    |
| 436 | mibObjectValueOID                        |           |   ✓   |     ✓    |    ✓    |
| 437 | mibObjectValueBits                       |           |   ✓   |     ✓    |    ✓    |
| 438 | mibObjectValueIPAddress                  |           |   ✓   |     ✓    |    ✓    |
| 439 | mibObjectValueCounter                    |           |   ✓   |     ✓    |    ✓    |
| 440 | mibObjectValueGauge                      |           |   ✓   |     ✓    |    ✓    |
| 441 | mibObjectValueTimeTicks                  |           |   ✓   |     ✓    |    ✓    |
| 442 | mibObjectValueUnsigned                   |           |   ✓   |     ✓    |    ✓    |
| 445 | mibObjectIdentifier                      |           |   ✓   |     ✓    |    ✓    |
| 446 | mibSubIdentifier                         |           |   ✓   |     ✓    |    ✓    |
| 447 | mibIndexIndicator                        |           |   ✓   |     ✓    |    ✓    |
| 448 | mibCaptureTimeSemantics                  |           |   ✓   |     ✓    |    ✓    |
| 449 | mibContextEngineID                       |           |   ✓   |     ✓    |    ✓    |
| 450 | mibContextName                           |           |   ✓   |     ✓    |    ✓    |
| 451 | mibObjectName                            |           |   ✓   |     ✓    |    ✓    |
| 452 | mibObjectDescription                     |           |   ✓   |     ✓    |    ✓    |
| 453 | mibObjectSyntax                          |           |   ✓   |     ✓    |    ✓    |
| 454 | mibModuleName                            |           |   ✓   |     ✓    |    ✓    |
| 455 | mobileIMSI                               |           |   ✓   |     ✓    |    ✓    |
| 456 | mobileMSISDN                             |           |   ✓   |     ✓    |    ✓    |
| 457 | httpStatusCode                           |           |   ✓   |     ✓    |    ✓    |
| 458 | sourceTransportPortsLimit                |           |   ✓   |     ✓    |    ✓    |
| 459 | httpRequestMethod                        |           |   ✓   |     ✓    |    ✓    |
| 460 | httpRequestHost                          |           |   ✓   |     ✓    |    ✓    |
| 461 | httpRequestTarget                        |           |   ✓   |     ✓    |    ✓    |
| 462 | httpMessageVersion                       |           |   ✓   |     ✓    |    ✓    |
| 463 | natInstanceID                            |           |   ✓   |     ✓    |    ✓    |
| 464 | internalAddressRealm                     |           |   ✓   |     ✓    |    ✓    |
| 465 | externalAddressRealm                     |           |   ✓   |     ✓    |    ✓    |
| 466 | natQuotaExceededEvent                    |           |   ✓   |     ✓    |    ✓    |
| 467 | natThresholdEvent                        |           |   ✓   |     ✓    |    ✓    |
| 468 | httpUserAgent                            |           |   ✓   |     ✓    |    ✓    |
| 469 | httpContentType                          |           |   ✓   |     ✓    |    ✓    |
| 470 | httpReasonPhrase                         |           |   ✓   |     ✓    |    ✓    |
| 471 | maxSessionEntries                        |           |   ✓   |     ✓    |    ✓    |
| 472 | maxBIBEntries                            |           |   ✓   |     ✓    |    ✓    |
| 473 | maxEntriesPerUser                        |           |   ✓   |     ✓    |    ✓    |
| 474 | maxSubscribers                           |           |   ✓   |     ✓    |    ✓    |
| 475 | maxFragmentsPendingReassembly            |           |   ✓   |     ✓    |    ✓    |
| 476 | addressPoolHighThreshold                 |           |   ✓   |     ✓    |    ✓    |
| 477 | addressPoolLowThreshold                  |           |   ✓   |     ✓    |    ✓    |
| 478 | addressPortMappingHighThreshold          |           |   ✓   |     ✓    |    ✓    |
| 479 | addressPortMappingLowThreshold           |           |   ✓   |     ✓    |    ✓    |
| 480 | addressPortMappingPerUserHighThreshold   |           |   ✓   |     ✓    |    ✓    |
| 481 | globalAddressMappingHighThreshold        |           |   ✓   |     ✓    |    ✓    |
| 482 | vpnIdentifier                            |           |   ✓   |     ✓    |    ✓    |
| 483 | bgpCommunity                             |           |   ✓   |     ✓    |    ✓    |
| 486 | bgpExtendedCommunity                     |           |   ✓   |     ✓    |    ✓    |
| 489 | bgpLargeCommunity                        |           |   ✓   |     ✓    |    ✓    |

#### Cisco (PEN: 9)

| Name                                                 | Community | Basic | Standard | Premium |
| ---------------------------------------------------- | :-------: | :---: | :------: | :-----: |
| AAA\_USERNAME                                        |           |   ✓   |     ✓    |    ✓    |
| application business-relevance                       |           |   ✓   |     ✓    |    ✓    |
| application category name                            |           |   ✓   |     ✓    |    ✓    |
| application delay average                            |           |   ✓   |     ✓    |    ✓    |
| application family name                              |           |   ✓   |     ✓    |    ✓    |
| application group name                               |           |   ✓   |     ✓    |    ✓    |
| application http uri statistics                      |           |   ✓   |     ✓    |    ✓    |
| application media bytes counter                      |           |   ✓   |     ✓    |    ✓    |
| application media bytes counter permanent            |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate                         |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate per-flow                |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate per-flow max            |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate per-flow min            |           |   ✓   |     ✓    |    ✓    |
| application media event                              |           |   ✓   |     ✓    |    ✓    |
| application media packets counter                    |           |   ✓   |     ✓    |    ✓    |
| application media packets counter permanen           |           |   ✓   |     ✓    |    ✓    |
| application media packets rate                       |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation             |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation m           |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation m           |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation s           |           |   ✓   |     ✓    |    ✓    |
| application set name                                 |           |   ✓   |     ✓    |    ✓    |
| application sub category name                        |           |   ✓   |     ✓    |    ✓    |
| application traffic-class                            |           |   ✓   |     ✓    |    ✓    |
| application transaction counter new                  |           |   ✓   |     ✓    |    ✓    |
| application video eMOS compression bitstre           |           |   ✓   |     ✓    |    ✓    |
| application video eMOS compression network           |           |   ✓   |     ✓    |    ✓    |
| application video eMOS packet-loss bitstre           |           |   ✓   |     ✓    |    ✓    |
| application video eMOS packet-loss network           |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter bytes              |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter frames             |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter packets            |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter packets            |           |   ✓   |     ✓    |    ✓    |
| application video frame I slice-quantizati           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter bytes            |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter frames           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR slice-quantiza           |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter bytes             |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter frames            |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter packets           |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter packets           |           |   ✓   |     ✓    |    ✓    |
| application video frame NR slice-quantizat           |           |   ✓   |     ✓    |    ✓    |
| application video frame percentage damaged           |           |   ✓   |     ✓    |    ✓    |
| application video frame rate                         |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter bytes            |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter frames           |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame STR slice-quantiza           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter by           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter fr           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter pa           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter pa           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P slice-quan           |           |   ✓   |     ✓    |    ✓    |
| application video level-of-motion                    |           |   ✓   |     ✓    |    ✓    |
| application video payload bitrate average            |           |   ✓   |     ✓    |    ✓    |
| application video payload bitrate fluctuat           |           |   ✓   |     ✓    |    ✓    |
| application video resolution height last             |           |   ✓   |     ✓    |    ✓    |
| application video resolution width last              |           |   ✓   |     ✓    |    ✓    |
| application video scene-complexity                   |           |   ✓   |     ✓    |    ✓    |
| application voice call duration                      |           |   ✓   |     ✓    |    ✓    |
| application voice codec id                           |           |   ✓   |     ✓    |    ✓    |
| application voice concealment-ratio averag           |           |   ✓   |     ✓    |    ✓    |
| application voice delay end-point                    |           |   ✓   |     ✓    |    ✓    |
| application voice delay round-trip                   |           |   ✓   |     ✓    |    ✓    |
| application voice jitter buffer-overrun              |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured initia           |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured maximu           |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured minimu           |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured type             |           |   ✓   |     ✓    |    ✓    |
| application voice mos conversation                   |           |   ✓   |     ✓    |    ✓    |
| application voice mos listening                      |           |   ✓   |     ✓    |    ✓    |
| application voice number called                      |           |   ✓   |     ✓    |    ✓    |
| application voice number calling                     |           |   ✓   |     ✓    |    ✓    |
| application voice packet conceal-count               |           |   ✓   |     ✓    |    ✓    |
| application voice play delay current                 |           |   ✓   |     ✓    |    ✓    |
| application voice play delay maximum                 |           |   ✓   |     ✓    |    ✓    |
| application voice play delay minimum                 |           |   ✓   |     ✓    |    ✓    |
| application voice r-factor 1                         |           |   ✓   |     ✓    |    ✓    |
| application voice r-factor 2                         |           |   ✓   |     ✓    |    ✓    |
| application voice router global-call-id              |           |   ✓   |     ✓    |    ✓    |
| application voice rx bad-packet                      |           |   ✓   |     ✓    |    ✓    |
| application voice rx early-packet count              |           |   ✓   |     ✓    |    ✓    |
| application voice rx late-packet count               |           |   ✓   |     ✓    |    ✓    |
| application voice rx out-of-sequence                 |           |   ✓   |     ✓    |    ✓    |
| application voice setup time                         |           |   ✓   |     ✓    |    ✓    |
| application voice sip call-id                        |           |   ✓   |     ✓    |    ✓    |
| appqoe ssl policy action                             |           |   ✓   |     ✓    |    ✓    |
| appqoe ssl service type                              |           |   ✓   |     ✓    |    ✓    |
| appqoe ssl traffic type                              |           |   ✓   |     ✓    |    ✓    |
| art count new connections                            |           |   ✓   |     ✓    |    ✓    |
| art count responses                                  |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket1                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket2                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket3                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket4                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket5                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket6                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket7                |           |   ✓   |     ✓    |    ✓    |
| artClientNetworkTimeLongLivedMaximum                 |           |   ✓   |     ✓    |    ✓    |
| artClientNetworkTimeLongLivedMinimum                 |           |   ✓   |     ✓    |    ✓    |
| artClientpackets                                     |           |   ✓   |     ✓    |    ✓    |
| artServerNetworkTimeLongLivedMaximum                 |           |   ✓   |     ✓    |    ✓    |
| artServerNetworkTimeLongLivedMinimum                 |           |   ✓   |     ✓    |    ✓    |
| artServerpackets                                     |           |   ✓   |     ✓    |    ✓    |
| audio concealment ratio maximum                      |           |   ✓   |     ✓    |    ✓    |
| audio concealment ratio minimum                      |           |   ✓   |     ✓    |    ✓    |
| audio concealment ratio now                          |           |   ✓   |     ✓    |    ✓    |
| audio concealment time                               |           |   ✓   |     ✓    |    ✓    |
| audio duration clock adjust                          |           |   ✓   |     ✓    |    ✓    |
| audio duration early packet                          |           |   ✓   |     ✓    |    ✓    |
| audio duration late discard                          |           |   ✓   |     ✓    |    ✓    |
| audio duration playout decrease                      |           |   ✓   |     ✓    |    ✓    |
| audio duration playout increase                      |           |   ✓   |     ✓    |    ✓    |
| audio duration receive                               |           |   ✓   |     ✓    |    ✓    |
| audio duration receive voice                         |           |   ✓   |     ✓    |    ✓    |
| audio frame arriving times difference                |           |   ✓   |     ✓    |    ✓    |
| audio frame arriving times difference vari           |           |   ✓   |     ✓    |    ✓    |
| audio frame size                                     |           |   ✓   |     ✓    |    ✓    |
| audio frames-per-packet                              |           |   ✓   |     ✓    |    ✓    |
| audio g107 codec baseline                            |           |   ✓   |     ✓    |    ✓    |
| audio g107 codec baseline bpl                        |           |   ✓   |     ✓    |    ✓    |
| audio g107 impairment                                |           |   ✓   |     ✓    |    ✓    |
| audio g107 impairment one-way-delay                  |           |   ✓   |     ✓    |    ✓    |
| audio g107 lossRate                                  |           |   ✓   |     ✓    |    ✓    |
| audio noise level average                            |           |   ✓   |     ✓    |    ✓    |
| audio noise level configured                         |           |   ✓   |     ✓    |    ✓    |
| audio noise level current                            |           |   ✓   |     ✓    |    ✓    |
| audio noise level maximum                            |           |   ✓   |     ✓    |    ✓    |
| audio noise level minimum                            |           |   ✓   |     ✓    |    ✓    |
| audio packets cs                                     |           |   ✓   |     ✓    |    ✓    |
| audio packets ok                                     |           |   ✓   |     ✓    |    ✓    |
| audio packets rtp                                    |           |   ✓   |     ✓    |    ✓    |
| audio packets scs                                    |           |   ✓   |     ✓    |    ✓    |
| audio packets silence                                |           |   ✓   |     ✓    |    ✓    |
| audio rtp fwd out-of-sequence sum                    |           |   ✓   |     ✓    |    ✓    |
| audio rtp jitter ticks                               |           |   ✓   |     ✓    |    ✓    |
| audio rtp packets expected                           |           |   ✓   |     ✓    |    ✓    |
| audio rtp packets lost                               |           |   ✓   |     ✓    |    ✓    |
| audio rtp seconds concealed                          |           |   ✓   |     ✓    |    ✓    |
| audio rtp seconds concealed severe                   |           |   ✓   |     ✓    |    ✓    |
| audio rtp seconds ok                                 |           |   ✓   |     ✓    |    ✓    |
| audio snr average                                    |           |   ✓   |     ✓    |    ✓    |
| audio snr configured                                 |           |   ✓   |     ✓    |    ✓    |
| audio snr current                                    |           |   ✓   |     ✓    |    ✓    |
| audio snr maximum                                    |           |   ✓   |     ✓    |    ✓    |
| audio snr minimum                                    |           |   ✓   |     ✓    |    ✓    |
| audio speech time                                    |           |   ✓   |     ✓    |    ✓    |
| AVCSubApplicationValue                               |           |   ✓   |     ✓    |    ✓    |
| bandwidth used                                       |           |   ✓   |     ✓    |    ✓    |
| bandwidth used percentage                            |           |   ✓   |     ✓    |    ✓    |
| bgp community                                        |           |   ✓   |     ✓    |    ✓    |
| bgp prepend                                          |           |   ✓   |     ✓    |    ✓    |
| bw fee                                               |           |   ✓   |     ✓    |    ✓    |
| bw percentage                                        |           |   ✓   |     ✓    |    ✓    |
| BYTE\_RATE                                           |           |   ✓   |     ✓    |    ✓    |
| c3pl class cce-id                                    |           |   ✓   |     ✓    |    ✓    |
| c3pl class name                                      |           |   ✓   |     ✓    |    ✓    |
| c3pl class type                                      |           |   ✓   |     ✓    |    ✓    |
| c3pl policy cce-id                                   |           |   ✓   |     ✓    |    ✓    |
| c3pl policy name                                     |           |   ✓   |     ✓    |    ✓    |
| c3pl policy type                                     |           |   ✓   |     ✓    |    ✓    |
| capacity                                             |           |   ✓   |     ✓    |    ✓    |
| client network delay average                         |           |   ✓   |     ✓    |    ✓    |
| client throughput average                            |           |   ✓   |     ✓    |    ✓    |
| closed sessions                                      |           |   ✓   |     ✓    |    ✓    |
| connection client counter bytes network              |           |   ✓   |     ✓    |    ✓    |
| connection client counter bytes retransmit           |           |   ✓   |     ✓    |    ✓    |
| connection client counter packets retransm           |           |   ✓   |     ✓    |    ✓    |
| connection client ipv4 address                       |           |   ✓   |     ✓    |    ✓    |
| connection client ipv6 address                       |           |   ✓   |     ✓    |    ✓    |
| connection client transport port                     |           |   ✓   |     ✓    |    ✓    |
| connection concurrent-connections                    |           |   ✓   |     ✓    |    ✓    |
| connection delay application max                     |           |   ✓   |     ✓    |    ✓    |
| connection delay application min                     |           |   ✓   |     ✓    |    ✓    |
| connection delay application sum                     |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network long-lived client           |           |   ✓   |     ✓    |    ✓    |
| connection delay network long-lived to-cli           |           |   ✓   |     ✓    |    ✓    |
| connection delay network long-lived to-ser           |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client max               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client min               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client num-sam           |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client sum               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server max               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server min               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server num-sam           |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server sum               |           |   ✓   |     ✓    |    ✓    |
| connection delay response client-to-server           |           |   ✓   |     ✓    |    ✓    |
| connection delay response client-to-server           |           |   ✓   |     ✓    |    ✓    |
| connection delay response client-to-server           |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server histog           |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server max              |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server min              |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server sum              |           |   ✓   |     ✓    |    ✓    |
| connection id                                        |           |   ✓   |     ✓    |    ✓    |
| connection id long                                   |           |   ✓   |     ✓    |    ✓    |
| connection server counter bytes network              |           |   ✓   |     ✓    |    ✓    |
| connection server counter bytes retransmit           |           |   ✓   |     ✓    |    ✓    |
| connection server counter packets retransm           |           |   ✓   |     ✓    |    ✓    |
| connection server ipv4 address                       |           |   ✓   |     ✓    |    ✓    |
| connection server ipv6 address                       |           |   ✓   |     ✓    |    ✓    |
| connection server transport port                     |           |   ✓   |     ✓    |    ✓    |
| connection transaction counter complete              |           |   ✓   |     ✓    |    ✓    |
| connection transaction duration max                  |           |   ✓   |     ✓    |    ✓    |
| connection transaction duration min                  |           |   ✓   |     ✓    |    ✓    |
| connection transaction duration sum                  |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-de-read                     |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-de-written                  |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-en-read                     |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-en-written                  |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-read                        |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-written                     |           |   ✓   |     ✓    |    ✓    |
| counter bytes rate per-flow                          |           |   ✓   |     ✓    |    ✓    |
| counter bytes rate per-flow max                      |           |   ✓   |     ✓    |    ✓    |
| counter bytes rate per-flow min                      |           |   ✓   |     ✓    |    ✓    |
| counter bytes sdwan dropped long                     |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe fec-d-pkts                    |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe fec-r-pkts                    |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe pkt-dup-d-pkts-dup            |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe pkt-dup-d-pkts-orig           |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe pkt-dup-r-pkts                |           |   ✓   |     ✓    |    ✓    |
| counter packets dropped permanent                    |           |   ✓   |     ✓    |    ✓    |
| counter packets rate per-flow                        |           |   ✓   |     ✓    |    ✓    |
| counter packets rate per-flow max                    |           |   ✓   |     ✓    |    ✓    |
| counter packets rate per-flow min                    |           |   ✓   |     ✓    |    ✓    |
| counter packets sdwan pkt-cxp-d-pkts                 |           |   ✓   |     ✓    |    ✓    |
| datalink event                                       |           |   ✓   |     ✓    |    ✓    |
| datalink event extended                              |           |   ✓   |     ✓    |    ✓    |
| discard rollup count                                 |           |   ✓   |     ✓    |    ✓    |
| drop cause id                                        |           |   ✓   |     ✓    |    ✓    |
| drop cause name                                      |           |   ✓   |     ✓    |    ✓    |
| egress bw                                            |           |   ✓   |     ✓    |    ✓    |
| egress rollup bw                                     |           |   ✓   |     ✓    |    ✓    |
| EGRESS\_ACL\_ID                                      |           |   ✓   |     ✓    |    ✓    |
| end timestamp                                        |           |   ✓   |     ✓    |    ✓    |
| entrance downgrade                                   |           |   ✓   |     ✓    |    ✓    |
| ETAByteDistribution                                  |           |   ✓   |     ✓    |    ✓    |
| ETAInitialDataPacketOld                              |           |   ✓   |     ✓    |    ✓    |
| ETASequenceofPktLengthsandTimes                      |           |   ✓   |     ✓    |    ✓    |
| ETTA\_INITIAL\_DATA\_PACKET                          |           |   ✓   |     ✓    |    ✓    |
| ETTA\_SEQUENCE\_OF\_APPLICATION\_LENGTHS\_AND\_TIMES |           |   ✓   |     ✓    |    ✓    |
| ETTA\_SEQUENCE\_OF\_PACKET\_LENGTHS\_AND\_TIMES      |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_CIPHER\_SUITES                            |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_EXTENSION\_LENGTHS                        |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_EXTENSION\_TYPES                          |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_EXTENSIONS                                |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_KEY\_LENGTH                               |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_RANDOM                                    |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_RECORDS                                   |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_SESSION\_ID                               |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_VERSION                                   |           |   ✓   |     ✓    |    ✓    |
| flow cts switch derived-sgt                          |           |   ✓   |     ✓    |    ✓    |
| flow left time                                       |           |   ✓   |     ✓    |    ✓    |
| FW\_BLACKOUT\_SECS                                   |           |   ✓   |     ✓    |    ✓    |
| FW\_CONFIGURED\_VALUE                                |           |   ✓   |     ✓    |    ✓    |
| FW\_ERM\_EXT\_EVENT                                  |           |   ✓   |     ✓    |    ✓    |
| FW\_ERM\_EXT\_EVENT\_DESC                            |           |   ✓   |     ✓    |    ✓    |
| FW\_EVENT                                            |           |   ✓   |     ✓    |    ✓    |
| FW\_EVENT\_LEVEL                                     |           |   ✓   |     ✓    |    ✓    |
| FW\_EVENT\_LEVEL\_ID                                 |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT                                       |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT                                       |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT\_DESC                                 |           |   ✓   |     ✓    |    ✓    |
| FW\_HALFOPEN\_CNT                                    |           |   ✓   |     ✓    |    ✓    |
| FW\_HALFOPEN\_HIGH                                   |           |   ✓   |     ✓    |    ✓    |
| FW\_HALFOPEN\_RATE                                   |           |   ✓   |     ✓    |    ✓    |
| FW\_MAX\_SESSIONS                                    |           |   ✓   |     ✓    |    ✓    |
| FW\_SUMMARY\_PKT\_CNT                                |           |   ✓   |     ✓    |    ✓    |
| FW\_ZONEPAIR\_ID                                     |           |   ✓   |     ✓    |    ✓    |
| FW\_ZONEPAIR\_NAME                                   |           |   ✓   |     ✓    |    ✓    |
| ingress bw                                           |           |   ✓   |     ✓    |    ✓    |
| ingress rollup bw                                    |           |   ✓   |     ✓    |    ✓    |
| INGRESS\_ACL\_ID                                     |           |   ✓   |     ✓    |    ✓    |
| interface input fex-node-id                          |           |   ✓   |     ✓    |    ✓    |
| interface output fex-node-id                         |           |   ✓   |     ✓    |    ✓    |
| interface power                                      |           |   ✓   |     ✓    |    ✓    |
| iOAM Application metadata                            |           |   ✓   |     ✓    |    ✓    |
| IOAM byte count                                      |           |   ✓   |     ✓    |    ✓    |
| IOAM cs0 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs0 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs1 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs1 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs2 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs2 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs3 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs3 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs4 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs4 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs5 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs5 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs6 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs6 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs7 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs7 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM duplicate packet counter                        |           |   ✓   |     ✓    |    ✓    |
| iOAM E2E Header                                      |           |   ✓   |     ✓    |    ✓    |
| IOAM highest PPC sequence number                     |           |   ✓   |     ✓    |    ✓    |
| IOAM lost packet counter                             |           |   ✓   |     ✓    |    ✓    |
| iOAM my node name                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM my node-id                                      |           |   ✓   |     ✓    |    ✓    |
| iOAM node-id                                         |           |   ✓   |     ✓    |    ✓    |
| iOAM node1 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node1 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node1 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM node2 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node2 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node2 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM node3 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node3 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node3 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM node4 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node4 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node4 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM number of nodes                                 |           |   ✓   |     ✓    |    ✓    |
| IOAM packet counter                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM Path Map                                        |           |   ✓   |     ✓    |    ✓    |
| IOAM reordered packet counter                        |           |   ✓   |     ✓    |    ✓    |
| iOAM sfc invalidated count                           |           |   ✓   |     ✓    |    ✓    |
| iOAM sfc validated count                             |           |   ✓   |     ✓    |    ✓    |
| iOAM sfc-id                                          |           |   ✓   |     ✓    |    ✓    |
| IPv4 destination observation node                    |           |   ✓   |     ✓    |    ✓    |
| IPv4 source observation node                         |           |   ✓   |     ✓    |    ✓    |
| IPv6 destination observation node                    |           |   ✓   |     ✓    |    ✓    |
| ipv6 protocol filed                                  |           |   ✓   |     ✓    |    ✓    |
| IPv6 source observation node                         |           |   ✓   |     ✓    |    ✓    |
| kth rollup bw                                        |           |   ✓   |     ✓    |    ✓    |
| l4r event                                            |           |   ✓   |     ✓    |    ✓    |
| l4r event timestamp                                  |           |   ✓   |     ✓    |    ✓    |
| l4r server ipv4 address                              |           |   ✓   |     ✓    |    ✓    |
| l4r server ipv6 address                              |           |   ✓   |     ✓    |    ✓    |
| l4r server transport port                            |           |   ✓   |     ✓    |    ✓    |
| link group name                                      |           |   ✓   |     ✓    |    ✓    |
| long-term round-trip-time                            |           |   ✓   |     ✓    |    ✓    |
| max egress bw                                        |           |   ✓   |     ✓    |    ✓    |
| max ingress bw                                       |           |   ✓   |     ✓    |    ✓    |
| metadata clock-rate                                  |           |   ✓   |     ✓    |    ✓    |
| metadata global-session-id                           |           |   ✓   |     ✓    |    ✓    |
| metadata multi-party-session-id                      |           |   ✓   |     ✓    |    ✓    |
| misc unsupported                                     |           |   ✓   |     ✓    |    ✓    |
| monitor device-type                                  |           |   ✓   |     ✓    |    ✓    |
| monitor event                                        |           |   ✓   |     ✓    |    ✓    |
| mos below                                            |           |   ✓   |     ✓    |    ✓    |
| mos quality                                          |           |   ✓   |     ✓    |    ✓    |
| mos total count                                      |           |   ✓   |     ✓    |    ✓    |
| mos worst 100                                        |           |   ✓   |     ✓    |    ✓    |
| network delay sample                                 |           |   ✓   |     ✓    |    ✓    |
| network delay sum                                    |           |   ✓   |     ✓    |    ✓    |
| NETWORK\_DELAY\_AVG network delay average            |           |   ✓   |     ✓    |    ✓    |
| nvzFlowCoordinatesList                               |           |   ✓   |     ✓    |    ✓    |
| nvzFlowDestinationHostname                           |           |   ✓   |     ✓    |    ✓    |
| nvzFlowDNSSuffix                                     |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceDetailsList                          |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceIndex                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceInfoUID                              |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceMac                                  |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceName                                 |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceType                                 |           |   ✓   |     ✓    |    ✓    |
| nvzFlowL4ByteCountIn                                 |           |   ✓   |     ✓    |    ✓    |
| nvzFlowL4ByteCountOut                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowLoggedInUser                                  |           |   ✓   |     ✓    |    ✓    |
| nvzFlowModuleHashList                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowModuleNameList                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowOSEdition                                     |           |   ✓   |     ✓    |    ✓    |
| nvzFlowOSName                                        |           |   ✓   |     ✓    |    ✓    |
| nvzFlowOSVersion                                     |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessAccount                          |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessAccountType                      |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessHash                             |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessName                             |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessAccount                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessAccountType                            |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessHash                                   |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessName                                   |           |   ✓   |     ✓    |    ✓    |
| nvzFlowSystemManufacturer                            |           |   ✓   |     ✓    |    ✓    |
| nvzFlowSystemType                                    |           |   ✓   |     ✓    |    ✓    |
| nvzFlowUDID                                          |           |   ✓   |     ✓    |    ✓    |
| nvzFlowUserAccountType                               |           |   ✓   |     ✓    |    ✓    |
| ONE\_WAY\_DELAY pfr one-way-delay                    |           |   ✓   |     ✓    |    ✓    |
| overlay session id input                             |           |   ✓   |     ✓    |    ✓    |
| overlay session id output                            |           |   ✓   |     ✓    |    ✓    |
| packet arrival timestamp                             |           |   ✓   |     ✓    |    ✓    |
| PACKET\_RATE                                         |           |   ✓   |     ✓    |    ✓    |
| PACKETS\_DROPPED                                     |           |   ✓   |     ✓    |    ✓    |
| pbhk event                                           |           |   ✓   |     ✓    |    ✓    |
| pbhk event timestamp                                 |           |   ✓   |     ✓    |    ✓    |
| pbhk mapped ipv4 address                             |           |   ✓   |     ✓    |    ✓    |
| pbhk mapped transport port                           |           |   ✓   |     ✓    |    ✓    |
| pfr br ipv4 address                                  |           |   ✓   |     ✓    |    ✓    |
| pfr counter event error traffic-class miti           |           |   ✓   |     ✓    |    ✓    |
| pfr counter event error traffic-class miti           |           |   ✓   |     ✓    |    ✓    |
| pfr counter event error traffic-class miti           |           |   ✓   |     ✓    |    ✓    |
| pfr label identifier                                 |           |   ✓   |     ✓    |    ✓    |
| pfr one-way-delay samples                            |           |   ✓   |     ✓    |    ✓    |
| pfr one-way-delay sum                                |           |   ✓   |     ✓    |    ✓    |
| pfr priority                                         |           |   ✓   |     ✓    |    ✓    |
| pfr service provider tag identifier                  |           |   ✓   |     ✓    |    ✓    |
| pfr site destination id ipv4                         |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix ipv4                     |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix ipv6                     |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix mask ipv4                |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix mask ipv6                |           |   ✓   |     ✓    |    ✓    |
| pfr site source id ipv4                              |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix ipv4                          |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix ipv6                          |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix mask ipv4                     |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix mask ipv6                     |           |   ✓   |     ✓    |    ✓    |
| pfr status                                           |           |   ✓   |     ✓    |    ✓    |
| policy qos classification hierarchy                  |           |   ✓   |     ✓    |    ✓    |
| policy qos queue drops                               |           |   ✓   |     ✓    |    ✓    |
| policy qos queue index                               |           |   ✓   |     ✓    |    ✓    |
| reason id                                            |           |   ✓   |     ✓    |    ✓    |
| refused sessions                                     |           |   ✓   |     ✓    |    ✓    |
| retransmitted packets                                |           |   ✓   |     ✓    |    ✓    |
| routing vrf service                                  |           |   ✓   |     ✓    |    ✓    |
| rsvp bw pool                                         |           |   ✓   |     ✓    |    ✓    |
| scAccessString                                       |           |   ✓   |     ✓    |    ✓    |
| scActiveSubscribers                                  |           |   ✓   |     ✓    |    ✓    |
| scAttackId                                           |           |   ✓   |     ✓    |    ✓    |
| scAttackIp                                           |           |   ✓   |     ✓    |    ✓    |
| scAttackIpProtocol                                   |           |   ✓   |     ✓    |    ✓    |
| scAttackMaliciousSessions                            |           |   ✓   |     ✓    |    ✓    |
| scAttackOtherIp                                      |           |   ✓   |     ✓    |    ✓    |
| scAttackPortNumber                                   |           |   ✓   |     ✓    |    ✓    |
| scAttacks                                            |           |   ✓   |     ✓    |    ✓    |
| scAttackSide                                         |           |   ✓   |     ✓    |    ✓    |
| scAttackType                                         |           |   ✓   |     ✓    |    ✓    |
| scBreachState                                        |           |   ✓   |     ✓    |    ✓    |
| scClientPort                                         |           |   ✓   |     ✓    |    ✓    |
| scConcurrentSessions                                 |           |   ✓   |     ✓    |    ✓    |
| scConfiguredDuration                                 |           |   ✓   |     ✓    |    ✓    |
| scDestinationIpSample                                |           |   ✓   |     ✓    |    ✓    |
| scDownstreamVolume                                   |           |   ✓   |     ✓    |    ✓    |
| scDuration                                           |           |   ✓   |     ✓    |    ✓    |
| scEndTime                                            |           |   ✓   |     ✓    |    ✓    |
| scFlavorId                                           |           |   ✓   |     ✓    |    ✓    |
| scFlowCloseMode                                      |           |   ✓   |     ✓    |    ✓    |
| scFlowContextId                                      |           |   ✓   |     ✓    |    ✓    |
| scGeneratorId                                        |           |   ✓   |     ✓    |    ✓    |
| scInfoString                                         |           |   ✓   |     ✓    |    ✓    |
| scInitiatingSide                                     |           |   ✓   |     ✓    |    ✓    |
| scLinkId                                             |           |   ✓   |     ✓    |    ✓    |
| scPackageCounterId                                   |           |   ✓   |     ✓    |    ✓    |
| scPackageId                                          |           |   ✓   |     ✓    |    ✓    |
| scProtocolId                                         |           |   ✓   |     ✓    |    ✓    |
| scProtocolSignature                                  |           |   ✓   |     ✓    |    ✓    |
| scReason                                             |           |   ✓   |     ✓    |    ✓    |
| scReportTime                                         |           |   ✓   |     ✓    |    ✓    |
| scSeconds                                            |           |   ✓   |     ✓    |    ✓    |
| scServerPort                                         |           |   ✓   |     ✓    |    ✓    |
| scServiceGlobalCounterId                             |           |   ✓   |     ✓    |    ✓    |
| scServiceId                                          |           |   ✓   |     ✓    |    ✓    |
| scServiceUsageCounterId                              |           |   ✓   |     ✓    |    ✓    |
| scSessionDownstreamVolume                            |           |   ✓   |     ✓    |    ✓    |
| scSessions                                           |           |   ✓   |     ✓    |    ✓    |
| scSessionUpstreamVolume                              |           |   ✓   |     ✓    |    ✓    |
| scSkipppedSessions                                   |           |   ✓   |     ✓    |    ✓    |
| scSourceIpSample                                     |           |   ✓   |     ✓    |    ✓    |
| scSubscriberCounterId                                |           |   ✓   |     ✓    |    ✓    |
| scSubscriberId                                       |           |   ✓   |     ✓    |    ✓    |
| scTag                                                |           |   ✓   |     ✓    |    ✓    |
| scTimeFrame                                          |           |   ✓   |     ✓    |    ✓    |
| scTotalActiveSubscribers                             |           |   ✓   |     ✓    |    ✓    |
| scTrafficProcessorId                                 |           |   ✓   |     ✓    |    ✓    |
| scTransactionDurationMillisec                        |           |   ✓   |     ✓    |    ✓    |
| scUpstreamVolume                                     |           |   ✓   |     ✓    |    ✓    |
| scZoneId                                             |           |   ✓   |     ✓    |    ✓    |
| sdwan preferred-color-not-met                        |           |   ✓   |     ✓    |    ✓    |
| sdwan qos-queue-id                                   |           |   ✓   |     ✓    |    ✓    |
| sdwan sla-not-met                                    |           |   ✓   |     ✓    |    ✓    |
| server network delay average                         |           |   ✓   |     ✓    |    ✓    |
| server response time average                         |           |   ✓   |     ✓    |    ✓    |
| services pfr class-tag-id                            |           |   ✓   |     ✓    |    ✓    |
| services pfr mc-id                                   |           |   ✓   |     ✓    |    ✓    |
| services waas passthrough-reason                     |           |   ✓   |     ✓    |    ✓    |
| services waas segment                                |           |   ✓   |     ✓    |    ✓    |
| session time average                                 |           |   ✓   |     ✓    |    ✓    |
| session time maximum                                 |           |   ✓   |     ✓    |    ✓    |
| session time minimum                                 |           |   ✓   |     ✓    |    ✓    |
| SGT\_DESTINATION\_NAME                               |           |   ✓   |     ✓    |    ✓    |
| SGT\_DESTINATION\_TAG                                |           |   ✓   |     ✓    |    ✓    |
| SGT\_SOURCE\_NAME                                    |           |   ✓   |     ✓    |    ✓    |
| SGT\_SOURCE\_TAG                                     |           |   ✓   |     ✓    |    ✓    |
| sip header from uri host ip addr                     |           |   ✓   |     ✓    |    ✓    |
| sip header from uri userinfo user                    |           |   ✓   |     ✓    |    ✓    |
| sip header to uri host ip addr                       |           |   ✓   |     ✓    |    ✓    |
| sip header to uri userinfo user                      |           |   ✓   |     ✓    |    ✓    |
| sip sess duration                                    |           |   ✓   |     ✓    |    ✓    |
| sip sess end\_reason                                 |           |   ✓   |     ✓    |    ✓    |
| sip sess\_connected                                  |           |   ✓   |     ✓    |    ✓    |
| sip sess\_dialed                                     |           |   ✓   |     ✓    |    ✓    |
| sip sess\_failed                                     |           |   ✓   |     ✓    |    ✓    |
| start timestamp                                      |           |   ✓   |     ✓    |    ✓    |
| tcpWindowSizeSum                                     |           |   ✓   |     ✓    |    ✓    |
| threshold                                            |           |   ✓   |     ✓    |    ✓    |
| timestamp interval                                   |           |   ✓   |     ✓    |    ✓    |
| timestampAbsoluteMonitoring-intervalEnd              |           |   ✓   |     ✓    |    ✓    |
| timestampAbsoluteMonitoring-intervalStart            |           |   ✓   |     ✓    |    ✓    |
| tloc local color                                     |           |   ✓   |     ✓    |    ✓    |
| tloc local system ip address                         |           |   ✓   |     ✓    |    ✓    |
| tloc remote color                                    |           |   ✓   |     ✓    |    ✓    |
| tloc remote system ip address                        |           |   ✓   |     ✓    |    ✓    |
| tloc table overlay session id                        |           |   ✓   |     ✓    |    ✓    |
| tloc tunnel protocol                                 |           |   ✓   |     ✓    |    ✓    |
| transaction time average                             |           |   ✓   |     ✓    |    ✓    |
| transport bytes expected                             |           |   ✓   |     ✓    |    ✓    |
| transport bytes lost                                 |           |   ✓   |     ✓    |    ✓    |
| transport bytes lost rate                            |           |   ✓   |     ✓    |    ✓    |
| transport bytes out-of-order                         |           |   ✓   |     ✓    |    ✓    |
| transport destination-port max                       |           |   ✓   |     ✓    |    ✓    |
| transport destination-port min                       |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter                  |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter max              |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter min              |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter perman           |           |   ✓   |     ✓    |    ✓    |
| transport packets expected counter                   |           |   ✓   |     ✓    |    ✓    |
| transport packets expected counter permane           |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter                       |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter max                   |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter min                   |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter permanent             |           |   ✓   |     ✓    |    ✓    |
| transport packets lost rate                          |           |   ✓   |     ✓    |    ✓    |
| transport packets lost rate max                      |           |   ✓   |     ✓    |    ✓    |
| transport packets lost rate min                      |           |   ✓   |     ✓    |    ✓    |
| transport packets out-of-order                       |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time                            |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time max                        |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time min                        |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time samples                    |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time sum                        |           |   ✓   |     ✓    |    ✓    |
| transport rtp flow count                             |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter inter arrival mean              |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter inter arrival samples           |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter inter arrival sum               |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter maximum                         |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter mean                            |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter mean sum                        |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter minimum                         |           |   ✓   |     ✓    |    ✓    |
| transport rtp payload-type                           |           |   ✓   |     ✓    |    ✓    |
| transport rtp sequence-number                        |           |   ✓   |     ✓    |    ✓    |
| transport rtp sequence-number last                   |           |   ✓   |     ✓    |    ✓    |
| transport rtp ssrc                                   |           |   ✓   |     ✓    |    ✓    |
| transport source-port max                            |           |   ✓   |     ✓    |    ✓    |
| transport source-port min                            |           |   ✓   |     ✓    |    ✓    |
| transport tcp flow count                             |           |   ✓   |     ✓    |    ✓    |
| transport tcp maximum-segment-size                   |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size average                    |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size average sum                |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size maximum                    |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size minimum                    |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size sum                        |           |   ✓   |     ✓    |    ✓    |
| unresponsive sessions                                |           |   ✓   |     ✓    |    ✓    |
| vxlan flags                                          |           |   ✓   |     ✓    |    ✓    |
| vxlan sgt                                            |           |   ✓   |     ✓    |    ✓    |
| vxlan vtep input                                     |           |   ✓   |     ✓    |    ✓    |
| vxlan vtep output                                    |           |   ✓   |     ✓    |    ✓    |
| waas application                                     |           |   ✓   |     ✓    |    ✓    |
| waas bytes input                                     |           |   ✓   |     ✓    |    ✓    |
| waas bytes output                                    |           |   ✓   |     ✓    |    ✓    |
| waas class                                           |           |   ✓   |     ✓    |    ✓    |
| waas connection mode                                 |           |   ✓   |     ✓    |    ✓    |
| waas dre input                                       |           |   ✓   |     ✓    |    ✓    |
| waas dre output                                      |           |   ✓   |     ✓    |    ✓    |
| waas lz input                                        |           |   ✓   |     ✓    |    ✓    |
| waas lz output                                       |           |   ✓   |     ✓    |    ✓    |
| waas optimised bytes                                 |           |   ✓   |     ✓    |    ✓    |
| waas original bytes                                  |           |   ✓   |     ✓    |    ✓    |
| wireless afd accept bytes                            |           |   ✓   |     ✓    |    ✓    |
| wireless afd accept packets                          |           |   ✓   |     ✓    |    ✓    |
| wireless afd drop bytes                              |           |   ✓   |     ✓    |    ✓    |
| wireless afd drop packets                            |           |   ✓   |     ✓    |    ✓    |
| wlan\_id                                             |           |   ✓   |     ✓    |    ✓    |
| XLATE\_DST\_ADDR\_IPV4                               |           |   ✓   |     ✓    |    ✓    |
| XLATE\_DST\_PORT                                     |           |   ✓   |     ✓    |    ✓    |
| XLATE\_SRC\_ADDR\_IPV4                               |           |   ✓   |     ✓    |    ✓    |
| XLATE\_SRC\_PORT                                     |           |   ✓   |     ✓    |    ✓    |

#### Ericsson (PEN: 193)

| Name                                    | Community | Basic | Standard | Premium |
| --------------------------------------- | :-------: | :---: | :------: | :-----: |
| NAT\_LOG\_FIELD\_IDX\_ASSIGN\_TS\_SEC   |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_CONTEXT\_ID       |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_CONTEXT\_NAME     |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_EXT\_PORT\_FIRST  |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_EXT\_PORT\_LAST   |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_IPV4\_EXT\_ADDR   |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_IPV4\_INT\_ADDR   |           |   ✓   |     ✓    |    ✓    |
| NAT\_LOG\_FIELD\_IDX\_UNASSIGN\_TS\_SEC |           |   ✓   |     ✓    |    ✓    |

#### StreamCORE (PEN: 4056)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| call\_direction        |           |   ✓   |     ✓    |    ✓    |
| codec\_in              |           |   ✓   |     ✓    |    ✓    |
| codec\_out             |           |   ✓   |     ✓    |    ✓    |
| hostname               |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_1            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_10           |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_2            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_3            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_4            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_5            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_6            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_7            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_8            |           |   ✓   |     ✓    |    ✓    |
| id\_rule\_9            |           |   ✓   |     ✓    |    ✓    |
| mos\_lq                |           |   ✓   |     ✓    |    ✓    |
| net\_app\_resp\_time   |           |   ✓   |     ✓    |    ✓    |
| net\_delay             |           |   ✓   |     ✓    |    ✓    |
| net\_discard           |           |   ✓   |     ✓    |    ✓    |
| net\_jitter            |           |   ✓   |     ✓    |    ✓    |
| net\_loss              |           |   ✓   |     ✓    |    ✓    |
| rtp\_clockrate\_in     |           |   ✓   |     ✓    |    ✓    |
| rtp\_clockrate\_out    |           |   ✓   |     ✓    |    ✓    |
| ssl\_cn                |           |   ✓   |     ✓    |    ✓    |
| ssl\_org               |           |   ✓   |     ✓    |    ✓    |
| tcp\_retrans\_rate     |           |   ✓   |     ✓    |    ✓    |
| total\_app\_resp\_time |           |   ✓   |     ✓    |    ✓    |
| url                    |           |   ✓   |     ✓    |    ✓    |
| wan\_rtt               |           |   ✓   |     ✓    |    ✓    |

#### Riverbed (PEN: 4321)

| Name                     | Community | Basic | Standard | Premium |
| ------------------------ | :-------: | :---: | :------: | :-----: |
| CFE in-path IP Address   |           |   ✓   |     ✓    |    ✓    |
| CFE TCP Port             |           |   ✓   |     ✓    |    ✓    |
| FE Type                  |           |   ✓   |     ✓    |    ✓    |
| Outer in-path IP Address |           |   ✓   |     ✓    |    ✓    |
| Outer TCP Port           |           |   ✓   |     ✓    |    ✓    |
| Pass-through Reason      |           |   ✓   |     ✓    |    ✓    |
| Retransmitted Bytes      |           |   ✓   |     ✓    |    ✓    |
| Retransmitted Packets    |           |   ✓   |     ✓    |    ✓    |
| SFE in-path IP Address   |           |   ✓   |     ✓    |    ✓    |
| SFE TCP Port             |           |   ✓   |     ✓    |    ✓    |
| TCP Connection RTT       |           |   ✓   |     ✓    |    ✓    |
| WAN Visibility mode      |           |   ✓   |     ✓    |    ✓    |

#### LANcope, now Cisco (PEN: 8712)

| Name                                  | Community | Basic | Standard | Premium |
| ------------------------------------- | :-------: | :---: | :------: | :-----: |
| EndpointFlowParentProcessAccount      |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowParentProcessHash         |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowParentProcessName         |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowProcessAccount            |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowProcessHash               |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowProcessName               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorApplicationDetails          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorApplicationIdentifier       |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagBadRST               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagNoACK                |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagNoFlag               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagSYNFIN               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagURG                  |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagXmas                 |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailIn          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailInMessages  |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailInTrys      |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailOut         |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailOutMessages |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailOutTrys     |           |   ✓   |     ✓    |    ✓    |
| FlowSensorEmbeddedICMPCode            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorEmbeddedICMPProtocol        |           |   ✓   |     ✓    |    ✓    |
| FlowSensorEmbeddedICMPType            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorFragPacketDifferentSizes    |           |   ✓   |     ✓    |    ✓    |
| FlowSensorFragPacketTooLong           |           |   ✓   |     ✓    |    ✓    |
| FlowSensorFragPacketTooShort          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorInitiator                   |           |   ✓   |     ✓    |    ✓    |
| FlowSensorRetransmits                 |           |   ✓   |     ✓    |    ✓    |
| FlowSensorRoundTripTime               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorServerResponseTime          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorShortFragAttack             |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailIn               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailInMessages       |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailInTrys           |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailOut              |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailOutMessages      |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailOutTrys          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPBadTotalCount            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPFragTotalCount           |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPSRSTotalCount            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPSYNACKTotalCount         |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTraces                      |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTrustsecSourceIdentifier    |           |   ✓   |     ✓    |    ✓    |

#### Palo Alto (PEN: 25461)

| Name    | Community | Basic | Standard | Premium |
| ------- | :-------: | :---: | :------: | :-----: |
| App-ID  |           |   ✓   |     ✓    |    ✓    |
| User-ID |           |   ✓   |     ✓    |    ✓    |

#### FastIP/Boundary (PEN: 33610)

| Name                                  | Community | Basic | Standard | Premium |
| ------------------------------------- | :-------: | :---: | :------: | :-----: |
| APP\_RTT\_USEC                        |           |   ✓   |     ✓    |    ✓    |
| BOND\_INTERFACE\_ID                   |           |   ✓   |     ✓    |    ✓    |
| BOND\_INTERFACE\_MODE                 |           |   ✓   |     ✓    |    ✓    |
| BOND\_INTERFACE\_PHYSICAL\_NIC\_COUNT |           |   ✓   |     ✓    |    ✓    |
| COLLISIONS                            |           |   ✓   |     ✓    |    ✓    |
| EPOCH\_SECOND                         |           |   ✓   |     ✓    |    ✓    |
| ERRORS                                |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_DISTRIBUTION\_NAME         |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_MACHINE                    |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_NODENAME                   |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_RELEASE                    |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_SYSNAME                    |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_VERSION                    |           |   ✓   |     ✓    |    ✓    |
| METER\_VERSION                        |           |   ✓   |     ✓    |    ✓    |
| NIC\_DRIVER\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| NIC\_DRIVER\_VERSION                  |           |   ✓   |     ✓    |    ✓    |
| NIC\_FIRMWARE\_VERSION                |           |   ✓   |     ✓    |    ✓    |
| NIC\_ID                               |           |   ✓   |     ✓    |    ✓    |
| NIC\_IP                               |           |   ✓   |     ✓    |    ✓    |
| NIC\_MAC                              |           |   ✓   |     ✓    |    ✓    |
| NIC\_NAME                             |           |   ✓   |     ✓    |    ✓    |
| TCP\_FLAGS                            |           |   ✓   |     ✓    |    ✓    |
| TCP\_HANDSHAKE\_RTT\_USEC             |           |   ✓   |     ✓    |    ✓    |

#### ntop (PEN: 35632)

| Name                                | Community | Basic | Standard | Premium |
| ----------------------------------- | :-------: | :---: | :------: | :-----: |
| APPL\_LATENCY\_MS                   |           |   ✓   |     ✓    |    ✓    |
| APPLICATION\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| BITTORRENT\_HASH                    |           |   ✓   |     ✓    |    ✓    |
| CLIENT\_NW\_LATENCY\_MS             |           |   ✓   |     ✓    |    ✓    |
| CLIENT\_TCP\_FLAGS                  |           |   ✓   |     ✓    |    ✓    |
| CUMULATIVE\_ICMP\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| DHCP\_CLIENT\_IP                    |           |   ✓   |     ✓    |    ✓    |
| DHCP\_CLIENT\_MAC                   |           |   ✓   |     ✓    |    ✓    |
| DHCP\_CLIENT\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| DHCP\_MESSAGE\_TYPE                 |           |   ✓   |     ✓    |    ✓    |
| DHCP\_REMOTE\_ID                    |           |   ✓   |     ✓    |    ✓    |
| DHCP\_SUBSCRIBER\_ID                |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLED\_PARTY\_ADDRESS    |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLED\_STATION\_ID       |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLING\_PARTY\_ADDRESS   |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLING\_STATION\_ID      |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CLR\_CANCEL\_TYPE         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CLR\_FLAGS                |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_EXP\_RES\_RESULT\_CODE    |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_EXP\_RES\_VENDOR\_ID      |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_FRAMED\_IP\_ADDR          |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_HOP\_BY\_HOP\_ID          |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_PDP\_ADDR                 |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_REQ\_MSG\_TYPE            |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_REQ\_ORIGIN\_HOST         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_REQ\_USER\_NAME           |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_RSP\_MSG\_TYPE            |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_RSP\_ORIGIN\_HOST         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_RSP\_RESULT\_CODE         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_SERVED\_IP\_ADDR          |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_SUBSCRIPTION\_ID          |           |   ✓   |     ✓    |    ✓    |
| DICOM\_DEVICE\_SERIAL               |           |   ✓   |     ✓    |    ✓    |
| DICOM\_IMPL\_UID                    |           |   ✓   |     ✓    |    ✓    |
| DICOM\_IMPL\_VERSION                |           |   ✓   |     ✓    |    ✓    |
| DICOM\_INST\_ADDR                   |           |   ✓   |     ✓    |    ✓    |
| DICOM\_INST\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| DICOM\_MANUFACTURER                 |           |   ✓   |     ✓    |    ✓    |
| DICOM\_MODALITY                     |           |   ✓   |     ✓    |    ✓    |
| DICOM\_STATION\_NAME                |           |   ✓   |     ✓    |    ✓    |
| DICOM\_SW\_VERSION                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_NUM\_ANSWERS                   |           |   ✓   |     ✓    |    ✓    |
| DNS\_QUERY                          |           |   ✓   |     ✓    |    ✓    |
| DNS\_QUERY\_ID                      |           |   ✓   |     ✓    |    ✓    |
| DNS\_QUERY\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_RESPONSE                       |           |   ✓   |     ✓    |    ✓    |
| DNS\_RET\_CODE                      |           |   ✓   |     ✓    |    ✓    |
| DNS\_TTL\_ANSWER                    |           |   ✓   |     ✓    |    ✓    |
| DOWNSTREAM\_SESSION\_ID             |           |   ✓   |     ✓    |    ✓    |
| DOWNSTREAM\_TUNNEL\_ID              |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_MAP                        |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_1                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_10                   |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_2                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_3                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_4                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_5                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_6                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_7                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_8                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_9                    |           |   ✓   |     ✓    |    ✓    |
| DST\_FATHER\_PROC\_NAME             |           |   ✓   |     ✓    |    ✓    |
| DST\_FATHER\_PROC\_PID              |           |   ✓   |     ✓    |    ✓    |
| DST\_FRAGMENTS                      |           |   ✓   |     ✓    |    ✓    |
| DST\_HOST\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_CITY                       |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_COUNTRY                    |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_LAT                        |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_LONG                       |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_ACTUAL\_MEMORY           |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_AVERAGE\_CPU\_LOAD       |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_NUM\_PAGE\_FAULTS        |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_PCTG\_IOWAIT             |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_PEAK\_MEMORY             |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_PID                      |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_UID                      |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_USER\_NAME               |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_AVG\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_MAX\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_MIN\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_SECOND\_BYTES         |           |   ✓   |     ✓    |    ✓    |
| DURATION\_IN                        |           |   ✓   |     ✓    |    ✓    |
| DURATION\_OUT                       |           |   ✓   |     ✓    |    ✓    |
| ENTROPY\_CLIENT\_BYTES              |           |   ✓   |     ✓    |    ✓    |
| ENTROPY\_SERVER\_BYTES              |           |   ✓   |     ✓    |    ✓    |
| EPP\_CMD                            |           |   ✓   |     ✓    |    ✓    |
| EPP\_CMD\_ARGS                      |           |   ✓   |     ✓    |    ✓    |
| EPP\_REASON\_STR                    |           |   ✓   |     ✓    |    ✓    |
| EPP\_REGISTRAR\_NAME                |           |   ✓   |     ✓    |    ✓    |
| EPP\_RSP\_CODE                      |           |   ✓   |     ✓    |    ✓    |
| EPP\_SERVER\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| FLOW\_PROTO\_PORT                   |           |   ✓   |     ✓    |    ✓    |
| FLOW\_SERVER\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| FLOW\_USER\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| FTP\_COMMAND                        |           |   ✓   |     ✓    |    ✓    |
| FTP\_COMMAND\_RET\_CODE             |           |   ✓   |     ✓    |    ✓    |
| FTP\_LOGIN                          |           |   ✓   |     ✓    |    ✓    |
| FTP\_PASSWORD                       |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_APN\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_END\_USER\_IP                |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_END\_USER\_MSISDN            |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_CELL\_LAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_CELL\_RAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_REQ\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RESPONSE\_CAUSE              |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RSP\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_TID                          |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_APN\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_C2S\_TEID\_CTRL              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_C2S\_TEID\_DATA              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_IMEI              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_IMSI              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_IP                |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_MSISDN            |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_LAC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_RAC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAT\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_REQ\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RESPONSE\_CAUSE              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RSP\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_S2C\_TEID\_CTRL              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_S2C\_TEID\_DATA              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_CELL\_CI                |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_CELL\_LAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_SAC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_APN\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S1U\_GTPU\_IP           |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S1U\_GTPU\_TEID         |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_GTPC\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_GTPU\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_GTPU\_TEID      |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_SGW\_GTPU\_IP   |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_SGW\_GTPU\_TEID |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_END\_USER\_IMEI              |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_END\_USER\_IMSI              |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_END\_USER\_MSISDN            |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_PDN\_IP                      |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_RAT\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_REQ\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_RESPONSE\_CAUSE              |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_RSP\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S1U\_GTPU\_IP           |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S1U\_GTPU\_TEID         |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_GTPC\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_GTPU\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_GTPU\_TEID      |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_SGW\_GTPU\_IP   |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_SGW\_GTPU\_TEID |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S5\_S8\_GTPC\_TEID           |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_CELL\_ID                |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_CELL\_TAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| HASSH\_CLIENT                       |           |   ✓   |     ✓    |    ✓    |
| HASSH\_SERVER                       |           |   ✓   |     ✓    |    ✓    |
| HTTP\_HOST                          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_METHOD                        |           |   ✓   |     ✓    |    ✓    |
| HTTP\_MIME                          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REFERER                       |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RET\_CODE                     |           |   ✓   |     ✓    |    ✓    |
| HTTP\_SITE                          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_UA                            |           |   ✓   |     ✓    |    ✓    |
| HTTP\_URL                           |           |   ✓   |     ✓    |    ✓    |
| HTTP\_VIA                           |           |   ✓   |     ✓    |    ✓    |
| HTTP\_X\_FORWARDED\_FOR             |           |   ✓   |     ✓    |    ✓    |
| IMAP\_LOGIN                         |           |   ✓   |     ✓    |    ✓    |
| IN\_SRC\_OSI\_SAP                   |           |   ✓   |     ✓    |    ✓    |
| JA3C\_HASH                          |           |   ✓   |     ✓    |    ✓    |
| JA3S\_HASH                          |           |   ✓   |     ✓    |    ✓    |
| L4\_DST\_PORT\_MAP                  |           |   ✓   |     ✓    |    ✓    |
| L4\_SRC\_PORT\_MAP                  |           |   ✓   |     ✓    |    ✓    |
| L4\_SRV\_PORT                       |           |   ✓   |     ✓    |    ✓    |
| L4\_SRV\_PORT\_MAP                  |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO                           |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO                           |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO\_CATEGORY                 |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| LONGEST\_FLOW\_PKT                  |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_APPL\_LATENCY\_USEC          |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_DB                           |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_QUERY                        |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_RESPONSE                     |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_SERVER\_VERSION              |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_USERNAME                     |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_QUERY\_NAME                |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_QUERY\_OS                  |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_QUERY\_TYPE                |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_RESPONSE                   |           |   ✓   |     ✓    |    ✓    |
| NPROBE\_IPV4\_ADDRESS               |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_1024\_TO\_1514\_BYTES    |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_128\_TO\_256\_BYTES      |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_256\_TO\_512\_BYTES      |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_512\_TO\_1024\_BYTES     |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_OVER\_1514\_BYTES        |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_128\_160            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_160\_192            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_192\_224            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_2\_5                |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_224\_255            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_5\_32               |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_64\_96              |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_64\_96              |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_96\_128             |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_EQ\_1               |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_UP\_TO\_128\_BYTES       |           |   ✓   |     ✓    |    ✓    |
| OOORDER\_IN\_PKTS                   |           |   ✓   |     ✓    |    ✓    |
| OOORDER\_OUT\_PKTS                  |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_QUERY                       |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_QUERY\_DURATION             |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_RSP\_CODE                   |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_RSP\_STRING                 |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_USERNAME                    |           |   ✓   |     ✓    |    ✓    |
| OUT\_DST\_OSI\_SAP                  |           |   ✓   |     ✓    |    ✓    |
| PAYLOAD\_HASH                       |           |   ✓   |     ✓    |    ✓    |
| PKT\_VECTOR                         |           |   ✓   |     ✓    |    ✓    |
| PLUGIN\_NAME                        |           |   ✓   |     ✓    |    ✓    |
| POP\_USER                           |           |   ✓   |     ✓    |    ✓    |
| PROTOCOL\_MAP                       |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_IN\_OCTETS            |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_IN\_PKTS              |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_OUT\_OCTETS           |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_OUT\_PKTS             |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_SESSION\_ID           |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_STATUS\_TYPE          |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_CALLED\_STATION\_ID         |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_CALLING\_STATION\_ID        |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_FRAMED\_IP\_ADDR            |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_NAS\_IDENTIFIER             |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_NAS\_IP\_ADDR               |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_REQ\_MSG\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_RSP\_MSG\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_USER\_IMEI                  |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_USER\_IMSI                  |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_USER\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_IN\_BYTES            |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_IN\_PKTS             |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_OUT\_BYTES           |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_OUT\_PKTS            |           |   ✓   |     ✓    |    ✓    |
| RTP\_DTMF\_TONES                    |           |   ✓   |     ✓    |    ✓    |
| RTP\_FIRST\_SEQ                     |           |   ✓   |     ✓    |    ✓    |
| RTP\_FIRST\_TS                      |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_JITTER                     |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_MAX\_DELTA                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_MOS                        |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_PAYLOAD\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_PKT\_DROP                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_PKT\_LOST                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_R\_FACTOR                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_TRANSIT                    |           |   ✓   |     ✓    |    ✓    |
| RTP\_LAST\_SEQ                      |           |   ✓   |     ✓    |    ✓    |
| RTP\_LAST\_TS                       |           |   ✓   |     ✓    |    ✓    |
| RTP\_MOS                            |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_JITTER                    |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_MAX\_DELTA                |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_MOS                       |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_PAYLOAD\_TYPE             |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_PKT\_DROP                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_PKT\_LOST                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_R\_FACTOR                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_TRANSIT                   |           |   ✓   |     ✓    |    ✓    |
| RTP\_R\_FACTOR                      |           |   ✓   |     ✓    |    ✓    |
| RTP\_RTT                            |           |   ✓   |     ✓    |    ✓    |
| RTP\_SIP\_CALL\_ID                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_SSRC                           |           |   ✓   |     ✓    |    ✓    |
| S1AP\_CAUSE\_ENB\_TO\_MME           |           |   ✓   |     ✓    |    ✓    |
| S1AP\_DETAILED\_CAUSE\_ENB\_TO\_MME |           |   ✓   |     ✓    |    ✓    |
| S1AP\_ENB\_UE\_S1AP\_ID             |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MME\_UE\_S1AP\_ID             |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_EMM\_TYPE\_ENB\_TO\_MME  |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_EMM\_TYPE\_MME\_TO\_ENB  |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_ESM\_TYPE\_ENB\_TO\_MME  |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_ESM\_TYPE\_MME\_TO\_ENB  |           |   ✓   |     ✓    |    ✓    |
| SEQ\_PLEN                           |           |   ✓   |     ✓    |    ✓    |
| SEQ\_PLEN\_HASH                     |           |   ✓   |     ✓    |    ✓    |
| SEQ\_TDIFF                          |           |   ✓   |     ✓    |    ✓    |
| SEQ\_TDIFF\_HASH                    |           |   ✓   |     ✓    |    ✓    |
| SERVER\_NW\_LATENCY\_MS             |           |   ✓   |     ✓    |    ✓    |
| SERVER\_TCP\_FLAGS                  |           |   ✓   |     ✓    |    ✓    |
| SHORTEST\_FLOW\_PKT                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_BYE\_OK\_TIME                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_BYE\_TIME                      |           |   ✓   |     ✓    |    ✓    |
| SIP\_C\_IP                          |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALL\_ID                       |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALL\_STATE                    |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALLED\_PARTY                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALLING\_PARTY                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_CANCEL\_OK\_TIME               |           |   ✓   |     ✓    |    ✓    |
| SIP\_CANCEL\_TIME                   |           |   ✓   |     ✓    |    ✓    |
| SIP\_INVITE\_FAILURE\_TIME          |           |   ✓   |     ✓    |    ✓    |
| SIP\_INVITE\_OK\_TIME               |           |   ✓   |     ✓    |    ✓    |
| SIP\_INVITE\_TIME                   |           |   ✓   |     ✓    |    ✓    |
| SIP\_REASON\_CAUSE                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_RESPONSE\_CODE                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_RINGING\_TIME                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_CODECS                    |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_IPV4\_DST\_ADDR           |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_IPV4\_SRC\_ADDR           |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_L4\_DST\_PORT             |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_L4\_SRC\_PORT             |           |   ✓   |     ✓    |    ✓    |
| SIP\_TRYING\_TIME                   |           |   ✓   |     ✓    |    ✓    |
| SIP\_UAC                            |           |   ✓   |     ✓    |    ✓    |
| SIP\_UAS                            |           |   ✓   |     ✓    |    ✓    |
| SMTP\_MAIL\_FROM                    |           |   ✓   |     ✓    |    ✓    |
| SMTP\_RCPT\_TO                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_MAP                        |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_1                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_10                   |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_2                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_3                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_4                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_5                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_6                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_7                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_8                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_9                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_FATHER\_PROC\_NAME             |           |   ✓   |     ✓    |    ✓    |
| SRC\_FATHER\_PROC\_PID              |           |   ✓   |     ✓    |    ✓    |
| SRC\_FRAGMENTS                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_HOST\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_CITY                       |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_COUNTRY                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_LAT                        |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_LONG                       |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_ACTUAL\_MEMORY           |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_AVERAGE\_CPU\_LOAD       |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_NUM\_PAGE\_FAULTS        |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_PCTG\_IOWAIT             |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_PEAK\_MEMORY             |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_PID                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_UID                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_USER\_NAME               |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_AVG\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_MAX\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_MIN\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_SECOND\_BYTES         |           |   ✓   |     ✓    |    ✓    |
| SSDP\_HOST                          |           |   ✓   |     ✓    |    ✓    |
| SSDP\_METHOD                        |           |   ✓   |     ✓    |    ✓    |
| SSDP\_SERVER                        |           |   ✓   |     ✓    |    ✓    |
| SSDP\_TYPE                          |           |   ✓   |     ✓    |    ✓    |
| SSDP\_USN                           |           |   ✓   |     ✓    |    ✓    |
| SSL\_CIPHER                         |           |   ✓   |     ✓    |    ✓    |
| SSL\_SERVER\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| SSL\_UNSAFE\_CIPHER                 |           |   ✓   |     ✓    |    ✓    |
| SSL\_VERSION                        |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MAX\_IN                   |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MAX\_OUT                  |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MIN\_IN                   |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MIN\_OUT                  |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MSS\_IN                   |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MSS\_OUT                  |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_SCALE\_IN                 |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_SCALE\_OUT                |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV4\_DST\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV4\_SRC\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV6\_DST\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV6\_SRC\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_L4\_DST\_PORT           |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_L4\_SRC\_PORT           |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_PROTOCOL                |           |   ✓   |     ✓    |    ✓    |
| UPSTREAM\_SESSION\_ID               |           |   ✓   |     ✓    |    ✓    |
| UPSTREAM\_TUNNEL\_ID                |           |   ✓   |     ✓    |    ✓    |
| USER\_NAME                          |           |   ✓   |     ✓    |    ✓    |
| WHOIS\_DAS\_DOMAIN                  |           |   ✓   |     ✓    |    ✓    |

#### A10 Networks (PEN: 40842)

| Name                       | Community | Basic | Standard | Premium |
| -------------------------- | :-------: | :---: | :------: | :-----: |
| cgn-flow-direction         |           |   ✓   |     ✓    |    ✓    |
| Custom1                    |           |   ✓   |     ✓    |    ✓    |
| Custom2                    |           |   ✓   |     ✓    |    ✓    |
| Custom3                    |           |   ✓   |     ✓    |    ✓    |
| DestZone                   |           |   ✓   |     ✓    |    ✓    |
| flowDurationMilliseconds64 |           |   ✓   |     ✓    |    ✓    |
| fwDenyReset                |           |   ✓   |     ✓    |    ✓    |
| fwdTupleType               |           |   ✓   |     ✓    |    ✓    |
| fwdVNPID                   |           |   ✓   |     ✓    |    ✓    |
| mobileIMEI                 |           |   ✓   |     ✓    |    ✓    |
| revTupleType               |           |   ✓   |     ✓    |    ✓    |
| revVNPID                   |           |   ✓   |     ✓    |    ✓    |
| RuleName                   |           |   ✓   |     ✓    |    ✓    |
| RuleSetName                |           |   ✓   |     ✓    |    ✓    |
| SourceZone                 |           |   ✓   |     ✓    |    ✓    |


# IPFIX IEs

NetObserv Flow supports 4284 unique IPFIX information elements (IE).

|   PEN | Vendor                                      | IEs |
| ----: | ------------------------------------------- | --: |
|     0 | IANA                                        | 462 |
|     9 | Cisco                                       | 581 |
|   568 | NetQuest                                    | 110 |
|   637 | Nokia (was Alcatel-Lucent)                  | 139 |
|  1916 | Extreme Networks                            |  13 |
|  2428 | UNINETT                                     |  30 |
|  2636 | Juniper Networks                            |   5 |
|  3054 | Ixia Communications                         | 153 |
|  5951 | Citrix Systems (was Netscaler)              | 469 |
|  6321 | Calix Networks                              | 516 |
|  6871 | CERT Coordination Center                    | 269 |
|  6876 | VMware                                      |  30 |
|  8057 | CESNET                                      |  81 |
|  8712 | LANcope (Cisco)                             |  43 |
|  8741 | SonicWALL                                   | 160 |
|  9789 | Sophos (was Astaro AG)                      |   3 |
| 10704 | Barracuda Networks (was phion)              |  12 |
| 12276 | F5 Networks                                 |  91 |
| 12325 | Fraunhofer FOKUS                            | 111 |
| 12559 | INRIA                                       |  10 |
| 13745 | Plixer                                      |  33 |
| 15397 | Sandvine (was Procera Networks / Netintact) |  67 |
| 16982 | Masaryk University                          |  63 |
| 21373 | netfilter/iptables project                  |   2 |
| 25461 | Palo Alto Networks                          |   2 |
| 26866 | Gigamon Systems                             |  72 |
| 29305 | IPFIX Reverse Information Elements          | 409 |
| 32182 | Cubro                                       |   1 |
| 32622 | CACE Technologies                           |  12 |
| 33610 | FastIP / Boundary                           |  23 |
| 35566 | trammell.ch                                 |  30 |
| 35632 | ntop                                        | 370 |
| 39499 | INVEA-TECH / FlowMon Networks               | 196 |
| 40842 | A10 Networks                                |  15 |
| 41916 | vIPtela (Cisco)                             |   2 |
| 42359 | Versa Networks                              |   4 |
| 43874 | pmacct                                      |   4 |
| 44237 | Allegro Packets                             |   2 |
| 44619 | Ziften Technologies                         |  18 |
| 44913 | RedSocks                                    |   9 |
| 45346 | Velocloud Networks (VMware)                 |  24 |
| 45480 | Cognitix                                    |  27 |
| 45956 | Juniper Networks (was 128 Technology)       |  13 |
| 47269 | Pluribus Networks                           |   1 |
| 47729 | Niagara Networks                            |  86 |
| 51886 | Pensando Systems                            |  13 |
| 56506 | Project Antrea (VMware)                     |  48 |

### Standards-based IEs (PEN: 0)

|  ID | Name                                     | Community | Basic | Standard | Premium |
| --: | ---------------------------------------- | :-------: | :---: | :------: | :-----: |
|   1 | octetDeltaCount                          |     ✓     |   ✓   |     ✓    |    ✓    |
|   2 | packetDeltaCount                         |     ✓     |   ✓   |     ✓    |    ✓    |
|   3 | deltaFlowCount                           |     ✓     |   ✓   |     ✓    |    ✓    |
|   4 | protocolIdentifier                       |     ✓     |   ✓   |     ✓    |    ✓    |
|   5 | ipClassOfService                         |     ✓     |   ✓   |     ✓    |    ✓    |
|   6 | tcpControlBits                           |     ✓     |   ✓   |     ✓    |    ✓    |
|   7 | sourceTransportPort                      |     ✓     |   ✓   |     ✓    |    ✓    |
|   8 | sourceIPv4Address                        |     ✓     |   ✓   |     ✓    |    ✓    |
|   9 | sourceIPv4PrefixLength                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  10 | ingressInterface                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  11 | destinationTransportPort                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  12 | destinationIPv4Address                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  13 | destinationIPv4PrefixLength              |     ✓     |   ✓   |     ✓    |    ✓    |
|  14 | egressInterface                          |     ✓     |   ✓   |     ✓    |    ✓    |
|  15 | ipNextHopIPv4Address                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  16 | bgpSourceAsNumber                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  17 | bgpDestinationAsNumber                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  18 | bgpNextHopIPv4Address                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  19 | postMCastPacketDeltaCount                |     ✓     |   ✓   |     ✓    |    ✓    |
|  20 | postMCastOctetDeltaCount                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  21 | flowEndSysUpTime                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  22 | flowStartSysUpTime                       |     ✓     |   ✓   |     ✓    |    ✓    |
|  23 | postOctetDeltaCount                      |     ✓     |   ✓   |     ✓    |    ✓    |
|  24 | postPacketDeltaCount                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  25 | minimumIpTotalLength                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  26 | maximumIpTotalLength                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  27 | sourceIPv6Address                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  28 | destinationIPv6Address                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  29 | sourceIPv6PrefixLength                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  30 | destinationIPv6PrefixLength              |     ✓     |   ✓   |     ✓    |    ✓    |
|  31 | flowLabelIPv6                            |     ✓     |   ✓   |     ✓    |    ✓    |
|  32 | icmpTypeCodeIPv4                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  33 | igmpType                                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  34 | samplingInterval                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  35 | samplingAlgorithm                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  36 | flowActiveTimeout                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  37 | flowIdleTimeout                          |     ✓     |   ✓   |     ✓    |    ✓    |
|  38 | engineType                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  39 | engineId                                 |     ✓     |   ✓   |     ✓    |    ✓    |
|  40 | exportedOctetTotalCount                  |     ✓     |   ✓   |     ✓    |    ✓    |
|  41 | exportedMessageTotalCount                |     ✓     |   ✓   |     ✓    |    ✓    |
|  42 | exportedFlowRecordTotalCount             |     ✓     |   ✓   |     ✓    |    ✓    |
|  44 | sourceIPv4Prefix                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  45 | destinationIPv4Prefix                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  46 | mplsTopLabelType                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  47 | mplsTopLabelIPv4Address                  |     ✓     |   ✓   |     ✓    |    ✓    |
|  48 | samplerId                                |     ✓     |   ✓   |     ✓    |    ✓    |
|  49 | samplerMode                              |     ✓     |   ✓   |     ✓    |    ✓    |
|  50 | samplerRandomInterval                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  51 | classId                                  |     ✓     |   ✓   |     ✓    |    ✓    |
|  52 | minimumTTL                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  53 | maximumTTL                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  54 | fragmentIdentification                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  55 | postIpClassOfService                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  56 | sourceMacAddress                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  57 | postDestinationMacAddress                |     ✓     |   ✓   |     ✓    |    ✓    |
|  58 | vlanId                                   |     ✓     |   ✓   |     ✓    |    ✓    |
|  59 | postVlanId                               |     ✓     |   ✓   |     ✓    |    ✓    |
|  60 | ipVersion                                |     ✓     |   ✓   |     ✓    |    ✓    |
|  61 | flowDirection                            |     ✓     |   ✓   |     ✓    |    ✓    |
|  62 | ipNextHopIPv6Address                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  63 | bgpNextHopIPv6Address                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  64 | ipv6ExtensionHeaders                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  65 | transportPacketLoss `Cisco Legacy`       |           |   ✓   |     ✓    |    ✓    |
|  66 | transportUnreachability `Cisco Legacy`   |           |   ✓   |     ✓    |    ✓    |
|  67 | transportLatency `Cisco Legacy`          |           |   ✓   |     ✓    |    ✓    |
|  68 | dataPoints `Cisco Legacy`                |           |   ✓   |     ✓    |    ✓    |
|  69 | variance `Cisco Legacy`                  |           |   ✓   |     ✓    |    ✓    |
|  70 | mplsTopLabelStackSection                 |           |   ✓   |     ✓    |    ✓    |
|  71 | mplsLabelStackSection2                   |           |   ✓   |     ✓    |    ✓    |
|  72 | mplsLabelStackSection3                   |           |   ✓   |     ✓    |    ✓    |
|  73 | mplsLabelStackSection4                   |           |   ✓   |     ✓    |    ✓    |
|  74 | mplsLabelStackSection5                   |           |   ✓   |     ✓    |    ✓    |
|  75 | mplsLabelStackSection6                   |           |   ✓   |     ✓    |    ✓    |
|  76 | mplsLabelStackSection7                   |           |   ✓   |     ✓    |    ✓    |
|  77 | mplsLabelStackSection8                   |           |   ✓   |     ✓    |    ✓    |
|  78 | mplsLabelStackSection9                   |           |   ✓   |     ✓    |    ✓    |
|  79 | mplsLabelStackSection10                  |           |   ✓   |     ✓    |    ✓    |
|  80 | destinationMacAddress                    |     ✓     |   ✓   |     ✓    |    ✓    |
|  81 | postSourceMacAddress                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  82 | interfaceName                            |     ✓     |   ✓   |     ✓    |    ✓    |
|  83 | interfaceDescription                     |     ✓     |   ✓   |     ✓    |    ✓    |
|  84 | samplerName                              |     ✓     |   ✓   |     ✓    |    ✓    |
|  85 | octetTotalCount                          |     ✓     |   ✓   |     ✓    |    ✓    |
|  86 | packetTotalCount                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  87 | flagsAndSamplerId                        |     ✓     |   ✓   |     ✓    |    ✓    |
|  88 | fragmentOffset                           |     ✓     |   ✓   |     ✓    |    ✓    |
|  89 | forwardingStatus                         |     ✓     |   ✓   |     ✓    |    ✓    |
|  90 | mplsVpnRouteDistinguisher                |           |   ✓   |     ✓    |    ✓    |
|  91 | mplsTopLabelPrefixLength                 |           |   ✓   |     ✓    |    ✓    |
|  92 | srcTrafficIndex                          |           |   ✓   |     ✓    |    ✓    |
|  93 | dstTrafficIndex                          |           |   ✓   |     ✓    |    ✓    |
|  94 | applicationDescription                   |           |   ✓   |     ✓    |    ✓    |
|  95 | applicationId                            |           |   ✓   |     ✓    |    ✓    |
|  96 | applicationName                          |           |   ✓   |     ✓    |    ✓    |
|  97 | subApplicationTag `Cisco Legacy`         |           |   ✓   |     ✓    |    ✓    |
|  98 | postIpDiffServCodePoint                  |           |   ✓   |     ✓    |    ✓    |
|  99 | multicastReplicationFactor               |           |   ✓   |     ✓    |    ✓    |
| 100 | className                                |           |   ✓   |     ✓    |    ✓    |
| 101 | classificationEngineId                   |           |   ✓   |     ✓    |    ✓    |
| 102 | layer2packetSectionOffset                |           |   ✓   |     ✓    |    ✓    |
| 103 | layer2packetSectionSize                  |           |   ✓   |     ✓    |    ✓    |
| 104 | layer2packetSectionData                  |           |   ✓   |     ✓    |    ✓    |
| 105 | applicationVersion `Cisco Legacy`        |           |   ✓   |     ✓    |    ✓    |
| 106 | applicationVersionName `Cisco Legacy`    |           |   ✓   |     ✓    |    ✓    |
| 107 | applicationVendor `Cisco Legacy`         |           |   ✓   |     ✓    |    ✓    |
| 109 | subApplicationName `Cisco Legacy`        |           |   ✓   |     ✓    |    ✓    |
| 110 | subApplicationDescription `Cisco Legacy` |           |   ✓   |     ✓    |    ✓    |
| 111 | templateParameterRangeEnd `Cisco Legacy` |           |   ✓   |     ✓    |    ✓    |
| 128 | bgpNextAdjacentAsNumber                  |           |   ✓   |     ✓    |    ✓    |
| 129 | bgpPrevAdjacentAsNumber                  |           |   ✓   |     ✓    |    ✓    |
| 130 | exporterIPv4Address                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 131 | exporterIPv6Address                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 132 | droppedOctetDeltaCount                   |           |   ✓   |     ✓    |    ✓    |
| 133 | droppedPacketDeltaCount                  |           |   ✓   |     ✓    |    ✓    |
| 134 | droppedOctetTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 135 | droppedPacketTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| 136 | flowEndReason                            |           |   ✓   |     ✓    |    ✓    |
| 137 | commonPropertiesId                       |           |   ✓   |     ✓    |    ✓    |
| 138 | observationPointId                       |           |   ✓   |     ✓    |    ✓    |
| 139 | icmpTypeCodeIPv6                         |           |   ✓   |     ✓    |    ✓    |
| 140 | mplsTopLabelIPv6Address                  |           |   ✓   |     ✓    |    ✓    |
| 141 | lineCardId                               |           |   ✓   |     ✓    |    ✓    |
| 142 | portId                                   |           |   ✓   |     ✓    |    ✓    |
| 143 | meteringProcessId                        |           |   ✓   |     ✓    |    ✓    |
| 144 | exportingProcessId                       |           |   ✓   |     ✓    |    ✓    |
| 145 | templateId                               |           |   ✓   |     ✓    |    ✓    |
| 146 | wlanChannelId                            |           |   ✓   |     ✓    |    ✓    |
| 147 | wlanSSID                                 |           |   ✓   |     ✓    |    ✓    |
| 148 | flowId                                   |           |   ✓   |     ✓    |    ✓    |
| 149 | observationDomainId                      |           |   ✓   |     ✓    |    ✓    |
| 150 | flowStartSeconds                         |     ✓     |   ✓   |     ✓    |    ✓    |
| 151 | flowEndSeconds                           |     ✓     |   ✓   |     ✓    |    ✓    |
| 152 | flowStartMilliseconds                    |     ✓     |   ✓   |     ✓    |    ✓    |
| 153 | flowEndMilliseconds                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 154 | flowStartMicroseconds                    |     ✓     |   ✓   |     ✓    |    ✓    |
| 155 | flowEndMicroseconds                      |     ✓     |   ✓   |     ✓    |    ✓    |
| 156 | flowStartNanoseconds                     |     ✓     |   ✓   |     ✓    |    ✓    |
| 157 | flowEndNanoseconds                       |     ✓     |   ✓   |     ✓    |    ✓    |
| 158 | flowStartDeltaMicroseconds               |           |   ✓   |     ✓    |    ✓    |
| 159 | flowEndDeltaMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| 160 | systemInitTimeMilliseconds               |           |   ✓   |     ✓    |    ✓    |
| 161 | flowDurationMilliseconds                 |           |   ✓   |     ✓    |    ✓    |
| 162 | flowDurationMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| 163 | observedFlowTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 164 | ignoredPacketTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| 165 | ignoredOctetTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 166 | notSentFlowTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 167 | notSentPacketTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| 168 | notSentOctetTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| 169 | destinationIPv6Prefix                    |           |   ✓   |     ✓    |    ✓    |
| 170 | sourceIPv6Prefix                         |           |   ✓   |     ✓    |    ✓    |
| 171 | postOctetTotalCount                      |           |   ✓   |     ✓    |    ✓    |
| 172 | postPacketTotalCount                     |           |   ✓   |     ✓    |    ✓    |
| 173 | flowKeyIndicator                         |           |   ✓   |     ✓    |    ✓    |
| 174 | postMCastPacketTotalCount                |           |   ✓   |     ✓    |    ✓    |
| 175 | postMCastOctetTotalCount                 |           |   ✓   |     ✓    |    ✓    |
| 176 | icmpTypeIPv4                             |           |   ✓   |     ✓    |    ✓    |
| 177 | icmpCodeIPv4                             |           |   ✓   |     ✓    |    ✓    |
| 178 | icmpTypeIPv6                             |           |   ✓   |     ✓    |    ✓    |
| 179 | icmpCodeIPv6                             |           |   ✓   |     ✓    |    ✓    |
| 180 | udpSourcePort                            |           |   ✓   |     ✓    |    ✓    |
| 181 | udpDestinationPort                       |           |   ✓   |     ✓    |    ✓    |
| 182 | tcpSourcePort                            |           |   ✓   |     ✓    |    ✓    |
| 183 | tcpDestinationPort                       |           |   ✓   |     ✓    |    ✓    |
| 184 | tcpSequenceNumber                        |           |   ✓   |     ✓    |    ✓    |
| 185 | tcpAcknowledgementNumber                 |           |   ✓   |     ✓    |    ✓    |
| 186 | tcpWindowSize                            |           |   ✓   |     ✓    |    ✓    |
| 187 | tcpUrgentPointer                         |           |   ✓   |     ✓    |    ✓    |
| 188 | tcpHeaderLength                          |           |   ✓   |     ✓    |    ✓    |
| 189 | ipHeaderLength                           |           |   ✓   |     ✓    |    ✓    |
| 190 | totalLengthIPv4                          |           |   ✓   |     ✓    |    ✓    |
| 191 | payloadLengthIPv6                        |           |   ✓   |     ✓    |    ✓    |
| 192 | ipTTL                                    |           |   ✓   |     ✓    |    ✓    |
| 193 | nextHeaderIPv6                           |           |   ✓   |     ✓    |    ✓    |
| 194 | mplsPayloadLength                        |           |   ✓   |     ✓    |    ✓    |
| 195 | ipDiffServCodePoint                      |           |   ✓   |     ✓    |    ✓    |
| 196 | ipPrecedence                             |           |   ✓   |     ✓    |    ✓    |
| 197 | fragmentFlags                            |           |   ✓   |     ✓    |    ✓    |
| 198 | octetDeltaSumOfSquares                   |           |   ✓   |     ✓    |    ✓    |
| 199 | octetTotalSumOfSquares                   |           |   ✓   |     ✓    |    ✓    |
| 200 | mplsTopLabelTTL                          |           |   ✓   |     ✓    |    ✓    |
| 201 | mplsLabelStackLength                     |           |   ✓   |     ✓    |    ✓    |
| 202 | mplsLabelStackDepth                      |           |   ✓   |     ✓    |    ✓    |
| 203 | mplsTopLabelExp                          |           |   ✓   |     ✓    |    ✓    |
| 204 | ipPayloadLength                          |           |   ✓   |     ✓    |    ✓    |
| 205 | udpMessageLength                         |           |   ✓   |     ✓    |    ✓    |
| 206 | isMulticast                              |           |   ✓   |     ✓    |    ✓    |
| 207 | ipv4IHL                                  |           |   ✓   |     ✓    |    ✓    |
| 208 | ipv4Options                              |           |   ✓   |     ✓    |    ✓    |
| 209 | tcpOptions                               |           |   ✓   |     ✓    |    ✓    |
| 210 | paddingOctets                            |           |   ✓   |     ✓    |    ✓    |
| 211 | collectorIPv4Address                     |           |   ✓   |     ✓    |    ✓    |
| 212 | collectorIPv6Address                     |           |   ✓   |     ✓    |    ✓    |
| 213 | exportInterface                          |           |   ✓   |     ✓    |    ✓    |
| 214 | exportProtocolVersion                    |           |   ✓   |     ✓    |    ✓    |
| 215 | exportTransportProtocol                  |           |   ✓   |     ✓    |    ✓    |
| 216 | collectorTransportPort                   |           |   ✓   |     ✓    |    ✓    |
| 217 | exporterTransportPort                    |           |   ✓   |     ✓    |    ✓    |
| 218 | tcpSynTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 219 | tcpFinTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 220 | tcpRstTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 221 | tcpPshTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 222 | tcpAckTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 223 | tcpUrgTotalCount                         |           |   ✓   |     ✓    |    ✓    |
| 224 | ipTotalLength                            |           |   ✓   |     ✓    |    ✓    |
| 225 | postNATSourceIPv4Address                 |           |   ✓   |     ✓    |    ✓    |
| 226 | postNATDestinationIPv4Address            |           |   ✓   |     ✓    |    ✓    |
| 227 | postNAPTSourceTransportPort              |           |   ✓   |     ✓    |    ✓    |
| 228 | postNAPTDestinationTransportPort         |           |   ✓   |     ✓    |    ✓    |
| 229 | natOriginatingAddressRealm               |           |   ✓   |     ✓    |    ✓    |
| 230 | natEvent                                 |           |   ✓   |     ✓    |    ✓    |
| 231 | initiatorOctets                          |           |   ✓   |     ✓    |    ✓    |
| 232 | responderOctets                          |           |   ✓   |     ✓    |    ✓    |
| 233 | firewallEvent                            |           |   ✓   |     ✓    |    ✓    |
| 234 | ingressVRFID                             |           |   ✓   |     ✓    |    ✓    |
| 235 | egressVRFID                              |           |   ✓   |     ✓    |    ✓    |
| 236 | VRFname                                  |           |   ✓   |     ✓    |    ✓    |
| 237 | postMplsTopLabelExp                      |           |   ✓   |     ✓    |    ✓    |
| 238 | tcpWindowScale                           |           |   ✓   |     ✓    |    ✓    |
| 239 | biflowDirection                          |           |   ✓   |     ✓    |    ✓    |
| 240 | ethernetHeaderLength                     |           |   ✓   |     ✓    |    ✓    |
| 241 | ethernetPayloadLength                    |           |   ✓   |     ✓    |    ✓    |
| 242 | ethernetTotalLength                      |           |   ✓   |     ✓    |    ✓    |
| 243 | dot1qVlanId                              |           |   ✓   |     ✓    |    ✓    |
| 244 | dot1qPriority                            |           |   ✓   |     ✓    |    ✓    |
| 245 | dot1qCustomerVlanId                      |           |   ✓   |     ✓    |    ✓    |
| 246 | dot1qCustomerPriority                    |           |   ✓   |     ✓    |    ✓    |
| 247 | metroEvcId                               |           |   ✓   |     ✓    |    ✓    |
| 248 | metroEvcType                             |           |   ✓   |     ✓    |    ✓    |
| 249 | pseudoWireId                             |           |   ✓   |     ✓    |    ✓    |
| 250 | pseudoWireType                           |           |   ✓   |     ✓    |    ✓    |
| 251 | pseudoWireControlWord                    |           |   ✓   |     ✓    |    ✓    |
| 252 | ingressPhysicalInterface                 |           |   ✓   |     ✓    |    ✓    |
| 253 | egressPhysicalInterface                  |           |   ✓   |     ✓    |    ✓    |
| 254 | postDot1qVlanId                          |           |   ✓   |     ✓    |    ✓    |
| 255 | postDot1qCustomerVlanId                  |           |   ✓   |     ✓    |    ✓    |
| 256 | ethernetType                             |           |   ✓   |     ✓    |    ✓    |
| 257 | postIpPrecedence                         |           |   ✓   |     ✓    |    ✓    |
| 258 | collectionTimeMilliseconds               |           |   ✓   |     ✓    |    ✓    |
| 259 | exportSctpStreamId                       |           |   ✓   |     ✓    |    ✓    |
| 260 | maxExportSeconds                         |           |   ✓   |     ✓    |    ✓    |
| 261 | maxFlowEndSeconds                        |           |   ✓   |     ✓    |    ✓    |
| 262 | messageMD5Checksum                       |           |   ✓   |     ✓    |    ✓    |
| 263 | messageScope                             |           |   ✓   |     ✓    |    ✓    |
| 264 | minExportSeconds                         |           |   ✓   |     ✓    |    ✓    |
| 265 | minFlowStartSeconds                      |           |   ✓   |     ✓    |    ✓    |
| 266 | opaqueOctets                             |           |   ✓   |     ✓    |    ✓    |
| 267 | sessionScope                             |           |   ✓   |     ✓    |    ✓    |
| 268 | maxFlowEndMicroseconds                   |           |   ✓   |     ✓    |    ✓    |
| 269 | maxFlowEndMilliseconds                   |           |   ✓   |     ✓    |    ✓    |
| 270 | maxFlowEndNanoseconds                    |           |   ✓   |     ✓    |    ✓    |
| 271 | minFlowStartMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| 272 | minFlowStartMilliseconds                 |           |   ✓   |     ✓    |    ✓    |
| 273 | minFlowStartNanoseconds                  |           |   ✓   |     ✓    |    ✓    |
| 274 | collectorCertificate                     |           |   ✓   |     ✓    |    ✓    |
| 275 | exporterCertificate                      |           |   ✓   |     ✓    |    ✓    |
| 276 | dataRecordsReliability                   |           |   ✓   |     ✓    |    ✓    |
| 277 | observationPointType                     |           |   ✓   |     ✓    |    ✓    |
| 278 | newConnectionDeltaCount                  |           |   ✓   |     ✓    |    ✓    |
| 279 | connectionSumDurationSeconds             |           |   ✓   |     ✓    |    ✓    |
| 280 | connectionTransactionId                  |           |   ✓   |     ✓    |    ✓    |
| 281 | postNATSourceIPv6Address                 |           |   ✓   |     ✓    |    ✓    |
| 282 | postNATDestinationIPv6Address            |           |   ✓   |     ✓    |    ✓    |
| 283 | natPoolId                                |           |   ✓   |     ✓    |    ✓    |
| 284 | natPoolName                              |           |   ✓   |     ✓    |    ✓    |
| 285 | anonymizationFlags                       |           |   ✓   |     ✓    |    ✓    |
| 286 | anonymizationTechnique                   |           |   ✓   |     ✓    |    ✓    |
| 287 | informationElementIndex                  |           |   ✓   |     ✓    |    ✓    |
| 288 | p2pTechnology                            |           |   ✓   |     ✓    |    ✓    |
| 289 | tunnelTechnology                         |           |   ✓   |     ✓    |    ✓    |
| 290 | encryptedTechnology                      |           |   ✓   |     ✓    |    ✓    |
| 294 | bgpValidityState                         |           |   ✓   |     ✓    |    ✓    |
| 295 | IPSecSPI                                 |           |   ✓   |     ✓    |    ✓    |
| 296 | greKey                                   |           |   ✓   |     ✓    |    ✓    |
| 297 | natType                                  |           |   ✓   |     ✓    |    ✓    |
| 298 | initiatorPackets                         |           |   ✓   |     ✓    |    ✓    |
| 299 | responderPackets                         |           |   ✓   |     ✓    |    ✓    |
| 300 | observationDomainName                    |           |   ✓   |     ✓    |    ✓    |
| 301 | selectionSequenceId                      |           |   ✓   |     ✓    |    ✓    |
| 302 | selectorId                               |           |   ✓   |     ✓    |    ✓    |
| 303 | informationElementId                     |           |   ✓   |     ✓    |    ✓    |
| 304 | selectorAlgorithm                        |           |   ✓   |     ✓    |    ✓    |
| 305 | samplingPacketInterval                   |           |   ✓   |     ✓    |    ✓    |
| 306 | samplingPacketSpace                      |           |   ✓   |     ✓    |    ✓    |
| 307 | samplingTimeInterval                     |           |   ✓   |     ✓    |    ✓    |
| 308 | samplingTimeSpace                        |           |   ✓   |     ✓    |    ✓    |
| 309 | samplingSize                             |           |   ✓   |     ✓    |    ✓    |
| 310 | samplingPopulation                       |           |   ✓   |     ✓    |    ✓    |
| 311 | samplingProbability                      |           |   ✓   |     ✓    |    ✓    |
| 312 | dataLinkFrameSize                        |           |   ✓   |     ✓    |    ✓    |
| 313 | ipHeaderPacketSection                    |           |   ✓   |     ✓    |    ✓    |
| 314 | ipPayloadPacketSection                   |           |   ✓   |     ✓    |    ✓    |
| 315 | dataLinkFrameSection                     |           |   ✓   |     ✓    |    ✓    |
| 316 | mplsLabelStackSection                    |           |   ✓   |     ✓    |    ✓    |
| 317 | mplsPayloadPacketSection                 |           |   ✓   |     ✓    |    ✓    |
| 318 | selectorIdTotalPktsObserved              |           |   ✓   |     ✓    |    ✓    |
| 319 | selectorIdTotalPktsSelected              |           |   ✓   |     ✓    |    ✓    |
| 320 | absoluteError                            |           |   ✓   |     ✓    |    ✓    |
| 321 | relativeError                            |           |   ✓   |     ✓    |    ✓    |
| 322 | observationTimeSeconds                   |           |   ✓   |     ✓    |    ✓    |
| 323 | observationTimeMilliseconds              |           |   ✓   |     ✓    |    ✓    |
| 324 | observationTimeMicroseconds              |           |   ✓   |     ✓    |    ✓    |
| 325 | observationTimeNanoseconds               |           |   ✓   |     ✓    |    ✓    |
| 326 | digestHashValue                          |           |   ✓   |     ✓    |    ✓    |
| 327 | hashIPPayloadOffset                      |           |   ✓   |     ✓    |    ✓    |
| 328 | hashIPPayloadSize                        |           |   ✓   |     ✓    |    ✓    |
| 329 | hashOutputRangeMin                       |           |   ✓   |     ✓    |    ✓    |
| 330 | hashOutputRangeMax                       |           |   ✓   |     ✓    |    ✓    |
| 331 | hashSelectedRangeMin                     |           |   ✓   |     ✓    |    ✓    |
| 332 | hashSelectedRangeMax                     |           |   ✓   |     ✓    |    ✓    |
| 333 | hashDigestOutput                         |           |   ✓   |     ✓    |    ✓    |
| 334 | hashInitialiserValue                     |           |   ✓   |     ✓    |    ✓    |
| 335 | selectorName                             |           |   ✓   |     ✓    |    ✓    |
| 336 | upperCILimit                             |           |   ✓   |     ✓    |    ✓    |
| 337 | lowerCILimit                             |           |   ✓   |     ✓    |    ✓    |
| 338 | confidenceLevel                          |           |   ✓   |     ✓    |    ✓    |
| 339 | informationElementDataType               |           |   ✓   |     ✓    |    ✓    |
| 340 | informationElementDescription            |           |   ✓   |     ✓    |    ✓    |
| 341 | informationElementName                   |           |   ✓   |     ✓    |    ✓    |
| 342 | informationElementRangeBegin             |           |   ✓   |     ✓    |    ✓    |
| 343 | informationElementRangeEnd               |           |   ✓   |     ✓    |    ✓    |
| 344 | informationElementSemantics              |           |   ✓   |     ✓    |    ✓    |
| 345 | informationElementUnits                  |           |   ✓   |     ✓    |    ✓    |
| 346 | privateEnterpriseNumber                  |           |   ✓   |     ✓    |    ✓    |
| 347 | virtualStationInterfaceId                |           |   ✓   |     ✓    |    ✓    |
| 348 | virtualStationInterfaceName              |           |   ✓   |     ✓    |    ✓    |
| 349 | virtualStationUUID                       |           |   ✓   |     ✓    |    ✓    |
| 350 | virtualStationName                       |           |   ✓   |     ✓    |    ✓    |
| 351 | layer2SegmentId                          |           |   ✓   |     ✓    |    ✓    |
| 352 | layer2OctetDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| 353 | layer2OctetTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 354 | ingressUnicastPacketTotalCount           |           |   ✓   |     ✓    |    ✓    |
| 355 | ingressMulticastPacketTotalCount         |           |   ✓   |     ✓    |    ✓    |
| 356 | ingressBroadcastPacketTotalCount         |           |   ✓   |     ✓    |    ✓    |
| 357 | egressUnicastPacketTotalCount            |           |   ✓   |     ✓    |    ✓    |
| 358 | egressBroadcastPacketTotalCount          |           |   ✓   |     ✓    |    ✓    |
| 359 | monitoringIntervalStartMilliSeconds      |           |   ✓   |     ✓    |    ✓    |
| 360 | monitoringIntervalEndMilliSeconds        |           |   ✓   |     ✓    |    ✓    |
| 361 | portRangeStart                           |           |   ✓   |     ✓    |    ✓    |
| 362 | portRangeEnd                             |           |   ✓   |     ✓    |    ✓    |
| 363 | portRangeStepSize                        |           |   ✓   |     ✓    |    ✓    |
| 364 | portRangeNumPorts                        |           |   ✓   |     ✓    |    ✓    |
| 365 | staMacAddress                            |           |   ✓   |     ✓    |    ✓    |
| 366 | staIPv4Address                           |           |   ✓   |     ✓    |    ✓    |
| 367 | wtpMacAddress                            |           |   ✓   |     ✓    |    ✓    |
| 368 | ingressInterfaceType                     |           |   ✓   |     ✓    |    ✓    |
| 369 | egressInterfaceType                      |           |   ✓   |     ✓    |    ✓    |
| 370 | rtpSequenceNumber                        |           |   ✓   |     ✓    |    ✓    |
| 371 | userName                                 |           |   ✓   |     ✓    |    ✓    |
| 372 | applicationCategoryName                  |           |   ✓   |     ✓    |    ✓    |
| 373 | applicationSubCategoryName               |           |   ✓   |     ✓    |    ✓    |
| 374 | applicationGroupName                     |           |   ✓   |     ✓    |    ✓    |
| 375 | originalFlowsPresent                     |           |   ✓   |     ✓    |    ✓    |
| 376 | originalFlowsInitiated                   |           |   ✓   |     ✓    |    ✓    |
| 377 | originalFlowsCompleted                   |           |   ✓   |     ✓    |    ✓    |
| 378 | distinctCountOfSourceIPAddress           |           |   ✓   |     ✓    |    ✓    |
| 379 | distinctCountOfDestinationIPAddress      |           |   ✓   |     ✓    |    ✓    |
| 380 | distinctCountOfSourceIPv4Address         |           |   ✓   |     ✓    |    ✓    |
| 381 | distinctCountOfDestinationIPv4Address    |           |   ✓   |     ✓    |    ✓    |
| 382 | distinctCountOfSourceIPv6Address         |           |   ✓   |     ✓    |    ✓    |
| 383 | distinctCountOfDestinationIPv6Address    |           |   ✓   |     ✓    |    ✓    |
| 384 | valueDistributionMethod                  |           |   ✓   |     ✓    |    ✓    |
| 385 | rfc3550JitterMilliseconds                |           |   ✓   |     ✓    |    ✓    |
| 386 | rfc3550JitterMicroseconds                |           |   ✓   |     ✓    |    ✓    |
| 387 | rfc3550JitterNanoseconds                 |           |   ✓   |     ✓    |    ✓    |
| 388 | dot1qDEI                                 |           |   ✓   |     ✓    |    ✓    |
| 389 | dot1qCustomerDEI                         |           |   ✓   |     ✓    |    ✓    |
| 390 | flowSelectorAlgorithm                    |           |   ✓   |     ✓    |    ✓    |
| 391 | flowSelectedOctetDeltaCount              |           |   ✓   |     ✓    |    ✓    |
| 392 | flowSelectedPacketDeltaCount             |           |   ✓   |     ✓    |    ✓    |
| 393 | flowSelectedFlowDeltaCount               |           |   ✓   |     ✓    |    ✓    |
| 394 | selectorIDTotalFlowsObserved             |           |   ✓   |     ✓    |    ✓    |
| 395 | selectorIDTotalFlowsSelected             |           |   ✓   |     ✓    |    ✓    |
| 396 | samplingFlowInterval                     |           |   ✓   |     ✓    |    ✓    |
| 397 | samplingFlowSpacing                      |           |   ✓   |     ✓    |    ✓    |
| 398 | flowSamplingTimeInterval                 |           |   ✓   |     ✓    |    ✓    |
| 399 | flowSamplingTimeSpacing                  |           |   ✓   |     ✓    |    ✓    |
| 400 | hashFlowDomain                           |           |   ✓   |     ✓    |    ✓    |
| 401 | transportOctetDeltaCount                 |           |   ✓   |     ✓    |    ✓    |
| 402 | transportPacketDeltaCount                |           |   ✓   |     ✓    |    ✓    |
| 403 | originalExporterIPv4Address              |           |   ✓   |     ✓    |    ✓    |
| 404 | originalExporterIPv6Address              |           |   ✓   |     ✓    |    ✓    |
| 405 | originalObservationDomainId              |           |   ✓   |     ✓    |    ✓    |
| 406 | intermediateProcessId                    |           |   ✓   |     ✓    |    ✓    |
| 407 | ignoredDataRecordTotalCount              |           |   ✓   |     ✓    |    ✓    |
| 408 | dataLinkFrameType                        |           |   ✓   |     ✓    |    ✓    |
| 409 | sectionOffset                            |           |   ✓   |     ✓    |    ✓    |
| 410 | sectionExportedOctets                    |           |   ✓   |     ✓    |    ✓    |
| 411 | dot1qServiceInstanceTag                  |           |   ✓   |     ✓    |    ✓    |
| 412 | dot1qServiceInstanceId                   |           |   ✓   |     ✓    |    ✓    |
| 413 | dot1qServiceInstancePriority             |           |   ✓   |     ✓    |    ✓    |
| 414 | dot1qCustomerSourceMacAddress            |           |   ✓   |     ✓    |    ✓    |
| 415 | dot1qCustomerDestinationMacAddress       |           |   ✓   |     ✓    |    ✓    |
| 416 | layer2OctetDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| 417 | postLayer2OctetDeltaCount                |           |   ✓   |     ✓    |    ✓    |
| 418 | postMCastLayer2OctetDeltaCount           |           |   ✓   |     ✓    |    ✓    |
| 419 | layer2OctetTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 420 | postLayer2OctetTotalCount                |           |   ✓   |     ✓    |    ✓    |
| 421 | postMCastLayer2OctetTotalCount           |           |   ✓   |     ✓    |    ✓    |
| 422 | minimumLayer2TotalLength                 |           |   ✓   |     ✓    |    ✓    |
| 423 | maximumLayer2TotalLength                 |           |   ✓   |     ✓    |    ✓    |
| 424 | droppedLayer2OctetDeltaCount             |           |   ✓   |     ✓    |    ✓    |
| 425 | droppedLayer2OctetTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 426 | ignoredLayer2OctetTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 427 | notSentLayer2OctetTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 428 | layer2OctetDeltaSumOfSquares             |           |   ✓   |     ✓    |    ✓    |
| 429 | layer2OctetTotalSumOfSquares             |           |   ✓   |     ✓    |    ✓    |
| 430 | layer2FrameDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| 431 | layer2FrameTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| 432 | pseudoWireDestinationIPv4Address         |           |   ✓   |     ✓    |    ✓    |
| 433 | ignoredLayer2FrameTotalCount             |           |   ✓   |     ✓    |    ✓    |
| 434 | mibObjectValueInteger                    |           |   ✓   |     ✓    |    ✓    |
| 435 | mibObjectValueOctetString                |           |   ✓   |     ✓    |    ✓    |
| 436 | mibObjectValueOID                        |           |   ✓   |     ✓    |    ✓    |
| 437 | mibObjectValueBits                       |           |   ✓   |     ✓    |    ✓    |
| 438 | mibObjectValueIPAddress                  |           |   ✓   |     ✓    |    ✓    |
| 439 | mibObjectValueCounter                    |           |   ✓   |     ✓    |    ✓    |
| 440 | mibObjectValueGauge                      |           |   ✓   |     ✓    |    ✓    |
| 441 | mibObjectValueTimeTicks                  |           |   ✓   |     ✓    |    ✓    |
| 442 | mibObjectValueUnsigned                   |           |   ✓   |     ✓    |    ✓    |
| 445 | mibObjectIdentifier                      |           |   ✓   |     ✓    |    ✓    |
| 446 | mibSubIdentifier                         |           |   ✓   |     ✓    |    ✓    |
| 447 | mibIndexIndicator                        |           |   ✓   |     ✓    |    ✓    |
| 448 | mibCaptureTimeSemantics                  |           |   ✓   |     ✓    |    ✓    |
| 449 | mibContextEngineID                       |           |   ✓   |     ✓    |    ✓    |
| 450 | mibContextName                           |           |   ✓   |     ✓    |    ✓    |
| 451 | mibObjectName                            |           |   ✓   |     ✓    |    ✓    |
| 452 | mibObjectDescription                     |           |   ✓   |     ✓    |    ✓    |
| 453 | mibObjectSyntax                          |           |   ✓   |     ✓    |    ✓    |
| 454 | mibModuleName                            |           |   ✓   |     ✓    |    ✓    |
| 455 | mobileIMSI                               |           |   ✓   |     ✓    |    ✓    |
| 456 | mobileMSISDN                             |           |   ✓   |     ✓    |    ✓    |
| 457 | httpStatusCode                           |           |   ✓   |     ✓    |    ✓    |
| 458 | sourceTransportPortsLimit                |           |   ✓   |     ✓    |    ✓    |
| 459 | httpRequestMethod                        |           |   ✓   |     ✓    |    ✓    |
| 460 | httpRequestHost                          |           |   ✓   |     ✓    |    ✓    |
| 461 | httpRequestTarget                        |           |   ✓   |     ✓    |    ✓    |
| 462 | httpMessageVersion                       |           |   ✓   |     ✓    |    ✓    |
| 463 | natInstanceID                            |           |   ✓   |     ✓    |    ✓    |
| 464 | internalAddressRealm                     |           |   ✓   |     ✓    |    ✓    |
| 465 | externalAddressRealm                     |           |   ✓   |     ✓    |    ✓    |
| 466 | natQuotaExceededEvent                    |           |   ✓   |     ✓    |    ✓    |
| 467 | natThresholdEvent                        |           |   ✓   |     ✓    |    ✓    |
| 468 | httpUserAgent                            |           |   ✓   |     ✓    |    ✓    |
| 469 | httpContentType                          |           |   ✓   |     ✓    |    ✓    |
| 470 | httpReasonPhrase                         |           |   ✓   |     ✓    |    ✓    |
| 471 | maxSessionEntries                        |           |   ✓   |     ✓    |    ✓    |
| 472 | maxBIBEntries                            |           |   ✓   |     ✓    |    ✓    |
| 473 | maxEntriesPerUser                        |           |   ✓   |     ✓    |    ✓    |
| 474 | maxSubscribers                           |           |   ✓   |     ✓    |    ✓    |
| 475 | maxFragmentsPendingReassembly            |           |   ✓   |     ✓    |    ✓    |
| 476 | addressPoolHighThreshold                 |           |   ✓   |     ✓    |    ✓    |
| 477 | addressPoolLowThreshold                  |           |   ✓   |     ✓    |    ✓    |
| 478 | addressPortMappingHighThreshold          |           |   ✓   |     ✓    |    ✓    |
| 479 | addressPortMappingLowThreshold           |           |   ✓   |     ✓    |    ✓    |
| 480 | addressPortMappingPerUserHighThreshold   |           |   ✓   |     ✓    |    ✓    |
| 481 | globalAddressMappingHighThreshold        |           |   ✓   |     ✓    |    ✓    |
| 482 | vpnIdentifier                            |           |   ✓   |     ✓    |    ✓    |
| 483 | bgpCommunity                             |           |   ✓   |     ✓    |    ✓    |
| 486 | bgpExtendedCommunity                     |           |   ✓   |     ✓    |    ✓    |
| 489 | bgpLargeCommunity                        |           |   ✓   |     ✓    |    ✓    |

### Cisco (PEN: 9)

| Name                                                 | Community | Basic | Standard | Premium |
| ---------------------------------------------------- | :-------: | :---: | :------: | :-----: |
| AAA\_USERNAME                                        |           |   ✓   |     ✓    |    ✓    |
| application business-relevance                       |           |   ✓   |     ✓    |    ✓    |
| application category name                            |           |   ✓   |     ✓    |    ✓    |
| application delay average                            |           |   ✓   |     ✓    |    ✓    |
| application family name                              |           |   ✓   |     ✓    |    ✓    |
| application group name                               |           |   ✓   |     ✓    |    ✓    |
| application http uri statistics                      |           |   ✓   |     ✓    |    ✓    |
| application media bytes counter                      |           |   ✓   |     ✓    |    ✓    |
| application media bytes counter permanent            |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate                         |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate per-flow                |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate per-flow max            |           |   ✓   |     ✓    |    ✓    |
| application media bytes rate per-flow min            |           |   ✓   |     ✓    |    ✓    |
| application media event                              |           |   ✓   |     ✓    |    ✓    |
| application media packets counter                    |           |   ✓   |     ✓    |    ✓    |
| application media packets counter permanen           |           |   ✓   |     ✓    |    ✓    |
| application media packets rate                       |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation             |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation m           |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation m           |           |   ✓   |     ✓    |    ✓    |
| application media packets rate variation s           |           |   ✓   |     ✓    |    ✓    |
| application set name                                 |           |   ✓   |     ✓    |    ✓    |
| application sub category name                        |           |   ✓   |     ✓    |    ✓    |
| application traffic-class                            |           |   ✓   |     ✓    |    ✓    |
| application transaction counter new                  |           |   ✓   |     ✓    |    ✓    |
| application video eMOS compression bitstre           |           |   ✓   |     ✓    |    ✓    |
| application video eMOS compression network           |           |   ✓   |     ✓    |    ✓    |
| application video eMOS packet-loss bitstre           |           |   ✓   |     ✓    |    ✓    |
| application video eMOS packet-loss network           |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter bytes              |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter frames             |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter packets            |           |   ✓   |     ✓    |    ✓    |
| application video frame I counter packets            |           |   ✓   |     ✓    |    ✓    |
| application video frame I slice-quantizati           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter bytes            |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter frames           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame LTR slice-quantiza           |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter bytes             |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter frames            |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter packets           |           |   ✓   |     ✓    |    ✓    |
| application video frame NR counter packets           |           |   ✓   |     ✓    |    ✓    |
| application video frame NR slice-quantizat           |           |   ✓   |     ✓    |    ✓    |
| application video frame percentage damaged           |           |   ✓   |     ✓    |    ✓    |
| application video frame rate                         |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter bytes            |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter frames           |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame STR counter packet           |           |   ✓   |     ✓    |    ✓    |
| application video frame STR slice-quantiza           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter by           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter fr           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter pa           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P counter pa           |           |   ✓   |     ✓    |    ✓    |
| application video frame super-P slice-quan           |           |   ✓   |     ✓    |    ✓    |
| application video level-of-motion                    |           |   ✓   |     ✓    |    ✓    |
| application video payload bitrate average            |           |   ✓   |     ✓    |    ✓    |
| application video payload bitrate fluctuat           |           |   ✓   |     ✓    |    ✓    |
| application video resolution height last             |           |   ✓   |     ✓    |    ✓    |
| application video resolution width last              |           |   ✓   |     ✓    |    ✓    |
| application video scene-complexity                   |           |   ✓   |     ✓    |    ✓    |
| application voice call duration                      |           |   ✓   |     ✓    |    ✓    |
| application voice codec id                           |           |   ✓   |     ✓    |    ✓    |
| application voice concealment-ratio averag           |           |   ✓   |     ✓    |    ✓    |
| application voice delay end-point                    |           |   ✓   |     ✓    |    ✓    |
| application voice delay round-trip                   |           |   ✓   |     ✓    |    ✓    |
| application voice jitter buffer-overrun              |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured initia           |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured maximu           |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured minimu           |           |   ✓   |     ✓    |    ✓    |
| application voice jitter configured type             |           |   ✓   |     ✓    |    ✓    |
| application voice mos conversation                   |           |   ✓   |     ✓    |    ✓    |
| application voice mos listening                      |           |   ✓   |     ✓    |    ✓    |
| application voice number called                      |           |   ✓   |     ✓    |    ✓    |
| application voice number calling                     |           |   ✓   |     ✓    |    ✓    |
| application voice packet conceal-count               |           |   ✓   |     ✓    |    ✓    |
| application voice play delay current                 |           |   ✓   |     ✓    |    ✓    |
| application voice play delay maximum                 |           |   ✓   |     ✓    |    ✓    |
| application voice play delay minimum                 |           |   ✓   |     ✓    |    ✓    |
| application voice r-factor 1                         |           |   ✓   |     ✓    |    ✓    |
| application voice r-factor 2                         |           |   ✓   |     ✓    |    ✓    |
| application voice router global-call-id              |           |   ✓   |     ✓    |    ✓    |
| application voice rx bad-packet                      |           |   ✓   |     ✓    |    ✓    |
| application voice rx early-packet count              |           |   ✓   |     ✓    |    ✓    |
| application voice rx late-packet count               |           |   ✓   |     ✓    |    ✓    |
| application voice rx out-of-sequence                 |           |   ✓   |     ✓    |    ✓    |
| application voice setup time                         |           |   ✓   |     ✓    |    ✓    |
| application voice sip call-id                        |           |   ✓   |     ✓    |    ✓    |
| appqoe ssl policy action                             |           |   ✓   |     ✓    |    ✓    |
| appqoe ssl service type                              |           |   ✓   |     ✓    |    ✓    |
| appqoe ssl traffic type                              |           |   ✓   |     ✓    |    ✓    |
| art count new connections                            |           |   ✓   |     ✓    |    ✓    |
| art count responses                                  |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket1                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket2                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket3                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket4                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket5                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket6                |           |   ✓   |     ✓    |    ✓    |
| art count responses histogram bucket7                |           |   ✓   |     ✓    |    ✓    |
| artClientNetworkTimeLongLivedMaximum                 |           |   ✓   |     ✓    |    ✓    |
| artClientNetworkTimeLongLivedMinimum                 |           |   ✓   |     ✓    |    ✓    |
| artClientpackets                                     |           |   ✓   |     ✓    |    ✓    |
| artServerNetworkTimeLongLivedMaximum                 |           |   ✓   |     ✓    |    ✓    |
| artServerNetworkTimeLongLivedMinimum                 |           |   ✓   |     ✓    |    ✓    |
| artServerpackets                                     |           |   ✓   |     ✓    |    ✓    |
| audio concealment ratio maximum                      |           |   ✓   |     ✓    |    ✓    |
| audio concealment ratio minimum                      |           |   ✓   |     ✓    |    ✓    |
| audio concealment ratio now                          |           |   ✓   |     ✓    |    ✓    |
| audio concealment time                               |           |   ✓   |     ✓    |    ✓    |
| audio duration clock adjust                          |           |   ✓   |     ✓    |    ✓    |
| audio duration early packet                          |           |   ✓   |     ✓    |    ✓    |
| audio duration late discard                          |           |   ✓   |     ✓    |    ✓    |
| audio duration playout decrease                      |           |   ✓   |     ✓    |    ✓    |
| audio duration playout increase                      |           |   ✓   |     ✓    |    ✓    |
| audio duration receive                               |           |   ✓   |     ✓    |    ✓    |
| audio duration receive voice                         |           |   ✓   |     ✓    |    ✓    |
| audio frame arriving times difference                |           |   ✓   |     ✓    |    ✓    |
| audio frame arriving times difference vari           |           |   ✓   |     ✓    |    ✓    |
| audio frame size                                     |           |   ✓   |     ✓    |    ✓    |
| audio frames-per-packet                              |           |   ✓   |     ✓    |    ✓    |
| audio g107 codec baseline                            |           |   ✓   |     ✓    |    ✓    |
| audio g107 codec baseline bpl                        |           |   ✓   |     ✓    |    ✓    |
| audio g107 impairment                                |           |   ✓   |     ✓    |    ✓    |
| audio g107 impairment one-way-delay                  |           |   ✓   |     ✓    |    ✓    |
| audio g107 lossRate                                  |           |   ✓   |     ✓    |    ✓    |
| audio noise level average                            |           |   ✓   |     ✓    |    ✓    |
| audio noise level configured                         |           |   ✓   |     ✓    |    ✓    |
| audio noise level current                            |           |   ✓   |     ✓    |    ✓    |
| audio noise level maximum                            |           |   ✓   |     ✓    |    ✓    |
| audio noise level minimum                            |           |   ✓   |     ✓    |    ✓    |
| audio packets cs                                     |           |   ✓   |     ✓    |    ✓    |
| audio packets ok                                     |           |   ✓   |     ✓    |    ✓    |
| audio packets rtp                                    |           |   ✓   |     ✓    |    ✓    |
| audio packets scs                                    |           |   ✓   |     ✓    |    ✓    |
| audio packets silence                                |           |   ✓   |     ✓    |    ✓    |
| audio rtp fwd out-of-sequence sum                    |           |   ✓   |     ✓    |    ✓    |
| audio rtp jitter ticks                               |           |   ✓   |     ✓    |    ✓    |
| audio rtp packets expected                           |           |   ✓   |     ✓    |    ✓    |
| audio rtp packets lost                               |           |   ✓   |     ✓    |    ✓    |
| audio rtp seconds concealed                          |           |   ✓   |     ✓    |    ✓    |
| audio rtp seconds concealed severe                   |           |   ✓   |     ✓    |    ✓    |
| audio rtp seconds ok                                 |           |   ✓   |     ✓    |    ✓    |
| audio snr average                                    |           |   ✓   |     ✓    |    ✓    |
| audio snr configured                                 |           |   ✓   |     ✓    |    ✓    |
| audio snr current                                    |           |   ✓   |     ✓    |    ✓    |
| audio snr maximum                                    |           |   ✓   |     ✓    |    ✓    |
| audio snr minimum                                    |           |   ✓   |     ✓    |    ✓    |
| audio speech time                                    |           |   ✓   |     ✓    |    ✓    |
| AVCSubApplicationValue                               |           |   ✓   |     ✓    |    ✓    |
| bandwidth used                                       |           |   ✓   |     ✓    |    ✓    |
| bandwidth used percentage                            |           |   ✓   |     ✓    |    ✓    |
| bgp community                                        |           |   ✓   |     ✓    |    ✓    |
| bgp prepend                                          |           |   ✓   |     ✓    |    ✓    |
| bw fee                                               |           |   ✓   |     ✓    |    ✓    |
| bw percentage                                        |           |   ✓   |     ✓    |    ✓    |
| BYTE\_RATE                                           |           |   ✓   |     ✓    |    ✓    |
| c3pl class cce-id                                    |           |   ✓   |     ✓    |    ✓    |
| c3pl class name                                      |           |   ✓   |     ✓    |    ✓    |
| c3pl class type                                      |           |   ✓   |     ✓    |    ✓    |
| c3pl policy cce-id                                   |           |   ✓   |     ✓    |    ✓    |
| c3pl policy name                                     |           |   ✓   |     ✓    |    ✓    |
| c3pl policy type                                     |           |   ✓   |     ✓    |    ✓    |
| capacity                                             |           |   ✓   |     ✓    |    ✓    |
| client network delay average                         |           |   ✓   |     ✓    |    ✓    |
| client throughput average                            |           |   ✓   |     ✓    |    ✓    |
| closed sessions                                      |           |   ✓   |     ✓    |    ✓    |
| connection client counter bytes network              |           |   ✓   |     ✓    |    ✓    |
| connection client counter bytes retransmit           |           |   ✓   |     ✓    |    ✓    |
| connection client counter packets retransm           |           |   ✓   |     ✓    |    ✓    |
| connection client ipv4 address                       |           |   ✓   |     ✓    |    ✓    |
| connection client ipv6 address                       |           |   ✓   |     ✓    |    ✓    |
| connection client transport port                     |           |   ✓   |     ✓    |    ✓    |
| connection concurrent-connections                    |           |   ✓   |     ✓    |    ✓    |
| connection delay application max                     |           |   ✓   |     ✓    |    ✓    |
| connection delay application min                     |           |   ✓   |     ✓    |    ✓    |
| connection delay application sum                     |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network client-to-server            |           |   ✓   |     ✓    |    ✓    |
| connection delay network long-lived client           |           |   ✓   |     ✓    |    ✓    |
| connection delay network long-lived to-cli           |           |   ✓   |     ✓    |    ✓    |
| connection delay network long-lived to-ser           |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client max               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client min               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client num-sam           |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-client sum               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server max               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server min               |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server num-sam           |           |   ✓   |     ✓    |    ✓    |
| connection delay network to-server sum               |           |   ✓   |     ✓    |    ✓    |
| connection delay response client-to-server           |           |   ✓   |     ✓    |    ✓    |
| connection delay response client-to-server           |           |   ✓   |     ✓    |    ✓    |
| connection delay response client-to-server           |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server histog           |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server max              |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server min              |           |   ✓   |     ✓    |    ✓    |
| connection delay response to-server sum              |           |   ✓   |     ✓    |    ✓    |
| connection id                                        |           |   ✓   |     ✓    |    ✓    |
| connection id long                                   |           |   ✓   |     ✓    |    ✓    |
| connection server counter bytes network              |           |   ✓   |     ✓    |    ✓    |
| connection server counter bytes retransmit           |           |   ✓   |     ✓    |    ✓    |
| connection server counter packets retransm           |           |   ✓   |     ✓    |    ✓    |
| connection server ipv4 address                       |           |   ✓   |     ✓    |    ✓    |
| connection server ipv6 address                       |           |   ✓   |     ✓    |    ✓    |
| connection server transport port                     |           |   ✓   |     ✓    |    ✓    |
| connection transaction counter complete              |           |   ✓   |     ✓    |    ✓    |
| connection transaction duration max                  |           |   ✓   |     ✓    |    ✓    |
| connection transaction duration min                  |           |   ✓   |     ✓    |    ✓    |
| connection transaction duration sum                  |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-de-read                     |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-de-written                  |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-en-read                     |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-en-written                  |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-read                        |           |   ✓   |     ✓    |    ✓    |
| counter bytes appqoe ssl-written                     |           |   ✓   |     ✓    |    ✓    |
| counter bytes rate per-flow                          |           |   ✓   |     ✓    |    ✓    |
| counter bytes rate per-flow max                      |           |   ✓   |     ✓    |    ✓    |
| counter bytes rate per-flow min                      |           |   ✓   |     ✓    |    ✓    |
| counter bytes sdwan dropped long                     |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe fec-d-pkts                    |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe fec-r-pkts                    |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe pkt-dup-d-pkts-dup            |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe pkt-dup-d-pkts-orig           |           |   ✓   |     ✓    |    ✓    |
| counter packets appqoe pkt-dup-r-pkts                |           |   ✓   |     ✓    |    ✓    |
| counter packets dropped permanent                    |           |   ✓   |     ✓    |    ✓    |
| counter packets rate per-flow                        |           |   ✓   |     ✓    |    ✓    |
| counter packets rate per-flow max                    |           |   ✓   |     ✓    |    ✓    |
| counter packets rate per-flow min                    |           |   ✓   |     ✓    |    ✓    |
| counter packets sdwan pkt-cxp-d-pkts                 |           |   ✓   |     ✓    |    ✓    |
| datalink event                                       |           |   ✓   |     ✓    |    ✓    |
| datalink event extended                              |           |   ✓   |     ✓    |    ✓    |
| discard rollup count                                 |           |   ✓   |     ✓    |    ✓    |
| drop cause id                                        |           |   ✓   |     ✓    |    ✓    |
| drop cause name                                      |           |   ✓   |     ✓    |    ✓    |
| egress bw                                            |           |   ✓   |     ✓    |    ✓    |
| egress rollup bw                                     |           |   ✓   |     ✓    |    ✓    |
| EGRESS\_ACL\_ID                                      |           |   ✓   |     ✓    |    ✓    |
| end timestamp                                        |           |   ✓   |     ✓    |    ✓    |
| entrance downgrade                                   |           |   ✓   |     ✓    |    ✓    |
| ETAByteDistribution                                  |           |   ✓   |     ✓    |    ✓    |
| ETAInitialDataPacketOld                              |           |   ✓   |     ✓    |    ✓    |
| ETASequenceofPktLengthsandTimes                      |           |   ✓   |     ✓    |    ✓    |
| ETTA\_INITIAL\_DATA\_PACKET                          |           |   ✓   |     ✓    |    ✓    |
| ETTA\_SEQUENCE\_OF\_APPLICATION\_LENGTHS\_AND\_TIMES |           |   ✓   |     ✓    |    ✓    |
| ETTA\_SEQUENCE\_OF\_PACKET\_LENGTHS\_AND\_TIMES      |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_CIPHER\_SUITES                            |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_EXTENSION\_LENGTHS                        |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_EXTENSION\_TYPES                          |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_EXTENSIONS                                |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_KEY\_LENGTH                               |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_RANDOM                                    |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_RECORDS                                   |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_SESSION\_ID                               |           |   ✓   |     ✓    |    ✓    |
| ETTA\_TLS\_VERSION                                   |           |   ✓   |     ✓    |    ✓    |
| flow cts switch derived-sgt                          |           |   ✓   |     ✓    |    ✓    |
| flow left time                                       |           |   ✓   |     ✓    |    ✓    |
| FW\_BLACKOUT\_SECS                                   |           |   ✓   |     ✓    |    ✓    |
| FW\_CONFIGURED\_VALUE                                |           |   ✓   |     ✓    |    ✓    |
| FW\_ERM\_EXT\_EVENT                                  |           |   ✓   |     ✓    |    ✓    |
| FW\_ERM\_EXT\_EVENT\_DESC                            |           |   ✓   |     ✓    |    ✓    |
| FW\_EVENT                                            |           |   ✓   |     ✓    |    ✓    |
| FW\_EVENT\_LEVEL                                     |           |   ✓   |     ✓    |    ✓    |
| FW\_EVENT\_LEVEL\_ID                                 |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT                                       |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT                                       |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT\_DESC                                 |           |   ✓   |     ✓    |    ✓    |
| FW\_HALFOPEN\_CNT                                    |           |   ✓   |     ✓    |    ✓    |
| FW\_HALFOPEN\_HIGH                                   |           |   ✓   |     ✓    |    ✓    |
| FW\_HALFOPEN\_RATE                                   |           |   ✓   |     ✓    |    ✓    |
| FW\_MAX\_SESSIONS                                    |           |   ✓   |     ✓    |    ✓    |
| FW\_SUMMARY\_PKT\_CNT                                |           |   ✓   |     ✓    |    ✓    |
| FW\_ZONEPAIR\_ID                                     |           |   ✓   |     ✓    |    ✓    |
| FW\_ZONEPAIR\_NAME                                   |           |   ✓   |     ✓    |    ✓    |
| ingress bw                                           |           |   ✓   |     ✓    |    ✓    |
| ingress rollup bw                                    |           |   ✓   |     ✓    |    ✓    |
| INGRESS\_ACL\_ID                                     |           |   ✓   |     ✓    |    ✓    |
| interface input fex-node-id                          |           |   ✓   |     ✓    |    ✓    |
| interface output fex-node-id                         |           |   ✓   |     ✓    |    ✓    |
| interface power                                      |           |   ✓   |     ✓    |    ✓    |
| iOAM Application metadata                            |           |   ✓   |     ✓    |    ✓    |
| IOAM byte count                                      |           |   ✓   |     ✓    |    ✓    |
| IOAM cs0 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs0 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs1 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs1 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs2 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs2 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs3 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs3 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs4 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs4 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs5 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs5 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs6 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs6 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM cs7 byte count                                  |           |   ✓   |     ✓    |    ✓    |
| IOAM cs7 packet counter                              |           |   ✓   |     ✓    |    ✓    |
| IOAM duplicate packet counter                        |           |   ✓   |     ✓    |    ✓    |
| iOAM E2E Header                                      |           |   ✓   |     ✓    |    ✓    |
| IOAM highest PPC sequence number                     |           |   ✓   |     ✓    |    ✓    |
| IOAM lost packet counter                             |           |   ✓   |     ✓    |    ✓    |
| iOAM my node name                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM my node-id                                      |           |   ✓   |     ✓    |    ✓    |
| iOAM node-id                                         |           |   ✓   |     ✓    |    ✓    |
| iOAM node1 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node1 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node1 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM node2 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node2 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node2 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM node3 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node3 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node3 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM node4 eif id                                    |           |   ✓   |     ✓    |    ✓    |
| iOAM node4 id                                        |           |   ✓   |     ✓    |    ✓    |
| iOAM node4 in if id                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM number of nodes                                 |           |   ✓   |     ✓    |    ✓    |
| IOAM packet counter                                  |           |   ✓   |     ✓    |    ✓    |
| iOAM Path Map                                        |           |   ✓   |     ✓    |    ✓    |
| IOAM reordered packet counter                        |           |   ✓   |     ✓    |    ✓    |
| iOAM sfc invalidated count                           |           |   ✓   |     ✓    |    ✓    |
| iOAM sfc validated count                             |           |   ✓   |     ✓    |    ✓    |
| iOAM sfc-id                                          |           |   ✓   |     ✓    |    ✓    |
| IPv4 destination observation node                    |           |   ✓   |     ✓    |    ✓    |
| IPv4 source observation node                         |           |   ✓   |     ✓    |    ✓    |
| IPv6 destination observation node                    |           |   ✓   |     ✓    |    ✓    |
| ipv6 protocol filed                                  |           |   ✓   |     ✓    |    ✓    |
| IPv6 source observation node                         |           |   ✓   |     ✓    |    ✓    |
| kth rollup bw                                        |           |   ✓   |     ✓    |    ✓    |
| l4r event                                            |           |   ✓   |     ✓    |    ✓    |
| l4r event timestamp                                  |           |   ✓   |     ✓    |    ✓    |
| l4r server ipv4 address                              |           |   ✓   |     ✓    |    ✓    |
| l4r server ipv6 address                              |           |   ✓   |     ✓    |    ✓    |
| l4r server transport port                            |           |   ✓   |     ✓    |    ✓    |
| link group name                                      |           |   ✓   |     ✓    |    ✓    |
| long-term round-trip-time                            |           |   ✓   |     ✓    |    ✓    |
| max egress bw                                        |           |   ✓   |     ✓    |    ✓    |
| max ingress bw                                       |           |   ✓   |     ✓    |    ✓    |
| metadata clock-rate                                  |           |   ✓   |     ✓    |    ✓    |
| metadata global-session-id                           |           |   ✓   |     ✓    |    ✓    |
| metadata multi-party-session-id                      |           |   ✓   |     ✓    |    ✓    |
| misc unsupported                                     |           |   ✓   |     ✓    |    ✓    |
| monitor device-type                                  |           |   ✓   |     ✓    |    ✓    |
| monitor event                                        |           |   ✓   |     ✓    |    ✓    |
| mos below                                            |           |   ✓   |     ✓    |    ✓    |
| mos quality                                          |           |   ✓   |     ✓    |    ✓    |
| mos total count                                      |           |   ✓   |     ✓    |    ✓    |
| mos worst 100                                        |           |   ✓   |     ✓    |    ✓    |
| network delay sample                                 |           |   ✓   |     ✓    |    ✓    |
| network delay sum                                    |           |   ✓   |     ✓    |    ✓    |
| NETWORK\_DELAY\_AVG network delay average            |           |   ✓   |     ✓    |    ✓    |
| nvzFlowCoordinatesList                               |           |   ✓   |     ✓    |    ✓    |
| nvzFlowDestinationHostname                           |           |   ✓   |     ✓    |    ✓    |
| nvzFlowDNSSuffix                                     |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceDetailsList                          |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceIndex                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceInfoUID                              |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceMac                                  |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceName                                 |           |   ✓   |     ✓    |    ✓    |
| nvzFlowInterfaceType                                 |           |   ✓   |     ✓    |    ✓    |
| nvzFlowL4ByteCountIn                                 |           |   ✓   |     ✓    |    ✓    |
| nvzFlowL4ByteCountOut                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowLoggedInUser                                  |           |   ✓   |     ✓    |    ✓    |
| nvzFlowModuleHashList                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowModuleNameList                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowOSEdition                                     |           |   ✓   |     ✓    |    ✓    |
| nvzFlowOSName                                        |           |   ✓   |     ✓    |    ✓    |
| nvzFlowOSVersion                                     |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessAccount                          |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessAccountType                      |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessHash                             |           |   ✓   |     ✓    |    ✓    |
| nvzFlowParentProcessName                             |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessAccount                                |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessAccountType                            |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessHash                                   |           |   ✓   |     ✓    |    ✓    |
| nvzFlowProcessName                                   |           |   ✓   |     ✓    |    ✓    |
| nvzFlowSystemManufacturer                            |           |   ✓   |     ✓    |    ✓    |
| nvzFlowSystemType                                    |           |   ✓   |     ✓    |    ✓    |
| nvzFlowUDID                                          |           |   ✓   |     ✓    |    ✓    |
| nvzFlowUserAccountType                               |           |   ✓   |     ✓    |    ✓    |
| ONE\_WAY\_DELAY pfr one-way-delay                    |           |   ✓   |     ✓    |    ✓    |
| overlay session id input                             |           |   ✓   |     ✓    |    ✓    |
| overlay session id output                            |           |   ✓   |     ✓    |    ✓    |
| packet arrival timestamp                             |           |   ✓   |     ✓    |    ✓    |
| PACKET\_RATE                                         |           |   ✓   |     ✓    |    ✓    |
| PACKETS\_DROPPED                                     |           |   ✓   |     ✓    |    ✓    |
| pbhk event                                           |           |   ✓   |     ✓    |    ✓    |
| pbhk event timestamp                                 |           |   ✓   |     ✓    |    ✓    |
| pbhk mapped ipv4 address                             |           |   ✓   |     ✓    |    ✓    |
| pbhk mapped transport port                           |           |   ✓   |     ✓    |    ✓    |
| pfr br ipv4 address                                  |           |   ✓   |     ✓    |    ✓    |
| pfr counter event error traffic-class miti           |           |   ✓   |     ✓    |    ✓    |
| pfr counter event error traffic-class miti           |           |   ✓   |     ✓    |    ✓    |
| pfr counter event error traffic-class miti           |           |   ✓   |     ✓    |    ✓    |
| pfr label identifier                                 |           |   ✓   |     ✓    |    ✓    |
| pfr one-way-delay samples                            |           |   ✓   |     ✓    |    ✓    |
| pfr one-way-delay sum                                |           |   ✓   |     ✓    |    ✓    |
| pfr priority                                         |           |   ✓   |     ✓    |    ✓    |
| pfr service provider tag identifier                  |           |   ✓   |     ✓    |    ✓    |
| pfr site destination id ipv4                         |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix ipv4                     |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix ipv6                     |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix mask ipv4                |           |   ✓   |     ✓    |    ✓    |
| pfr site destination prefix mask ipv6                |           |   ✓   |     ✓    |    ✓    |
| pfr site source id ipv4                              |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix ipv4                          |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix ipv6                          |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix mask ipv4                     |           |   ✓   |     ✓    |    ✓    |
| pfr site source prefix mask ipv6                     |           |   ✓   |     ✓    |    ✓    |
| pfr status                                           |           |   ✓   |     ✓    |    ✓    |
| policy qos classification hierarchy                  |           |   ✓   |     ✓    |    ✓    |
| policy qos queue drops                               |           |   ✓   |     ✓    |    ✓    |
| policy qos queue index                               |           |   ✓   |     ✓    |    ✓    |
| reason id                                            |           |   ✓   |     ✓    |    ✓    |
| refused sessions                                     |           |   ✓   |     ✓    |    ✓    |
| retransmitted packets                                |           |   ✓   |     ✓    |    ✓    |
| routing vrf service                                  |           |   ✓   |     ✓    |    ✓    |
| rsvp bw pool                                         |           |   ✓   |     ✓    |    ✓    |
| scAccessString                                       |           |   ✓   |     ✓    |    ✓    |
| scActiveSubscribers                                  |           |   ✓   |     ✓    |    ✓    |
| scAttackId                                           |           |   ✓   |     ✓    |    ✓    |
| scAttackIp                                           |           |   ✓   |     ✓    |    ✓    |
| scAttackIpProtocol                                   |           |   ✓   |     ✓    |    ✓    |
| scAttackMaliciousSessions                            |           |   ✓   |     ✓    |    ✓    |
| scAttackOtherIp                                      |           |   ✓   |     ✓    |    ✓    |
| scAttackPortNumber                                   |           |   ✓   |     ✓    |    ✓    |
| scAttacks                                            |           |   ✓   |     ✓    |    ✓    |
| scAttackSide                                         |           |   ✓   |     ✓    |    ✓    |
| scAttackType                                         |           |   ✓   |     ✓    |    ✓    |
| scBreachState                                        |           |   ✓   |     ✓    |    ✓    |
| scClientPort                                         |           |   ✓   |     ✓    |    ✓    |
| scConcurrentSessions                                 |           |   ✓   |     ✓    |    ✓    |
| scConfiguredDuration                                 |           |   ✓   |     ✓    |    ✓    |
| scDestinationIpSample                                |           |   ✓   |     ✓    |    ✓    |
| scDownstreamVolume                                   |           |   ✓   |     ✓    |    ✓    |
| scDuration                                           |           |   ✓   |     ✓    |    ✓    |
| scEndTime                                            |           |   ✓   |     ✓    |    ✓    |
| scFlavorId                                           |           |   ✓   |     ✓    |    ✓    |
| scFlowCloseMode                                      |           |   ✓   |     ✓    |    ✓    |
| scFlowContextId                                      |           |   ✓   |     ✓    |    ✓    |
| scGeneratorId                                        |           |   ✓   |     ✓    |    ✓    |
| scInfoString                                         |           |   ✓   |     ✓    |    ✓    |
| scInitiatingSide                                     |           |   ✓   |     ✓    |    ✓    |
| scLinkId                                             |           |   ✓   |     ✓    |    ✓    |
| scPackageCounterId                                   |           |   ✓   |     ✓    |    ✓    |
| scPackageId                                          |           |   ✓   |     ✓    |    ✓    |
| scProtocolId                                         |           |   ✓   |     ✓    |    ✓    |
| scProtocolSignature                                  |           |   ✓   |     ✓    |    ✓    |
| scReason                                             |           |   ✓   |     ✓    |    ✓    |
| scReportTime                                         |           |   ✓   |     ✓    |    ✓    |
| scSeconds                                            |           |   ✓   |     ✓    |    ✓    |
| scServerPort                                         |           |   ✓   |     ✓    |    ✓    |
| scServiceGlobalCounterId                             |           |   ✓   |     ✓    |    ✓    |
| scServiceId                                          |           |   ✓   |     ✓    |    ✓    |
| scServiceUsageCounterId                              |           |   ✓   |     ✓    |    ✓    |
| scSessionDownstreamVolume                            |           |   ✓   |     ✓    |    ✓    |
| scSessions                                           |           |   ✓   |     ✓    |    ✓    |
| scSessionUpstreamVolume                              |           |   ✓   |     ✓    |    ✓    |
| scSkipppedSessions                                   |           |   ✓   |     ✓    |    ✓    |
| scSourceIpSample                                     |           |   ✓   |     ✓    |    ✓    |
| scSubscriberCounterId                                |           |   ✓   |     ✓    |    ✓    |
| scSubscriberId                                       |           |   ✓   |     ✓    |    ✓    |
| scTag                                                |           |   ✓   |     ✓    |    ✓    |
| scTimeFrame                                          |           |   ✓   |     ✓    |    ✓    |
| scTotalActiveSubscribers                             |           |   ✓   |     ✓    |    ✓    |
| scTrafficProcessorId                                 |           |   ✓   |     ✓    |    ✓    |
| scTransactionDurationMillisec                        |           |   ✓   |     ✓    |    ✓    |
| scUpstreamVolume                                     |           |   ✓   |     ✓    |    ✓    |
| scZoneId                                             |           |   ✓   |     ✓    |    ✓    |
| sdwan preferred-color-not-met                        |           |   ✓   |     ✓    |    ✓    |
| sdwan qos-queue-id                                   |           |   ✓   |     ✓    |    ✓    |
| sdwan sla-not-met                                    |           |   ✓   |     ✓    |    ✓    |
| server network delay average                         |           |   ✓   |     ✓    |    ✓    |
| server response time average                         |           |   ✓   |     ✓    |    ✓    |
| services pfr class-tag-id                            |           |   ✓   |     ✓    |    ✓    |
| services pfr mc-id                                   |           |   ✓   |     ✓    |    ✓    |
| services waas passthrough-reason                     |           |   ✓   |     ✓    |    ✓    |
| services waas segment                                |           |   ✓   |     ✓    |    ✓    |
| session time average                                 |           |   ✓   |     ✓    |    ✓    |
| session time maximum                                 |           |   ✓   |     ✓    |    ✓    |
| session time minimum                                 |           |   ✓   |     ✓    |    ✓    |
| SGT\_DESTINATION\_NAME                               |           |   ✓   |     ✓    |    ✓    |
| SGT\_DESTINATION\_TAG                                |           |   ✓   |     ✓    |    ✓    |
| SGT\_SOURCE\_NAME                                    |           |   ✓   |     ✓    |    ✓    |
| SGT\_SOURCE\_TAG                                     |           |   ✓   |     ✓    |    ✓    |
| sip header from uri host ip addr                     |           |   ✓   |     ✓    |    ✓    |
| sip header from uri userinfo user                    |           |   ✓   |     ✓    |    ✓    |
| sip header to uri host ip addr                       |           |   ✓   |     ✓    |    ✓    |
| sip header to uri userinfo user                      |           |   ✓   |     ✓    |    ✓    |
| sip sess duration                                    |           |   ✓   |     ✓    |    ✓    |
| sip sess end\_reason                                 |           |   ✓   |     ✓    |    ✓    |
| sip sess\_connected                                  |           |   ✓   |     ✓    |    ✓    |
| sip sess\_dialed                                     |           |   ✓   |     ✓    |    ✓    |
| sip sess\_failed                                     |           |   ✓   |     ✓    |    ✓    |
| start timestamp                                      |           |   ✓   |     ✓    |    ✓    |
| tcpWindowSizeSum                                     |           |   ✓   |     ✓    |    ✓    |
| threshold                                            |           |   ✓   |     ✓    |    ✓    |
| timestamp interval                                   |           |   ✓   |     ✓    |    ✓    |
| timestampAbsoluteMonitoring-intervalEnd              |           |   ✓   |     ✓    |    ✓    |
| timestampAbsoluteMonitoring-intervalStart            |           |   ✓   |     ✓    |    ✓    |
| tloc local color                                     |           |   ✓   |     ✓    |    ✓    |
| tloc local system ip address                         |           |   ✓   |     ✓    |    ✓    |
| tloc remote color                                    |           |   ✓   |     ✓    |    ✓    |
| tloc remote system ip address                        |           |   ✓   |     ✓    |    ✓    |
| tloc table overlay session id                        |           |   ✓   |     ✓    |    ✓    |
| tloc tunnel protocol                                 |           |   ✓   |     ✓    |    ✓    |
| transaction time average                             |           |   ✓   |     ✓    |    ✓    |
| transport bytes expected                             |           |   ✓   |     ✓    |    ✓    |
| transport bytes lost                                 |           |   ✓   |     ✓    |    ✓    |
| transport bytes lost rate                            |           |   ✓   |     ✓    |    ✓    |
| transport bytes out-of-order                         |           |   ✓   |     ✓    |    ✓    |
| transport destination-port max                       |           |   ✓   |     ✓    |    ✓    |
| transport destination-port min                       |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter                  |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter max              |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter min              |           |   ✓   |     ✓    |    ✓    |
| transport event packet-loss counter perman           |           |   ✓   |     ✓    |    ✓    |
| transport packets expected counter                   |           |   ✓   |     ✓    |    ✓    |
| transport packets expected counter permane           |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter                       |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter max                   |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter min                   |           |   ✓   |     ✓    |    ✓    |
| transport packets lost counter permanent             |           |   ✓   |     ✓    |    ✓    |
| transport packets lost rate                          |           |   ✓   |     ✓    |    ✓    |
| transport packets lost rate max                      |           |   ✓   |     ✓    |    ✓    |
| transport packets lost rate min                      |           |   ✓   |     ✓    |    ✓    |
| transport packets out-of-order                       |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time                            |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time max                        |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time min                        |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time samples                    |           |   ✓   |     ✓    |    ✓    |
| transport round-trip-time sum                        |           |   ✓   |     ✓    |    ✓    |
| transport rtp flow count                             |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter inter arrival mean              |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter inter arrival samples           |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter inter arrival sum               |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter maximum                         |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter mean                            |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter mean sum                        |           |   ✓   |     ✓    |    ✓    |
| transport rtp jitter minimum                         |           |   ✓   |     ✓    |    ✓    |
| transport rtp payload-type                           |           |   ✓   |     ✓    |    ✓    |
| transport rtp sequence-number                        |           |   ✓   |     ✓    |    ✓    |
| transport rtp sequence-number last                   |           |   ✓   |     ✓    |    ✓    |
| transport rtp ssrc                                   |           |   ✓   |     ✓    |    ✓    |
| transport source-port max                            |           |   ✓   |     ✓    |    ✓    |
| transport source-port min                            |           |   ✓   |     ✓    |    ✓    |
| transport tcp flow count                             |           |   ✓   |     ✓    |    ✓    |
| transport tcp maximum-segment-size                   |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size average                    |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size average sum                |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size maximum                    |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size minimum                    |           |   ✓   |     ✓    |    ✓    |
| transport tcp window-size sum                        |           |   ✓   |     ✓    |    ✓    |
| unresponsive sessions                                |           |   ✓   |     ✓    |    ✓    |
| vxlan flags                                          |           |   ✓   |     ✓    |    ✓    |
| vxlan sgt                                            |           |   ✓   |     ✓    |    ✓    |
| vxlan vtep input                                     |           |   ✓   |     ✓    |    ✓    |
| vxlan vtep output                                    |           |   ✓   |     ✓    |    ✓    |
| waas application                                     |           |   ✓   |     ✓    |    ✓    |
| waas bytes input                                     |           |   ✓   |     ✓    |    ✓    |
| waas bytes output                                    |           |   ✓   |     ✓    |    ✓    |
| waas class                                           |           |   ✓   |     ✓    |    ✓    |
| waas connection mode                                 |           |   ✓   |     ✓    |    ✓    |
| waas dre input                                       |           |   ✓   |     ✓    |    ✓    |
| waas dre output                                      |           |   ✓   |     ✓    |    ✓    |
| waas lz input                                        |           |   ✓   |     ✓    |    ✓    |
| waas lz output                                       |           |   ✓   |     ✓    |    ✓    |
| waas optimised bytes                                 |           |   ✓   |     ✓    |    ✓    |
| waas original bytes                                  |           |   ✓   |     ✓    |    ✓    |
| wireless afd accept bytes                            |           |   ✓   |     ✓    |    ✓    |
| wireless afd accept packets                          |           |   ✓   |     ✓    |    ✓    |
| wireless afd drop bytes                              |           |   ✓   |     ✓    |    ✓    |
| wireless afd drop packets                            |           |   ✓   |     ✓    |    ✓    |
| wlan\_id                                             |           |   ✓   |     ✓    |    ✓    |
| XLATE\_DST\_ADDR\_IPV4                               |           |   ✓   |     ✓    |    ✓    |
| XLATE\_DST\_PORT                                     |           |   ✓   |     ✓    |    ✓    |
| XLATE\_SRC\_ADDR\_IPV4                               |           |   ✓   |     ✓    |    ✓    |
| XLATE\_SRC\_PORT                                     |           |   ✓   |     ✓    |    ✓    |

### NetQuest (PEN: 568)

| Name                                  | Community | Basic | Standard | Premium |
| ------------------------------------- | :-------: | :---: | :------: | :-----: |
| bgp\_dest\_as                         |           |   ✓   |     ✓    |    ✓    |
| bgp\_next\_hop\_ip                    |           |   ✓   |     ✓    |    ✓    |
| bgp\_source\_as                       |           |   ✓   |     ✓    |    ✓    |
| dlts\_not\_valid\_after               |           |   ✓   |     ✓    |    ✓    |
| dns\_flags\_codes                     |           |   ✓   |     ✓    |    ✓    |
| dns\_qclass                           |           |   ✓   |     ✓    |    ✓    |
| dns\_qtype                            |           |   ✓   |     ✓    |    ✓    |
| dns\_query                            |           |   ✓   |     ✓    |    ✓    |
| dns\_rcode                            |           |   ✓   |     ✓    |    ✓    |
| dns\_response\_ipv4\_addr             |           |   ✓   |     ✓    |    ✓    |
| dns\_response\_ipv6\_addr             |           |   ✓   |     ✓    |    ✓    |
| dns\_trans\_id                        |           |   ✓   |     ✓    |    ✓    |
| dns\_TTLs                             |           |   ✓   |     ✓    |    ✓    |
| dtls\_cert\_hash                      |           |   ✓   |     ✓    |    ✓    |
| dtls\_certificate\_issuer\_cn         |           |   ✓   |     ✓    |    ✓    |
| dtls\_certificate\_subject\_key\_size |           |   ✓   |     ✓    |    ✓    |
| dtls\_cipher                          |           |   ✓   |     ✓    |    ✓    |
| dtls\_client\_subject                 |           |   ✓   |     ✓    |    ✓    |
| dtls\_common\_name                    |           |   ✓   |     ✓    |    ✓    |
| dtls\_issuer                          |           |   ✓   |     ✓    |    ✓    |
| dtls\_ja3                             |           |   ✓   |     ✓    |    ✓    |
| dtls\_ja3s                            |           |   ✓   |     ✓    |    ✓    |
| dtls\_not\_valid\_before              |           |   ✓   |     ✓    |    ✓    |
| dtls\_server\_name                    |           |   ✓   |     ✓    |    ✓    |
| dtls\_subject                         |           |   ✓   |     ✓    |    ✓    |
| dtls\_version                         |           |   ✓   |     ✓    |    ✓    |
| GRE\_packets                          |           |   ✓   |     ✓    |    ✓    |
| GTP\_packets                          |           |   ✓   |     ✓    |    ✓    |
| http\_host                            |           |   ✓   |     ✓    |    ✓    |
| http\_method                          |           |   ✓   |     ✓    |    ✓    |
| http\_password                        |           |   ✓   |     ✓    |    ✓    |
| http\_proxied                         |           |   ✓   |     ✓    |    ✓    |
| http\_referrer                        |           |   ✓   |     ✓    |    ✓    |
| http\_request\_body\_len              |           |   ✓   |     ✓    |    ✓    |
| http\_response\_body\_len             |           |   ✓   |     ✓    |    ✓    |
| http\_status\_code                    |           |   ✓   |     ✓    |    ✓    |
| http\_status\_msg                     |           |   ✓   |     ✓    |    ✓    |
| http\_uri                             |           |   ✓   |     ✓    |    ✓    |
| http\_user\_agent                     |           |   ✓   |     ✓    |    ✓    |
| http\_username                        |           |   ✓   |     ✓    |    ✓    |
| IP-in-IP\_packets                     |           |   ✓   |     ✓    |    ✓    |
| JA3C                                  |           |   ✓   |     ✓    |    ✓    |
| JA3S                                  |           |   ✓   |     ✓    |    ✓    |
| JA4                                   |           |   ✓   |     ✓    |    ✓    |
| L2TP\_packets                         |           |   ✓   |     ✓    |    ✓    |
| MACSEC\_packets                       |           |   ✓   |     ✓    |    ✓    |
| ospf\_area\_id                        |           |   ✓   |     ✓    |    ✓    |
| ospf\_backup\_router                  |           |   ✓   |     ✓    |    ✓    |
| ospf\_dead\_interval                  |           |   ✓   |     ✓    |    ✓    |
| ospf\_designated\_router              |           |   ✓   |     ✓    |    ✓    |
| ospf\_external\_fwd\_addr             |           |   ✓   |     ✓    |    ✓    |
| ospf\_external\_route\_tag            |           |   ✓   |     ✓    |    ✓    |
| ospf\_hello\_interval                 |           |   ✓   |     ✓    |    ✓    |
| ospf\_link\_data                      |           |   ✓   |     ✓    |    ✓    |
| ospf\_link\_id                        |           |   ✓   |     ✓    |    ✓    |
| ospf\_link\_type                      |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_adv\_router                 |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_age                         |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_attach\_router              |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_flags\_b                    |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_flags\_e                    |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_flags\_v                    |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_id                          |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_metric                      |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_seq\_number                 |           |   ✓   |     ✓    |    ✓    |
| ospf\_ls\_type                        |           |   ✓   |     ✓    |    ✓    |
| ospf\_message\_type                   |           |   ✓   |     ✓    |    ✓    |
| ospf\_neighbor                        |           |   ✓   |     ✓    |    ✓    |
| ospf\_netmask                         |           |   ✓   |     ✓    |    ✓    |
| ospf\_options                         |           |   ✓   |     ✓    |    ✓    |
| ospf\_priority                        |           |   ✓   |     ✓    |    ✓    |
| ospf\_router\_id                      |           |   ✓   |     ✓    |    ✓    |
| PPTP\_packets                         |           |   ✓   |     ✓    |    ✓    |
| PWE3\_w\_ctrl\_word\_packets          |           |   ✓   |     ✓    |    ✓    |
| PWE3\_wo\_ctrl\_word\_packets         |           |   ✓   |     ✓    |    ✓    |
| quic\_server\_name                    |           |   ✓   |     ✓    |    ✓    |
| quic\_user\_agent                     |           |   ✓   |     ✓    |    ✓    |
| quic\_version                         |           |   ✓   |     ✓    |    ✓    |
| sip\_call\_id                         |           |   ✓   |     ✓    |    ✓    |
| sip\_connection\_addr\_ipv4           |           |   ✓   |     ✓    |    ✓    |
| sip\_connection\_addr\_ipv6           |           |   ✓   |     ✓    |    ✓    |
| sip\_from                             |           |   ✓   |     ✓    |    ✓    |
| sip\_to                               |           |   ✓   |     ✓    |    ✓    |
| sip\_via                              |           |   ✓   |     ✓    |    ✓    |
| ssh\_cipher\_alg\_cts                 |           |   ✓   |     ✓    |    ✓    |
| ssh\_cipher\_alg\_stc                 |           |   ✓   |     ✓    |    ✓    |
| ssh\_client                           |           |   ✓   |     ✓    |    ✓    |
| ssh\_compression\_alg\_cts            |           |   ✓   |     ✓    |    ✓    |
| ssh\_compression\_alg\_stc            |           |   ✓   |     ✓    |    ✓    |
| ssh\_fingerprint\_hassh               |           |   ✓   |     ✓    |    ✓    |
| ssh\_fingerprint\_hassh\_server       |           |   ✓   |     ✓    |    ✓    |
| ssh\_host\_key\_alg                   |           |   ✓   |     ✓    |    ✓    |
| ssh\_kex\_alg\_cts                    |           |   ✓   |     ✓    |    ✓    |
| ssh\_kex\_alg\_stc                    |           |   ✓   |     ✓    |    ✓    |
| ssh\_mac\_alg\_cts                    |           |   ✓   |     ✓    |    ✓    |
| ssh\_mac\_alg\_stc                    |           |   ✓   |     ✓    |    ✓    |
| ssh\_server                           |           |   ✓   |     ✓    |    ✓    |
| ssh\_version                          |           |   ✓   |     ✓    |    ✓    |
| ssl\_cert\_hash                       |           |   ✓   |     ✓    |    ✓    |
| ssl\_certificate\_subject\_key\_size  |           |   ✓   |     ✓    |    ✓    |
| ssl\_cipher                           |           |   ✓   |     ✓    |    ✓    |
| ssl\_client\_issuer                   |           |   ✓   |     ✓    |    ✓    |
| ssl\_client\_subject                  |           |   ✓   |     ✓    |    ✓    |
| ssl\_issuer                           |           |   ✓   |     ✓    |    ✓    |
| ssl\_not\_valid\_after                |           |   ✓   |     ✓    |    ✓    |
| ssl\_not\_valid\_before               |           |   ✓   |     ✓    |    ✓    |
| ssl\_server\_name                     |           |   ✓   |     ✓    |    ✓    |
| ssl\_session\_id                      |           |   ✓   |     ✓    |    ✓    |
| ssl\_subject                          |           |   ✓   |     ✓    |    ✓    |
| ssl\_version                          |           |   ✓   |     ✓    |    ✓    |

### Nokia, was Alcatel-Lucent (PEN: 637)

| Name                              | Community | Basic | Standard | Premium |
| --------------------------------- | :-------: | :---: | :------: | :-----: |
| aaApp                             |           |   ✓   |     ✓    |    ✓    |
| aaAppGrp                          |           |   ✓   |     ✓    |    ✓    |
| aaChargingGroup                   |           |   ✓   |     ✓    |    ✓    |
| aaProt                            |           |   ✓   |     ✓    |    ✓    |
| aaRecordType                      |           |   ✓   |     ✓    |    ✓    |
| aaSubTetheringState               |           |   ✓   |     ✓    |    ✓    |
| aaSubType                         |           |   ✓   |     ✓    |    ✓    |
| anlCongestionState                |           |   ✓   |     ✓    |    ✓    |
| anlTopology                       |           |   ✓   |     ✓    |    ✓    |
| anlType                           |           |   ✓   |     ✓    |    ✓    |
| apn                               |           |   ✓   |     ✓    |    ✓    |
| avgFrameArrivalDelay              |           |   ✓   |     ✓    |    ✓    |
| avgGoPLength                      |           |   ✓   |     ✓    |    ✓    |
| avgInterIFrameGap                 |           |   ✓   |     ✓    |    ✓    |
| BFrameImpaired                    |           |   ✓   |     ✓    |    ✓    |
| BFrameReceived                    |           |   ✓   |     ✓    |    ✓    |
| bsid                              |           |   ✓   |     ✓    |    ✓    |
| cellId                            |           |   ✓   |     ✓    |    ✓    |
| chargeId                          |           |   ✓   |     ✓    |    ✓    |
| chargingChar                      |           |   ✓   |     ✓    |    ✓    |
| customerId                        |           |   ✓   |     ✓    |    ✓    |
| deviceId                          |           |   ✓   |     ✓    |    ✓    |
| deviceMfgId                       |           |   ✓   |     ✓    |    ✓    |
| deviceOsId                        |           |   ✓   |     ✓    |    ✓    |
| deviceOsVer1                      |           |   ✓   |     ✓    |    ✓    |
| deviceOsVer2                      |           |   ✓   |     ✓    |    ✓    |
| deviceOsVer3                      |           |   ✓   |     ✓    |    ✓    |
| estimatedPSNR                     |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_abr\_service            |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_audio                   |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_download                |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_encrypted               |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_esni                    |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_realtime\_communication |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_upload                  |           |   ✓   |     ✓    |    ✓    |
| flowAttr\_video                   |           |   ✓   |     ✓    |    ✓    |
| frameInterArrivalJitter           |           |   ✓   |     ✓    |    ✓    |
| frameRate                         |           |   ✓   |     ✓    |    ✓    |
| GoPType                           |           |   ✓   |     ✓    |    ✓    |
| hostName                          |           |   ✓   |     ✓    |    ✓    |
| IFrameImpaired                    |           |   ✓   |     ✓    |    ✓    |
| IFrameInterArrivalJitter          |           |   ✓   |     ✓    |    ✓    |
| IFrameReceived                    |           |   ✓   |     ✓    |    ✓    |
| imageHeight                       |           |   ✓   |     ✓    |    ✓    |
| imageWidth                        |           |   ✓   |     ✓    |    ✓    |
| imei                              |           |   ✓   |     ✓    |    ✓    |
| imsi                              |           |   ✓   |     ✓    |    ✓    |
| ipFamily                          |           |   ✓   |     ✓    |    ✓    |
| MAPDV                             |           |   ✓   |     ✓    |    ✓    |
| mcc                               |           |   ✓   |     ✓    |    ✓    |
| mnc                               |           |   ✓   |     ✓    |    ✓    |
| MOSA                              |           |   ✓   |     ✓    |    ✓    |
| MOSAV                             |           |   ✓   |     ✓    |    ✓    |
| MOSCQ                             |           |   ✓   |     ✓    |    ✓    |
| MOSLQ                             |           |   ✓   |     ✓    |    ✓    |
| MOSNOM                            |           |   ✓   |     ✓    |    ✓    |
| MOSReference                      |           |   ✓   |     ✓    |    ✓    |
| MOSVAbsolute                      |           |   ✓   |     ✓    |    ✓    |
| MOSVRelative                      |           |   ✓   |     ✓    |    ✓    |
| msisdn                            |           |   ✓   |     ✓    |    ✓    |
| natInsideSvcid                    |           |   ✓   |     ✓    |    ✓    |
| natOutsideSvcid                   |           |   ✓   |     ✓    |    ✓    |
| natSubString                      |           |   ✓   |     ✓    |    ✓    |
| PFrameImpaired                    |           |   ✓   |     ✓    |    ✓    |
| PFrameReceived                    |           |   ✓   |     ✓    |    ✓    |
| pgw-ggsnAddr                      |           |   ✓   |     ✓    |    ✓    |
| plmnid                            |           |   ✓   |     ✓    |    ✓    |
| PPDVM                             |           |   ✓   |     ✓    |    ✓    |
| ratType                           |           |   ✓   |     ✓    |    ✓    |
| RBurst                            |           |   ✓   |     ✓    |    ✓    |
| RCQ                               |           |   ✓   |     ✓    |    ✓    |
| regionId                          |           |   ✓   |     ✓    |    ✓    |
| RG107                             |           |   ✓   |     ✓    |    ✓    |
| RGap                              |           |   ✓   |     ✓    |    ✓    |
| RLQ                               |           |   ✓   |     ✓    |    ✓    |
| RNom                              |           |   ✓   |     ✓    |    ✓    |
| roamingStatus                     |           |   ✓   |     ✓    |    ✓    |
| rtpAvgAudioBw                     |           |   ✓   |     ✓    |    ✓    |
| rtpAvgBurstLengthMs               |           |   ✓   |     ✓    |    ✓    |
| rtpAvgBurstLengthPkts             |           |   ✓   |     ✓    |    ✓    |
| rtpAvgGapLengthMs                 |           |   ✓   |     ✓    |    ✓    |
| rtpAvgGapLengthPkts               |           |   ✓   |     ✓    |    ✓    |
| rtpAvgRtDelay                     |           |   ✓   |     ✓    |    ✓    |
| rtpAvgVideoBw                     |           |   ✓   |     ✓    |    ✓    |
| rtpAvgVoiceBw                     |           |   ✓   |     ✓    |    ✓    |
| rtpBurstCount                     |           |   ✓   |     ✓    |    ✓    |
| rtpCodecName                      |           |   ✓   |     ✓    |    ✓    |
| rtpDegAVSync                      |           |   ✓   |     ✓    |    ✓    |
| rtpDegCodecEncBwRestrict          |           |   ✓   |     ✓    |    ✓    |
| rtpDegCodecQuantize               |           |   ✓   |     ✓    |    ✓    |
| rtpDegCodecType                   |           |   ✓   |     ✓    |    ✓    |
| rtpDegDelay                       |           |   ✓   |     ✓    |    ✓    |
| rtpDegEcho                        |           |   ✓   |     ✓    |    ✓    |
| rtpDegFramePresentRate            |           |   ✓   |     ✓    |    ✓    |
| rtpDegFrameRez                    |           |   ✓   |     ✓    |    ✓    |
| rtpDegGoPLength                   |           |   ✓   |     ✓    |    ✓    |
| rtpDegNetBwConstraint             |           |   ✓   |     ✓    |    ✓    |
| rtpDegNoiseLevel                  |           |   ✓   |     ✓    |    ✓    |
| rtpDegPacketDiscard               |           |   ✓   |     ✓    |    ✓    |
| rtpDegPacketLoss                  |           |   ✓   |     ✓    |    ✓    |
| rtpDegRecency                     |           |   ✓   |     ✓    |    ✓    |
| rtpDegSignalLevel                 |           |   ✓   |     ✓    |    ✓    |
| rtpDiscardPackets                 |           |   ✓   |     ✓    |    ✓    |
| rtpGapCount                       |           |   ✓   |     ✓    |    ✓    |
| rtpLostPackets                    |           |   ✓   |     ✓    |    ✓    |
| rtpNumAudioChannels               |           |   ✓   |     ✓    |    ✓    |
| rtpOutOfSeqPackets                |           |   ✓   |     ✓    |    ✓    |
| rtpPayloadType                    |           |   ✓   |     ✓    |    ✓    |
| rtpPeakAudioBw                    |           |   ✓   |     ✓    |    ✓    |
| rtpPeakVideoBw                    |           |   ✓   |     ✓    |    ✓    |
| rtpReceivedPackets                |           |   ✓   |     ✓    |    ✓    |
| rtpRefClockRate                   |           |   ✓   |     ✓    |    ✓    |
| rtpRtDelaySrc                     |           |   ✓   |     ✓    |    ✓    |
| sessionDirection                  |           |   ✓   |     ✓    |    ✓    |
| sessionDurationMilliseconds       |           |   ✓   |     ✓    |    ✓    |
| sessionEndSeconds                 |           |   ✓   |     ✓    |    ✓    |
| sessionStartSeconds               |           |   ✓   |     ✓    |    ✓    |
| sgw-sgsnAddr                      |           |   ✓   |     ✓    |    ✓    |
| SIFrameImpaired                   |           |   ✓   |     ✓    |    ✓    |
| SIFrameReceived                   |           |   ✓   |     ✓    |    ✓    |
| slicesPerIFrame                   |           |   ✓   |     ✓    |    ✓    |
| SPFrameImpaired                   |           |   ✓   |     ✓    |    ✓    |
| SPFrameReceived                   |           |   ✓   |     ✓    |    ✓    |
| SSRC                              |           |   ✓   |     ✓    |    ✓    |
| tcpDelayAvg                       |           |   ✓   |     ✓    |    ✓    |
| tcpDelayMax                       |           |   ✓   |     ✓    |    ✓    |
| tcpDelayMin                       |           |   ✓   |     ✓    |    ✓    |
| tcpDelaySampleCnt                 |           |   ✓   |     ✓    |    ✓    |
| tcpDelayVariance                  |           |   ✓   |     ✓    |    ✓    |
| tcpRetransmittedBytes             |           |   ✓   |     ✓    |    ✓    |
| tcpRetransmittedBytes\_r          |           |   ✓   |     ✓    |    ✓    |
| tcpRetransmittedPackets           |           |   ✓   |     ✓    |    ✓    |
| tcpRetransmittedPackets\_r        |           |   ✓   |     ✓    |    ✓    |
| tcpSessionEstDelay                |           |   ✓   |     ✓    |    ✓    |
| tcpSessionEstDelay\_r             |           |   ✓   |     ✓    |    ✓    |
| timezone                          |           |   ✓   |     ✓    |    ✓    |
| uli                               |           |   ✓   |     ✓    |    ✓    |
| videoInterlaced                   |           |   ✓   |     ✓    |    ✓    |
| VSTQ                              |           |   ✓   |     ✓    |    ✓    |

### Extreme Networks (PEN: 1916)

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| appGroupName     |           |   ✓   |     ✓    |    ✓    |
| appResponseTime  |           |   ✓   |     ✓    |    ✓    |
| clientLocation   |           |   ✓   |     ✓    |    ✓    |
| detailedLocation |           |   ✓   |     ✓    |    ✓    |
| dstHostName      |           |   ✓   |     ✓    |    ✓    |
| metaData         |           |   ✓   |     ✓    |    ✓    |
| nacProfile       |           |   ✓   |     ✓    |    ✓    |
| netResponseTime  |           |   ✓   |     ✓    |    ✓    |
| oneSidedFlow     |           |   ✓   |     ✓    |    ✓    |
| serverAddress    |           |   ✓   |     ✓    |    ✓    |
| serverLocation   |           |   ✓   |     ✓    |    ✓    |
| srcHostName      |           |   ✓   |     ✓    |    ✓    |
| userName         |           |   ✓   |     ✓    |    ✓    |

### UNINETT (PEN: 2428)

| Name                | Community | Basic | Standard | Premium |
| ------------------- | :-------: | :---: | :------: | :-----: |
| CONN\_DIRECTION     |           |   ✓   |     ✓    |    ✓    |
| EXPVAL\_PKT\_DIST   |           |   ✓   |     ✓    |    ✓    |
| EXPVAL\_PKT\_LENGTH |           |   ✓   |     ✓    |    ✓    |
| HIST\_PKT\_DIST     |           |   ✓   |     ✓    |    ✓    |
| HIST\_PKT\_LEN      |           |   ✓   |     ✓    |    ✓    |
| MAXRATE\_100MS      |           |   ✓   |     ✓    |    ✓    |
| MAXRATE\_10MS       |           |   ✓   |     ✓    |    ✓    |
| MAXRATE\_1MS        |           |   ✓   |     ✓    |    ✓    |
| MAXRATE\_1SEC       |           |   ✓   |     ✓    |    ✓    |
| MINRATE\_100MS      |           |   ✓   |     ✓    |    ✓    |
| MINRATE\_10MS       |           |   ✓   |     ✓    |    ✓    |
| MINRATE\_1MS        |           |   ✓   |     ✓    |    ✓    |
| MINRATE\_1SEC       |           |   ✓   |     ✓    |    ✓    |
| PAYLOAD             |           |   ✓   |     ✓    |    ✓    |
| PIM\_PACKETS        |           |   ✓   |     ✓    |    ✓    |
| PKT\_REORDERED      |           |   ✓   |     ✓    |    ✓    |
| QSUM\_PKT\_DIST     |           |   ✓   |     ✓    |    ✓    |
| QSUM\_PKT\_LENGTH   |           |   ✓   |     ✓    |    ✓    |
| RTP\_JITTER         |           |   ✓   |     ✓    |    ✓    |
| RTP\_LOSTFRAC       |           |   ✓   |     ✓    |    ✓    |
| RTP\_LOSTPKTS       |           |   ✓   |     ✓    |    ✓    |
| RTP\_SEQCYCLES      |           |   ✓   |     ✓    |    ✓    |
| SERVICE             |           |   ✓   |     ✓    |    ✓    |
| SUM\_PKT\_DIST      |           |   ✓   |     ✓    |    ✓    |
| SUM\_PKT\_LENGTH    |           |   ✓   |     ✓    |    ✓    |
| TCPWIN\_EFF         |           |   ✓   |     ✓    |    ✓    |
| TCPWIN\_MAX         |           |   ✓   |     ✓    |    ✓    |
| TCPWIN\_MIN         |           |   ✓   |     ✓    |    ✓    |
| VAR\_PKT\_DIST      |           |   ✓   |     ✓    |    ✓    |
| VAR\_PKT\_LENGTH    |           |   ✓   |     ✓    |    ✓    |

### Juniper Networks (PEN: 2636)

| Name                  | Community | Basic | Standard | Premium |
| --------------------- | :-------: | :---: | :------: | :-----: |
| Forwarding Class Name |           |   ✓   |     ✓    |    ✓    |
| ifa\_headers          |           |   ✓   |     ✓    |    ✓    |
| ifa\_metadata         |           |   ✓   |     ✓    |    ✓    |
| ifa\_sampled\_packet  |           |   ✓   |     ✓    |    ✓    |
| Packet Loss Priority  |           |   ✓   |     ✓    |    ✓    |

### Ixia Communications (PEN: 3054)

| Name                         | Community | Basic | Standard | Premium |
| ---------------------------- | :-------: | :---: | :------: | :-----: |
| BrowserId                    |           |   ✓   |     ✓    |    ✓    |
| BrowserName                  |           |   ✓   |     ✓    |    ✓    |
| ConnAvgRtt                   |           |   ✓   |     ✓    |    ✓    |
| DeviceId                     |           |   ✓   |     ✓    |    ✓    |
| DeviceName                   |           |   ✓   |     ✓    |    ✓    |
| DhcpAgentCircuitId           |           |   ✓   |     ✓    |    ✓    |
| DhcpClientId                 |           |   ✓   |     ✓    |    ✓    |
| DhcpClientMac                |           |   ✓   |     ✓    |    ✓    |
| DhcpLeaseDuration            |           |   ✓   |     ✓    |    ✓    |
| DhcpMessageTimestamp         |           |   ✓   |     ✓    |    ✓    |
| DhcpMessageType              |           |   ✓   |     ✓    |    ✓    |
| DhcpServerName               |           |   ✓   |     ✓    |    ✓    |
| DnsAnCount                   |           |   ✓   |     ✓    |    ✓    |
| DnsAnswer                    |           |   ✓   |     ✓    |    ✓    |
| DnsArCount                   |           |   ✓   |     ✓    |    ✓    |
| DnsAuthAnswer                |           |   ✓   |     ✓    |    ✓    |
| DnsCanonicalName             |           |   ✓   |     ✓    |    ✓    |
| DnsClasses                   |           |   ✓   |     ✓    |    ✓    |
| DnsIPv4Address               |           |   ✓   |     ✓    |    ✓    |
| DNSIPv6Address               |           |   ✓   |     ✓    |    ✓    |
| DnsMxDomain                  |           |   ✓   |     ✓    |    ✓    |
| DNSName                      |           |   ✓   |     ✓    |    ✓    |
| DnsNsCount                   |           |   ✓   |     ✓    |    ✓    |
| DnsOpcode                    |           |   ✓   |     ✓    |    ✓    |
| DnsPackets                   |           |   ✓   |     ✓    |    ✓    |
| DnsQdCount                   |           |   ✓   |     ✓    |    ✓    |
| DnsQrFlag                    |           |   ✓   |     ✓    |    ✓    |
| DnsQuery                     |           |   ✓   |     ✓    |    ✓    |
| DnsQueryName                 |           |   ✓   |     ✓    |    ✓    |
| DnsQueryType                 |           |   ✓   |     ✓    |    ✓    |
| DnsQuestions                 |           |   ✓   |     ✓    |    ✓    |
| DnsRawRdata                  |           |   ✓   |     ✓    |    ✓    |
| DnsRdataLen                  |           |   ✓   |     ✓    |    ✓    |
| DnsRecordTtl                 |           |   ✓   |     ✓    |    ✓    |
| DnsRecordTxt                 |           |   ✓   |     ✓    |    ✓    |
| DnsRecursionAvail            |           |   ✓   |     ✓    |    ✓    |
| DnsRecursionDesired          |           |   ✓   |     ✓    |    ✓    |
| DnsRequestType               |           |   ✓   |     ✓    |    ✓    |
| DnsResponseCode              |           |   ✓   |     ✓    |    ✓    |
| DnsResponseType              |           |   ✓   |     ✓    |    ✓    |
| DnsSectionType               |           |   ✓   |     ✓    |    ✓    |
| DnsTransactionId             |           |   ✓   |     ✓    |    ✓    |
| DnsTrucation                 |           |   ✓   |     ✓    |    ✓    |
| DstAsName                    |           |   ✓   |     ✓    |    ✓    |
| DstCityName                  |           |   ✓   |     ✓    |    ✓    |
| DstCountryCode               |           |   ✓   |     ✓    |    ✓    |
| DstCountryName               |           |   ✓   |     ✓    |    ✓    |
| DstLatitude                  |           |   ✓   |     ✓    |    ✓    |
| DstLongitude                 |           |   ✓   |     ✓    |    ✓    |
| DstRegionCode                |           |   ✓   |     ✓    |    ✓    |
| DstRegionNode                |           |   ✓   |     ✓    |    ✓    |
| EmailMsgAttachments          |           |   ✓   |     ✓    |    ✓    |
| EmailMsgBcc                  |           |   ✓   |     ✓    |    ✓    |
| EmailMsgCc                   |           |   ✓   |     ✓    |    ✓    |
| EmailMsgDate                 |           |   ✓   |     ✓    |    ✓    |
| EmailMsgFrom                 |           |   ✓   |     ✓    |    ✓    |
| EmailMsgId                   |           |   ✓   |     ✓    |    ✓    |
| EmailMsgSubject              |           |   ✓   |     ✓    |    ✓    |
| EmailMsgTo                   |           |   ✓   |     ✓    |    ✓    |
| EncryptCipher                |           |   ✓   |     ✓    |    ✓    |
| EncryptKeyLength             |           |   ✓   |     ✓    |    ✓    |
| EncryptType                  |           |   ✓   |     ✓    |    ✓    |
| gtp\_down\_APN\_DNN          |           |   ✓   |     ✓    |    ✓    |
| gtp\_down\_ipv4\_addr        |           |   ✓   |     ✓    |    ✓    |
| gtp\_down\_ipv6\_addr        |           |   ✓   |     ✓    |    ✓    |
| gtp\_down\_QCI\_QFI          |           |   ✓   |     ✓    |    ✓    |
| gtp\_down\_TEID              |           |   ✓   |     ✓    |    ✓    |
| gtp\_ep\_gen                 |           |   ✓   |     ✓    |    ✓    |
| gtp\_IMEI                    |           |   ✓   |     ✓    |    ✓    |
| gtp\_IMSI                    |           |   ✓   |     ✓    |    ✓    |
| gtp\_MSISDN                  |           |   ✓   |     ✓    |    ✓    |
| gtp\_RAT\_type               |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_CELL\_ID           |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_ECGI\_E\_NODEB\_ID |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_LAC                |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_MCC                |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_MNC                |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_RAI\_RAC           |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_SAI\_SAC           |           |   ✓   |     ✓    |    ✓    |
| gtp\_ULI\_TAC                |           |   ✓   |     ✓    |    ✓    |
| gtp\_up\_APN\_DNN            |           |   ✓   |     ✓    |    ✓    |
| gtp\_up\_ipv4\_addr          |           |   ✓   |     ✓    |    ✓    |
| gtp\_up\_ipv6\_addr          |           |   ✓   |     ✓    |    ✓    |
| gtp\_up\_QCI\_QFI            |           |   ✓   |     ✓    |    ✓    |
| gtp\_up\_TEID                |           |   ✓   |     ✓    |    ✓    |
| HttpAccept                   |           |   ✓   |     ✓    |    ✓    |
| HttpAcceptEncoding           |           |   ✓   |     ✓    |    ✓    |
| HttpAcceptLanguage           |           |   ✓   |     ✓    |    ✓    |
| HttpConnection               |           |   ✓   |     ✓    |    ✓    |
| HttpContentLength            |           |   ✓   |     ✓    |    ✓    |
| HttpHostName                 |           |   ✓   |     ✓    |    ✓    |
| HttpMessageVersion           |           |   ✓   |     ✓    |    ✓    |
| HttpReason                   |           |   ✓   |     ✓    |    ✓    |
| HttpReferer                  |           |   ✓   |     ✓    |    ✓    |
| HttpRequestMethod            |           |   ✓   |     ✓    |    ✓    |
| HttpServer                   |           |   ✓   |     ✓    |    ✓    |
| HttpStatusCode               |           |   ✓   |     ✓    |    ✓    |
| HttpUri                      |           |   ✓   |     ✓    |    ✓    |
| HttpUserAgent                |           |   ✓   |     ✓    |    ✓    |
| HttpUseragentCpu             |           |   ✓   |     ✓    |    ✓    |
| ImsiSubscriber               |           |   ✓   |     ✓    |    ✓    |
| Ja3FingerprintString         |           |   ✓   |     ✓    |    ✓    |
| L7AppId                      |           |   ✓   |     ✓    |    ✓    |
| L7AppName                    |           |   ✓   |     ✓    |    ✓    |
| Latency                      |           |   ✓   |     ✓    |    ✓    |
| MatchedFilterName            |           |   ✓   |     ✓    |    ✓    |
| QuicAppResponseTime          |           |   ✓   |     ✓    |    ✓    |
| QuicConnRTT                  |           |   ✓   |     ✓    |    ✓    |
| QuicConnSetupTime            |           |   ✓   |     ✓    |    ✓    |
| RadiusCalledStationId        |           |   ✓   |     ✓    |    ✓    |
| RadiusCallingStationId       |           |   ✓   |     ✓    |    ✓    |
| RadiusEventTimestamp         |           |   ✓   |     ✓    |    ✓    |
| RadiusFilterId               |           |   ✓   |     ✓    |    ✓    |
| RadiusFramedIp               |           |   ✓   |     ✓    |    ✓    |
| RadiusFramedProtocol         |           |   ✓   |     ✓    |    ✓    |
| RadiusNasIPv4                |           |   ✓   |     ✓    |    ✓    |
| RadiusReplyMessage           |           |   ✓   |     ✓    |    ✓    |
| RadiusServiceType            |           |   ✓   |     ✓    |    ✓    |
| RadiusTimestamp              |           |   ✓   |     ✓    |    ✓    |
| RadiusUsername               |           |   ✓   |     ✓    |    ✓    |
| RequestTime                  |           |   ✓   |     ✓    |    ✓    |
| RevOctetDeltaCount           |           |   ✓   |     ✓    |    ✓    |
| RevPacketDeltaCount          |           |   ✓   |     ✓    |    ✓    |
| Sni                          |           |   ✓   |     ✓    |    ✓    |
| SrcAsName                    |           |   ✓   |     ✓    |    ✓    |
| SrcCityName                  |           |   ✓   |     ✓    |    ✓    |
| SrcCountryCode               |           |   ✓   |     ✓    |    ✓    |
| SrcCountryName               |           |   ✓   |     ✓    |    ✓    |
| SrcLatitude                  |           |   ✓   |     ✓    |    ✓    |
| SrcLongitude                 |           |   ✓   |     ✓    |    ✓    |
| SrcRegionCode                |           |   ✓   |     ✓    |    ✓    |
| SrcRegionName                |           |   ✓   |     ✓    |    ✓    |
| TcpAppResponseTime           |           |   ✓   |     ✓    |    ✓    |
| TcpConnSetupTime             |           |   ✓   |     ✓    |    ✓    |
| TcpRetransPktCount           |           |   ✓   |     ✓    |    ✓    |
| ThreatIPv4                   |           |   ✓   |     ✓    |    ✓    |
| ThreatIPv6                   |           |   ✓   |     ✓    |    ✓    |
| ThreatType                   |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCert                  |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertAltnames          |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertAltnamesAttr      |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertAltnamesVal       |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertIssuer            |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertIssuerAttr        |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertIssuerVal         |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertSignAlgo          |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertSrlNum            |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertSubject           |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertSubjectAttr       |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertSubjectVal        |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertSubjPkiAlgo       |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertVldNtAftr         |           |   ✓   |     ✓    |    ✓    |
| TlsSrvrCertVldNtBfr          |           |   ✓   |     ✓    |    ✓    |
| UdpAppResponseTime           |           |   ✓   |     ✓    |    ✓    |

### Citrix Systems, was Netscaler (PEN: 5951)

| Name                                                | Community | Basic | Standard | Premium |
| --------------------------------------------------- | :-------: | :---: | :------: | :-----: |
| netscaleIcaClientVersion                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAaaUserEmailId                             |           |   ✓   |     ✓    |    ✓    |
| netscalerAaaUsername                                |           |   ✓   |     ✓    |    ✓    |
| netscalerAAAUsername                                |           |   ✓   |     ✓    |    ✓    |
| netscalerAccessInsightFlags                         |           |   ✓   |     ✓    |    ✓    |
| netscalerAccessInsightStatusCode                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAccessInsightTimestamp                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAccessType                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerAppFqdn                                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwAppNameId                             |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwAppSafetyIndex                        |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwAppThreatIndex                        |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwBlockFlags                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwGeoLocation                           |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwHttpMethod                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwIncarnationNumber                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwNSLatitude                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwNSLongitude                           |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileBlockFlags                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileLearnFlags                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileLogFlags                       |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileName                           |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileNoneFlags                      |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileRelaxedFlags                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSafetyIndex                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSecChecksSafetyIndex           |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSigAutoUpdate                  |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSigBlockCount                  |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSigDisabled                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSigEnabled                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSigLogCount                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSignatureSafetyIndex           |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileSigStatCount                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileStatsflags                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwProfileType                           |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwReqUrl                                |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSequenceNumber                        |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSessionId                             |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigCategory1                          |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigCategory2                          |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigCategory3                          |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigName                               |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleBlockFlags                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleCategory1                      |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleCategory2                      |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleCategory3                      |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleCategory4                      |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleCategory5                      |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleEnabledFlags                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleFileName                       |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleID1                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleID2                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleID3                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleID4                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleID5                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleLogFlags                       |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleLogstring1                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleLogstring2                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleLogstring3                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleLogstring4                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleLogString5                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwSigRuleStatsFlags                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwTransformFlags                        |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationLocation                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationNameValue1                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationNameValue2                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationNameValue3                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationOccuredTime                  |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationSeverity                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationThreatIndex                  |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationType                         |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationTypeName1                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationTypeName2                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppfwViolationTypeName3                    |           |   ✓   |     ✓    |    ✓    |
| netscalerApplicationByteCount                       |           |   ✓   |     ✓    |    ✓    |
| netscalerApplicationStartupDuration                 |           |   ✓   |     ✓    |    ✓    |
| netscalerApplicationStartupTime                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAppName                                    |           |   ✓   |     ✓    |    ✓    |
| netscalerAppNameAppId                               |           |   ✓   |     ✓    |    ✓    |
| netscalerAppNameAppId1                              |           |   ✓   |     ✓    |    ✓    |
| netscalerAppNameIncarnationNumber                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAppTemplateID                              |           |   ✓   |     ✓    |    ✓    |
| netscalerAppTemplateName                            |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthAgentName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthenticationDuration                     |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthenticationStage                        |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthenticationstage                        |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthenticationstatuscode                   |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthenticationtype                         |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthenticationType                         |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthPolicyActionName                       |           |   ✓   |     ✓    |    ✓    |
| netscalerAuthSessionID                              |           |   ✓   |     ✓    |    ✓    |
| netscalerBackendServerName                          |           |   ✓   |     ✓    |    ✓    |
| netscalerCacheServiceIPAdress                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCategoryDomainName                         |           |   ✓   |     ✓    |    ✓    |
| netscalerCategoryDomainSource                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCleartextVideoFlags                        |           |   ✓   |     ✓    |    ✓    |
| netscalerClientConnectionCoreID                     |           |   ✓   |     ✓    |    ✓    |
| netscalerClientConnectionTransactionID              |           |   ✓   |     ✓    |    ✓    |
| netscalerClientIP                                   |           |   ✓   |     ✓    |    ✓    |
| netscalerClientMss                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerClientRTT                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerClientSideZeroWindowCount                  |           |   ✓   |     ✓    |    ✓    |
| netscalerClientTypeFlags                            |           |   ✓   |     ✓    |    ✓    |
| netscalerClntTcpPacketsRetransmited                 |           |   ✓   |     ✓    |    ✓    |
| netscalerCoEmbedObjFlags                            |           |   ✓   |     ✓    |    ✓    |
| netscalerCoEmbedObjNumSize                          |           |   ✓   |     ✓    |    ✓    |
| netscalerCoEmbedObjType                             |           |   ✓   |     ✓    |    ✓    |
| netscalerCoEmbedObjUrl                              |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSCombined                      |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSDeltaSzDec                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSDeltaSzInc                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSImgsInlined                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSImport2Link                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSInlined                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSMinified                      |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSMoved                         |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSNumOptimized                  |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageCSSNumScanned                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageGifDeltaSzDec                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageGifdeltaSzInc                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageGifNumOptimized                  |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageGifNumScanned                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageGifToPngNum                      |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageGifToWebpNum                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageHtmlMinifyDeltaSz                |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageImgsInlined                      |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageImgsLazyLd                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageImgsShrinked                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJpegDeltaSzDec                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJpegDeltaSzInc                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJpegNumOptimized                 |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJpegNumScanned                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJpegToJxrNum                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJpegToWebpNum                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSDeltaSzDec                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSDeltaSzInc                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSInlined                        |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSMinified                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSMoved                          |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSNumOptimized                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageJSNumScanned                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageLazyLdJSSz                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPagePngDeltaSzDec                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPagePngDeltaSzInc                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPagePngNumOptimized                  |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPagePngNumScanned                    |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPagePngToJxrNum                      |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPagePngToWebpNum                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotalOptimized                   |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotalScanned                     |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotalSzDec                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotalSzInc                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotImgDeltaSzDec                 |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotImgDeltaSzInc                 |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotImgOptimized                  |           |   ✓   |     ✓    |    ✓    |
| netscalerCoMainPageTotImgScanned                    |           |   ✓   |     ✓    |    ✓    |
| netscalerConnectionChainHopCount                    |           |   ✓   |     ✓    |    ✓    |
| netscalerConnectionChainID                          |           |   ✓   |     ✓    |    ✓    |
| netscalerConnectionId                               |           |   ✓   |     ✓    |    ✓    |
| netscalerCSecExpression                             |           |   ✓   |     ✓    |    ✓    |
| netscalerCurFactorPolicyLabel                       |           |   ✓   |     ✓    |    ✓    |
| netscalerCurrentLicenseConsumed                     |           |   ✓   |     ✓    |    ✓    |
| netscalerDbCltHostName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerDbDatabaseName                             |           |   ✓   |     ✓    |    ✓    |
| netscalerDbLoginFlags                               |           |   ✓   |     ✓    |    ✓    |
| netscalerDbProtocolName                             |           |   ✓   |     ✓    |    ✓    |
| netscalerDbReqString                                |           |   ✓   |     ✓    |    ✓    |
| netscalerDbReqType                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerDbRespLength                               |           |   ✓   |     ✓    |    ✓    |
| netscalerDbRespStatus                               |           |   ✓   |     ✓    |    ✓    |
| netscalerDbRespStatusString                         |           |   ✓   |     ✓    |    ✓    |
| netscalerDbUserName                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerDetectedDomainName                         |           |   ✓   |     ✓    |    ✓    |
| netscalerDeviceID                                   |           |   ✓   |     ✓    |    ✓    |
| netscalerDeviceLocation                             |           |   ✓   |     ✓    |    ✓    |
| netscalerDeviceType                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerEncryptedVideoFlags                        |           |   ✓   |     ✓    |    ✓    |
| netscalerEPAID                                      |           |   ✓   |     ✓    |    ✓    |
| netscalerFastRetxCount                              |           |   ✓   |     ✓    |    ✓    |
| netscalerFeatureEnabledForAppflow                   |           |   ✓   |     ✓    |    ✓    |
| netscalerFlowFlags                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerGatewayIP                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerGatewayPort                                |           |   ✓   |     ✓    |    ✓    |
| netscalerGiTotalBytesRecvd                          |           |   ✓   |     ✓    |    ✓    |
| netscalerGiTotalBytesSent                           |           |   ✓   |     ✓    |    ✓    |
| netscalerGroupName                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerHttp2SlowrisCntr                           |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpClientInteractionEndTime               |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpClientInteractionStartTime             |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpClientRenderEndTime                    |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpClientRenderStartTime                  |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpContentType                            |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpDomainName                             |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqAuthorization                       |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqCookie                              |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqForwFB                              |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqForwLB                              |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqHost                                |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqMethod                              |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqRcvFB                               |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqRcvLB                               |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqReferer                             |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqUrl                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqUserAgent                           |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqVia                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpReqXForwardedFor                       |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResForwFB                              |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResForwLB                              |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResLocation                            |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResRcvFB                               |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResRcvLB                               |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResSetCookie                           |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpResSetCookie2                          |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpRspLen                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerHttpRspStatus                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaApplicationName                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaApplicationTerminationTime              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaApplicationTerminationType              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaAppModulePath                           |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaAppProcessID                            |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId1                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId1Bytes                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId2                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId2Bytes                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId3                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId3Bytes                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId4                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId4Bytes                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId5                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaChannelId5Bytes                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientHostName                          |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientIP                                |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientLauncher                          |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientsideDelay                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientsideJitter                        |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientsidePacketsRetransmit             |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientSideRTOCount                      |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientsideRTT                           |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientsideRXBytes                       |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientsideSRTT                          |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaClientType                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaConnectionPriority                      |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaDeviceSerialNo                          |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaDomainName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaFlags                                   |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaHostDelay                               |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaL7ClientLatency                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaL7ServerLatency                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaLaunchMechanism                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaNetworkUpdateEndTime                    |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaNetworkUpdateStartTime                  |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaRTT                                     |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServerName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServersideDelay                         |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServersideJitter                        |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServersidePacketsRetransmit             |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServerSideRTOCount                      |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServersideRTT                           |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaServersideSRTT                          |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaSessionEndTime                          |           |   ✓   |     ✓    |    ✓    |
| netscalerICASessionGuid                             |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaSessionReconnects                       |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaSessionSetupTime                        |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaSessionType                             |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaSessionUpdateBeginSec                   |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaSessionUpdateEndSec                     |           |   ✓   |     ✓    |    ✓    |
| netscalerIcaUsername                                |           |   ✓   |     ✓    |    ✓    |
| netscalerIcContGrpName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIcFlags                                    |           |   ✓   |     ✓    |    ✓    |
| netscalerIcNostoreFlags                             |           |   ✓   |     ✓    |    ✓    |
| netscalerIcPolicyName                               |           |   ✓   |     ✓    |    ✓    |
| netscalerIIPAddress                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepAppSafetyIndex                        |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepAppThreatIndex                        |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepAttackTime                            |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepCategory                              |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepGeoLocation                           |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepHTTPMethod                            |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepNSLatitude                            |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepNSLongitude                           |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepReputationScore                       |           |   ✓   |     ✓    |    ✓    |
| netscalerIprepSeverity                              |           |   ✓   |     ✓    |    ✓    |
| netscalerL7AvgClientLatency                         |           |   ✓   |     ✓    |    ✓    |
| netscalerL7AvgServerLatency                         |           |   ✓   |     ✓    |    ✓    |
| netscalerL7LatencyMaxNotifyCount                    |           |   ✓   |     ✓    |    ✓    |
| netscalerL7LatencyNotifyInterval                    |           |   ✓   |     ✓    |    ✓    |
| netscalerL7LatencyThresholdFactor                   |           |   ✓   |     ✓    |    ✓    |
| netscalerL7LatencyWaitTime                          |           |   ✓   |     ✓    |    ✓    |
| netscalerL7MaxClientLatency                         |           |   ✓   |     ✓    |    ✓    |
| netscalerL7MaxServerLatency                         |           |   ✓   |     ✓    |    ✓    |
| netscalerLicenseType                                |           |   ✓   |     ✓    |    ✓    |
| netscalerLogonTicketInfo                            |           |   ✓   |     ✓    |    ✓    |
| netscalerMainPageCoreId                             |           |   ✓   |     ✓    |    ✓    |
| netscalerMainPageId                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerMaxLicenseCount                            |           |   ✓   |     ✓    |    ✓    |
| netscalerMinL7Latency                               |           |   ✓   |     ✓    |    ✓    |
| netscalerMsiClientCookie                            |           |   ✓   |     ✓    |    ✓    |
| netscalerNextFactorPolicyLabel                      |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsAppId                                   |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsAppName                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsAppType                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsClientsideRXBytes                       |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsClientsideWireRXBytes                   |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsConnectionGuid                          |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsDomainName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsProductName                             |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsRecordType                              |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsServersideRXBytes                       |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsServersideWireRXBytes                   |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsUsageTransactionId                      |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsUsageUpdateEndTime                      |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsUsageUpdatStartTime                     |           |   ✓   |     ✓    |    ✓    |
| netscalerNgsUsername                                |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaACRCount                              |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaReconnectCount                        |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionClientIPAddress                |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionClientPort                     |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionPreviousDeviceIP               |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionServerIPAddress                |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionServerPort                     |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionStatus                         |           |   ✓   |     ✓    |    ✓    |
| netscalerNsicaSessionTimestamp                      |           |   ✓   |     ✓    |    ✓    |
| netscalerNsPartitionId                              |           |   ✓   |     ✓    |    ✓    |
| netscalerNsPartitionName                            |           |   ✓   |     ✓    |    ✓    |
| netscalerObservationDomainNumPoints                 |           |   ✓   |     ✓    |    ✓    |
| netscalerObservationPointId1                        |           |   ✓   |     ✓    |    ✓    |
| netscalerObservationPointId2                        |           |   ✓   |     ✓    |    ✓    |
| netscalerObservationPointId3                        |           |   ✓   |     ✓    |    ✓    |
| netscalerObservationPointId4                        |           |   ✓   |     ✓    |    ✓    |
| netscalerObservationPointId5                        |           |   ✓   |     ✓    |    ✓    |
| netscalerOriginResStatus                            |           |   ✓   |     ✓    |    ✓    |
| netscalerOriginRspLen                               |           |   ✓   |     ✓    |    ✓    |
| netscalerOriginServerIPAdress                       |           |   ✓   |     ✓    |    ✓    |
| netscalerPolicyName                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerRate\_limit\_identifier\_name              |           |   ✓   |     ✓    |    ✓    |
| netscalerRequestURL                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerResourceName                               |           |   ✓   |     ✓    |    ✓    |
| netscalerResponderActionType                        |           |   ✓   |     ✓    |    ✓    |
| netscalerResponseMediaType                          |           |   ✓   |     ✓    |    ✓    |
| netscalerRoundTripTime                              |           |   ✓   |     ✓    |    ✓    |
| netscalerServersideRXBytes                          |           |   ✓   |     ✓    |    ✓    |
| netscalerServerSideZeroWindowCount                  |           |   ✓   |     ✓    |    ✓    |
| netscalerServerTTFB                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerServerTTLB                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerServerVersion                              |           |   ✓   |     ✓    |    ✓    |
| netscalerSessionSharingKey                          |           |   ✓   |     ✓    |    ✓    |
| netscalerSmoothedRoundTripTime                      |           |   ✓   |     ✓    |    ✓    |
| netscalerSNIPAddress                                |           |   ✓   |     ✓    |    ✓    |
| netscalerSrvrTcpPacketsRetransmited                 |           |   ✓   |     ✓    |    ✓    |
| netscalerSslCipherValueBE                           |           |   ✓   |     ✓    |    ✓    |
| netscalerSslCipherValueFE                           |           |   ✓   |     ✓    |    ✓    |
| netscalerSslClientCertSizeBE                        |           |   ✓   |     ✓    |    ✓    |
| netscalerSslClientCertSizeFE                        |           |   ✓   |     ✓    |    ✓    |
| netscalerSslClntCertSigHashBE                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSslClntCertSigHashFE                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSslErrAppName                              |           |   ✓   |     ✓    |    ✓    |
| netscalerSslErrFlag                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerSslFLagsBE                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerSslFLagsFE                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerSslHandshakeErrorMsg                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliDomainCategory                         |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliDomainCategoryGroup                    |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliDomainName                             |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliDomainReputation                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliExecutedAction                         |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliPolicyAction                           |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliReasonForAction                        |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliurlsetMatched                          |           |   ✓   |     ✓    |    ✓    |
| netscalerSsliurlsetPrivate                          |           |   ✓   |     ✓    |    ✓    |
| netscalerSslServerCertSizeBE                        |           |   ✓   |     ✓    |    ✓    |
| netscalerSslServerCertSizeFE                        |           |   ✓   |     ✓    |    ✓    |
| netscalerSslSessionIDBE                             |           |   ✓   |     ✓    |    ✓    |
| netscalerSslSessionIDFE                             |           |   ✓   |     ✓    |    ✓    |
| netscalerSslSigHashAlgBE                            |           |   ✓   |     ✓    |    ✓    |
| netscalerSslSigHashAlgFE                            |           |   ✓   |     ✓    |    ✓    |
| netscalerSslSrvrCertSigHashBE                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSslSrvrCertSigHashFE                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSsoAuthMethod                              |           |   ✓   |     ✓    |    ✓    |
| netscalerSSORequestURL                              |           |   ✓   |     ✓    |    ✓    |
| netscalerSTATicket                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamIdentifierName                       |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionActualMetricValue             |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionBreachedMetric                |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionBreachingTransactions         |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionBreachTime                    |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionConfiguredAcceptanceThreshold |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionConfiguredBreachThreshold     |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionInterval                      |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionMaxThreshold                  |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionMinThreshold                  |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionName                          |           |   ✓   |     ✓    |    ✓    |
| netscalerStreamSessionTotalTransactions             |           |   ✓   |     ✓    |    ✓    |
| netscalerSubscriberIdentifier                       |           |   ✓   |     ✓    |    ✓    |
| netscalerSyslogMessage                              |           |   ✓   |     ✓    |    ✓    |
| netscalerSyslogPriority                             |           |   ✓   |     ✓    |    ✓    |
| netscalerSyslogTimestamp                            |           |   ✓   |     ✓    |    ✓    |
| netscalerSystemRuleFlags1                           |           |   ✓   |     ✓    |    ✓    |
| netscalerSystemSafetyIndex                          |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpClntConnRstCode                         |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpJitter                                  |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpPacketsRetransmited                     |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpRtoCount                                |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpSlowrisCntr                             |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpSrvrConnRstCode                         |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpSynAttackCntr                           |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpzerowindowCntr                          |           |   ✓   |     ✓    |    ✓    |
| netscalerTcpZeroWindowCount                         |           |   ✓   |     ✓    |    ✓    |
| netscalerTempVPNsessionID                           |           |   ✓   |     ✓    |    ✓    |
| netscalerTenantName                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerTransactionId                              |           |   ✓   |     ✓    |    ✓    |
| netscalerTransportProtocolType                      |           |   ✓   |     ✓    |    ✓    |
| netscalerTxnClientIpv4Addr                          |           |   ✓   |     ✓    |    ✓    |
| netscalerTxnServerIpv4Addr                          |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlCategory                                |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlCategoryactionReason                    |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlCategoryGroup                           |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlCategoryReputation                      |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlCatPolicyName                           |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlsetMatched                              |           |   ✓   |     ✓    |    ✓    |
| netscalerUrlsetPrivate                              |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessAbsStarttime                      |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessAppReqBytes                       |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessAppRespBytes                      |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessClientIP4                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessClientIpv6Addr                    |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessClientVlan                        |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessDuration                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessFlags                             |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessID                                |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessMediaType                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessPacingRate                        |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessReqbytes                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessRespBytes                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoSessTxnCount                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnAppReqBytes                        |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnAppRespBytes                       |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnClientIpv6Addr                     |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnClientPort                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnClientVlan                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnEndtime                            |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnEndtimeUsec                        |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnId                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnLastDataTime                       |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnLastDataTimeUsec                   |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnMediaType                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnPacingRate                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnReqBytes                           |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnRespBytes                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnServerIpv6Addr                     |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnServerPort                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnServerVlan                         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnSessionDiameterTimestamp           |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnSessionID                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnSessionSubscriberID                |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnSessionSubscriberSessionID         |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnSessionTcpTimestamp                |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnSessionTimestamp                   |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnStarttime                          |           |   ✓   |     ✓    |    ✓    |
| netscalerVideoTxnStarttimeUsec                      |           |   ✓   |     ✓    |    ✓    |
| netscalerVlanNumber                                 |           |   ✓   |     ✓    |    ✓    |
| netscalerVPNRequestURL                              |           |   ✓   |     ✓    |    ✓    |
| netscalerVPNsessionID                               |           |   ✓   |     ✓    |    ✓    |
| netscalerVPNsessionIdTemp                           |           |   ✓   |     ✓    |    ✓    |
| netscalerVPNSessionLogoutMode                       |           |   ✓   |     ✓    |    ✓    |
| netscalerVPNSessionMode                             |           |   ✓   |     ✓    |    ✓    |
| netscalerVPNSessionState                            |           |   ✓   |     ✓    |    ✓    |
| netscalerVserverFQDN                                |           |   ✓   |     ✓    |    ✓    |
| netscalerVserverIP                                  |           |   ✓   |     ✓    |    ✓    |

### Calix Networks (PEN: 6321)

| Name                                         | Community | Basic | Standard | Premium |
| -------------------------------------------- | :-------: | :---: | :------: | :-----: |
| active-default-subscribers-with-pcrf-enabled |           |   ✓   |     ✓    |    ✓    |
| active-dynamic-ips                           |           |   ✓   |     ✓    |    ✓    |
| active-dynamic-subscribers                   |           |   ✓   |     ✓    |    ✓    |
| active-leases                                |           |   ✓   |     ✓    |    ✓    |
| active-static-ips                            |           |   ✓   |     ✓    |    ✓    |
| active-static-subscribers                    |           |   ✓   |     ✓    |    ✓    |
| active-subscribers-with-pcrf-enabled         |           |   ✓   |     ✓    |    ✓    |
| address-family                               |           |   ✓   |     ✓    |    ✓    |
| admin-state                                  |           |   ✓   |     ✓    |    ✓    |
| admitted excess upstream bw                  |           |   ✓   |     ✓    |    ✓    |
| admitted fixed upstream bw                   |           |   ✓   |     ✓    |    ✓    |
| admitted-assured-upstream-bw                 |           |   ✓   |     ✓    |    ✓    |
| agent-reference                              |           |   ✓   |     ✓    |    ✓    |
| ageouts                                      |           |   ✓   |     ✓    |    ✓    |
| align-errors                                 |           |   ✓   |     ✓    |    ✓    |
| alignment-error                              |           |   ✓   |     ✓    |    ✓    |
| arp-timer-expiries                           |           |   ✓   |     ✓    |    ✓    |
| assured-upstream-bytes                       |           |   ✓   |     ✓    |    ✓    |
| available excess upstream bw                 |           |   ✓   |     ✓    |    ✓    |
| available fixed upstream bw                  |           |   ✓   |     ✓    |    ✓    |
| available-assured-upstream-bw                |           |   ✓   |     ✓    |    ✓    |
| available-memory                             |           |   ✓   |     ✓    |    ✓    |
| avg-active-dynamic-subscribers               |           |   ✓   |     ✓    |    ✓    |
| avg-active-static-subscribers                |           |   ✓   |     ✓    |    ✓    |
| avg-leases                                   |           |   ✓   |     ✓    |    ✓    |
| backward-available-indicators                |           |   ✓   |     ✓    |    ✓    |
| backward-avg-frame-loss-ratio                |           |   ✓   |     ✓    |    ✓    |
| backward-avg-frame-loss-ratio                |           |   ✓   |     ✓    |    ✓    |
| backward-consecutive-high-loss-intervals     |           |   ✓   |     ✓    |    ✓    |
| backward-high-loss-intervals                 |           |   ✓   |     ✓    |    ✓    |
| backward-max-frame-loss-ratio                |           |   ✓   |     ✓    |    ✓    |
| backward-max-frame-loss-ratio                |           |   ✓   |     ✓    |    ✓    |
| backward-min-frame-loss-ratio                |           |   ✓   |     ✓    |    ✓    |
| backward-min-frame-loss-ratio                |           |   ✓   |     ✓    |    ✓    |
| backward-received-frames                     |           |   ✓   |     ✓    |    ✓    |
| backward-transmitted-frames                  |           |   ✓   |     ✓    |    ✓    |
| backward-unavailable-indicators              |           |   ✓   |     ✓    |    ✓    |
| bgp                                          |           |   ✓   |     ✓    |    ✓    |
| bgp-stat-aid                                 |           |   ✓   |     ✓    |    ✓    |
| bgpv6-stat-aid                               |           |   ✓   |     ✓    |    ✓    |
| bin-duration                                 |           |   ✓   |     ✓    |    ✓    |
| bin-number                                   |           |   ✓   |     ✓    |    ✓    |
| bng-arp-counters-id                          |           |   ✓   |     ✓    |    ✓    |
| bng-dhcp-pool-aid                            |           |   ✓   |     ✓    |    ✓    |
| bng-dhcp-subscriber-aid                      |           |   ✓   |     ✓    |    ✓    |
| bng-diameter-client-aid                      |           |   ✓   |     ✓    |    ✓    |
| bng-gx-counter-aid                           |           |   ✓   |     ✓    |    ✓    |
| bng-policy-mgmt-aid                          |           |   ✓   |     ✓    |    ✓    |
| bng-radius-client-aid                        |           |   ✓   |     ✓    |    ✓    |
| bng-static-subscriber-aid                    |           |   ✓   |     ✓    |    ✓    |
| bng-url-redirect-aid                         |           |   ✓   |     ✓    |    ✓    |
| broadcast-pkts                               |           |   ✓   |     ✓    |    ✓    |
| buffer-overflow-recv                         |           |   ✓   |     ✓    |    ✓    |
| buffer-overflow-xmit                         |           |   ✓   |     ✓    |    ✓    |
| carrier-sense-error                          |           |   ✓   |     ✓    |    ✓    |
| carrier-transitions                          |           |   ✓   |     ✓    |    ✓    |
| cause                                        |           |   ✓   |     ✓    |    ✓    |
| ccm-received                                 |           |   ✓   |     ✓    |    ✓    |
| ccm-received-bad-if-status                   |           |   ✓   |     ✓    |    ✓    |
| ccm-received-bad-port-status                 |           |   ✓   |     ✓    |    ✓    |
| ccm-received-bad-sender-id                   |           |   ✓   |     ✓    |    ✓    |
| ccm-received-bad-seq-errors                  |           |   ✓   |     ✓    |    ✓    |
| ccm-received-rdi                             |           |   ✓   |     ✓    |    ✓    |
| ccm-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| ccm-transmitted-rdi                          |           |   ✓   |     ✓    |    ✓    |
| cfg-speed                                    |           |   ✓   |     ✓    |    ✓    |
| configured-active-subscribers                |           |   ✓   |     ✓    |    ✓    |
| configured-dynamic-subscribers               |           |   ✓   |     ✓    |    ✓    |
| configured-pool-size                         |           |   ✓   |     ✓    |    ✓    |
| configured-subscribers-with-pcrf-enabled     |           |   ✓   |     ✓    |    ✓    |
| connected                                    |           |   ✓   |     ✓    |    ✓    |
| cpu-usage                                    |           |   ✓   |     ✓    |    ✓    |
| crc-align-errors                             |           |   ✓   |     ✓    |    ✓    |
| curr-version                                 |           |   ✓   |     ✓    |    ✓    |
| cvlan                                        |           |   ✓   |     ✓    |    ✓    |
| deferred-xmit-count                          |           |   ✓   |     ✓    |    ✓    |
| delay-measurement-aid                        |           |   ✓   |     ✓    |    ✓    |
| dest-agent                                   |           |   ✓   |     ✓    |    ✓    |
| diameter-client-name                         |           |   ✓   |     ✓    |    ✓    |
| dm1-received                                 |           |   ✓   |     ✓    |    ✓    |
| dm1-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| dmm-received                                 |           |   ✓   |     ✓    |    ✓    |
| dmm-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| dmr-received                                 |           |   ✓   |     ✓    |    ✓    |
| dmr-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| dn-mhf-lbm-received                          |           |   ✓   |     ✓    |    ✓    |
| dn-mhf-lbr-transmitted                       |           |   ✓   |     ✓    |    ✓    |
| dn-mhf-ltm-forwarded                         |           |   ✓   |     ✓    |    ✓    |
| dn-mhf-ltm-received                          |           |   ✓   |     ✓    |    ✓    |
| dn-mhf-ltr-transmitted                       |           |   ✓   |     ✓    |    ✓    |
| downstream-bip-errors                        |           |   ✓   |     ✓    |    ✓    |
| downstream-bip8-err-sec                      |           |   ✓   |     ✓    |    ✓    |
| downstream-bip8-severely-err-sec             |           |   ✓   |     ✓    |    ✓    |
| downstream-bip8-unavail-sec                  |           |   ✓   |     ✓    |    ✓    |
| downstream-broadcast-packets                 |           |   ✓   |     ✓    |    ✓    |
| downstream-bytes                             |           |   ✓   |     ✓    |    ✓    |
| downstream-crc-error-frames                  |           |   ✓   |     ✓    |    ✓    |
| downstream-crc-errored-packets               |           |   ✓   |     ✓    |    ✓    |
| downstream-discard-events                    |           |   ✓   |     ✓    |    ✓    |
| downstream-drop-events                       |           |   ✓   |     ✓    |    ✓    |
| downstream-fec-corrected-bytes               |           |   ✓   |     ✓    |    ✓    |
| downstream-fec-corrected-code-words          |           |   ✓   |     ✓    |    ✓    |
| downstream-fec-sec                           |           |   ✓   |     ✓    |    ✓    |
| downstream-fec-total-code-words              |           |   ✓   |     ✓    |    ✓    |
| downstream-fec-uncorrected-code-words        |           |   ✓   |     ✓    |    ✓    |
| downstream-gem-frames                        |           |   ✓   |     ✓    |    ✓    |
| downstream-gem-payload-bytes                 |           |   ✓   |     ✓    |    ✓    |
| downstream-multicast-packets                 |           |   ✓   |     ✓    |    ✓    |
| downstream-octet-ibont                       |           |   ✓   |     ✓    |    ✓    |
| downstream-octets                            |           |   ✓   |     ✓    |    ✓    |
| downstream-octets-internet                   |           |   ✓   |     ✓    |    ✓    |
| downstream-octets-soho                       |           |   ✓   |     ✓    |    ✓    |
| downstream-oversize-packets                  |           |   ✓   |     ✓    |    ✓    |
| downstream-packets                           |           |   ✓   |     ✓    |    ✓    |
| downstream-percentage                        |           |   ✓   |     ✓    |    ✓    |
| downstream-pon-rate                          |           |   ✓   |     ✓    |    ✓    |
| downstream-undersize-packets                 |           |   ✓   |     ✓    |    ✓    |
| downstream-unicast-packets                   |           |   ✓   |     ✓    |    ✓    |
| dowstream-discarded-frames                   |           |   ✓   |     ✓    |    ✓    |
| drop-events                                  |           |   ✓   |     ✓    |    ✓    |
| dynamic-policy-apply-failures                |           |   ✓   |     ✓    |    ✓    |
| dynamic-policy-apply-requests                |           |   ✓   |     ✓    |    ✓    |
| dynamic-policy-apply-successes               |           |   ✓   |     ✓    |    ✓    |
| egress-bucket-bps                            |           |   ✓   |     ✓    |    ✓    |
| egress-bucket-percent                        |           |   ✓   |     ✓    |    ✓    |
| egress-bucket-seconds                        |           |   ✓   |     ✓    |    ✓    |
| elapsed-time                                 |           |   ✓   |     ✓    |    ✓    |
| elapsed-time                                 |           |   ✓   |     ✓    |    ✓    |
| elapsed-time                                 |           |   ✓   |     ✓    |    ✓    |
| end-time                                     |           |   ✓   |     ✓    |    ✓    |
| end-time                                     |           |   ✓   |     ✓    |    ✓    |
| end-time                                     |           |   ✓   |     ✓    |    ✓    |
| end-time                                     |           |   ✓   |     ✓    |    ✓    |
| eth-vlan-monitor-aid                         |           |   ✓   |     ✓    |    ✓    |
| excess-upstream-bytes                        |           |   ✓   |     ✓    |    ✓    |
| excessive-collision                          |           |   ✓   |     ✓    |    ✓    |
| fcs-errors                                   |           |   ✓   |     ✓    |    ✓    |
| fixed-upstream-bytes                         |           |   ✓   |     ✓    |    ✓    |
| flow-bytes                                   |           |   ✓   |     ✓    |    ✓    |
| flow-direction                               |           |   ✓   |     ✓    |    ✓    |
| flow-drop-bytes                              |           |   ✓   |     ✓    |    ✓    |
| flow-drop-pkts                               |           |   ✓   |     ✓    |    ✓    |
| flow-number                                  |           |   ✓   |     ✓    |    ✓    |
| flow-pkts                                    |           |   ✓   |     ✓    |    ✓    |
| forward-available-indicators                 |           |   ✓   |     ✓    |    ✓    |
| forward-avg-frame-loss-ratio                 |           |   ✓   |     ✓    |    ✓    |
| forward-avg-frame-loss-ratio                 |           |   ✓   |     ✓    |    ✓    |
| forward-consecutive-high-loss-intervals      |           |   ✓   |     ✓    |    ✓    |
| forward-high-loss-intervals                  |           |   ✓   |     ✓    |    ✓    |
| forward-max-frame-loss-ratio                 |           |   ✓   |     ✓    |    ✓    |
| forward-max-frame-loss-ratio                 |           |   ✓   |     ✓    |    ✓    |
| forward-min-frame-loss-ratio                 |           |   ✓   |     ✓    |    ✓    |
| forward-min-frame-loss-ratio                 |           |   ✓   |     ✓    |    ✓    |
| forward-received-frames                      |           |   ✓   |     ✓    |    ✓    |
| forward-transmitted-frames                   |           |   ✓   |     ✓    |    ✓    |
| forward-unavailable-indicators               |           |   ✓   |     ✓    |    ✓    |
| fragments                                    |           |   ✓   |     ✓    |    ✓    |
| frame-delay-backward-avg                     |           |   ✓   |     ✓    |    ✓    |
| frame-delay-backward-max                     |           |   ✓   |     ✓    |    ✓    |
| frame-delay-backward-min                     |           |   ✓   |     ✓    |    ✓    |
| frame-delay-forward-avg                      |           |   ✓   |     ✓    |    ✓    |
| frame-delay-forward-max                      |           |   ✓   |     ✓    |    ✓    |
| frame-delay-forward-min                      |           |   ✓   |     ✓    |    ✓    |
| frame-delay-range-backward-avg               |           |   ✓   |     ✓    |    ✓    |
| frame-delay-range-backward-max               |           |   ✓   |     ✓    |    ✓    |
| frame-delay-range-forward-avg                |           |   ✓   |     ✓    |    ✓    |
| frame-delay-range-forward-max                |           |   ✓   |     ✓    |    ✓    |
| frame-delay-range-two-way-avg                |           |   ✓   |     ✓    |    ✓    |
| frame-delay-range-two-way-max                |           |   ✓   |     ✓    |    ✓    |
| frame-delay-two-way-avg                      |           |   ✓   |     ✓    |    ✓    |
| frame-delay-two-way-max                      |           |   ✓   |     ✓    |    ✓    |
| frame-delay-two-way-min                      |           |   ✓   |     ✓    |    ✓    |
| frame-too-long                               |           |   ✓   |     ✓    |    ✓    |
| gem-encryption-key-errors                    |           |   ✓   |     ✓    |    ✓    |
| grace-timer-expiries                         |           |   ✓   |     ✓    |    ✓    |
| green-octets-pon                             |           |   ✓   |     ✓    |    ✓    |
| green-octets-uni                             |           |   ✓   |     ✓    |    ✓    |
| green-pkts-pon                               |           |   ✓   |     ✓    |    ✓    |
| green-pkts-uni                               |           |   ✓   |     ✓    |    ✓    |
| group                                        |           |   ✓   |     ✓    |    ✓    |
| hook-status                                  |           |   ✓   |     ✓    |    ✓    |
| hostname                                     |           |   ✓   |     ✓    |    ✓    |
| if-index                                     |           |   ✓   |     ✓    |    ✓    |
| in-discards                                  |           |   ✓   |     ✓    |    ✓    |
| in-errors                                    |           |   ✓   |     ✓    |    ✓    |
| in-keepalives                                |           |   ✓   |     ✓    |    ✓    |
| in-notifications                             |           |   ✓   |     ✓    |    ✓    |
| in-oam-pdus                                  |           |   ✓   |     ✓    |    ✓    |
| in-oam-pdus                                  |           |   ✓   |     ✓    |    ✓    |
| in-opens                                     |           |   ✓   |     ✓    |    ✓    |
| in-total                                     |           |   ✓   |     ✓    |    ✓    |
| in-total-messages                            |           |   ✓   |     ✓    |    ✓    |
| in-updates                                   |           |   ✓   |     ✓    |    ✓    |
| ingress-bucket-bps                           |           |   ✓   |     ✓    |    ✓    |
| ingress-bucket-percent                       |           |   ✓   |     ✓    |    ✓    |
| ingress-bucket-seconds                       |           |   ✓   |     ✓    |    ✓    |
| input-power-instant                          |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-backward-avg     |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-backward-max     |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-backward-min     |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-forward-avg      |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-forward-max      |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-forward-min      |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-two-way-avg      |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-two-way-max      |           |   ✓   |     ✓    |    ✓    |
| inter-frame-delay-variation-two-way-min      |           |   ✓   |     ✓    |    ✓    |
| interface-ethernet-aid                       |           |   ✓   |     ✓    |    ✓    |
| interface-lag-aid                            |           |   ✓   |     ✓    |    ✓    |
| internal-mac-recv-error                      |           |   ✓   |     ✓    |    ✓    |
| internal-mac-xmit-error                      |           |   ✓   |     ✓    |    ✓    |
| isis                                         |           |   ✓   |     ✓    |    ✓    |
| jabbers                                      |           |   ✓   |     ✓    |    ✓    |
| lag-vlan-monitor-aid                         |           |   ✓   |     ✓    |    ✓    |
| laser-bias-current                           |           |   ✓   |     ✓    |    ✓    |
| late-collision                               |           |   ✓   |     ✓    |    ✓    |
| lbm-received                                 |           |   ✓   |     ✓    |    ✓    |
| lbm-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| lbr-received                                 |           |   ✓   |     ✓    |    ✓    |
| lbr-received-bad-msdu                        |           |   ✓   |     ✓    |    ✓    |
| lbr-received-out-of-order                    |           |   ✓   |     ✓    |    ✓    |
| lbr-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| ldp-peer                                     |           |   ✓   |     ✓    |    ✓    |
| lease-renewals                               |           |   ✓   |     ✓    |    ✓    |
| lease-timer-expiries                         |           |   ✓   |     ✓    |    ✓    |
| leases-in-grace                              |           |   ✓   |     ✓    |    ✓    |
| linked-pon                                   |           |   ✓   |     ✓    |    ✓    |
| lm-availability-aid                          |           |   ✓   |     ✓    |    ✓    |
| lmm-Received                                 |           |   ✓   |     ✓    |    ✓    |
| lmm-Transmitted                              |           |   ✓   |     ✓    |    ✓    |
| lmr-Received                                 |           |   ✓   |     ✓    |    ✓    |
| lmr-Transmitted                              |           |   ✓   |     ✓    |    ✓    |
| loss-measurement-aid                         |           |   ✓   |     ✓    |    ✓    |
| ltm-received                                 |           |   ✓   |     ✓    |    ✓    |
| ltm-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| ltr-received                                 |           |   ✓   |     ✓    |    ✓    |
| ltr-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| ltr-unexpected                               |           |   ✓   |     ✓    |    ✓    |
| mac                                          |           |   ✓   |     ✓    |    ✓    |
| management-address-tlv                       |           |   ✓   |     ✓    |    ✓    |
| max-active-dynamic-subscribers               |           |   ✓   |     ✓    |    ✓    |
| max-active-static-subscribers                |           |   ✓   |     ✓    |    ✓    |
| max-leases                                   |           |   ✓   |     ✓    |    ✓    |
| mean-optical-launch-power                    |           |   ✓   |     ✓    |    ✓    |
| mep-stats-aid                                |           |   ✓   |     ✓    |    ✓    |
| mgcp-profile                                 |           |   ✓   |     ✓    |    ✓    |
| min-active-dynamic-subscribers               |           |   ✓   |     ✓    |    ✓    |
| min-active-static-subscribers                |           |   ✓   |     ✓    |    ✓    |
| min-leases                                   |           |   ✓   |     ✓    |    ✓    |
| mip-stats-aid                                |           |   ✓   |     ✓    |    ✓    |
| module-rx-power                              |           |   ✓   |     ✓    |    ✓    |
| module-temperature                           |           |   ✓   |     ✓    |    ✓    |
| module-tx-power                              |           |   ✓   |     ✓    |    ✓    |
| module-vcc                                   |           |   ✓   |     ✓    |    ✓    |
| mpls-stat-aid                                |           |   ✓   |     ✓    |    ✓    |
| msg-timeout                                  |           |   ✓   |     ✓    |    ✓    |
| multicast-pkts                               |           |   ✓   |     ✓    |    ✓    |
| multiple-collision                           |           |   ✓   |     ✓    |    ✓    |
| ne-opt-signal-level                          |           |   ✓   |     ✓    |    ✓    |
| neighbor                                     |           |   ✓   |     ✓    |    ✓    |
| neighbor-v6                                  |           |   ✓   |     ✓    |    ✓    |
| octets                                       |           |   ✓   |     ✓    |    ✓    |
| octets-policer-discards                      |           |   ✓   |     ✓    |    ✓    |
| offers-accepted                              |           |   ✓   |     ✓    |    ✓    |
| offers-sent                                  |           |   ✓   |     ✓    |    ✓    |
| OLT-ont-bin-aid                              |           |   ✓   |     ✓    |    ✓    |
| OLT-ontpots-mgcp-service-aid                 |           |   ✓   |     ✓    |    ✓    |
| OLT-ontpots-sip-service-aid                  |           |   ✓   |     ✓    |    ✓    |
| OLT-ontrg-bin-aid                            |           |   ✓   |     ✓    |    ✓    |
| OLT-pon-dyn-agg-util-total-aid               |           |   ✓   |     ✓    |    ✓    |
| OLT-pon-optical-aid                          |           |   ✓   |     ✓    |    ✓    |
| OLT-pon-util-aid                             |           |   ✓   |     ✓    |    ✓    |
| ONT-eth-total-aid                            |           |   ✓   |     ✓    |    ✓    |
| ONT-eth-util-aid                             |           |   ✓   |     ✓    |    ✓    |
| ONT-evccos-stats-aid                         |           |   ✓   |     ✓    |    ✓    |
| ONT-evcstats-aid                             |           |   ✓   |     ✓    |    ✓    |
| ONT-fb-total-aid                             |           |   ✓   |     ✓    |    ✓    |
| ont-id                                       |           |   ✓   |     ✓    |    ✓    |
| ONT-ifstats-aid                              |           |   ✓   |     ✓    |    ✓    |
| ONT-pots-total-aid                           |           |   ✓   |     ✓    |    ✓    |
| ONT-rg-total-aid                             |           |   ✓   |     ✓    |    ✓    |
| ONT-status-aid                               |           |   ✓   |     ✓    |    ✓    |
| ont-ua                                       |           |   ✓   |     ✓    |    ✓    |
| oper-state                                   |           |   ✓   |     ✓    |    ✓    |
| optical-channel                              |           |   ✓   |     ✓    |    ✓    |
| ospf                                         |           |   ✓   |     ✓    |    ✓    |
| ospf-stat-aid                                |           |   ✓   |     ✓    |    ✓    |
| out-keepalives                               |           |   ✓   |     ✓    |    ✓    |
| out-notifications                            |           |   ✓   |     ✓    |    ✓    |
| out-oam-pdus                                 |           |   ✓   |     ✓    |    ✓    |
| out-oam-pdus                                 |           |   ✓   |     ✓    |    ✓    |
| out-opens                                    |           |   ✓   |     ✓    |    ✓    |
| out-total-messages                           |           |   ✓   |     ✓    |    ✓    |
| out-updates                                  |           |   ✓   |     ✓    |    ✓    |
| output-power-instant                         |           |   ✓   |     ✓    |    ✓    |
| oversize-pkts                                |           |   ✓   |     ✓    |    ✓    |
| pcrf-timer-expiries                          |           |   ✓   |     ✓    |    ✓    |
| pdu-length-errors                            |           |   ✓   |     ✓    |    ✓    |
| peer-disconnect                              |           |   ✓   |     ✓    |    ✓    |
| peer-down                                    |           |   ✓   |     ✓    |    ✓    |
| peer-up                                      |           |   ✓   |     ✓    |    ✓    |
| pkts                                         |           |   ✓   |     ✓    |    ✓    |
| pkts-1024to1518                              |           |   ✓   |     ✓    |    ✓    |
| pkts-128to255                                |           |   ✓   |     ✓    |    ✓    |
| pkts-1519to2047                              |           |   ✓   |     ✓    |    ✓    |
| pkts-2048to4095                              |           |   ✓   |     ✓    |    ✓    |
| pkts-256-511                                 |           |   ✓   |     ✓    |    ✓    |
| pkts-4096to9216                              |           |   ✓   |     ✓    |    ✓    |
| pkts-512to1023                               |           |   ✓   |     ✓    |    ✓    |
| pkts-64                                      |           |   ✓   |     ✓    |    ✓    |
| pkts-65to127                                 |           |   ✓   |     ✓    |    ✓    |
| pkts-9217to16383                             |           |   ✓   |     ✓    |    ✓    |
| pkts-policer-discards                        |           |   ✓   |     ✓    |    ✓    |
| pon-ont-type-util-aid                        |           |   ✓   |     ✓    |    ✓    |
| pon-ont-util-aid                             |           |   ✓   |     ✓    |    ✓    |
| pon-ont-util-total-aid                       |           |   ✓   |     ✓    |    ✓    |
| pool-name                                    |           |   ✓   |     ✓    |    ✓    |
| port                                         |           |   ✓   |     ✓    |    ✓    |
| port-id-tlv                                  |           |   ✓   |     ✓    |    ✓    |
| power-feed-voltage                           |           |   ✓   |     ✓    |    ✓    |
| raa-session-id-mismatch                      |           |   ✓   |     ✓    |    ✓    |
| radius-client-name                           |           |   ✓   |     ✓    |    ✓    |
| ram-usage                                    |           |   ✓   |     ✓    |    ✓    |
| range-length                                 |           |   ✓   |     ✓    |    ✓    |
| rate-violations                              |           |   ✓   |     ✓    |    ✓    |
| red-octets-uni                               |           |   ✓   |     ✓    |    ✓    |
| red-pkts-uni                                 |           |   ✓   |     ✓    |    ✓    |
| request-timeouts                             |           |   ✓   |     ✓    |    ✓    |
| requests-declined                            |           |   ✓   |     ✓    |    ✓    |
| requests-granted                             |           |   ✓   |     ✓    |    ✓    |
| rfavo received-optical-power                 |           |   ✓   |     ✓    |    ✓    |
| role                                         |           |   ✓   |     ✓    |    ✓    |
| route-summary-stat-aid                       |           |   ✓   |     ✓    |    ✓    |
| rtx-accounting-interim                       |           |   ✓   |     ✓    |    ✓    |
| rtx-accounting-start                         |           |   ✓   |     ✓    |    ✓    |
| rtx-accounting-stop                          |           |   ✓   |     ✓    |    ✓    |
| rtx-msg                                      |           |   ✓   |     ✓    |    ✓    |
| rx-accounting-failure-resp                   |           |   ✓   |     ✓    |    ✓    |
| rx-accounting-success-resp                   |           |   ✓   |     ✓    |    ✓    |
| rx-address                                   |           |   ✓   |     ✓    |    ✓    |
| rx-address withdraw                          |           |   ✓   |     ✓    |    ✓    |
| rx-arp-req                                   |           |   ✓   |     ✓    |    ✓    |
| rx-available-bandwidth                       |           |   ✓   |     ✓    |    ✓    |
| rx-bps                                       |           |   ✓   |     ✓    |    ✓    |
| rx-broadcast-octets                          |           |   ✓   |     ✓    |    ✓    |
| rx-broadcast-pkts                            |           |   ✓   |     ✓    |    ✓    |
| rx-cca-i                                     |           |   ✓   |     ✓    |    ✓    |
| rx-cca-u                                     |           |   ✓   |     ✓    |    ✓    |
| rx-cea                                       |           |   ✓   |     ✓    |    ✓    |
| rx-db-des                                    |           |   ✓   |     ✓    |    ✓    |
| rx-discards                                  |           |   ✓   |     ✓    |    ✓    |
| rx-errors                                    |           |   ✓   |     ✓    |    ✓    |
| rx-fec-corrected-code-words                  |           |   ✓   |     ✓    |    ✓    |
| rx-fec-total-code-words                      |           |   ✓   |     ✓    |    ✓    |
| rx-fec-uncorrected-code-words                |           |   ✓   |     ✓    |    ✓    |
| rx-hello                                     |           |   ✓   |     ✓    |    ✓    |
| rx-info-tlv                                  |           |   ✓   |     ✓    |    ✓    |
| rx-initialization                            |           |   ✓   |     ✓    |    ✓    |
| rx-keepalive                                 |           |   ✓   |     ✓    |    ✓    |
| rx-label abort request                       |           |   ✓   |     ✓    |    ✓    |
| rx-label mapping                             |           |   ✓   |     ✓    |    ✓    |
| rx-label release                             |           |   ✓   |     ✓    |    ✓    |
| rx-label request                             |           |   ✓   |     ✓    |    ✓    |
| rx-label withdraw                            |           |   ✓   |     ✓    |    ✓    |
| rx-ls-ack                                    |           |   ✓   |     ✓    |    ✓    |
| rx-ls-req                                    |           |   ✓   |     ✓    |    ✓    |
| rx-ls-upd                                    |           |   ✓   |     ✓    |    ✓    |
| rx-multicast-octets                          |           |   ✓   |     ✓    |    ✓    |
| rx-multicast-pkts                            |           |   ✓   |     ✓    |    ✓    |
| rx-notification                              |           |   ✓   |     ✓    |    ✓    |
| rx-octets                                    |           |   ✓   |     ✓    |    ✓    |
| rx-optical-power                             |           |   ✓   |     ✓    |    ✓    |
| rx-pause-frames                              |           |   ✓   |     ✓    |    ✓    |
| rx-pkts                                      |           |   ✓   |     ✓    |    ✓    |
| rx-pps                                       |           |   ✓   |     ✓    |    ✓    |
| rx-rar                                       |           |   ✓   |     ✓    |    ✓    |
| rx-state                                     |           |   ✓   |     ✓    |    ✓    |
| rx-unicast-octets                            |           |   ✓   |     ✓    |    ✓    |
| rx-unicast-pkts                              |           |   ✓   |     ✓    |    ✓    |
| rx-unknown-protos                            |           |   ✓   |     ✓    |    ✓    |
| rx-utilization                               |           |   ✓   |     ✓    |    ✓    |
| sample-time                                  |           |   ✓   |     ✓    |    ✓    |
| sample-time                                  |           |   ✓   |     ✓    |    ✓    |
| service-status                               |           |   ✓   |     ✓    |    ✓    |
| shelf                                        |           |   ✓   |     ✓    |    ✓    |
| single-collision                             |           |   ✓   |     ✓    |    ✓    |
| sip-profile                                  |           |   ✓   |     ✓    |    ✓    |
| slm-received                                 |           |   ✓   |     ✓    |    ✓    |
| slm-transmitted                              |           |   ✓   |     ✓    |    ✓    |
| slot                                         |           |   ✓   |     ✓    |    ✓    |
| slr-received                                 |           |   ✓   |     ✓    |    ✓    |
| slr-Transmitted                              |           |   ✓   |     ✓    |    ✓    |
| sqe-counter                                  |           |   ✓   |     ✓    |    ✓    |
| start-time                                   |           |   ✓   |     ✓    |    ✓    |
| static                                       |           |   ✓   |     ✓    |    ✓    |
| stats-index                                  |           |   ✓   |     ✓    |    ✓    |
| stats-index                                  |           |   ✓   |     ✓    |    ✓    |
| stats-index                                  |           |   ✓   |     ✓    |    ✓    |
| subscriber-flows-aid                         |           |   ✓   |     ✓    |    ✓    |
| suspect                                      |           |   ✓   |     ✓    |    ✓    |
| suspect                                      |           |   ✓   |     ✓    |    ✓    |
| suspect                                      |           |   ✓   |     ✓    |    ✓    |
| suspect                                      |           |   ✓   |     ✓    |    ✓    |
| svlan                                        |           |   ✓   |     ✓    |    ✓    |
| sys-info-aid                                 |           |   ✓   |     ✓    |    ✓    |
| system-name-tlv                              |           |   ✓   |     ✓    |    ✓    |
| temp-sensor                                  |           |   ✓   |     ✓    |    ✓    |
| temperature                                  |           |   ✓   |     ✓    |    ✓    |
| time-elapsed                                 |           |   ✓   |     ✓    |    ✓    |
| tlvs-discarded                               |           |   ✓   |     ✓    |    ✓    |
| tlvs-unrecognized                            |           |   ✓   |     ✓    |    ✓    |
| too-many-neighbors                           |           |   ✓   |     ✓    |    ✓    |
| total                                        |           |   ✓   |     ✓    |    ✓    |
| ttl-tlv                                      |           |   ✓   |     ✓    |    ✓    |
| tx-accounting-interim                        |           |   ✓   |     ✓    |    ✓    |
| tx-accounting-start                          |           |   ✓   |     ✓    |    ✓    |
| tx-accounting-stop                           |           |   ✓   |     ✓    |    ✓    |
| tx-address                                   |           |   ✓   |     ✓    |    ✓    |
| tx-address withdraw                          |           |   ✓   |     ✓    |    ✓    |
| tx-arp-resp                                  |           |   ✓   |     ✓    |    ✓    |
| tx-available-bandwidth                       |           |   ✓   |     ✓    |    ✓    |
| tx-bias                                      |           |   ✓   |     ✓    |    ✓    |
| tx-bps                                       |           |   ✓   |     ✓    |    ✓    |
| tx-broadcast-octets                          |           |   ✓   |     ✓    |    ✓    |
| tx-broadcast-pkts                            |           |   ✓   |     ✓    |    ✓    |
| tx-ccr-i                                     |           |   ✓   |     ✓    |    ✓    |
| tx-ccr-u                                     |           |   ✓   |     ✓    |    ✓    |
| tx-cer                                       |           |   ✓   |     ✓    |    ✓    |
| tx-credit                                    |           |   ✓   |     ✓    |    ✓    |
| tx-db-des                                    |           |   ✓   |     ✓    |    ✓    |
| tx-discards                                  |           |   ✓   |     ✓    |    ✓    |
| tx-errors                                    |           |   ✓   |     ✓    |    ✓    |
| tx-fast                                      |           |   ✓   |     ✓    |    ✓    |
| tx-hello                                     |           |   ✓   |     ✓    |    ✓    |
| tx-initialization                            |           |   ✓   |     ✓    |    ✓    |
| tx-keepalive                                 |           |   ✓   |     ✓    |    ✓    |
| tx-label abort request                       |           |   ✓   |     ✓    |    ✓    |
| tx-label mapping                             |           |   ✓   |     ✓    |    ✓    |
| tx-label release                             |           |   ✓   |     ✓    |    ✓    |
| tx-label request                             |           |   ✓   |     ✓    |    ✓    |
| tx-label withdraw                            |           |   ✓   |     ✓    |    ✓    |
| tx-ls-ack                                    |           |   ✓   |     ✓    |    ✓    |
| tx-ls-req                                    |           |   ✓   |     ✓    |    ✓    |
| tx-ls-upd                                    |           |   ✓   |     ✓    |    ✓    |
| tx-multicast-octets                          |           |   ✓   |     ✓    |    ✓    |
| tx-multicast-pkts                            |           |   ✓   |     ✓    |    ✓    |
| tx-notification                              |           |   ✓   |     ✓    |    ✓    |
| tx-octets                                    |           |   ✓   |     ✓    |    ✓    |
| tx-opt-level                                 |           |   ✓   |     ✓    |    ✓    |
| tx-pause-frames                              |           |   ✓   |     ✓    |    ✓    |
| tx-pkts                                      |           |   ✓   |     ✓    |    ✓    |
| tx-power                                     |           |   ✓   |     ✓    |    ✓    |
| tx-pps                                       |           |   ✓   |     ✓    |    ✓    |
| tx-raa                                       |           |   ✓   |     ✓    |    ✓    |
| tx-state                                     |           |   ✓   |     ✓    |    ✓    |
| tx-tmr-state                                 |           |   ✓   |     ✓    |    ✓    |
| tx-ttl                                       |           |   ✓   |     ✓    |    ✓    |
| tx-ttr                                       |           |   ✓   |     ✓    |    ✓    |
| tx-unicast-octets                            |           |   ✓   |     ✓    |    ✓    |
| tx-unicast-pkts                              |           |   ✓   |     ✓    |    ✓    |
| tx-utilization                               |           |   ✓   |     ✓    |    ✓    |
| undersize-pkts                               |           |   ✓   |     ✓    |    ✓    |
| up-mhf-lbm-received                          |           |   ✓   |     ✓    |    ✓    |
| up-mhf-lbr-transmitted                       |           |   ✓   |     ✓    |    ✓    |
| up-mhf-ltm-forwarded                         |           |   ✓   |     ✓    |    ✓    |
| up-mhf-ltm-received                          |           |   ✓   |     ✓    |    ✓    |
| up-mhf-ltr-transmitted                       |           |   ✓   |     ✓    |    ✓    |
| upstream-bip-errors                          |           |   ✓   |     ✓    |    ✓    |
| upstream-bip8-err-sec                        |           |   ✓   |     ✓    |    ✓    |
| upstream-bip8-severely-err-sec               |           |   ✓   |     ✓    |    ✓    |
| upstream-bip8-unavail-sec                    |           |   ✓   |     ✓    |    ✓    |
| upstream-broadcast-packets                   |           |   ✓   |     ✓    |    ✓    |
| upstream-bytes                               |           |   ✓   |     ✓    |    ✓    |
| upstream-crc-error-frames                    |           |   ✓   |     ✓    |    ✓    |
| upstream-crc-errored-packets                 |           |   ✓   |     ✓    |    ✓    |
| upstream-discard-events                      |           |   ✓   |     ✓    |    ✓    |
| upstream-drop-events                         |           |   ✓   |     ✓    |    ✓    |
| upstream-fec-corrected-bytes                 |           |   ✓   |     ✓    |    ✓    |
| upstream-fec-corrected-code-words            |           |   ✓   |     ✓    |    ✓    |
| upstream-fec-sec                             |           |   ✓   |     ✓    |    ✓    |
| upstream-fec-total-code-words                |           |   ✓   |     ✓    |    ✓    |
| upstream-fec-uncorrected-code-words          |           |   ✓   |     ✓    |    ✓    |
| upstream-gal-discarded-frames                |           |   ✓   |     ✓    |    ✓    |
| upstream-gem-frames                          |           |   ✓   |     ✓    |    ✓    |
| upstream-gem-hec-errors                      |           |   ✓   |     ✓    |    ✓    |
| upstream-gem-payload-bytes                   |           |   ✓   |     ✓    |    ✓    |
| upstream-missed-bursts                       |           |   ✓   |     ✓    |    ✓    |
| upstream-missed-bursts-err-sec               |           |   ✓   |     ✓    |    ✓    |
| upstream-multicast-packets                   |           |   ✓   |     ✓    |    ✓    |
| upstream-octets                              |           |   ✓   |     ✓    |    ✓    |
| upstream-octets-ibont                        |           |   ✓   |     ✓    |    ✓    |
| upstream-octets-internet                     |           |   ✓   |     ✓    |    ✓    |
| upstream-octets-soho                         |           |   ✓   |     ✓    |    ✓    |
| upstream-oversize-packets                    |           |   ✓   |     ✓    |    ✓    |
| upstream-packets                             |           |   ✓   |     ✓    |    ✓    |
| upstream-packets-1024-to-1518-octets         |           |   ✓   |     ✓    |    ✓    |
| upstream-packets-128-to-255-octets           |           |   ✓   |     ✓    |    ✓    |
| upstream-packets-256-to-511-octets           |           |   ✓   |     ✓    |    ✓    |
| upstream-packets-512-to-1023-octets          |           |   ✓   |     ✓    |    ✓    |
| upstream-packets-64-octets                   |           |   ✓   |     ✓    |    ✓    |
| upstream-packets-64-to-127-octets            |           |   ✓   |     ✓    |    ✓    |
| upstream-percentage                          |           |   ✓   |     ✓    |    ✓    |
| upstream-pon-rate                            |           |   ✓   |     ✓    |    ✓    |
| upstream-undersize-packets                   |           |   ✓   |     ✓    |    ✓    |
| upstream-unicast-packets                     |           |   ✓   |     ✓    |    ✓    |
| uptime                                       |           |   ✓   |     ✓    |    ✓    |
| uptime                                       |           |   ✓   |     ✓    |    ✓    |
| url-redirect-policies-applied                |           |   ✓   |     ✓    |    ✓    |
| url-redirect-subscribers                     |           |   ✓   |     ✓    |    ✓    |
| url-updates                                  |           |   ✓   |     ✓    |    ✓    |
| vendor-part-number                           |           |   ✓   |     ✓    |    ✓    |
| vrf-name                                     |           |   ✓   |     ✓    |    ✓    |
| watchdog-timer-expiries                      |           |   ✓   |     ✓    |    ✓    |
| yellow-octets-pon                            |           |   ✓   |     ✓    |    ✓    |
| yellow-octets-uni                            |           |   ✓   |     ✓    |    ✓    |
| yellow-pkts-pon                              |           |   ✓   |     ✓    |    ✓    |
| yellow-pkts-uni                              |           |   ✓   |     ✓    |    ✓    |

### CERT Coordination Center (PEN: 6871)

| Name                                            | Community | Basic | Standard | Premium |
| ----------------------------------------------- | :-------: | :---: | :------: | :-----: |
| assembledFragmentCount                          |           |   ✓   |     ✓    |    ✓    |
| averageInterarrivalTime                         |           |   ✓   |     ✓    |    ✓    |
| certToolId                                      |           |   ✓   |     ✓    |    ✓    |
| dataByteCount                                   |           |   ✓   |     ✓    |    ✓    |
| dhcpFingerPrint                                 |           |   ✓   |     ✓    |    ✓    |
| dhcpOption                                      |           |   ✓   |     ✓    |    ✓    |
| dhcpVendorCode                                  |           |   ✓   |     ✓    |    ✓    |
| dnp3DestinationAddress                          |           |   ✓   |     ✓    |    ✓    |
| dnp3Function                                    |           |   ✓   |     ✓    |    ✓    |
| dnp3ObjectData                                  |           |   ✓   |     ✓    |    ✓    |
| dnp3SourceAddress                               |           |   ✓   |     ✓    |    ✓    |
| dnsAlgorithm                                    |           |   ✓   |     ✓    |    ✓    |
| dnsAuthoritative                                |           |   ✓   |     ✓    |    ✓    |
| dnsCName                                        |           |   ✓   |     ✓    |    ✓    |
| dnsDigest                                       |           |   ✓   |     ✓    |    ✓    |
| dnsDigestType                                   |           |   ✓   |     ✓    |    ✓    |
| dnsFlags                                        |           |   ✓   |     ✓    |    ✓    |
| dnsHashData                                     |           |   ✓   |     ✓    |    ✓    |
| dnsHitCount                                     |           |   ✓   |     ✓    |    ✓    |
| dnsID                                           |           |   ✓   |     ✓    |    ✓    |
| dnsIterations                                   |           |   ✓   |     ✓    |    ✓    |
| DNSKEY\_protocolIdentifier                      |           |   ✓   |     ✓    |    ✓    |
| dnsKeyTag                                       |           |   ✓   |     ✓    |    ✓    |
| dnsLabels                                       |           |   ✓   |     ✓    |    ✓    |
| dnsMXExchange                                   |           |   ✓   |     ✓    |    ✓    |
| dnsMXPreference                                 |           |   ✓   |     ✓    |    ✓    |
| dnsNSDName                                      |           |   ✓   |     ✓    |    ✓    |
| dnsNXDomain                                     |           |   ✓   |     ✓    |    ✓    |
| dnsPTRDName                                     |           |   ✓   |     ✓    |    ✓    |
| dnsPublicKey                                    |           |   ✓   |     ✓    |    ✓    |
| dnsQName                                        |           |   ✓   |     ✓    |    ✓    |
| dnsQRType                                       |           |   ✓   |     ✓    |    ✓    |
| dnsQueryResponse                                |           |   ✓   |     ✓    |    ✓    |
| dnsRName                                        |           |   ✓   |     ✓    |    ✓    |
| dnsRRSection                                    |           |   ✓   |     ✓    |    ✓    |
| dnsSalt                                         |           |   ✓   |     ✓    |    ✓    |
| dnsSignature                                    |           |   ✓   |     ✓    |    ✓    |
| dnsSignatureExpiration                          |           |   ✓   |     ✓    |    ✓    |
| dnsSignatureInception                           |           |   ✓   |     ✓    |    ✓    |
| dnsSigner                                       |           |   ✓   |     ✓    |    ✓    |
| dnsSOAExpire                                    |           |   ✓   |     ✓    |    ✓    |
| dnsSOAMinimum                                   |           |   ✓   |     ✓    |    ✓    |
| dnsSOAMName                                     |           |   ✓   |     ✓    |    ✓    |
| dnsSOARefresh                                   |           |   ✓   |     ✓    |    ✓    |
| dnsSOARetry                                     |           |   ✓   |     ✓    |    ✓    |
| dnsSOARName                                     |           |   ✓   |     ✓    |    ✓    |
| dnsSOASerial                                    |           |   ✓   |     ✓    |    ✓    |
| dnsSRVPort                                      |           |   ✓   |     ✓    |    ✓    |
| dnsSRVPriority                                  |           |   ✓   |     ✓    |    ✓    |
| dnsSRVTarget                                    |           |   ✓   |     ✓    |    ✓    |
| dnsSRVWeight                                    |           |   ✓   |     ✓    |    ✓    |
| dnsTTL                                          |           |   ✓   |     ✓    |    ✓    |
| dnsTXTData                                      |           |   ✓   |     ✓    |    ✓    |
| dnsTypeCovered                                  |           |   ✓   |     ✓    |    ✓    |
| ethernetIPData                                  |           |   ✓   |     ✓    |    ✓    |
| expiredFragmentCount                            |           |   ✓   |     ✓    |    ✓    |
| exporterConfiguredId                            |           |   ✓   |     ✓    |    ✓    |
| exporterUniqueId                                |           |   ✓   |     ✓    |    ✓    |
| firstEightNonEmptyPacketDirections              |           |   ✓   |     ✓    |    ✓    |
| firstNonEmptyPacketSize                         |           |   ✓   |     ✓    |    ✓    |
| firstPacketBanner                               |           |   ✓   |     ✓    |    ✓    |
| flowAttributes                                  |           |   ✓   |     ✓    |    ✓    |
| flowTableFlushEventCount                        |           |   ✓   |     ✓    |    ✓    |
| flowTablePeakCount                              |           |   ✓   |     ✓    |    ✓    |
| ftpPass                                         |           |   ✓   |     ✓    |    ✓    |
| ftpRespCode                                     |           |   ✓   |     ✓    |    ✓    |
| ftpReturn                                       |           |   ✓   |     ✓    |    ✓    |
| ftpType                                         |           |   ✓   |     ✓    |    ✓    |
| ftpUser                                         |           |   ✓   |     ✓    |    ✓    |
| httpAccept                                      |           |   ✓   |     ✓    |    ✓    |
| httpAcceptCharset                               |           |   ✓   |     ✓    |    ✓    |
| httpAcceptEncoding                              |           |   ✓   |     ✓    |    ✓    |
| httpAcceptLanguage                              |           |   ✓   |     ✓    |    ✓    |
| httpAge                                         |           |   ✓   |     ✓    |    ✓    |
| httpAllow                                       |           |   ✓   |     ✓    |    ✓    |
| httpAuthorization                               |           |   ✓   |     ✓    |    ✓    |
| httpConnection                                  |           |   ✓   |     ✓    |    ✓    |
| httpContentEncoding                             |           |   ✓   |     ✓    |    ✓    |
| httpContentLanguage                             |           |   ✓   |     ✓    |    ✓    |
| httpContentLength                               |           |   ✓   |     ✓    |    ✓    |
| httpContentLocation                             |           |   ✓   |     ✓    |    ✓    |
| httpContentType                                 |           |   ✓   |     ✓    |    ✓    |
| httpCookie                                      |           |   ✓   |     ✓    |    ✓    |
| httpDate                                        |           |   ✓   |     ✓    |    ✓    |
| httpDNT                                         |           |   ✓   |     ✓    |    ✓    |
| httpExpect                                      |           |   ✓   |     ✓    |    ✓    |
| httpExpires                                     |           |   ✓   |     ✓    |    ✓    |
| httpFrom                                        |           |   ✓   |     ✓    |    ✓    |
| httpGet                                         |           |   ✓   |     ✓    |    ✓    |
| httpHost                                        |           |   ✓   |     ✓    |    ✓    |
| httpIMEI                                        |           |   ✓   |     ✓    |    ✓    |
| httpIMSI                                        |           |   ✓   |     ✓    |    ✓    |
| httpLastModified                                |           |   ✓   |     ✓    |    ✓    |
| httpLocation                                    |           |   ✓   |     ✓    |    ✓    |
| httpMSISDN                                      |           |   ✓   |     ✓    |    ✓    |
| httpProxyAuthentication                         |           |   ✓   |     ✓    |    ✓    |
| httpReferer                                     |           |   ✓   |     ✓    |    ✓    |
| httpRefresh                                     |           |   ✓   |     ✓    |    ✓    |
| httpResponse                                    |           |   ✓   |     ✓    |    ✓    |
| httpServerString                                |           |   ✓   |     ✓    |    ✓    |
| httpSetCookie                                   |           |   ✓   |     ✓    |    ✓    |
| httpSubscriber                                  |           |   ✓   |     ✓    |    ✓    |
| httpUpgrade                                     |           |   ✓   |     ✓    |    ✓    |
| httpUserAgent                                   |           |   ✓   |     ✓    |    ✓    |
| httpVersion                                     |           |   ✓   |     ✓    |    ✓    |
| httpVia                                         |           |   ✓   |     ✓    |    ✓    |
| httpWarning                                     |           |   ✓   |     ✓    |    ✓    |
| httpX-DeviceID                                  |           |   ✓   |     ✓    |    ✓    |
| httpX-Forwarded-For                             |           |   ✓   |     ✓    |    ✓    |
| httpX-Forwarded-Host                            |           |   ✓   |     ✓    |    ✓    |
| httpX-Forwarded-Proto                           |           |   ✓   |     ✓    |    ✓    |
| httpX-Forwarded-Server                          |           |   ✓   |     ✓    |    ✓    |
| httpX-Profile                                   |           |   ✓   |     ✓    |    ✓    |
| httpX-UA-Compatible                             |           |   ✓   |     ✓    |    ✓    |
| imapAuthenticate                                |           |   ✓   |     ✓    |    ✓    |
| imapCapability                                  |           |   ✓   |     ✓    |    ✓    |
| imapCommand                                     |           |   ✓   |     ✓    |    ✓    |
| imapExists                                      |           |   ✓   |     ✓    |    ✓    |
| imapLogin                                       |           |   ✓   |     ✓    |    ✓    |
| imapRecent                                      |           |   ✓   |     ✓    |    ✓    |
| imapStartTLS                                    |           |   ✓   |     ✓    |    ✓    |
| initialTCPFlags                                 |           |   ✓   |     ✓    |    ✓    |
| ircTextMessage                                  |           |   ✓   |     ✓    |    ✓    |
| largePacketCount                                |           |   ✓   |     ✓    |    ✓    |
| maxPacketSize                                   |           |   ✓   |     ✓    |    ✓    |
| meanFlowRate                                    |           |   ✓   |     ✓    |    ✓    |
| meanPacketRate                                  |           |   ✓   |     ✓    |    ✓    |
| modbusData                                      |           |   ✓   |     ✓    |    ✓    |
| mptcpAddressID                                  |           |   ✓   |     ✓    |    ✓    |
| mptcpFlags                                      |           |   ✓   |     ✓    |    ✓    |
| mptcpInitialDataSequenceNumber                  |           |   ✓   |     ✓    |    ✓    |
| mptcpMaximumSegmentSize                         |           |   ✓   |     ✓    |    ✓    |
| mptcpReceiverToken                              |           |   ✓   |     ✓    |    ✓    |
| mysqlCommandCode                                |           |   ✓   |     ✓    |    ✓    |
| mysqlCommandText                                |           |   ✓   |     ✓    |    ✓    |
| mysqlUsername                                   |           |   ✓   |     ✓    |    ✓    |
| nDPIL7Protocol                                  |           |   ✓   |     ✓    |    ✓    |
| nDPIL7SubProtocol                               |           |   ✓   |     ✓    |    ✓    |
| nntpCommand                                     |           |   ✓   |     ✓    |    ✓    |
| nntpResponse                                    |           |   ✓   |     ✓    |    ✓    |
| nonEmptyPacketCount                             |           |   ✓   |     ✓    |    ✓    |
| observedData                                    |           |   ✓   |     ✓    |    ✓    |
| observedDataTotalCount                          |           |   ✓   |     ✓    |    ✓    |
| obsoleteReverseInitialTCPFlags                  |           |   ✓   |     ✓    |    ✓    |
| obsoleteReverseOctetTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| obsoleteReversePacketTotalCount                 |           |   ✓   |     ✓    |    ✓    |
| obsoleteReversePayload                          |           |   ✓   |     ✓    |    ✓    |
| obsoleteReverseTcpSequenceNumber                |           |   ✓   |     ✓    |    ✓    |
| obsoleteReverseUnionTCPFlags                    |           |   ✓   |     ✓    |    ✓    |
| obsoleteReverseVlanId                           |           |   ✓   |     ✓    |    ✓    |
| osFingerPrint                                   |           |   ✓   |     ✓    |    ✓    |
| osName                                          |           |   ✓   |     ✓    |    ✓    |
| osVersion                                       |           |   ✓   |     ✓    |    ✓    |
| payload                                         |           |   ✓   |     ✓    |    ✓    |
| payloadEntropy                                  |           |   ✓   |     ✓    |    ✓    |
| pop3TextMessage                                 |           |   ✓   |     ✓    |    ✓    |
| Reverse flow averageInterarrivalTime            |           |   ✓   |     ✓    |    ✓    |
| Reverse flow dataByteCount                      |           |   ✓   |     ✓    |    ✓    |
| Reverse flow dhcpFingerPrint                    |           |   ✓   |     ✓    |    ✓    |
| Reverse flow dhcpVendorCode                     |           |   ✓   |     ✓    |    ✓    |
| Reverse flow firstEightNonEmptyPacketDirections |           |   ✓   |     ✓    |    ✓    |
| Reverse flow firstNonEmptyPacketSize            |           |   ✓   |     ✓    |    ✓    |
| Reverse flow firstPacketBanner                  |           |   ✓   |     ✓    |    ✓    |
| Reverse flow flowAttributes                     |           |   ✓   |     ✓    |    ✓    |
| Reverse flow initialTCPFlags                    |           |   ✓   |     ✓    |    ✓    |
| Reverse flow largePacketCount                   |           |   ✓   |     ✓    |    ✓    |
| Reverse flow maxPacketSize                      |           |   ✓   |     ✓    |    ✓    |
| Reverse flow nonEmptyPacketCount                |           |   ✓   |     ✓    |    ✓    |
| Reverse flow osFingerPrint                      |           |   ✓   |     ✓    |    ✓    |
| Reverse flow osName                             |           |   ✓   |     ✓    |    ✓    |
| Reverse flow osVersion                          |           |   ✓   |     ✓    |    ✓    |
| Reverse flow payload                            |           |   ✓   |     ✓    |    ✓    |
| Reverse flow payloadEntropy                     |           |   ✓   |     ✓    |    ✓    |
| Reverse flow rtpPayloadType                     |           |   ✓   |     ✓    |    ✓    |
| Reverse flow secondPacketBanner                 |           |   ✓   |     ✓    |    ✓    |
| Reverse flow smallPacketCount                   |           |   ✓   |     ✓    |    ✓    |
| Reverse flow standardDeviationInterarrivalTime  |           |   ✓   |     ✓    |    ✓    |
| Reverse flow standardDeviationPayloadLength     |           |   ✓   |     ✓    |    ✓    |
| Reverse flow tcpUrgentCount                     |           |   ✓   |     ✓    |    ✓    |
| Reverse flow unionTCPFlags                      |           |   ✓   |     ✓    |    ✓    |
| reverseFlowDeltaMilliseconds                    |           |   ✓   |     ✓    |    ✓    |
| rrIPv4                                          |           |   ✓   |     ✓    |    ✓    |
| rrIPv6                                          |           |   ✓   |     ✓    |    ✓    |
| rtpPayloadType                                  |           |   ✓   |     ✓    |    ✓    |
| rtspCommand                                     |           |   ✓   |     ✓    |    ✓    |
| rtspContentLength                               |           |   ✓   |     ✓    |    ✓    |
| rtspContentType                                 |           |   ✓   |     ✓    |    ✓    |
| rtspCSeq                                        |           |   ✓   |     ✓    |    ✓    |
| rtspJitter                                      |           |   ✓   |     ✓    |    ✓    |
| rtspLocation                                    |           |   ✓   |     ✓    |    ✓    |
| rtspPacketsReceived                             |           |   ✓   |     ✓    |    ✓    |
| rtspReturnCode                                  |           |   ✓   |     ✓    |    ✓    |
| rtspTransport                                   |           |   ✓   |     ✓    |    ✓    |
| rtspURL                                         |           |   ✓   |     ✓    |    ✓    |
| rtspUserAgent                                   |           |   ✓   |     ✓    |    ✓    |
| rtspVersion                                     |           |   ✓   |     ✓    |    ✓    |
| secondPacketBanner                              |           |   ✓   |     ✓    |    ✓    |
| silkAppLabel                                    |           |   ✓   |     ✓    |    ✓    |
| silkFlowSensor                                  |           |   ✓   |     ✓    |    ✓    |
| silkFlowType                                    |           |   ✓   |     ✓    |    ✓    |
| silkTCPState                                    |           |   ✓   |     ✓    |    ✓    |
| sipAddress                                      |           |   ✓   |     ✓    |    ✓    |
| sipCommand                                      |           |   ✓   |     ✓    |    ✓    |
| sipContentLength                                |           |   ✓   |     ✓    |    ✓    |
| sipInvite                                       |           |   ✓   |     ✓    |    ✓    |
| sipMaxForwards                                  |           |   ✓   |     ✓    |    ✓    |
| sipUserAgent                                    |           |   ✓   |     ✓    |    ✓    |
| sipVia                                          |           |   ✓   |     ✓    |    ✓    |
| slpMessageType                                  |           |   ✓   |     ✓    |    ✓    |
| slpString                                       |           |   ✓   |     ✓    |    ✓    |
| slpVersion                                      |           |   ✓   |     ✓    |    ✓    |
| smallPacketCount                                |           |   ✓   |     ✓    |    ✓    |
| smtpContentDisposition                          |           |   ✓   |     ✓    |    ✓    |
| smtpContentType                                 |           |   ✓   |     ✓    |    ✓    |
| smtpDate                                        |           |   ✓   |     ✓    |    ✓    |
| smtpEnhanced                                    |           |   ✓   |     ✓    |    ✓    |
| smtpFilename                                    |           |   ✓   |     ✓    |    ✓    |
| smtpFrom                                        |           |   ✓   |     ✓    |    ✓    |
| smtpHello                                       |           |   ✓   |     ✓    |    ✓    |
| smtpResponse                                    |           |   ✓   |     ✓    |    ✓    |
| smtpSize                                        |           |   ✓   |     ✓    |    ✓    |
| smtpSubject                                     |           |   ✓   |     ✓    |    ✓    |
| smtpTo                                          |           |   ✓   |     ✓    |    ✓    |
| sshVersion                                      |           |   ✓   |     ✓    |    ✓    |
| sslCertificate                                  |           |   ✓   |     ✓    |    ✓    |
| sslCertificateHash                              |           |   ✓   |     ✓    |    ✓    |
| sslCertificateMD5                               |           |   ✓   |     ✓    |    ✓    |
| sslCertificateSHA1                              |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerCommonName                         |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerCountryName                        |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerLocalityName                       |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerOrgName                            |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerOrgUnitName                        |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerState                              |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerStreetAddress                      |           |   ✓   |     ✓    |    ✓    |
| sslCertIssuerZipCode                            |           |   ✓   |     ✓    |    ✓    |
| sslCertSerialNumber                             |           |   ✓   |     ✓    |    ✓    |
| sslCertSignature                                |           |   ✓   |     ✓    |    ✓    |
| sslCertSubCommonName                            |           |   ✓   |     ✓    |    ✓    |
| sslCertSubCountryName                           |           |   ✓   |     ✓    |    ✓    |
| sslCertSubLocalityName                          |           |   ✓   |     ✓    |    ✓    |
| sslCertSubOrgName                               |           |   ✓   |     ✓    |    ✓    |
| sslCertSubOrgUnitName                           |           |   ✓   |     ✓    |    ✓    |
| sslCertSubState                                 |           |   ✓   |     ✓    |    ✓    |
| sslCertSubStreetAddress                         |           |   ✓   |     ✓    |    ✓    |
| sslCertSubZipCode                               |           |   ✓   |     ✓    |    ✓    |
| sslCertValidityNotAfter                         |           |   ✓   |     ✓    |    ✓    |
| sslCertValidityNotBefore                        |           |   ✓   |     ✓    |    ✓    |
| sslCertVersion                                  |           |   ✓   |     ✓    |    ✓    |
| sslCipher                                       |           |   ✓   |     ✓    |    ✓    |
| sslClientVersion                                |           |   ✓   |     ✓    |    ✓    |
| sslCompressionMethod                            |           |   ✓   |     ✓    |    ✓    |
| sslObjectType                                   |           |   ✓   |     ✓    |    ✓    |
| sslObjectValue                                  |           |   ✓   |     ✓    |    ✓    |
| sslPublicKeyAlgorithm                           |           |   ✓   |     ✓    |    ✓    |
| sslPublicKeyLength                              |           |   ✓   |     ✓    |    ✓    |
| sslRecordVersion                                |           |   ✓   |     ✓    |    ✓    |
| sslServerCipher                                 |           |   ✓   |     ✓    |    ✓    |
| sslServerName                                   |           |   ✓   |     ✓    |    ✓    |
| standardDeviationInterarrivalTime               |           |   ✓   |     ✓    |    ✓    |
| standardDeviationPayloadLength                  |           |   ✓   |     ✓    |    ✓    |
| tcpUrgentCount                                  |           |   ✓   |     ✓    |    ✓    |
| templateDescription                             |           |   ✓   |     ✓    |    ✓    |
| templateName                                    |           |   ✓   |     ✓    |    ✓    |
| tftpFilename                                    |           |   ✓   |     ✓    |    ✓    |
| tftpMode                                        |           |   ✓   |     ✓    |    ✓    |
| tombstoneId                                     |           |   ✓   |     ✓    |    ✓    |
| unionTCPFlags                                   |           |   ✓   |     ✓    |    ✓    |
| yafFlowKeyHash                                  |           |   ✓   |     ✓    |    ✓    |

### VMware (PEN: 6876)

| Name                           | Community | Basic | Standard | Premium |
| ------------------------------ | :-------: | :---: | :------: | :-----: |
| algControlFlowId               |           |   ✓   |     ✓    |    ✓    |
| algFlowType                    |           |   ✓   |     ✓    |    ✓    |
| algType                        |           |   ✓   |     ✓    |    ✓    |
| averageLatency                 |           |   ✓   |     ✓    |    ✓    |
| egressInterfaceAttr            |           |   ✓   |     ✓    |    ✓    |
| flowDirection                  |           |   ✓   |     ✓    |    ✓    |
| ingressInterfaceAttr           |           |   ✓   |     ✓    |    ✓    |
| retransmissionCount            |           |   ✓   |     ✓    |    ✓    |
| ruleId                         |           |   ✓   |     ✓    |    ✓    |
| sessionFlags                   |           |   ✓   |     ✓    |    ✓    |
| tenantDestIPv4                 |           |   ✓   |     ✓    |    ✓    |
| tenantDestIPv6                 |           |   ✓   |     ✓    |    ✓    |
| tenantDestPort                 |           |   ✓   |     ✓    |    ✓    |
| tenantProtocol                 |           |   ✓   |     ✓    |    ✓    |
| tenantSourceIPv4               |           |   ✓   |     ✓    |    ✓    |
| tenantSourceIPv6               |           |   ✓   |     ✓    |    ✓    |
| tenantSourcePort               |           |   ✓   |     ✓    |    ✓    |
| tunnelDestinationIPv4Address   |           |   ✓   |     ✓    |    ✓    |
| tunnelDestinationTransportPort |           |   ✓   |     ✓    |    ✓    |
| tunnelKey                      |           |   ✓   |     ✓    |    ✓    |
| tunnelProtocolIdentifier       |           |   ✓   |     ✓    |    ✓    |
| tunnelSourceIPv4Address        |           |   ✓   |     ✓    |    ✓    |
| tunnelSourceTransportPort      |           |   ✓   |     ✓    |    ✓    |
| tunnelType                     |           |   ✓   |     ✓    |    ✓    |
| vifId                          |           |   ✓   |     ✓    |    ✓    |
| vifUuid                        |           |   ✓   |     ✓    |    ✓    |
| virtualObsID                   |           |   ✓   |     ✓    |    ✓    |
| vmUuid                         |           |   ✓   |     ✓    |    ✓    |
| vnicIndex                      |           |   ✓   |     ✓    |    ✓    |
| vxlanExportRole                |           |   ✓   |     ✓    |    ✓    |

### CESNET (PEN: 8057)

| Name                          | Community | Basic | Standard | Premium |
| ----------------------------- | :-------: | :---: | :------: | :-----: |
| ARP\_DST\_HA                  |           |   ✓   |     ✓    |    ✓    |
| ARP\_DST\_PA                  |           |   ✓   |     ✓    |    ✓    |
| ARP\_HA\_FORMAT               |           |   ✓   |     ✓    |    ✓    |
| ARP\_OPCODE                   |           |   ✓   |     ✓    |    ✓    |
| ARP\_PA\_FORMAT               |           |   ✓   |     ✓    |    ✓    |
| ARP\_SRC\_HA                  |           |   ✓   |     ✓    |    ✓    |
| ARP\_SRC\_PA                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_A                        |           |   ✓   |     ✓    |    ✓    |
| DNS\_AAAA                     |           |   ✓   |     ✓    |    ✓    |
| DNS\_ANSWERS                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_ATYPE                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_CLASS                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_DO                       |           |   ✓   |     ✓    |    ✓    |
| DNS\_ID                       |           |   ✓   |     ✓    |    ✓    |
| DNS\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| DNS\_PSIZE                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_QTYPE                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_RCODE                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_RDATA                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_RLENGTH                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_RR\_TTL                  |           |   ✓   |     ✓    |    ✓    |
| FLOWDIR\_SYN                  |           |   ✓   |     ✓    |    ✓    |
| HB\_DIR                       |           |   ✓   |     ✓    |    ✓    |
| HB\_SIZE\_MSG                 |           |   ✓   |     ✓    |    ✓    |
| HB\_SIZE\_PAYLOAD             |           |   ✓   |     ✓    |    ✓    |
| HB\_TYPE                      |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_AGENT          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_HOST           |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_HOST           |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_METHOD\_ID     |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_RANGE          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_REFERER        |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REQUEST\_URL            |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RESPONSE\_CONTENT\_TYPE |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RESPONSE\_STATUS\_CODE  |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RESPONSE\_TIME          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RESPONSE\_TIME          |           |   ✓   |     ✓    |    ✓    |
| NTP\_DELAY                    |           |   ✓   |     ✓    |    ✓    |
| NTP\_DISPERSION               |           |   ✓   |     ✓    |    ✓    |
| NTP\_LEAP                     |           |   ✓   |     ✓    |    ✓    |
| NTP\_MODE                     |           |   ✓   |     ✓    |    ✓    |
| NTP\_ORIG                     |           |   ✓   |     ✓    |    ✓    |
| NTP\_POLL                     |           |   ✓   |     ✓    |    ✓    |
| NTP\_PRECISION                |           |   ✓   |     ✓    |    ✓    |
| NTP\_RECV                     |           |   ✓   |     ✓    |    ✓    |
| NTP\_REF                      |           |   ✓   |     ✓    |    ✓    |
| NTP\_REF\_ID                  |           |   ✓   |     ✓    |    ✓    |
| NTP\_SENT                     |           |   ✓   |     ✓    |    ✓    |
| NTP\_STRATUM                  |           |   ✓   |     ✓    |    ✓    |
| NTP\_VERSION                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALL\_ID                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALLED\_PARTY            |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALLING\_PARTY           |           |   ✓   |     ✓    |    ✓    |
| SIP\_CSEQ                     |           |   ✓   |     ✓    |    ✓    |
| SIP\_MSG\_TYPE                |           |   ✓   |     ✓    |    ✓    |
| SIP\_REQUEST\_URI             |           |   ✓   |     ✓    |    ✓    |
| SIP\_STATUS\_CODE             |           |   ✓   |     ✓    |    ✓    |
| SIP\_USER\_AGENT              |           |   ✓   |     ✓    |    ✓    |
| SIP\_VIA                      |           |   ✓   |     ✓    |    ✓    |
| SIPContact                    |           |   ✓   |     ✓    |    ✓    |
| SIPFrom                       |           |   ✓   |     ✓    |    ✓    |
| SIPMethod                     |           |   ✓   |     ✓    |    ✓    |
| SIPRecordRoute                |           |   ✓   |     ✓    |    ✓    |
| SIPRequestURI                 |           |   ✓   |     ✓    |    ✓    |
| SIPRoute                      |           |   ✓   |     ✓    |    ✓    |
| SIPStatusCode                 |           |   ✓   |     ✓    |    ✓    |
| SIPTo                         |           |   ✓   |     ✓    |    ✓    |
| SIPVia                        |           |   ✓   |     ✓    |    ✓    |
| SMTP\_2XX\_STAT\_CODE\_COUNT  |           |   ✓   |     ✓    |    ✓    |
| SMTP\_3XX\_STAT\_CODE\_COUNT  |           |   ✓   |     ✓    |    ✓    |
| SMTP\_4XX\_STAT\_CODE\_COUNT  |           |   ✓   |     ✓    |    ✓    |
| SMTP\_5XX\_STAT\_CODE\_COUNT  |           |   ✓   |     ✓    |    ✓    |
| SMTP\_COMMAND\_FLAGS          |           |   ✓   |     ✓    |    ✓    |
| SMTP\_DOMAIN                  |           |   ✓   |     ✓    |    ✓    |
| SMTP\_FIRST\_RECIPIENT        |           |   ✓   |     ✓    |    ✓    |
| SMTP\_FIRST\_SENDER           |           |   ✓   |     ✓    |    ✓    |
| SMTP\_FLAGS                   |           |   ✓   |     ✓    |    ✓    |
| SMTP\_MAIL\_CMD\_COUNT        |           |   ✓   |     ✓    |    ✓    |
| SMTP\_RCPT\_CMD\_COUNT        |           |   ✓   |     ✓    |    ✓    |
| SMTP\_STAT\_CODE\_FLAGS       |           |   ✓   |     ✓    |    ✓    |
| VENOM                         |           |   ✓   |     ✓    |    ✓    |

### LANcope, now Cisco (PEN: 8712)

| Name                                  | Community | Basic | Standard | Premium |
| ------------------------------------- | :-------: | :---: | :------: | :-----: |
| EndpointFlowParentProcessAccount      |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowParentProcessHash         |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowParentProcessName         |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowProcessAccount            |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowProcessHash               |           |   ✓   |     ✓    |    ✓    |
| EndpointFlowProcessName               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorApplicationDetails          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorApplicationIdentifier       |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagBadRST               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagNoACK                |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagNoFlag               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagSYNFIN               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagURG                  |           |   ✓   |     ✓    |    ✓    |
| FlowSensorBadFlagXmas                 |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailIn          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailInMessages  |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailInTrys      |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailOut         |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailOutMessages |           |   ✓   |     ✓    |    ✓    |
| FlowSensorDestinationEmailOutTrys     |           |   ✓   |     ✓    |    ✓    |
| FlowSensorEmbeddedICMPCode            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorEmbeddedICMPProtocol        |           |   ✓   |     ✓    |    ✓    |
| FlowSensorEmbeddedICMPType            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorFragPacketDifferentSizes    |           |   ✓   |     ✓    |    ✓    |
| FlowSensorFragPacketTooLong           |           |   ✓   |     ✓    |    ✓    |
| FlowSensorFragPacketTooShort          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorInitiator                   |           |   ✓   |     ✓    |    ✓    |
| FlowSensorRetransmits                 |           |   ✓   |     ✓    |    ✓    |
| FlowSensorRoundTripTime               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorServerResponseTime          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorShortFragAttack             |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailIn               |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailInMessages       |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailInTrys           |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailOut              |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailOutMessages      |           |   ✓   |     ✓    |    ✓    |
| FlowSensorSourceEmailOutTrys          |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPBadTotalCount            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPFragTotalCount           |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPSRSTotalCount            |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTCPSYNACKTotalCount         |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTraces                      |           |   ✓   |     ✓    |    ✓    |
| FlowSensorTrustsecSourceIdentifier    |           |   ✓   |     ✓    |    ✓    |

### SonicWALL (PEN: 8741)

| Name                          | Community | Basic | Standard | Premium |
| ----------------------------- | :-------: | :---: | :------: | :-----: |
| APP\_ATTR\_BIT\_MASK          |           |   ✓   |     ✓    |    ✓    |
| APP\_BWM\_ATTR                |           |   ✓   |     ✓    |    ✓    |
| APP\_CAT\_ID                  |           |   ✓   |     ✓    |    ✓    |
| APP\_CAT\_NAME                |           |   ✓   |     ✓    |    ✓    |
| APP\_CONTENT\_TYPE            |           |   ✓   |     ✓    |    ✓    |
| APP\_ID                       |           |   ✓   |     ✓    |    ✓    |
| APP\_INDEX                    |           |   ✓   |     ✓    |    ✓    |
| APP\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| APP\_RISK\_ATTR               |           |   ✓   |     ✓    |    ✓    |
| APP\_SIG\_ID                  |           |   ✓   |     ✓    |    ✓    |
| APP\_TECH\_ATTR               |           |   ✓   |     ✓    |    ✓    |
| ASPY\_INDEX                   |           |   ✓   |     ✓    |    ✓    |
| ASPY\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| ASPY\_PROD\_ID                |           |   ✓   |     ✓    |    ✓    |
| ASPY\_PROD\_NAME              |           |   ✓   |     ✓    |    ✓    |
| ASPY\_SIG\_ID                 |           |   ✓   |     ✓    |    ✓    |
| COLUMN\_IDENTIFIER            |           |   ✓   |     ✓    |    ✓    |
| COLUMN\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| COLUMN\_STANDARD\_IPFIX\_ID   |           |   ✓   |     ✓    |    ✓    |
| COLUMN\_TYPE                  |           |   ✓   |     ✓    |    ✓    |
| CORE\_STAT\_CORE\_ID          |           |   ✓   |     ✓    |    ✓    |
| CORE\_STAT\_CORE\_UTIL        |           |   ✓   |     ✓    |    ✓    |
| COUNTRY\_ID                   |           |   ✓   |     ✓    |    ✓    |
| COUNTRY\_NAME                 |           |   ✓   |     ✓    |    ✓    |
| DEV\_IFACE\_ID                |           |   ✓   |     ✓    |    ✓    |
| DEV\_IP\_ADDR                 |           |   ✓   |     ✓    |    ✓    |
| DEV\_MAC\_ADDR                |           |   ✓   |     ✓    |    ✓    |
| DEV\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| FLOW\_BLOCK\_REASON           |           |   ✓   |     ✓    |    ✓    |
| FLOW\_END\_TIME               |           |   ✓   |     ✓    |    ✓    |
| FLOW\_IDENTIFIER              |           |   ✓   |     ✓    |    ✓    |
| FLOW\_INIT\_OCTETS\_RATE      |           |   ✓   |     ✓    |    ✓    |
| FLOW\_INIT\_PKT\_RATE         |           |   ✓   |     ✓    |    ✓    |
| FLOW\_INIT\_PKT\_SIZE         |           |   ✓   |     ✓    |    ✓    |
| FLOW\_RESP\_OCTETS\_RATE      |           |   ✓   |     ✓    |    ✓    |
| FLOW\_RESP\_PKT\_RATE         |           |   ✓   |     ✓    |    ✓    |
| FLOW\_RESP\_PKT\_SIZE         |           |   ✓   |     ✓    |    ✓    |
| FLOW\_START\_TIME             |           |   ✓   |     ✓    |    ✓    |
| FLOW\_TO\_APPLICATION\_ID     |           |   ✓   |     ✓    |    ✓    |
| FLOW\_TO\_IPS\_ID             |           |   ✓   |     ✓    |    ✓    |
| FLOW\_TO\_SPYWARE\_ID         |           |   ✓   |     ✓    |    ✓    |
| FLOW\_TO\_USER\_ID            |           |   ✓   |     ✓    |    ✓    |
| FLOW\_TO\_VIRUS\_ID           |           |   ✓   |     ✓    |    ✓    |
| GAV\_INDEX                    |           |   ✓   |     ✓    |    ✓    |
| GAV\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| GAV\_SIG\_ID                  |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_CONN\_RATE          |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IF\_MODE            |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IF\_MTU             |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IF\_NAME            |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IF\_SPEED           |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IF\_STATE           |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IF\_TYPE            |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IFACE               |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IN\_OCTETS\_RATE    |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IN\_PKT\_SIZE       |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IN\_PKTS\_RATE      |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_IP\_ADDRESS         |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_MAC\_ADDRESS        |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_OUT\_OCTETS\_RATE   |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_OUT\_PKT\_SIZE      |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_OUT\_PKTS\_RATE     |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_SECURITY\_TYPE      |           |   ✓   |     ✓    |    ✓    |
| IF\_STAT\_ZONE\_NAME          |           |   ✓   |     ✓    |    ✓    |
| INIT\_TO\_RESP\_DELTA\_OCTETS |           |   ✓   |     ✓    |    ✓    |
| INIT\_TO\_RESP\_DELTA\_PKTS   |           |   ✓   |     ✓    |    ✓    |
| INIT\_TO\_RESP\_OCTETS        |           |   ✓   |     ✓    |    ✓    |
| INIT\_TO\_RESP\_PKTS          |           |   ✓   |     ✓    |    ✓    |
| INIT\_VPN\_SPI\_OUT           |           |   ✓   |     ✓    |    ✓    |
| INITIATOR\_GW\_IP\_ADDR       |           |   ✓   |     ✓    |    ✓    |
| INITIATOR\_GW\_MAC            |           |   ✓   |     ✓    |    ✓    |
| INITIATOR\_IFACE              |           |   ✓   |     ✓    |    ✓    |
| INITIATOR\_IP\_ADDR           |           |   ✓   |     ✓    |    ✓    |
| INITIATOR\_PORT               |           |   ✓   |     ✓    |    ✓    |
| INTERNAL\_FLAGS               |           |   ✓   |     ✓    |    ✓    |
| IPS\_CAT\_ID                  |           |   ✓   |     ✓    |    ✓    |
| IPS\_CAT\_NAME                |           |   ✓   |     ✓    |    ✓    |
| IPS\_INDEX                    |           |   ✓   |     ✓    |    ✓    |
| IPS\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| IPS\_SIG\_ID                  |           |   ✓   |     ✓    |    ✓    |
| LOCATION\_DOMAIN\_NAME        |           |   ✓   |     ✓    |    ✓    |
| LOCATION\_IP                  |           |   ✓   |     ✓    |    ✓    |
| LOCATION\_REGION\_ID          |           |   ✓   |     ✓    |    ✓    |
| MEDIA\_PROTOCOL               |           |   ✓   |     ✓    |    ✓    |
| MEDIA\_TYPE                   |           |   ✓   |     ✓    |    ✓    |
| MEM\_AVAIL\_RAM               |           |   ✓   |     ✓    |    ✓    |
| MEM\_DB\_RAM                  |           |   ✓   |     ✓    |    ✓    |
| MEM\_FLOW\_COUNT              |           |   ✓   |     ✓    |    ✓    |
| MEM\_PER\_FLOW                |           |   ✓   |     ✓    |    ✓    |
| MEM\_TOTAL\_RAM               |           |   ✓   |     ✓    |    ✓    |
| MEM\_USED\_RAM                |           |   ✓   |     ✓    |    ✓    |
| PROTOCOL\_TYPE                |           |   ✓   |     ✓    |    ✓    |
| RATING\_INDEX                 |           |   ✓   |     ✓    |    ✓    |
| RATING\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| REGION\_ID                    |           |   ✓   |     ✓    |    ✓    |
| REGION\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| RESP\_TO\_INIT\_DELTA\_OCTETS |           |   ✓   |     ✓    |    ✓    |
| RESP\_TO\_INIT\_DELTA\_PKTS   |           |   ✓   |     ✓    |    ✓    |
| RESP\_TO\_INIT\_OCTETS        |           |   ✓   |     ✓    |    ✓    |
| RESP\_TO\_INIT\_PKTS          |           |   ✓   |     ✓    |    ✓    |
| RESP\_VPN\_SPI\_OUT           |           |   ✓   |     ✓    |    ✓    |
| RESPONDER\_GW\_IP\_ADDR       |           |   ✓   |     ✓    |    ✓    |
| RESPONDER\_GW\_MAC            |           |   ✓   |     ✓    |    ✓    |
| RESPONDER\_IFACE              |           |   ✓   |     ✓    |    ✓    |
| RESPONDER\_IP\_ADDR           |           |   ✓   |     ✓    |    ✓    |
| RESPONDER\_PORT               |           |   ✓   |     ✓    |    ✓    |
| SERVICE\_IP\_TYPE             |           |   ✓   |     ✓    |    ✓    |
| SERVICE\_NAME                 |           |   ✓   |     ✓    |    ✓    |
| SERVICE\_PORT\_BEGIN          |           |   ✓   |     ✓    |    ✓    |
| SERVICE\_PORT\_END            |           |   ✓   |     ✓    |    ✓    |
| SNWL\_OPTION                  |           |   ✓   |     ✓    |    ✓    |
| SPAM\_FLOW\_ID                |           |   ✓   |     ✓    |    ✓    |
| SPAM\_FROM\_E\_MAIL           |           |   ✓   |     ✓    |    ✓    |
| SPAM\_SESS\_ID                |           |   ✓   |     ✓    |    ✓    |
| SPAM\_SPAMMER                 |           |   ✓   |     ✓    |    ✓    |
| SPAM\_TIME\_ID                |           |   ✓   |     ✓    |    ✓    |
| SPAM\_TO\_E\_MAIL             |           |   ✓   |     ✓    |    ✓    |
| SPAM\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| TABLE\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| TEMPLATE\_IDENTIFIER          |           |   ✓   |     ✓    |    ✓    |
| TIME\_STAMP                   |           |   ✓   |     ✓    |    ✓    |
| TOP\_APPS\_APPNAME            |           |   ✓   |     ✓    |    ✓    |
| TOP\_APPS\_RATE               |           |   ✓   |     ✓    |    ✓    |
| TOP\_APPS\_SIGID              |           |   ✓   |     ✓    |    ✓    |
| URL\_FLOW\_ID                 |           |   ✓   |     ✓    |    ✓    |
| URL\_IP                       |           |   ✓   |     ✓    |    ✓    |
| URL\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| URL\_RATING\_VAL1             |           |   ✓   |     ✓    |    ✓    |
| URL\_RATING\_VAL2             |           |   ✓   |     ✓    |    ✓    |
| URL\_RATING\_VAL3             |           |   ✓   |     ✓    |    ✓    |
| URL\_RATING\_VAL4             |           |   ✓   |     ✓    |    ✓    |
| URL\_TIME\_ID                 |           |   ✓   |     ✓    |    ✓    |
| USER\_AUTH\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| USER\_DOMAIN\_NAME            |           |   ✓   |     ✓    |    ✓    |
| USER\_ID                      |           |   ✓   |     ✓    |    ✓    |
| USER\_INDEX                   |           |   ✓   |     ✓    |    ✓    |
| USER\_IP\_ADDR                |           |   ✓   |     ✓    |    ✓    |
| USER\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| VOIP\_FLOW\_ID                |           |   ✓   |     ✓    |    ✓    |
| VOIP\_INIT\_CALL\_ID          |           |   ✓   |     ✓    |    ✓    |
| VOIP\_INIT2RESP\_AVG\_LATENCY |           |   ✓   |     ✓    |    ✓    |
| VOIP\_INIT2RESP\_LOST\_PKTS   |           |   ✓   |     ✓    |    ✓    |
| VOIP\_INIT2RESP\_MAX\_LATENCY |           |   ✓   |     ✓    |    ✓    |
| VOIP\_RESP\_CALL\_ID          |           |   ✓   |     ✓    |    ✓    |
| VOIP\_RESP2INIT\_AVG\_LATENCY |           |   ✓   |     ✓    |    ✓    |
| VOIP\_RESP2INIT\_LOST\_PKTS   |           |   ✓   |     ✓    |    ✓    |
| VOIP\_RESP2INIT\_MAX\_LATENCY |           |   ✓   |     ✓    |    ✓    |
| VOIP\_TIME\_ID                |           |   ✓   |     ✓    |    ✓    |
| VPN\_AUTHENTICATION\_TYPE     |           |   ✓   |     ✓    |    ✓    |
| VPN\_ENCRYPTION\_TYPE         |           |   ✓   |     ✓    |    ✓    |
| VPN\_END\_TIME                |           |   ✓   |     ✓    |    ✓    |
| VPN\_IN\_SPI\_ID              |           |   ✓   |     ✓    |    ✓    |
| VPN\_LOCAL\_GW                |           |   ✓   |     ✓    |    ✓    |
| VPN\_OUT\_SPI\_ID             |           |   ✓   |     ✓    |    ✓    |
| VPN\_POLICY\_TYPE             |           |   ✓   |     ✓    |    ✓    |
| VPN\_PROTOCOL\_TYPE           |           |   ✓   |     ✓    |    ✓    |
| VPN\_REMOTE\_GW               |           |   ✓   |     ✓    |    ✓    |
| VPN\_START\_TIME              |           |   ✓   |     ✓    |    ✓    |
| VPN\_TUNNEL\_IFACE\_ID        |           |   ✓   |     ✓    |    ✓    |
| VPN\_TUNNEL\_NAME             |           |   ✓   |     ✓    |    ✓    |

### Sophos, was Astaro AG (PEN: 9789)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| afcProtocol     |           |   ✓   |     ✓    |    ✓    |
| afcProtocolName |           |   ✓   |     ✓    |    ✓    |
| flowDirection   |           |   ✓   |     ✓    |    ✓    |

### Barracuda Networks, was phion (PEN: 10704)

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| AuditCounter      |           |   ✓   |     ✓    |    ✓    |
| BindIPv4Address   |           |   ✓   |     ✓    |    ✓    |
| BindTransportPort |           |   ✓   |     ✓    |    ✓    |
| ConnIPv4Address   |           |   ✓   |     ✓    |    ✓    |
| ConnTransportPort |           |   ✓   |     ✓    |    ✓    |
| FW\_Rule          |           |   ✓   |     ✓    |    ✓    |
| LogOp             |           |   ✓   |     ✓    |    ✓    |
| Reason            |           |   ✓   |     ✓    |    ✓    |
| ReasonText        |           |   ✓   |     ✓    |    ✓    |
| ServiceName       |           |   ✓   |     ✓    |    ✓    |
| Timestamp         |           |   ✓   |     ✓    |    ✓    |
| TrafficType       |           |   ✓   |     ✓    |    ✓    |

### F5 Networks (PEN: 12276)

| Name                                 | Community | Basic | Standard | Premium |
| ------------------------------------ | :-------: | :---: | :------: | :-----: |
| 3gppParameters                       |           |   ✓   |     ✓    |    ✓    |
| aclPolicyName                        |           |   ✓   |     ✓    |    ✓    |
| aclPolicyType                        |           |   ✓   |     ✓    |    ✓    |
| aclRuleName                          |           |   ✓   |     ✓    |    ✓    |
| action                               |           |   ✓   |     ✓    |    ✓    |
| applicationCategoryId                |           |   ✓   |     ✓    |    ✓    |
| attackEvent (dosAttackEvent)         |           |   ✓   |     ✓    |    ✓    |
| attackId (dosAttackId)               |           |   ✓   |     ✓    |    ✓    |
| attackName (dosAttackName)           |           |   ✓   |     ✓    |    ✓    |
| attackType                           |           |   ✓   |     ✓    |    ✓    |
| bigipHostName                        |           |   ✓   |     ✓    |    ✓    |
| bigipMgmtIPv4Address                 |           |   ✓   |     ✓    |    ✓    |
| bigipMgmtIPv6Address                 |           |   ✓   |     ✓    |    ✓    |
| classification                       |           |   ✓   |     ✓    |    ✓    |
| concurrentFlows                      |           |   ✓   |     ✓    |    ✓    |
| contextName                          |           |   ✓   |     ✓    |    ✓    |
| contextType                          |           |   ✓   |     ✓    |    ✓    |
| destinationFqdn                      |           |   ✓   |     ✓    |    ✓    |
| destinationGeo                       |           |   ✓   |     ✓    |    ✓    |
| deviceProduct                        |           |   ✓   |     ✓    |    ✓    |
| deviceVendor                         |           |   ✓   |     ✓    |    ✓    |
| deviceVersion                        |           |   ✓   |     ✓    |    ✓    |
| dnsQueryType                         |           |   ✓   |     ✓    |    ✓    |
| downlinkVolume                       |           |   ✓   |     ✓    |    ✓    |
| dropReason                           |           |   ✓   |     ✓    |    ✓    |
| durationSec                          |           |   ✓   |     ✓    |    ✓    |
| errdefsMsgNo                         |           |   ✓   |     ✓    |    ✓    |
| flowId                               |           |   ✓   |     ✓    |    ✓    |
| flowStartMilliSeconds                |           |   ✓   |     ✓    |    ✓    |
| flowStartSeconds                     |           |   ✓   |     ✓    |    ✓    |
| flowStopMilliSeconds                 |           |   ✓   |     ✓    |    ✓    |
| flowStopSeconds                      |           |   ✓   |     ✓    |    ✓    |
| httpHostname                         |           |   ✓   |     ✓    |    ✓    |
| httpHostnameTruncated                |           |   ✓   |     ✓    |    ✓    |
| httpResponseCode                     |           |   ✓   |     ✓    |    ✓    |
| httpUrl                              |           |   ✓   |     ✓    |    ✓    |
| httpUrlTruncated                     |           |   ✓   |     ✓    |    ✓    |
| httpUserAgent                        |           |   ✓   |     ✓    |    ✓    |
| httpUserAgentTruncated               |           |   ✓   |     ✓    |    ✓    |
| ipfixMsgNo                           |           |   ✓   |     ✓    |    ✓    |
| ipintelligencePolicyName             |           |   ✓   |     ✓    |    ✓    |
| ipintelligenceThreatName             |           |   ✓   |     ✓    |    ✓    |
| lastRecordSent                       |           |   ✓   |     ✓    |    ✓    |
| logMsgDrops                          |           |   ✓   |     ✓    |    ✓    |
| logMsgName                           |           |   ✓   |     ✓    |    ✓    |
| logprofileName                       |           |   ✓   |     ✓    |    ✓    |
| messageSeverity                      |           |   ✓   |     ✓    |    ✓    |
| msgName                              |           |   ✓   |     ✓    |    ✓    |
| newFlows                             |           |   ✓   |     ✓    |    ✓    |
| observationTimeSeconds               |           |   ✓   |     ✓    |    ✓    |
| packetsDropped (dosPacketsDropped)   |           |   ✓   |     ✓    |    ✓    |
| packetsReceived (dosPacketsReceived) |           |   ✓   |     ✓    |    ✓    |
| partitionName                        |           |   ✓   |     ✓    |    ✓    |
| queryName                            |           |   ✓   |     ✓    |    ✓    |
| recordReason                         |           |   ✓   |     ✓    |    ✓    |
| recordType                           |           |   ✓   |     ✓    |    ✓    |
| reportId                             |           |   ✓   |     ✓    |    ✓    |
| reportVersion                        |           |   ✓   |     ✓    |    ✓    |
| saTransPool                          |           |   ✓   |     ✓    |    ✓    |
| saTransType                          |           |   ✓   |     ✓    |    ✓    |
| sipCallee                            |           |   ✓   |     ✓    |    ✓    |
| sipCaller                            |           |   ✓   |     ✓    |    ✓    |
| sipMethodName                        |           |   ✓   |     ✓    |    ✓    |
| skippedTransactions                  |           |   ✓   |     ✓    |    ✓    |
| sourceFqdn                           |           |   ✓   |     ✓    |    ✓    |
| sourceGeo                            |           |   ✓   |     ✓    |    ✓    |
| sourceUser                           |           |   ✓   |     ✓    |    ✓    |
| subscriberId                         |           |   ✓   |     ✓    |    ✓    |
| subscriberIdType                     |           |   ✓   |     ✓    |    ✓    |
| successfulTransactions               |           |   ✓   |     ✓    |    ✓    |
| terminatedFlows                      |           |   ✓   |     ✓    |    ✓    |
| timestampMsec                        |           |   ✓   |     ✓    |    ✓    |
| totalTransactions                    |           |   ✓   |     ✓    |    ✓    |
| transactionNumber                    |           |   ✓   |     ✓    |    ✓    |
| transactionStartMilliSeconds         |           |   ✓   |     ✓    |    ✓    |
| transactionStartSeconds              |           |   ✓   |     ✓    |    ✓    |
| transactionStopMilliSeconds          |           |   ✓   |     ✓    |    ✓    |
| transactionStopSeconds               |           |   ✓   |     ✓    |    ✓    |
| transDestinationIPv4Address          |           |   ✓   |     ✓    |    ✓    |
| transDestinationIPv6Address          |           |   ✓   |     ✓    |    ✓    |
| transDestinationPort                 |           |   ✓   |     ✓    |    ✓    |
| transIpProtocol                      |           |   ✓   |     ✓    |    ✓    |
| transRouteDomain                     |           |   ✓   |     ✓    |    ✓    |
| transSourceIPv4Address               |           |   ✓   |     ✓    |    ✓    |
| transSourceIPv6Address               |           |   ✓   |     ✓    |    ✓    |
| transSourcePort                      |           |   ✓   |     ✓    |    ✓    |
| transVlanName                        |           |   ✓   |     ✓    |    ✓    |
| uplinkVolume                         |           |   ✓   |     ✓    |    ✓    |
| urlCategoryId                        |           |   ✓   |     ✓    |    ✓    |
| vlanId                               |           |   ✓   |     ✓    |    ✓    |
| vlanName                             |           |   ✓   |     ✓    |    ✓    |

### Fraunhofer FOKUS (PEN: 12325)

| Name                          | Community | Basic | Standard | Premium |
| ----------------------------- | :-------: | :---: | :------: | :-----: |
| APN                           |           |   ✓   |     ✓    |    ✓    |
| APNDownload                   |           |   ✓   |     ✓    |    ✓    |
| APNUpload                     |           |   ✓   |     ✓    |    ✓    |
| Bandwidth\_of\_CAP            |           |   ✓   |     ✓    |    ✓    |
| Battery\_lifetime\_h          |           |   ✓   |     ✓    |    ✓    |
| Battery\_lifetime\_min        |           |   ✓   |     ✓    |    ✓    |
| Battery\_status               |           |   ✓   |     ✓    |    ✓    |
| bottleneck                    |           |   ✓   |     ✓    |    ✓    |
| Cell\_id\_number              |           |   ✓   |     ✓    |    ✓    |
| Center\_frequency             |           |   ✓   |     ✓    |    ✓    |
| channel\_status               |           |   ✓   |     ✓    |    ✓    |
| cryptoInitVector              |           |   ✓   |     ✓    |    ✓    |
| decryptionKey                 |           |   ✓   |     ✓    |    ✓    |
| destinationIPv4FanIn          |           |   ✓   |     ✓    |    ✓    |
| encryptedData128              |           |   ✓   |     ✓    |    ✓    |
| encryptedData256              |           |   ✓   |     ✓    |    ✓    |
| endTime                       |           |   ✓   |     ✓    |    ✓    |
| flowCreationTimeUsec          |           |   ✓   |     ✓    |    ✓    |
| flowEndTimeUsec               |           |   ✓   |     ✓    |    ✓    |
| freq                          |           |   ✓   |     ✓    |    ✓    |
| geoLatitude                   |           |   ✓   |     ✓    |    ✓    |
| geoLongitude                  |           |   ✓   |     ✓    |    ✓    |
| GuaranteedDownload            |           |   ✓   |     ✓    |    ✓    |
| GuaranteedUpload              |           |   ✓   |     ✓    |    ✓    |
| ident                         |           |   ✓   |     ✓    |    ✓    |
| IMSI                          |           |   ✓   |     ✓    |    ✓    |
| Infrastructure\_network\_id   |           |   ✓   |     ✓    |    ✓    |
| Infrastructure\_network\_type |           |   ✓   |     ✓    |    ✓    |
| interfaceDescripton           |           |   ✓   |     ✓    |    ✓    |
| interfaceName                 |           |   ✓   |     ✓    |    ✓    |
| keyShare128                   |           |   ✓   |     ✓    |    ✓    |
| keyShare256                   |           |   ✓   |     ✓    |    ✓    |
| keyShareAdp                   |           |   ✓   |     ✓    |    ✓    |
| lostPackets                   |           |   ✓   |     ✓    |    ✓    |
| MaxDownload                   |           |   ✓   |     ✓    |    ✓    |
| MaxUpload                     |           |   ✓   |     ✓    |    ✓    |
| msg                           |           |   ✓   |     ✓    |    ✓    |
| msgId                         |           |   ✓   |     ✓    |    ✓    |
| msgValue                      |           |   ✓   |     ✓    |    ✓    |
| OR\_terminal\_id              |           |   ✓   |     ✓    |    ✓    |
| OR\_terminal\_id\_list        |           |   ✓   |     ✓    |    ✓    |
| ORgeopositionElev             |           |   ✓   |     ✓    |    ✓    |
| ORgeopositionLat              |           |   ✓   |     ✓    |    ✓    |
| ORgeopositionLon              |           |   ✓   |     ✓    |    ✓    |
| ORmodulation                  |           |   ✓   |     ✓    |    ✓    |
| ORmodulationOrder             |           |   ✓   |     ✓    |    ✓    |
| ORmodulationType              |           |   ✓   |     ✓    |    ✓    |
| ORpolicyRecord                |           |   ✓   |     ✓    |    ✓    |
| ORprofileRecord               |           |   ✓   |     ✓    |    ✓    |
| ORrolloffFactor               |           |   ✓   |     ✓    |    ✓    |
| ORsignalBandwidth             |           |   ✓   |     ✓    |    ✓    |
| ORsignalPower                 |           |   ✓   |     ✓    |    ✓    |
| ORsymbolRate                  |           |   ✓   |     ✓    |    ✓    |
| owd\_usec                     |           |   ✓   |     ✓    |    ✓    |
| owdmax\_usec                  |           |   ✓   |     ✓    |    ✓    |
| owdmean\_usec                 |           |   ✓   |     ✓    |    ✓    |
| owdmin\_usec                  |           |   ✓   |     ✓    |    ✓    |
| owdsd\_usec                   |           |   ✓   |     ✓    |    ✓    |
| owdvar\_usec                  |           |   ✓   |     ✓    |    ✓    |
| owdvarmax\_nsec               |           |   ✓   |     ✓    |    ✓    |
| owdvarmax\_usec               |           |   ✓   |     ✓    |    ✓    |
| owdvarmean\_nsec              |           |   ✓   |     ✓    |    ✓    |
| owdvarmean\_usec              |           |   ✓   |     ✓    |    ✓    |
| owdvarmin\_nsec               |           |   ✓   |     ✓    |    ✓    |
| owdvarmin\_usec               |           |   ✓   |     ✓    |    ✓    |
| packetArrivalMean             |           |   ✓   |     ✓    |    ✓    |
| packetArrivalVar              |           |   ✓   |     ✓    |    ✓    |
| pcapDrop                      |           |   ✓   |     ✓    |    ✓    |
| pcapRecv                      |           |   ✓   |     ✓    |    ✓    |
| pktId                         |           |   ✓   |     ✓    |    ✓    |
| pktLength                     |           |   ✓   |     ✓    |    ✓    |
| probeLocationName             |           |   ✓   |     ✓    |    ✓    |
| probeName                     |           |   ✓   |     ✓    |    ✓    |
| procCpuSys                    |           |   ✓   |     ✓    |    ✓    |
| procCpuUser                   |           |   ✓   |     ✓    |    ✓    |
| procMemRss                    |           |   ✓   |     ✓    |    ✓    |
| procMemVzs                    |           |   ✓   |     ✓    |    ✓    |
| QCI                           |           |   ✓   |     ✓    |    ✓    |
| queueFillLevel                |           |   ✓   |     ✓    |    ✓    |
| revOctetDeltaCount            |           |   ✓   |     ✓    |    ✓    |
| revPacketDeltaCount           |           |   ✓   |     ✓    |    ✓    |
| rtt\_usec                     |           |   ✓   |     ✓    |    ✓    |
| rttmax\_usec                  |           |   ✓   |     ✓    |    ✓    |
| rttmean\_usec                 |           |   ✓   |     ✓    |    ✓    |
| rttmin\_usec                  |           |   ✓   |     ✓    |    ✓    |
| RuleFlag                      |           |   ✓   |     ✓    |    ✓    |
| RuleID                        |           |   ✓   |     ✓    |    ✓    |
| RuleName                      |           |   ✓   |     ✓    |    ✓    |
| sensing\_threshold            |           |   ✓   |     ✓    |    ✓    |
| sensing\_value                |           |   ✓   |     ✓    |    ✓    |
| sessionId                     |           |   ✓   |     ✓    |    ✓    |
| sourceIPv4FanOut              |           |   ✓   |     ✓    |    ✓    |
| Spectral\_allocation\_profile |           |   ✓   |     ✓    |    ✓    |
| Spectral\_allocation\_vector  |           |   ✓   |     ✓    |    ✓    |
| startTime                     |           |   ✓   |     ✓    |    ✓    |
| sysCpuIdle                    |           |   ✓   |     ✓    |    ✓    |
| sysMemFree                    |           |   ✓   |     ✓    |    ✓    |
| sysMemTotal                   |           |   ✓   |     ✓    |    ✓    |
| taskId                        |           |   ✓   |     ✓    |    ✓    |
| tc\_qlen                      |           |   ✓   |     ✓    |    ✓    |
| tcbacklog                     |           |   ✓   |     ✓    |    ✓    |
| tcBytes                       |           |   ✓   |     ✓    |    ✓    |
| tcDrops                       |           |   ✓   |     ✓    |    ✓    |
| tcOverlimits                  |           |   ✓   |     ✓    |    ✓    |
| tcPackets                     |           |   ✓   |     ✓    |    ✓    |
| tcRate\_bps                   |           |   ✓   |     ✓    |    ✓    |
| tcRequeues                    |           |   ✓   |     ✓    |    ✓    |
| tcRrate\_pps                  |           |   ✓   |     ✓    |    ✓    |
| transactionId                 |           |   ✓   |     ✓    |    ✓    |
| tstamp\_nsec                  |           |   ✓   |     ✓    |    ✓    |
| tstamp\_sec                   |           |   ✓   |     ✓    |    ✓    |

### INRIA (PEN: 12559)

| Name                      | Community | Basic | Standard | Premium |
| ------------------------- | :-------: | :---: | :------: | :-----: |
| civicLocationType         |           |   ✓   |     ✓    |    ✓    |
| civicLocationValue        |           |   ✓   |     ✓    |    ✓    |
| deviceId                  |           |   ✓   |     ✓    |    ✓    |
| geospatialLocationAlt     |           |   ✓   |     ✓    |    ✓    |
| geospatialLocationCRSCode |           |   ✓   |     ✓    |    ✓    |
| geospatialLocationLat     |           |   ✓   |     ✓    |    ✓    |
| geospatialLocationLng     |           |   ✓   |     ✓    |    ✓    |
| geospatialLocationRadius  |           |   ✓   |     ✓    |    ✓    |
| locationMethod            |           |   ✓   |     ✓    |    ✓    |
| locationTime              |           |   ✓   |     ✓    |    ✓    |

### Plixer (PEN: 13745)

| Name                        | Community | Basic | Standard | Premium |
| --------------------------- | :-------: | :---: | :------: | :-----: |
| client\_hostname            |           |   ✓   |     ✓    |    ✓    |
| client\_ip                  |           |   ✓   |     ✓    |    ✓    |
| client\_ip                  |           |   ✓   |     ✓    |    ✓    |
| connector\_id               |           |   ✓   |     ✓    |    ✓    |
| custom\_data                |           |   ✓   |     ✓    |    ✓    |
| date\_time                  |           |   ✓   |     ✓    |    ✓    |
| directionality              |           |   ✓   |     ✓    |    ✓    |
| encryption                  |           |   ✓   |     ✓    |    ✓    |
| event\_id                   |           |   ✓   |     ✓    |    ✓    |
| internal\_message\_id       |           |   ✓   |     ✓    |    ✓    |
| linked\_msgid               |           |   ✓   |     ✓    |    ✓    |
| message\_info               |           |   ✓   |     ✓    |    ✓    |
| message\_subject            |           |   ✓   |     ✓    |    ✓    |
| msgid                       |           |   ✓   |     ✓    |    ✓    |
| number\_recipients          |           |   ✓   |     ✓    |    ✓    |
| original\_client\_ip        |           |   ✓   |     ✓    |    ✓    |
| original\_server\_ip        |           |   ✓   |     ✓    |    ✓    |
| origination\_time           |           |   ✓   |     ✓    |    ✓    |
| partner\_name               |           |   ✓   |     ✓    |    ✓    |
| priority                    |           |   ✓   |     ✓    |    ✓    |
| recipient\_address          |           |   ✓   |     ✓    |    ✓    |
| recipient\_report\_status   |           |   ✓   |     ✓    |    ✓    |
| reference                   |           |   ✓   |     ✓    |    ✓    |
| related\_recipient\_address |           |   ✓   |     ✓    |    ✓    |
| return\_path                |           |   ✓   |     ✓    |    ✓    |
| sender\_address             |           |   ✓   |     ✓    |    ✓    |
| server\_hostname            |           |   ✓   |     ✓    |    ✓    |
| server\_ip                  |           |   ✓   |     ✓    |    ✓    |
| server\_ip                  |           |   ✓   |     ✓    |    ✓    |
| service\_version            |           |   ✓   |     ✓    |    ✓    |
| source\_component           |           |   ✓   |     ✓    |    ✓    |
| source\_context             |           |   ✓   |     ✓    |    ✓    |
| tenant\_id                  |           |   ✓   |     ✓    |    ✓    |

### Sandvine, was Procera Networks/Netintact (PEN: 15397)

| Name                                | Community | Basic | Standard | Premium |
| ----------------------------------- | :-------: | :---: | :------: | :-----: |
| sandvineApn                         |           |   ✓   |     ✓    |    ✓    |
| sandvineBaseService                 |           |   ✓   |     ✓    |    ✓    |
| sandvineContentCategories           |           |   ✓   |     ✓    |    ✓    |
| sandvineDeviceId                    |           |   ✓   |     ✓    |    ✓    |
| sandvineExternalJitter              |           |   ✓   |     ✓    |    ✓    |
| sandvineExternalRtt                 |           |   ✓   |     ✓    |    ✓    |
| sandvineFlowBehavior                |           |   ✓   |     ✓    |    ✓    |
| sandvineGgsn                        |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpContentType             |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpFileLength              |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpLanguage                |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpLocation                |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpReferer                 |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpRequestMethod           |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpRequestVersion          |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpResponseStatus          |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpUrl                     |           |   ✓   |     ✓    |    ✓    |
| sandvineHttpUserAgent               |           |   ✓   |     ✓    |    ✓    |
| sandvineImsi                        |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qPriorityLevel1 |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qPriorityLevel2 |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qPriorityLevel3 |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qPriorityLevel4 |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qVlanIdLevel1   |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qVlanIdLevel2   |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qVlanIdLevel3   |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDot1qVlanIdLevel4   |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingDscp                |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingOctets              |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingPackets             |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingShapingDrops        |           |   ✓   |     ✓    |    ✓    |
| sandvineIncomingShapingLatency      |           |   ✓   |     ✓    |    ✓    |
| sandvineInternalJitter              |           |   ✓   |     ✓    |    ✓    |
| sandvineInternalRtt                 |           |   ✓   |     ✓    |    ✓    |
| sandvineLocalIPv4Host               |           |   ✓   |     ✓    |    ✓    |
| sandvineLocalIPv6Host               |           |   ✓   |     ✓    |    ✓    |
| sandvineMsisdn                      |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qPriorityLevel1 |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qPriorityLevel2 |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qPriorityLevel3 |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qPriorityLevel4 |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qVlanIdLevel1   |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qVlanIdLevel2   |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qVlanIdLevel3   |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDot1qVlanIdLevel4   |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingDscp                |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingOctets              |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingPackets             |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingShapingDrops        |           |   ✓   |     ✓    |    ✓    |
| sandvineOutgoingShapingLatency      |           |   ✓   |     ✓    |    ✓    |
| sandvineProperty                    |           |   ✓   |     ✓    |    ✓    |
| sandvineQoeIncomingExternal         |           |   ✓   |     ✓    |    ✓    |
| sandvineQoeIncomingInternal         |           |   ✓   |     ✓    |    ✓    |
| sandvineQoeOutgoingExternal         |           |   ✓   |     ✓    |    ✓    |
| sandvineQoeOutgoingInternal         |           |   ✓   |     ✓    |    ✓    |
| sandvineRat                         |           |   ✓   |     ✓    |    ✓    |
| sandvineRemoteGeoip                 |           |   ✓   |     ✓    |    ✓    |
| sandvineRemoteIPv4Host              |           |   ✓   |     ✓    |    ✓    |
| sandvineRemoteIPv6Host              |           |   ✓   |     ✓    |    ✓    |
| sandvineRnc                         |           |   ✓   |     ✓    |    ✓    |
| sandvineServerHostname              |           |   ✓   |     ✓    |    ✓    |
| sandvineService                     |           |   ✓   |     ✓    |    ✓    |
| sandvineServiceObject               |           |   ✓   |     ✓    |    ✓    |
| sandvineSgsn                        |           |   ✓   |     ✓    |    ✓    |
| sandvineSubscriberId                |           |   ✓   |     ✓    |    ✓    |
| sandvineTemplateName                |           |   ✓   |     ✓    |    ✓    |
| sandvineUserLocationInformation     |           |   ✓   |     ✓    |    ✓    |

### Masaryk University (PEN: 16982)

| Name                      | Community | Basic | Standard | Premium |
| ------------------------- | :-------: | :---: | :------: | :-----: |
| appMatchLevel             |           |   ✓   |     ✓    |    ✓    |
| appName                   |           |   ✓   |     ✓    |    ✓    |
| appPID                    |           |   ✓   |     ✓    |    ✓    |
| appUID                    |           |   ✓   |     ✓    |    ✓    |
| DELAY\_AVG\_US            |           |   ✓   |     ✓    |    ✓    |
| DELAY\_DEV\_US            |           |   ✓   |     ✓    |    ✓    |
| DELAY\_MAX\_US            |           |   ✓   |     ✓    |    ✓    |
| DELAY\_MIN\_US            |           |   ✓   |     ✓    |    ✓    |
| destinationGeo            |           |   ✓   |     ✓    |    ✓    |
| HTTPContentType           |           |   ✓   |     ✓    |    ✓    |
| HTTPDomain                |           |   ✓   |     ✓    |    ✓    |
| HTTPHeaderCount           |           |   ✓   |     ✓    |    ✓    |
| HTTPMethod                |           |   ✓   |     ✓    |    ✓    |
| HTTPReferer               |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestAgent          |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestAgentID        |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestHost           |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestReferer        |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestType           |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestURL            |           |   ✓   |     ✓    |    ✓    |
| HTTPResponseCode          |           |   ✓   |     ✓    |    ✓    |
| HTTPResponseTime          |           |   ✓   |     ✓    |    ✓    |
| HTTPResponseType          |           |   ✓   |     ✓    |    ✓    |
| HTTPStatus                |           |   ✓   |     ✓    |    ✓    |
| HTTPUrl                   |           |   ✓   |     ✓    |    ✓    |
| HTTPUserAgent             |           |   ✓   |     ✓    |    ✓    |
| JITTER\_AVG\_US           |           |   ✓   |     ✓    |    ✓    |
| JITTER\_DEV\_US           |           |   ✓   |     ✓    |    ✓    |
| JITTER\_MAX\_US           |           |   ✓   |     ✓    |    ✓    |
| JITTER\_MIN\_US           |           |   ✓   |     ✓    |    ✓    |
| sourceGeo                 |           |   ✓   |     ✓    |    ✓    |
| SYN\_SIZE                 |           |   ✓   |     ✓    |    ✓    |
| TCP\_CRT\_US              |           |   ✓   |     ✓    |    ✓    |
| TCP\_RTT\_US              |           |   ✓   |     ✓    |    ✓    |
| TCP\_SRT\_US              |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_SIZE            |           |   ✓   |     ✓    |    ✓    |
| tlsCerNotAfter            |           |   ✓   |     ✓    |    ✓    |
| tlsCertIssuer             |           |   ✓   |     ✓    |    ✓    |
| tlsCertNotBefore          |           |   ✓   |     ✓    |    ✓    |
| tlsCertSubject            |           |   ✓   |     ✓    |    ✓    |
| tlsCliCips                |           |   ✓   |     ✓    |    ✓    |
| tlsCliVer                 |           |   ✓   |     ✓    |    ✓    |
| tlsPkeyAlgorithm          |           |   ✓   |     ✓    |    ✓    |
| tlsPkeyExponent           |           |   ✓   |     ✓    |    ✓    |
| tlsPkeyLength             |           |   ✓   |     ✓    |    ✓    |
| tlsSerCips                |           |   ✓   |     ✓    |    ✓    |
| tlsSerVer                 |           |   ✓   |     ✓    |    ✓    |
| tlsServerName             |           |   ✓   |     ✓    |    ✓    |
| tunnelDestinationGeo      |           |   ✓   |     ✓    |    ✓    |
| tunnelDstIPv6             |           |   ✓   |     ✓    |    ✓    |
| tunnelDstPort             |           |   ✓   |     ✓    |    ✓    |
| tunnelHOPLimit            |           |   ✓   |     ✓    |    ✓    |
| tunnelICMPcode            |           |   ✓   |     ✓    |    ✓    |
| tunnelOuterDestinationGeo |           |   ✓   |     ✓    |    ✓    |
| tunnelOuterSourceGeo      |           |   ✓   |     ✓    |    ✓    |
| tunnelProtocol            |           |   ✓   |     ✓    |    ✓    |
| tunnelSourceGeo           |           |   ✓   |     ✓    |    ✓    |
| tunnelSrcIPv6             |           |   ✓   |     ✓    |    ✓    |
| tunnelSrcPort             |           |   ✓   |     ✓    |    ✓    |
| tunnelTCPFlags            |           |   ✓   |     ✓    |    ✓    |
| tunnelTeredoHeaders       |           |   ✓   |     ✓    |    ✓    |
| tunnelTeredoTrailers      |           |   ✓   |     ✓    |    ✓    |
| tunnelType                |           |   ✓   |     ✓    |    ✓    |

### netfilter/iptables project (PEN: 21373)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| conntrack\_id |           |   ✓   |     ✓    |    ✓    |
| mark          |           |   ✓   |     ✓    |    ✓    |

### Palo Alto Networks (PEN: 25461)

| Name    | Community | Basic | Standard | Premium |
| ------- | :-------: | :---: | :------: | :-----: |
| App-ID  |           |   ✓   |     ✓    |    ✓    |
| User-ID |           |   ✓   |     ✓    |    ✓    |

### Gigamon Systems (PEN: 26866)

| Name                         | Community | Basic | Standard | Premium |
| ---------------------------- | :-------: | :---: | :------: | :-----: |
| CERT\_Issuer                 |           |   ✓   |     ✓    |    ✓    |
| CERT\_IssuerCname            |           |   ✓   |     ✓    |    ✓    |
| CERT\_SerialNo               |           |   ✓   |     ✓    |    ✓    |
| CERT\_SignatureAlgo          |           |   ✓   |     ✓    |    ✓    |
| CERT\_SignatureAlgoTxt       |           |   ✓   |     ✓    |    ✓    |
| CERT\_Subject                |           |   ✓   |     ✓    |    ✓    |
| CERT\_SubjectAlgo            |           |   ✓   |     ✓    |    ✓    |
| CERT\_SubjectAlgoTxt         |           |   ✓   |     ✓    |    ✓    |
| CERT\_SubjectAltName         |           |   ✓   |     ✓    |    ✓    |
| CERT\_SubjectCname           |           |   ✓   |     ✓    |    ✓    |
| CERT\_SubjectKeySize         |           |   ✓   |     ✓    |    ✓    |
| CERT\_ValidFrom              |           |   ✓   |     ✓    |    ✓    |
| CERT\_ValidTo                |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddClass                |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddClassTxt             |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddName                 |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddRdata                |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddRdlen                |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddTTL                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddType                 |           |   ✓   |     ✓    |    ✓    |
| DNS\_AddTypeTxt              |           |   ✓   |     ✓    |    ✓    |
| DNS\_AnCt                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_ArCt                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthClass               |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthClassTxt            |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthName                |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthRdata               |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthRdlen               |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthTTL                 |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthType                |           |   ✓   |     ✓    |    ✓    |
| DNS\_AuthTypeTxt             |           |   ✓   |     ✓    |    ✓    |
| DNS\_Bits                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_ID                      |           |   ✓   |     ✓    |    ✓    |
| DNS\_NsCt                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_OPCODE                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_QdCt                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_QueryClass              |           |   ✓   |     ✓    |    ✓    |
| DNS\_QueryClassTxt           |           |   ✓   |     ✓    |    ✓    |
| DNS\_QueryName               |           |   ✓   |     ✓    |    ✓    |
| DNS\_QueryType               |           |   ✓   |     ✓    |    ✓    |
| DNS\_QueryTypeTxt            |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespClass               |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespClassTxt            |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespCode                |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespIPv4                |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespIPv6                |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespName                |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespRdata               |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespRdlen               |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespTTL                 |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespType                |           |   ✓   |     ✓    |    ✓    |
| DNS\_RespTypeTxt             |           |   ✓   |     ✓    |    ✓    |
| DnsResponseIpv4AddrText      |           |   ✓   |     ✓    |    ✓    |
| HTTP\_Host                   |           |   ✓   |     ✓    |    ✓    |
| HTTP\_ReqMethod              |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RespCode               |           |   ✓   |     ✓    |    ✓    |
| HTTP\_URL                    |           |   ✓   |     ✓    |    ✓    |
| HTTP\_UserAgent              |           |   ✓   |     ✓    |    ✓    |
| HTTP\_Version                |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_CALLED\_STATION\_ID  |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_CALLING\_STATION\_ID |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_LOGIN                |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_NAT\_ADDRESS         |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_PORT\_END            |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_PORT\_START          |           |   ✓   |     ✓    |    ✓    |
| SERVER\_Cipher               |           |   ✓   |     ✓    |    ✓    |
| SERVER\_CipherTxt            |           |   ✓   |     ✓    |    ✓    |
| SERVER\_CompressionMethod    |           |   ✓   |     ✓    |    ✓    |
| SERVER\_SessionId            |           |   ✓   |     ✓    |    ✓    |
| SERVER\_SNI                  |           |   ✓   |     ✓    |    ✓    |
| SERVER\_Version              |           |   ✓   |     ✓    |    ✓    |
| SERVER\_VersionTxt           |           |   ✓   |     ✓    |    ✓    |

### IPFIX Reverse Information Element Private Enterprise (PEN: 29305)

| Name                                   | Community | Basic | Standard | Premium |
| -------------------------------------- | :-------: | :---: | :------: | :-----: |
| absoluteError                          |           |   ✓   |     ✓    |    ✓    |
| addressPoolHighThreshold               |           |   ✓   |     ✓    |    ✓    |
| addressPoolLowThreshold                |           |   ✓   |     ✓    |    ✓    |
| addressPortMappingHighThreshold        |           |   ✓   |     ✓    |    ✓    |
| addressPortMappingLowThreshold         |           |   ✓   |     ✓    |    ✓    |
| addressPortMappingPerUserHighThreshold |           |   ✓   |     ✓    |    ✓    |
| anonymizationFlags                     |           |   ✓   |     ✓    |    ✓    |
| anonymizationTechnique                 |           |   ✓   |     ✓    |    ✓    |
| applicationCategoryName                |           |   ✓   |     ✓    |    ✓    |
| applicationDescription                 |           |   ✓   |     ✓    |    ✓    |
| applicationGroupName                   |           |   ✓   |     ✓    |    ✓    |
| applicationId                          |           |   ✓   |     ✓    |    ✓    |
| applicationName                        |           |   ✓   |     ✓    |    ✓    |
| applicationSubCategoryName             |           |   ✓   |     ✓    |    ✓    |
| basicList                              |           |   ✓   |     ✓    |    ✓    |
| bgpCommunity                           |           |   ✓   |     ✓    |    ✓    |
| bgpDestinationAsNumber                 |           |   ✓   |     ✓    |    ✓    |
| bgpExtendedCommunity                   |           |   ✓   |     ✓    |    ✓    |
| bgpLargeCommunity                      |           |   ✓   |     ✓    |    ✓    |
| bgpNextAdjacentAsNumber                |           |   ✓   |     ✓    |    ✓    |
| bgpNextHopIPv4Address                  |           |   ✓   |     ✓    |    ✓    |
| bgpNextHopIPv6Address                  |           |   ✓   |     ✓    |    ✓    |
| bgpPrevAdjacentAsNumber                |           |   ✓   |     ✓    |    ✓    |
| bgpSourceAsNumber                      |           |   ✓   |     ✓    |    ✓    |
| bgpValidityState                       |           |   ✓   |     ✓    |    ✓    |
| classId                                |           |   ✓   |     ✓    |    ✓    |
| classificationEngineId                 |           |   ✓   |     ✓    |    ✓    |
| className                              |           |   ✓   |     ✓    |    ✓    |
| collectionTimeMilliseconds             |           |   ✓   |     ✓    |    ✓    |
| collectorCertificate                   |           |   ✓   |     ✓    |    ✓    |
| confidenceLevel                        |           |   ✓   |     ✓    |    ✓    |
| connectionSumDurationSeconds           |           |   ✓   |     ✓    |    ✓    |
| connectionTransactionId                |           |   ✓   |     ✓    |    ✓    |
| dataLinkFrameSection                   |           |   ✓   |     ✓    |    ✓    |
| dataLinkFrameSize                      |           |   ✓   |     ✓    |    ✓    |
| dataLinkFrameType                      |           |   ✓   |     ✓    |    ✓    |
| dataRecordsReliability                 |           |   ✓   |     ✓    |    ✓    |
| deltaFlowCount                         |           |   ✓   |     ✓    |    ✓    |
| destinationIPv4Address                 |           |   ✓   |     ✓    |    ✓    |
| destinationIPv4Prefix                  |           |   ✓   |     ✓    |    ✓    |
| destinationIPv4PrefixLength            |           |   ✓   |     ✓    |    ✓    |
| destinationIPv6Address                 |           |   ✓   |     ✓    |    ✓    |
| destinationIPv6Prefix                  |           |   ✓   |     ✓    |    ✓    |
| destinationIPv6PrefixLength            |           |   ✓   |     ✓    |    ✓    |
| destinationMacAddress                  |           |   ✓   |     ✓    |    ✓    |
| destinationTransportPort               |           |   ✓   |     ✓    |    ✓    |
| digestHashValue                        |           |   ✓   |     ✓    |    ✓    |
| distinctCountOfDestinationIPAddress    |           |   ✓   |     ✓    |    ✓    |
| distinctCountOfDestinationIPv4Address  |           |   ✓   |     ✓    |    ✓    |
| distinctCountOfDestinationIPv6Address  |           |   ✓   |     ✓    |    ✓    |
| distinctCountOfSourceIPAddress         |           |   ✓   |     ✓    |    ✓    |
| distinctCountOfSourceIPv4Address       |           |   ✓   |     ✓    |    ✓    |
| distinctCountOfSourceIPv6Address       |           |   ✓   |     ✓    |    ✓    |
| dot1qCustomerDEI                       |           |   ✓   |     ✓    |    ✓    |
| dot1qCustomerDestinationMacAddress     |           |   ✓   |     ✓    |    ✓    |
| dot1qCustomerPriority                  |           |   ✓   |     ✓    |    ✓    |
| dot1qCustomerSourceMacAddress          |           |   ✓   |     ✓    |    ✓    |
| dot1qCustomerVlanId                    |           |   ✓   |     ✓    |    ✓    |
| dot1qDEI                               |           |   ✓   |     ✓    |    ✓    |
| dot1qPriority                          |           |   ✓   |     ✓    |    ✓    |
| dot1qServiceInstanceId                 |           |   ✓   |     ✓    |    ✓    |
| dot1qServiceInstancePriority           |           |   ✓   |     ✓    |    ✓    |
| dot1qServiceInstanceTag                |           |   ✓   |     ✓    |    ✓    |
| dot1qVlanId                            |           |   ✓   |     ✓    |    ✓    |
| droppedLayer2OctetDeltaCount           |           |   ✓   |     ✓    |    ✓    |
| droppedLayer2OctetTotalCount           |           |   ✓   |     ✓    |    ✓    |
| droppedOctetDeltaCount                 |           |   ✓   |     ✓    |    ✓    |
| droppedOctetTotalCount                 |           |   ✓   |     ✓    |    ✓    |
| droppedPacketDeltaCount                |           |   ✓   |     ✓    |    ✓    |
| droppedPacketTotalCount                |           |   ✓   |     ✓    |    ✓    |
| dstTrafficIndex                        |           |   ✓   |     ✓    |    ✓    |
| egressBroadcastPacketTotalCount        |           |   ✓   |     ✓    |    ✓    |
| egressInterface                        |           |   ✓   |     ✓    |    ✓    |
| egressInterfaceType                    |           |   ✓   |     ✓    |    ✓    |
| egressPhysicalInterface                |           |   ✓   |     ✓    |    ✓    |
| egressUnicastPacketTotalCount          |           |   ✓   |     ✓    |    ✓    |
| egressVRFID                            |           |   ✓   |     ✓    |    ✓    |
| encryptedTechnology                    |           |   ✓   |     ✓    |    ✓    |
| engineId                               |           |   ✓   |     ✓    |    ✓    |
| engineType                             |           |   ✓   |     ✓    |    ✓    |
| ethernetHeaderLength                   |           |   ✓   |     ✓    |    ✓    |
| ethernetPayloadLength                  |           |   ✓   |     ✓    |    ✓    |
| ethernetTotalLength                    |           |   ✓   |     ✓    |    ✓    |
| ethernetType                           |           |   ✓   |     ✓    |    ✓    |
| exporterCertificate                    |           |   ✓   |     ✓    |    ✓    |
| exportingProcessId                     |           |   ✓   |     ✓    |    ✓    |
| exportSctpStreamId                     |           |   ✓   |     ✓    |    ✓    |
| externalAddressRealm                   |           |   ✓   |     ✓    |    ✓    |
| firewallEvent                          |           |   ✓   |     ✓    |    ✓    |
| flagsAndSamplerId                      |           |   ✓   |     ✓    |    ✓    |
| flowActiveTimeout                      |           |   ✓   |     ✓    |    ✓    |
| flowDirection                          |           |   ✓   |     ✓    |    ✓    |
| flowDurationMicroseconds               |           |   ✓   |     ✓    |    ✓    |
| flowDurationMilliseconds               |           |   ✓   |     ✓    |    ✓    |
| flowEndDeltaMicroseconds               |           |   ✓   |     ✓    |    ✓    |
| flowEndMicroseconds                    |           |   ✓   |     ✓    |    ✓    |
| flowEndMilliseconds                    |           |   ✓   |     ✓    |    ✓    |
| flowEndNanoseconds                     |           |   ✓   |     ✓    |    ✓    |
| flowEndReason                          |           |   ✓   |     ✓    |    ✓    |
| flowEndSeconds                         |           |   ✓   |     ✓    |    ✓    |
| flowEndSysUpTime                       |           |   ✓   |     ✓    |    ✓    |
| flowIdleTimeout                        |           |   ✓   |     ✓    |    ✓    |
| flowLabelIPv6                          |           |   ✓   |     ✓    |    ✓    |
| flowSamplingTimeInterval               |           |   ✓   |     ✓    |    ✓    |
| flowSamplingTimeSpacing                |           |   ✓   |     ✓    |    ✓    |
| flowSelectedFlowDeltaCount             |           |   ✓   |     ✓    |    ✓    |
| flowSelectedOctetDeltaCount            |           |   ✓   |     ✓    |    ✓    |
| flowSelectedPacketDeltaCount           |           |   ✓   |     ✓    |    ✓    |
| flowSelectorAlgorithm                  |           |   ✓   |     ✓    |    ✓    |
| flowStartDeltaMicroseconds             |           |   ✓   |     ✓    |    ✓    |
| flowStartMicroseconds                  |           |   ✓   |     ✓    |    ✓    |
| flowStartMilliseconds                  |           |   ✓   |     ✓    |    ✓    |
| flowStartNanoseconds                   |           |   ✓   |     ✓    |    ✓    |
| flowStartSeconds                       |           |   ✓   |     ✓    |    ✓    |
| flowStartSysUpTime                     |           |   ✓   |     ✓    |    ✓    |
| forwardingStatus                       |           |   ✓   |     ✓    |    ✓    |
| fragmentFlags                          |           |   ✓   |     ✓    |    ✓    |
| fragmentIdentification                 |           |   ✓   |     ✓    |    ✓    |
| fragmentOffset                         |           |   ✓   |     ✓    |    ✓    |
| globalAddressMappingHighThreshold      |           |   ✓   |     ✓    |    ✓    |
| greKey                                 |           |   ✓   |     ✓    |    ✓    |
| hashDigestOutput                       |           |   ✓   |     ✓    |    ✓    |
| hashFlowDomain                         |           |   ✓   |     ✓    |    ✓    |
| hashInitialiserValue                   |           |   ✓   |     ✓    |    ✓    |
| hashIPPayloadOffset                    |           |   ✓   |     ✓    |    ✓    |
| hashIPPayloadSize                      |           |   ✓   |     ✓    |    ✓    |
| hashOutputRangeMax                     |           |   ✓   |     ✓    |    ✓    |
| hashOutputRangeMin                     |           |   ✓   |     ✓    |    ✓    |
| hashSelectedRangeMax                   |           |   ✓   |     ✓    |    ✓    |
| hashSelectedRangeMin                   |           |   ✓   |     ✓    |    ✓    |
| httpContentType                        |           |   ✓   |     ✓    |    ✓    |
| httpMessageVersion                     |           |   ✓   |     ✓    |    ✓    |
| httpReasonPhrase                       |           |   ✓   |     ✓    |    ✓    |
| httpRequestHost                        |           |   ✓   |     ✓    |    ✓    |
| httpRequestMethod                      |           |   ✓   |     ✓    |    ✓    |
| httpRequestTarget                      |           |   ✓   |     ✓    |    ✓    |
| httpStatusCode                         |           |   ✓   |     ✓    |    ✓    |
| httpUserAgent                          |           |   ✓   |     ✓    |    ✓    |
| icmpCodeIPv4                           |           |   ✓   |     ✓    |    ✓    |
| icmpCodeIPv6                           |           |   ✓   |     ✓    |    ✓    |
| icmpTypeCodeIPv4                       |           |   ✓   |     ✓    |    ✓    |
| icmpTypeCodeIPv6                       |           |   ✓   |     ✓    |    ✓    |
| icmpTypeIPv4                           |           |   ✓   |     ✓    |    ✓    |
| icmpTypeIPv6                           |           |   ✓   |     ✓    |    ✓    |
| igmpType                               |           |   ✓   |     ✓    |    ✓    |
| ignoredDataRecordTotalCount            |           |   ✓   |     ✓    |    ✓    |
| ignoredLayer2FrameTotalCount           |           |   ✓   |     ✓    |    ✓    |
| ignoredLayer2OctetTotalCount           |           |   ✓   |     ✓    |    ✓    |
| informationElementDataType             |           |   ✓   |     ✓    |    ✓    |
| informationElementDescription          |           |   ✓   |     ✓    |    ✓    |
| informationElementId                   |           |   ✓   |     ✓    |    ✓    |
| informationElementIndex                |           |   ✓   |     ✓    |    ✓    |
| informationElementName                 |           |   ✓   |     ✓    |    ✓    |
| informationElementRangeBegin           |           |   ✓   |     ✓    |    ✓    |
| informationElementRangeEnd             |           |   ✓   |     ✓    |    ✓    |
| informationElementSemantics            |           |   ✓   |     ✓    |    ✓    |
| informationElementUnits                |           |   ✓   |     ✓    |    ✓    |
| ingressBroadcastPacketTotalCount       |           |   ✓   |     ✓    |    ✓    |
| ingressInterface                       |           |   ✓   |     ✓    |    ✓    |
| ingressInterfaceType                   |           |   ✓   |     ✓    |    ✓    |
| ingressMulticastPacketTotalCount       |           |   ✓   |     ✓    |    ✓    |
| ingressPhysicalInterface               |           |   ✓   |     ✓    |    ✓    |
| ingressUnicastPacketTotalCount         |           |   ✓   |     ✓    |    ✓    |
| ingressVRFID                           |           |   ✓   |     ✓    |    ✓    |
| initiatorOctets                        |           |   ✓   |     ✓    |    ✓    |
| initiatorPackets                       |           |   ✓   |     ✓    |    ✓    |
| interfaceDescription                   |           |   ✓   |     ✓    |    ✓    |
| interfaceName                          |           |   ✓   |     ✓    |    ✓    |
| intermediateProcessId                  |           |   ✓   |     ✓    |    ✓    |
| internalAddressRealm                   |           |   ✓   |     ✓    |    ✓    |
| ipClassOfService                       |           |   ✓   |     ✓    |    ✓    |
| ipDiffServCodePoint                    |           |   ✓   |     ✓    |    ✓    |
| ipHeaderLength                         |           |   ✓   |     ✓    |    ✓    |
| ipHeaderPacketSection                  |           |   ✓   |     ✓    |    ✓    |
| ipNextHopIPv4Address                   |           |   ✓   |     ✓    |    ✓    |
| ipNextHopIPv6Address                   |           |   ✓   |     ✓    |    ✓    |
| ipPayloadLength                        |           |   ✓   |     ✓    |    ✓    |
| ipPayloadPacketSection                 |           |   ✓   |     ✓    |    ✓    |
| ipPrecedence                           |           |   ✓   |     ✓    |    ✓    |
| IPSecSPI                               |           |   ✓   |     ✓    |    ✓    |
| ipTotalLength                          |           |   ✓   |     ✓    |    ✓    |
| ipTTL                                  |           |   ✓   |     ✓    |    ✓    |
| ipv4IHL                                |           |   ✓   |     ✓    |    ✓    |
| ipv4Options                            |           |   ✓   |     ✓    |    ✓    |
| ipv4RouterSc                           |           |   ✓   |     ✓    |    ✓    |
| ipv6ExtensionHeaders                   |           |   ✓   |     ✓    |    ✓    |
| ipVersion                              |           |   ✓   |     ✓    |    ✓    |
| isMulticast                            |           |   ✓   |     ✓    |    ✓    |
| layer2FrameDeltaCount                  |           |   ✓   |     ✓    |    ✓    |
| layer2FrameTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| layer2OctetDeltaCount                  |           |   ✓   |     ✓    |    ✓    |
| layer2OctetDeltaSumOfSquares           |           |   ✓   |     ✓    |    ✓    |
| layer2OctetTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| layer2OctetTotalCount                  |           |   ✓   |     ✓    |    ✓    |
| layer2OctetTotalSumOfSquares           |           |   ✓   |     ✓    |    ✓    |
| layer2packetSectionData                |           |   ✓   |     ✓    |    ✓    |
| layer2packetSectionOffset              |           |   ✓   |     ✓    |    ✓    |
| layer2packetSectionSize                |           |   ✓   |     ✓    |    ✓    |
| layer2SegmentId                        |           |   ✓   |     ✓    |    ✓    |
| lineCardId                             |           |   ✓   |     ✓    |    ✓    |
| lowerCILimit                           |           |   ✓   |     ✓    |    ✓    |
| maxBIBEntries                          |           |   ✓   |     ✓    |    ✓    |
| maxEntriesPerUser                      |           |   ✓   |     ✓    |    ✓    |
| maxExportSeconds                       |           |   ✓   |     ✓    |    ✓    |
| maxFlowEndMicroseconds                 |           |   ✓   |     ✓    |    ✓    |
| maxFlowEndMilliseconds                 |           |   ✓   |     ✓    |    ✓    |
| maxFlowEndNanoseconds                  |           |   ✓   |     ✓    |    ✓    |
| maxFlowEndSeconds                      |           |   ✓   |     ✓    |    ✓    |
| maxFragmentsPendingReassembly          |           |   ✓   |     ✓    |    ✓    |
| maximumIpTotalLength                   |           |   ✓   |     ✓    |    ✓    |
| maximumLayer2TotalLength               |           |   ✓   |     ✓    |    ✓    |
| maximumTTL                             |           |   ✓   |     ✓    |    ✓    |
| maxSessionEntries                      |           |   ✓   |     ✓    |    ✓    |
| maxSubscribers                         |           |   ✓   |     ✓    |    ✓    |
| messageMD5Checksum                     |           |   ✓   |     ✓    |    ✓    |
| messageScope                           |           |   ✓   |     ✓    |    ✓    |
| meteringProcessId                      |           |   ✓   |     ✓    |    ✓    |
| metroEvcId                             |           |   ✓   |     ✓    |    ✓    |
| metroEvcType                           |           |   ✓   |     ✓    |    ✓    |
| minExportSeconds                       |           |   ✓   |     ✓    |    ✓    |
| minFlowStartMicroseconds               |           |   ✓   |     ✓    |    ✓    |
| minFlowStartMilliseconds               |           |   ✓   |     ✓    |    ✓    |
| minFlowStartNanoseconds                |           |   ✓   |     ✓    |    ✓    |
| minFlowStartSeconds                    |           |   ✓   |     ✓    |    ✓    |
| minimumIpTotalLength                   |           |   ✓   |     ✓    |    ✓    |
| minimumLayer2TotalLength               |           |   ✓   |     ✓    |    ✓    |
| minimumTTL                             |           |   ✓   |     ✓    |    ✓    |
| mobileIMSI                             |           |   ✓   |     ✓    |    ✓    |
| mobileMSISDN                           |           |   ✓   |     ✓    |    ✓    |
| monitoringIntervalEndMilliSeconds      |           |   ✓   |     ✓    |    ✓    |
| monitoringIntervalStartMilliSeconds    |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackDepth                    |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackLength                   |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection                  |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection10                |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection2                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection3                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection4                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection5                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection6                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection7                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection8                 |           |   ✓   |     ✓    |    ✓    |
| mplsLabelStackSection9                 |           |   ✓   |     ✓    |    ✓    |
| mplsPayloadLength                      |           |   ✓   |     ✓    |    ✓    |
| mplsPayloadPacketSection               |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelExp                        |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelIPv4Address                |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelIPv6Address                |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelPrefixLength               |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelStackSection               |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelTTL                        |           |   ✓   |     ✓    |    ✓    |
| mplsTopLabelType                       |           |   ✓   |     ✓    |    ✓    |
| mplsVpnRouteDistinguisher              |           |   ✓   |     ✓    |    ✓    |
| multicastReplicationFactor             |           |   ✓   |     ✓    |    ✓    |
| natEvent                               |           |   ✓   |     ✓    |    ✓    |
| natInstanceID                          |           |   ✓   |     ✓    |    ✓    |
| natOriginatingAddressRealm             |           |   ✓   |     ✓    |    ✓    |
| natPoolId                              |           |   ✓   |     ✓    |    ✓    |
| natPoolName                            |           |   ✓   |     ✓    |    ✓    |
| natQuotaExceededEvent                  |           |   ✓   |     ✓    |    ✓    |
| natThresholdEvent                      |           |   ✓   |     ✓    |    ✓    |
| natType                                |           |   ✓   |     ✓    |    ✓    |
| newConnectionDeltaCount                |           |   ✓   |     ✓    |    ✓    |
| nextHeaderIPv6                         |           |   ✓   |     ✓    |    ✓    |
| notSentLayer2OctetTotalCount           |           |   ✓   |     ✓    |    ✓    |
| observationDomainName                  |           |   ✓   |     ✓    |    ✓    |
| observationPointId                     |           |   ✓   |     ✓    |    ✓    |
| observationPointType                   |           |   ✓   |     ✓    |    ✓    |
| observationTimeMicroseconds            |           |   ✓   |     ✓    |    ✓    |
| observationTimeMilliseconds            |           |   ✓   |     ✓    |    ✓    |
| observationTimeNanoseconds             |           |   ✓   |     ✓    |    ✓    |
| observationTimeSeconds                 |           |   ✓   |     ✓    |    ✓    |
| octetDeltaCount                        |           |   ✓   |     ✓    |    ✓    |
| octetDeltaSumOfSquares                 |           |   ✓   |     ✓    |    ✓    |
| octetTotalCount                        |           |   ✓   |     ✓    |    ✓    |
| octetTotalSumOfSquares                 |           |   ✓   |     ✓    |    ✓    |
| opaqueOctets                           |           |   ✓   |     ✓    |    ✓    |
| originalExporterIPv4Address            |           |   ✓   |     ✓    |    ✓    |
| originalExporterIPv6Address            |           |   ✓   |     ✓    |    ✓    |
| originalFlowsCompleted                 |           |   ✓   |     ✓    |    ✓    |
| originalFlowsInitiated                 |           |   ✓   |     ✓    |    ✓    |
| originalFlowsPresent                   |           |   ✓   |     ✓    |    ✓    |
| originalObservationDomainId            |           |   ✓   |     ✓    |    ✓    |
| p2pTechnology                          |           |   ✓   |     ✓    |    ✓    |
| packetDeltaCount                       |           |   ✓   |     ✓    |    ✓    |
| packetTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| payloadLengthIPv6                      |           |   ✓   |     ✓    |    ✓    |
| portId                                 |           |   ✓   |     ✓    |    ✓    |
| portRangeEnd                           |           |   ✓   |     ✓    |    ✓    |
| portRangeNumPorts                      |           |   ✓   |     ✓    |    ✓    |
| portRangeStart                         |           |   ✓   |     ✓    |    ✓    |
| portRangeStepSize                      |           |   ✓   |     ✓    |    ✓    |
| postDestinationMacAddress              |           |   ✓   |     ✓    |    ✓    |
| postDot1qCustomerVlanId                |           |   ✓   |     ✓    |    ✓    |
| postDot1qVlanId                        |           |   ✓   |     ✓    |    ✓    |
| postIpClassOfService                   |           |   ✓   |     ✓    |    ✓    |
| postIpDiffServCodePoint                |           |   ✓   |     ✓    |    ✓    |
| postIpPrecedence                       |           |   ✓   |     ✓    |    ✓    |
| postLayer2OctetDeltaCount              |           |   ✓   |     ✓    |    ✓    |
| postLayer2OctetTotalCount              |           |   ✓   |     ✓    |    ✓    |
| postMCastLayer2OctetDeltaCount         |           |   ✓   |     ✓    |    ✓    |
| postMCastLayer2OctetTotalCount         |           |   ✓   |     ✓    |    ✓    |
| postMCastOctetDeltaCount               |           |   ✓   |     ✓    |    ✓    |
| postMCastOctetTotalCount               |           |   ✓   |     ✓    |    ✓    |
| postMCastPacketDeltaCount              |           |   ✓   |     ✓    |    ✓    |
| postMCastPacketTotalCount              |           |   ✓   |     ✓    |    ✓    |
| postMplsTopLabelExp                    |           |   ✓   |     ✓    |    ✓    |
| postNAPTDestinationTransportPort       |           |   ✓   |     ✓    |    ✓    |
| postNAPTSourceTransportPort            |           |   ✓   |     ✓    |    ✓    |
| postNATDestinationIPv4Address          |           |   ✓   |     ✓    |    ✓    |
| postNATDestinationIPv6Address          |           |   ✓   |     ✓    |    ✓    |
| postNATSourceIPv4Address               |           |   ✓   |     ✓    |    ✓    |
| postNATSourceIPv6Address               |           |   ✓   |     ✓    |    ✓    |
| postOctetDeltaCount                    |           |   ✓   |     ✓    |    ✓    |
| postOctetTotalCount                    |           |   ✓   |     ✓    |    ✓    |
| postPacketDeltaCount                   |           |   ✓   |     ✓    |    ✓    |
| postPacketTotalCount                   |           |   ✓   |     ✓    |    ✓    |
| postSourceMacAddress                   |           |   ✓   |     ✓    |    ✓    |
| postVlanId                             |           |   ✓   |     ✓    |    ✓    |
| privateEnterpriseNumber                |           |   ✓   |     ✓    |    ✓    |
| protocolIdentifier                     |           |   ✓   |     ✓    |    ✓    |
| pseudoWireControlWord                  |           |   ✓   |     ✓    |    ✓    |
| pseudoWireDestinationIPv4Address       |           |   ✓   |     ✓    |    ✓    |
| pseudoWireId                           |           |   ✓   |     ✓    |    ✓    |
| pseudoWireType                         |           |   ✓   |     ✓    |    ✓    |
| relativeError                          |           |   ✓   |     ✓    |    ✓    |
| responderOctets                        |           |   ✓   |     ✓    |    ✓    |
| responderPackets                       |           |   ✓   |     ✓    |    ✓    |
| rfc3550JitterMicroseconds              |           |   ✓   |     ✓    |    ✓    |
| rfc3550JitterMilliseconds              |           |   ✓   |     ✓    |    ✓    |
| rfc3550JitterNanoseconds               |           |   ✓   |     ✓    |    ✓    |
| rtpSequenceNumber                      |           |   ✓   |     ✓    |    ✓    |
| samplerId                              |           |   ✓   |     ✓    |    ✓    |
| samplerMode                            |           |   ✓   |     ✓    |    ✓    |
| samplerName                            |           |   ✓   |     ✓    |    ✓    |
| samplerRandomInterval                  |           |   ✓   |     ✓    |    ✓    |
| samplingAlgorithm                      |           |   ✓   |     ✓    |    ✓    |
| samplingFlowInterval                   |           |   ✓   |     ✓    |    ✓    |
| samplingFlowSpacing                    |           |   ✓   |     ✓    |    ✓    |
| samplingInterval                       |           |   ✓   |     ✓    |    ✓    |
| samplingPacketInterval                 |           |   ✓   |     ✓    |    ✓    |
| samplingPacketSpace                    |           |   ✓   |     ✓    |    ✓    |
| samplingPopulation                     |           |   ✓   |     ✓    |    ✓    |
| samplingProbability                    |           |   ✓   |     ✓    |    ✓    |
| samplingSize                           |           |   ✓   |     ✓    |    ✓    |
| samplingTimeInterval                   |           |   ✓   |     ✓    |    ✓    |
| samplingTimeSpace                      |           |   ✓   |     ✓    |    ✓    |
| sectionExportedOctets                  |           |   ✓   |     ✓    |    ✓    |
| sectionOffset                          |           |   ✓   |     ✓    |    ✓    |
| selectionSequenceId                    |           |   ✓   |     ✓    |    ✓    |
| selectorAlgorithm                      |           |   ✓   |     ✓    |    ✓    |
| selectorId                             |           |   ✓   |     ✓    |    ✓    |
| selectorIDTotalFlowsObserved           |           |   ✓   |     ✓    |    ✓    |
| selectorIDTotalFlowsSelected           |           |   ✓   |     ✓    |    ✓    |
| selectorIdTotalPktsObserved            |           |   ✓   |     ✓    |    ✓    |
| selectorIdTotalPktsSelected            |           |   ✓   |     ✓    |    ✓    |
| selectorName                           |           |   ✓   |     ✓    |    ✓    |
| sessionScope                           |           |   ✓   |     ✓    |    ✓    |
| sourceIPv4Address                      |           |   ✓   |     ✓    |    ✓    |
| sourceIPv4Prefix                       |           |   ✓   |     ✓    |    ✓    |
| sourceIPv4PrefixLength                 |           |   ✓   |     ✓    |    ✓    |
| sourceIPv6Address                      |           |   ✓   |     ✓    |    ✓    |
| sourceIPv6Prefix                       |           |   ✓   |     ✓    |    ✓    |
| sourceIPv6PrefixLength                 |           |   ✓   |     ✓    |    ✓    |
| sourceMacAddress                       |           |   ✓   |     ✓    |    ✓    |
| sourceTransportPort                    |           |   ✓   |     ✓    |    ✓    |
| sourceTransportPortsLimit              |           |   ✓   |     ✓    |    ✓    |
| srcTrafficIndex                        |           |   ✓   |     ✓    |    ✓    |
| staIPv4Address                         |           |   ✓   |     ✓    |    ✓    |
| staMacAddress                          |           |   ✓   |     ✓    |    ✓    |
| subTemplateList                        |           |   ✓   |     ✓    |    ✓    |
| subTemplateMultiList                   |           |   ✓   |     ✓    |    ✓    |
| systemInitTimeMilliseconds             |           |   ✓   |     ✓    |    ✓    |
| tcpAcknowledgementNumber               |           |   ✓   |     ✓    |    ✓    |
| tcpAckTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| tcpControlBits                         |           |   ✓   |     ✓    |    ✓    |
| tcpDestinationPort                     |           |   ✓   |     ✓    |    ✓    |
| tcpFinTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| tcpHeaderLength                        |           |   ✓   |     ✓    |    ✓    |
| tcpOptions                             |           |   ✓   |     ✓    |    ✓    |
| tcpPshTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| tcpRstTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| tcpSequenceNumber                      |           |   ✓   |     ✓    |    ✓    |
| tcpSourcePort                          |           |   ✓   |     ✓    |    ✓    |
| tcpSynTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| tcpUrgentPointer                       |           |   ✓   |     ✓    |    ✓    |
| tcpUrgTotalCount                       |           |   ✓   |     ✓    |    ✓    |
| tcpWindowScale                         |           |   ✓   |     ✓    |    ✓    |
| tcpWindowSize                          |           |   ✓   |     ✓    |    ✓    |
| totalLengthIPv4                        |           |   ✓   |     ✓    |    ✓    |
| transportOctetDeltaCount               |           |   ✓   |     ✓    |    ✓    |
| transportPacketDeltaCount              |           |   ✓   |     ✓    |    ✓    |
| tunnelTechnology                       |           |   ✓   |     ✓    |    ✓    |
| udpDestinationPort                     |           |   ✓   |     ✓    |    ✓    |
| udpMessageLength                       |           |   ✓   |     ✓    |    ✓    |
| udpSourcePort                          |           |   ✓   |     ✓    |    ✓    |
| upperCILimit                           |           |   ✓   |     ✓    |    ✓    |
| userName                               |           |   ✓   |     ✓    |    ✓    |
| valueDistributionMethod                |           |   ✓   |     ✓    |    ✓    |
| virtualStationInterfaceId              |           |   ✓   |     ✓    |    ✓    |
| virtualStationInterfaceName            |           |   ✓   |     ✓    |    ✓    |
| virtualStationName                     |           |   ✓   |     ✓    |    ✓    |
| virtualStationUUID                     |           |   ✓   |     ✓    |    ✓    |
| vlanId                                 |           |   ✓   |     ✓    |    ✓    |
| vpnIdentifier                          |           |   ✓   |     ✓    |    ✓    |
| VRFname                                |           |   ✓   |     ✓    |    ✓    |
| wlanChannelId                          |           |   ✓   |     ✓    |    ✓    |
| wlanSSID                               |           |   ✓   |     ✓    |    ✓    |
| wtpMacAddress                          |           |   ✓   |     ✓    |    ✓    |

### Cubro (PEN: 32182)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| appID |           |   ✓   |     ✓    |    ✓    |

### CACE Technologies (PEN: 32622)

| Name                     | Community | Basic | Standard | Premium |
| ------------------------ | :-------: | :---: | :------: | :-----: |
| caceLocalICMPid          |           |   ✓   |     ✓    |    ✓    |
| caceLocalIPv4Address     |           |   ✓   |     ✓    |    ✓    |
| caceLocalIPv4id          |           |   ✓   |     ✓    |    ✓    |
| caceLocalIPv6Address     |           |   ✓   |     ✓    |    ✓    |
| caceLocalProcessCommand  |           |   ✓   |     ✓    |    ✓    |
| caceLocalProcessCommand  |           |   ✓   |     ✓    |    ✓    |
| caceLocalProcessId       |           |   ✓   |     ✓    |    ✓    |
| caceLocalProcessUserId   |           |   ✓   |     ✓    |    ✓    |
| caceLocalProcessUserName |           |   ✓   |     ✓    |    ✓    |
| caceLocalTransportPort   |           |   ✓   |     ✓    |    ✓    |
| caceRemoteIPv4Address    |           |   ✓   |     ✓    |    ✓    |
| caceRemoteIPv6Address    |           |   ✓   |     ✓    |    ✓    |
| caceRemoteTransportPort  |           |   ✓   |     ✓    |    ✓    |

### FastIP/Boundary (PEN: 33610)

| Name                                  | Community | Basic | Standard | Premium |
| ------------------------------------- | :-------: | :---: | :------: | :-----: |
| APP\_RTT\_USEC                        |           |   ✓   |     ✓    |    ✓    |
| BOND\_INTERFACE\_ID                   |           |   ✓   |     ✓    |    ✓    |
| BOND\_INTERFACE\_MODE                 |           |   ✓   |     ✓    |    ✓    |
| BOND\_INTERFACE\_PHYSICAL\_NIC\_COUNT |           |   ✓   |     ✓    |    ✓    |
| COLLISIONS                            |           |   ✓   |     ✓    |    ✓    |
| EPOCH\_SECOND                         |           |   ✓   |     ✓    |    ✓    |
| ERRORS                                |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_DISTRIBUTION\_NAME         |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_MACHINE                    |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_NODENAME                   |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_RELEASE                    |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_SYSNAME                    |           |   ✓   |     ✓    |    ✓    |
| METER\_OS\_VERSION                    |           |   ✓   |     ✓    |    ✓    |
| METER\_VERSION                        |           |   ✓   |     ✓    |    ✓    |
| NIC\_DRIVER\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| NIC\_DRIVER\_VERSION                  |           |   ✓   |     ✓    |    ✓    |
| NIC\_FIRMWARE\_VERSION                |           |   ✓   |     ✓    |    ✓    |
| NIC\_ID                               |           |   ✓   |     ✓    |    ✓    |
| NIC\_IP                               |           |   ✓   |     ✓    |    ✓    |
| NIC\_MAC                              |           |   ✓   |     ✓    |    ✓    |
| NIC\_NAME                             |           |   ✓   |     ✓    |    ✓    |
| TCP\_FLAGS                            |           |   ✓   |     ✓    |    ✓    |
| TCP\_HANDSHAKE\_RTT\_USEC             |           |   ✓   |     ✓    |    ✓    |

### trammell.ch (PEN: 35566)

| Name                     | Community | Basic | Standard | Premium |
| ------------------------ | :-------: | :---: | :------: | :-----: |
| sipAuthUsername          |           |   ✓   |     ✓    |    ✓    |
| sipCallId                |           |   ✓   |     ✓    |    ✓    |
| sipClientTransaction     |           |   ✓   |     ✓    |    ✓    |
| sipContactURI            |           |   ✓   |     ✓    |    ✓    |
| sipExpires               |           |   ✓   |     ✓    |    ✓    |
| sipFromTag               |           |   ✓   |     ✓    |    ✓    |
| sipFromURI               |           |   ✓   |     ✓    |    ✓    |
| sipMethod                |           |   ✓   |     ✓    |    ✓    |
| sipObservationType       |           |   ✓   |     ✓    |    ✓    |
| sipPAccessNetworkInfo    |           |   ✓   |     ✓    |    ✓    |
| sipPaiURI                |           |   ✓   |     ✓    |    ✓    |
| sipPaiURI                |           |   ✓   |     ✓    |    ✓    |
| sipPAssocURI             |           |   ✓   |     ✓    |    ✓    |
| sipPCalledPartyURI       |           |   ✓   |     ✓    |    ✓    |
| sipPChargingFunctionAddr |           |   ✓   |     ✓    |    ✓    |
| sipPChargingVector       |           |   ✓   |     ✓    |    ✓    |
| sipPpiURI                |           |   ✓   |     ✓    |    ✓    |
| sipPVisitedNetworkID     |           |   ✓   |     ✓    |    ✓    |
| sipRequestURI            |           |   ✓   |     ✓    |    ✓    |
| sipResponseStatus        |           |   ✓   |     ✓    |    ✓    |
| sipRouteURI              |           |   ✓   |     ✓    |    ✓    |
| sipSequenceNumber        |           |   ✓   |     ✓    |    ✓    |
| sipServerTransaction     |           |   ✓   |     ✓    |    ✓    |
| sipSessionIdCode         |           |   ✓   |     ✓    |    ✓    |
| sipSubscriptionEvent     |           |   ✓   |     ✓    |    ✓    |
| sipSubscriptionState     |           |   ✓   |     ✓    |    ✓    |
| sipToTag                 |           |   ✓   |     ✓    |    ✓    |
| sipToURI                 |           |   ✓   |     ✓    |    ✓    |
| sipUsername              |           |   ✓   |     ✓    |    ✓    |
| sipVia                   |           |   ✓   |     ✓    |    ✓    |

### ntop (PEN: 35632)

| Name                                | Community | Basic | Standard | Premium |
| ----------------------------------- | :-------: | :---: | :------: | :-----: |
| APPL\_LATENCY\_MS                   |           |   ✓   |     ✓    |    ✓    |
| APPLICATION\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| BITTORRENT\_HASH                    |           |   ✓   |     ✓    |    ✓    |
| CLIENT\_NW\_LATENCY\_MS             |           |   ✓   |     ✓    |    ✓    |
| CLIENT\_TCP\_FLAGS                  |           |   ✓   |     ✓    |    ✓    |
| CUMULATIVE\_ICMP\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| DHCP\_CLIENT\_IP                    |           |   ✓   |     ✓    |    ✓    |
| DHCP\_CLIENT\_MAC                   |           |   ✓   |     ✓    |    ✓    |
| DHCP\_CLIENT\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| DHCP\_MESSAGE\_TYPE                 |           |   ✓   |     ✓    |    ✓    |
| DHCP\_REMOTE\_ID                    |           |   ✓   |     ✓    |    ✓    |
| DHCP\_SUBSCRIBER\_ID                |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLED\_PARTY\_ADDRESS    |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLED\_STATION\_ID       |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLING\_PARTY\_ADDRESS   |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CALLING\_STATION\_ID      |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CLR\_CANCEL\_TYPE         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_CLR\_FLAGS                |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_EXP\_RES\_RESULT\_CODE    |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_EXP\_RES\_VENDOR\_ID      |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_FRAMED\_IP\_ADDR          |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_HOP\_BY\_HOP\_ID          |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_PDP\_ADDR                 |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_REQ\_MSG\_TYPE            |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_REQ\_ORIGIN\_HOST         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_REQ\_USER\_NAME           |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_RSP\_MSG\_TYPE            |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_RSP\_ORIGIN\_HOST         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_RSP\_RESULT\_CODE         |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_SERVED\_IP\_ADDR          |           |   ✓   |     ✓    |    ✓    |
| DIAMETER\_SUBSCRIPTION\_ID          |           |   ✓   |     ✓    |    ✓    |
| DICOM\_DEVICE\_SERIAL               |           |   ✓   |     ✓    |    ✓    |
| DICOM\_IMPL\_UID                    |           |   ✓   |     ✓    |    ✓    |
| DICOM\_IMPL\_VERSION                |           |   ✓   |     ✓    |    ✓    |
| DICOM\_INST\_ADDR                   |           |   ✓   |     ✓    |    ✓    |
| DICOM\_INST\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| DICOM\_MANUFACTURER                 |           |   ✓   |     ✓    |    ✓    |
| DICOM\_MODALITY                     |           |   ✓   |     ✓    |    ✓    |
| DICOM\_STATION\_NAME                |           |   ✓   |     ✓    |    ✓    |
| DICOM\_SW\_VERSION                  |           |   ✓   |     ✓    |    ✓    |
| DNS\_NUM\_ANSWERS                   |           |   ✓   |     ✓    |    ✓    |
| DNS\_QUERY                          |           |   ✓   |     ✓    |    ✓    |
| DNS\_QUERY\_ID                      |           |   ✓   |     ✓    |    ✓    |
| DNS\_QUERY\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| DNS\_RESPONSE                       |           |   ✓   |     ✓    |    ✓    |
| DNS\_RET\_CODE                      |           |   ✓   |     ✓    |    ✓    |
| DNS\_TTL\_ANSWER                    |           |   ✓   |     ✓    |    ✓    |
| DOWNSTREAM\_SESSION\_ID             |           |   ✓   |     ✓    |    ✓    |
| DOWNSTREAM\_TUNNEL\_ID              |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_MAP                        |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_1                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_10                   |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_2                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_3                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_4                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_5                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_6                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_7                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_8                    |           |   ✓   |     ✓    |    ✓    |
| DST\_AS\_PATH\_9                    |           |   ✓   |     ✓    |    ✓    |
| DST\_FATHER\_PROC\_NAME             |           |   ✓   |     ✓    |    ✓    |
| DST\_FATHER\_PROC\_PID              |           |   ✓   |     ✓    |    ✓    |
| DST\_FRAGMENTS                      |           |   ✓   |     ✓    |    ✓    |
| DST\_HOST\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_CITY                       |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_COUNTRY                    |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_LAT                        |           |   ✓   |     ✓    |    ✓    |
| DST\_IP\_LONG                       |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_ACTUAL\_MEMORY           |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_AVERAGE\_CPU\_LOAD       |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_NUM\_PAGE\_FAULTS        |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_PCTG\_IOWAIT             |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_PEAK\_MEMORY             |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_PID                      |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_UID                      |           |   ✓   |     ✓    |    ✓    |
| DST\_PROC\_USER\_NAME               |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_AVG\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_MAX\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_MIN\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| DST\_TO\_SRC\_SECOND\_BYTES         |           |   ✓   |     ✓    |    ✓    |
| DURATION\_IN                        |           |   ✓   |     ✓    |    ✓    |
| DURATION\_OUT                       |           |   ✓   |     ✓    |    ✓    |
| ENTROPY\_CLIENT\_BYTES              |           |   ✓   |     ✓    |    ✓    |
| ENTROPY\_SERVER\_BYTES              |           |   ✓   |     ✓    |    ✓    |
| EPP\_CMD                            |           |   ✓   |     ✓    |    ✓    |
| EPP\_CMD\_ARGS                      |           |   ✓   |     ✓    |    ✓    |
| EPP\_REASON\_STR                    |           |   ✓   |     ✓    |    ✓    |
| EPP\_REGISTRAR\_NAME                |           |   ✓   |     ✓    |    ✓    |
| EPP\_RSP\_CODE                      |           |   ✓   |     ✓    |    ✓    |
| EPP\_SERVER\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| FLOW\_PROTO\_PORT                   |           |   ✓   |     ✓    |    ✓    |
| FLOW\_SERVER\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| FLOW\_USER\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| FTP\_COMMAND                        |           |   ✓   |     ✓    |    ✓    |
| FTP\_COMMAND\_RET\_CODE             |           |   ✓   |     ✓    |    ✓    |
| FTP\_LOGIN                          |           |   ✓   |     ✓    |    ✓    |
| FTP\_PASSWORD                       |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_APN\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_END\_USER\_IP                |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_END\_USER\_MSISDN            |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_CELL\_LAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_CELL\_RAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RAI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_REQ\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RESPONSE\_CAUSE              |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_RSP\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV0\_TID                          |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_APN\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_C2S\_TEID\_CTRL              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_C2S\_TEID\_DATA              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_IMEI              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_IMSI              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_IP                |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_END\_USER\_MSISDN            |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_LAC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAI\_RAC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RAT\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_REQ\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RESPONSE\_CAUSE              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_RSP\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_S2C\_TEID\_CTRL              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_S2C\_TEID\_DATA              |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_CELL\_CI                |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_CELL\_LAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV1\_ULI\_SAC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_APN\_NAME                    |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S1U\_GTPU\_IP           |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S1U\_GTPU\_TEID         |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_GTPC\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_GTPU\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_GTPU\_TEID      |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_SGW\_GTPU\_IP   |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_C2S\_S5\_S8\_SGW\_GTPU\_TEID |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_END\_USER\_IMEI              |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_END\_USER\_IMSI              |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_END\_USER\_MSISDN            |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_PDN\_IP                      |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_RAT\_TYPE                    |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_REQ\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_RESPONSE\_CAUSE              |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_RSP\_MSG\_TYPE               |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S1U\_GTPU\_IP           |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S1U\_GTPU\_TEID         |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_GTPC\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_GTPU\_IP        |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_GTPU\_TEID      |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_SGW\_GTPU\_IP   |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S2C\_S5\_S8\_SGW\_GTPU\_TEID |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_S5\_S8\_GTPC\_TEID           |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_CELL\_ID                |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_CELL\_TAC               |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_MCC                     |           |   ✓   |     ✓    |    ✓    |
| GTPV2\_ULI\_MNC                     |           |   ✓   |     ✓    |    ✓    |
| HASSH\_CLIENT                       |           |   ✓   |     ✓    |    ✓    |
| HASSH\_SERVER                       |           |   ✓   |     ✓    |    ✓    |
| HTTP\_HOST                          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_METHOD                        |           |   ✓   |     ✓    |    ✓    |
| HTTP\_MIME                          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_REFERER                       |           |   ✓   |     ✓    |    ✓    |
| HTTP\_RET\_CODE                     |           |   ✓   |     ✓    |    ✓    |
| HTTP\_SITE                          |           |   ✓   |     ✓    |    ✓    |
| HTTP\_UA                            |           |   ✓   |     ✓    |    ✓    |
| HTTP\_URL                           |           |   ✓   |     ✓    |    ✓    |
| HTTP\_VIA                           |           |   ✓   |     ✓    |    ✓    |
| HTTP\_X\_FORWARDED\_FOR             |           |   ✓   |     ✓    |    ✓    |
| IMAP\_LOGIN                         |           |   ✓   |     ✓    |    ✓    |
| IN\_SRC\_OSI\_SAP                   |           |   ✓   |     ✓    |    ✓    |
| JA3C\_HASH                          |           |   ✓   |     ✓    |    ✓    |
| JA3S\_HASH                          |           |   ✓   |     ✓    |    ✓    |
| L4\_DST\_PORT\_MAP                  |           |   ✓   |     ✓    |    ✓    |
| L4\_SRC\_PORT\_MAP                  |           |   ✓   |     ✓    |    ✓    |
| L4\_SRV\_PORT                       |           |   ✓   |     ✓    |    ✓    |
| L4\_SRV\_PORT\_MAP                  |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO                           |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO                           |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO\_CATEGORY                 |           |   ✓   |     ✓    |    ✓    |
| L7\_PROTO\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| LONGEST\_FLOW\_PKT                  |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_APPL\_LATENCY\_USEC          |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_DB                           |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_QUERY                        |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_RESPONSE                     |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_SERVER\_VERSION              |           |   ✓   |     ✓    |    ✓    |
| MYSQL\_USERNAME                     |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_QUERY\_NAME                |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_QUERY\_OS                  |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_QUERY\_TYPE                |           |   ✓   |     ✓    |    ✓    |
| NETBIOS\_RESPONSE                   |           |   ✓   |     ✓    |    ✓    |
| NPROBE\_IPV4\_ADDRESS               |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_1024\_TO\_1514\_BYTES    |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_128\_TO\_256\_BYTES      |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_256\_TO\_512\_BYTES      |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_512\_TO\_1024\_BYTES     |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_OVER\_1514\_BYTES        |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_128\_160            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_160\_192            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_192\_224            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_2\_5                |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_224\_255            |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_5\_32               |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_64\_96              |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_64\_96              |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_96\_128             |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_TTL\_EQ\_1               |           |   ✓   |     ✓    |    ✓    |
| NUM\_PKTS\_UP\_TO\_128\_BYTES       |           |   ✓   |     ✓    |    ✓    |
| OOORDER\_IN\_PKTS                   |           |   ✓   |     ✓    |    ✓    |
| OOORDER\_OUT\_PKTS                  |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_QUERY                       |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_QUERY\_DURATION             |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_RSP\_CODE                   |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_RSP\_STRING                 |           |   ✓   |     ✓    |    ✓    |
| ORACLE\_USERNAME                    |           |   ✓   |     ✓    |    ✓    |
| OUT\_DST\_OSI\_SAP                  |           |   ✓   |     ✓    |    ✓    |
| PAYLOAD\_HASH                       |           |   ✓   |     ✓    |    ✓    |
| PKT\_VECTOR                         |           |   ✓   |     ✓    |    ✓    |
| PLUGIN\_NAME                        |           |   ✓   |     ✓    |    ✓    |
| POP\_USER                           |           |   ✓   |     ✓    |    ✓    |
| PROTOCOL\_MAP                       |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_IN\_OCTETS            |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_IN\_PKTS              |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_OUT\_OCTETS           |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_OUT\_PKTS             |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_SESSION\_ID           |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_ACCT\_STATUS\_TYPE          |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_CALLED\_STATION\_ID         |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_CALLING\_STATION\_ID        |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_FRAMED\_IP\_ADDR            |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_NAS\_IDENTIFIER             |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_NAS\_IP\_ADDR               |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_REQ\_MSG\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_RSP\_MSG\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_USER\_IMEI                  |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_USER\_IMSI                  |           |   ✓   |     ✓    |    ✓    |
| RADIUS\_USER\_NAME                  |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_IN\_BYTES            |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_IN\_PKTS             |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_OUT\_BYTES           |           |   ✓   |     ✓    |    ✓    |
| RETRANSMITTED\_OUT\_PKTS            |           |   ✓   |     ✓    |    ✓    |
| RTP\_DTMF\_TONES                    |           |   ✓   |     ✓    |    ✓    |
| RTP\_FIRST\_SEQ                     |           |   ✓   |     ✓    |    ✓    |
| RTP\_FIRST\_TS                      |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_JITTER                     |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_MAX\_DELTA                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_MOS                        |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_PAYLOAD\_TYPE              |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_PKT\_DROP                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_PKT\_LOST                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_R\_FACTOR                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_IN\_TRANSIT                    |           |   ✓   |     ✓    |    ✓    |
| RTP\_LAST\_SEQ                      |           |   ✓   |     ✓    |    ✓    |
| RTP\_LAST\_TS                       |           |   ✓   |     ✓    |    ✓    |
| RTP\_MOS                            |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_JITTER                    |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_MAX\_DELTA                |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_MOS                       |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_PAYLOAD\_TYPE             |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_PKT\_DROP                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_PKT\_LOST                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_R\_FACTOR                 |           |   ✓   |     ✓    |    ✓    |
| RTP\_OUT\_TRANSIT                   |           |   ✓   |     ✓    |    ✓    |
| RTP\_R\_FACTOR                      |           |   ✓   |     ✓    |    ✓    |
| RTP\_RTT                            |           |   ✓   |     ✓    |    ✓    |
| RTP\_SIP\_CALL\_ID                  |           |   ✓   |     ✓    |    ✓    |
| RTP\_SSRC                           |           |   ✓   |     ✓    |    ✓    |
| S1AP\_CAUSE\_ENB\_TO\_MME           |           |   ✓   |     ✓    |    ✓    |
| S1AP\_DETAILED\_CAUSE\_ENB\_TO\_MME |           |   ✓   |     ✓    |    ✓    |
| S1AP\_ENB\_UE\_S1AP\_ID             |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MME\_UE\_S1AP\_ID             |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_EMM\_TYPE\_ENB\_TO\_MME  |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_EMM\_TYPE\_MME\_TO\_ENB  |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_ESM\_TYPE\_ENB\_TO\_MME  |           |   ✓   |     ✓    |    ✓    |
| S1AP\_MSG\_ESM\_TYPE\_MME\_TO\_ENB  |           |   ✓   |     ✓    |    ✓    |
| SEQ\_PLEN                           |           |   ✓   |     ✓    |    ✓    |
| SEQ\_PLEN\_HASH                     |           |   ✓   |     ✓    |    ✓    |
| SEQ\_TDIFF                          |           |   ✓   |     ✓    |    ✓    |
| SEQ\_TDIFF\_HASH                    |           |   ✓   |     ✓    |    ✓    |
| SERVER\_NW\_LATENCY\_MS             |           |   ✓   |     ✓    |    ✓    |
| SERVER\_TCP\_FLAGS                  |           |   ✓   |     ✓    |    ✓    |
| SHORTEST\_FLOW\_PKT                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_BYE\_OK\_TIME                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_BYE\_TIME                      |           |   ✓   |     ✓    |    ✓    |
| SIP\_C\_IP                          |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALL\_ID                       |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALL\_STATE                    |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALLED\_PARTY                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_CALLING\_PARTY                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_CANCEL\_OK\_TIME               |           |   ✓   |     ✓    |    ✓    |
| SIP\_CANCEL\_TIME                   |           |   ✓   |     ✓    |    ✓    |
| SIP\_INVITE\_FAILURE\_TIME          |           |   ✓   |     ✓    |    ✓    |
| SIP\_INVITE\_OK\_TIME               |           |   ✓   |     ✓    |    ✓    |
| SIP\_INVITE\_TIME                   |           |   ✓   |     ✓    |    ✓    |
| SIP\_REASON\_CAUSE                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_RESPONSE\_CODE                 |           |   ✓   |     ✓    |    ✓    |
| SIP\_RINGING\_TIME                  |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_CODECS                    |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_IPV4\_DST\_ADDR           |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_IPV4\_SRC\_ADDR           |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_L4\_DST\_PORT             |           |   ✓   |     ✓    |    ✓    |
| SIP\_RTP\_L4\_SRC\_PORT             |           |   ✓   |     ✓    |    ✓    |
| SIP\_TRYING\_TIME                   |           |   ✓   |     ✓    |    ✓    |
| SIP\_UAC                            |           |   ✓   |     ✓    |    ✓    |
| SIP\_UAS                            |           |   ✓   |     ✓    |    ✓    |
| SMTP\_MAIL\_FROM                    |           |   ✓   |     ✓    |    ✓    |
| SMTP\_RCPT\_TO                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_MAP                        |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_1                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_10                   |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_2                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_3                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_4                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_5                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_6                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_7                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_8                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_AS\_PATH\_9                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_FATHER\_PROC\_NAME             |           |   ✓   |     ✓    |    ✓    |
| SRC\_FATHER\_PROC\_PID              |           |   ✓   |     ✓    |    ✓    |
| SRC\_FRAGMENTS                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_HOST\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_CITY                       |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_COUNTRY                    |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_LAT                        |           |   ✓   |     ✓    |    ✓    |
| SRC\_IP\_LONG                       |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_ACTUAL\_MEMORY           |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_AVERAGE\_CPU\_LOAD       |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_NAME                     |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_NUM\_PAGE\_FAULTS        |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_PCTG\_IOWAIT             |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_PEAK\_MEMORY             |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_PID                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_UID                      |           |   ✓   |     ✓    |    ✓    |
| SRC\_PROC\_USER\_NAME               |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_AVG\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_MAX\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_MIN\_THROUGHPUT       |           |   ✓   |     ✓    |    ✓    |
| SRC\_TO\_DST\_SECOND\_BYTES         |           |   ✓   |     ✓    |    ✓    |
| SSDP\_HOST                          |           |   ✓   |     ✓    |    ✓    |
| SSDP\_METHOD                        |           |   ✓   |     ✓    |    ✓    |
| SSDP\_SERVER                        |           |   ✓   |     ✓    |    ✓    |
| SSDP\_TYPE                          |           |   ✓   |     ✓    |    ✓    |
| SSDP\_USN                           |           |   ✓   |     ✓    |    ✓    |
| SSL\_CIPHER                         |           |   ✓   |     ✓    |    ✓    |
| SSL\_SERVER\_NAME                   |           |   ✓   |     ✓    |    ✓    |
| SSL\_UNSAFE\_CIPHER                 |           |   ✓   |     ✓    |    ✓    |
| SSL\_VERSION                        |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MAX\_IN                   |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MAX\_OUT                  |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MIN\_IN                   |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MIN\_OUT                  |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MSS\_IN                   |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_MSS\_OUT                  |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_SCALE\_IN                 |           |   ✓   |     ✓    |    ✓    |
| TCP\_WIN\_SCALE\_OUT                |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV4\_DST\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV4\_SRC\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV6\_DST\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_IPV6\_SRC\_ADDR         |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_L4\_DST\_PORT           |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_L4\_SRC\_PORT           |           |   ✓   |     ✓    |    ✓    |
| UNTUNNELED\_PROTOCOL                |           |   ✓   |     ✓    |    ✓    |
| UPSTREAM\_SESSION\_ID               |           |   ✓   |     ✓    |    ✓    |
| UPSTREAM\_TUNNEL\_ID                |           |   ✓   |     ✓    |    ✓    |
| USER\_NAME                          |           |   ✓   |     ✓    |    ✓    |
| WHOIS\_DAS\_DOMAIN                  |           |   ✓   |     ✓    |    ✓    |

### INVEA-TECH/FlowMon Networks (PEN: 39499)

| Name                          | Community | Basic | Standard | Premium |
| ----------------------------- | :-------: | :---: | :------: | :-----: |
| arpHrd                        |           |   ✓   |     ✓    |    ✓    |
| arpOp                         |           |   ✓   |     ✓    |    ✓    |
| coapAccept                    |           |   ✓   |     ✓    |    ✓    |
| coapCode                      |           |   ✓   |     ✓    |    ✓    |
| coapContentFormat             |           |   ✓   |     ✓    |    ✓    |
| coapMid                       |           |   ✓   |     ✓    |    ✓    |
| coapOptionsCount              |           |   ✓   |     ✓    |    ✓    |
| coapToken                     |           |   ✓   |     ✓    |    ✓    |
| coapTokenLength               |           |   ✓   |     ✓    |    ✓    |
| coapType                      |           |   ✓   |     ✓    |    ✓    |
| coapUriHost                   |           |   ✓   |     ✓    |    ✓    |
| coapUriPath                   |           |   ✓   |     ✓    |    ✓    |
| coapUriQuery                  |           |   ✓   |     ✓    |    ✓    |
| coapVersion                   |           |   ✓   |     ✓    |    ✓    |
| dhcpDomainName                |           |   ✓   |     ✓    |    ✓    |
| dhcpHostMacAddr               |           |   ✓   |     ✓    |    ✓    |
| dhcpHostName                  |           |   ✓   |     ✓    |    ✓    |
| dhcpIpLeaseTime               |           |   ✓   |     ✓    |    ✓    |
| dhcpIpRequest                 |           |   ✓   |     ✓    |    ✓    |
| dhcpOfferedIp                 |           |   ✓   |     ✓    |    ✓    |
| dhcpServerIp                  |           |   ✓   |     ✓    |    ✓    |
| dhcpType                      |           |   ✓   |     ✓    |    ✓    |
| dlms\_action\_result          |           |   ✓   |     ✓    |    ✓    |
| dlms\_attr\_method\_id        |           |   ✓   |     ✓    |    ✓    |
| dlms\_class\_id               |           |   ✓   |     ✓    |    ✓    |
| dlms\_data\_access\_result    |           |   ✓   |     ✓    |    ✓    |
| dlms\_data\_length            |           |   ✓   |     ✓    |    ✓    |
| dlms\_data\_type              |           |   ✓   |     ✓    |    ✓    |
| dlms\_obis                    |           |   ✓   |     ✓    |    ✓    |
| dlms\_subtype                 |           |   ✓   |     ✓    |    ✓    |
| dlms\_type                    |           |   ✓   |     ✓    |    ✓    |
| dnsAddtrecCount               |           |   ✓   |     ✓    |    ✓    |
| dnsAnswrecCount               |           |   ✓   |     ✓    |    ✓    |
| dnsAuthrecCount               |           |   ✓   |     ✓    |    ✓    |
| dnsCrrClass                   |           |   ✓   |     ✓    |    ✓    |
| dnsCrrName                    |           |   ✓   |     ✓    |    ✓    |
| dnsCrrRdata                   |           |   ✓   |     ✓    |    ✓    |
| dnsCrrRdataLen                |           |   ✓   |     ✓    |    ✓    |
| dnsCrrTtl                     |           |   ✓   |     ✓    |    ✓    |
| dnsCrrType                    |           |   ✓   |     ✓    |    ✓    |
| dnsFlagsCodes                 |           |   ✓   |     ✓    |    ✓    |
| dnsId                         |           |   ✓   |     ✓    |    ✓    |
| dnsQclass                     |           |   ✓   |     ✓    |    ✓    |
| dnsQname                      |           |   ✓   |     ✓    |    ✓    |
| dnsQtype                      |           |   ✓   |     ✓    |    ✓    |
| dnsQuestionCount              |           |   ✓   |     ✓    |    ✓    |
| EGRESS\_ACL\_ID               |           |   ✓   |     ✓    |    ✓    |
| FW\_EXT\_EVENT                |           |   ✓   |     ✓    |    ✓    |
| gooseCocbRef                  |           |   ✓   |     ✓    |    ✓    |
| gooseDataset                  |           |   ✓   |     ✓    |    ✓    |
| gooseGocbRef                  |           |   ✓   |     ✓    |    ✓    |
| gooseGoID                     |           |   ✓   |     ✓    |    ✓    |
| gooseStNum                    |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestAgent              |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestAgentID            |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestHost               |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestReferer            |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestType               |           |   ✓   |     ✓    |    ✓    |
| HTTPRequestURL                |           |   ✓   |     ✓    |    ✓    |
| HTTPResponseCode              |           |   ✓   |     ✓    |    ✓    |
| HTTPResponseType              |           |   ✓   |     ✓    |    ✓    |
| httpUaApp                     |           |   ✓   |     ✓    |    ✓    |
| httpUaAppBld                  |           |   ✓   |     ✓    |    ✓    |
| httpUaAppMaj                  |           |   ✓   |     ✓    |    ✓    |
| httpUaAppMin                  |           |   ✓   |     ✓    |    ✓    |
| httpUaOs                      |           |   ✓   |     ✓    |    ✓    |
| httpUaOsBld                   |           |   ✓   |     ✓    |    ✓    |
| httpUaOsMaj                   |           |   ✓   |     ✓    |    ✓    |
| httpUaOsMin                   |           |   ✓   |     ✓    |    ✓    |
| iec104AsduAddress             |           |   ✓   |     ✓    |    ✓    |
| iec104AsduCot                 |           |   ✓   |     ✓    |    ✓    |
| iec104AsduObjCount            |           |   ✓   |     ✓    |    ✓    |
| iec104AsduOrg                 |           |   ✓   |     ✓    |    ✓    |
| iec104AsduType                |           |   ✓   |     ✓    |    ✓    |
| iec104FrameFmt                |           |   ✓   |     ✓    |    ✓    |
| iec104PktLength               |           |   ✓   |     ✓    |    ✓    |
| INGRESS\_ACL\_ID              |           |   ✓   |     ✓    |    ✓    |
| mailFailedAuthenticationCount |           |   ✓   |     ✓    |    ✓    |
| mailIsEncrypted               |           |   ✓   |     ✓    |    ✓    |
| mailUsername                  |           |   ✓   |     ✓    |    ✓    |
| mms\_conf\_service\_req       |           |   ✓   |     ✓    |    ✓    |
| mms\_conf\_service\_resp      |           |   ✓   |     ✓    |    ✓    |
| mms\_type                     |           |   ✓   |     ✓    |    ✓    |
| mms\_unconf\_service          |           |   ✓   |     ✓    |    ✓    |
| mysqlAuthMethodName           |           |   ✓   |     ✓    |    ✓    |
| mysqlCapabilitiesClient       |           |   ✓   |     ✓    |    ✓    |
| mysqlCapabilitiesServer       |           |   ✓   |     ✓    |    ✓    |
| mysqlCommand                  |           |   ✓   |     ✓    |    ✓    |
| mysqlDatabase                 |           |   ✓   |     ✓    |    ✓    |
| mysqlErrorCode                |           |   ✓   |     ✓    |    ✓    |
| mysqlProtocolVersion          |           |   ✓   |     ✓    |    ✓    |
| mysqlQuery                    |           |   ✓   |     ✓    |    ✓    |
| mysqlServerVersion            |           |   ✓   |     ✓    |    ✓    |
| mysqlUserAuthenticated        |           |   ✓   |     ✓    |    ✓    |
| mysqlUsername                 |           |   ✓   |     ✓    |    ✓    |
| NPMDelayAvg                   |           |   ✓   |     ✓    |    ✓    |
| NPMDelayDev                   |           |   ✓   |     ✓    |    ✓    |
| NPMDelayMax                   |           |   ✓   |     ✓    |    ✓    |
| NPMDelayMin                   |           |   ✓   |     ✓    |    ✓    |
| NPMJitterAvg                  |           |   ✓   |     ✓    |    ✓    |
| NPMJitterDev                  |           |   ✓   |     ✓    |    ✓    |
| NPMJitterMax                  |           |   ✓   |     ✓    |    ✓    |
| NPMJitterMin                  |           |   ✓   |     ✓    |    ✓    |
| NPMRoundTripTime              |           |   ✓   |     ✓    |    ✓    |
| NPMServerResponseTime         |           |   ✓   |     ✓    |    ✓    |
| NPMTCPOutOfOrder              |           |   ✓   |     ✓    |    ✓    |
| NPMTCPRetransmission          |           |   ✓   |     ✓    |    ✓    |
| pgsqlAuthMethod               |           |   ✓   |     ✓    |    ✓    |
| pgsqlDatabase                 |           |   ✓   |     ✓    |    ✓    |
| pgsqlErrorSeverity            |           |   ✓   |     ✓    |    ✓    |
| pgsqlErrorSqlstate            |           |   ✓   |     ✓    |    ✓    |
| pgsqlMsgTypeClient            |           |   ✓   |     ✓    |    ✓    |
| pgsqlMsgTypeServer            |           |   ✓   |     ✓    |    ✓    |
| pgsqlProtocolVersion          |           |   ✓   |     ✓    |    ✓    |
| pgsqlServerVersion            |           |   ✓   |     ✓    |    ✓    |
| pgsqlSqlQuery                 |           |   ✓   |     ✓    |    ✓    |
| pgsqlUsername                 |           |   ✓   |     ✓    |    ✓    |
| rtcpLost                      |           |   ✓   |     ✓    |    ✓    |
| rtcpOctets                    |           |   ✓   |     ✓    |    ✓    |
| rtcpPackets                   |           |   ✓   |     ✓    |    ✓    |
| rtcpSourceCount               |           |   ✓   |     ✓    |    ✓    |
| rtpCodec                      |           |   ✓   |     ✓    |    ✓    |
| rtpJitter                     |           |   ✓   |     ✓    |    ✓    |
| sipByeTime                    |           |   ✓   |     ✓    |    ✓    |
| sipCalledParty                |           |   ✓   |     ✓    |    ✓    |
| sipCallId                     |           |   ✓   |     ✓    |    ✓    |
| sipCallingParty               |           |   ✓   |     ✓    |    ✓    |
| sipCSeq                       |           |   ✓   |     ✓    |    ✓    |
| sipInviteRingingTime          |           |   ✓   |     ✓    |    ✓    |
| sipOkTime                     |           |   ✓   |     ✓    |    ✓    |
| sipRequestUri                 |           |   ✓   |     ✓    |    ✓    |
| sipRtpAudio                   |           |   ✓   |     ✓    |    ✓    |
| sipRtpIp4                     |           |   ✓   |     ✓    |    ✓    |
| sipRtpIp6                     |           |   ✓   |     ✓    |    ✓    |
| sipRtpVideo                   |           |   ✓   |     ✓    |    ✓    |
| sipStats                      |           |   ✓   |     ✓    |    ✓    |
| sipUserAgent                  |           |   ✓   |     ✓    |    ✓    |
| sipVia                        |           |   ✓   |     ✓    |    ✓    |
| smbCmd                        |           |   ✓   |     ✓    |    ✓    |
| smbFile                       |           |   ✓   |     ✓    |    ✓    |
| smbFileType                   |           |   ✓   |     ✓    |    ✓    |
| smbOp                         |           |   ✓   |     ✓    |    ✓    |
| smbTree                       |           |   ✓   |     ✓    |    ✓    |
| smtpEhloHelo                  |           |   ✓   |     ✓    |    ✓    |
| smtpMailFrom                  |           |   ✓   |     ✓    |    ✓    |
| tcpSynSize                    |           |   ✓   |     ✓    |    ✓    |
| tcpSynTtl                     |           |   ✓   |     ✓    |    ✓    |
| tdsClientVersion              |           |   ✓   |     ✓    |    ✓    |
| tdsDatabase                   |           |   ✓   |     ✓    |    ✓    |
| tdsEnchangeType               |           |   ✓   |     ✓    |    ✓    |
| tdsErrorCode                  |           |   ✓   |     ✓    |    ✓    |
| tdsHostname                   |           |   ✓   |     ✓    |    ✓    |
| tdsRequestType                |           |   ✓   |     ✓    |    ✓    |
| tdsResponseType               |           |   ✓   |     ✓    |    ✓    |
| tdsRpcName                    |           |   ✓   |     ✓    |    ✓    |
| tdsServerName                 |           |   ✓   |     ✓    |    ✓    |
| tdsServerVersion              |           |   ✓   |     ✓    |    ✓    |
| tdsSqlQuery                   |           |   ✓   |     ✓    |    ✓    |
| tdsTmrType                    |           |   ✓   |     ✓    |    ✓    |
| tdsToken                      |           |   ✓   |     ✓    |    ✓    |
| tdsUsername                   |           |   ✓   |     ✓    |    ✓    |
| tdsVersion                    |           |   ✓   |     ✓    |    ✓    |
| tlsAlpn                       |           |   ✓   |     ✓    |    ✓    |
| tlsCipherSuite                |           |   ✓   |     ✓    |    ✓    |
| tlsCipherSuites               |           |   ✓   |     ✓    |    ✓    |
| tlsClientKeyLength            |           |   ✓   |     ✓    |    ✓    |
| tlsClientRandom               |           |   ✓   |     ✓    |    ✓    |
| tlsClientSessionId            |           |   ✓   |     ✓    |    ✓    |
| tlsClientVersion              |           |   ✓   |     ✓    |    ✓    |
| tlsContentType                |           |   ✓   |     ✓    |    ✓    |
| tlsEcPointFormats             |           |   ✓   |     ✓    |    ✓    |
| tlsEllipticCurves             |           |   ✓   |     ✓    |    ✓    |
| tlsExtensionLengths           |           |   ✓   |     ✓    |    ✓    |
| tlsExtensionTypes             |           |   ✓   |     ✓    |    ✓    |
| tlsHandshakeType              |           |   ✓   |     ✓    |    ✓    |
| tlsIssuerCn                   |           |   ✓   |     ✓    |    ✓    |
| tlsJa3Fingerprint             |           |   ✓   |     ✓    |    ✓    |
| tlsPublicKeyAlg               |           |   ✓   |     ✓    |    ✓    |
| tlsPublicKeyLength            |           |   ✓   |     ✓    |    ✓    |
| tlsServerRandom               |           |   ✓   |     ✓    |    ✓    |
| tlsServerSessionId            |           |   ✓   |     ✓    |    ✓    |
| tlsServerVersion              |           |   ✓   |     ✓    |    ✓    |
| tlsSetupTime                  |           |   ✓   |     ✓    |    ✓    |
| tlsSignatureAlg               |           |   ✓   |     ✓    |    ✓    |
| tlsSni                        |           |   ✓   |     ✓    |    ✓    |
| tlsSniLength                  |           |   ✓   |     ✓    |    ✓    |
| tlsSubjectCn                  |           |   ✓   |     ✓    |    ✓    |
| tlsSubjectOn                  |           |   ✓   |     ✓    |    ✓    |
| tlsValidityNotAfter           |           |   ✓   |     ✓    |    ✓    |
| tlsValidityNotBefore          |           |   ✓   |     ✓    |    ✓    |
| username                      |           |   ✓   |     ✓    |    ✓    |
| voipPacketType                |           |   ✓   |     ✓    |    ✓    |
| vxlanVNI                      |           |   ✓   |     ✓    |    ✓    |
| xlateDestinationAddressIPV4   |           |   ✓   |     ✓    |    ✓    |
| xlateDestinationPort          |           |   ✓   |     ✓    |    ✓    |
| xlateSourceAddressIPV4        |           |   ✓   |     ✓    |    ✓    |
| xlateSourcePort               |           |   ✓   |     ✓    |    ✓    |

### A10 Networks (PEN: 40842)

| Name                       | Community | Basic | Standard | Premium |
| -------------------------- | :-------: | :---: | :------: | :-----: |
| cgn-flow-direction         |           |   ✓   |     ✓    |    ✓    |
| Custom1                    |           |   ✓   |     ✓    |    ✓    |
| Custom2                    |           |   ✓   |     ✓    |    ✓    |
| Custom3                    |           |   ✓   |     ✓    |    ✓    |
| DestZone                   |           |   ✓   |     ✓    |    ✓    |
| flowDurationMilliseconds64 |           |   ✓   |     ✓    |    ✓    |
| fwDenyReset                |           |   ✓   |     ✓    |    ✓    |
| fwdTupleType               |           |   ✓   |     ✓    |    ✓    |
| fwdVNPID                   |           |   ✓   |     ✓    |    ✓    |
| mobileIMEI                 |           |   ✓   |     ✓    |    ✓    |
| revTupleType               |           |   ✓   |     ✓    |    ✓    |
| revVNPID                   |           |   ✓   |     ✓    |    ✓    |
| RuleName                   |           |   ✓   |     ✓    |    ✓    |
| RuleSetName                |           |   ✓   |     ✓    |    ✓    |
| SourceZone                 |           |   ✓   |     ✓    |    ✓    |

### vIPtela, now Cisco (PEN: 41916)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| App\_Identifier |           |   ✓   |     ✓    |    ✓    |
| VPN\_Identifier |           |   ✓   |     ✓    |    ✓    |

### Versa Networks (PEN: 42359)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| appId       |           |   ✓   |     ✓    |    ✓    |
| applianceId |           |   ✓   |     ✓    |    ✓    |
| eventType   |           |   ✓   |     ✓    |    ✓    |
| tenentId    |           |   ✓   |     ✓    |    ✓    |

### pmacct (PEN: 43874)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| tag1 |           |   ✓   |     ✓    |    ✓    |
| tag2 |           |   ✓   |     ✓    |    ✓    |
| tag3 |           |   ✓   |     ✓    |    ✓    |
| tag4 |           |   ✓   |     ✓    |    ✓    |

### Allegro Packets (44237)

| Name                              | Community | Basic | Standard | Premium |
| --------------------------------- | :-------: | :---: | :------: | :-----: |
| allegroMessageType                |           |   ✓   |     ✓    |    ✓    |
| allegroUpdateIntervalMilliseconds |           |   ✓   |     ✓    |    ✓    |

### Ziften Technologies (PEN: 44619)

| Name                 | Community | Basic | Standard | Premium |
| -------------------- | :-------: | :---: | :------: | :-----: |
| ZAccountId           |           |   ✓   |     ✓    |    ✓    |
| ZAgentGUID           |           |   ✓   |     ✓    |    ✓    |
| ZBaseFilename        |           |   ✓   |     ✓    |    ✓    |
| ZCommandName         |           |   ✓   |     ✓    |    ✓    |
| ZCommandName         |           |   ✓   |     ✓    |    ✓    |
| ZFileSigAlgo         |           |   ✓   |     ✓    |    ✓    |
| ZFileSigAlgoChar     |           |   ✓   |     ✓    |    ✓    |
| ZFileSignature       |           |   ✓   |     ✓    |    ✓    |
| ZHostname            |           |   ✓   |     ✓    |    ✓    |
| ZImagePath           |           |   ✓   |     ✓    |    ✓    |
| ZInbound             |           |   ✓   |     ✓    |    ✓    |
| ZModTimeSeconds      |           |   ✓   |     ✓    |    ✓    |
| ZParentFileSignature |           |   ✓   |     ✓    |    ✓    |
| ZParentImagePath     |           |   ✓   |     ✓    |    ✓    |
| ZParentPid           |           |   ✓   |     ✓    |    ✓    |
| ZPid                 |           |   ✓   |     ✓    |    ✓    |
| ZPlatform            |           |   ✓   |     ✓    |    ✓    |
| ZUserSID             |           |   ✓   |     ✓    |    ✓    |

### RedSocks (PEN: 44913)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| http\_req\_host        |           |   ✓   |     ✓    |    ✓    |
| http\_req\_url         |           |   ✓   |     ✓    |    ✓    |
| http\_req\_user\_agent |           |   ✓   |     ✓    |    ✓    |
| orig\_dst\_ip          |           |   ✓   |     ✓    |    ✓    |
| orig\_dst\_ip          |           |   ✓   |     ✓    |    ✓    |
| orig\_dst\_port        |           |   ✓   |     ✓    |    ✓    |
| orig\_src\_ip          |           |   ✓   |     ✓    |    ✓    |
| orig\_src\_ip          |           |   ✓   |     ✓    |    ✓    |
| orig\_src\_port        |           |   ✓   |     ✓    |    ✓    |

### Velocloud Networks, now VMware (PEN: 45346)

| Name                             | Community | Basic | Standard | Premium |
| -------------------------------- | :-------: | :---: | :------: | :-----: |
| avgLatencyRxMs                   |           |   ✓   |     ✓    |    ✓    |
| avgLatencyTxMs                   |           |   ✓   |     ✓    |    ✓    |
| bizPolicyId                      |           |   ✓   |     ✓    |    ✓    |
| destinationUUID                  |           |   ✓   |     ✓    |    ✓    |
| firewallId                       |           |   ✓   |     ✓    |    ✓    |
| interfaceType                    |           |   ✓   |     ✓    |    ✓    |
| jitterRxMs                       |           |   ✓   |     ✓    |    ✓    |
| jitterTxMs                       |           |   ✓   |     ✓    |    ✓    |
| linkName                         |           |   ✓   |     ✓    |    ✓    |
| linkUUID                         |           |   ✓   |     ✓    |    ✓    |
| lostPacketsRxDeltaCount          |           |   ✓   |     ✓    |    ✓    |
| nextHopUUID                      |           |   ✓   |     ✓    |    ✓    |
| packetsLostDeltaTxCount          |           |   ✓   |     ✓    |    ✓    |
| primaryIpv4Address               |           |   ✓   |     ✓    |    ✓    |
| replicatedPacketsRxDeltaCount    |           |   ✓   |     ✓    |    ✓    |
| replicatedPacketsTxDeltaCount    |           |   ✓   |     ✓    |    ✓    |
| retransmittedPacketsTxDeltaCount |           |   ✓   |     ✓    |    ✓    |
| rxLossPercent                    |           |   ✓   |     ✓    |    ✓    |
| txLossPercent                    |           |   ✓   |     ✓    |    ✓    |
| vcFlowPath                       |           |   ✓   |     ✓    |    ✓    |
| vcLinkPolicy                     |           |   ✓   |     ✓    |    ✓    |
| vcPriority                       |           |   ✓   |     ✓    |    ✓    |
| vcRouteType                      |           |   ✓   |     ✓    |    ✓    |
| vcTrafficType                    |           |   ✓   |     ✓    |    ✓    |

### Cognitix (PEN: 45480)

| Name                           | Community | Basic | Standard | Premium |
| ------------------------------ | :-------: | :---: | :------: | :-----: |
| cognitixCountryDestination     |           |   ✓   |     ✓    |    ✓    |
| cognitixCountrySource          |           |   ✓   |     ✓    |    ✓    |
| cognitixDpiApplication         |           |   ✓   |     ✓    |    ✓    |
| cognitixDpiClassification      |           |   ✓   |     ✓    |    ✓    |
| cognitixDpiInSslClassification |           |   ✓   |     ✓    |    ✓    |
| cognitixDpiProtocol            |           |   ✓   |     ✓    |    ✓    |
| cognitixDpiSrcOS               |           |   ✓   |     ✓    |    ✓    |
| cognitixDstAssetId             |           |   ✓   |     ✓    |    ✓    |
| cognitixDstLocation            |           |   ✓   |     ✓    |    ✓    |
| cognitixFileTransferFilename   |           |   ✓   |     ✓    |    ✓    |
| cognitixIocFeedId              |           |   ✓   |     ✓    |    ✓    |
| cognitixIocFeedName            |           |   ✓   |     ✓    |    ✓    |
| cognitixIocValue               |           |   ✓   |     ✓    |    ✓    |
| cognitixIocValueType           |           |   ✓   |     ✓    |    ✓    |
| cognitixIPSRuleId              |           |   ✓   |     ✓    |    ✓    |
| cognitixLogSeverity            |           |   ✓   |     ✓    |    ✓    |
| cognitixPolicyId               |           |   ✓   |     ✓    |    ✓    |
| cognitixPolicyName             |           |   ✓   |     ✓    |    ✓    |
| cognitixPolicyRuleAction       |           |   ✓   |     ✓    |    ✓    |
| cognitixPolicyRuleId           |           |   ✓   |     ✓    |    ✓    |
| cognitixPolicyRuleName         |           |   ✓   |     ✓    |    ✓    |
| cognitixSrcAssetId             |           |   ✓   |     ✓    |    ✓    |
| cognitixSrcLocation            |           |   ✓   |     ✓    |    ✓    |
| cognitixUrl                    |           |   ✓   |     ✓    |    ✓    |
| cognitixUrlCategory            |           |   ✓   |     ✓    |    ✓    |
| cognitixUrlReputation          |           |   ✓   |     ✓    |    ✓    |
| cognitixUserId                 |           |   ✓   |     ✓    |    ✓    |

### Juniper Networks, was 128 Technology (PEN: 45956)

| Name                | Community | Basic | Standard | Premium |
| ------------------- | :-------: | :---: | :------: | :-----: |
| End Time            |           |   ✓   |     ✓    |    ✓    |
| Record Type         |           |   ✓   |     ✓    |    ✓    |
| Router Name         |           |   ✓   |     ✓    |    ✓    |
| Service Class       |           |   ✓   |     ✓    |    ✓    |
| Service Group       |           |   ✓   |     ✓    |    ✓    |
| Service Name        |           |   ✓   |     ✓    |    ✓    |
| Session ID          |           |   ✓   |     ✓    |    ✓    |
| Session Type        |           |   ✓   |     ✓    |    ✓    |
| Start Time          |           |   ✓   |     ✓    |    ✓    |
| TCP Retransmissions |           |   ✓   |     ✓    |    ✓    |
| Tenant              |           |   ✓   |     ✓    |    ✓    |
| Total Byte Count    |           |   ✓   |     ✓    |    ✓    |
| Total Packet Count  |           |   ✓   |     ✓    |    ✓    |

### Pluribus Networks (PEN: 47269)

| Name                | Community | Basic | Standard | Premium |
| ------------------- | :-------: | :---: | :------: | :-----: |
| LatencyMicroseconds |           |   ✓   |     ✓    |    ✓    |

### Niagara Networks (PEN: 47729)

| Name                                     | Community | Basic | Standard | Premium |
| ---------------------------------------- | :-------: | :---: | :------: | :-----: |
| DnsAdditionalClass                       |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalClassText                   |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalName                        |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalRData                       |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalRDLength                    |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalTTL                         |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalType                        |           |   ✓   |     ✓    |    ✓    |
| DnsAdditionalTypeText                    |           |   ✓   |     ✓    |    ✓    |
| DnsANCount                               |           |   ✓   |     ✓    |    ✓    |
| DnsARCount                               |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityClass                        |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityClassText                    |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityName                         |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityRData                        |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityRDLength                     |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityTTL                          |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityType                         |           |   ✓   |     ✓    |    ✓    |
| DnsAuthorityTypeText                     |           |   ✓   |     ✓    |    ✓    |
| DnsBits                                  |           |   ✓   |     ✓    |    ✓    |
| DnsIdentifier                            |           |   ✓   |     ✓    |    ✓    |
| DnsNSCount                               |           |   ✓   |     ✓    |    ✓    |
| DnsOpCode                                |           |   ✓   |     ✓    |    ✓    |
| DnsQDCount                               |           |   ✓   |     ✓    |    ✓    |
| DnsQueryClass                            |           |   ✓   |     ✓    |    ✓    |
| DnsQueryClassText                        |           |   ✓   |     ✓    |    ✓    |
| DnsQueryName                             |           |   ✓   |     ✓    |    ✓    |
| DnsQueryType                             |           |   ✓   |     ✓    |    ✓    |
| DnsQueryTypeText                         |           |   ✓   |     ✓    |    ✓    |
| DnsResponseClass                         |           |   ✓   |     ✓    |    ✓    |
| DnsResponseClassText                     |           |   ✓   |     ✓    |    ✓    |
| DnsResponseCode                          |           |   ✓   |     ✓    |    ✓    |
| DnsResponseIPv4Addr                      |           |   ✓   |     ✓    |    ✓    |
| DnsResponseIPv4AddrText                  |           |   ✓   |     ✓    |    ✓    |
| DnsResponseIPv6Addr                      |           |   ✓   |     ✓    |    ✓    |
| DnsResponseIPv6AddrText                  |           |   ✓   |     ✓    |    ✓    |
| DnsResponseName                          |           |   ✓   |     ✓    |    ✓    |
| DnsResponseRData                         |           |   ✓   |     ✓    |    ✓    |
| DnsResponseRDLength                      |           |   ✓   |     ✓    |    ✓    |
| DnsResponseTTL                           |           |   ✓   |     ✓    |    ✓    |
| DnsResponseType                          |           |   ✓   |     ✓    |    ✓    |
| DnsResponseTypeText                      |           |   ✓   |     ✓    |    ✓    |
| RadiusAcctInOctets                       |           |   ✓   |     ✓    |    ✓    |
| RadiusAcctInPackets                      |           |   ✓   |     ✓    |    ✓    |
| RadiusAcctOutOctets                      |           |   ✓   |     ✓    |    ✓    |
| RadiusAcctOutPackets                     |           |   ✓   |     ✓    |    ✓    |
| RadiusAcctSessionId                      |           |   ✓   |     ✓    |    ✓    |
| RadiusAcctStatusType                     |           |   ✓   |     ✓    |    ✓    |
| RadiusAuthenticator                      |           |   ✓   |     ✓    |    ✓    |
| RadiusCalledStationId                    |           |   ✓   |     ✓    |    ✓    |
| RadiusCallingStationId                   |           |   ✓   |     ✓    |    ✓    |
| RadiusFramedIpAddress                    |           |   ✓   |     ✓    |    ✓    |
| RadiusFramedIpv6Address                  |           |   ✓   |     ✓    |    ✓    |
| RadiusNasIdentifier                      |           |   ✓   |     ✓    |    ✓    |
| RadiusNasIpAddress                       |           |   ✓   |     ✓    |    ✓    |
| RadiusNasIpv6Address                     |           |   ✓   |     ✓    |    ✓    |
| RadiusPacketIdentifier                   |           |   ✓   |     ✓    |    ✓    |
| RadiusPacketTypeCode                     |           |   ✓   |     ✓    |    ✓    |
| RadiusPacketTypeCodeText                 |           |   ✓   |     ✓    |    ✓    |
| RadiusUserName                           |           |   ✓   |     ✓    |    ✓    |
| RadiusVsaId                              |           |   ✓   |     ✓    |    ✓    |
| RadiusVsaName                            |           |   ✓   |     ✓    |    ✓    |
| RadiusVsaValue                           |           |   ✓   |     ✓    |    ✓    |
| RadiusVsaVendorId                        |           |   ✓   |     ✓    |    ✓    |
| SslCertificateIssuer                     |           |   ✓   |     ✓    |    ✓    |
| SslCertificateIssuerName                 |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSerialNumber               |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSha1                       |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSignatureAlgorithm         |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSignatureAlgorithmText     |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubject                    |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubjectAlgorithmText       |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubjectAlternativeName     |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubjectName                |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubjectPublicAlgorithm     |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubjectPublicAlgorithmText |           |   ✓   |     ✓    |    ✓    |
| SslCertificateSubjectPublicKeySize       |           |   ✓   |     ✓    |    ✓    |
| SslCertificateValidNotAfter              |           |   ✓   |     ✓    |    ✓    |
| SslCertificateValidNotBefore             |           |   ✓   |     ✓    |    ✓    |
| SslConnectionEncryptionType              |           |   ✓   |     ✓    |    ✓    |
| SslServerCipher                          |           |   ✓   |     ✓    |    ✓    |
| SslServerCipherText                      |           |   ✓   |     ✓    |    ✓    |
| SslServerCompressionMethod               |           |   ✓   |     ✓    |    ✓    |
| SslServerNameIndication                  |           |   ✓   |     ✓    |    ✓    |
| SslServerSessionId                       |           |   ✓   |     ✓    |    ✓    |
| SslServerVersion                         |           |   ✓   |     ✓    |    ✓    |
| SslServerVersionText                     |           |   ✓   |     ✓    |    ✓    |

### AMD/Pensando Systems (PEN: 51886)

| Name                     | Community | Basic | Standard | Premium |
| ------------------------ | :-------: | :---: | :------: | :-----: |
| egress-interface-type    |           |   ✓   |     ✓    |    ✓    |
| egress-logical-interface |           |   ✓   |     ✓    |    ✓    |
| flow-state-index         |           |   ✓   |     ✓    |    ✓    |
| flowLastMilliSeconds     |           |   ✓   |     ✓    |    ✓    |
| pen1                     |           |   ✓   |     ✓    |    ✓    |
| role                     |           |   ✓   |     ✓    |    ✓    |
| subnetUUID               |           |   ✓   |     ✓    |    ✓    |
| tcp-exceptions           |           |   ✓   |     ✓    |    ✓    |
| tcp-rtt                  |           |   ✓   |     ✓    |    ✓    |
| tcp-state                |           |   ✓   |     ✓    |    ✓    |
| tcp-win-mss              |           |   ✓   |     ✓    |    ✓    |
| tcpRetransmitCount       |           |   ✓   |     ✓    |    ✓    |
| vpcUUID                  |           |   ✓   |     ✓    |    ✓    |

### Project Antrea/VMware (PEN: 56506)

| Name                                       | Community | Basic | Standard | Premium |
| ------------------------------------------ | :-------: | :---: | :------: | :-----: |
| appProtocolName                            |           |   ✓   |     ✓    |    ✓    |
| destinationClusterIPv4                     |           |   ✓   |     ✓    |    ✓    |
| destinationClusterIPv6                     |           |   ✓   |     ✓    |    ✓    |
| destinationNodeName                        |           |   ✓   |     ✓    |    ✓    |
| destinationPodName                         |           |   ✓   |     ✓    |    ✓    |
| destinationPodNamespace                    |           |   ✓   |     ✓    |    ✓    |
| destinationServicePort                     |           |   ✓   |     ✓    |    ✓    |
| destinationServicePortName                 |           |   ✓   |     ✓    |    ✓    |
| egressIP                                   |           |   ✓   |     ✓    |    ✓    |
| egressName                                 |           |   ✓   |     ✓    |    ✓    |
| egressNetworkPolicyName                    |           |   ✓   |     ✓    |    ✓    |
| egressNetworkPolicyNamespace               |           |   ✓   |     ✓    |    ✓    |
| egressNetworkPolicyRulePriority            |           |   ✓   |     ✓    |    ✓    |
| egressNetworkPolicyType                    |           |   ✓   |     ✓    |    ✓    |
| egressNetworkPolicyUID                     |           |   ✓   |     ✓    |    ✓    |
| flowEndSecondsFromDestinationNode          |           |   ✓   |     ✓    |    ✓    |
| flowEndSecondsFromSourceNode               |           |   ✓   |     ✓    |    ✓    |
| httpVals                                   |           |   ✓   |     ✓    |    ✓    |
| ingressNetworkPolicyName                   |           |   ✓   |     ✓    |    ✓    |
| ingressNetworkPolicyNamespace              |           |   ✓   |     ✓    |    ✓    |
| ingressNetworkPolicyRulePriority           |           |   ✓   |     ✓    |    ✓    |
| ingressNetworkPolicyType                   |           |   ✓   |     ✓    |    ✓    |
| ingressNetworkPolicyUID                    |           |   ✓   |     ✓    |    ✓    |
| octetDeltaCountFromDestinationNode         |           |   ✓   |     ✓    |    ✓    |
| octetDeltaCountFromSourceNode              |           |   ✓   |     ✓    |    ✓    |
| octetTotalCountFromDestinationNode         |           |   ✓   |     ✓    |    ✓    |
| octetTotalCountFromSourceNode              |           |   ✓   |     ✓    |    ✓    |
| packetDeltaCountFromDestinationNode        |           |   ✓   |     ✓    |    ✓    |
| packetDeltaCountFromSourceNode             |           |   ✓   |     ✓    |    ✓    |
| packetTotalCountFromDestinationNode        |           |   ✓   |     ✓    |    ✓    |
| packetTotalCountFromSourceNode             |           |   ✓   |     ✓    |    ✓    |
| reverseOctetDeltaCountFromDestinationNode  |           |   ✓   |     ✓    |    ✓    |
| reverseOctetDeltaCountFromSourceNode       |           |   ✓   |     ✓    |    ✓    |
| reverseOctetTotalCountFromDestinationNode  |           |   ✓   |     ✓    |    ✓    |
| reverseOctetTotalCountFromSourceNode       |           |   ✓   |     ✓    |    ✓    |
| reversePacketDeltaCountFromDestinationNode |           |   ✓   |     ✓    |    ✓    |
| reversePacketDeltaCountFromSourceNode      |           |   ✓   |     ✓    |    ✓    |
| reversePacketTotalCountFromDestinationNode |           |   ✓   |     ✓    |    ✓    |
| reversePacketTotalCountFromSourceNode      |           |   ✓   |     ✓    |    ✓    |
| reverseThroughput                          |           |   ✓   |     ✓    |    ✓    |
| reverseThroughputFromDestinationNode       |           |   ✓   |     ✓    |    ✓    |
| reverseThroughputFromSourceNode            |           |   ✓   |     ✓    |    ✓    |
| sourceNodeName                             |           |   ✓   |     ✓    |    ✓    |
| sourcePodName                              |           |   ✓   |     ✓    |    ✓    |
| sourcePodNamespace                         |           |   ✓   |     ✓    |    ✓    |
| throughput                                 |           |   ✓   |     ✓    |    ✓    |
| throughputFromDestinationNode              |           |   ✓   |     ✓    |    ✓    |
| throughputFromSourceNode                   |           |   ✓   |     ✓    |    ✓    |


# sFlow IEs

NetObserv Flow supports the following sFlow information elements (IE).

|  PEN | Sample Type | Vendor                               | IEs |
| ---: | ----------- | ------------------------------------ | --: |
|    0 | flow\_data  | flow\_sample                         |  10 |
|    0 | flow\_data  | sampled\_header                      | 160 |
|    0 | flow\_data  | sampled\_ethernet                    |   3 |
|    0 | flow\_data  | sampled\_ipv4                        |   7 |
|    0 | flow\_data  | sampled\_ipv6                        |   7 |
|    0 | flow\_data  | extended\_switch                     |   4 |
|    0 | flow\_data  | extended\_router                     |   3 |
|    0 | flow\_data  | extended\_gateway                    |   9 |
|    0 | flow\_data  | extended\_user                       |   4 |
|    0 | flow\_data  | extended\_url                        |   3 |
|    0 | flow\_data  | extended\_mpls                       |   3 |
|    0 | flow\_data  | extended\_nat                        |   2 |
|    0 | flow\_data  | extended\_mpls\_tunnel               |   3 |
|    0 | flow\_data  | extended\_mpls\_vc                   |   3 |
|    0 | flow\_data  | extended\_mpls\_FTN                  |   2 |
|    0 | flow\_data  | extended\_mpls\_LDP\_FEC             |   1 |
|    0 | flow\_data  | extended\_vlantunnel                 |   1 |
|    0 | flow\_data  | extended\_80211\_payload             |   2 |
|    0 | flow\_data  | extended\_80211\_rx                  |   8 |
|    0 | flow\_data  | extended\_80211\_tx                  |   9 |
|    0 | flow\_data  | extended\_openflow\_v1               |   3 |
|    0 | flow\_data  | extended\_fc                         |   6 |
|    0 | flow\_data  | extended\_queue\_length              |   2 |
|    0 | flow\_data  | extended\_nat\_port                  |   2 |
|    0 | flow\_data  | extended\_L2\_tunnel\_egress         |   3 |
|    0 | flow\_data  | extended\_L2\_tunnel\_ingress        |   3 |
|    0 | flow\_data  | extended\_ipv4\_tunnel\_egress       |   7 |
|    0 | flow\_data  | extended\_ipv4\_tunnel\_ingress      |   7 |
|    0 | flow\_data  | extended\_ipv6\_tunnel\_egress       |   7 |
|    0 | flow\_data  | extended\_ipv6\_tunnel\_ingress      |   7 |
|    0 | flow\_data  | extended\_decapsulate\_egress        |   1 |
|    0 | flow\_data  | extended\_decapsulate\_ingress       |   1 |
|    0 | flow\_data  | extended\_vni\_egress                |   1 |
|    0 | flow\_data  | extended\_vni\_ingress               |   1 |
|    0 | flow\_data  | extended\_ib\_lrh                    |  10 |
|    0 | flow\_data  | extended\_ib\_grh                    |   4 |
|    0 | flow\_data  | extended\_ib\_brh                    |   2 |
|    0 | flow\_data  | extended\_vlanin                     |   2 |
|    0 | flow\_data  | extended\_vlanout                    |   2 |
|    0 | flow\_data  | extended\_egress\_queue              |   1 |
|    0 | flow\_data  | extended\_acl                        |   3 |
|    0 | flow\_data  | extended\_function                   |   1 |
|    0 | flow\_data  | extended\_transit                    |   1 |
|    0 | flow\_data  | extended\_queue                      |   1 |
|    0 | flow\_data  | transaction                          |   6 |
|    0 | flow\_data  | extended\_nfs\_storage\_transaction  |   3 |
|    0 | flow\_data  | extensed\_scsi\_storage\_transaction |   3 |
|    0 | flow\_data  | extended\_http\_transaction          |   6 |
|    0 | flow\_data  | extended\_socket\_ipv4               |   5 |
|    0 | flow\_data  | extended\_socket\_ipv6               |   5 |
|    0 | flow\_data  | extended\_proxy\_socket\_ipv4        |   1 |
|    0 | flow\_data  | extended\_proxy\_socket\_ipv6        |   1 |
|    0 | flow\_data  | memcached\_operation                 |   7 |
|    0 | flow\_data  | http\_request (deprecated)           |   9 |
|    0 | flow\_data  | app\_operation                       |   8 |
|    0 | flow\_data  | app\_parent\_context                 |   3 |
|    0 | flow\_data  | app\_initiator                       |   1 |
|    0 | flow\_data  | app\_target                          |   1 |
|    0 | flow\_data  | http\_request                        |  13 |
|    0 | flow\_data  | extended\_proxy\_request             |   1 |
|    0 | flow\_data  | extended\_nav\_timing                |  23 |
|    0 | flow\_data  | extended\_tcp\_info                  |  12 |
|    0 | flow\_data  | extended\_entities                   |   2 |
| 4413 | flow\_data  | bst\_egress\_queue                   |   1 |

### Flow Samples

#### flow\_sample

| Name                      | Community | Basic | Standard | Premium |
| ------------------------- | :-------: | :---: | :------: | :-----: |
| sample\_sequence          |     ✓     |   ✓   |     ✓    |    ✓    |
| source\_id\_type          |     ✓     |   ✓   |     ✓    |    ✓    |
| source\_id                |     ✓     |   ✓   |     ✓    |    ✓    |
| sampling\_rate            |     ✓     |   ✓   |     ✓    |    ✓    |
| sample\_pool              |     ✓     |   ✓   |     ✓    |    ✓    |
| drops                     |     ✓     |   ✓   |     ✓    |    ✓    |
| interface\_format\_input  |     ✓     |   ✓   |     ✓    |    ✓    |
| interface\_input          |     ✓     |   ✓   |     ✓    |    ✓    |
| interface\_format\_output |     ✓     |   ✓   |     ✓    |    ✓    |
| interface\_output         |     ✓     |   ✓   |     ✓    |    ✓    |

#### sampled\_header (enterprise = 0, format = 1)

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| header\_protocol |     ✓     |   ✓   |     ✓    |    ✓    |
| frame\_length    |     ✓     |   ✓   |     ✓    |    ✓    |
| stripped         |     ✓     |   ✓   |     ✓    |    ✓    |
| length           |     ✓     |   ✓   |     ✓    |    ✓    |
| header           |     ✓     |   ✓   |     ✓    |    ✓    |

**Ethernet**

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| destination\_mac\_addr |     ✓     |   ✓   |     ✓    |    ✓    |
| source\_mac\_addr      |     ✓     |   ✓   |     ✓    |    ✓    |

**VLAN C-Tag "inner tag"**

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| c\_vlan\_pcp |     ✓     |   ✓   |     ✓    |    ✓    |
| c\_vlan\_dei |     ✓     |   ✓   |     ✓    |    ✓    |
| c\_vlan\_id  |     ✓     |   ✓   |     ✓    |    ✓    |

**VLAN S-Tag "outer tag"**

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| s\_vlan\_pcp |     ✓     |   ✓   |     ✓    |    ✓    |
| s\_vlan\_dei |     ✓     |   ✓   |     ✓    |    ✓    |
| s\_vlan\_id  |     ✓     |   ✓   |     ✓    |    ✓    |

**Internet Protocol version 4 (IPv4) (ether\_type: 0x0800)**

| Name                | Community | Basic | Standard | Premium |
| ------------------- | :-------: | :---: | :------: | :-----: |
| version             |     ✓     |   ✓   |     ✓    |    ✓    |
| dscp                |     ✓     |   ✓   |     ✓    |    ✓    |
| ecn                 |     ✓     |   ✓   |     ✓    |    ✓    |
| total\_length       |     ✓     |   ✓   |     ✓    |    ✓    |
| flags               |     ✓     |   ✓   |     ✓    |    ✓    |
| ttl                 |     ✓     |   ✓   |     ✓    |    ✓    |
| protocol            |     ✓     |   ✓   |     ✓    |    ✓    |
| source\_ipaddr      |     ✓     |   ✓   |     ✓    |    ✓    |
| destination\_ipaddr |     ✓     |   ✓   |     ✓    |    ✓    |
| options             |     ✓     |   ✓   |     ✓    |    ✓    |

**Internet Protocol version 6 (IPv6) (ether\_type: 0x86dd)**

| Name                | Community | Basic | Standard | Premium |
| ------------------- | :-------: | :---: | :------: | :-----: |
| version             |     ✓     |   ✓   |     ✓    |    ✓    |
| dscp                |     ✓     |   ✓   |     ✓    |    ✓    |
| ecn                 |     ✓     |   ✓   |     ✓    |    ✓    |
| flow\_label         |     ✓     |   ✓   |     ✓    |    ✓    |
| payload\_length     |     ✓     |   ✓   |     ✓    |    ✓    |
| next\_header        |     ✓     |   ✓   |     ✓    |    ✓    |
| hop\_limit          |     ✓     |   ✓   |     ✓    |    ✓    |
| source\_ipaddr      |     ✓     |   ✓   |     ✓    |    ✓    |
| destination\_ipaddr |     ✓     |   ✓   |     ✓    |    ✓    |
| ext\_route\_type    |     ✓     |   ✓   |     ✓    |    ✓    |
| ext\_route\_hops    |     ✓     |   ✓   |     ✓    |    ✓    |

**Point-to-Point Protocol over Ethernet (PPPoE) Discovery (ether\_type: 0x8863)**

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| code        |     ✓     |   ✓   |     ✓    |    ✓    |
| session\_id |     ✓     |   ✓   |     ✓    |    ✓    |
| ddl\_proto  |     ✓     |   ✓   |     ✓    |    ✓    |
| type        |     ✓     |   ✓   |     ✓    |    ✓    |
| version     |     ✓     |   ✓   |     ✓    |    ✓    |

**Point-to-Point Protocol over Ethernet (PPPoE) Session (ether\_type: 0x8864)**

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| code        |     ✓     |   ✓   |     ✓    |    ✓    |
| session\_id |     ✓     |   ✓   |     ✓    |    ✓    |
| ddl\_proto  |     ✓     |   ✓   |     ✓    |    ✓    |
| type        |     ✓     |   ✓   |     ✓    |    ✓    |
| version     |     ✓     |   ✓   |     ✓    |    ✓    |

**Transmission Control Protocol (TCP)**

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| header\_size     |     ✓     |   ✓   |     ✓    |    ✓    |
| source port      |     ✓     |   ✓   |     ✓    |    ✓    |
| destination port |     ✓     |   ✓   |     ✓    |    ✓    |
| flags            |     ✓     |   ✓   |     ✓    |    ✓    |
| seq              |     ✓     |   ✓   |     ✓    |    ✓    |
| ack              |     ✓     |   ✓   |     ✓    |    ✓    |
| window           |     ✓     |   ✓   |     ✓    |    ✓    |
| urgent\_pointer  |     ✓     |   ✓   |     ✓    |    ✓    |
| options          |     ✓     |   ✓   |     ✓    |    ✓    |

**User Datagram Protocol (UDP)**

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| source\_port      |     ✓     |   ✓   |     ✓    |    ✓    |
| destination\_port |     ✓     |   ✓   |     ✓    |    ✓    |
| pdu\_length       |     ✓     |   ✓   |     ✓    |    ✓    |

**Authentication Header (AH)**

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| icv  |     ✓     |   ✓   |     ✓    |    ✓    |
| spi  |     ✓     |   ✓   |     ✓    |    ✓    |

**Address Resolution Protocol (ARP)**

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| dst\_hw\_addr    |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_proto\_addr |     ✓     |   ✓   |     ✓    |    ✓    |
| hw\_type         |     ✓     |   ✓   |     ✓    |    ✓    |
| op\_code         |     ✓     |   ✓   |     ✓    |    ✓    |
| proto\_type      |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_hw\_addr    |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_proto\_addr |     ✓     |   ✓   |     ✓    |    ✓    |

**Border Gateway Protocol (BGP)**

| Name           | Community | Basic | Standard | Premium |
| -------------- | :-------: | :---: | :------: | :-----: |
| error\_code    |     ✓     |   ✓   |     ✓    |    ✓    |
| error\_subcode |     ✓     |   ✓   |     ✓    |    ✓    |
| hold\_time     |     ✓     |   ✓   |     ✓    |    ✓    |
| msg\_type      |     ✓     |   ✓   |     ✓    |    ✓    |
| route\_afi     |     ✓     |   ✓   |     ✓    |    ✓    |
| route\_safi    |     ✓     |   ✓   |     ✓    |    ✓    |
| router\_as     |     ✓     |   ✓   |     ✓    |    ✓    |
| router\_ip     |     ✓     |   ✓   |     ✓    |    ✓    |
| version        |     ✓     |   ✓   |     ✓    |    ✓    |

**Encapsulating Security Payload (ESP)**

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| spi  |     ✓     |   ✓   |     ✓    |    ✓    |

**Generic Routing Encapsulation (GRE)**

| Name                | Community | Basic | Standard | Premium |
| ------------------- | :-------: | :---: | :------: | :-----: |
| flow\_id            |     ✓     |   ✓   |     ✓    |    ✓    |
| key                 |     ✓     |   ✓   |     ✓    |    ✓    |
| pptp\_call\_id      |     ✓     |   ✓   |     ✓    |    ✓    |
| pptp\_payload\_size |     ✓     |   ✓   |     ✓    |    ✓    |
| version             |     ✓     |   ✓   |     ✓    |    ✓    |
| vsid                |     ✓     |   ✓   |     ✓    |    ✓    |

**Internet Control Message Protocol (ICMP)**

| Name                       | Community | Basic | Standard | Premium |
| -------------------------- | :-------: | :---: | :------: | :-----: |
| v4\_code                   |     ✓     |   ✓   |     ✓    |    ✓    |
| v4\_type                   |     ✓     |   ✓   |     ✓    |    ✓    |
| v6\_code                   |     ✓     |   ✓   |     ✓    |    ✓    |
| v6\_type                   |     ✓     |   ✓   |     ✓    |    ✓    |
| conv\_error\_pointer       |     ✓     |   ✓   |     ✓    |    ✓    |
| dns\_names                 |     ✓     |   ✓   |     ✓    |    ✓    |
| dns\_ttl                   |     ✓     |   ✓   |     ✓    |    ✓    |
| echo\_ext\_req\_flags      |     ✓     |   ✓   |     ✓    |    ✓    |
| echo\_ext\_resp\_flags     |     ✓     |   ✓   |     ✓    |    ✓    |
| echo\_ext\_state           |     ✓     |   ✓   |     ✓    |    ✓    |
| id                         |     ✓     |   ✓   |     ✓    |    ✓    |
| mobile\_subtype            |     ✓     |   ✓   |     ✓    |    ✓    |
| param\_error\_pointer      |     ✓     |   ✓   |     ✓    |    ✓    |
| photuris\_pointer          |     ✓     |   ✓   |     ✓    |    ✓    |
| redirect\_next\_hop        |     ✓     |   ✓   |     ✓    |    ✓    |
| router\_advert\_addrs      |     ✓     |   ✓   |     ✓    |    ✓    |
| router\_advert\_size       |     ✓     |   ✓   |     ✓    |    ✓    |
| router\_advert\_lifetime   |     ✓     |   ✓   |     ✓    |    ✓    |
| seq\_num                   |     ✓     |   ✓   |     ✓    |    ✓    |
| subnet\_mask               |     ✓     |   ✓   |     ✓    |    ✓    |
| timestamp\_origin          |     ✓     |   ✓   |     ✓    |    ✓    |
| timestamp\_rx              |     ✓     |   ✓   |     ✓    |    ✓    |
| timestamp\_tx              |     ✓     |   ✓   |     ✓    |    ✓    |
| traceroute\_id             |     ✓     |   ✓   |     ✓    |    ✓    |
| traceroute\_hops\_out      |     ✓     |   ✓   |     ✓    |    ✓    |
| traceroute\_hops\_in       |     ✓     |   ✓   |     ✓    |    ✓    |
| traceroute\_bandwidth\_out |     ✓     |   ✓   |     ✓    |    ✓    |
| traceroute\_mtu\_out       |     ✓     |   ✓   |     ✓    |    ✓    |

**Inband Flow Analyzer (IFA)**

| Name                       | Community | Basic | Standard | Premium |
| -------------------------- | :-------: | :---: | :------: | :-----: |
| flags                      |     ✓     |   ✓   |     ✓    |    ✓    |
| gns                        |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_action           |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_frag\_id         |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_frag\_last       |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_frag\_packet\_id |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_size\_max        |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_req              |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_size             |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_ttl              |     ✓     |   ✓   |     ✓    |    ✓    |

**Internet Group Management Protocol (IGMP)**

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| group           |     ✓     |   ✓   |     ✓    |    ✓    |
| max\_resp\_time |     ✓     |   ✓   |     ✓    |    ✓    |
| type            |     ✓     |   ✓   |     ✓    |    ✓    |

**Logical Link Control (LLC)**

| Name                     | Community | Basic | Standard | Premium |
| ------------------------ | :-------: | :---: | :------: | :-----: |
| dsap                     |     ✓     |   ✓   |     ✓    |    ✓    |
| dsap\_u                  |     ✓     |   ✓   |     ✓    |    ✓    |
| dsap\_ig                 |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_frame\_type        |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_info\_seq\_curr    |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_info\_seq\_next    |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_pf                 |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_super\_frame\_type |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_super\_seq\_next   |     ✓     |   ✓   |     ✓    |    ✓    |
| lpdu\_unnum\_frame\_type |     ✓     |   ✓   |     ✓    |    ✓    |
| ssap                     |     ✓     |   ✓   |     ✓    |    ✓    |
| ssap\_u                  |     ✓     |   ✓   |     ✓    |    ✓    |
| ssap\_cr                 |     ✓     |   ✓   |     ✓    |    ✓    |

**Multi-Protocol Label Switching (MPLS)**

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| mpls\_label |     ✓     |   ✓   |     ✓    |    ✓    |
| mpls\_tc    |     ✓     |   ✓   |     ✓    |    ✓    |
| mpls\_ttl   |     ✓     |   ✓   |     ✓    |    ✓    |

**Network Service Header (NSH)**

| Name                 | Community | Basic | Standard | Premium |
| -------------------- | :-------: | :---: | :------: | :-----: |
| flag\_oam\_bit       |     ✓     |   ✓   |     ✓    |    ✓    |
| metadata\_type       |     ✓     |   ✓   |     ✓    |    ✓    |
| sfp\_si              |     ✓     |   ✓   |     ✓    |    ✓    |
| sfp\_spi             |     ✓     |   ✓   |     ✓    |    ✓    |
| ttl                  |     ✓     |   ✓   |     ✓    |    ✓    |
| version              |     ✓     |   ✓   |     ✓    |    ✓    |
| opt\_metadata\_class |     ✓     |   ✓   |     ✓    |    ✓    |
| opt\_metadata\_type  |     ✓     |   ✓   |     ✓    |    ✓    |
| opt\_payload         |     ✓     |   ✓   |     ✓    |    ✓    |

**Open Shortest Path First (OSPF)**

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| version    |     ✓     |   ✓   |     ✓    |    ✓    |
| router\_ip |     ✓     |   ✓   |     ✓    |    ✓    |
| area       |     ✓     |   ✓   |     ✓    |    ✓    |
| auth\_code |     ✓     |   ✓   |     ✓    |    ✓    |
| msg\_type  |     ✓     |   ✓   |     ✓    |    ✓    |
| inst\_id   |     ✓     |   ✓   |     ✓    |    ✓    |

**Point-to-Point Protocol (PPP)**

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| addr         |     ✓     |   ✓   |     ✓    |    ✓    |
| cntrl\_value |     ✓     |   ✓   |     ✓    |    ✓    |
| dll\_proto   |     ✓     |   ✓   |     ✓    |    ✓    |

**Pseudowire**

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| pwe3\_seq |     ✓     |   ✓   |     ✓    |    ✓    |

**Subnetwork Access Protocol (SNAP)**

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| oui  |     ✓     |   ✓   |     ✓    |    ✓    |

**Virtual Extensible LAN (VXLAN)**

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| flags |     ✓     |   ✓   |     ✓    |    ✓    |
| vni   |     ✓     |   ✓   |     ✓    |    ✓    |

#### sampled\_ethernet (enterprise = 0, format = 2)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| source\_mac\_addr      |     ✓     |   ✓   |     ✓    |    ✓    |
| destination\_mac\_addr |     ✓     |   ✓   |     ✓    |    ✓    |
| eth\_type              |     ✓     |   ✓   |     ✓    |    ✓    |

#### sampled\_ipv4 (enterprise = 0, format = 3)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ip\_protocol |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_ip      |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_ip      |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_port    |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_port    |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |     ✓     |   ✓   |     ✓    |    ✓    |
| tos          |     ✓     |   ✓   |     ✓    |    ✓    |

#### sampled\_ipv6 (enterprise = 0, format = 4)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ip\_protocol |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_ip      |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_ip      |     ✓     |   ✓   |     ✓    |    ✓    |
| src\_port    |     ✓     |   ✓   |     ✓    |    ✓    |
| dst\_port    |     ✓     |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |     ✓     |   ✓   |     ✓    |    ✓    |
| ip\_priority |     ✓     |   ✓   |     ✓    |    ✓    |

#### extended\_switch (enterprise = 0, format = 1001)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| src\_vlan     |           |   ✓   |     ✓    |    ✓    |
| src\_priority |           |   ✓   |     ✓    |    ✓    |
| dst\_vlan     |           |   ✓   |     ✓    |    ✓    |
| dst\_priority |           |   ✓   |     ✓    |    ✓    |

#### extended\_router (enterprise = 0, format = 1002)

| Name           | Community | Basic | Standard | Premium |
| -------------- | :-------: | :---: | :------: | :-----: |
| next\_hop      |           |   ✓   |     ✓    |    ✓    |
| src\_mask\_len |           |   ✓   |     ✓    |    ✓    |
| dst\_mask\_len |           |   ✓   |     ✓    |    ✓    |

#### extended\_gateway (enterprise = 0, format = 1003)

| Name               | Community | Basic | Standard | Premium |
| ------------------ | :-------: | :---: | :------: | :-----: |
| next\_hop          |           |   ✓   |     ✓    |    ✓    |
| router\_as         |           |   ✓   |     ✓    |    ✓    |
| source\_as         |           |   ✓   |     ✓    |    ✓    |
| source\_peer\_as   |           |   ✓   |     ✓    |    ✓    |
| destination\_count |           |   ✓   |     ✓    |    ✓    |
| destinations       |           |   ✓   |     ✓    |    ✓    |
| community\_count   |           |   ✓   |     ✓    |    ✓    |
| communities        |           |   ✓   |     ✓    |    ✓    |
| localpref          |           |   ✓   |     ✓    |    ✓    |

#### extended\_user (enterprise = 0, format = 1004)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| src\_charset |           |   ✓   |     ✓    |    ✓    |
| src\_user    |           |   ✓   |     ✓    |    ✓    |
| dst\_charset |           |   ✓   |     ✓    |    ✓    |
| dst\_user    |           |   ✓   |     ✓    |    ✓    |

#### extended\_url (enterprise = 0, format = 1005)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| direction |           |   ✓   |     ✓    |    ✓    |
| url       |           |   ✓   |     ✓    |    ✓    |
| host      |           |   ✓   |     ✓    |    ✓    |

#### extended\_mpls (enterprise = 0, format = 1006)

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| nexthop    |           |   ✓   |     ✓    |    ✓    |
| in\_stack  |           |   ✓   |     ✓    |    ✓    |
| out\_stack |           |   ✓   |     ✓    |    ✓    |

#### extended\_nat (enterprise = 0, format = 1007)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| src\_address |           |   ✓   |     ✓    |    ✓    |
| dst\_address |           |   ✓   |     ✓    |    ✓    |

#### extended\_mpls\_tunnel (enterprise = 0, format = 1008)

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| tunnel\_lsp\_name |           |   ✓   |     ✓    |    ✓    |
| tunnel\_id        |           |   ✓   |     ✓    |    ✓    |
| tunnel\_cos       |           |   ✓   |     ✓    |    ✓    |

#### extended\_mpls\_vc (enterprise = 0, format = 1009)

| Name               | Community | Basic | Standard | Premium |
| ------------------ | :-------: | :---: | :------: | :-----: |
| vc\_instance\_name |           |   ✓   |     ✓    |    ✓    |
| vll\_vc\_id        |           |   ✓   |     ✓    |    ✓    |
| vc\_label\_cos     |           |   ✓   |     ✓    |    ✓    |

#### extended\_mpls\_FTN (enterprise = 0, format = 1010)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| mplsFTNDescr |           |   ✓   |     ✓    |    ✓    |
| mplsFTNMask  |           |   ✓   |     ✓    |    ✓    |

#### extended\_mpls\_LDP\_FEC (enterprise = 0, format = 1011)

| Name                    | Community | Basic | Standard | Premium |
| ----------------------- | :-------: | :---: | :------: | :-----: |
| mplsFecAddrPrefixLength |           |   ✓   |     ✓    |    ✓    |

#### extended\_vlantunnel (enterprise = 0, format = 1012)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| stack |           |   ✓   |     ✓    |    ✓    |

#### extended\_80211\_payload (enterprise = 0, format = 1013)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| ciphersuite |           |   ✓   |     ✓    |    ✓    |
| data        |           |   ✓   |     ✓    |    ✓    |

#### extended\_80211\_rx (enterprise = 0, format = 1014)

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| ssid             |           |   ✓   |     ✓    |    ✓    |
| bssid            |           |   ✓   |     ✓    |    ✓    |
| version          |           |   ✓   |     ✓    |    ✓    |
| channel          |           |   ✓   |     ✓    |    ✓    |
| speed            |           |   ✓   |     ✓    |    ✓    |
| rsni             |           |   ✓   |     ✓    |    ✓    |
| rcpi             |           |   ✓   |     ✓    |    ✓    |
| packet\_duration |           |   ✓   |     ✓    |    ✓    |

#### extended\_80211\_tx (enterprise = 0, format = 1015)

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| ssid              |           |   ✓   |     ✓    |    ✓    |
| bssid             |           |   ✓   |     ✓    |    ✓    |
| version           |           |   ✓   |     ✓    |    ✓    |
| transmissions     |           |   ✓   |     ✓    |    ✓    |
| packet\_duration  |           |   ✓   |     ✓    |    ✓    |
| retrans\_duration |           |   ✓   |     ✓    |    ✓    |
| channel           |           |   ✓   |     ✓    |    ✓    |
| speed             |           |   ✓   |     ✓    |    ✓    |
| power             |           |   ✓   |     ✓    |    ✓    |

#### extended\_openflow\_v1 (enterprise = 0, format = 1017)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| flow\_cookie  |           |   ✓   |     ✓    |    ✓    |
| flow\_match   |           |   ✓   |     ✓    |    ✓    |
| flow\_actions |           |   ✓   |     ✓    |    ✓    |

#### extended\_fc (enterprise = 0, format = 1018)

| Name                          | Community | Basic | Standard | Premium |
| ----------------------------- | :-------: | :---: | :------: | :-----: |
| t11FcRouteSrcMask             |           |   ✓   |     ✓    |    ✓    |
| t11FcRouteDestMask            |           |   ✓   |     ✓    |    ✓    |
| next\_hop\_t11FcRouteDomainId |           |   ✓   |     ✓    |    ✓    |
| t11FcRouteType                |           |   ✓   |     ✓    |    ✓    |
| t11FcRouteProto               |           |   ✓   |     ✓    |    ✓    |
| t11FcRouteMetric              |           |   ✓   |     ✓    |    ✓    |

#### extended\_queue\_length (enterprise = 0, format = 1019)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| queueIndex  |           |   ✓   |     ✓    |    ✓    |
| queueLength |           |   ✓   |     ✓    |    ✓    |

#### extended\_nat\_port (enterprise = 0, format = 1020)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| src\_port |           |   ✓   |     ✓    |    ✓    |
| dst\_port |           |   ✓   |     ✓    |    ✓    |

#### extended\_L2\_tunnel\_egress (enterprise = 0, format = 1021)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| source\_mac\_addr      |           |   ✓   |     ✓    |    ✓    |
| destination\_mac\_addr |           |   ✓   |     ✓    |    ✓    |
| eth\_type              |           |   ✓   |     ✓    |    ✓    |

#### extended\_L2\_tunnel\_ingress (enterprise = 0, format = 1022)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| source\_mac\_addr      |           |   ✓   |     ✓    |    ✓    |
| destination\_mac\_addr |           |   ✓   |     ✓    |    ✓    |
| eth\_type              |           |   ✓   |     ✓    |    ✓    |

#### extended\_ipv4\_tunnel\_egress (enterprise = 0, format = 1023)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ip\_protocol |           |   ✓   |     ✓    |    ✓    |
| src\_ip      |           |   ✓   |     ✓    |    ✓    |
| dst\_ip      |           |   ✓   |     ✓    |    ✓    |
| src\_port    |           |   ✓   |     ✓    |    ✓    |
| dst\_port    |           |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |           |   ✓   |     ✓    |    ✓    |
| tos          |           |   ✓   |     ✓    |    ✓    |

#### extended\_ipv4\_tunnel\_ingress (enterprise = 0, format = 1024)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ip\_protocol |           |   ✓   |     ✓    |    ✓    |
| src\_ip      |           |   ✓   |     ✓    |    ✓    |
| dst\_ip      |           |   ✓   |     ✓    |    ✓    |
| src\_port    |           |   ✓   |     ✓    |    ✓    |
| dst\_port    |           |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |           |   ✓   |     ✓    |    ✓    |
| tos          |           |   ✓   |     ✓    |    ✓    |

#### extended\_ipv6\_tunnel\_egress (enterprise = 0, format = 1025)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ip\_protocol |           |   ✓   |     ✓    |    ✓    |
| src\_ip      |           |   ✓   |     ✓    |    ✓    |
| dst\_ip      |           |   ✓   |     ✓    |    ✓    |
| src\_port    |           |   ✓   |     ✓    |    ✓    |
| dst\_port    |           |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |           |   ✓   |     ✓    |    ✓    |
| ip\_priority |           |   ✓   |     ✓    |    ✓    |

#### extended\_ipv6\_tunnel\_ingress (enterprise = 0, format = 1026)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ip\_protocol |           |   ✓   |     ✓    |    ✓    |
| src\_ip      |           |   ✓   |     ✓    |    ✓    |
| dst\_ip      |           |   ✓   |     ✓    |    ✓    |
| src\_port    |           |   ✓   |     ✓    |    ✓    |
| dst\_port    |           |   ✓   |     ✓    |    ✓    |
| tcp\_flags   |           |   ✓   |     ✓    |    ✓    |
| ip\_priority |           |   ✓   |     ✓    |    ✓    |

#### extended\_decapsulate\_egress (enterprise = 0, format = 1027)

| Name                  | Community | Basic | Standard | Premium |
| --------------------- | :-------: | :---: | :------: | :-----: |
| inner\_header\_offset |           |   ✓   |     ✓    |    ✓    |

#### extended\_decapsulate\_ingress (enterprise = 0, format = 1028)

| Name                  | Community | Basic | Standard | Premium |
| --------------------- | :-------: | :---: | :------: | :-----: |
| inner\_header\_offset |           |   ✓   |     ✓    |    ✓    |

#### extended\_vni\_egress (enterprise = 0, format = 1029)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| vni  |           |   ✓   |     ✓    |    ✓    |

#### extended\_vni\_ingress (enterprise = 0, format = 1030)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| vni  |           |   ✓   |     ✓    |    ✓    |

#### extended\_ib\_lrh (enterprise = 0, format = 1031)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| src\_vl   |           |   ✓   |     ✓    |    ✓    |
| src\_sl   |           |   ✓   |     ✓    |    ✓    |
| src\_dlid |           |   ✓   |     ✓    |    ✓    |
| src\_slid |           |   ✓   |     ✓    |    ✓    |
| src\_lnh  |           |   ✓   |     ✓    |    ✓    |
| dst\_vl   |           |   ✓   |     ✓    |    ✓    |
| dst\_sl   |           |   ✓   |     ✓    |    ✓    |
| dst\_dlid |           |   ✓   |     ✓    |    ✓    |
| dst\_slid |           |   ✓   |     ✓    |    ✓    |
| dest\_lnh |           |   ✓   |     ✓    |    ✓    |

#### extended\_ib\_grh (enterprise = 0, format = 1032)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| flow\_label |           |   ✓   |     ✓    |    ✓    |
| tc          |           |   ✓   |     ✓    |    ✓    |
| s\_gid      |           |   ✓   |     ✓    |    ✓    |
| d\_gid      |           |   ✓   |     ✓    |    ✓    |

#### extended\_ib\_brh (enterprise = 0, format = 1033)

| Name    | Community | Basic | Standard | Premium |
| ------- | :-------: | :---: | :------: | :-----: |
| pky     |           |   ✓   |     ✓    |    ✓    |
| dst\_qp |           |   ✓   |     ✓    |    ✓    |

#### extended\_vlanin (enterprise = 0, format = 1034)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| tpid |           |   ✓   |     ✓    |    ✓    |
| tci  |           |   ✓   |     ✓    |    ✓    |

#### extended\_vlanout (enterprise = 0, format = 1035)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| tpid |           |   ✓   |     ✓    |    ✓    |
| tci  |           |   ✓   |     ✓    |    ✓    |

#### extended\_egress\_queue (enterprise = 0, format = 1036)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| queue |           |   ✓   |     ✓    |    ✓    |

#### extended\_acl (enterprise = 0, format = 1037)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| acl\_number |           |   ✓   |     ✓    |    ✓    |
| acl\_name   |           |   ✓   |     ✓    |    ✓    |
| direction   |           |   ✓   |     ✓    |    ✓    |

#### extended\_function (enterprise = 0, format = 1038)

| Name   | Community | Basic | Standard | Premium |
| ------ | :-------: | :---: | :------: | :-----: |
| symbol |           |   ✓   |     ✓    |    ✓    |

#### extended\_transit (enterprise = 0, format = 1039)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| delay |           |   ✓   |     ✓    |    ✓    |

#### extended\_queue (enterprise = 0, format = 1040)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| depth |           |   ✓   |     ✓    |    ✓    |

#### transaction (enterprise = 0, format = 2000)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| direction       |           |   ✓   |     ✓    |    ✓    |
| wait            |           |   ✓   |     ✓    |    ✓    |
| duration        |           |   ✓   |     ✓    |    ✓    |
| status          |           |   ✓   |     ✓    |    ✓    |
| bytes\_received |           |   ✓   |     ✓    |    ✓    |
| bytes\_send     |           |   ✓   |     ✓    |    ✓    |

#### extended\_nfs\_storage\_transaction (enterprise = 0, format = 2001)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| path      |           |   ✓   |     ✓    |    ✓    |
| operation |           |   ✓   |     ✓    |    ✓    |
| status    |           |   ✓   |     ✓    |    ✓    |

#### extensed\_scsi\_storage\_transaction (enterprise = 0, format = 2002)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| lun       |           |   ✓   |     ✓    |    ✓    |
| operation |           |   ✓   |     ✓    |    ✓    |
| status    |           |   ✓   |     ✓    |    ✓    |

#### extended\_http\_transaction (enterprise = 0, format = 2003)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| url       |           |   ✓   |     ✓    |    ✓    |
| host      |           |   ✓   |     ✓    |    ✓    |
| referer   |           |   ✓   |     ✓    |    ✓    |
| useragent |           |   ✓   |     ✓    |    ✓    |
| user      |           |   ✓   |     ✓    |    ✓    |
| status    |           |   ✓   |     ✓    |    ✓    |

#### extended\_socket\_ipv4 (enterprise = 0, format = 2100)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| protocol     |           |   ✓   |     ✓    |    ✓    |
| local\_ip    |           |   ✓   |     ✓    |    ✓    |
| remote\_ip   |           |   ✓   |     ✓    |    ✓    |
| local\_port  |           |   ✓   |     ✓    |    ✓    |
| remote\_port |           |   ✓   |     ✓    |    ✓    |

#### extended\_socket\_ipv6 (enterprise = 0, format = 2101)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| protocol     |           |   ✓   |     ✓    |    ✓    |
| local\_ip    |           |   ✓   |     ✓    |    ✓    |
| remote\_ip   |           |   ✓   |     ✓    |    ✓    |
| local\_port  |           |   ✓   |     ✓    |    ✓    |
| remote\_port |           |   ✓   |     ✓    |    ✓    |

#### extended\_proxy\_socket\_ipv4 (enterprise = 0, format = 2102)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| extended\_socket\_ipv4 |           |   ✓   |     ✓    |    ✓    |

#### extended\_proxy\_socket\_ipv6 (enterprise = 0, format = 2103)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| extended\_socket\_ipv6 |           |   ✓   |     ✓    |    ✓    |

#### memcached\_operation (enterprise = 0, format = 2200)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| protocol     |           |   ✓   |     ✓    |    ✓    |
| cmd          |           |   ✓   |     ✓    |    ✓    |
| key          |           |   ✓   |     ✓    |    ✓    |
| nkeys        |           |   ✓   |     ✓    |    ✓    |
| value\_bytes |           |   ✓   |     ✓    |    ✓    |
| uS           |           |   ✓   |     ✓    |    ✓    |
| status       |           |   ✓   |     ✓    |    ✓    |

#### http\_request (enterprise = 0, format = 2201)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| method    |           |   ✓   |     ✓    |    ✓    |
| uri       |           |   ✓   |     ✓    |    ✓    |
| host      |           |   ✓   |     ✓    |    ✓    |
| referer   |           |   ✓   |     ✓    |    ✓    |
| useragent |           |   ✓   |     ✓    |    ✓    |
| authuser  |           |   ✓   |     ✓    |    ✓    |
| bytes     |           |   ✓   |     ✓    |    ✓    |
| duration  |           |   ✓   |     ✓    |    ✓    |
| status    |           |   ✓   |     ✓    |    ✓    |

#### app\_operation (enterprise = 0, format = 2202)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| application   |           |   ✓   |     ✓    |    ✓    |
| operation     |           |   ✓   |     ✓    |    ✓    |
| attributes    |           |   ✓   |     ✓    |    ✓    |
| status\_descr |           |   ✓   |     ✓    |    ✓    |
| req\_bytes    |           |   ✓   |     ✓    |    ✓    |
| resp\_bytes   |           |   ✓   |     ✓    |    ✓    |
| duration      |           |   ✓   |     ✓    |    ✓    |
| status        |           |   ✓   |     ✓    |    ✓    |

#### app\_parent\_context (enterprise = 0, format = 2203)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| application |           |   ✓   |     ✓    |    ✓    |
| operation   |           |   ✓   |     ✓    |    ✓    |
| attributes  |           |   ✓   |     ✓    |    ✓    |

#### app\_initiator (enterprise = 0, format = 2204)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| actor |           |   ✓   |     ✓    |    ✓    |

#### app\_target (enterprise = 0, format = 2205)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| actor |           |   ✓   |     ✓    |    ✓    |

#### http\_request (enterprise = 0, format = 2206)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| method      |           |   ✓   |     ✓    |    ✓    |
| protocol    |           |   ✓   |     ✓    |    ✓    |
| uri         |           |   ✓   |     ✓    |    ✓    |
| host        |           |   ✓   |     ✓    |    ✓    |
| referer     |           |   ✓   |     ✓    |    ✓    |
| useragent   |           |   ✓   |     ✓    |    ✓    |
| xff         |           |   ✓   |     ✓    |    ✓    |
| authuser    |           |   ✓   |     ✓    |    ✓    |
| mime-type   |           |   ✓   |     ✓    |    ✓    |
| req\_bytes  |           |   ✓   |     ✓    |    ✓    |
| resp\_bytes |           |   ✓   |     ✓    |    ✓    |
| duration    |           |   ✓   |     ✓    |    ✓    |
| status      |           |   ✓   |     ✓    |    ✓    |

#### extended\_proxy\_request (enterprise = 0, format = 2207)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| uri  |           |   ✓   |     ✓    |    ✓    |

#### extended\_nav\_timing (enterprise = 0, format = 2208)

| Name                       | Community | Basic | Standard | Premium |
| -------------------------- | :-------: | :---: | :------: | :-----: |
| type                       |           |   ✓   |     ✓    |    ✓    |
| redirectCount              |           |   ✓   |     ✓    |    ✓    |
| navigationStart            |           |   ✓   |     ✓    |    ✓    |
| unloadEventStart           |           |   ✓   |     ✓    |    ✓    |
| unloadEventEnd             |           |   ✓   |     ✓    |    ✓    |
| redirectStart              |           |   ✓   |     ✓    |    ✓    |
| redirectEnd                |           |   ✓   |     ✓    |    ✓    |
| fetchStart                 |           |   ✓   |     ✓    |    ✓    |
| domainLookupStart          |           |   ✓   |     ✓    |    ✓    |
| domainLookupEnd            |           |   ✓   |     ✓    |    ✓    |
| connectStart               |           |   ✓   |     ✓    |    ✓    |
| connectEnd                 |           |   ✓   |     ✓    |    ✓    |
| secureConnectionStart      |           |   ✓   |     ✓    |    ✓    |
| requestStart               |           |   ✓   |     ✓    |    ✓    |
| responseStart              |           |   ✓   |     ✓    |    ✓    |
| responseEnd                |           |   ✓   |     ✓    |    ✓    |
| domLoading                 |           |   ✓   |     ✓    |    ✓    |
| domInteractive             |           |   ✓   |     ✓    |    ✓    |
| domContentLoadedEventStart |           |   ✓   |     ✓    |    ✓    |
| domContentLoadedEventEnd   |           |   ✓   |     ✓    |    ✓    |
| domComplete                |           |   ✓   |     ✓    |    ✓    |
| loadEventStart             |           |   ✓   |     ✓    |    ✓    |
| loadEventEnd               |           |   ✓   |     ✓    |    ✓    |

#### extended\_tcp\_info (enterprise = 0, format = 2209)

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| direction  |           |   ✓   |     ✓    |    ✓    |
| snd\_mss   |           |   ✓   |     ✓    |    ✓    |
| rcv\_mss   |           |   ✓   |     ✓    |    ✓    |
| unacked    |           |   ✓   |     ✓    |    ✓    |
| lost       |           |   ✓   |     ✓    |    ✓    |
| retrans    |           |   ✓   |     ✓    |    ✓    |
| pmtu       |           |   ✓   |     ✓    |    ✓    |
| rtt        |           |   ✓   |     ✓    |    ✓    |
| rttvar     |           |   ✓   |     ✓    |    ✓    |
| snd\_cwnd  |           |   ✓   |     ✓    |    ✓    |
| reordering |           |   ✓   |     ✓    |    ✓    |
| min\_rtt   |           |   ✓   |     ✓    |    ✓    |

#### extended\_entities (enterprise = 0, format = 2210)

| Name    | Community | Basic | Standard | Premium |
| ------- | :-------: | :---: | :------: | :-----: |
| src\_ds |           |   ✓   |     ✓    |    ✓    |
| dst\_ds |           |   ✓   |     ✓    |    ✓    |

#### bst\_egress\_queue (enterprise = 4413, format = 1)

| Name  | Community | Basic | Standard | Premium |
| ----- | :-------: | :---: | :------: | :-----: |
| queue |           |   ✓   |     ✓    |    ✓    |

### Counter Samples

|  PEN | Sample Type   | Vendor               | IEs |
| ---: | ------------- | -------------------- | --: |
|    0 | counter\_data | if\_counters         |  19 |
|    0 | counter\_data | ethernet\_counters   |  13 |
|    0 | counter\_data | tokenring\_counters  |  18 |
|    0 | counter\_data | vg\_counters         |  14 |
|    0 | counter\_data | vlan\_counters       |   6 |
|    0 | counter\_data | ieee80211\_counters  |  20 |
|    0 | counter\_data | lag\_port\_stats     |  12 |
|    0 | counter\_data | slow\_path\_counts   |   6 |
|    0 | counter\_data | ib\_counters         |  16 |
|    0 | counter\_data | sfp                  |  14 |
|    0 | counter\_data | processor            |   5 |
|    0 | counter\_data | radio\_utilization   |   3 |
|    0 | counter\_data | queue\_length        |  13 |
|    0 | counter\_data | of\_port             |   2 |
|    0 | counter\_data | port\_name           |   1 |
|    0 | counter\_data | host\_descr          |   5 |
|    0 | counter\_data | host\_adapters       |   2 |
|    0 | counter\_data | host\_parent         |   2 |
|    0 | counter\_data | host\_cpu            |  17 |
|    0 | counter\_data | host\_memory         |  11 |
|    0 | counter\_data | host\_disk\_io       |   9 |
|    0 | counter\_data | host\_net\_io        |   8 |
|    0 | counter\_data | mib2\_ip\_group      |  19 |
|    0 | counter\_data | mib2\_icmp\_group    |  25 |
|    0 | counter\_data | mib2\_tcp\_group     |  15 |
|    0 | counter\_data | mib2\_udp\_group     |   7 |
|    0 | counter\_data | virt\_node           |   5 |
|    0 | counter\_data | virt\_cpu            |   3 |
|    0 | counter\_data | virt\_memory         |   2 |
|    0 | counter\_data | virt\_disk\_io       |   8 |
|    0 | counter\_data | virt\_net\_io        |   8 |
|    0 | counter\_data | jmx\_runtime         |   3 |
|    0 | counter\_data | jmx\_statistics      |  19 |
|    0 | counter\_data | memcached\_counters  |  33 |
|    0 | counter\_data | http\_counters       |  15 |
|    0 | counter\_data | app\_operations      |  11 |
|    0 | counter\_data | app\_resources       |   8 |
|    0 | counter\_data | memcache\_counters   |  31 |
|    0 | counter\_data | app\_workers         |   5 |
|    0 | counter\_data | ovs\_dp\_stats       |   6 |
|    0 | counter\_data | energy               |   6 |
|    0 | counter\_data | temperature          |   3 |
|    0 | counter\_data | humidity             |   1 |
|    0 | counter\_data | fans                 |   3 |
| 4413 | counter\_data | bst\_device\_buffers |   2 |
| 4413 | counter\_data | bst\_port\_buffers   |   6 |
| 4413 | counter\_data | hw\_tables           |  36 |
| 5703 | counter\_data | nvidia\_gpu          |  10 |

#### if\_counters (enterprise = 0, format = 1)

| Name               | Community | Basic | Standard | Premium |
| ------------------ | :-------: | :---: | :------: | :-----: |
| ifIndex            |           |   ✓   |     ✓    |    ✓    |
| ifType             |           |   ✓   |     ✓    |    ✓    |
| ifSpeed            |           |   ✓   |     ✓    |    ✓    |
| ifDirection        |           |   ✓   |     ✓    |    ✓    |
| ifStatus           |           |   ✓   |     ✓    |    ✓    |
| ifInOctets         |           |   ✓   |     ✓    |    ✓    |
| ifInUcastPkts      |           |   ✓   |     ✓    |    ✓    |
| ifInMulticastPkts  |           |   ✓   |     ✓    |    ✓    |
| ifInBroadcastPkts  |           |   ✓   |     ✓    |    ✓    |
| ifInDiscards       |           |   ✓   |     ✓    |    ✓    |
| ifInErrors         |           |   ✓   |     ✓    |    ✓    |
| ifInUnknownProtos  |           |   ✓   |     ✓    |    ✓    |
| ifOutOctets        |           |   ✓   |     ✓    |    ✓    |
| ifOutUcastPkts     |           |   ✓   |     ✓    |    ✓    |
| ifOutMulticastPkts |           |   ✓   |     ✓    |    ✓    |
| ifOutBroadcastPkts |           |   ✓   |     ✓    |    ✓    |
| ifOutDiscards      |           |   ✓   |     ✓    |    ✓    |
| ifOutErrors        |           |   ✓   |     ✓    |    ✓    |
| ifPromiscuousMode  |           |   ✓   |     ✓    |    ✓    |

#### ethernet\_counters (enterprise = 0, format = 2)

| Name                               | Community | Basic | Standard | Premium |
| ---------------------------------- | :-------: | :---: | :------: | :-----: |
| dot3StatsAlignmentErrors           |           |   ✓   |     ✓    |    ✓    |
| dot3StatsFCSErrors                 |           |   ✓   |     ✓    |    ✓    |
| dot3StatsSingleCollisionFrames     |           |   ✓   |     ✓    |    ✓    |
| dot3StatsMultipleCollisionFrames   |           |   ✓   |     ✓    |    ✓    |
| dot3StatsSQETestErrors             |           |   ✓   |     ✓    |    ✓    |
| dot3StatsDeferredTransmissions     |           |   ✓   |     ✓    |    ✓    |
| dot3StatsLateCollisions            |           |   ✓   |     ✓    |    ✓    |
| dot3StatsExcessiveCollisions       |           |   ✓   |     ✓    |    ✓    |
| dot3StatsInternalMacTransmitErrors |           |   ✓   |     ✓    |    ✓    |
| dot3StatsCarrierSenseErrors        |           |   ✓   |     ✓    |    ✓    |
| dot3StatsFrameTooLongs             |           |   ✓   |     ✓    |    ✓    |
| dot3StatsInternalMacReceiveErrors  |           |   ✓   |     ✓    |    ✓    |
| dot3StatsSymbolErrors              |           |   ✓   |     ✓    |    ✓    |

#### tokenring\_counters (enterprise = 0, format = 3)

| Name                        | Community | Basic | Standard | Premium |
| --------------------------- | :-------: | :---: | :------: | :-----: |
| dot5StatsLineErrors         |           |   ✓   |     ✓    |    ✓    |
| dot5StatsBurstErrors        |           |   ✓   |     ✓    |    ✓    |
| dot5StatsACErrors           |           |   ✓   |     ✓    |    ✓    |
| dot5StatsAbortTransErrors   |           |   ✓   |     ✓    |    ✓    |
| dot5StatsInternalErrors     |           |   ✓   |     ✓    |    ✓    |
| dot5StatsLostFrameErrors    |           |   ✓   |     ✓    |    ✓    |
| dot5StatsReceiveCongestions |           |   ✓   |     ✓    |    ✓    |
| dot5StatsFrameCopiedErrors  |           |   ✓   |     ✓    |    ✓    |
| dot5StatsTokenErrors        |           |   ✓   |     ✓    |    ✓    |
| dot5StatsSoftErrors         |           |   ✓   |     ✓    |    ✓    |
| dot5StatsHardErrors         |           |   ✓   |     ✓    |    ✓    |
| dot5StatsSignalLoss         |           |   ✓   |     ✓    |    ✓    |
| dot5StatsTransmitBeacons    |           |   ✓   |     ✓    |    ✓    |
| dot5StatsRecoverys          |           |   ✓   |     ✓    |    ✓    |
| dot5StatsLobeWires          |           |   ✓   |     ✓    |    ✓    |
| dot5StatsRemoves            |           |   ✓   |     ✓    |    ✓    |
| dot5StatsSingles            |           |   ✓   |     ✓    |    ✓    |
| dot5StatsFreqErrors         |           |   ✓   |     ✓    |    ✓    |

#### vg\_counters (enterprise = 0, format = 4)

| Name                         | Community | Basic | Standard | Premium |
| ---------------------------- | :-------: | :---: | :------: | :-----: |
| dot12InHighPriorityFrames    |           |   ✓   |     ✓    |    ✓    |
| dot12InHighPriorityOctets    |           |   ✓   |     ✓    |    ✓    |
| dot12InNormPriorityFrames    |           |   ✓   |     ✓    |    ✓    |
| dot12InNormPriorityOctets    |           |   ✓   |     ✓    |    ✓    |
| dot12InIPMErrors             |           |   ✓   |     ✓    |    ✓    |
| dot12InOversizeFrameErrors   |           |   ✓   |     ✓    |    ✓    |
| dot12InDataErrors            |           |   ✓   |     ✓    |    ✓    |
| dot12InNullAddressedFrames   |           |   ✓   |     ✓    |    ✓    |
| dot12OutHighPriorityFrames   |           |   ✓   |     ✓    |    ✓    |
| dot12OutHighPriorityOctets   |           |   ✓   |     ✓    |    ✓    |
| dot12TransitionIntoTrainings |           |   ✓   |     ✓    |    ✓    |
| dot12HCInHighPriorityOctets  |           |   ✓   |     ✓    |    ✓    |
| dot12HCInNormPriorityOctets  |           |   ✓   |     ✓    |    ✓    |
| dot12HCOutHighPriorityOctets |           |   ✓   |     ✓    |    ✓    |

#### vlan\_counters (enterprise = 0, format = 5)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| vlan\_id      |           |   ✓   |     ✓    |    ✓    |
| octets        |           |   ✓   |     ✓    |    ✓    |
| ucastPkts     |           |   ✓   |     ✓    |    ✓    |
| multicastPkts |           |   ✓   |     ✓    |    ✓    |
| broadcastPkts |           |   ✓   |     ✓    |    ✓    |
| discards      |           |   ✓   |     ✓    |    ✓    |

#### ieee80211\_counters (enterprise = 0, format = 6)

| Name                            | Community | Basic | Standard | Premium |
| ------------------------------- | :-------: | :---: | :------: | :-----: |
| dot11TransmittedFragmentCount   |           |   ✓   |     ✓    |    ✓    |
| dot11GroupTransmittedFrameCount |           |   ✓   |     ✓    |    ✓    |
| dot11FailedCount                |           |   ✓   |     ✓    |    ✓    |
| dot11RetryCount                 |           |   ✓   |     ✓    |    ✓    |
| dot11MultipleRetryCount         |           |   ✓   |     ✓    |    ✓    |
| dot11FrameDuplicateCount        |           |   ✓   |     ✓    |    ✓    |
| dot11RTSSuccessCount            |           |   ✓   |     ✓    |    ✓    |
| dot11RTSFailureCount            |           |   ✓   |     ✓    |    ✓    |
| dot11AckFailureCount            |           |   ✓   |     ✓    |    ✓    |
| dot11ReceivedFragmentCount      |           |   ✓   |     ✓    |    ✓    |
| dot11GroupReceivedFrameCount    |           |   ✓   |     ✓    |    ✓    |
| dot11FCSErrorCount              |           |   ✓   |     ✓    |    ✓    |
| dot11TransmittedFrameCount      |           |   ✓   |     ✓    |    ✓    |
| dot11WEPUndecryptableCount      |           |   ✓   |     ✓    |    ✓    |
| dot11QosDiscardedFragmentCount  |           |   ✓   |     ✓    |    ✓    |
| dot11AssociatedStationCount     |           |   ✓   |     ✓    |    ✓    |
| dot11QosCFPollsReceivedCount    |           |   ✓   |     ✓    |    ✓    |
| dot11QosCFPollsUnusedCount      |           |   ✓   |     ✓    |    ✓    |
| dot11QosCFPollsUnusableCount    |           |   ✓   |     ✓    |    ✓    |
| dot11QosCFPollsLostCount        |           |   ✓   |     ✓    |    ✓    |

#### lag\_port\_stats (enterprise = 0, format = 7)

| Name                                   | Community | Basic | Standard | Premium |
| -------------------------------------- | :-------: | :---: | :------: | :-----: |
| dot3adAggPortActorSystemID             |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortPartnerOperSystemID       |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortAttachedAggID             |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortState                     |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsLACPDUsRx            |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsMarkerPDUsRx         |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsMarkerResponsePDUsRx |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsUnknownRx            |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsIllegalRx            |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsLACPDUsTx            |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsMarkerPDUsTx         |           |   ✓   |     ✓    |    ✓    |
| dot3adAggPortStatsMarkerResponsePDUsTx |           |   ✓   |     ✓    |    ✓    |

#### slow\_path\_counts (enterprise = 0, format = 8)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| unknown         |           |   ✓   |     ✓    |    ✓    |
| other           |           |   ✓   |     ✓    |    ✓    |
| cam\_miss       |           |   ✓   |     ✓    |    ✓    |
| cam\_full       |           |   ✓   |     ✓    |    ✓    |
| no\_hw\_support |           |   ✓   |     ✓    |    ✓    |
| cntrl           |           |   ✓   |     ✓    |    ✓    |

#### ib\_counters (enterprise = 0, format = 9)

| Name                         | Community | Basic | Standard | Premium |
| ---------------------------- | :-------: | :---: | :------: | :-----: |
| PortXmitData                 |           |   ✓   |     ✓    |    ✓    |
| PortRcvData                  |           |   ✓   |     ✓    |    ✓    |
| PortXmitPkts                 |           |   ✓   |     ✓    |    ✓    |
| PortRcvPkts                  |           |   ✓   |     ✓    |    ✓    |
| SymbolErrorCounter           |           |   ✓   |     ✓    |    ✓    |
| LinkErrorRecoveryCounter     |           |   ✓   |     ✓    |    ✓    |
| LinkDownedCounter            |           |   ✓   |     ✓    |    ✓    |
| PortRcvErrors                |           |   ✓   |     ✓    |    ✓    |
| PortRcvRemotePhysicalErrors  |           |   ✓   |     ✓    |    ✓    |
| PortRcvSwitchRelayErrors     |           |   ✓   |     ✓    |    ✓    |
| PortXmitDiscards             |           |   ✓   |     ✓    |    ✓    |
| PortXmitConstraintErrors     |           |   ✓   |     ✓    |    ✓    |
| PortRcvConstraintErrors      |           |   ✓   |     ✓    |    ✓    |
| LocalLinkIntegrityErrors     |           |   ✓   |     ✓    |    ✓    |
| ExcessiveBufferOverrunErrors |           |   ✓   |     ✓    |    ✓    |
| VL15Dropped                  |           |   ✓   |     ✓    |    ✓    |

#### sfp (enterprise = 0, format = 10)

| Name                    | Community | Basic | Standard | Premium |
| ----------------------- | :-------: | :---: | :------: | :-----: |
| module\_id              |           |   ✓   |     ✓    |    ✓    |
| module\_num\_lanes      |           |   ✓   |     ✓    |    ✓    |
| module\_supply\_voltage |           |   ✓   |     ✓    |    ✓    |
| module\_temperature     |           |   ✓   |     ✓    |    ✓    |
| index                   |           |   ✓   |     ✓    |    ✓    |
| tx\_bias\_current       |           |   ✓   |     ✓    |    ✓    |
| tx\_power               |           |   ✓   |     ✓    |    ✓    |
| tx\_power\_min          |           |   ✓   |     ✓    |    ✓    |
| tx\_power\_max          |           |   ✓   |     ✓    |    ✓    |
| tx\_wavelength          |           |   ✓   |     ✓    |    ✓    |
| rx\_power               |           |   ✓   |     ✓    |    ✓    |
| rx\_power\_min          |           |   ✓   |     ✓    |    ✓    |
| rx\_power\_max          |           |   ✓   |     ✓    |    ✓    |
| rx\_wavelength          |           |   ✓   |     ✓    |    ✓    |

#### processor (enterprise = 0, format = 1001)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| 5s\_cpu       |           |   ✓   |     ✓    |    ✓    |
| 1m\_cpu       |           |   ✓   |     ✓    |    ✓    |
| 5m\_cpu       |           |   ✓   |     ✓    |    ✓    |
| total\_memory |           |   ✓   |     ✓    |    ✓    |
| free\_memory  |           |   ✓   |     ✓    |    ✓    |

#### radio\_utilization (enterprise = 0, format = 1002)

| Name                    | Community | Basic | Standard | Premium |
| ----------------------- | :-------: | :---: | :------: | :-----: |
| elapsed\_time           |           |   ✓   |     ✓    |    ✓    |
| on\_channel\_time       |           |   ✓   |     ✓    |    ✓    |
| on\_channel\_busy\_time |           |   ✓   |     ✓    |    ✓    |

#### queue\_length (enterprise = 0, format = 1003)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| queueIndex      |           |   ✓   |     ✓    |    ✓    |
| segmentSize     |           |   ✓   |     ✓    |    ✓    |
| queueSegments   |           |   ✓   |     ✓    |    ✓    |
| queueLength0    |           |   ✓   |     ✓    |    ✓    |
| queueLength1    |           |   ✓   |     ✓    |    ✓    |
| queueLength2    |           |   ✓   |     ✓    |    ✓    |
| queueLength4    |           |   ✓   |     ✓    |    ✓    |
| queueLength8    |           |   ✓   |     ✓    |    ✓    |
| queueLength32   |           |   ✓   |     ✓    |    ✓    |
| queueLength128  |           |   ✓   |     ✓    |    ✓    |
| queueLength1024 |           |   ✓   |     ✓    |    ✓    |
| queueLengthMore |           |   ✓   |     ✓    |    ✓    |
| dropped         |           |   ✓   |     ✓    |    ✓    |

#### of\_port (enterprise = 0, format = 1004)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| datapath\_id |           |   ✓   |     ✓    |    ✓    |
| port\_no     |           |   ✓   |     ✓    |    ✓    |

#### port\_name (enterprise = 0, format = 1005)

| Name | Community | Basic | Standard | Premium |
| ---- | :-------: | :---: | :------: | :-----: |
| name |           |   ✓   |     ✓    |    ✓    |

#### host\_descr (enterprise = 0, format = 2000)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| hostname      |           |   ✓   |     ✓    |    ✓    |
| uuid          |           |   ✓   |     ✓    |    ✓    |
| machine\_type |           |   ✓   |     ✓    |    ✓    |
| os\_name      |           |   ✓   |     ✓    |    ✓    |
| os\_release   |           |   ✓   |     ✓    |    ✓    |

#### host\_adapters (enterprise = 0, format = 2001)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| ifIndex      |           |   ✓   |     ✓    |    ✓    |
| mac\_address |           |   ✓   |     ✓    |    ✓    |

#### host\_parent (enterprise = 0, format = 2002)

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| container\_type  |           |   ✓   |     ✓    |    ✓    |
| container\_index |           |   ✓   |     ✓    |    ✓    |

#### host\_cpu (enterprise = 0, format = 2003)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| load\_one     |           |   ✓   |     ✓    |    ✓    |
| load\_five    |           |   ✓   |     ✓    |    ✓    |
| load\_fifteen |           |   ✓   |     ✓    |    ✓    |
| proc\_run     |           |   ✓   |     ✓    |    ✓    |
| proc\_total   |           |   ✓   |     ✓    |    ✓    |
| cpu\_num      |           |   ✓   |     ✓    |    ✓    |
| cpu\_speed    |           |   ✓   |     ✓    |    ✓    |
| uptime        |           |   ✓   |     ✓    |    ✓    |
| cpu\_user     |           |   ✓   |     ✓    |    ✓    |
| cpu\_nice     |           |   ✓   |     ✓    |    ✓    |
| cpu\_system   |           |   ✓   |     ✓    |    ✓    |
| cpu\_idle     |           |   ✓   |     ✓    |    ✓    |
| cpu\_wio      |           |   ✓   |     ✓    |    ✓    |
| cpu\_intr     |           |   ✓   |     ✓    |    ✓    |
| cpu\_sintr    |           |   ✓   |     ✓    |    ✓    |
| interrupts    |           |   ✓   |     ✓    |    ✓    |
| contexts      |           |   ✓   |     ✓    |    ✓    |

#### host\_memory (enterprise = 0, format = 2004)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| mem\_total   |           |   ✓   |     ✓    |    ✓    |
| mem\_free    |           |   ✓   |     ✓    |    ✓    |
| mem\_shared  |           |   ✓   |     ✓    |    ✓    |
| mem\_buffers |           |   ✓   |     ✓    |    ✓    |
| mem\_cached  |           |   ✓   |     ✓    |    ✓    |
| swap\_total  |           |   ✓   |     ✓    |    ✓    |
| swap\_free   |           |   ✓   |     ✓    |    ✓    |
| page\_in     |           |   ✓   |     ✓    |    ✓    |
| page\_out    |           |   ✓   |     ✓    |    ✓    |
| swap\_in     |           |   ✓   |     ✓    |    ✓    |
| swap\_out    |           |   ✓   |     ✓    |    ✓    |

#### host\_disk\_io (enterprise = 0, format = 2005)

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| hyper disk\_total |           |   ✓   |     ✓    |    ✓    |
| disk\_free        |           |   ✓   |     ✓    |    ✓    |
| part\_max\_used   |           |   ✓   |     ✓    |    ✓    |
| reads             |           |   ✓   |     ✓    |    ✓    |
| bytes\_read       |           |   ✓   |     ✓    |    ✓    |
| read\_time        |           |   ✓   |     ✓    |    ✓    |
| writes            |           |   ✓   |     ✓    |    ✓    |
| bytes\_written    |           |   ✓   |     ✓    |    ✓    |
| write\_time       |           |   ✓   |     ✓    |    ✓    |

#### host\_net\_io (enterprise = 0, format = 2006)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| hyper bytes\_in |           |   ✓   |     ✓    |    ✓    |
| pkts\_in        |           |   ✓   |     ✓    |    ✓    |
| errs\_in        |           |   ✓   |     ✓    |    ✓    |
| drops\_in       |           |   ✓   |     ✓    |    ✓    |
| bytes\_out      |           |   ✓   |     ✓    |    ✓    |
| packets\_out    |           |   ✓   |     ✓    |    ✓    |
| errs\_out       |           |   ✓   |     ✓    |    ✓    |
| drops\_out      |           |   ✓   |     ✓    |    ✓    |

#### mib2\_ip\_group (enterprise = 0, format = 2007)

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| ipForwarding      |           |   ✓   |     ✓    |    ✓    |
| ipDefaultTTL      |           |   ✓   |     ✓    |    ✓    |
| ipInReceives      |           |   ✓   |     ✓    |    ✓    |
| ipInHdrErrors     |           |   ✓   |     ✓    |    ✓    |
| ipInAddrErrors    |           |   ✓   |     ✓    |    ✓    |
| ipForwDatagrams   |           |   ✓   |     ✓    |    ✓    |
| ipInUnknownProtos |           |   ✓   |     ✓    |    ✓    |
| ipInDiscards      |           |   ✓   |     ✓    |    ✓    |
| ipInDelivers      |           |   ✓   |     ✓    |    ✓    |
| ipOutRequests     |           |   ✓   |     ✓    |    ✓    |
| ipOutDiscards     |           |   ✓   |     ✓    |    ✓    |
| ipOutNoRoutes     |           |   ✓   |     ✓    |    ✓    |
| ipReasmTimeout    |           |   ✓   |     ✓    |    ✓    |
| ipReasmReqds      |           |   ✓   |     ✓    |    ✓    |
| ipReasmOKs        |           |   ✓   |     ✓    |    ✓    |
| ipReasmFails      |           |   ✓   |     ✓    |    ✓    |
| ipFragOKs         |           |   ✓   |     ✓    |    ✓    |
| ipFragFails       |           |   ✓   |     ✓    |    ✓    |
| ipFragCreates     |           |   ✓   |     ✓    |    ✓    |

#### mib2\_icmp\_group (enterprise = 0, format = 2008)

| Name                 | Community | Basic | Standard | Premium |
| -------------------- | :-------: | :---: | :------: | :-----: |
| icmpInMsgs           |           |   ✓   |     ✓    |    ✓    |
| icmpInErrors         |           |   ✓   |     ✓    |    ✓    |
| icmpInDestUnreachs   |           |   ✓   |     ✓    |    ✓    |
| icmpInTimeExcds      |           |   ✓   |     ✓    |    ✓    |
| icmpInParamProbs     |           |   ✓   |     ✓    |    ✓    |
| icmpInSrcQuenchs     |           |   ✓   |     ✓    |    ✓    |
| icmpInRedirects      |           |   ✓   |     ✓    |    ✓    |
| icmpInEchos          |           |   ✓   |     ✓    |    ✓    |
| icmpInEchoReps       |           |   ✓   |     ✓    |    ✓    |
| icmpInTimestamps     |           |   ✓   |     ✓    |    ✓    |
| icmpInAddrMasks      |           |   ✓   |     ✓    |    ✓    |
| icmpInAddrMaskReps   |           |   ✓   |     ✓    |    ✓    |
| icmpOutMsgs          |           |   ✓   |     ✓    |    ✓    |
| icmpOutErrors        |           |   ✓   |     ✓    |    ✓    |
| icmpOutDestUnreachs  |           |   ✓   |     ✓    |    ✓    |
| icmpOutTimeExcds     |           |   ✓   |     ✓    |    ✓    |
| icmpOutParamProbs    |           |   ✓   |     ✓    |    ✓    |
| icmpOutSrcQuenchs    |           |   ✓   |     ✓    |    ✓    |
| icmpOutRedirects     |           |   ✓   |     ✓    |    ✓    |
| icmpOutEchos         |           |   ✓   |     ✓    |    ✓    |
| icmpOutEchoReps      |           |   ✓   |     ✓    |    ✓    |
| icmpOutTimestamps    |           |   ✓   |     ✓    |    ✓    |
| icmpOutTimestampReps |           |   ✓   |     ✓    |    ✓    |
| icmpOutAddrMasks     |           |   ✓   |     ✓    |    ✓    |
| icmpOutAddrMaskReps  |           |   ✓   |     ✓    |    ✓    |

#### mib2\_tcp\_group (enterprise = 0, format = 2009)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| tcpRtoAlgorithm |           |   ✓   |     ✓    |    ✓    |
| tcpRtoMin       |           |   ✓   |     ✓    |    ✓    |
| tcpRtoMax       |           |   ✓   |     ✓    |    ✓    |
| tcpMaxConn      |           |   ✓   |     ✓    |    ✓    |
| tcpActiveOpens  |           |   ✓   |     ✓    |    ✓    |
| tcpPassiveOpens |           |   ✓   |     ✓    |    ✓    |
| tcpAttemptFails |           |   ✓   |     ✓    |    ✓    |
| tcpEstabResets  |           |   ✓   |     ✓    |    ✓    |
| tcpCurrEstab    |           |   ✓   |     ✓    |    ✓    |
| tcpInSegs       |           |   ✓   |     ✓    |    ✓    |
| tcpOutSegs      |           |   ✓   |     ✓    |    ✓    |
| tcpRetransSegs  |           |   ✓   |     ✓    |    ✓    |
| tcpInErrs       |           |   ✓   |     ✓    |    ✓    |
| tcpOutRsts      |           |   ✓   |     ✓    |    ✓    |
| tcpInCsumErrs   |           |   ✓   |     ✓    |    ✓    |

#### mib2\_udp\_group (enterprise = 0, format = 2010)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| udpInDatagrams  |           |   ✓   |     ✓    |    ✓    |
| udpNoPorts      |           |   ✓   |     ✓    |    ✓    |
| udpInErrors     |           |   ✓   |     ✓    |    ✓    |
| udpOutDatagrams |           |   ✓   |     ✓    |    ✓    |
| udpRcvbufErrors |           |   ✓   |     ✓    |    ✓    |
| udpSndbufErrors |           |   ✓   |     ✓    |    ✓    |
| udpInCsumErrors |           |   ✓   |     ✓    |    ✓    |

#### virt\_node (enterprise = 0, format = 2100)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| mhz          |           |   ✓   |     ✓    |    ✓    |
| cpus         |           |   ✓   |     ✓    |    ✓    |
| memory       |           |   ✓   |     ✓    |    ✓    |
| memory\_free |           |   ✓   |     ✓    |    ✓    |
| num\_domains |           |   ✓   |     ✓    |    ✓    |

#### virt\_cpu (enterprise = 0, format = 2101)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| state     |           |   ✓   |     ✓    |    ✓    |
| cpuTime   |           |   ✓   |     ✓    |    ✓    |
| nrVirtCpu |           |   ✓   |     ✓    |    ✓    |

#### virt\_memory (enterprise = 0, format = 2102)

| Name      | Community | Basic | Standard | Premium |
| --------- | :-------: | :---: | :------: | :-----: |
| memory    |           |   ✓   |     ✓    |    ✓    |
| maxMemory |           |   ✓   |     ✓    |    ✓    |

#### virt\_disk\_io (enterprise = 0, format = 2103)

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| capacity   |           |   ✓   |     ✓    |    ✓    |
| allocation |           |   ✓   |     ✓    |    ✓    |
| available  |           |   ✓   |     ✓    |    ✓    |
| rd\_req    |           |   ✓   |     ✓    |    ✓    |
| rd\_bytes  |           |   ✓   |     ✓    |    ✓    |
| wr\_req    |           |   ✓   |     ✓    |    ✓    |
| wr\_bytes  |           |   ✓   |     ✓    |    ✓    |
| errs       |           |   ✓   |     ✓    |    ✓    |

#### virt\_net\_io (enterprise = 0, format = 2104)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| rx\_bytes   |           |   ✓   |     ✓    |    ✓    |
| rx\_packets |           |   ✓   |     ✓    |    ✓    |
| rx\_errs    |           |   ✓   |     ✓    |    ✓    |
| rx\_drop    |           |   ✓   |     ✓    |    ✓    |
| tx\_bytes   |           |   ✓   |     ✓    |    ✓    |
| tx\_packets |           |   ✓   |     ✓    |    ✓    |
| tx\_errs    |           |   ✓   |     ✓    |    ✓    |
| tx\_drop    |           |   ✓   |     ✓    |    ✓    |

#### jmx\_runtime (enterprise = 0, format = 2105)

| Name        | Community | Basic | Standard | Premium |
| ----------- | :-------: | :---: | :------: | :-----: |
| vm\_name    |           |   ✓   |     ✓    |    ✓    |
| vm\_vendor  |           |   ✓   |     ✓    |    ✓    |
| vm\_version |           |   ✓   |     ✓    |    ✓    |

#### jmx\_statistics (enterprise = 0, format = 2106)

| Name                 | Community | Basic | Standard | Premium |
| -------------------- | :-------: | :---: | :------: | :-----: |
| heap\_initial        |           |   ✓   |     ✓    |    ✓    |
| heap\_used           |           |   ✓   |     ✓    |    ✓    |
| heap\_committed      |           |   ✓   |     ✓    |    ✓    |
| heap\_max            |           |   ✓   |     ✓    |    ✓    |
| non\_heap\_initial   |           |   ✓   |     ✓    |    ✓    |
| non\_heap\_used      |           |   ✓   |     ✓    |    ✓    |
| non\_heap\_committed |           |   ✓   |     ✓    |    ✓    |
| non\_heap\_max       |           |   ✓   |     ✓    |    ✓    |
| gc\_count            |           |   ✓   |     ✓    |    ✓    |
| gc\_time             |           |   ✓   |     ✓    |    ✓    |
| classes\_loaded      |           |   ✓   |     ✓    |    ✓    |
| classes\_total       |           |   ✓   |     ✓    |    ✓    |
| classes\_unloaded    |           |   ✓   |     ✓    |    ✓    |
| compilation\_time    |           |   ✓   |     ✓    |    ✓    |
| thread\_num\_live    |           |   ✓   |     ✓    |    ✓    |
| thread\_num\_daemon  |           |   ✓   |     ✓    |    ✓    |
| thread\_num\_started |           |   ✓   |     ✓    |    ✓    |
| fd\_open\_count      |           |   ✓   |     ✓    |    ✓    |
| fd\_max\_count       |           |   ✓   |     ✓    |    ✓    |

#### memcached\_counters (enterprise = 0, format = 2200)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| uptime                 |           |   ✓   |     ✓    |    ✓    |
| rusage\_user           |           |   ✓   |     ✓    |    ✓    |
| rusage\_system         |           |   ✓   |     ✓    |    ✓    |
| curr\_connections      |           |   ✓   |     ✓    |    ✓    |
| total\_connections     |           |   ✓   |     ✓    |    ✓    |
| connection\_structures |           |   ✓   |     ✓    |    ✓    |
| cmd\_get               |           |   ✓   |     ✓    |    ✓    |
| cmd\_set               |           |   ✓   |     ✓    |    ✓    |
| cmd\_flush             |           |   ✓   |     ✓    |    ✓    |
| get\_hits              |           |   ✓   |     ✓    |    ✓    |
| get\_misses            |           |   ✓   |     ✓    |    ✓    |
| delete\_hits           |           |   ✓   |     ✓    |    ✓    |
| delete\_misses         |           |   ✓   |     ✓    |    ✓    |
| incr\_hits             |           |   ✓   |     ✓    |    ✓    |
| incr\_misses           |           |   ✓   |     ✓    |    ✓    |
| decr\_hits             |           |   ✓   |     ✓    |    ✓    |
| decr\_misses           |           |   ✓   |     ✓    |    ✓    |
| cas\_misses            |           |   ✓   |     ✓    |    ✓    |
| cas\_hits              |           |   ✓   |     ✓    |    ✓    |
| cas\_badval            |           |   ✓   |     ✓    |    ✓    |
| auth\_cmds             |           |   ✓   |     ✓    |    ✓    |
| auth\_errors           |           |   ✓   |     ✓    |    ✓    |
| bytes\_read            |           |   ✓   |     ✓    |    ✓    |
| bytes\_written         |           |   ✓   |     ✓    |    ✓    |
| limit\_maxbytes        |           |   ✓   |     ✓    |    ✓    |
| conn\_accepts          |           |   ✓   |     ✓    |    ✓    |
| listen\_disabled\_num  |           |   ✓   |     ✓    |    ✓    |
| threads                |           |   ✓   |     ✓    |    ✓    |
| conn\_yields           |           |   ✓   |     ✓    |    ✓    |
| bytes                  |           |   ✓   |     ✓    |    ✓    |
| curr\_items            |           |   ✓   |     ✓    |    ✓    |
| total\_items           |           |   ✓   |     ✓    |    ✓    |
| evictions              |           |   ✓   |     ✓    |    ✓    |

#### http\_counters (enterprise = 0, format = 2201)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| method\_option\_count  |           |   ✓   |     ✓    |    ✓    |
| method\_get\_count     |           |   ✓   |     ✓    |    ✓    |
| method\_head\_count    |           |   ✓   |     ✓    |    ✓    |
| method\_post\_count    |           |   ✓   |     ✓    |    ✓    |
| method\_put\_count     |           |   ✓   |     ✓    |    ✓    |
| method\_delete\_count  |           |   ✓   |     ✓    |    ✓    |
| method\_trace\_count   |           |   ✓   |     ✓    |    ✓    |
| method\_connect\_count |           |   ✓   |     ✓    |    ✓    |
| method\_other\_count   |           |   ✓   |     ✓    |    ✓    |
| status\_1XX\_count     |           |   ✓   |     ✓    |    ✓    |
| status\_2XX\_count     |           |   ✓   |     ✓    |    ✓    |
| status\_3XX\_count     |           |   ✓   |     ✓    |    ✓    |
| status\_4XX\_count     |           |   ✓   |     ✓    |    ✓    |
| status\_5XX\_count     |           |   ✓   |     ✓    |    ✓    |
| status\_other\_count   |           |   ✓   |     ✓    |    ✓    |

#### app\_operations (enterprise = 0, format = 2202)

| Name             | Community | Basic | Standard | Premium |
| ---------------- | :-------: | :---: | :------: | :-----: |
| success          |           |   ✓   |     ✓    |    ✓    |
| other            |           |   ✓   |     ✓    |    ✓    |
| timeout          |           |   ✓   |     ✓    |    ✓    |
| internal\_error  |           |   ✓   |     ✓    |    ✓    |
| bad\_request     |           |   ✓   |     ✓    |    ✓    |
| forbidden        |           |   ✓   |     ✓    |    ✓    |
| too\_large       |           |   ✓   |     ✓    |    ✓    |
| not\_implemented |           |   ✓   |     ✓    |    ✓    |
| not\_found       |           |   ✓   |     ✓    |    ✓    |
| unavailable      |           |   ✓   |     ✓    |    ✓    |
| unauthorized     |           |   ✓   |     ✓    |    ✓    |

#### app\_resources (enterprise = 0, format = 2203)

| Name         | Community | Basic | Standard | Premium |
| ------------ | :-------: | :---: | :------: | :-----: |
| user\_time   |           |   ✓   |     ✓    |    ✓    |
| system\_time |           |   ✓   |     ✓    |    ✓    |
| mem\_used    |           |   ✓   |     ✓    |    ✓    |
| mem\_max     |           |   ✓   |     ✓    |    ✓    |
| fd\_open     |           |   ✓   |     ✓    |    ✓    |
| fd\_max      |           |   ✓   |     ✓    |    ✓    |
| conn\_open   |           |   ✓   |     ✓    |    ✓    |
| conn\_max    |           |   ✓   |     ✓    |    ✓    |

#### memcache\_counters (enterprise = 0, format = 2204)

| Name                   | Community | Basic | Standard | Premium |
| ---------------------- | :-------: | :---: | :------: | :-----: |
| cmd\_set               |           |   ✓   |     ✓    |    ✓    |
| cmd\_touch             |           |   ✓   |     ✓    |    ✓    |
| cmd\_flush             |           |   ✓   |     ✓    |    ✓    |
| get\_hits              |           |   ✓   |     ✓    |    ✓    |
| get\_misses            |           |   ✓   |     ✓    |    ✓    |
| delete\_hits           |           |   ✓   |     ✓    |    ✓    |
| delete\_misses         |           |   ✓   |     ✓    |    ✓    |
| incr\_hits             |           |   ✓   |     ✓    |    ✓    |
| incr\_misses           |           |   ✓   |     ✓    |    ✓    |
| decr\_hits             |           |   ✓   |     ✓    |    ✓    |
| decr\_misses           |           |   ✓   |     ✓    |    ✓    |
| cas\_hits              |           |   ✓   |     ✓    |    ✓    |
| cas\_misses            |           |   ✓   |     ✓    |    ✓    |
| cas\_badval            |           |   ✓   |     ✓    |    ✓    |
| auth\_cmds             |           |   ✓   |     ✓    |    ✓    |
| auth\_errors           |           |   ✓   |     ✓    |    ✓    |
| threads                |           |   ✓   |     ✓    |    ✓    |
| conn\_yields           |           |   ✓   |     ✓    |    ✓    |
| listen\_disabled\_num  |           |   ✓   |     ✓    |    ✓    |
| curr\_connections      |           |   ✓   |     ✓    |    ✓    |
| ejected\_connections   |           |   ✓   |     ✓    |    ✓    |
| total\_connections     |           |   ✓   |     ✓    |    ✓    |
| connection\_structures |           |   ✓   |     ✓    |    ✓    |
| evictions              |           |   ✓   |     ✓    |    ✓    |
| reclaimed              |           |   ✓   |     ✓    |    ✓    |
| curr\_items            |           |   ✓   |     ✓    |    ✓    |
| total\_items           |           |   ✓   |     ✓    |    ✓    |
| bytes\_read            |           |   ✓   |     ✓    |    ✓    |
| bytes\_written         |           |   ✓   |     ✓    |    ✓    |
| bytes                  |           |   ✓   |     ✓    |    ✓    |
| limit\_maxbytes        |           |   ✓   |     ✓    |    ✓    |

#### app\_workers (enterprise = 0, format = 2206)

| Name            | Community | Basic | Standard | Premium |
| --------------- | :-------: | :---: | :------: | :-----: |
| workers\_active |           |   ✓   |     ✓    |    ✓    |
| workers\_idle   |           |   ✓   |     ✓    |    ✓    |
| workers\_max    |           |   ✓   |     ✓    |    ✓    |
| req\_delayed    |           |   ✓   |     ✓    |    ✓    |
| req\_dropped    |           |   ✓   |     ✓    |    ✓    |

#### ovs\_dp\_stats (enterprise = 0, format = 2207)

| Name       | Community | Basic | Standard | Premium |
| ---------- | :-------: | :---: | :------: | :-----: |
| hits       |           |   ✓   |     ✓    |    ✓    |
| misses     |           |   ✓   |     ✓    |    ✓    |
| lost       |           |   ✓   |     ✓    |    ✓    |
| mask\_hits |           |   ✓   |     ✓    |    ✓    |
| flows      |           |   ✓   |     ✓    |    ✓    |
| masks      |           |   ✓   |     ✓    |    ✓    |

#### energy (enterprise = 0, format = 3000)

| Name          | Community | Basic | Standard | Premium |
| ------------- | :-------: | :---: | :------: | :-----: |
| voltage       |           |   ✓   |     ✓    |    ✓    |
| current       |           |   ✓   |     ✓    |    ✓    |
| real\_power   |           |   ✓   |     ✓    |    ✓    |
| power\_factor |           |   ✓   |     ✓    |    ✓    |
| energy        |           |   ✓   |     ✓    |    ✓    |
| errors        |           |   ✓   |     ✓    |    ✓    |

#### temperature (enterprise = 0, format = 3001)

| Name    | Community | Basic | Standard | Premium |
| ------- | :-------: | :---: | :------: | :-----: |
| minimum |           |   ✓   |     ✓    |    ✓    |
| maximum |           |   ✓   |     ✓    |    ✓    |
| errors  |           |   ✓   |     ✓    |    ✓    |

#### humidity (enterprise = 0, format = 3002)

| Name              | Community | Basic | Standard | Premium |
| ----------------- | :-------: | :---: | :------: | :-----: |
| relative humidity |           |   ✓   |     ✓    |    ✓    |

#### fans (enterprise = 0, format = 3003)

| Name   | Community | Basic | Standard | Premium |
| ------ | :-------: | :---: | :------: | :-----: |
| total  |           |   ✓   |     ✓    |    ✓    |
| failed |           |   ✓   |     ✓    |    ✓    |
| speed  |           |   ✓   |     ✓    |    ✓    |

#### bst\_device\_buffers (enterprise = 4413, format = 1)

| Name                                     | Community | Basic | Standard | Premium |
| ---------------------------------------- | :-------: | :---: | :------: | :-----: |
| unicast buffers percentage utilization   |           |   ✓   |     ✓    |    ✓    |
| multicast buffers percentage utilization |           |   ✓   |     ✓    |    ✓    |

#### bst\_port\_buffers (enterprise = 4413, format = 2)

| Name                                           | Community | Basic | Standard | Premium |
| ---------------------------------------------- | :-------: | :---: | :------: | :-----: |
| ingress unicast buffers utilization            |           |   ✓   |     ✓    |    ✓    |
| ingress multicast buffers utilization          |           |   ✓   |     ✓    |    ✓    |
| egress unicast buffers utilization             |           |   ✓   |     ✓    |    ✓    |
| egress multicast buffers utilization           |           |   ✓   |     ✓    |    ✓    |
| per egress queue unicast buffers utilization   |           |   ✓   |     ✓    |    ✓    |
| per egress queue multicast buffers utilization |           |   ✓   |     ✓    |    ✓    |

#### hw\_tables (enterprise = 4413, format = 3)

| Name                                      | Community | Basic | Standard | Premium |
| ----------------------------------------- | :-------: | :---: | :------: | :-----: |
| broadcom\_hw\_host\_entries               |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_host\_entries\_max          |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv4\_entries               |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv4\_entries\_max          |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv6\_entries               |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv6\_entries\_max          |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv4\_ipv6\_entries         |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv6\_ipv6\_entries\_max    |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_long\_ipv6\_entries         |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_long\_ipv6\_entries\_max    |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_total\_routes               |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_total\_routes\_max          |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ecmp\_nexthops              |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ecmp\_nexthops\_max         |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_mac\_entries                |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_mac\_entries\_max           |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv4\_neighbors             |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv6\_neighbors             |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv4\_routes                |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_ipv6\_routes                |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_entries       |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_entries\_max  |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_counters      |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_counters\_max |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_meters        |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_meters\_max   |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_slices        |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_ingress\_slices\_max   |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_entries        |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_entries\_max   |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_counters       |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_counters\_max  |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_meters         |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_meters\_max    |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_slices         |           |   ✓   |     ✓    |    ✓    |
| broadcom\_hw\_acl\_egress\_slices\_max    |           |   ✓   |     ✓    |    ✓    |

#### nvidia\_gpu (enterprise = 5703, format = 1)

| Name                     | Community | Basic | Standard | Premium |
| ------------------------ | :-------: | :---: | :------: | :-----: |
| nvidia\_gpu\_devices     |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_processes   |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_gpu\_time   |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_mem\_time   |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_mem\_total  |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_mem\_free   |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_ecc\_errors |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_energy      |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_temperature |           |   ✓   |     ✓    |    ✓    |
| nvidia\_gpu\_fan\_speed  |           |   ✓   |     ✓    |    ✓    |


# Installation


# System Requirements

### Compute Resources

The resources required to collect, decode and process flow records is dependent on the type of record (Netflow, IPFIX or sFlow), and the specific contents of those records.

#### CPU Cores

The decoding and processing flow records is primarily a CPU-centric load. While there are various factors that will affect throughput, the following table provides guidance on the expected throughput per core on current server-class processors.

| Flow Type  | Flows/sec. |
| ---------- | ---------- |
| Netflow v5 | 3500-4000  |
| Netflow v9 | 4500-5000  |
| IPFIX      | 4500-5000  |
| sFlow v5   | 3250-3750  |

{% hint style="info" %}
As mentioned, the above values are an approximate range of records per second. Depending on the specific content of flow records in a given environment, and the actual performance of the CPU, actual throughput may be less (or more) than the indicated range.
{% endhint %}

#### Memory

The collector will cache various pieces of information, such an Netflow v9 and IPFIX templates, DNS names, Interfaces names, and more. This cached data is held in memory. Memory usage is generally less than a 1-2GB. However, environments which observe a high number of public IP addresses, for which Maxmind or NetIntel enrichment options are enabled, will have higher memory requirements.

If you are ingesting Cloud Flow Logs from Azure or AWS through S3 buckets additional memory will be required. This is because we're receiving bulk flow log data rather than a data stream. In our testing we needed roughly 5GB of memory to run NetObserv Flow ingesting 4,000 Azure VNet flows per second.

### Recommended Kernel Tuning

The high volume of UDP packets experienced in many environments, combined with less than optimal default Linux kernel network parameters, can result in kernel buffer overflows and dropped packets. To minimize the chance of such data loss, especially during sudden peaks in packet volume, the Linux kernel network parameters should be modified as shown in the following examples.

{% hint style="info" %}
The recommended settings should be added to a file in `/etc/sysctl.d` so that they are applied automatically when the system is booted.
{% endhint %}

For light to moderate ingest rates (less than 75000 flows per second):

```conf
net.core.netdev_max_backlog=4096
net.core.rmem_default=262144
net.core.rmem_max=67108864
net.ipv4.udp_rmem_min=131072
net.ipv4.udp_mem=2097152 4194304 8388608
```

For heavy ingest rates (more than 75000 flows per second):

```conf
net.core.netdev_max_backlog=8192
net.core.rmem_default=262144
net.core.rmem_max=134217728
net.ipv4.udp_rmem_min=131072
net.ipv4.udp_mem=4194304 8388608 16777216
```

### Network Connectivity

Depending on the configured options, the ElastiFlow solution will require various TCP and UDP ports to receive flow records, retrieve data for enrichment and store data in the chosen data platform. Any host or network firewalls through which such traffic must pass, will need to be configured to allow communication on these ports.

{% hint style="info" %}
The UDP and TCP ports used by many systems is often configurable. The following tables of port numbers refer to the *default* ports.
{% endhint %}

#### Listening for Flow Data

NetObserv Flow can be configured to listen for incoming flow record packets on one or more UDP ports, and to retrieve Azure vnet flow logs via their https & amqp API. The default and other common ports are listed in the following table.

| Protocol | Port            | Direction | Description             |
| -------- | --------------- | --------- | ----------------------- |
| UDP      | 9995            | in        | ElastiFlow default port |
| UDP      | 2055            | in        | Netflow standard port   |
| UDP      | 4739            | in        | IPFIX standard port     |
| UDP      | 6343            | in        | sFlow standard port     |
| UDP      | 9996-9998       | in        | additional common ports |
| TCP      | 443, 5671, 5672 | out       | Azure vnet flow logs    |

While a variety of ports can be used to listen for flow record packets, the specific ports which must be allowed are those for which the collector is configured using `EF_FLOW_SERVER_UDP_PORT`.

#### Accessing Enrichment Data

NetObserv Flow can enrich flow records with various additional information. Depending on the configured enrichment options, communication on the following ports must be allowed.

**DNS**

Required when `EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE` is `true`.

| Protocol | Port | Direction | Description |
| -------- | ---- | --------- | ----------- |
| UDP      | 53   | out       | DNS         |

**SNMP**

Required when `EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`.

| Protocol | Port | Direction | Description                           |
| -------- | ---- | --------- | ------------------------------------- |
| UDP      | 161  | out       | Network interface attributes via SNMP |

**NetIntel**

To retrieve Network Intelligence data, NetObserv Flow requires an internet connection over port 443.

| Protocol | Port | Direction | Description                                                                     |
| -------- | ---- | --------- | ------------------------------------------------------------------------------- |
| TCP      | 443  | out       | NetIntel API: `query.netintel.elastiflow.com`                                   |
| TCP      | 443  | out       | NetIntel API: [CloudFlare IP ranges](https://www.cloudflare.com/en-gb/ips/)     |
| TCP      | 443  | out       | NetIntel Storage: [CloudFlare IP ranges](https://www.cloudflare.com/en-gb/ips/) |
| TCP      | 443  | out       | Google Storage API: storage.googleapis.com                                      |

#### Storing Data

NetObserv Flow supports sending the collected and processed flow records to a variety of data platforms. The port used by each supported platform is provided in the following tables.

**Elastic Stack**

Required when `EF_OUTPUT_ELASTICSEARCH_ENABLE` is `true`.

| Protocol | Port | Direction | Description            |
| -------- | ---- | --------- | ---------------------- |
| TCP      | 9200 | out       | Elasticsearch REST API |
| TCP      | 5601 | out       | Kibana UI and API      |

**OpenSearch**

Required when `EF_OUTPUT_OPENSEARCH_ENABLE` is `true`.

| Protocol | Port | Direction | Description                      |
| -------- | ---- | --------- | -------------------------------- |
| TCP      | 9200 | out       | OpenSearch REST API              |
| TCP      | 5601 | out       | OpenSearch Dashboards UI and API |

{% hint style="info" %}
Currently the Elasticsearch output is used for storing data in both the Elasticsearch and OpenSearch. It is expected that the APIs of the applications will diverge over time. For this reason a dedicated OpenSearch-specific output will be available in a future release.
{% endhint %}

**Splunk**

Required when `EF_OUTPUT_SPLUNK_HEC_ENABLE` is `true`.

| Protocol | Port | Direction | Description                |
| -------- | ---- | --------- | -------------------------- |
| TCP      | 8088 | out       | HTTP Event Collector (HEC) |
| TCP      | 8000 | out       | Splunk UI                  |

**Kafka**

Required when `EF_OUTPUT_KAFKA_ENABLE` is `true`.

| Protocol | Port | Direction | Description  |
| -------- | ---- | --------- | ------------ |
| TCP      | 9092 | out       | Kafka broker |

**Cribl**

Required when `EF_OUTPUT_CRIBL_ENABLE` is `true`.

| Protocol | Port | Direction | Description  |
| -------- | ---- | --------- | ------------ |
| TCP      | 8088 | out       | Cribl Worker |


# Installation on Linux

{% hint style="info" %}
This section provides the installation steps for NetObserv Flow. Many users get started using ElastiFlow with the Elastic Stack (Elasticsearch and Kibana). To install and configure **both** the Elastic Stack and NetObserv Flow, step-by-step instructions are provided for both [**Ubuntu/Debian**](/data_platforms/elastic/install_ubuntu) and [**RedHat/AlmaLinux**](/data_platforms/elastic/install_redhat).
{% endhint %}

NetObserv Flow can be installed natively on Linux. Packages are currently provided for and supported on the Linux distributions and versions listed in the following table.

| Distribution              | Versions             |
| ------------------------- | -------------------- |
| Ubuntu                    | 22.04 LTS, 24.04 LTS |
| Debian                    | 12                   |
| RHEL/RockyLinux/AlmaLinux | 8.x, 9.x             |

### Ubuntu/Debian Installation (deb)

The Debian package for the NetObserv Flow can be downloaded from [here](https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector_7.25.0_linux_amd64.deb). It can be used for installation on most Debian-based systems such as Debian and Ubuntu.

#### Download the `.deb` Package

The package can be downloaded using either the `wget` or `curl` command:

<pre data-overflow="wrap"><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

<pre data-overflow="wrap"><code>curl https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb --output flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

#### Verify the Package

**Checksum Verification**

To ensure the downloaded file was fully downloaded and wasn't corrupted or tampered with, you can verify the provided checksum matches.

<pre data-overflow="wrap"><code># get checksum of the downloaded file:
sha256sum flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb

# verify the checksum provided from the previous command matches the checksum here:
https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb.sha256
</code></pre>

**GPG Verification**

ElastiFlow signs the Debian package with a GNU Privacy Guard (GPG) key. To verify the Debian package, download and import the ElastiFlow GPG public key:

```shell
# import public key into gpg keychain
curl -o- https://elastiflow-releases.s3.us-east-2.amazonaws.com/elastiflow.pgp | gpg --import -

# trust the public key
echo "6A2E26EFDE24AA7A634A442ED5C0572E5D212F6B:6:" | gpg --import-ownertrust
```

Next, download the signature file:

<pre data-overflow="wrap"><code>curl -SLO https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb.sig
</code></pre>

Finally, verify the file with the signature:

<pre><code>gpg --verify flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb.sig flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

#### Ensure that `libpcap-dev` and `ca-certificates` are Installed

The collector requires `libpcap-dev` and `ca-certificates`. Check if the packages are installed:

```shell
sudo dpkg-query -l | grep libpcap-dev
sudo dpkg-query -l | grep ca-certificates
```

If installed, the output will look similar to the following:

```shell
ii  libpcap-dev:amd64       1.10.1-4build1                          amd64        development library for libpcap (transitional package)
ii  ca-certificates         20230311ubuntu0.22.04.1                 all          Common CA certificates
```

If the packages are not present, install them:

```shell
sudo apt install libpcap-dev ca-certificates
```

#### Install the `.deb` Package

There are two methods to install the NetObserv Flow package, `apt` or `dpkg`.

**Install with `apt`**

<pre><code>sudo apt install ./flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

**Install with `dpkg`**

<pre><code>sudo dpkg -i flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

### RedHat/AlmaLinux Installation (rpm)

The RPM package for NetObserv Flow can be downloaded [here](https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector-7.25.0-1.x86_64.rpm). It can be used for installation on most RedHat-based systems such as RHEL and CentOS.

#### Download the `.rpm` Package

The package can be easily downloaded using `wget` or `curl`:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

<pre><code>curl https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm --output flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

#### Verify the Package

**Checksum Verification**

To ensure the downloaded file was fully downloaded and wasn't corrupted or tampered with, you can verify the provided checksum matches.

<pre><code># get checksum of the downloaded file:
sha256sum flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm

# verify the checksum provided from the previous command matches the checksum here:
https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm.sha256
</code></pre>

**GPG Verification**

ElastiFlow signs the RPM package with a GNU Privacy Guard (GPG) key. To verify the RPM package, download and import the ElastiFlow GPG public key:

```shell
# import public key into gpg keychain
curl -o- https://elastiflow-releases.s3.us-east-2.amazonaws.com/elastiflow.pgp | gpg --import -

# trust the public key
echo "6A2E26EFDE24AA7A634A442ED5C0572E5D212F6B:6:" | gpg --import-ownertrust

# import public key into rpm trust store
rpm --import https://elastiflow-releases.s3.us-east-2.amazonaws.com/elastiflow.pgp
```

Next, download the signature file:

<pre><code>curl -SLO https://elastiflow-releases.s3.us-east-2.amazonaws.com/flow-collector/flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm.sig
</code></pre>

Finally, verify the file with the signature:

<pre><code>gpg --verify flow-collector- <code class="expression">space.vars.current_version</code>-1.x86_64.rpm.sig flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

#### Ensure that `libpcap`, `libpcap-devel` and `ca-certificates` are Installed

The collector requires `libpcap`, `libpcap-devel` and `ca-certificates`. Check if the packages are installed:

```shell
rpm -q libpcap libpcap-devel ca-certificates
```

If installed, the output will look similar to the following:

```shell
libpcap-1.9.1-5.el8.x86_64
libpcap-devel-1.9.1-5.el8.x86_64
ca-certificates-2023.2.60_v7.0.306-80.0.el8_8.noarch
```

If the packages are not present, install them:

**RHEL 8.x based Distributions (Alma, Rocky, Fedora, etc.)**

```shell
sudo dnf --enablerepo=powertools install libpcap libpcap-devel ca-certificates -y
```

**RHEL 9.x based Distributions (Alma, Rocky, Fedora, etc.)**

```shell
sudo dnf --enablerepo=crb install libpcap libpcap-devel ca-certificates -y
```

**RHEL 9.x Distributions (Official RedHat distribution)**

```shell
sudo dnf --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install libpcap libpcap-devel ca-certificates -y
```

#### Install/Upgrade the `.rpm` Package

If installing the NetObserv Flow package for the first time, i.e. NOT upgrading, run the following:

<pre><code>sudo yum install -y flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

If upgrading from a previously installed NetObserv Flow package, run the following:

<pre><code>sudo rpm -Uhv flow-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

### Configuration

The NetObserv Flow will be installed to run as a daemon managed by `systemd`. Configuration of the collector is provided via environment variables and, depending on the enabled options, via various configuration files which by default are located within `/etc/elastiflow`.

To configure the NetObserv Flow, edit the file `/etc/elastiflow/flowcoll.yml`. For details on the configuration options, please refer to the [Configuration Reference](/flowcoll/configuration).

{% hint style="info" %}
At a minimum the NetObserv Flow must point to a valid data store. Additionally, source flows need to be pointed to the NetObserv Flow so it can pass those along to the data store. The most common installation uses Elasticsearch and Kibana as the data store.\
To install and configure **both** the Elastic Stack and NetObserv Flow, step-by-step instructions are provided for both [**Ubuntu/Debian**](/data_platforms/elastic/install_ubuntu) and [**RedHat/AlmaLinux**](/data_platforms/elastic/install_redhat).
{% endhint %}

### Running the Collector

To start the collector, execute the follow commands:

```shell
sudo systemctl daemon-reload && sudo systemctl start flowcoll.service
```

To ensure the collector has started and is running, execute:

```shell
sudo systemctl status flowcoll.service
```

The collector can be stopped using:

```shell
sudo systemctl stop flowcoll.service
```

If you want the collector to be started automatically when the system is booted, it must be enabled:

```shell
sudo systemctl enable flowcoll.service
```


# Installation using Docker

A Docker container for NetObserv Flow is available on [Docker Hub](https://hub.docker.com/r/elastiflow/flow-collector). [docker-compose](https://docs.docker.com/compose/) is a good way to run the container. It allows for the various environment variables, used to configure the collector, to be easily managed in one place without having to enter them on the command line.

### docker-compose.yml

The following `docker-compose.yml` file provides an example with common settings that will likely need to be configured to process flow records and send them to Elasticsearch.

<pre data-overflow="wrap"><code>
services:
  # ElastiFlow NetObserv Flow
  flow-collector:
      image: elastiflow/flow-collector:<code class="expression">space.vars.current_version</code>
      container_name: flow-collector
      restart: 'unless-stopped'
      network_mode: 'host'
      volumes:
        # mkdir -p /etc/elastiflow &#x26;&#x26; chown -R 1000:1000 /etc/elastiflow
        - /etc/elastiflow:/etc/elastiflow
        # mkdir -p /var/lib/elastiflow/flowcoll &#x26;&#x26; chown -R 1000:1000 /var/lib/elastiflow
        - /var/lib/elastiflow/flowcoll:/var/lib/elastiflow/flowcoll
      environment:
        EF_LICENSE_ACCEPTED: 'false'
        #EF_ACCOUNT_ID: ''

        #EF_LICENSE_KEY: ''
        #EF_LICENSE_FLOW_RECORDS_PER_SECOND:

        #EF_INSTANCE_NAME: default
        #EF_API_PORT: 8080
        #EF_API_TLS_ENABLE: ''
        #EF_API_TLS_CERT_FILEPATH: ''
        #EF_API_TLS_KEY_FILEPATH: ''
        #EF_API_BASIC_AUTH_ENABLE: 'false'
        #EF_API_BASIC_AUTH_USERNAME: ''
        #EF_API_BASIC_AUTH_PASSWORD: ''

        #EF_LOGGER_LEVEL: 'info'
        #EF_LOGGER_ENCODING: 'json'
        #EF_LOGGER_FILE_LOG_ENABLE: 'false'
        #EF_LOGGER_FILE_LOG_FILENAME: '/var/log/elastiflow/flowcoll/flowcoll.log'
        #EF_LOGGER_FILE_LOG_MAX_SIZE: 100
        #EF_LOGGER_FILE_LOG_MAX_AGE: ''
        #EF_LOGGER_FILE_LOG_MAX_BACKUPS: 4
        #EF_LOGGER_FILE_LOG_COMPRESS: 'false'

        EF_FLOW_SERVER_UDP_IP: '0.0.0.0'
        EF_FLOW_SERVER_UDP_PORT: 9995
        #EF_FLOW_SERVER_UDP_READ_BUFFER_MAX_SIZE: 134217728

        #EF_FLOW_PACKET_STREAM_MAX_SIZE:

        EF_AWS_VPC_FLOW_LOG_S3_ENABLE: 'false'
        #EF_AWS_VPC_FLOW_LOG_S3_BUCKET: ''
        #EF_AWS_VPC_FLOW_LOG_S3_PREFIX: 'AWSLogs'
        #AWS_REGION: ''
        #AWS_ACCESS_KEY_ID: ''
        #AWS_SECRET_ACCESS_KEY: ''
        #EF_AWS_VPC_FLOW_LOG_S3_TLS_ENABLE: 'false'
        #EF_AWS_VPC_FLOW_LOG_S3_TLS_SKIP_VERIFICATION: 'false'
        #EF_AWS_VPC_FLOW_LOG_S3_TLS_CA_CERT_FILEPATH: ''
        #EF_AWS_VPC_FLOW_LOG_S3_TLS_MIN_VERSION: '1.2'

        #EF_INPUT_FLOW_BENCHMARK_ENABLE: 'false'
        #EF_INPUT_FLOW_BENCHMARK_PACKET_FILEPATH: '/etc/elastiflow/benchmark/flow/packets.txt'

        #EF_PROCESSOR_POOL_SIZE:

        #EF_PROCESSOR_DECODE_IPFIX_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_NETFLOW1_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_NETFLOW5_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_NETFLOW6_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_NETFLOW7_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_NETFLOW9_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_SFLOW5_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_SFLOW_FLOWS_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_SFLOW_FLOWS_KEEP_SAMPLES: 'false'
        #EF_PROCESSOR_DECODE_SFLOW_COUNTERS_ENABLE: 'true'
        #EF_PROCESSOR_DECODE_MAX_RECORDS_PER_PACKET: 64

        #EF_PROCESSOR_TRANSLATE_KEEP_IDS: 'default'

        EF_PROCESSOR_ENRICH_APP_ID_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_APP_ID_PATH: '/etc/elastiflow/app/appid.yml'
        #EF_PROCESSOR_ENRICH_APP_ID_TTL: 7200
        EF_PROCESSOR_ENRICH_APP_IPPORT_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_APP_IPPORT_PATH: '/etc/elastiflow/app/ipport.yml'
        #EF_PROCESSOR_ENRICH_APP_IPPORT_TTL: 7200
        #EF_PROCESSOR_ENRICH_APP_IPPORT_PRIVATE: 'true'
        #EF_PROCESSOR_ENRICH_APP_IPPORT_PUBLIC: 'false'
        #EF_PROCESSOR_ENRICH_APP_REFRESH_RATE: 15

        #EF_PROCESSOR_ENRICH_IPADDR_TTL: 7200

        EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH: '/etc/elastiflow/metadata/ipaddrs.yml'
        #EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE: 15

        EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE: 'false'
        EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_IP: ''
        EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_TIMEOUT: 3000
        #EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PRIVATE: 'true'
        #EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PUBLIC: 'true'
        #EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH: '/etc/elastiflow/hostname/user_defined.yml'
        #EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_REFRESH_RATE: 15
        #EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_PATH: '/etc/elastiflow/hostname/incl_excl.yml'
        #EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_REFRESH_RATE: 15

        EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_ASN_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_ASN_PATH: '/etc/elastiflow/maxmind/GeoLite2-ASN.mmdb'

        EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_PATH: '/etc/elastiflow/maxmind/GeoLite2-City.mmdb'
        #EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_VALUES: 'city,country,country_code,location,timezone'
        #EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_LANG: 'en'
        #EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_INCLEXCL_PATH: '/etc/elastiflow/maxmind/incl_excl.yml'
        #EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_INCLEXCL_REFRESH_RATE: 15
        #EF_PROCESSOR_ENRICH_ASN_PREF: 'lookup'

        #EF_PROCESSOR_ENRICH_NETIF_TTL: 7200

        EF_PROCESSOR_ENRICH_NETIF_METADATA_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_NETIF_METADATA_USERDEF_PATH: '/etc/elastiflow/metadata/ipaddrs.yml'
        #EF_PROCESSOR_ENRICH_NETIF_METADATA_REFRESH_RATE: 15

        EF_PROCESSOR_ENRICH_NETIF_FLOW_OPTIONS_ENABLE: 'true'

        EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_PORT: 161
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_VERSION: 2
        EF_PROCESSOR_ENRICH_NETIF_SNMP_COMMUNITIES: 'public'
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_USERNAME: ''
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_AUTHENTICATION_PROTOCOL: 'noauth'
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_AUTHENTICATION_PASSPHRASE: ''
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_PRIVACY_PROTOCOL: 'nopriv'
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_PRIVACY_PASSPHRASE: ''
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_TIMEOUT: 2
        #EF_PROCESSOR_ENRICH_NETIF_SNMP_RETRIES: 1

        #EF_PROCESSOR_ENRICH_TOTALS_IF_NO_DELTAS: 'false'

        #EF_PROCESSOR_ENRICH_SAMPLERATE_CACHE_SIZE: 32768
        #EF_PROCESSOR_ENRICH_SAMPLERATE_USERDEF_ENABLE: 'false'
        #EF_PROCESSOR_ENRICH_SAMPLERATE_USERDEF_PATH: '/etc/elastiflow/settings/sample_rate.yml'
        #EF_PROCESSOR_ENRICH_SAMPLERATE_USERDEF_OVERRIDE: 'false'

        #EF_PROCESSOR_ENRICH_COMMUNITYID_ENABLE: 'true'
        #EF_PROCESSOR_ENRICH_COMMUNITYID_SEED: 0
        #EF_PROCESSOR_ENRICH_CONVERSATIONID_ENABLE: 'true'
        #EF_PROCESSOR_ENRICH_CONVERSATIONID_SEED: 0

        #EF_PROCESSOR_ENRICH_JOIN_ASN: 'true'
        #EF_PROCESSOR_ENRICH_JOIN_GEOIP: 'true'
        #EF_PROCESSOR_ENRICH_JOIN_SEC: 'true'
        #EF_PROCESSOR_ENRICH_JOIN_NETATTR: 'true'
        #EF_PROCESSOR_ENRICH_JOIN_SUBNETATTR: 'true'

        #EF_PROCESSOR_DURATION_PRECISION: 'ms'
        #EF_PROCESSOR_TIMESTAMP_PRECISION: 'ms'
        #EF_PROCESSOR_PERCENT_NORM: 100
        #EF_PROCESSOR_EXPAND_CLISRV: 'true'
        #EF_PROCESSOR_EXPAND_CLISRV_NO_L4_PORTS: 'true'
        #EF_PROCESSOR_KEEP_CPU_TICKS: 'false'

        #EF_PROCESSOR_DROP_FIELDS: ''

        #EF_PROCESSOR_IFA_ENABLE: 'false'

        # stdout
        #EF_OUTPUT_STDOUT_ENABLE: 'false'
        #EF_OUTPUT_STDOUT_FORMAT: 'json_pretty'

        # monitor
        #EF_OUTPUT_MONITOR_ENABLE: 'false'
        #EF_OUTPUT_MONITOR_INTERVAL: 300

        # Elasticsearch
        EF_OUTPUT_ELASTICSEARCH_ENABLE: 'false'
        EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE: 'false'
        #EF_OUTPUT_ELASTICSEARCH_BATCH_DEADLINE: 2000
        #EF_OUTPUT_ELASTICSEARCH_BATCH_MAX_BYTES: 8388608
        #EF_OUTPUT_ELASTICSEARCH_TIMESTAMP_SOURCE: 'collect'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD: 'rollover'
        #EF_OUTPUT_ELASTICSEARCH_TSDS_ENABLE: 'false'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_SUFFIX: ''
        #EF_OUTPUT_ELASTICSEARCH_DROP_FIELDS: ''
        #EF_OUTPUT_ELASTICSEARCH_ALLOWED_RECORD_TYPES: 'as_path_hop,flow_option,flow,telemetry'

        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ENABLE: 'true'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_OVERWRITE: 'true'
        EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_SHARDS: 1
        EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_REPLICAS: 0
        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_REFRESH_INTERVAL: '10s'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_CODEC: 'best_compression'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ILM_LIFECYCLE: 'elastiflow'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_PIPELINE_DEFAULT: '_none'
        #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_PIPELINE_FINAL: '_none'

        # A comma separated list of Elasticsearch nodes to use. DO NOT include "http://" or "https://"
        EF_OUTPUT_ELASTICSEARCH_ADDRESSES: '127.0.0.1:9200'
        EF_OUTPUT_ELASTICSEARCH_USERNAME: 'elastic'
        EF_OUTPUT_ELASTICSEARCH_PASSWORD: 'changeme'
        #EF_OUTPUT_ELASTICSEARCH_CLOUD_ID: ''
        #EF_OUTPUT_ELASTICSEARCH_API_KEY: ''
        #EF_OUTPUT_ELASTICSEARCH_CLIENT_CA_CERT_FILEPATH: ''
        #EF_OUTPUT_ELASTICSEARCH_CLIENT_CERT_FILEPATH: ''
        #EF_OUTPUT_ELASTICSEARCH_CLIENT_KEY_FILEPATH: ''

        EF_OUTPUT_ELASTICSEARCH_TLS_ENABLE: 'false'
        EF_OUTPUT_ELASTICSEARCH_TLS_SKIP_VERIFICATION: 'false'
        EF_OUTPUT_ELASTICSEARCH_TLS_CA_CERT_FILEPATH: ''

        #EF_OUTPUT_ELASTICSEARCH_RETRY_ENABLE: 'true'
        #EF_OUTPUT_ELASTICSEARCH_RETRY_ON_TIMEOUT_ENABLE: 'true'
        #EF_OUTPUT_ELASTICSEARCH_MAX_RETRIES: 3
        #EF_OUTPUT_ELASTICSEARCH_RETRY_BACKOFF: 1000

        # OpenSearch
        EF_OUTPUT_OPENSEARCH_ENABLE: 'false'
        EF_OUTPUT_OPENSEARCH_ECS_ENABLE: 'false'
        #EF_OUTPUT_OPENSEARCH_BATCH_DEADLINE: 2000
        #EF_OUTPUT_OPENSEARCH_BATCH_MAX_BYTES: 8388608
        #EF_OUTPUT_OPENSEARCH_TIMESTAMP_SOURCE: 'collect'
        #EF_OUTPUT_OPENSEARCH_INDEX_PERIOD: 'daily'
        #EF_OUTPUT_OPENSEARCH_INDEX_SUFFIX: ''
        #EF_OUTPUT_OPENSEARCH_DROP_FIELDS: ''
        #EF_OUTPUT_OPENSEARCH_ALLOWED_RECORD_TYPES: 'as_path_hop,flow_option,flow,telemetry'

        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_ENABLE: 'true'
        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_OVERWRITE: 'true'
        EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_SHARDS: 1
        EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_REPLICAS: 0
        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_REFRESH_INTERVAL: '10s'
        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_CODEC: 'best_compression'
        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_ISM_POLICY: 'elastiflow'
        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_PIPELINE_DEFAULT: '_none'
        #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_PIPELINE_FINAL: '_none'

        # A comma separated list of OpenSearch nodes to use. DO NOT include "http://" or "https://"
        EF_OUTPUT_OPENSEARCH_ADDRESSES: '127.0.0.1:9200'
        EF_OUTPUT_OPENSEARCH_USERNAME: 'admin'
        EF_OUTPUT_OPENSEARCH_PASSWORD: 'admin'
        #EF_OUTPUT_OPENSEARCH_CLIENT_CA_CERT_FILEPATH: ''
        #EF_OUTPUT_OPENSEARCH_CLIENT_CERT_FILEPATH: ''
        #EF_OUTPUT_OPENSEARCH_CLIENT_KEY_FILEPATH: ''

        EF_OUTPUT_OPENSEARCH_TLS_ENABLE: 'false'
        EF_OUTPUT_OPENSEARCH_TLS_SKIP_VERIFICATION: 'false'
        EF_OUTPUT_OPENSEARCH_TLS_CA_CERT_FILEPATH: ''

        #EF_OUTPUT_OPENSEARCH_RETRY_ENABLE: 'true'
        #EF_OUTPUT_OPENSEARCH_RETRY_ON_TIMEOUT_ENABLE: 'true'
        #EF_OUTPUT_OPENSEARCH_MAX_RETRIES: 3
        #EF_OUTPUT_OPENSEARCH_RETRY_BACKOFF: 1000

        # Splunk
        EF_OUTPUT_SPLUNK_HEC_ENABLE: 'false'
        #EF_OUTPUT_SPLUNK_HEC_CIM_ENABLE: 'false'
        EF_OUTPUT_SPLUNK_HEC_ADDRESSES: '127.0.0.1:8088'
        EF_OUTPUT_SPLUNK_HEC_TOKEN: ''
        #EF_OUTPUT_SPLUNK_HEC_BATCH_MAX_BYTES: 8388608
        #EF_OUTPUT_SPLUNK_HEC_BATCH_DEADLINE: 2000
        #EF_OUTPUT_SPLUNK_HEC_TLS_ENABLE: 'true'
        #EF_OUTPUT_SPLUNK_HEC_TLS_SKIP_VERIFICATION: 'false'
        #EF_OUTPUT_SPLUNK_HEC_TLS_CA_CERT_FILEPATH: ''
        #EF_OUTPUT_SPLUNK_HEC_DROP_FIELDS: ''

        # Kafka
        EF_OUTPUT_KAFKA_ENABLE: 'false'
        EF_OUTPUT_KAFKA_BROKERS: ''
        #EF_OUTPUT_KAFKA_VERSION: '1.0.0'
        #EF_OUTPUT_KAFKA_TOPIC: 'elastiflow-flow-codex'
        #EF_OUTPUT_KAFKA_PARTITION_KEY: 'flow.export.ip.addr'
        #EF_OUTPUT_KAFKA_CLIENT_ID: 'elastiflow-flowcoll'
        #EF_OUTPUT_KAFKA_RACK_ID: ''
        #EF_OUTPUT_KAFKA_TIMEOUT: 30
        #EF_OUTPUT_KAFKA_DROP_FIELDS: ''
        #EF_OUTPUT_KAFKA_ALLOWED_RECORD_TYPES: 'as_path_hop,flow_option,flow,telemetry'
        #EF_OUTPUT_KAFKA_FLAT_RECORD_ENABLE: 'true'

        EF_OUTPUT_KAFKA_SASL_ENABLE: 'false'
        #EF_OUTPUT_KAFKA_SASL_USERNAME: ''
        #EF_OUTPUT_KAFKA_SASL_PASSWORD: ''

        #EF_OUTPUT_KAFKA_TLS_ENABLE: 'false'
        #EF_OUTPUT_KAFKA_TLS_CA_CERT_FILEPATH: ''
        #EF_OUTPUT_KAFKA_TLS_CERT_FILEPATH: ''
        #EF_OUTPUT_KAFKA_TLS_KEY_FILEPATH: ''
        #EF_OUTPUT_KAFKA_TLS_SKIP_VERIFICATION: 'false'

        #EF_OUTPUT_KAFKA_PRODUCER_MAX_MESSAGE_BYTES: 1000000
        #EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS: 1
        #EF_OUTPUT_KAFKA_PRODUCER_TIMEOUT: 10
        #EF_OUTPUT_KAFKA_PRODUCER_COMPRESSION: 3
        #EF_OUTPUT_KAFKA_PRODUCER_COMPRESSION_LEVEL: -1000
        #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_BYTES: 1000000
        #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_MESSAGES: 1024
        #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_FREQUENCY: 1000
        #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_MAX_MESSAGES: 0
        #EF_OUTPUT_KAFKA_PRODUCER_RETRY_MAX: 3
        #EF_OUTPUT_KAFKA_PRODUCER_RETRY_BACKOFF: 100

        # Cribl
        EF_OUTPUT_CRIBL_ENABLE: 'false'
        EF_OUTPUT_CRIBL_ADDRESSES: '127.0.0.1:10080'
        EF_OUTPUT_CRIBL_TOKEN: ''
        #EF_OUTPUT_CRIBL_BATCH_DEADLINE: 2000
        #EF_OUTPUT_CRIBL_BATCH_MAX_BYTES: 8388608
        #EF_OUTPUT_CRIBL_TLS_ENABLE: 'false'
        #EF_OUTPUT_CRIBL_TLS_SKIP_VERIFICATION: 'false'
        #EF_OUTPUT_CRIBL_TLS_CA_CERT_FILEPATH: ''
        #EF_OUTPUT_CRIBL_DROP_FIELDS: ''

        # Generic HTTP
        EF_OUTPUT_GENERIC_HTTP_ENABLE: 'false'
        EF_OUTPUT_GENERIC_HTTP_ECS_ENABLE: 'false'
        #EF_OUTPUT_GENERIC_HTTP_BATCH_DEADLINE: 2000
        #EF_OUTPUT_GENERIC_HTTP_BATCH_MAX_BYTES: 8388608
        EF_OUTPUT_GENERIC_HTTP_ADDRESSES: ''
        #EF_OUTPUT_GENERIC_HTTP_USERNAME: ''
        #EF_OUTPUT_GENERIC_HTTP_PASSWORD: ''
        #EF_OUTPUT_GENERIC_HTTP_TLS_ENABLE: 'false'
        #EF_OUTPUT_GENERIC_HTTP_TLS_SKIP_VERIFICATION: 'false'
        #EF_OUTPUT_GENERIC_HTTP_TLS_CA_CERT_FILEPATH: ''
        #EF_OUTPUT_GENERIC_HTTP_DROP_FIELDS: ''
        #EF_OUTPUT_GENERIC_HTTP_TIMESTAMP_SOURCE: 'collect'
</code></pre>

#### image

The name of the current released image is elastiflow/flow-collector:<code class="expression">space.vars.current\_version</code>.

#### restart

`restart` is set to `unless-stopped` so that the collector will restart automatically if it fails for some reason.

#### network\_mode

There is a old issue with Docker that persists still, where an inbound packet's source IP address is not persisted across the Docker bridge interface. This is not an issue for sFlow as the exporter's IP is extracted from the `agent_address` in the sFlow header. However for Netflow and IPFIX the source IP from the IP header is all that is available to determine which device sent the records. The Docker bridge messes this up.

To work around this issue `network_mode` must be set to `host`.

{% hint style="info" %}
On macOS Docker containers do not run natively on the operating system. They actually run in a behind the scenes linux VM. In the case \`host\` networking would be the network stack of the VM and not of macOS itself. This means the \`bridged\` mode networking must be used and the necessary port mapping defined. Because of the source IP issues mentioned above, you will not be able to do much on macOS other than basic testing.
{% endhint %}

#### volumes

There are a few scenarios where it is necessary to make files on the host file system available to the collector.

In the example above, `/etc/elastiflow` on the host's filesystem is mapped into the same path within the container. After downloading the `GeoLite2-City` and `GeoLite2-ASN` maxmind databases from the Maxmind website, they can be placed at `/etc/elastiflow/maxmind` on the host's filesystem and will be able to be accessed by the collector within the container.

The `/var/lib/elastiflow/flowcoll` path is used by the container to persist data across container restarts. This is a new requirement for version 7.5 and later. The path on the host system must be created and have the correct permissions set. The path can be changed to any desired location on the host system.

{% hint style="info" %}
It is also possible to build a new container, adding additional files as needed. This may the best choice if running the container in a dynamically orchestrated environment (e.g. running in Kubernetes). However for an instance dedicated to a specific host, using bind mounted volumes can be very convenient.
{% endhint %}

#### environment variables

NetObserv Flow is configured using environment variables. The settings above provide an example configuration that represents the most likely settings to consider and modify when deploying the collector.

For a complete reference of all configuration options please refer to the [Configuration Reference](/flowcoll/configuration).

#### Running the Container

After completing configuration of the collector in the `docker-compose.yml` file, you can start the container using one of the following commands...

From within the same path as the `docker-compose.yml` file:

```
docker compose up -d
```

From a path different from the location of the `docker-compose.yml` file:

```
docker compose -f /PATH/TO/docker-compose.yml up -d
```

To view the logs written by the container run:

```
docker logs -f NAME_OF_CONTAINER
```

To stop the container run:

```
docker compose down
```

or:

```
docker compose -f /PATH/TO/docker-compose.yml down
```


# Installation using Ansible

{% hint style="info" %}
The [Ansible collection for NetObserv](https://galaxy.ansible.com/ui/repo/published/elastiflow/netobserv/docs/) is currently a *technology preview*. The design and implementation are less mature than stable features and subject to change. Please provide feedback or report issues to the [ElastiFlow Forum](https://forum.elastiflow.com/).&#x20;
{% endhint %}

An ansible role is available to install and configure NetObserv Flow. The role is available via the [Ansible Galaxy role](https://galaxy.ansible.com/ui/repo/published/elastiflow/netobserv/content/role/netobserv_flow/).

### Requirements

* Ansible 2.16 or later
* Python 3.10 or later
* A target host running a supported version of Linux. For more information on available distributions and versions, see the [NetObserv Collection Requirements](https://github.com/elastiflow/ansible-collection-netobserv?tab=readme-ov-file#requirements).

### Example Playbooks

Here are the examples of how to use the `elastiflow.netobserv.netobserv_flow` role:

* [NetObserv Flow ES simple](https://github.com/elastiflow/ansible-collection-netobserv/tree/main/examples/netobserv_flow_es_simple): Deploy NetObserv Flow with "simple" Elasticsearch
* [NetObserv Flow OS simple](https://github.com/elastiflow/ansible-collection-netobserv/tree/main/examples/netobserv_flow_os_simple): Deploy NetObserv Flow with "simple" OpenSearch

### Usage Instructions

1. **Add the Role**: Add the `elastiflow.netobserv` collection to the `requirements.txt` in your Ansible roles directory or include it in your project structure and [install the requirements](https://docs.ansible.com/ansible/latest/galaxy/user_guide.html#installing-multiple-roles-from-a-file).
2. **Include the Role in Your Playbook**: Reference the `elastiflow.netobserv.netobserv_flow` role in your playbook as shown in the examples above (full role configuration [doc](https://github.com/elastiflow/ansible-collection-netobserv/tree/main/roles/netobserv_flow)).
3. **Run the Playbook**:
   * **Check Mode (Dry Run)**:

     ```
     ansible-playbook playbook.yml --check
     ```
   * **Apply Changes**:

     ```
     ansible-playbook playbook.yml
     ```


# Deployment using Helm

For Kubernetes deployments, the NetObserv Flow collector can be deployed using Helm. The Helm chart is available in the [NetObserv Flow Helm Chart GitHub repository](https://github.com/elastiflow/helm-chart-netobserv).

### Requirements

* Helm 3.x
* Kubernetes 1.19+
* A supported version of Linux on your nodes. Packages are currently provided for and supported on the Linux distributions and versions listed in the following table.

| Distribution              | Versions             |
| ------------------------- | -------------------- |
| Ubuntu                    | 22.04 LTS, 24.04 LTS |
| Debian                    | 12                   |
| RHEL/RockyLinux/AlmaLinux | 8.x, 9.x             |

### Installation

```
helm repo add netobserv https://elastiflow.github.io/helm-chart-netobserv/
helm repo update
helm install netobserv netobserv/netobserv-flow
```

### Configuration

#### License Setup

To configure an ElastiFlow license key, you can add the following to your `values.yaml`:

```yaml
license:
  createSecret: true
```

Then make sure to use Helm's `set` option to configure the license key when installing the chart. For example:

```sh
helm install netobserv netobserv/netobserv-flow \
  --set license.licenseKey="licensekeygoeshere"
```

#### Additional Configuration

For additional Kubernetes configuration information, refer to the comments in the [default values file](https://github.com/elastiflow/helm-chart-netobserv/blob/main/charts/netobserv-flow/values.yaml).

For additional environment variable configurations, refer to the [configuration reference guide](/flowcoll/configuration).


# Configuration


# Encrypting Configuration Files

## Overview <a href="#id-1fb3f9ab-535e-46e3-b4bc-c5d96c8a60e5" id="id-1fb3f9ab-535e-46e3-b4bc-c5d96c8a60e5"></a>

{% hint style="info" %}
This feature was introduced in NetObserv 7.21.0
{% endhint %}

NetObserv can encrypt configuration files (decrypting them on startup to read them).

Files encrypted with this feature:

* NetObserv Flow: flowcoll.yml, Azure vnet config file
  * See [additional docs](/flowcoll/configuration/encrypting-configuration-files/encrypting-azure-vnet-configuration) if you are using NetObserv Flow and want to encrypt Azure vnet config
* NetObserv SNMP: snmpcoll.yml
* NetObserv SNMP Trap: trapcoll.yml

## Set Up Encryption For Configuration Files <a href="#f4027373-4813-4604-9869-40687e34f955" id="f4027373-4813-4604-9869-40687e34f955"></a>

There are two modes of encryption:

1. (default) full-file encryption -- where the entire contents of the yml config file is encrypted.
2. Value-only encryption -- where the config names are plain-text in the yml file, but all the values are encrypted.

### Install System Dependencies <a href="#a0fc48dd-3a9c-4135-b812-f6c5fec662aa" id="a0fc48dd-3a9c-4135-b812-f6c5fec662aa"></a>

Ensure [age](https://github.com/FiloSottile/age) is installed in your local environment in order to edit the config file

```
# Debian based linux
sudo apt install age
age --version # to verify install
```

Or (for RPM based distributions)

```
# RPM based linux
sudo dnf install epel-release
sudo dnf install age
age --version # to verify install
```

If you want to use the value-only encryption mode, you must also install `sops`. Follow the [sops installation steps](https://github.com/getsops/sops?tab=readme-ov-file#1download) to install sops.

### Create Encryption Keys <a href="#c4e67db1-c40e-4f40-b62d-1d5cf5cb41bf" id="c4e67db1-c40e-4f40-b62d-1d5cf5cb41bf"></a>

<pre><code>sudo mkdir -p /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age
cd /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age
age-keygen | sudo tee key.age
age-keygen -y key.age | sudo tee public-age-keys.txt
</code></pre>

If you also want to encrypt the private key with a password (optional):

<pre><code>cd /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age
sudo age --encrypt -p -o key.age.enc key.age
sudo mv key.age.enc key.age
</code></pre>

### Enable File Encryption <a href="#id-0222e94b-dc82-41e7-b8ad-c2687cc5188e" id="id-0222e94b-dc82-41e7-b8ad-c2687cc5188e"></a>

Edit the file /etc/systemd/system/<code class="expression">page.vars.product\_shortname</code>.env

* set `EF_CONFIG_ENCRYPT_ENABLE=true`
* if you used a password to encrypt the private key, set `EF_CONFIG_ENCRYPT_PASSWORD` to match the password

If you want to use the alternative mode of encryption (where only values are encrypted), then change `EF_CONFIG_ENCRYPT_TYPE` to be `sops`

Then reload system config: `sudo systemctl daemon-reload`

#### Setting Up Initial Encryption <a href="#ab003428-1870-4c32-a69d-1ebe184b631a" id="ab003428-1870-4c32-a69d-1ebe184b631a"></a>

You must manually encrypt the config file for the first time.

**For Default Encryption Mode**

<pre><code>cd /etc/elastiflow
sudo age -e -R ./<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt -o <code class="expression">page.vars.product_shortname</code>.enc.yml <code class="expression">page.vars.product_shortname</code>.yml
sudo mv <code class="expression">page.vars.product_shortname</code>.enc.yml <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

**For Value-Only Encryption Mode**

If you have set `EF_CONFIG_ENCRYPT_TYPE` to `sops`, then you have to do the initial encryption of <code class="expression">page.vars.product\_shortname</code>.yml

<pre><code>cd /etc/elastiflow
sudo sops encrypt --age $(&#x3C; ./<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt) --input-type yaml --output-type yaml --output "<code class="expression">page.vars.product_shortname</code>.yml.enc" <code class="expression">page.vars.product_shortname</code>.yml
sudo mv <code class="expression">page.vars.product_shortname</code>.yml.enc <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

### Restart NetObserv <a href="#id-717c1466-f455-4b3a-91a6-83fa1809dca7" id="id-717c1466-f455-4b3a-91a6-83fa1809dca7"></a>

Restart NetObserv, and it will use the encrypted config file

<pre><code>sudo systemctl daemon-reload
sudo systemctl restart <code class="expression">page.vars.product_shortname</code>
</code></pre>

## Editing Config Files <a href="#id-2328ded6-1033-4ef2-9c46-1d65057414b7" id="id-2328ded6-1033-4ef2-9c46-1d65057414b7"></a>

#### Using Default Encryption Mode <a href="#id-0edea2d1-b89a-4283-b599-8220fcc9bad7" id="id-0edea2d1-b89a-4283-b599-8220fcc9bad7"></a>

To edit an encrypted config file, you will need to use the `age` cli tool to decrypt first.

<pre><code>cd /etc/elastiflow
sudo age -d -o <code class="expression">page.vars.product_shortname</code>.decrypted.yml -i ./<code class="expression">page.vars.product_shortname</code>/.age/key.age ./<code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

Then edit the contents of <code class="expression">page.vars.product\_shortname</code>.decrypted.yml

Once done, use `age` to encrypt again

<pre><code>cd /etc/elastiflow
sudo age -e -R ./<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt -o <code class="expression">page.vars.product_shortname</code>.yml <code class="expression">page.vars.product_shortname</code>.decrypted.yml
sudo rm <code class="expression">page.vars.product_shortname</code>.decrypted.yml
</code></pre>

Then restart NetObserv

#### Using Value-Only Encryption Mode <a href="#id-39297bb7-ef3d-4de5-b73c-4c6f07a595e2" id="id-39297bb7-ef3d-4de5-b73c-4c6f07a595e2"></a>

To securely edit encrypted configuration files, you can use sops via the CLI:

<pre><code>SOPS_AGE_RECIPIENTS=$(&#x3C;/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt) \
SOPS_AGE_KEY_FILE=/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/key.age \
sudo --preserve-env=SOPS_AGE_RECIPIENTS --preserve-env=SOPS_AGE_KEY_FILE \
sops /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

This command will decrypt the file in memory and open with a cli text editor. By default, the editor used will be vim

To use another editor (like nano) instead of vim, change the `EDITOR` environment variable:

<pre><code>EDITOR=nano \
SOPS_AGE_RECIPIENTS=$(&#x3C;/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt) \
SOPS_AGE_KEY_FILE=/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/key.age \
sudo --preserve-env=SOPS_AGE_RECIPIENTS --preserve-env=SOPS_AGE_KEY_FILE --preserve-env=EDITOR \
sops /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

Then restart NetObserv

### Disabling File Encryption <a href="#fee26357-e94f-423c-8088-2b3fa32a6dea" id="fee26357-e94f-423c-8088-2b3fa32a6dea"></a>

Edit /etc/systemd/system/<code class="expression">page.vars.product\_shortname</code>.env and set `EF_CONFIG_ENCRYPT_ENABLE=false`

If using default encryption mode, use this command to decrypt config file:

<pre><code>cd /etc/elastiflow
sudo age -d -o <code class="expression">page.vars.product_shortname</code>.decrypted.yml -i ./<code class="expression">page.vars.product_shortname</code>/.age/key.age ./<code class="expression">page.vars.product_shortname</code>.yml
sudo mv <code class="expression">page.vars.product_shortname</code>.decrypted.yml <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

If using value-only encryption mode, use this command:

<pre><code>cd /etc/elastiflow
SOPS_AGE_KEY_FILE="/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/key.age" sudo --preserve-env=SOPS_AGE_KEY_FILE sudo --preserve-env=SOPS_AGE_KEY_FILE sops decrypt --input-type yaml --output-type yaml --output "<code class="expression">page.vars.product_shortname</code>.yml.dec" "<code class="expression">page.vars.product_shortname</code>.yml"
sudo mv <code class="expression">page.vars.product_shortname</code>.yml.dec <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>


# Encrypting Azure Vnet Configuration

If you are using the [Azure Flow Logs (VNET)](/flowcoll/configuration/inputs/input_azure_vnet) input, and you want to encrypt the Azure vnet config file:

1. Setup [generic file encryption](/flowcoll/configuration/encrypting-configuration-files) first
2. follow the same steps used to encrypt flowcoll.yml (using either `age` or `sops` depending on encryption mode), but this time run it on `/etc/elastiflow/azure/flowlog_vnet.yml` file.


# Inputs


# Netflow/IPFIX/sFlow (UDP)

NetObserv Flow receives IPFIX, Netflow and sFlow network flow records and telemetry over UDP. By default the collector listens on all interfaces of the system where it is running. However it can be configured to listen on only a specific interface. The default UDP listening port is `9995`, which can also be configured.

It is recommended that the collector be configured to request a larger than default receive buffer size. The size, in bytes, that the collector will request be created by the operating system kernel is configurable. If this value exceeds the maximum allowed buffer size (`net.core.rmem_max` on Linux), the maximum allowed size is used.

Received UDP PDUs are queued prior to being processed by an available decoder. This allows the collector to better handle temporary spikes of received packets without losing data. The default size of the queue is `512`. This can be overridden using `EF_FLOW_PACKET_STREAM_MAX_SIZE`.

#### EF\_FLOW\_SERVER\_UDP\_IP

NetObserv Flow receives network flow records over UDP. This setting specifies the IP address of the interface on which the collector will listen.

* Valid Values
  * `0.0.0.0` or any valid IP address to which the UDP socket can be bound.
* Default
  * `0.0.0.0` (listen on all interfaces)

#### EF\_FLOW\_SERVER\_UDP\_PORT

The UDP port(s) on which the collector will create a socket to receive incoming packets. Multiple ports may be specified, separated by a comma. For example `2055,6343,4739`

* Valid Values
  * Any valid port number. Common values include:
    * `2055`: the standard port for Netflow
    * `4739`: the standard port for IPFIX
    * `6343`: the standard port for sFlow
    * `9995-9998`: commonly use port numbers
* Default
  * `2055,4739,6343,9995`

#### EF\_FLOW\_SERVER\_UDP\_READ\_BUFFER\_MAX\_SIZE

The size, in bytes, of the UDP receive buffer that the UDP server will request be created by the operating system kernel when the socket is created. If this value exceeds the maximum allowed buffer size (`net.core.rmem_max` on Linux), the maximum allowed size is used.

* Default
  * `33554432`

#### EF\_FLOW\_PACKET\_STREAM\_MAX\_SIZE

Received UDP PDUs are queued prior to being processed by an available decoder. This value specifies the size of the queue as a quantity of PDUs.

* Default
  * `512`


# AWS Flow Logs (Firehose HTTP)

NetObserv Flow supports the collection of AWS VPC Flow Logs directly from Amazon Firehose via an HTTP endpoint.

{% hint style="warning" %}
NOTICE

If an S3 bucket is involved, you need to use [AWS Flow Logs (S3)](/flowcoll/configuration/inputs/input_aws_s3) instead. Even if Firehose is involved, if Firehose is exporting to S3 bucket, those settings are required. These settings are only for when Firehose is exporting flow logs over HTTP directly.
{% endhint %}

To integrate with Firehose, it is necessary to create a Firehose stream with an HTTP Endpoint destination. The HTTP endpoint URL must point to a NetObserv server configured with TLS. The endpoint path must be `/api/v1/aws/firehose/flow-logs` to ensure it targets the correct API endpoint.

Although this is a public endpoint, it is recommended to set an access key for authentication. If an access key is configured, it must be set as an environment variable with the exact value.

## EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_HTTP\_ENABLE

This setting is used to enable or disable an HTTP endpoint which can receive data from Amazon Firehose.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_HTTP\_PORT

This setting is used to declare the port that the HTTP endpoint will listen on for incoming data from Amazon Firehose.

* Default
  * `443`

## EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_HTTP\_ACCESS\_KEY

This setting is used to declare the access key used by the configured Firehose stream if one is set. If this does not match the correct value, the API endpoint will error.

* Default
  * `""`

## EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_HTTP\_LOG\_FORMAT

This setting is used when the input is receiving data from Amazon Firehose. It specifies the format of the logs. Each key must be wrapped in a format that looks like `${key}` and must be a valid key according to AWS log formats.

* Default
  * `${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}`


# AWS Flow Logs (S3)

NetObserv Flow can collect AWS VPC Flow Logs stored in S3.

{% hint style="warning" %}
NOTICE

If *no S3 bucket* *is involved* because Firehose is exporting over HTTP, you will need to use [AWS Flow Logs (Firehose HTTP)](/flowcoll/configuration/inputs/input_aws_firehose) settings instead. If, however, flow logs are being exported into an S3 bucket by any means (with or without AWS Firehose involved), then these are the right settings to use.
{% endhint %}

When NetObserv Flow processes flow logs from the specified S3 bucket, it defaults to looking for a folder called “AWSLogs”. Every time NetObserv processes flow logs, it moves them to another folder called “elastiflow-processed”. This behavior is essential to ensure that the collector can easily identify flow logs which are already processed vs new flow logs that need to be processed still. The schema of the logs remains unchanged; only their location within the S3 bucket is modified.

If Firehose is being used to export flow logs into S3, then there are additional settings required. This is because Firehose does not include the field names in the exported data, therefore NetObserv must know to process the exported flow logs slightly differently.

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_ENABLE

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_BUCKET

The S3 bucket from which to fetch AWS VPC Flow Logs.

* Default
  * `''`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_PREFIX

* Default
  * `AWSLogs`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_POOL\_SIZE

Specifies the number of concurrent workers to start. Increasing the number of workers will allow the collector to better handle a processing vpc flow logs in s3.

* Default
  * `number of license units`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to AWS S3.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the AWS S3 endpoint to which the input is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the AWS S3 endpoint to which the input is attempting to connect.

* Default
  * `''`

## EF\_AWS\_VPC\_FLOW\_LOG\_S3\_TLS\_MIN\_VERSION

This setting is used to set the TLS minimum version

* Valid Values
  * `1.2`, `1.3`
* Default
  * `1.2`

## EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_S3\_ENABLE

This setting is used to declare an S3 bucket receives data from Amazon Firehose instead of directly from VPCs.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_AWS\_VPC\_FLOW\_LOG\_FIREHOSE\_S3\_LOG\_FORMAT

This setting is used when the input is receiving data from Amazon Firehose. It specifies the format of the logs. Each key must be wrapped in a format that looks like `${key}` and must be a valid key according to AWS log formats.

You do not need to set this unless you are using Firehose to export flow logs to S3, and if you customized the exported fields to be anything other than the default v1 fields.

* Default
  * `${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}`

## AWS\_REGION

The AWS SDK compatible environment variable that specifies the AWS Region to send the request to.

## AWS\_ACCESS\_KEY\_ID

Specifies an AWS access key associated with an IAM user or role.

## AWS\_SECRET\_ACCESS\_KEY

Specifies the secret key associated with the access key. This is essentially the "password" for the access key.


# Azure Flow Logs (VNET)

### Overview

NetObserv Flow can receive VNet flow logs from Microsoft Azure.

This input collects 'Virtual network flow logs' from Microsoft Azure Network Watcher. VNet flow logs provide information about IP traffic flowing through a virtual network. See [Azure documentation](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview) for more information about their flow log feature.

The retrieval of VNet flow logs is event-based, meaning that NetObserv Flow will listen for an event from Azure Event Hub and will then retrieve and ingest all new flow logs since the last event.

![Overview of Azure FLow Log Feature](/files/osCH4yvDiNWLfolJsiYK)

* [Azure setup guide](/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/setup_azure_flow_logs) (for setting configuring Azure to output flow logs)
* [Notes about system resources](/flowcoll/installation/requirements#memory) for using Azure Flow Logs
* [Supported information elements](/flowcoll/supported_ie/supported_ie_azure)

### Configuring NetObserv Flow to Receive Azure Flow Logs

### Firewall

The following ports must be open for outbound traffic to allow communication between the NetObserv Flow collector and Azure:

* **TCP 443**: This is the default port for HTTPS traffic.
* **TCP 5671 and 5672**: These are the default ports for AMQP traffic.

#### EF\_AZURE\_FLOW\_LOG\_VNET\_ENABLE

This enables the feature.

* Valid Values
  * `true`, `false`
* Default Value
  * `false`

#### EF\_AZURE\_FLOW\_LOG\_VNET\_CONFIG\_FILE\_PATH

The path to the config file for this feature. See below for more details.

* Default Value
  * `"/etc/elastiflow/azure/flowlog_vnet.yml"`

### VNet Consumers Configuration File

Here is a minimal example of what this config file will look like

```yml
- tenantId: "App registration Directory ID"
  clientId: "App registration Application ID"
  clientSecret: "App registration client secret"
  consumers:
    - namespace: "Host name of the Event Hubs namespace"
      name: "Name of the Event Hub"
      consumerGroup: "$Default"
```

* **tenantId** - This is the "Directory (tenant) Id" displayed from the "[Create an App registration](/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/setup_azure_flow_logs#create-an-app-registration)" step of the setup guide. This is the tenant ID associated with your Azure subscription. [More information](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant)
* **clientId** - This is the "Application (client) ID" displayed during that same step.
* **clientSecret** - This is the secret displayed from the "[Add a Client Secret](/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/setup_azure_flow_logs#add-a-client-secret)" step of the setup guide
* **consumers**: This is a list of consumer tuples. You must have at least one consumer with namespace and name defined; consumerGroup is optional and defaults to `$Default`.
  * **namespace**: This is the Event Hub Namespace created or configured during the "[Create an Events Hub namespace](/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/setup_azure_flow_logs#create-an-events-hub-namespace)" step of the setup guide. Namespace corresponds to a Kafka instance.
  * **name**: This is the Event Hub created or configured during the "[Create an Event Hub](/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/setup_azure_flow_logs#create-an-event-hub)" step of the setup guide. Name corresponds to a Kafka topic.
  * **consumerGroup**: This is the consumer group of the above name. The "Basic" tier of the Event Hub Namespace only allows a single $Default consumer group; the "Standard" tier allows multiple consumer groups. Create consumer groups if you want to run multiple independent instances of flowcoll (or other consumers of these events). If you're using the $Default group, you can omit this field, as $Default is its default value.


# Benchmark Input

NetObserv Flow provides a benchmarking input which is helpful for evaluating the performance of your environment. This input runs indefinitely until the collector is shut down.

#### EF\_INPUT\_FLOW\_BENCHMARK\_ENABLE

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_INPUT\_FLOW\_BENCHMARK\_PACKET\_FILEPATH

The path to the file containing the UDP payloads, in hex-string form, that you want to use for benchmarking.

* Default
  * `/etc/elastiflow/benchmark/flow/packets.txt`


# OTel


# Trace

The OTLP (OpenTelemetry Protocol) input enables the ingestion of trace data from any OTel compatible source

#### Protocol Support

The OTLP input can operate in two modes:

* **gRPC** - Uses the OTLP/gRPC protocol (recommended for production). Implements the `opentelemetry.proto.collector.trace.v1.TraceService` interface with full OTLP compliance.
* **HTTP** 1.1 - Uses the OTLP/HTTP protocol with RESTful endpoints. Supports both Protocol Buffers and JSON content types.

{% hint style="info" %}
**Namespace Support**\
The OTLP input supports multiple isolated namespaces, allowing you to run separate instances of the trace collector with different configurations. To create additional namespaces, use the pattern `EF_INPUT_OTLP_<NAMESPACE>_` where `<NAMESPACE>` is your namespace identifier (e.g., `EF_INPUT_OTLP_INTERNAL_`, `EF_INPUT_OTLP_PARTNER_`).
{% endhint %}

* [Server Configuration](#server-configuration)
* [Authentication Configuration](#authentication-configuration)
  * [Basic Authentication](#basic-authentication)
  * [Bearer Token Authentication](#bearer-token-authentication)
  * [OIDC Authentication](#oidc-authentication)
* [gRPC Health Check Server](#grpc-health-check-server)
* [HTTP Server Details](#http-server-details)
* [Config Examples](#configuration-examples)

### Server Configuration&#x20;

#### `EF_INPUT_OTLP_TRACE_SERVER_ENABLE`

Enable or disable the OTLP trace server.

*Valid Values*: `true`, `false`

*Default*: `true`

#### `EF_INPUT_OTLP_TRACE_WORKERS`

Specifies the number of concurrent worker goroutines to process incoming trace data. Increasing the number of workers will allow the collector to better handle high-volume trace ingestion.

*Default:* `3`

#### `EF_INPUT_OTLP_TRACE_BUFFER`

The size of the internal channel buffer that holds trace records before they are processed. A larger buffer can help handle traffic bursts but will consume more memory.

*Default:* `128`

#### `EF_INPUT_OTLP_TRACE_SERVER_TYPE`

Specifies the protocol type for the trace server.

When `EF_INPUT_OTLP_TRACE_SERVER_TYPE=http`, the following endpoint is available: ***POST /v1/traces** - Submit trace data*

The HTTP server accepts trace data in two formats:

* `Content-Type: application/x-protobuf` - Binary Protocol Buffers format
* `Content-Type: application/json` - JSON format

Valid Values: `grpc`, `http`

*Default* `grpc`

#### `EF_INPUT_OTLP_TRACE_SERVER_ADDR_HOST`

The IP address to bind the trace server to. Use `0.0.0.0` to listen on all network interfaces, or specify a specific IP address.

*Default*: `0.0.0.0`

#### `EF_INPUT_OTLP_TRACE_SERVER_ADDR_PORT`

The port number for the trace server to listen on. Standard OTLP ports are 4317 for gRPC and 4318 for HTTP.

*Default*: `4317`

#### `EF_INPUT_OTLP_TRACE_SERVER_TLS_ENABLE`

Enable or disable TLS encryption for the trace server.

*Valid Values*: `true`, `false`

*Default*: `false`

#### `EF_INPUT_OTLP_TRACE_SERVER_TLS_CERT_FILE`

The path to the TLS certificate file for the trace server.

#### `EF_INPUT_OTLP_TRACE_SERVER_TLS_KEY_FILE`

The path to the TLS private key file for the trace server.

#### `EF_INPUT_OTLP_TRACE_SERVER_TLS_VERIFICATION_TYPE`

The client certificate verification mode for TLS connections.

Valid Values

* `NoClientCert` (or `0`) - No client certificate required
* `RequestClientCert` (or `1`) - Request client certificate but don't verify
* `RequireAnyClientCert` (or `2`) - Require client certificate but don't verify CA
* `VerifyClientCertIfGiven` (or `3`) - Verify client certificate if provided
* `RequireAndVerifyClientCert` (or `4`) - Require and verify client certificate

*Default*: `NoClientCert`

### Authentication Configuration

The OTLP input supports multiple authentication mechanisms: none, basic, bearer token, and OIDC.

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE`

Specifies the authentication mechanism to use for the trace server.

*Valid Values:* `none`, `basic`, `bearer`, `oidc`

*Default*: `none`

### Basic Authentication

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_BASIC_USERNAME`

The username for HTTP Basic Authentication. Required when `EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE=basic`.

Clients must include the Authorization header: `Authorization: Basic <base64-encoded-credentials>`

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_BASIC_PASSWORD`

The password for HTTP Basic Authentication. Required when `EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE=basic`. This value is redacted in logs.

### Bearer Token Authentication

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_BEARER_TOKEN`

The static bearer token for authentication. Required when `EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE=bearer` (unless using `AUTH_BEARER_TOKEN_FILE`). This value is redacted in logs.

Clients must include the Authorization header: `Authorization: Bearer <token>`

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_BEARER_TOKEN_FILE`

Path to a file containing the bearer token. Required when `EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE=bearer` (unless using `AUTH_BEARER_TOKEN`). This value is redacted in logs.

### OIDC Authentication

OpenID Connect (OIDC) authentication validates JWT tokens from an identity provider.

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_ISSUER_URL`

The OIDC issuer URL. Required when `EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE=oidc`.

Clients must include the Authorization header with a valid JWT token: `Authorization: Bearer <jwt-token>`

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_AUDIENCE`

The expected audience claim in the JWT token. Required unless `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_SKIP_AUDIENCE_CHECK=true`.

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_CLIENT_ID`

The OIDC client ID.

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_JWKS_URL`

The JWKS endpoint URL for validating JWT signatures. If not provided, the endpoint will be auto-discovered from the issuer URL.

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_SKIP_ISSUER_CHECK`

Skip validation of the issuer claim in JWT tokens.

*Valid Values*: `true`, `false`

*Default*: `false`

#### `EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_SKIP_AUDIENCE_CHECK`

Skip validation of the audience claim in JWT tokens.

*Valid Values*: `true`, `false`

*Default*: `false`

### gRPC Health Check Server

A separate health check server is provided for Kubernetes liveness and readiness probes. The health check server implements the gRPC Health Checking Protocol (`grpc.health.v1.Health`).

#### `EF_INPUT_OTLP_HEALTH_SERVER_ADDR_HOST`

The IP address to bind the health check server to.

*Default*: `0.0.0.0`

#### `EF_INPUT_OTLP_HEALTH_SERVER_ADDR_PORT`

The port number for the health check server to listen on.

*Default*: `9411`

#### `EF_INPUT_OTLP_HEALTH_SERVER_TLS_ENABLE`

Enable or disable TLS encryption for the health check server.

*Valid Values:* `true`, `false`

*Default*: `false`

#### `EF_INPUT_OTLP_HEALTH_SERVER_TLS_CERT_FILE`

The path to the TLS certificate file for the health check server.

#### `EF_INPUT_OTLP_HEALTH_SERVER_TLS_KEY_FILE`

The path to the TLS private key file for the health check server.

#### `EF_INPUT_OTLP_HEALTH_SERVER_TLS_VERIFICATION_TYPE`

The client certificate verification mode for the health check server.

*Valid Values*:

* `NoClientCert` (or `0`) - No client certificate required
* `RequestClientCert` (or `1`) - Request client certificate but don't verify
* `RequireAnyClientCert` (or `2`) - Require client certificate but don't verify CA
* `VerifyClientCertIfGiven` (or `3`) - Verify client certificate if provided
* `RequireAndVerifyClientCert` (or `4`) - Require and verify client certificate

*Default*: `NoClientCert`

### Configuration Examples

#### gRPC with TLS and OIDC

```yaml
EF_INPUT_OTLP_TRACE_SERVER_ENABLE: true
EF_INPUT_OTLP_TRACE_SERVER_TYPE: grpc
EF_INPUT_OTLP_TRACE_SERVER_ADDR_HOST: 0.0.0.0
EF_INPUT_OTLP_TRACE_SERVER_ADDR_PORTL: 4317
EF_INPUT_OTLP_TRACE_WORKERS: 5
EF_INPUT_OTLP_TRACE_BUFFER: 256

EF_INPUT_OTLP_TRACE_SERVER_TLS_ENABLE: true
EF_INPUT_OTLP_TRACE_SERVER_TLS_CERT_FILE: /etc/certs/server.crt
EF_INPUT_OTLP_TRACE_SERVER_TLS_KEY_FILE: /etc/certs/server.key

EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE: oidc
EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_ISSUER_URL: https://auth.company.com
EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_AUDIENCE: trace-collector
EF_INPUT_OTLP_TRACE_SERVER_AUTH_OIDC_CLIENT_ID: otlp-collector

EF_INPUT_OTLP_HEALTH_SERVER_ADDR_HOST: 0.0.0.0
EF_INPUT_OTLP_HEALTH_SERVER_ADDR_PORT: 9411
```

#### HTTP Server with Basic Authentication

```yaml
EF_INPUT_OTLP_TRACE_SERVER_ENABLE: true
EF_INPUT_OTLP_TRACE_SERVER_TYPE: http
EF_INPUT_OTLP_TRACE_SERVER_ADDR_HOST: 0.0.0.0
EF_INPUT_OTLP_TRACE_SERVER_ADDR_PORT: 4318

EF_INPUT_OTLP_TRACE_SERVER_AUTH_TYPE: basic
EF_INPUT_OTLP_TRACE_SERVER_AUTH_BASIC_USERNAME: myuser
EF_INPUT_OTLP_TRACE_SERVER_AUTH_BASIC_PASSWORD: mysecretpassword
```


# Flow Processing

### Processor Configuration Options

#### EF\_PROCESSOR\_POOL\_SIZE[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_pool_size) <a href="#ef_processor_pool_size" id="ef_processor_pool_size"></a>

Specifies the number of 'processors' to start. In other words, how many logical threads of execution to run at once when processing input. For NetObserv Flow, you will need at least one (1) processor for every 2000 records/second. Increasing the number of processors will allow the collector to better handle a high volume of high latency enrichment tasks such as DNS lookups for IP addresses. We see diminishing returns for a processor pool size of greater than 32.

{% hint style="info" %}
While increasing the number of processors can be beneficial, there are diminishing returns at higher processor counts. This is especially true when the number of processors exceeds the number of available CPU threads (real cores + SMT threads) or vCPUs. If you require more than 64 processors, and are using a Standard or Premium License, it may be more beneficial to use multiple collector instances.
{% endhint %}

The minimum value is `2`. If you configure this to be '1', it will change to '2'.

If you configure it to '0', it will use the default value, as explained below (the same as not setting it at all).

* Default
  * `4 * the number of 'units' supported`
    * for NetObserv Flow, a 'unit' equals `flows per second supported / 4000`
    * for NetObserv SNMP, a 'unit' equals `hosts supported / 40`
    * for NetObserv SNMP Trap, a 'unit' equals `hosts supported / 40`

{% hint style="info" %}
Your license (if you are using one) will support a certain amount of flows per second (for NetObserv Flow) and/or hosts per second (for NetObserv SNMP and NetObserv SNMP Trap). However, you can manually configure any instance of NetObserv to use *less* than the maximum supported by the license. This helps support horizontal scaling. If you do that, the default value will base its calculation off of the manually configured limit.
{% endhint %}

#### EF\_PROCESSOR\_TRANSLATE\_KEEP\_IDS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_translate_keep_ids) <a href="#ef_processor_translate_keep_ids" id="ef_processor_translate_keep_ids"></a>

Specifies which identifier values will be included in the final dataset.

* Valid Values
  * `none` - All identifiers are removed from the final dataset.
  * `default` - Most identifiers are removed from the final dataset. However, some identifiers which are required for common use-cases (e.g. raw protocol port values) are included.
  * `all` - All identifiers are included in the final dataset.
* Default
  * `default`

#### EF\_PROCESSOR\_DURATION\_PRECISION[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_duration_precision) <a href="#ef_processor_duration_precision" id="ef_processor_duration_precision"></a>

The desired precision of duration-related values. Values received at a different precision than specified will be converted to the desired precision.

* Valid Values
  * `sec` - seconds
  * `ds` - deciseconds
  * `cs` - centiseconds
  * `ms` - milliseconds
  * `us` - microseconds
  * `ns` - nanoseconds
* Default
  * `ms`

{% hint style="info" %}
For most data sources this should milliseconds (`ms`)
{% endhint %}

#### EF\_PROCESSOR\_TIMESTAMP\_PRECISION[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_timestamp_precision) <a href="#ef_processor_timestamp_precision" id="ef_processor_timestamp_precision"></a>

The desired precision of timestamp values. Values received at a different precision than specified will be converted to the desired precision.

* Valid Values
  * `sec` - seconds
  * `ds` - deciseconds
  * `cs` - centiseconds
  * `ms` - milliseconds
  * `us` - microseconds
  * `ns` - nanoseconds
* Default
  * `ms`

{% hint style="info" %}
For most data stores, e.g. Elasticsearch, this should milliseconds (`ms`)
{% endhint %}

#### EF\_PROCESSOR\_PERCENT\_NORM[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_percent_norm) <a href="#ef_processor_percent_norm" id="ef_processor_percent_norm"></a>

The desired representation of percentages. Values received with a different representation than specified will be converted to the desired representation.

* Valid Values
  * `1` - values will be based on a scale of 0-1.
  * `100` - values will be based on a scale of 0-100.
* Default
  * `100`

#### EF\_PROCESSOR\_KEEP\_CPU\_TICKS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_keep_cpu_ticks) <a href="#ef_processor_keep_cpu_ticks" id="ef_processor_keep_cpu_ticks"></a>

For telemetry sources which provide CPU usage as timeticks, utilization percentages will be calculated. If this setting is set `false` the timetick values will be removed from the final dataset. If `true` they will be kept, in addition to the utilization values.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_PROCESSOR\_DROP\_FIELDS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_drop_fields) <a href="#ef_processor_drop_fields" id="ef_processor_drop_fields"></a>

This setting allows for a comma-separated list of fields that are to be removed from all records. The fields are dropped after all enrichment and *PRIOR* to the records being sent to the enabled outputs.

{% hint style="info" %}
The conversion from the default CODEX schema to alternate schemas, e.g. Elastic's ECS or Splunk's CIM, happens within the respective outputs. As fields are dropped *PRIOR* to the outputs, CODEX field names must be used to configure this option.
{% endhint %}

* Valid Values
  * any CODEX-schema field names, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

#### EF\_PROCESSOR\_DECODE\_IPFIX\_ENABLE

Set to `true` to enable decoding of IPFIX records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_NETFLOW1\_ENABLE

Set to `true` to enable decoding of Netflow v1 records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_NETFLOW5\_ENABLE

Set to `true` to enable decoding of Netflow v5 records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_NETFLOW6\_ENABLE

Set to `true` to enable decoding of Netflow v6 records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_NETFLOW7\_ENABLE

Set to `true` to enable decoding of Netflow v7 records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_NETFLOW9\_ENABLE

Set to `true` to enable decoding of Netflow v9 records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_SFLOW5\_ENABLE

Set to `true` to enable decoding of sFlow v5 records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_SFLOW\_FLOWS\_ENABLE

Set to `true` to enable decoding of sFlow `flow_sample` and `flow_sample_expanded` records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_SFLOW\_FLOWS\_KEEP\_SAMPLES

When set to `true`, the packet data from an sFlow `sampled_header` record will be stored in `l2.section.sample` as a hex-encoded string.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_PROCESSOR\_DECODE\_SFLOW\_COUNTERS\_ENABLE

Set to `true` to enable decoding of sFlow `counters_sample` and `counters_sample_expanded` records.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_DECODE\_MAX\_RECORDS\_PER\_PACKET

Corrupt packets can cause issues with the decoding of records. One way this is handled is by limiting the number of records that will be decoded from a packet. The default value is `64`. When the network between the device and collector has an MTU larger than `1500`, the default value may be exceeded by normal packets. This new configuration option allows the threshold to be increased when necessary.

* Default
  * `64`

#### EF\_PROCESSOR\_ENRICH\_ASN\_PREF

If enrichment with autonomous system attributes is enabled, but the autonomous system is already indicated directly in the flow record data, this setting specifies which source is preferred. If the preferred source is not available for a given record, the decoder will fall-back to the alternate option.

* Valid Values
  * `lookup` - prefer the autonomous system determined by lookup.
  * `flow` - prefer the autonomous system indicated directly in the flow record data.
* Default
  * `lookup`

#### EF\_PROCESSOR\_ENRICH\_JOIN\_ASN

Some features require that related values from separate fields are stored as an array in a single field. Such a "join" of autonomous system related fields is enabled when this setting is `true`.

{% hint style="info" %}
If records are being output to Elasticsearch this setting should be set to `true`.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_ENRICH\_JOIN\_GEOIP

Some features require that related values from separate fields are stored as an array in a single field. Such a "join" of GeoIP related fields is enabled when this setting is `true`.

{% hint style="info" %}
If records are being output to Elasticsearch this setting should be set to `true`.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_ENRICH\_JOIN\_NETATTR

Some features require that related values from separate fields are stored as an array in a single field. Such a "join" of network attribute related fields is enabled when this setting is `true`.

{% hint style="info" %}
If records are being output to Elasticsearch this setting should be set to `true`.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_ENRICH\_JOIN\_SUBNETATTR

Some features require that related values from separate fields are stored as an array in a single field. Such a "join" of IP subnetwork attribute related fields is enabled when this setting is `true`.

{% hint style="info" %}
If records are being output to Elasticsearch this setting should be set to `true`.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_ENRICH\_JOIN\_SEC

Some features require that related values from separate fields are stored as an array in a single field. Such a "join" of security attribute related fields is enabled when this setting is `true`.

{% hint style="info" %}
If records are being output to Elasticsearch this setting should be set to `true`.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_EXPAND\_CLISRV

The collector will infer the client/server relationship of two source/destination endpoints. The is setting determines whether such inference is enabled or not.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_EXPAND\_CLISRV\_NO\_L4\_PORTS

For flow records related to protocols which include no layer-4 ports, the collector will infer the client/server relationship of the two source/destination endpoints using the order of the IP addresses. The is setting determines whether such inference is enabled or not.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_IFA\_ENABLE

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_PROCESSOR\_IFA\_WORKER\_SIZE

Specifies the number of IFA Hop record processors to start.

* Default
  * `4 * the number of license units`

#### EF\_PROCESSOR\_ENRICH\_TOTALS\_IF\_NO\_DELTAS

The vast majority of flow exporters provide byte and packet quantities as *DELTA* values. This refers to the quantity since the last record for the flow was reported. However, some exporters will provide these quantities only as *TOTAL* values, referring to the quantity over the entire lifetime of the flow. Examples of such exporters are Cisco "Netflow Lite" (e.g. IE4000 series), some Juniper MX-series when sending IPFIX, and Versa Networks.

In cases where the exporter sends *ONLY* totals, it may still be desired to use these values to populate `flow.bytes` and `flow.packets`. The idea being that "something is better than nothing". When this option is set to `true`, *total* quantities will be used if they are available and when *delta* quantities are not.

{% hint style="danger" %}
***Total*** quantities can be problematic for many datastores. A simple sum of ***total*** values across multiple records within a time window will not produce an accurate quantity, as it does with ***delta*** values. As a result long-lived flows may over-report bytes and packets values if ***total*** values are used.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `false`


# Sample Rate Adjustments

Devices may sample packets to reduce the overall volume of traffic metered for flow accounting.

## EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_CACHE\_SIZE

The collector must adjust the calculation of bytes and packets based on the sampling rate used. Usually devices will inform the collector of the sampling rate either within the flow record itself, or as option data sent periodically by the device. This setting specifies the size of the cache to be used to hold sample rate information learned from option data.

* Default
  * `32768`

## EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_USERDEF\_ENABLE

In some cases, a device may not transmit information about the sampling rate for which it is configured. In this case, it is possible to statically define the sampling rate in a file provided to the collector. This setting is used to enable that feature.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_USERDEF\_PATH

If static sample rates are configured for devices in a file, this setting specifies the path from where that file can be loaded.

An example of the format of this file is:

```yaml
'192.0.2.1': 1024
'192.0.2.2': 512
'192.0.2.0-192.0.2.255': 256
'192.0.2.0/24': 128

# global sample rate
'0.0.0.0/0': 56
```

* Default
  * `/etc/elastiflow/settings/sample_rate.yml`

## EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_USERDEF\_OVERRIDE

In some scenarios, it may be desired to use a user-defined sample rate rather than the rate provided by the device. Setting this option to `true` will check for a user-defined rate even if the device has provided a rate.

* Valid Values
  * `true`, `false`
* Default
  * `false`


# Enrichment Options


# Application ID

NetObserv Flow will cache application attributes learned from option data. It also allows users to define application attributes by any combination of IP/CIDR/IP range and port/port range.

## EF\_PROCESSOR\_ENRICH\_APP\_ID\_ENABLE

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_PROCESSOR\_ENRICH\_APP\_ID\_PATH

If vendor-defined AppID to application attribute mappings is enabled (`EF_PROCESSOR_ENRICH_APP_ID_ENABLE` is `true`) this setting specifies the path to the file.

* Default
  * `/etc/elastiflow/app/appid.yml`

## EF\_PROCESSOR\_ENRICH\_APP\_ID\_TTL

The length of time the application attributes will be cached after they are initially fetched.

{% hint style="info" %}
Changes to the underlying files will not be picked up, even after the files have been re-loaded at the refresh interval, until the AppID has expired from the cache.
{% endhint %}

* Default
  * `7200`

## EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_ENABLE

While various flow record sources send the mapping of application IDs to application names as option data, in cases where no application identity technology is available, applications can be statically specified by IP address and port number.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_PATH

If user-defined IP/port to application mappings is enabled (`EF_PROCESSOR_ENRICH_APP_IPPORT_ENABLE` is `true`), this setting specifies the path to this file.

An example of the format of this file is:

```yaml
192.168.1.0/24:
  8090:
    name: "Synergy-cidr-port"
    category: "category-cidr-port"
    subcategory: "subcategory-cidr-port"
    metadata:
      ".location": "austin-cidr-port"
      "business.unit": "finance-cidr-port"
      "dev.unit": "dev-cidr-port"
      "app.count": 27

192.168.1.1-192.168.1.20:
  8090:
    name: "Synergy-iprange-port"
    category: "category-iprange-port"
    subcategory: "subcategory-iprange-port"
    metadata:
      .location: "austin-iprange-port"

  8090-9000:
    name: "Synergy-iprange-portrange"
    category: "category-iprange-portrange"
    subcategory: "subcategory-iprange-portrange"
    metadata:
      .location: "austin-iprange-portrange"
      business.unit: "finance-iprange-portrange"
      qa.unit: "qa-iprange-portrange"
      finance.unit: "finance-iprange-portrange"

192.168.1.1:
  8090:
    name: "Synergy-ip-port"
    category: "category-ip-port"
    subcategory: "subcategory-ip-port"
    metadata:
      .location: "austin-ip-port"
      business.unit: "finance-ip-port"
```

* Default
  * `/etc/elastiflow/app/ipport.yml`

## EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_TTL

The length of time the application attributes will be cached after they are initially fetched.

{% hint style="info" %}
Changes to the underlying files will not be picked up, even after the files have been re-loaded at the refresh interval, until the IP/Port has expired from the cache.
{% endhint %}

* Default
  * `7200`

## EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_PRIVATE

If user-defined application attributes are enabled (`EF_PROCESSOR_ENRICH_APP_IPPORT_ENABLE` is `true`) this option specifies whether application names will be checked for private IP addresses.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_PUBLIC

If user-defined application attributes are enabled (`EF_PROCESSOR_ENRICH_APP_IPPORT_ENABLE` is `true`) this option specifies whether application names will be checked for public IP addresses.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_PROCESSOR\_ENRICH\_APP\_REFRESH\_RATE

The files defined for application attribute enrichment can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`


# IP Address Enrichment

## Overview

ElastiFlow NetObserv Flow provides the ability to enrich flow records based on IP address. Enrichment attributes fetched for a particular IP address will be cached by the collector.

## Configurations

### EF\_PROCESSOR\_ENRICH\_IPADDR\_TTL

The length of time the IP address enrichment attributes will be cached after they are initially fetched. This value is in units of seconds.

* Default
  * `7200` (2 hours)


# ElastiFlow NetIntel

{% hint style="warning" %}
In order to enable NetIntel enrichment, you need to be on version 7.x of NetObserv Flow (flowcoll) and on Elasticsearch 8.x or OpenSearch 2.x. You will also need to download and install the [latest Kibana Dashboards](https://github.com/elastiflow/elastiflow_for_elasticsearch/tree/master/kibana/flow) or [OpenSearch Dashboards](https://github.com/elastiflow/elastiflow_for_opensearch/tree/main/dashboards/flow) respectively.
{% endhint %}

## Overview

ElastiFlow NetObserv Flow provides the ability to enrich flow records with threat intelligence and app/service information provided by ElastiFlow's NetIntel feed. NetIntel can help you quickly identify threats and high-risk traffic in your environment.

## Configurations

### EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_ENABLE

Enrichment with NetIntel is enabled by default starting in NetObserv v7. If you don't want NetIntel enrichment set this option to `false`.

* Valid Values
  * `true`, `false`
* Default
  * `true`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_AS\_PREFIX\_PRECISION

It's possible for an Autonomous system to house other Autonomous systems. Therefore, a user can either get the most specific AS prefix or all the prefixes for all the Autonomous systems a packet went through.

* Valid Values
  * `all`, `exact`
* Default Value
  * `exact`

## Air-Gapped Environment Configurations

By default, the NetIntel dataset is retrieved via API requests and stored to the [Data Path](/flowcoll/configuration/config_gen/data_path) directory for enrichment purposes. If you want to use NetIntel enrichment in an air-gapped environment, download the dataset and specify the path to it.

{% hint style="info" %}
This feature is only available to standard or premium licensed customers.
{% endhint %}

### EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_THREAT\_COLLECTION\_PATH

Path for the downloaded Threat Collection dataset. Setting this configuration option to non-empty string disables the recurring retrieval of the Threat Collection dataset.

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/netintel/threat_collection.pb`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_IP\_DB\_PATH

Path for the downloaded IPDB dataset. Setting this configuration option to non-empty string disables the recurring retrieval of the IPDB dataset.

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/netintel/ipdb.pb`

## Downloading the dataset

### Installing \`netobserv\` CLI Tool <a href="#install-cli-tool" id="install-cli-tool"></a>

You can download and install the `netobserv` CLI tool on Linux machines via our `deb` or `rpm` packages.

`deb`:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
sudo apt install ./netobserv_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

`rpm`:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
sudo yum install -y netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

If upgrading from a previously installed `rpm`, run the following:

<pre><code>sudo rpm -Uhv netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

### **Download the Dataset**

To download the NetIntel dataset, use the following command:

```shell
EF_ACCOUNT_ID="{your account id}"
EF_LICENSE_KEY="{your license key}"
EF_LICENSE_ACCEPTED="true"
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_IP_DB_PATH=/etc/elastiflow/netintel/ipdb.pb \                                 
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_THREAT_COLLECTION_PATH=/etc/elastiflow/netintel/threat_collection.pb \
/usr/share/elastiflow/bin/netobserv pull dataset --source=netintel --config={path to flowcoll.yml}
```

Or, alternatively,

```sh
EF_ACCOUNT_ID="{your account id}" \
EF_LICENSE_KEY="{your license key}" \
EF_LICENSE_ACCEPTED="true" \
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_IP_DB_PATH=/etc/elastiflow/netintel/ipdb.pb \                                 
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_THREAT_COLLECTION_PATH=/etc/elastiflow/netintel/threat_collection.pb \
/usr/share/elastiflow/bin/netobserv pull dataset --source=netintel
```

{% hint style="info" %}
You must have permission to write to the download paths (/etc/elastiflow/netintel is the default)
{% endhint %}

Then, provide the path to the dataset files in the NetObserv Flow configuration by setting the [EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_THREAT\_COLLECTION\_PATH](#ef_processor_enrich_ipaddr_netintel_threat_collection_path) and [EF\_PROCESSOR\_ENRICH\_IPADDR\_NETINTEL\_IP\_DB\_PATH](#ef_processor_enrich_ipaddr_netintel_ip_db_path) respectively.


# Maxmind GeoIP2 and GeoLite2

## Overview

NetObserv Flow can attempt to determine attributes associated with the autonomous system and geo-location to which a public IP address belongs.

## Obtaining the Databases

To use the Maxmind databases for GeoIP and ASN enrichment you will need to download the databases. Due to changes in privacy law in California, Maxmind no longer makes its GeoLite2 databases available for download without [registering on their website](https://dev.maxmind.com/geoip/geoip2/geolite2/). Once you have registered and downloaded the database, you can make them available to NetObserv Flow for enrichment of public IP addresses.

Signup at: <https://www.maxmind.com/en/geolite2/signup>

## Configurations

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_ASN\_ENABLE

NetObserv Flow will attempt to determine attributes associated with the autonomous system to which a public IP address belongs. This setting determines whether this feature is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_ASN\_PATH

If enrichment with autonomous system attributes is enabled using lookups in a Maxmind database (`EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_ASN_ENABLE` is `true`), this setting specifies the path to the Maxmind database.

* Default
  * `/etc/elastiflow/maxmind/GeoLite2-ASN.mmdb`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_ENABLE

NetObserv Flow will attempt to determine GeoIP attributes associated with a public IP address. This setting determines whether this feature is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_PATH

If enrichment with GeoIP attributes is enabled using lookups in a Maxmind database (`EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_ENABLE` is `true`), this setting specifies the path to the Maxmind database.

* Default
  * `/etc/elastiflow/maxmind/GeoLite2-City.mmdb`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_VALUES

If enrichment with GeoIP attributes is enabled using lookups in a Maxmind database (`EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_ENABLE` is `true`), this setting specifies the GeoIP attributes from the Maxmind database to be included in the resulting record.

* Valid Values
  * `city`, `continent`, `continent_code`, `country`, `country_code`, `location`, `timezone`
* Default
  * `city,country,country_code,location,timezone`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_LANG

If enrichment with GeoIP attributes is enabled using lookups in a Maxmind database (`EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_ENABLE` is `true`), this setting specifies the language which should be used for any language-specific values.

* Valid Values
  * `de` - German
  * `en` - English
  * `es` - Spanish
  * `fr` - French
  * `ja` - Japanese
  * `pt-BR` - Brazilian Portuguese
  * `ru` - Russian
  * `zh-CN` - Simplified Chinese
* Default
  * `en`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_INCLEXCL\_PATH

For more control of when enrichment is applied, IP addresses can be included or excluded from GeoIP enrichment by Autonomous System or CIDR. This setting specifies the path to this file.

For more details on the format of this file and the behavior of the include/exclude functionality, refer to: [Scoping Enrichment with Include/Exclude](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_udm#scoping-enrichment-with-include-exclude)

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/maxmind/incl_excl.yml`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_INCLEXCL\_REFRESH\_RATE

The file specified in `EF_PROCESSOR_ENRICH_IPADDR_MAXMIND_GEOIP_INCLEXCL_PATH` can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`


# DNS Enrichment

## Overview

NetObserv Flow can be configured to resolve IP addresses to hostnames. The following settings allow this feature to be tuned to the needs of your environment.

## Configurations

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_ENABLE

This setting enables DNS reverse lookups of IP addresses found in the received flow records. Disabling this feature will also disable looking up hostnames defined in the file referenced here: `EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH`.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_NAMESERVER\_IP

The default behavior of the collector is to use the operating system's configured name resolution to resolve IP addresses to hostnames. Optionally, a nameserver can be specified in this setting, which will be used instead.

{% hint style="info" %}
If configured, this setting *MUST* contain a valid IP address.
{% endhint %}

* Default
  * *empty*

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_NAMESERVER\_TIMEOUT

If `EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_IP` contains a valid IP address, this setting contains the timeout period, in milliseconds, for queries to the name server.

* Default
  * `3000` (milliseconds)

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_RESOLVE\_PRIVATE

If DNS resolution is enabled (`EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE` is `true`) this option specifies whether private IP addresses will be resolved to hostnames.

* Valid Values
  * `true`, `false`
* Default
  * `true`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_RESOLVE\_PUBLIC

If DNS resolution is enabled (`EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE` is `true`) this option specifies whether public IP addresses will be resolved to hostnames.

* Valid Values
  * `true`, `false`
* Default
  * `true`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_USERDEF\_PATH

This setting specifies the path to the file containing user-defined hostname mappings. The feature is enabled if a path is configured, otherwise it is disabled. If there is a conflict between the hostname returned by a DNS query and what is defined in this file, this file wins.

An example of the format of this file is:

```yaml
'192.0.2.1': 'host1'
'192.0.2.2': 'host2'
```

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/hostname/user_defined.yml`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_USERDEF\_REFRESH\_RATE

The file specified in `EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH` can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_INCLEXCL\_PATH

For more control of when enrichment is applied, IP addresses can be included or excluded from hostname enrichment by Autonomous System or CIDR. This setting specifies the path to this file.

For more details on the format of this file and the behavior of the include/exclude functionality, refer to: [Scoping Enrichment with Include/Exclude](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_udm#scoping-enrichment-with-include-exclude)

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/hostname/incl_excl.yml`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_INCLEXCL\_REFRESH\_RATE

The file specified in `EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_PATH` can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`


# User-Defined Metadata (UDM) for Addresses

The IP address enrichment module provides supplemental information for IP addresses, such as hostname, autonomous system, geolocation, reputation and additional user-defined metadata. Values are cached for improved performance and flow record throughput. For more control of when enrichment is applied, IP addresses can be included or excluded from various enrichers by CIDR, IP range or individual IP address.

This page provide detailed information about [User-Defined Metadata Enrichment](#user-defined-metadata-enrichment) and [Scoping Enrichment with Include/Exclude](#scoping-enrichment-with-include-exclude).

### User-Defined Metadata Enrichment

An example of the format of this file is:

```yaml
# Specify whether the IP/CIDR/Range is considered to be "internal".
192.0.2.0/24:
  internal: true

# Additional options are name, vlan, tags and metadata.
192.0.2.192/26:
  name: atlanta_guest_wifi
  vlan: 1001
  tags:
    - wifi
    - dhcp
  metadata:
    dhcp.pool.name: atlanta_guest_wifi
    .site.id: atlanta

# Metadata fields beginning with a . will be organized under the object containing the IP address.
192.0.2.194-192.0.2.198:
  metadata:
    .site.bldg.id: hq
    .site.floor.id: 2
    .site.rack.id: 1

# An individual IP address.
192.0.2.194:
  metadata:
    device.type.name: wifi_ap

# Showcasing the "contexts" feature
10.0.0.0/16:
  contexts:
    - exporter
  metadata:
    .is_exporter: true
10.0.0.0/32:
  contexts:
    - endpoint
  metadata:
    .is_exporter: false

```

#### Metadata Types

The User-Defined Metadata enricher supports a combination of pre-defined metadata types as well as the ability to provide custom data as key-value pairs. This section describes the various metadata types. The following table provides a summary of these types.

<table><thead><tr><th width="108">Attribute</th><th width="160">Data Type</th><th width="226">Field Populated</th><th width="253">Description</th></tr></thead><tbody><tr><td><code>name</code></td><td>string</td><td><code>&#x3C;object>.ip.subnet.name</code></td><td>The name given to this subnet.</td></tr><tr><td><code>contexts</code></td><td>array of strings</td><td>N/A</td><td>Limits which contexts this enrichment rule applies. See below for more details.</td></tr><tr><td><code>internal</code></td><td>boolean</td><td><code>&#x3C;object>.isInternal</code></td><td>Specifies whether or not the IP belongs to a network considered to be "internal".<br>(Only applies to endpoint fields like source and destination)</td></tr><tr><td><code>vlan</code></td><td>number (0-4094)</td><td><code>&#x3C;object>.vlan.tag.id</code></td><td>A VLAN ID</td></tr><tr><td><code>tags</code></td><td>array of strings</td><td><code>&#x3C;object>.ip.subnet.tags</code></td><td>Tags that describe attributes of the subnet or IP.</td></tr><tr><td><code>metadata</code></td><td>sequence of attributes</td><td><code>&#x3C;object>&#x3C;attribute></code> or <code>&#x3C;attribute></code></td><td>Key-value pairs which will be added at the IP object or record levels.</td></tr></tbody></table>

**internal**

`internal` is a boolean attribute used to specify whether the CIDR, Range or IP address is considered to be ***internal*** or ***external***. This differs from whether the IP address is within a private or public IP range. Some private IPs may still be considered ***external***, e.g. they are used with in a DMZ. Similarly some public IPs may still be considered ***internal*** if they are assigned to resources operated by the organization and to which access is generally restricted.

{% hint style="info" %}
We are planning future features which leverage this internal/external designation, and the derived ingress/egress direction of traffic flow.
{% endhint %}

**contexts**

This limits the current enrichment rule to only apply within certain contexts.

<table><thead><tr><th width="126">Value</th><th>Effect</th></tr></thead><tbody><tr><td><code>exporter</code></td><td><p>Only apply the enrichment rule when an "exporter" field matches.</p><p>Exporter fields: <code>system.ip.addr</code>, <code>flow.export.ip.addr</code> .</p><blockquote><p>Note: If you have Elasticsearch output enabled with ECS, the export field is <code>host.ip</code> </p></blockquote></td></tr><tr><td><code>endpoint</code></td><td><p>Only apply the enrichment rule when an "endpoint" field matches.</p><p>Endpoint fields: <code>flow.src</code>, <code>flow.dst</code> , <code>flow.client</code>, <code>flow.server</code> </p><blockquote><p>Note: If you have Elasticsearch output enabled with ECS, the endpoint fields are <code>source.ip</code>, <code>destination.ip</code>, <code>client.ip</code>, <code>server.ip</code></p></blockquote></td></tr></tbody></table>

For example, with the below rule:

```yaml
10.0.0.0/24:
  contexts:
    - exporter
  vlan: 9
  metadata:
    .is_exporter: true
    owner: department_x
```

Here is how that rule would apply (or not) in the following situations:

<table><thead><tr><th width="185">Exporter Address</th><th width="164">Source Address</th><th>Result</th></tr></thead><tbody><tr><td>10.0.0.1</td><td>192.168.10.11</td><td><ul><li>flow.exporter.is_exporter = true</li><li>flow.exporter.vlan.tag.id = 9</li><li>system.is_exporter = true</li><li>system.vlan.tag.id = 9</li><li>owner = department_x</li></ul></td></tr><tr><td>10.99.0.1</td><td>10.0.0.1</td><td>Nothing. No metadata enrichments applied.</td></tr></tbody></table>

If you have any context defined, then various other, less common, ip fields (like `next_hop` ) will never apply that enrichment rule.

You can have both exporter and endpoint context defined.

**name**

`name` is a string attribute to provide a user-friendly name to a subnet which is relevant to the user or organization.

{% hint style="danger" %}
Only a single `name` value is returned for a given IP address. Care should be taken to ensure that there are no conflicting names among overlapping CIDRs, Ranges and IP addresses. If you must assign multiple values, these should be add to the `tags` attribute.
{% endhint %}

**vlan**

`vlan` allows a VLAN tag to be specified for a CIDR, Range or IP address. This tag will typically be assigned to source/destination and client/server related fields. There should be no conflict with VLAN tags provided in the flow records from network devices. The devices are reporting on the VLAN tags observed on their own interfaces, not the endpoints of the flow. The VLAN tags reported by devices are typically assigned to the in/out related fields.

**tags**

`tags` is an array of string values for attributes that further describe the CIDR, Range or IP address.

**metadata**

`metadata` is a list of key-value pairs which will be added as fields to the record. These can either be *custom* fields specific to the needs of the user, or existing fields from the ElastiFlow CODEX schema. When CODEX fields are specified, the configured metadata value will override any values that already exist in the record.

{% hint style="info" %}
If you have enabled ECS (Elasticsearch/OpenSearch) or CIM (Splunk) support and want to override values from these schemas, you must specify the CODEX equivalent fields in the `metadata` attribute. Metadata is applied in the decoder portion of the collector, where all data is still in the CODEX schema. Conversion to other schemas is output-specific and thus occurs at a later phase of processing.
{% endhint %}

Key names can be specified with or without a leading `.`.

* If specified ***with*** a leading `.`, the field will be placed within the parent object containing the IP address.
* If specified ***without*** a leading `.`, the field will be placed at the root of the record.

Consider an IP address from `flow.src.ip.addr`:

* If the metadata key is defined as `.site.name`, the value would be assigned to `flow.src.site.name`.
* If the metadata key is defined as `site.name`, the value would be assigned directly to `site.name`.

#### Merging Values from Multiple Definitions

Attribute values for an IP address which matches multiple CIDR, Range or IP address entries will be merged into a single result set. Consider the following example:

```yaml
192.168.0.0/16:
  metadata:
    .geo.loc.coord: 48.167106,11.486918
    .geo.city.name: Munich
    .geo.country.code: DE
    .geo.country.name: Germany
    .geo.tz.name: Europe/Berlin

192.168.1.0/24:
  name: munich_hq
  tags:
    - campus
  metadata:
    sec.zone.name: campus

192.168.1.151-192.168.1.200:
  tags:
    - guest_wifi
    - dhcp
  metadata:
    .host.name: guest_wifi
    .ip.addr: 192.168.1.0
```

Here you have:

* the whole Class C private network `192.168.0.0/16` with some location metadata.
* a `/24` block of that network that is tagged as the campus network, and also the firewall zone to which it belongs.
* a range of those IP address that belong to the guest WiFi and are provided by DHCP.

Given a value for `flow.src.ip.addr` of `192.168.1.152`, which matches all three entries in the above configuration, the resulting enrichment fields added to the record would be:

```yaml
flow.src.ip.subnet.name: munich_hq
flow.src.ip.subnet.tags: [campus guest_wifi dhcp]
flow.src.geo.loc.coord: 48.167106,11.486918
flow.src.geo.city.name: Munich
flow.src.geo.country.code: DE
flow.src.geo.country.name: Germany
flow.src.geo.tz.name: Europe/Berlin
sec.zone.name: campus
flow.src.host.name: guest_wifi
flow.src.ip.addr: 192.168.1.0
```

{% hint style="info" %}
The last two values above demonstrate one of the use-cases for User-Defined Metadata. The `host.name` and `ip.addr` have been overridden to more generic static values, thus anonymizing the individual guest WiFi users. This allows the traffic to still be collected and analyzed, without tracking each guest individually. Network or security operations can investigate suspect traffic which they may want to block, while preserving individual guests' privacy.
{% endhint %}

### Scoping Enrichment with Include/Exclude

The Hostname/DNS, and Maxmind GeoIP enrichment features can be scoped to a subset of IP addresses by specifying specific Autonomous Systems or CIDRs to be included or excluded. These include/exclude definitions are provided via a YAML file which can be updated and refreshed without the need to restart the collector.

**An Example of include/exclude definitions:**

```yaml
include:
  asn:
    - 14168
  cidr:
    - 10.0.0.0/8
    - 192.168.0.0/16
exclude:
  #asn:
  #  -
  cidr:
    - 192.168.100.0/24
```

#### Evaluation of Include/Exclude Definitions

It is important to understand how include/exclude definitions are evaluated to ensure your configuration provides the desired outcome. The following rules apply:

1. If no specific include values are defined, ***everything*** is included.
2. Exclude values are evaluated within the scope of included values.

Consider the following examples:

{% hint style="info" %}
While the following examples use only CIDRs, the same logic applies when ASN values are specified.
{% endhint %}

**no include/exclude definitions**

```yaml
# no path provided or an empty file
```

If no include/excludes are defined, ***everything*** is included.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✓**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✓**     |

**only include is defined**

```yaml
include:
  cidr:
    - 10.0.0.0/8
```

Only those IP addresses within a defined AS or CIDR are included. In this example, only IPs within the CIDR `10.0.0.0/8` are included.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✕**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✓**     |

**only exclude is defined**

```yaml
exclude:
  cidr:
    - 10.111.0.0/16
```

All IP address which are ***not*** specifically excluded by the defined AS or CIDR are included. In this example, all IPs *except* those within the CIDR `10.111.0.0/16` are included.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✓**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✕**     |

**both include and exclude are defined**

```yaml
include:
  cidr:
    - 10.0.0.0/8
exclude:
  cidr:
    - 10.111.0.0/16
```

Only those IP addresses within a specified AS or CIDR are included, ***EXCEPT*** those within an excluded AS or CIDR.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✕**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✕**     |

* `192.168.0.1` is ***not*** included as it is not within an included AS or CIDR.
* `10.0.0.1` is included as it is within an included AS or CIDR.
* `10.111.0.1` is ***not*** included. While is does fall within the range of an included CIDR, it is also with a CIDR than is specifically excluded.


# UDM Configurations (Addresses)

## Overview

The User-Defined Metadata allows for additional information to be added to a record for a given IP address. It can also be used to override existing fields. Metadata maybe specified for CIDR blocks, IP ranges or individual IP addresses.

## Configurations

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_ENABLE

Specifies whether the user-defined metadata enrichment is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_USERDEF\_PATH

If the user-defined metadata enrichment is enabled (`EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE` is `true`) this setting specifies the path to the metadata file. If this value is undefined or empty, metadata enrichment will be disabled.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality, refer to: [User-Defined Metadata Enrichment](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_udm#user-defined-metadata-enrichment)

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/metadata/ipaddrs.yml`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_REFRESH\_RATE

The file specified in `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH` can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`&#x20;

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_API\_ENABLE

Enable the REST/gRPC/connectrpc [API for User-Defined Metadata](/flowcoll/overview/api-based-metadata-enrichment). To enable this feature, [`EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE`](#ef_processor_enrich_ipaddr_metadata_enable) must also be set to `true`.

If the API is enabled, after startup of NetObserv, the file configured with `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH` is never re-read, and should not be modified by hand, only via the API.

If this field is `false` (and `EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE` is `true`), then the API is disabled, and any updates to the `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH` file must be done manually. As mentioned above, in that case the refresh rate can be configured using `EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE`.

* Valid Values
  * `true`, `false`
* Default
  * `false`


# Network Interface Enrichment

## Overview

ElastiFlow NetObserv Flow provides the ability to enrich flow records based on the index of ingress and egress interfaces by which the network traffic traversed the exporting device.


# Option Record

## Overview

NetObserv Flow will attempt to determine network interface attributes learned from Netflow v9 or IPFIX option records.

## Configurations

### EF\_PROCESSOR\_ENRICH\_NETIF\_FLOW\_OPTIONS\_ENABLE

Setting this value to `false` will disable the enrichment of records with interface attributes learned from Netflow or IPFIX options records.

* Valid Values
  * `true`, `false`
* Default
  * `true`


# SNMP-Based Flow Enrichment

## Overview

Flow records generally include the index of ingress and egress interfaces by which the network traffic traversed the exporting device. NetObserv Flow will attempt to determine the names, and additional attributes, of these interfaces as learned by polling the exporting device using SNMP.

## Configurations

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_ENABLE

This setting determines whether SNMP polls will be used to gather these network interface attributes.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_PORT

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the UDP port used for such polls.

* Default
  * `161` (the default SNMP port number)

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_VERSION

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the SNMP version used for such polls.

{% hint style="info" %}
All network devices which may be polled MUST support this version of SNMP.
{% endhint %}

* Valid Values
  * `1` - use SNMPv1
  * `2` - use SNMPv2c
  * `3` - use SNMPv3
* Default
  * `2`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_COMMUNITIES

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the SNMP community strings that may be used for such polls. If a comma-separated list is specified, the collector will try each community in the order specified. Once a community returns a successful response, the collector will remember this community for future polls of the device.

{% hint style="info" %}
All network devices which may be polled MUST be configured to all visibility of collected attributes using this community. It may be necessary to specify a *view* associated with this community. The documentation for your devices should contain the necessary information that you will need for determining the correct configuration steps.
{% endhint %}

* Example
  * `public,private,whatever`
* Default
  * `public`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_USERNAME

The username used to authenticate with the device using SNMPv3.

* Default
  * `''`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_AUTHENTICATION\_PROTOCOL

The authentication protocol used to authenticate the username with the device using SNMPv3.

* Valid Values
  * `noauth`, `md5`, `sha`, `sha224`, `sha256`, `sha384`, `sha512`
* Default
  * `noauth`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_AUTHENTICATION\_PASSPHRASE

The authentication passphrase used to authenticate the username with the device using SNMPv3.

* Default
  * `''`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_PRIVACY\_PROTOCOL

The privacy protocol used to encrypt SNMPv3 traffic between the SNMP input and the device.

* Valid Values
  * `nopriv`, `des`, `aes`, `aes192`, `aes256`, `aes192c`, `aes256c`
* Default
  * `nopriv`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_PRIVACY\_PASSPHRASE

The privacy passphrase used to encrypt SNMPv3 traffic between the SNMP input and the device.

* Default
  * `''`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_TIMEOUT

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the number of seconds to wait for the polled device to respond.

* Default
  * `2`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_RETRIES

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the number of retries to attempt after the initial poll has timed out or otherwise fail. The timeout period will be doubled for each retry.

* Default
  * `1`


# User-Defined Metadata (UDM) for Interfaces

Flow records generally include the index of ingress and egress interfaces by which the network traffic traversed the exporting device. NetObserv Flow will attempt to determine the names, and additional attributes, of these interfaces as learned from Netflow v9 or IPFIX option records, determined by polling the exporting device using SNMP or specified in user-defined metadata.

The network interface enrichment module provides supplemental information for network interface, such as name (ifName), description (ifDescr), alias (ifAlias), type (ifType), bandwidth (ifSpeed/ifHighSpeed), committed information rate (CIR), user-defined tags, and additional user-defined metadata. Values are cached for improved performance and flow record throughput.

### User-Defined Metadata Enrichment

An example of the format of this file is:

```yaml
10.0.0.1:
  1:
    ifName: lo
    ifDescr: lo
    ifAlias: lo
    ifType: 24
    ifSpeed: 10000000
    tags:
      - router_mgmt
    metadata:
      sec.zone.name: network
  3:
    internal: false
    ifName: eth0
    ifDescr: eth0
    ifAlias: internet
    ifType: 6
    ifSpeed: 1000000000
    cirIn: 200000000
    cirOut: 12000000
    tags:
      - verizon
    metadata:
      sec.zone.name: internet

10.0.0.2:
  501:
    ifName: vlan
    ifDescr: vlan
    ifSpeed: 1000000000
  502:
    ifName: ge-0/0/0
    ifDescr: ge-0/0/0
    ifSpeed: 1000000000
```

#### Metadata Types

The User-Defined Metadata enricher supports a combination of pre-defined metadata types as well as the ability to provide custom data as key-value pairs. This section describes the various metadata types. The following table provides a summary of these types.

| Attribute  | Data Type              | Field Populated                                      | Description                                                                                                                                                                                                            |
| ---------- | ---------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ifName`   | string                 | `<object>.netif.name`                                | The textual name of the interface. The value of this object should be the name of the network interface as assigned by the device.                                                                                     |
| `ifDescr`  | string                 | `<object>.netif.descr`                               | A textual string containing information about the network interface.                                                                                                                                                   |
| `ifAlias`  | string                 | `<object>.netif.alias`                               | An administratively defined "alias" name for the interface.                                                                                                                                                            |
| `ifType`   | unsigned               | `<object>.netif.type.id`, `<object>.netif.type.name` | The type of interface as specified in IF-MIB (RFC 2233). Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA) via updates to the syntax of the `IANAifType` textual convention. |
| `ifSpeed`  | unsigned               | `<object>.netif.bandwidth.bw`                        | The interface's bandwidth in bits per second.                                                                                                                                                                          |
| `cirIn`    | unsigned               | `<object>.netif.bandwidth.prov.in`                   | The interface's ingress provisioned maximum bandwidth in bits per second.                                                                                                                                              |
| `cirOut`   | unsigned               | `<object>.netif.bandwidth.prov.out`                  | The interface's egress provisioned maximum bandwidth in bits per second.                                                                                                                                               |
| `internal` | bool                   | `<object>.isInternal`                                | Specifies whether or not the network interface is connected to a network considered to be "internal".                                                                                                                  |
| `tags`     | array of strings       | `<object>.netif.tags`                                | Tags that describe attributes of the network interface.                                                                                                                                                                |
| `metadata` | sequence of attributes | `<object><attribute>` or `<attribute>`               | Key-value pairs which will be added at the network interface object or record levels.                                                                                                                                  |

**metadata**

`metadata` is a list of key-value pairs which will be added as fields to the record. These can either be *custom* fields specific to the needs of the user, or existing fields from the ElastiFlow CODEX schema. When CODEX fields are specified, the configured metadata value will override any values that already exist in the record.

{% hint style="info" %}
If you have enabled ECS (Elasticsearch/OpenSearch) or CIM (Splunk) support and want to override values from these schemas, you must specify the CODEX equivalent fields in the `metadata` attribute. Metadata is applied in the decoder portion of the collector, where all data is still in the CODEX schema. Conversion to other schemas is output-specific and thus occurs at a later phase of processing.
{% endhint %}

Key names can be specified with or without a leading `.`.

* If specified ***with*** a leading `.`, the field will be placed within the parent object containing the network interface.
* If specified ***without*** a leading `.`, the field will be placed at the root of the record.

Consider a network interface from `flow.in.netif.index`:

* If the metadata key is defined as `.circuit.name`, the value would be assigned to `flow.in.netif.circuit.name`.
* If the metadata key is defined as `circuit.name`, the value would be assigned directly to `circuit.name`.


# UDM Configurations (Interfaces)

## Overview

The User-Defined Metadata allows for additional information to be added to a record for a given network interface. It can also be used to override existing fields.

## Configurations

### EF\_PROCESSOR\_ENRICH\_NETIF\_METADATA\_ENABLE

Specifies whether the user-defined metadata enrichment is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `true`

### EF\_PROCESSOR\_ENRICH\_NETIF\_METADATA\_USERDEF\_PATH

If the user-defined metadata enrichment is enabled (`EF_PROCESSOR_ENRICH_NETIF_METADATA_ENABLE` is `true`) this setting specifies the path to the metadata file. If this value is undefined or empty, metadata enrichment will be disabled.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality, refer to: [User-Defined Metadata Enrichment](/flowcoll/configuration/enrichment-options/enrich_netif_options/enrich_netif#user-defined-metadata-enrichment)

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/metadata/netifs.yml`

### EF\_PROCESSOR\_ENRICH\_NETIF\_METADATA\_REFRESH\_RATE

The file specified in `EF_PROCESSOR_ENRICH_NETIF_METADATA_USERDEF_PATH` can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`


# Community/Conversation IDs

### Community ID

#### EF\_PROCESSOR\_ENRICH\_COMMUNITYID\_ENABLE

Specifies whether flow records should be enriched with a Community ID value.

{% hint style="info" %}
For more information on community IDs see <https://github.com/corelight/community-id-spec>.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_ENRICH\_COMMUNITYID\_SEED

A 16-bit value used as the seed for determining the Community ID of a flow record.

* Default
  * `0`

### Conversation ID

#### EF\_PROCESSOR\_ENRICH\_CONVERSATIONID\_ENABLE

Specifies whether flow records should be enriched with a Conversation ID value. This value is similar to a community ID (see... EF\_PROCESSOR\_ENRICH\_COMMUNITYID\_ENABLE). However, rather than being based on the src/dst relationship of two endpoints, it is based on the client/server perspective. While multiple unique sessions (i.e. a unique client-side port for each session) will each have their own Community ID, they will share the same Conversation ID. This provides greater flexibility when exploring a complex flow dataset.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_PROCESSOR\_ENRICH\_CONVERSATIONID\_SEED

A 16-bit value used as the seed for determining the Conversation ID of a flow record.

* Default
  * `0`


# Outputs

Outputs can be figured using a global scope or within a namespaced scope. Global scope allows for one instance of an output. Namespaced scope allows for multiple instances of an output.

### Global Configuration

Global configuration only allows you to create a single instance of an output.

For example:

```shell
EF_OUTPUT_ELASTICSEARCH_ENABLE=true
```

The collector sends data to a single instance of an output.

```shell
2022-07-07T08:22:29.875-0500    info    httpoutput/httpoutput.go:98     Elasticsearch [default] Output: running
```

### Namespace Configuration

Namespaces allow multiple instances of an output for flows to be sent.

To define a namespace, include the name of your namespace after `EF_`.

For example:

To namespace a configuration defined as `EF_OUTPUT_ELASTICSEARCH_ENABLE`. Add your namespace between `EF_` and `_OUTPUT_ELASTICSEARCH_ENABLE`. As shown below:

```shell
EF_NAMESPACE1_OUTPUT_ELASTICSEARCH_ENABLE=true
EF_NAMESPACE2_OUTPUT_ELASTICSEARCH_ENABLE=true
EF_NAMESPACE3_OUTPUT_ELASTICSEARCH_ENABLE=true
```

The collector will send data to three(3) separate instances of an output.

```shell
2022-07-07T08:22:29.875-0500    info    httpoutput/httpoutput.go:98     Elasticsearch [NAMESPACE1] Output: running
2022-07-07T08:22:29.875-0500    info    httpoutput/httpoutput.go:98     Elasticsearch [NAMESPACE2] Output: running
2022-07-07T08:22:29.875-0500    info    httpoutput/httpoutput.go:98     Elasticsearch [NAMESPACE3] Output: running
```

{% hint style="info" %}
The collector must be configured with a global **OR** a namespaced configuration. Both cannot be used simultaneously.
{% endhint %}

**For example:**

When an Elasticsearch output is configured with both a global and a namespace configuration.

```shell
EF_OUTPUT_ELASTICSEARCH_ENABLE=true # global configuration
EF_NAMESPACE1_OUTPUT_ELASTICSEARCH_ENABLE=true # namespace configuration
```

NetObserv Flow will fail to start.

```shell
2022-07-07T08:27:39.536-0500    fatal   flowcoll/main.go:108    exiting flowcoll because of invalid configuration       {"code": "config/invalid", "reason": "both global and namespace environment variables cannot be used simultaneously"}
main.main
        /go/src/elastiflow.com/flowcoll/cmd/flowcoll/main.go:108
runtime.main
        /usr/local/go/src/runtime/proc.go:255
exit status 1
```


# Elasticsearch

The Elasticsearch output can be used to send records to Elasticsearch and Elastic Cloud.

### Download Kibana Objects

The Kibana dashboards and related configuration artifacts can be easily imported. You must first download the relevant import file, depending on the configuration of your environment.

#### Kibana Objects for Network Flow Data

| Version                      | Schema | Saved Objects                                                                                                                                                                 |
| ---------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 8.14.0 and later             | CODEX  | [kibana-8.14.x-flow-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/flow/kibana-8.14.x-flow-codex.ndjson)               |
| 8.14.0 and later             | ECS    | [kibana-8.14.x-flow-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/flow/kibana-8.14.x-flow-ecs.ndjson)                   |
| 8.2.0 - 8.13.x               | CODEX  | [kibana-8.2.x-flow-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/flow/kibana-8.2.x-flow-codex.ndjson)                 |
| 8.2.0 - 8.13.x               | ECS    | [kibana-8.2.x-flow-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/flow/kibana-8.2.x-flow-ecs.ndjson)                     |
| 7.17.x - 8.1.x (unsupported) | CODEX  | [kibana-7.17.x-flow-codex.ndjson (unsupported)](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/flow/kibana-7.17.x-flow-codex.ndjson) |
| 7.17.x - 8.1.x (unsupported) | ECS    | [kibana-7.17.x-flow-ecs.ndjson (unsupported)](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/flow/kibana-7.17.x-flow-ecs.ndjson)     |

### Import Kibana Objects

#### Importing via the User Interface

To import the configuration, in Kibana go to *Stack Management* --> *Saved Objects* and click *Import* in the upper right corner.

![Saved Objects Before](https://user-images.githubusercontent.com/10326954/109737687-c132b900-7bc6-11eb-8ec7-843e8d48dcdc.png)

A sidebar will appear. Again click *Import* at the top of the sidebar.

![Import](https://user-images.githubusercontent.com/10326954/109737831-05be5480-7bc7-11eb-942f-33e3958ee44b.png)

Select the file which you downloaded, and click the *Import* button at the bottom of the sidebar.

The configuration will be imported, and you will see all of the imported objects.

![Imported](https://user-images.githubusercontent.com/10326954/109738035-651c6480-7bc7-11eb-929d-d42ce9263c1d.png)

Close the sidebar. You will also see all of the imported objects in the *Saved Objects* list.

![Saved Objects After](https://user-images.githubusercontent.com/10326954/109738146-972dc680-7bc7-11eb-946c-156799f3487e.png)

#### Importing via the API

```shell
curl -XPOST "https://username:password@IPORHOSTOFKIBANA:5601/api/saved_objects/_import?overwrite=true" -k -H "kbn-xsrf: true" -H "securitytenant: global" --form file=@kibana-7.14.x-ecs-light.ndjson
```

#### Troubleshooting Import Problems

When the Kibana import fails, neither the import UI nor the Kibana logs will provide any useful information. However, attempting to import via `curl` will usually provide more detail.

The most common issue is related to the relative large size of the Kibana Saved Objects file. This can cause the import to fail unless the maximum allowed payload size is increased. The Kibana setting is `server.maxPayloadBytes` (or `SERVER_MAXPAYLOADBYTES` if using Docker), which should also be set to `8388608`.

If you have a reverse proxy in front of Kibana, you may have to modify your proxy settings as well. Many reverse proxies also have relatively low values for the maximum body size. For example, the NGINX default is only 1MB. This can be increased by setting `client_max_body_size` to `8388608`. Refer to the documentation for your proxy software to similarly modify its behavior.

### Recommended Kibana Advanced Settings

#### Settings for All Kibana Distributions

You may find that modifying a few of the Kibana advanced settings will produce a more user-friendly experience while using ElastiFlow. These settings are made in Kibana, under `Stack Management -> Kibana -> Advanced Settings`.

| Advanced Setting              | Value             | Why make the change?                                                                                                                                                                                                                                                               |
| ----------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| filters:pinnedByDefault       | `true`            | Pinning a filter allows it to persist when you are changing dashboards. This is very useful when drilling-down into something of interest and you want to change dashboards for a different perspective of the same data. This is the #1 setting we recommend changing.            |
| defaultRoute                  | *see description* | If your primary or only use-case for Kibana is ElastiFlow, set this the URL path for the dashboard to which you which to load immediately after logging in, or when returning to "home". The format of this value is `/app/dashboards#/view/4a608bc0-3d3e-11eb-bc2c-c5758316d788`. |
| doc\_table:highlight          | `false`           | There be a query performance penalty that comes with using the highlighting feature. As it isn't very useful for this use-case, it is better to just turn it off.                                                                                                                  |
| state:storeInSessionStorage   | `true`            | Kibana URLs can get pretty large. Especially when working with Vega visualizations. This will likely result in error messages for users of Internet Explorer. Using in-session storage will fix this issue for these users.                                                        |
| theme:darkMode                | `true` or `false` | Enable dark mode for the Kibana UI. This setting should match the `ndjson` import file discussed above.                                                                                                                                                                            |
| timepicker:timeDefaults       | *see below*       | The Time Picker Quick Range to use when Kibana is started without one.                                                                                                                                                                                                             |
| timepicker:quickRanges        | *see below*       | The default options in the Time Picker are less than optimal, for most logging and monitoring use-cases. Fortunately Kibana now allows you to customize the time picker. Our recommended settings can be found below.                                                              |
| format:number:defaultPattern  | `0,0.[00]`        | Default numeral format for the "number" format.                                                                                                                                                                                                                                    |
| format:percent:defaultPattern | `0,0.[00]%`       | Default numeral format for the "percent" format.                                                                                                                                                                                                                                   |

**Recommended Time Picker Time Defaults (timepicker:timeDefaults)**

We find that the following Time Picker Time Default provides more useful views of the data for network flow-related use-cases.

```json
{
  "from": "now-1h/m",
  "to": "now"
}
```

**Recommended Time Picker Quick Ranges (timepicker:quickRanges)**

We find that the following set of Time Picker Quick Ranges provides more useful views of the data for network flow-related use-cases.

```json
[
  {
    "from": "now-15m/m",
    "to": "now/m",
    "display": "Last 15 minutes"
  },
  {
    "from": "now-30m/m",
    "to": "now/m",
    "display": "Last 30 minutes"
  },
  {
    "from": "now-1h/m",
    "to": "now/m",
    "display": "Last 1 hour"
  },
  {
    "from": "now-2h/m",
    "to": "now/m",
    "display": "Last 2 hours"
  },
  {
    "from": "now-4h/m",
    "to": "now/m",
    "display": "Last 4 hours"
  },
  {
    "from": "now-12h/m",
    "to": "now/m",
    "display": "Last 12 hours"
  },
  {
    "from": "now-24h/m",
    "to": "now/m",
    "display": "Last 24 hours"
  },
  {
    "from": "now-48h/m",
    "to": "now/m",
    "display": "Last 48 hours"
  },
  {
    "from": "now-7d/m",
    "to": "now/m",
    "display": "Last 7 days"
  },
  {
    "from": "now-30d/m",
    "to": "now/m",
    "display": "Last 30 days"
  },
  {
    "from": "now-60d/m",
    "to": "now/m",
    "display": "Last 60 days"
  },
  {
    "from": "now-90d/m",
    "to": "now/m",
    "display": "Last 90 days"
  }
]
```

#### Settings for Elastic's X-Pack Features

The following settings require that NetObserv Flow is used with an Elastic Stack deployment licensed for X-Pack Basic or higher. The collector's Elasticsearch output must also be configured with ECS-support enabled (set `EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE` to `true`).

| Advanced Setting                   | Value                       | Why make the change?                                                                                                                          |
| ---------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| securitySolution:ipReputationLinks | *see below*                 | Modifying these settings provides a more seamless integration with the ElastiFlow NetIntel service while using Kibana's Security app.         |
| securitySolution:defaultIndex      | add `elastiflow-flow-ecs-*` | Add the ElastiFlow index pattern, with support for ECS, to populate the Kibana's Security app with data network flow records from ElastiFlow. |
| securitySolution:timeDefaults      | *see below*                 | For the best experience set this value similar to `timepicker:timeDefaults`.                                                                  |

**Recommended IP Reputation Links (securitySolution:ipReputationLinks)**

```json
[
  { "name": "ElastiFlow NetIntel", "url_template": "https://elastiflow.com/netintel/search?ip={{ip}}" },
  { "name": "VirusTotal", "url_template": "https://www.virustotal.com/gui/search/{{ip}}" }
]
```

**Recommended Security Solution Time Defaults (securitySolution:timeDefaults)**

We find that the following Security Solution Time Default provides more useful views of the data for network flow-related use-cases.

```json
{
  "from": "now-1h/m",
  "to": "now"
}
```


# Elastic Configuration Options

## EF\_OUTPUT\_ELASTICSEARCH\_ENABLE

Specifies whether the Elasticsearch output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to the Elasticsearch bulk API.

* Default
  * `2000`

## EF\_OUTPUT\_ELASTICSEARCH\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to the Elasticsearch bulk API.

* Default
  * `8388608`

## EF\_OUTPUT\_ELASTICSEARCH\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Elasticsearch output's default value for this setting was changed to `collect`. This will allow the collector to handle a wider variety of situations without additional configuration. If you wish to continue to use the old default setting of `end`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_PERIOD

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Elasticsearch output's default value for this setting was changed to `rollover`. This will enable the use of Index Lifecycle Management (ILM) to manage retention of ElastiFlow indices. If you wish to continue to use the old default setting of `daily`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `daily` - New indices will be created each day. The format of the time period suffix will be `-yyyy.MM.dd`.
  * `weekly` - New indices will be created each week. The format of the time period suffix will be `-yyyy.'w'ww`.
  * `monthly` - New indices will be created each month. The format of the time period suffix will be `-yyyy.MM`.
  * `rollover` - Index Lifecycle Management (ILM) will be used to handle the creation and deletion of indices. If no ILM policy is defined, a default policy will be created. The rollover alias is determined automatically. If the rollover alias does not exist, an initial write index will be bootstrapped with the rollover alias.
* Default
  * `rollover`

## EF\_OUTPUT\_ELASTICSEARCH\_TSDS\_ENABLE

{% hint style="info" %}
Only supported in NetObserv Flow and NetObserv SNMP. For NetObserv SNMP, support was introduced in 7.13.0
{% endhint %}

Elasticsearch 8.7 introduced TSDS (time series data stream) feature. Storing flow and telemetry data using TSDS can result in a storage savings of 50-70% depending on the content of the flow records. TSDS also supports downsampling (initially for bytes and packets fields) which can result in even less storage capacity needed for historical data. Enabling TSDS does increase the ingest-related CPU load for Elasticsearch. Setting this value to `true` will enable TSDS support.

{% hint style="info" %}
Enabling TSDS requires NetObserv to push new index templates. Please shut down the collector and remove ElastiFlow index templates before you enable TSDS. After you restart the collector you should see new index templates being created.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `false`

If set to `true`:

* the option `EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD` will be set to `rollover`, overriding any user-provided value.
* the option `EF_OUTPUT_ELASTICSEARCH_STORAGE_OPTIMIZATION_ENABLE` will be set to `false`, overriding any user-provided value.

### TSDS Metric Support Note

For NetObserv SNMP, only some fields will be marked as a '[metric](https://www.elastic.co/docs/manage-data/data-store/data-streams/time-series-data-stream-tsds#time-series-metric)' to Elasticsearch, which impacts downsampling. More specifically, the `time_series_metric` field is only set for a subset of fields in the Elasticsearch templates that NetObserv SNMP creates when it starts.

Initially, only IETF MIB objects will have TSDS metric support. ElastiFlow leverages the [snmp definition files](https://github.com/elastiflow/snmp/tree/main) (which ship with the product) to control which fields are supported as a TSDS metric. If you see the field "metric" assigned to a field (see [IP-MIB](https://github.com/elastiflow/snmp/blob/main/objects/ietf/IP-MIB.yml) for an example), it means that those fields will have time\_series\_metric defined in the Elaticsearch templates that NetObserv SNMP creates.

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_SUFFIX

It can sometimes be useful to have separate indices for different environments, locations or other organizational units. This setting allows you to specify a suffix that will be added to the index for such purposes.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ENABLE

Specifies whether the output should attempt to add the required index template to Elasticsearch.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_OVERWRITE

If the output is configured to add the index template to Elasticsearch (`EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ENABLE` is `true`), this setting determines whether the index template should be overwritten if it already exists.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_SHARDS

The number of shards with which the index should be created. As a general rule, additional shards increase ingest performance, assuming there are sufficient data nodes across which the shards can be distributed.

* Recommended
  * Equal to the number of Elasticsearch data nodes to which data will be indexed.
* Default
  * `3`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REPLICAS

The number of replicas that should be created for each shard. If using a multi-node cluster and data redundancy is desired, this value must be at least `1`.

In general, additional replicas will increase query performance, assuming there are sufficient data nodes across which the replicas can be distributed.

* Recommended
  * `1` if indexing data to a multi-node cluster.
  * `0` for a single-node.
* Default
  * `1`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL

Specifies the period for the refresh interval. The refresh interval is the time window in which newly ingested documents are added to a segment, prior to the segment being added to the index. Only after the refresh interval has ended and the segment has been added to the index do the documents become searchable.

* Recommended
  * `5s` - If the data needs to become available for queries more quickly. However shorter refresh intervals will negatively impact ingest performance.
  * `30s` - (or longer) If maximizing ingest performance is the highest priority. Longer refresh intervals negatively impact the real-time accessibility of new records.
  * `10s` or `20s` - This is a reasonable compromise between ingest performance and data accessibility for most network traffic analytics use-cases.
* Default
  * `20s`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_CODEC

The setting determines the level of compression used for stored values.

* Valid Values
  * `default` - Stored values are compressed using LZ4.
  * `best_compression` - Stored values are compressed using DEFLATE. This reduces disk capacity requirements with the trade-off of slightly higher CPU utilization.
* Default
  * `best_compression`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ILM\_LIFECYCLE

If data is being stored to an Elasticsearch cluster with Index Lifecycle Management (ILM) features enabled, this setting specifies the name of the ILM Lifecycle that should be applied to the indices.

{% hint style="info" %}
The ILM Lifecycle itself MUST be configured separately in Elasticsearch.
{% endhint %}

* Default
  * `elastiflow`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT

If it is desired to process the incoming with an Elasticsearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the default pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL

If it is desired to process the incoming with an Elasticsearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the final pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_SYNTHETIC\_SOURCE\_ENABLE

If set to `true`, this setting will configure the index template to use the synthetic `_source` field. This will improve storage efficiency, but may reduce the performance of some queries.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_ADDRESSES

This setting specifies the Elasticsearch servers to which the output should connect. It is a comma-separated list of Elasticsearch nodes, including port number. We recommend specifying a maximum of 6 to 8 Elasticsearch servers here. If you require sending data directly to more than 6 to 8 servers, consider using an Elastic "coordinating node".

{% hint style="danger" %}
Do **NOT** include `http://` or `https://` in the provided value. TLS communications is enabled/disabled using `EF_OUTPUT_ELASTICSEARCH_TLS_ENABLE`.
{% endhint %}

* Default
  * `127.0.0.1:9200`

## EF\_OUTPUT\_ELASTICSEARCH\_USERNAME

The username to use when connecting to Elasticsearch.

* Default
  * `elastic`

## EF\_OUTPUT\_ELASTICSEARCH\_PASSWORD

The password to use when connecting to Elasticsearch.

* Default
  * `changeme`

## EF\_OUTPUT\_ELASTICSEARCH\_CLOUD\_ID

The URI for the Elastic Cloud endpoint to which the output should connect. If set, this value overrides `EF_OUTPUT_ELASTICSEARCH_ADDRESSES`.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_API\_KEY

The base64-encoded token to use for authorization.

Elasticsearch provides [Security APIs](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api.html#security-api-keys) to:

* [Create API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html)
* [Get API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-api-key.html)
* [Invalidate API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-invalidate-api-key.html)
* [Clear API key cache](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-api-key-cache.html)
* [Grant API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html)

If set, this value overrides `EF_OUTPUT_ELASTICSEARCH_USERNAME` and `EF_OUTPUT_ELASTICSEARCH_PASSWORD`.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for client PKI authentication.

* Default
  * `''`

To use PKI authentication, your Elasticsearch cluster needs to be configured for such a setup. Here is a [guide](https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication). The collectors require the use of a [role mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role-mapping.html) with a "superuser" role. Alternatively, a custom role that can contain the privileges allowing the collectors to read/create/update/delete indices, and read/create/update/delete data to/from indices.

## EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CERT\_FILEPATH

The path to the client certificate to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_KEY\_FILEPATH

The path to the client key to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Elasticsearch.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Elasticsearch server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the Elasticsearch server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_ENABLE

Specifies whether to retry connecting to Elasticsearch after a connection has failed.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE

Specifies whether to retry bulk indexing requests which have timed-out.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_MAX\_RETRIES

Specifies the number of times to retry bulk indexing requests which have timed-out.

* Default
  * `3`

## EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_BACKOFF

If set, this value specifies the quantity of milliseconds that the output should "backoff" prior to retrying a failed bulk request.

* Default
  * `1000`

## EF\_OUTPUT\_ELASTICSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE

This setting is used to enable/disable the storage optimization feature. This feature will configure the index sort setting in the index template to optimize the storage of the data.

{% hint style="info" %}
`EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD` will be overridden to `rollover` when this setting is enabled.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. This is particularly useful when used with multiple namespaced outputs, e.g. sending flow records to one datastore and telemetry to another.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric'`


# OpenSearch

The OpenSearch output can be used to send records to [OpenSearch](https://opensearch.org/), [Open Distro for OpenSearch](https://opendistro.github.io/for-elasticsearch/) and [Amazon OpenSearch Service](https://aws.amazon.com/opensearch-service/).

## Dashboards

OpenSearch Dashboards enable you to interactively explore, visualize, and share insights into your network flow data, as well as manage and monitor OpenSearch.

### Download OpenSearch Dashboards Objects

The OpenSearch dashboards and related configuration artifacts can be easily imported. You must first download the relevant import file, depending on the configuration of your environment.

#### Saved Objects for Network Flow Data

| Version           | Schema | Saved Objects                                                                                                                                                          |
| ----------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 2.14.x and later  | CODEX  | [dashboards-2.14.x-flow-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/flow/dashboards-2.14.x-flow-codex.ndjson) |
| 2.14.x and later  | ECS    | [dashboards-2.14.x-flow-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/flow/dashboards-2.14.x-flow-ecs.ndjson)     |
| 2.0.0 - 2.13.x    | CODEX  | [dashboards-2.0.x-flow-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/flow/dashboards-2.0.x-flow-codex.ndjson)   |
| 2.0.0 - 2.13.x    | ECS    | [dashboards-2.0.x-flow-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/flow/dashboards-2.0.x-flow-ecs.ndjson)       |
| 1.x (unsupported) | CODEX  | [dashboards-1.0.x-flow-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/flow/dashboards-1.0.x-flow-codex.ndjson)   |
| 1.x (unsupported) | ECS    | [dashboards-1.0.x-flow-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/flow/dashboards-1.0.x-flow-ecs.ndjson)       |

### Import OpenSearch Dashboards Objects

#### Importing via the User Interface

To import the configuration, in OpenSearch Dashboards go to *Stack Management* --> *Saved Objects* and click *Import* in the upper right corner.

#### Importing via the API

```shell
curl -XPOST "https://username:password@IPORHOST:5601/api/saved_objects/_import?overwrite=true" -k -H "osd-xsrf: true" -H "securitytenant: global" --form file=@dashboards-1.0.x-codex-light.ndjson
```

#### Troubleshooting Import Problems

When the OpenSearch Dashboards import fails, neither the import UI nor the OpenSearch Dashboards logs will provide any useful information. However, attempting to import via `curl` will usually provide more detail.

The most common issue is related to the relative large size of the OpenSearch Dashboards Saved Objects file. This can cause the import to fail unless the maximum allowed payload size is increased. The OpenSearch Dashboards setting is `server.maxPayloadBytes` (or `SERVER_MAXPAYLOADBYTES` if using Docker), which should also be set to `8388608`.

If you have a reverse proxy in front of OpenSearch Dashboards, you may have to modify your proxy settings as well. Many reverse proxies also have relatively low values for the maximum body size. For example, the NGINX default is only 1MB. This can be increased by setting `client_max_body_size` to `8388608`. Refer to the documentation for your proxy software to similarly modify its behavior.

### Recommended OpenSearch Dashboards Advanced Settings

You may find that modifying a few of the OpenSearch Dashboards advanced settings will produce a more user-friendly experience while using ElastiFlow. These settings are made in OpenSearch Dashboards, under `Stack Management -> Advanced Settings`.

<table><thead><tr><th width="206.69921875">Advanced Setting</th><th width="124.75">Value</th><th>Why make the change?</th></tr></thead><tbody><tr><td>filters:pinnedByDefault</td><td><code>true</code></td><td>Pinning a filter allows it to persist when you are changing dashboards. This is very useful when drilling-down into something of interest and you want to change dashboards for a different perspective of the same data. This is the #1 setting we recommend changing.</td></tr><tr><td>defaultRoute</td><td><em>see description</em></td><td>If your primary or only use-case for OpenSearch Dashboards is ElastiFlow, set this the URL path for the dashboard to which you which to load immediately after logging in, or when returning to "home". The format of this value is <code>/app/dashboards#/view/4a608bc0-3d3e-11eb-bc2c-c5758316d788</code>.</td></tr><tr><td>doc_table:highlight</td><td><code>false</code></td><td>There be a query performance penalty that comes with using the highlighting feature. As it isn't very useful for this use-case, it is better to just turn it off.</td></tr><tr><td>state:storeInSessionStorage</td><td><code>true</code></td><td>OpenSearch Dashboards URLs can get pretty large. Especially when working with Vega visualizations. This will likely result in error messages for users of Internet Explorer. Using in-session storage will fix this issue for these users.</td></tr><tr><td>theme:darkMode</td><td><code>true</code> or <code>false</code></td><td>Enable dark mode for the OpenSearch Dashboards UI. This setting should match the <code>ndjson</code> import file discussed above.</td></tr><tr><td>timepicker:timeDefaults</td><td><em>see below</em></td><td>The Time Picker Quick Range to use when OpenSearch Dashboards is started without one.</td></tr><tr><td>timepicker:quickRanges</td><td><em>see below</em></td><td>The default options in the Time Picker are less than optimal, for most logging and monitoring use-cases. Fortunately OpenSearch Dashboards now allows you to customize the time picker. Our recommended settings can be found below.</td></tr><tr><td>format:number:defaultPattern</td><td><code>0,0.[00]</code></td><td>Default numeral format for the "number" format.</td></tr><tr><td>format:percent:defaultPattern</td><td><code>0,0.[00]%</code></td><td>Default numeral format for the "percent" format.</td></tr></tbody></table>

#### Recommended Time Picker Time Defaults (timepicker:timeDefaults)

We find that the following Time Picker Time Default provides more useful views of the data for network flow-related use-cases.

```json
{
  "from": "now-1h/m",
  "to": "now"
}
```

#### Recommended Time Picker Quick Ranges (timepicker:quickRanges)

We find that the following set of Time Picker Quick Ranges provides more useful views of the data for network flow-related use-cases.

```json
[
  {
    "from": "now-15m/m",
    "to": "now/m",
    "display": "Last 15 minutes"
  },
  {
    "from": "now-30m/m",
    "to": "now/m",
    "display": "Last 30 minutes"
  },
  {
    "from": "now-1h/m",
    "to": "now/m",
    "display": "Last 1 hour"
  },
  {
    "from": "now-2h/m",
    "to": "now/m",
    "display": "Last 2 hours"
  },
  {
    "from": "now-4h/m",
    "to": "now/m",
    "display": "Last 4 hours"
  },
  {
    "from": "now-12h/m",
    "to": "now/m",
    "display": "Last 12 hours"
  },
  {
    "from": "now-24h/m",
    "to": "now/m",
    "display": "Last 24 hours"
  },
  {
    "from": "now-48h/m",
    "to": "now/m",
    "display": "Last 48 hours"
  },
  {
    "from": "now-7d/m",
    "to": "now/m",
    "display": "Last 7 days"
  },
  {
    "from": "now-30d/m",
    "to": "now/m",
    "display": "Last 30 days"
  },
  {
    "from": "now-60d/m",
    "to": "now/m",
    "display": "Last 60 days"
  },
  {
    "from": "now-90d/m",
    "to": "now/m",
    "display": "Last 90 days"
  }
]
```


# OpenSearch Configuration Options

## EF\_OUTPUT\_OPENSEARCH\_ENABLE

Specifies whether the OpenSearch output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to the OpenSearch bulk API.

* Default
  * `2000`

## EF\_OUTPUT\_OPENSEARCH\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to the OpenSearch bulk API.

* Default
  * `8388608`

## EF\_OUTPUT\_OPENSEARCH\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the OpenSearch output's default value for this setting was changed to `collect`. This will allow the collector to handle a wider variety of situations without additional configuration. If you wish to continue to use the old default setting of `end`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_PERIOD

{% hint style="info" %}
Beginning with ElastiFlow `7.11.0` the OpenSearch output's default value for this setting will be changed to `rollover`. This will enable the use of Index State Management (ISM) to manage retention of ElastiFlow indices. If you wish to continue to use the old default setting of `daily`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `daily` - New indices will be created each day. The format of the time period suffix will be `-yyyy.MM.dd`.
  * `weekly` - New indices will be created each week. The format of the time period suffix will be `-yyyy.'w'ww`.
  * `monthly` - New indices will be created each month. The format of the time period suffix will be `-yyyy.MM`.
  * `rollover` - Index State Management will be used to handle the creation and deletion of indices.
* Default
  * `rollover`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_SUFFIX

It can sometimes be useful to have separate indices for different environments, locations or other organizational units. This setting allows you to specify a suffix that will be added to the index for such purposes.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ENABLE

Specifies whether the output should attempt to add the required index template to OpenSearch.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_OVERWRITE

If the output is configured to add the index template to OpenSearch (`EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_ENABLE` is `true`), this setting determines whether the index template should be overwritten if it already exists.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_SHARDS

The number of shards with which the index should be created. As a general rule, additional shards increase ingest performance, assuming there are sufficient data nodes across which the shards can be distributed.

* Recommended
  * Equal to the number of OpenSearch data nodes to which data will be indexed.
* Default
  * `3`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REPLICAS

The number of replicas that should be created for each shard. If using a multi-node cluster and data redundancy is desired, this value must be at least `1`.

In general, additional replicas will increase query performance, assuming there are sufficient data nodes across which the replicas can be distributed.

* Recommended
  * `1` if indexing data to a multi-node cluster.
  * `0` for a single-node.
* Default
  * `1`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL

Specifies the period for the refresh interval. The refresh interval is the time window in which newly ingested documents are added to a segment, prior to the segment being added to the index. Only after the refresh interval has ended and the segment has been added to the index do the documents become searchable.

* Recommended
  * `5s` - If the data needs to become available for queries more quickly. However, shorter refresh intervals will negatively impact ingest performance.
  * `30s` - (or longer) If maximizing ingest performance is the highest priority. Longer refresh intervals negatively impact the real-time accessibility of new records.
  * `10s` or `20s` - This is a reasonable compromise between ingest performance and data accessibility for most network traffic analytics use-cases.
* Default
  * `20s`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_CODEC

The setting determines the level of compression used for stored values.

* Valid Values
  * `default` - Stored values are compressed using LZ4.
  * `best_compression` - Stored values are compressed using DEFLATE. This reduces disk capacity requirements with the trade-off of slightly higher CPU utilization.
* Default
  * `best_compression`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ISM\_POLICY

If data is being stored to an Open Distro for OpenSearch cluster, this setting specifies the Index State Management (ISM) Policy ID that should be applied to the indices.

{% hint style="info" %}
The ISM Policy itself MUST be configured separately in OpenSearch. If `EF_OUTPUT_OPENSEARCH_INDEX_PERIOD` is set to `rollover` a default ISM policy will be added automatically with the name defined in this setting.
{% endhint %}

* Default
  * `elastiflow`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT

If it is desired to process the incoming with an OpenSearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the default pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL

If it is desired to process the incoming with an OpenSearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the final pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_OPENSEARCH\_ADDRESSES

This setting specifies the OpenSearch servers to which the output should connect. It is a comma-separated list of OpenSearch nodes, including port number.

{% hint style="danger" %}
Do **NOT** include `http://` or `https://` in the provided value. TLS communications is enabled/disabled using `EF_OUTPUT_OPENSEARCH_TLS_ENABLE`.
{% endhint %}

* Default
  * `127.0.0.1:9200`

## EF\_OUTPUT\_OPENSEARCH\_USERNAME

The username to use when connecting to OpenSearch.

* Default
  * `admin`

## EF\_OUTPUT\_OPENSEARCH\_PASSWORD

The password to use when connecting to OpenSearch.

* Default
  * `admin`

## EF\_OUTPUT\_OPENSEARCH\_AWS\_ACCESS\_KEY

The AWS Access key to use when connecting to OpenSearch via Auth Sig V4

## EF\_OUTPUT\_OPENSEARCH\_AWS\_SECRET\_KEY

The AWS Secret key to use when connecting to OpenSearch via Auth Sig V4

## EF\_OUTPUT\_OPENSEARCH\_AWS\_REGION

The AWS Region to use when connecting to OpenSearch via Auth Sig V4

## EF\_OUTPUT\_OPENSEARCH\_CLIENT\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_CLIENT\_CERT\_FILEPATH

The path to the client certificate to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_CLIENT\_KEY\_FILEPATH

The path to the client key to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to OpenSearch.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the OpenSearch server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the OpenSearch server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_RETRY\_ENABLE

Specifies whether to retry connecting to OpenSearch after a connection has failed.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE

Specifies whether to retry bulk indexing requests which have timed-out.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_MAX\_RETRIES

Specifies the number of times to retry bulk indexing requests which have timed-out.

* Default
  * `3`

## EF\_OUTPUT\_OPENSEARCH\_RETRY\_BACKOFF

If set, this value specifies the quantity of milliseconds that the output should "backoff" prior to retrying a failed bulk request.

* Default
  * `1000`

## EF\_OUTPUT\_OPENSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE

This setting is used to enable/disable the storage optimization feature. This feature will configure the index sort setting in the index template to optimize the storage of the data.

{% hint style="info" %}
`EF_OUTPUT_OPENSEARCH_INDEX_PERIOD` will be overridden to `rollover` when this setting is enabled.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. This is particularly useful when used with multiple namespaced outputs, e.g. sending flow records to one datastore and telemetry to another.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Cribl

{% hint style="info" %}
The Cribl output is currently a *technology preview*. The design and implementation are less mature than stable features and subject to change.
{% endhint %}

The Cribl output can be used to send records to the [Cribl LogStream HTTP/S (Bulk API)](https://docs.cribl.io/logstream/sources-https).

## EF\_OUTPUT\_CRIBL\_ENABLE

Specifies whether the Cribl output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_CRIBL\_ADDRESSES

This setting specifies the Cribl workers to which the output should connect. It is a comma-separated list of Cribl workers, including port number.

{% hint style="danger" %}
Do \*\*NOT\*\* include \`http\://\` or \`https\://\` in the provided value. TLS communications is enabled/disabled using \`EF\_OUTPUT\_CRIBL\_TLS\_ENABLE\`.
{% endhint %}

* Default
  * `127.0.0.1:10080`

## EF\_OUTPUT\_CRIBL\_TOKEN

The Cribl data shipping token that the collector will use to send data.

* Default
  * `''`

## EF\_OUTPUT\_CRIBL\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to Cribl.

* Default
  * `2000`

## EF\_OUTPUT\_CRIBL\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to Cribl.

* Default
  * `8388608`

## EF\_OUTPUT\_CRIBL\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Cribl Logstream.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_CRIBL\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Cribl Logstream server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_CRIBL\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the Cribl Logstream server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_CRIBL\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_CRIBL\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. If left empty, all types will be allowed by default.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Kafka

The Kafka output can be used to send records to [Apache Kafka](https://kafka.apache.org), [Confluent Platform](https://www.confluent.io/product/confluent-platform/), [Confluent Cloud](https://www.confluent.io/confluent-cloud/), [Redpanda](https://redpanda.com) and [Amazon Managed Streaming for Apache Kafka (Amazon MSK)](https://aws.amazon.com/msk/).

## EF\_OUTPUT\_KAFKA\_ENABLE

Specifies whether the Kafka output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_POOL\_SIZE

Specifies the number of Kafka output workers to start. An output worker is an instance of a Kafka producer.

* Default
  * Based on the number of licensed flows or devices, depending on the collector.

## EF\_OUTPUT\_KAFKA\_BROKERS

A comma-separated list of brokers, IP address and port number, to which the collector is to connect.

* Example
  * `192.0.2.11:9092,192.0.2.12:9092,broker1.example.com:9092`
* Default
  * `127.0.0.1:9092`

## EF\_OUTPUT\_KAFKA\_VERSION

The version of Kafka to which the collector will assume it is connecting.

{% hint style="danger" %}
Kafka provides backwards-compatibility, so specifying an older version is OK. However, specifying a version greater than the brokers will likely cause issues.
{% endhint %}

* Default
  * `1.0.0`

## EF\_OUTPUT\_KAFKA\_CLIENT\_ID

A user-provided string sent with every request to the Kafka brokers for logging, debugging, and auditing purposes.

* Default
  * `elastiflow`

## EF\_OUTPUT\_KAFKA\_RACK\_ID

A rack identifier. This can be any string value which indicates where the collector is physically located.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_TIMEOUT

The amount of time, in seconds, that the client will wait for the connection to be established.

* Default
  * `30`

## EF\_OUTPUT\_KAFKA\_TOPIC

The Kafka topic to which messages will be produced.

* Default
  * `elastiflow-flow-codex`

## EF\_OUTPUT\_KAFKA\_PARTITION\_KEY

Defines a field from the message which will be used to set the partitioning key.

* Default
  * `flow.export.ip.addr`

## EF\_OUTPUT\_KAFKA\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. This is particularly useful when used with multiple namespaced outputs, e.g. sending flow records to one datastore and telemetry to another.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric'`

## EF\_OUTPUT\_KAFKA\_SASL\_ENABLE

Specifies whether SASL based authentication is used when connecting to the Kafka brokers. While there are multiple SASL authentication methods, the current implementation is limited to plaintext (SASL/PLAIN) authentication.

* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_SASL\_USERNAME

The authentication identity (authcid) to present for SASL/PLAIN authentication.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_SASL\_PASSWORD

The password to use for SASL/PLAIN authentication.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Kafka.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for connecting to the Kafka brokers.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_TLS\_CERT\_FILEPATH

The path to the TLS certificate to use for connecting to the Kafka brokers.

* Default
  * `''`

* Default
  \*

## EF\_OUTPUT\_KAFKA\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Kafka brokers to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_MAX\_MESSAGE\_BYTES

The maximum permitted size of a message (defaults to 1\_000\_000). Should be set equal to or smaller than the broker's `message.max.bytes`.

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `1048576`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_REQUIRED\_ACKS

The level of acknowledgement reliability needed from the broker (defaults to 1 - WaitForLocal).

* Valid Values
  * `0` - (NoResponse) Doesn't require any acknowledgement other than the TCP ACK that the message payload was received.
  * `1` - (WaitForLocal) Waits for only the receiving broker to acknowledge commitment of the message.
  * `-1` - (WaitForAll) Waits for the topic's minimum in-sync replicas to acknowledge commitment of the message. The minimum number of in-sync replicas is configured for a Kafka topic via the `min.insync.replicas` attribute.
* Default
  * `1`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_TIMEOUT

The maximum duration, in seconds, that the producer will wait for the RequiredAcks defined in `EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS`. This is only relevant when `EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS` is set to `-1` (WaitForAll).

* Default
  * `10`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION

The type of compression to use on messages (defaults to no compression).

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Kafka output's default value for this setting was changed to `3` (LZ4). Performance testing has shown that this change can improve throughput. If you wish to continue to use the old default setting of `0` (none), you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `0` - none
  * `1` - Gzip
  * `2` - snappy
  * `3` - LZ4
  * `4` - ZSTD
* Default
  * `3`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION\_LEVEL

The level of compression to use on messages. The meaning depends on the actual compression type used and defaults to the compression codec's default level.

* Default
  * `-1000` (use the codec's default level)

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_BYTES

The best-effort number of bytes needed to trigger a flush. This setting is per broker. If no partition key is set, i.e. messages are distributed to partitions round-robin, each broker will receive approximately the same number of bytes. If a broker has two partitions of the topic, messages will be split between the two partitions. A partition which is the only partition of the topic on the broker will receive all of the produced messages and have approximately twice the volume of messages as on the broker with two partitions.

{% hint style="danger" %}
`EF_OUTPUT_KAFKA_PRODUCER_FLUSH_BYTES` should not be set to a value larger than the `message.max.bytes` setting of the Kafka topic to which records are to be written.
{% endhint %}

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `1048576`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MESSAGES

The best-effort number of messages needed to trigger a flush. This setting is per broker. If no partition key is set, i.e. messages are distributed to partitions round-robin, each broker will receive the same number of messages. If a broker has two partitions of the topic, messages will be split between the two partitions. A partition which is the only partition of the topic on the broker will receive all of the produced messages and have approximately twice as many messages as on the broker with two partitions.

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `1024`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_FREQUENCY

The best-effort frequency of flushes, in milliseconds. This setting is per partition. If multiple partitions for the same topic are on the same broker, messages will be flushed to each partition at this interval. If no partition key is set, i.e. messages are distributed to partitions round-robin, a broker with two partitions will receive approximately twice as many messages as a broker with only one partition.

{% hint style="danger" %}
Beginning with ElastiFlow `7.17.0` the Kafka output's default value for this setting was changed to `2000`. Performance testing has shown that this change can improve throughput. If you wish to continue to use the old default setting of `1000`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `2000`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MAX\_MESSAGES

The maximum number of messages the producer will send in a single broker request.

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `0`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_MAX

The total number of times to retry sending a message.

* Default
  * `3`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_BACKOFF

The period of time, in milliseconds, to wait for the Kafka cluster to settle between retries.

* Default
  * `100`

## EF\_OUTPUT\_KAFKA\_FLAT\_RECORD\_ENABLE

The Kafka output can send JSON records using nested or flattened field names. Historically only nested records were supported, which is why the default value for this setting is `false`. However, a record consisting of flattened field names reduces resource requirements and improves throughput.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Kafka output's default value for this setting was changed to `true`. Performance testing has shown that this change can improve throughput. If you wish to continue to use the old default setting of `false`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_KAFKA\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Kafka output's default value for this setting was changed to `collect`. This will allow the collector to handle a wider variety of situations without additional configuration. If you wish to continue to use the old default setting of `end`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`


# Generic HTTP

{% hint style="info" %}
The Generic HTTP output is currently a *technology preview*. The design and implementation are less mature than stable features and subject to change.
{% endhint %}

The Generic HTTP output can be used to send records to an HTTP endpoint such as the `http_endpoint` input of Elastic's Filebeat, or the `http` input of Elastic's Logstash.

The following is an example configuration for Elastic Filebeat:

```yaml
filebeat.inputs:
  - type: http_endpoint
    enabled: true
    listen_address: 0.0.0.0
    listen_port: 8888
    processors:
      - convert:
          fields:
            - {from: "json", type: "string"}
          ignore_missing: true
          fail_on_error: false
      - decode_json_fields:
          fields: ["json"]
          process_array: true
          target: ""
          overwrite_keys: true
          add_error_key: false
      - drop_fields:
          fields: ["json"]
          ignore_missing: false

processors:
  - drop_fields:
      fields:
        - agent
        - ecs
        - host
        - input
```

{% hint style="info" %}
The ElastiFlow Generic HTTP Output supports sending data using the ECS Schema. The global processor section in the above config is necessary to remove the fields automatically added by Filebeat. These would otherwise conflict with the fields ElastiFlow is emitting. This must be done in a global processor as (from the Filebeat source code) "Builtin fields can be modified using global `processors`, and `fields` only." This works because as of `6.0.0` ElastiFlow has transitioned to flattened field names. Dropping the Filebeat-emitted parent fields in a global processor does not affect the equivalent flattened field names.
{% endhint %}

The following is an example pipeline for Elastic Logstash:

```
input {
  http {
    host => "0.0.0.0"
    port => 8888
    ecs_compatibility => "disabled"
  }
}

filter {
  mutate {
    remove_field => ["host", "event", "headers"]
  }
}
```

## EF\_OUTPUT\_GENERIC\_HTTP\_ENABLE

Specifies whether the Generic HTTP output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_GENERIC\_HTTP\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_GENERIC\_HTTP\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to the HTTP Endpoint.

* Default
  * `2000`

## EF\_OUTPUT\_GENERIC\_HTTP\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to the HTTP Endpoint.

* Default
  * `8388608`

## EF\_OUTPUT\_GENERIC\_HTTP\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option. For this reason the default value is `collect` as it best handles a variety of scenarios.

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`

## EF\_OUTPUT\_GENERIC\_HTTP\_ADDRESSES

This setting specifies the HTTP servers to which the output should connect. It is a comma-separated list of HTTP servers, including port number.

{% hint style="danger" %}
Do **NOT** include `http://` or `https://` in the provided value. TLS communications is enabled/disabled using `EF_OUTPUT_GENERIC_HTTP_TLS_ENABLE`.
{% endhint %}

* Default
  * `127.0.0.1:8888`

## EF\_OUTPUT\_GENERIC\_HTTP\_USERNAME

The username to use when connecting to the HTTP endpoint.

* Default
  * \`\`

## EF\_OUTPUT\_GENERIC\_HTTP\_PASSWORD

The password to use when connecting to the HTTP endpoint.

* Default
  * \`\`

## EF\_OUTPUT\_GENERIC\_HTTP\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to the HTTP server.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_GENERIC\_HTTP\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the HTTP server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_GENERIC\_HTTP\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the HTTP server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_GENERIC\_HTTP\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_GENERIC\_HTTP\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. If left empty, all types will be allowed by default.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Monitor

## EF\_OUTPUT\_MONITOR\_ENABLE

The monitor output generates a log message containing the rate of records received and decoded by the collector over the past interval specified in `EF_OUTPUT_MONITOR_INTERVAL`. This can be useful for sizing or troubleshooting. This setting specifies whether the monitor output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_MONITOR\_INTERVAL

Specifies the interval, in seconds, after which the rate of records will be calculated and logged.

* Default
  * `300` (5 minutes)


# OTEL


# Trace

The OTEL output enables the collector to export trace data to OpenTelemetry-compliant backends.

### Protocol Support

The OTLP output can operate in two modes:

* **gRPC** - Uses the OTLP/gRPC protocol (recommended for production). Provides efficient binary communication with built-in features like streaming, load balancing, and multiplexing.
* **HTTP** - Uses the OTLP/HTTP protocol with RESTful endpoints. Supports Protocol Buffers format for compatibility with various backend systems.

{% hint style="info" %}
**Namespace Support**\
The OTLP output supports multiple isolated namespaces, allowing you to run separate instances of the output with different configurations. To create additional namespaces, use the pattern `EF_OUTPUT_OTLP_<NAMESPACE>_` where `<NAMESPACE>` is your namespace identifier (e.g., `EF_OUTPUT_OTLP_INTERNAL_`, `EF_OUTPUT_OTLP_PARTNER_`).
{% endhint %}

* [Server Configuration](#server-configuration)
* [gRPC Health Check Server](#grpc-health-check-server)[gRPC Health Check Server](#grpc-health-check-server)
* [Config Examples](#configuration-examples)

Determines how many dedicated workers are processing the output data

*Default*: 3

### EF\_OUTPUT\_OTLP\_TRACE\_BUFFER

Determines the channels buffer size

*Default*: `128`

### EF\_OUTPUT\_OTLP\_TRACE\_ALLOWED\_RECORD\_TYPES

Determines which record types are allowed to be exported&#x20;

*Default*: `trace,flow`

## Server Configuration

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_ENABLE

Enable or disable the OTLP trace output.

*Valid Values*: `true`, `false`

*Default*: `false`

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_TYPE

Specifies the protocol type for exporting traces.

*Valid Values*: `grpc`, `http`

*Default*: `grpc`

**Details:**

* When set to `grpc`, traces are exported using the OTLP/gRPC protocol on port 4317 (default)
* When set to `http`, traces are exported to the HTTP endpoint (default: `/v1/traces`) on port 4318 (default)

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_ADDR\_HOST

The hostname or IP address of the OTLP backend server to send traces to.

*Default*: `0.0.0.0`

**Examples:**

* `localhost` - Local backend
* `otlp-collector.example.com` - Remote backend
* `10.0.1.50` - IP address

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_ADDR\_PORT

The port number of the OTLP backend server.

*Default*: `4317`

Standard Port&#x73;**:**

* `4317` - Standard OTLP/gRPC port
* `4318` - Standard OTLP/HTTP port

### EF\_OUTPUT\_OTLP\_TRACE\_WORKERS

Specifies the number of concurrent worker goroutines to handle trace export operations. Increasing the number of workers allows the output to handle higher throughput when sending traces to the backend.

*Default*: `3`

### EF\_OUTPUT\_OTLP\_TRACE\_BUFFER\_SIZE

The size of the internal channel buffer that holds trace records before they are sent to the backend. A larger buffer can help handle traffic bursts but will consume more memory.

*Default*: `128`

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_BATCH\_TIMEOUT

The maximum duration to wait before sending a batch of traces to the backend. This helps optimize throughput by grouping multiple traces together.

*Default*: `5s`

*Valid Values*: Any valid Go duration string (e.g., `1s`, `500ms`, `10s`) or any integer value which will be interpreted as milliseconds (e.g., `5000` = 5 seconds)

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_COMPRESSOR

Specifies the compression algorithm to use when sending traces to the backend.&#x20;

*Valid Values*: `none`, `gzip`

*Default*: `none`

{% hint style="info" %}
Compression is only availble when using the `EF_OUTPUT_OTLP_TRACE_SERVER_TYPE` = `grpc`
{% endhint %}

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_HTTP\_ENDPOINT

The HTTP endpoint path for sending traces when using HTTP protocol.

*Default*: `/v1/traces`

{% hint style="info" %}
Only applicable when `EF_OUTPUT_OTLP_TRACE_SERVER_TYPE=http`&#x20;
{% endhint %}

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_TLS\_ENABLE

Enable or disable TLS encryption for the connection to the OTLP backend.

*Valid Values*: `true`, `false`

*Default*: `false`

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_TLS\_CERT\_FILE

The path to the TLS certificate file for client authentication.

{% hint style="info" %}
Required when the backend requires mutual TLS (mTLS) authentication.
{% endhint %}

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_FAILURE\_INIT\_INTERVAL

The initial wait time before the first retry attempt after a failed export.

*Valid Values*: Any valid Go duration string (e.g., `500ms`, `2s`, `5s`) or any integer value which will be interpreted as milliseconds (e.g., `1000` = 1 second)

*Default*: `1s`

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_FAILURE\_MAX\_RETRY\_INTERVAL

The maximum wait time between retry attempts. The retry interval increases exponentially up to this maximum.

*Valid Values*: Any valid Go duration string (e.g., `500ms`, `2s`, `5s`) or any integer value which will be interpreted as milliseconds (e.g., `1000` = 1 second)

Default: `5s`

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_FAILURE\_MAX\_ELAPSED\_TIME

The maximum total time to spend retrying failed exports before giving up.

*Valid Values*: Any valid Go duration string (e.g., `500ms`, `2s`, `5s`) or any integer value which will be interpreted as milliseconds (e.g., `1000` = 1 second)

*Default*: `1h`

### EF\_OUTPUT\_OTLP\_TRACE\_SERVER\_HEADERS

Custom HTTP headers to include with each trace export request. This is useful for authentication tokens, API keys, or other metadata required by the backend.

Format: comma delimited list of key value pairs

**Example**:

```bash
EF_OUTPUT_OTLP_TRACE_SERVER_HEADERS='x-greptime-pipeline-name=greptime_trace_v1'
```

### gRPC Health Check Server

A separate health check server is provided for Kubernetes liveness and readiness probes. The health check server implements the gRPC Health Checking Protocol (`grpc.health.v1.Health`).

### EF\_OUTPUT\_OTLP\_HEALTH\_SERVER\_ADDR\_HOST

The IP address to bind the health check server to.

*Default*: `0.0.0.0`

### EF\_OUTPUT\_OTLP\_HEALTH\_SERVER\_ADDR\_PORT

The port number for the health check server to listen on.

*Default*: `9412`

### EF\_OUTPUT\_OTLP\_HEALTH\_SERVER\_TLS\_ENABLE

Enable or disable TLS encryption for the health check server.

*Valid Values*: `true`, `false`

*Default*: `false`

### EF\_OUTPUT\_OTLP\_HEALTH\_SERVER\_TLS\_CERT\_FILE

The path to the TLS certificate file for the health check server.

### EF\_OUTPUT\_OTLP\_HEALTH\_SERVER\_TLS\_KEY\_FILE

The path to the TLS private key file for the health check server.

### EF\_OUTPUT\_OTLP\_HEALTH\_SERVER\_TLS\_VERIFICATION\_TYPE

The client certificate verification mode for the health check server.

*Valid Values:*

* `NoClientCert` (or `0`) - No client certificate required
* `RequestClientCert` (or `1`) - Request client certificate but don't verify
* `RequireAnyClientCert` (or `2`) - Require client certificate but don't verify CA
* `VerifyClientCertIfGiven` (or `3`) - Verify client certificate if provided
* `RequireAndVerifyClientCert` (or `4`) - Require and verify client certificate

*Default*: `NoClientCert`

## Configuration Examples

### Basic gRPC Configuration

Export traces to a local OTLP collector using gRPC:

```yaml
EF_OUTPUT_OTLP_TRACE_SERVER_ENABLE: true
EF_OUTPUT_OTLP_TRACE_SERVER_TYPE: grpc
EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_HOST: localhost
EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_PORT: 4317
EF_OUTPUT_OTLP_TRACE_WORKERS: 3
EF_OUTPUT_OTLP_TRACE_BUFFER_SIZE: 128
```

### gRPC with TLS and Custom Headers

Secure configuration with TLS encryption and API key authentication:

```yaml
EF_OUTPUT_OTLP_TRACE_SERVER_ENABLE: true
EF_OUTPUT_OTLP_TRACE_SERVER_TYPE: grpc
EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_HOST: otlp.example.com
EF_OUTPUT_OTLP_TRACE_SERVER_ADDR_PORT: 4317
EF_OUTPUT_OTLP_TRACE_WORKERS: 5
EF_OUTPUT_OTLP_TRACE_BUFFER_SIZE: 256
EF_OUTPUT_OTLP_TRACE_SERVER_BATCH_TIMEOUT: 10s
EF_OUTPUT_OTLP_TRACE_SERVER_COMPRESSOR: gzip

# TLS Configuration
EF_OUTPUT_OTLP_TRACE_SERVER_TLS_ENABLE: true
EF_OUTPUT_OTLP_TRACE_SERVER_TLS_CERT_FILE: /etc/certs/client.crt
EF_OUTPUT_OTLP_TRACE_SERVER_TLS_KEY_FILE: /etc/certs/client.key

# Custom Headers for Authentication
EF_OUTPUT_OTLP_TRACE_SERVER_HEADERS: '[{"key":"X-API-Key","value":"your-secret-api-key"}]'

# Health Check Server
EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_HOST: 0.0.0.0
EF_OUTPUT_OTLP_HEALTH_SERVER_ADDR_PORT: 9412
```


# Splunk

{% hint style="info" %}
The Splunk output is currently a *technology preview*. The design and implementation are less mature than stable features and subject to change.
{% endhint %}

The Splunk HEC output can be used to send records to [Splunk Enterprise](https://www.splunk.com/en_us/software/splunk-enterprise.html) or [Splunk Cloud Platform](https://www.splunk.com/en_us/software/splunk-cloud-platform.html) via the [HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector).

## EF\_OUTPUT\_SPLUNK\_HEC\_ENABLE

Specifies whether the Splunk output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_SPLUNK\_HEC\_CIM\_ENABLE

Specifies whether the data will be sent using the Splunk Common Information Model (CIM).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_SPLUNK\_HEC\_ADDRESSES

This setting specifies the Splunk servers to which the output should connect. It is a comma-separated list of Splunk nodes, including port number.

{% hint style="danger" %}
Do **NOT** include `http://` or `https://` in the provided value. TLS communications is enabled/disabled using `EF_OUTPUT_SPLUNK_HEC_TLS_ENABLE`.
{% endhint %}

* Default
  * `127.0.0.1:8088`

## EF\_OUTPUT\_SPLUNK\_HEC\_TOKEN

The HTTP Event Collector token to use when sending records to Splunk.

* Default
  * `''`

## EF\_OUTPUT\_SPLUNK\_HEC\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to Splunk.

* Default
  * `2000`

## EF\_OUTPUT\_SPLUNK\_HEC\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to Splunk.

* Default
  * `8388608`

## EF\_OUTPUT\_SPLUNK\_HEC\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Splunk.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_SPLUNK\_HEC\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Splunk server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_SPLUNK\_HEC\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the Splunk server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_SPLUNK\_HEC\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_SPLUNK\_HEC\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. If left empty, all types will be allowed by default.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Standard Out

The stdout output is used to output JSON-formatted records to stdout. It is useful for during initial installation and while troubleshooting issues to see the output of the collector directly in the terminal or logs.

{% hint style="info" %}
At anything more than a few flow records per second, the data will scroll too fast to be useful. For this reason the `stdout` output should be used primarily for manual testing.
{% endhint %}

## EF\_OUTPUT\_STDOUT\_ENABLE

Specifies whether the `stdout` output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_STDOUT\_FORMAT

* Valid Values
  * `json` - Output as a single JSON-formatted record per line.
  * `json_pretty` - Output each record as a "pretty" formatted JSON document.
* Default
  * `json_pretty`

## EF\_OUTPUT\_STDOUT\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. If left empty, all types will be allowed by default.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# General Configuration

ElastiFlow now supports YAML configuration files for all binaries, with a default file location of `/etc/elastiflow/<binary_name>.yml`. These YAML files are compatible with all existing ElastiFlow settings.

Although environment variables are still available for configuring the collector, the systemd attributes file may be removed in future releases.

To use a YAML file for configuration, either place it in the default location or specify a custom location with the `--config` or `-c` flag when running the binary:

```bash
./flowcoll --config=/etc/elastiflow/flowcoll.yml
```

or

```bash
./flowcoll -c=/etc/elastiflow/flowcoll.yml
```

### Implementing YAML Configuration

This example demonstrates configuring logging settings for the ElastiFlow flow-collector binary using a `flowcoll.yml` file:

1. Create a new file called `flowcoll.yml` with the following content.

   ```yaml
   EF_LOGGER_LEVEL: 'info'
   EF_LOGGER_ENCODING: 'json'
   EF_LOGGER_FILE_LOG_ENABLE: true
   EF_LOGGER_FILE_LOG_FILENAME: '/var/log/elastiflow/flowcoll/flowcoll.log'
   EF_LOGGER_FILE_LOG_MAX_SIZE: 100
   EF_LOGGER_FILE_LOG_MAX_AGE: 7
   EF_LOGGER_FILE_LOG_MAX_BACKUPS: 4
   EF_LOGGER_FILE_LOG_COMPRESS: false
   ```
2. Customize the settings as needed and create additional YAML files for other ElastiFlow binaries if required.
3. Run the flowcoll binary with the `--config` flag, specifying the path to your `flowcoll.yml` file:

   ```bash
   ./flowcoll --config=/path/to/flowcoll.yml
   ```


# Licensing

### Licensing Options

NetObserv Flow is available in three license tiers. The license tier determined a number of collector attributes, including the volume of flow records the collector can process (flow records per second), as well as which information elements (IEs) are supported.

| Features                                                     | Community |  Basic | Premium |
| ------------------------------------------------------------ | :-------: | :----: | :-----: |
| IE                                                           |  limited  | single |  multi  |
| [IPFIX](/flowcoll/supported_ie/supported_ie_ipfix)           |     83    |   450  |   4835  |
| [Netflow](/flowcoll/supported_ie/supported_ie_netflow)       |    152    |   519  |   1613  |
| [sFlow](/flowcoll/supported_ie/supported_ie_sflow)           |    187    |   206  |   939   |
| [AWS VPC Flow Logs](/flowcoll/supported_ie/supported_ie_aws) |     37    |   37   |    37   |
| [Azure Flow Logs](/flowcoll/supported_ie/supported_ie_azure) |     24    |   24   |    24   |

{% hint style="info" %}
The Community license is limited to 500 flow records/second.
{% endhint %}

{% hint style="info" %}
The flow records per second limit for the Community and Basic license applies to the person or entity accepting the license. It does \_\*\*not\*\*\_ allow for running multiple instances.
{% endhint %}

{% hint style="info" %}
The flow records per second available with a Standard or Premium license is determined by the license key. This volume may be split between multiple instances of the collector, as long as the total volume does not exceed the flow records per second allowed by the license.
{% endhint %}

By default the flow records per second will be set based on the provided license key. However, this volume can be configured manually for each instance. This is usually done when it is desired to use multiple instances of the collector. For example, a subscription for 16,000 flow records per second can be split into 2 instances, of 8,000 flow records per second each, by setting `EF_LICENSE_FLOW_RECORDS_PER_SECOND: 8000` for each instance. If set to a value greater than allowed by the license key, the instances will be started with the flow records per second from the license key.

#### Requesting a License

You can request a [Basic License](https://www.elastiflow.com/basic-license) via the [ElastiFlow website](https://www.elastiflow.com/basic-license). This license will be good for one year, after which it can be renewed by requesting a new license. The Basic License only supports polling of Standard MIBS (IEEE and IETF).

You can also request a [30-day Premium Trial License](https://www.elastiflow.com/trial) via the [ElastiFlow website](https://www.elastiflow.com/trial). This license can only be renewed with approval of ElastiFlow. To request an extension, please send an email to <sales@elastiflow.com>.

The license key for ElastiFlow Premium Tier customers will be made available through our support system. A ticket will be opened, from which an authorized user can download the license key.

#### Adding a License

The following is an example of a license configuration, as defined in a docker-compose file:

```yaml
EF_LICENSE_ACCEPTED: 'true'
EF_ACCOUNT_ID: '606abcdefe3546eee123456a'

EF_LICENSE_KEY: 'eyJhbGciOiJIUzI1HghIEjTUI6IkpXVCJ9.eyJhdWQiOiJKNHHFYTFKNJKHgkjKjknhLjKJkhyiiutUYfyrdIutKjsYXN0aWZsb3ciLCJzdWIiOiI2MDNkODUwMDMzZDg2YjA3OTE5YjE5Y2EiLCJjb3IiOjEyOCwibHZsIjo5fQ.FQtYWSWutfjn9q6876GHgf5fghir45vsuDnxrDldbd7xR8'
```

and as defined in the systemd configuration:

```conf
export EF_LICENSE_ACCEPTED=true
export EF_ACCOUNT_ID=606abcdefe3546eee123456a

export EF_LICENSE_KEY=eyJhbGciOiJIUzI1HghIEjTUI6IkpXVCJ9.eyJhdWQiOiJKNHHFYTFKNJKHgkjKjknhLjKJkhyiiutUYfyrdIutKjsYXN0aWZsb3ciLCJzdWIiOiI2MDNkODUwMDMzZDg2YjA3OTE5YjE5Y2EiLCJjb3IiOjEyOCwibHZsIjo5fQ.FQtYWSWutfjn9q6876GHgf5fghir45vsuDnxrDldbd7xR8
```

### Licensing Configuration

#### EF\_LICENSE\_ACCEPTED

To use ElastiFlow NetObserv it is necessary to accept the terms of the License Agreement. By running this software, you and/or the organization using the software agree and are bound to the terms of an ElastiFlow Inc. End-User License Agreement (EULA). For the Community (no license key), Basic and Trial tiers, the applicable license is the ElastiFlow Community EULA, which may be found at: <https://www.elastiflow.com/community-license>. For Standard and Premium Commercial tiers the applicable license is the ElastiFlow Standard EULA, or other terms agreed in writing with ElastiFlow Inc. The ElastiFlow Standard EULA may be found at: <https://www.elastiflow.com/commercial-license>.

* Default
  * `false`

#### EF\_ACCOUNT\_ID

License keys are generated per account. This field must contain the Account ID for the License Key specified in `EF_LICENSE_KEY`.

#### EF\_LICENSE\_KEY

This field contains the License Key issued for this instance of collector. EF\_ACCOUNT\_ID must also contain the Account ID to which this key belongs.

#### EF\_LICENSE\_FLOW\_RECORDS\_PER\_SECOND

NetObserv Flow is licensed by flow records per second. A Community license (no license key provided) is limited to 500 flow records per second. By default, the maximum flow records per second will be set based on the provided license key. However, this maximum can be configured manually for a given instance. This is usually done when it is desired to use multiple instances of the collector. For example, a subscription for 16,000 licensed flow records per second can be split into 2 instances, of 8,000 flow records per second each, by setting `EF_LICENSE_FLOW_RECORDS_PER_SECOND: 8000` for each instance. If set to a value greater than allowed by the license key, the instances will be started with the flow records per second based on the license key.

* Default
  * `0` (uses the flow records per second based on the license)


# Logging

By default NetObserv can be configured to log to stdout or to a file. It can also be configured to log with `json` or `console` formatting. If logging to a file, log rotation can be configured to manage the volume of logs.

#### EF\_LOGGER\_LEVEL

Specifies the output level for logging.

* Valid Values
  * `debug`, `info`, `warn`, `error`, `panic`, `fatal`
* Default
  * `info`

#### EF\_LOGGER\_ENCODING

Specifies the output format of the produced logs.

* Valid Values
  * `console`, `json`
* Default
  * `json`

#### EF\_LOGGER\_FILE\_LOG\_ENABLE

Set to `true` to enable writing logs to a file.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_LOGGER\_FILE\_LOG\_FILENAME

If file logging is enabled (`EF_LOGGER_FILE_LOG_ENABLE` is `true`) this option specifies the path to the file where the logs will be written.

* Default
  * NetObserv Flow: `/var/log/elastiflow/flowcoll/flowcoll.log`
  * NetObserv SNMP: `/var/log/elastiflow/snmpcoll/snmpcoll.log`

#### EF\_LOGGER\_FILE\_LOG\_MAX\_SIZE

This option specifies the maximum size in megabytes of the log file before it is rotated. The default is `100` megabytes.

* Valid Values
  * Any integer greater than `1`.
* Min Value
  * `1`
* Default
  * `100`

#### EF\_LOGGER\_FILE\_LOG\_MAX\_AGE

This option specifies the maximum number of days to retain old log files based on the timestamp encoded in their filename. Note that a day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc. The default is not to remove old log files based on age.

* Valid Values
  * Any integer greater than or equal to `0`.
* Default
  * `''`

#### EF\_LOGGER\_FILE\_LOG\_MAX\_BACKUPS

This option specifies the maximum number of old log files to retain. The default is to retain 4 old log files.

{% hint style="info" %}
Log files may be removed due to there age, as configured by `EF_LOGGER_FILE_LOG_MAX_AGE`, even if the maximum number of backups isn't reached.
{% endhint %}

* Valid Values
  * Any integer greater than or equal to `0`.
* Default
  * `4`

#### EF\_LOGGER\_FILE\_LOG\_COMPRESS

Set to `true` to enable compression of log files.

* Valid Values
  * `true`, `false`
* Default
  * `false`


# Persistent storage

#### EF\_FLOW\_DATA\_PATH

This field contains the path where NetObserv Flow will store data files that need to be persisted between runs.

* Default
  * `/var/lib/elastiflow/flowcoll`


# API Reference Overview

#### EF\_INSTANCE\_NAME <a href="#ef_instance_name" id="ef_instance_name"></a>

Configure the name of the collector instance.

* Default
  * `default`

#### EF\_API\_IP <a href="#ef_api_ip" id="ef_api_ip"></a>

The IP address on which the collector will listen for API requests.

* Default
  * `0.0.0.0`

#### EF\_API\_PORT <a href="#ef_api_port" id="ef_api_port"></a>

The port on which the collector will listen for API requests.

* Default
  * `8080`

#### EF\_API\_TLS\_ENABLE <a href="#ef_api_tls_enable" id="ef_api_tls_enable"></a>

This setting is used to enable/disable TLS connections to the API endpoint.

* Valid Values
  * `true`, `false`
* Default
  * `false`&#x20;

#### EF\_API\_TLS\_CERT\_FILEPATH <a href="#ef_api_tls_cert_filepath" id="ef_api_tls_cert_filepath"></a>

The path to the certificate to use for TLS connections to the API endpoint.

* Default
  * `''`

#### EF\_API\_TLS\_KEY\_FILEPATH <a href="#ef_api_tls_key_filepath" id="ef_api_tls_key_filepath"></a>

The path to the key to use for TLS connections to the API endpoint.

* Default
  * `''`

#### EF\_API\_BASIC\_AUTH\_ENABLE <a href="#ef_api_basic_auth_enable" id="ef_api_basic_auth_enable"></a>

This setting is used to enable/disable basic authentication protection of API endpoints.

* Default
  * `false`

#### EF\_API\_BASIC\_AUTH\_USERNAME <a href="#ef_api_basic_auth_username" id="ef_api_basic_auth_username"></a>

The username to use when connecting to basic authentication protection of API endpoints.

* Default
  * `''`

#### EF\_API\_BASIC\_AUTH\_PASSWORD <a href="#ef_api_basic_auth_password" id="ef_api_basic_auth_password"></a>

The password to use when connecting to basic authentication protection of API endpoints.

* Default
  * `''`


# Metrics

NetObserv Flow exposes the `/metrics` endpoint to provide Prometheus-compatible statistics related to its performance and the resources it uses.

The endpoint returns data in a Prometheus text-based exposition format. Please refer to the [Prometheus documentation](https://prometheus.io/docs/introduction/overview) to learn more.

### Information

This section describes the information metrics that can be retrieved from the `/metrics` endpoint.

#### app\_info

`app_info` provides application details. The following is an example of an `app_info` record:

```shell
app_info{arch="arm64",cpus="8",env="native",hostname="M1-MacBook-Pro.local",os="darwin",run_id="b1214e11-198f-43e7-81f1-c9986e9b3ff7",version="7.5"} 1
```

The `app_info` data provides the following labels:

| Label      | Description                          |
| ---------- | ------------------------------------ |
| `arch`     | environment running application      |
| `cpus`     | number of cpus available             |
| `env`      | native install or Docker             |
| `hostname` | name of machine                      |
| `os`       | operating system running application |
| `run_id`   | run id of application                |
| `version`  | version of the collector             |

#### license\_info

`license_info` provides license details. The following is an example of a `license_info` record:

```shell
license_info{account_id="account_id",application="flowcoll",expiration="1772150400",instance_name="default",level="7"} 1
```

The `license_info` record provides the following labels:

| Label           | Description                         |
| --------------- | ----------------------------------- |
| `account_id`    | account id of license               |
| `application`   | name of the application             |
| `expiration`    | license expiration date (unix time) |
| `instance_name` | name of the collector instance      |
| `level`         | license level                       |

#### license\_flow\_records\_per\_second

`license_flow_records_per_second` provides the maximum flow records per second that the collector is provisioned for according to the license and configurations. The following is an example of a `license_flow_records_per_second` record:

```shell
license_flow_records_per_second{application="snmpcoll",instance_name="default"} 4000
```

The `license_flow_records_per_second` record provides the following labels:

| Label           | Description                    |
| --------------- | ------------------------------ |
| `application`   | name of the application        |
| `instance_name` | name of the collector instance |

### Flow UDP Server

The following statistics are provided for the UDP Server input.

#### udp\_server\_packet\_queue\_util

`udp_server_packet_queue_util` provides the utilization of the packet queue, which stores received packets waiting to be processed.

```shell
udp_server_packet_queue_util{application="flowcoll"} 0
```

The `udp_server_packet_queue_util` record provides the following labels:

| Label         | Description             |
| ------------- | ----------------------- |
| `application` | name of the application |

#### udp\_server\_packets\_received\_total

`udp_server_packets_received_total` provides the total count of packets received by the UDP Server.

```shell
udp_server_packets_received_total{application="flowcoll",port="9995"} 0
```

The `udp_server_packets_received_total` record provides the following labels:

| Label         | Description                          |
| ------------- | ------------------------------------ |
| `application` | name of the application              |
| `port`        | port on which the UDP server listens |

#### udp\_server\_bytes\_received\_total

`udp_server_bytes_received_total` provides the total count of bytes received by the UDP Server.

```shell
udp_server_bytes_received_total{application="flowcoll",port="9995"} 0
```

The `udp_server_bytes_received_total` record provides the following labels:

| Label         | Description                          |
| ------------- | ------------------------------------ |
| `application` | name of the application              |
| `port`        | port on which the UDP server listens |

### Processor

#### record\_queue\_util

Ratio of the record queue size divided by its capacity.

```shell
record_queue_util{application="flowcoll"} 0
```

The `record_queue_util` record provides the following labels:

| Label         | Description             |
| ------------- | ----------------------- |
| `application` | name of the application |


# Liveness & Readiness

NetObserv provides liveness and readiness endpoints for use when deploying within a Kubernetes environment.

### Liveness

The `/livez` endpoint is provided to determine the health status of the collector. This is commonly used to restart a container if the service becomes non-operational. The endpoint will return an HTTP status code of 200 and 500, when the collector is fully operational or when the collector is down and can not send data to the outputs respectively. Commonly used in the [Kubernetes Liveness probe](https://kubernetes.io/docs/concepts/configuration/liveness-readiness-startup-probes/#liveness-probe).

### Readiness

The `/readyz` endpoint indicates when the collector is ready to receive data, commonly used in the [Kubernetes Readiness probe](https://kubernetes.io/docs/concepts/configuration/liveness-readiness-startup-probes/#readiness-probe).


# Monitoring

The ElastiFlow API `/metrics` endpoint can be used to monitor system performance and resources using standard monitoring tools. Here is information on how to implement monitoring using [Prometheus and Grafana.](/flowcoll/overview/monitoring/prom_grafana)


# Prometheus & Grafana

### Prerequisites

1. [The ElastiFlow Unified Collector is running and the metrics endpoint is reachable. (Reachable @ http://0.0.0.0:8080/metrics)](#elastiflow-metrics-endpoint)
2. [Prometheus is installed & running and can reach the NetObserv Flow Metrics endpoint. (Prometheus default @ http://0.0.0.0:9090)](#prometheus-installation-guide)
3. [Grafana is installed & running and can reach Prometheus. (Grafana default @ http://0.0.0.0:3000)](#grafana-installation-guide)

### ElastiFlow Metrics Endpoint

* Verify the ElastiFlow Unified Collector & Metrics Endpoint have successfully started (logs in /var/log/elastiflow/flowcoll/flowcoll.log):

```conf
2022-10-21T08:31:23.078-0700  info  pipeline/appserver.go:44  metrics exposed at http://0.0.0.0:8080/metrics
```

{% hint style="info" %}
If another service is already using port `8080`, you can change the port on which the collector listens by setting [`EF_API_PORT`](https://github.com/elastiflow/documentation/blob/main/docs/config_ref/common/api/README.md#ef_api_port).
{% endhint %}

### Grafana Installation Guide

* OS specific Grafana installation guides: <https://grafana.com/docs/grafana/latest/setup-grafana/installation/>
* Debian/Ubuntu installation guide: <https://grafana.com/docs/grafana/latest/setup-grafana/installation/debian/>
* RPM-based installation guide: <https://grafana.com/docs/grafana/latest/setup-grafana/installation/rpm/>

### Prometheus Installation Guide

* Main Installation guides: <https://prometheus.io/docs/prometheus/latest/installation/>
* Precompiled binaries: <https://prometheus.io/download/>

#### Prometheus Configuration

1. Once Prometheus is installed edit `prometheus.yml` and add a job pointing to the ElastiFlow Unified Collector as in the following example:

Example default Prometheus configuration:

```yaml
# my global config
global:
  scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
  # scrape_timeout is set to the global default (10s).

# Alertmanager configuration
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          # - alertmanager:9093

# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
rule_files:
  # - "first_rules.yml"
  # - "second_rules.yml"

# A scrape configuration containing exactly one endpoint to scrape:
# Here it's Prometheus itself.
scrape_configs:
  # The job name is added as a label `job=<job_name>` to any time series scraped from this config.
  - job_name: "prometheus"

    # metrics_path defaults to '/metrics'
    # scheme defaults to 'http'.

    static_configs:
      - targets: ["localhost:9090"]
```

An ElastiFlow-specific Job:

```yaml
    job_name: elastiflow-metrics-1
    scrape_interval: 15s
    metrics_path: /metrics

    scheme: http
    static_configs:
      - targets: ['192.168.3.18:8080']
```

### Connect Grafana To Prometheus

1. Once Grafana is up and running; from the "Welcome To Grafana" page click the cogwheel in the bottom left corner, then click "Data Sources", and finally click "Add Data Source": ![image](https://user-images.githubusercontent.com/43585378/198896237-86b1b14e-7927-4e6e-a027-15d8b2773bc3.png)
2. Select Prometheus ![Image](https://user-images.githubusercontent.com/43585378/198896308-9705b414-d7f3-4536-86b9-0a6b7594bdf1.png)
3. Name this Prometheus Datasource, type your Prometheus endpoint IP address and port in the "URL" field, and configure the authentication and "scrape interval" you have set up:

&#x20;![Iamge](https://user-images.githubusercontent.com/43585378/198896472-60632d65-aed7-43d9-a69d-fcf14333776b.png)&#x20;

4. Click "Save & Test"

&#x20;![Image](https://user-images.githubusercontent.com/43585378/198896476-b428b194-387c-4128-9916-fca7a529ae10.png)

### Import The ElastiFlow Metrics Dashboard

The ElastiFlow Metrics Dashboard can be found by searching Grafana Labs Dashboards: <https://grafana.com/grafana/dashboards/>

Direct Link: <https://grafana.com/grafana/dashboards/17306-elastiflow-metrics/>

![Image](https://user-images.githubusercontent.com/43585378/198896571-e33b4167-1c31-4f1e-a71c-6049219abb1d.png) ![Image](https://user-images.githubusercontent.com/43585378/199298518-5c5dd192-c335-41c4-80b3-922eaa84eaa5.png)

1. Import the Dashboard by entering the dashboard ID (17306) found after searching ElastiFlow Metrics in the Grafana Labs Dashboards search by going to Dashboards -> Import and clicking "Load":

![Image](https://user-images.githubusercontent.com/43585378/198896760-1eb827c7-50ed-49f4-a550-be1a70e1cc01.png) ![Image](https://user-images.githubusercontent.com/43585378/198905376-bbec59ee-fbd9-4f83-8b44-0db108961eb9.png)&#x20;

2. Accept the default or give the dashboard a name and place it in the folder you'd like it to reside in. After this point to the Prometheus Datasource you previously connected above click "Import" and you are done.

![Image](https://user-images.githubusercontent.com/43585378/198905499-7e724ba8-b7ae-4b30-86de-a340ae6d94e3.png)


# Metadata Enrichment (Addresses) API

## Introduction to the API

NetObserv Flow and NetObserv SNMP provide an API for managing user-defined metadata (UDM) entries. See docs for this feature in [NetObserv Flow](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_udm) and [NetObserv SNMP](/snmpcoll/configuration/enrichment-options/enrich_ip_udm/enrich_ip_udm). The API allows for creating, reading, updating, and deleting user-defined metadata entries (UDM entries).

The API documented here can be accessed via REST, gRPC, or connectrpc.

### Configuring the API <a href="#configuring-the-api" id="configuring-the-api"></a>

To enable this API, set the following configuration values:

* `EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE: true`
* `EF_PROCESSOR_ENRICH_IPADDR_METADATA_API_ENABLE: true`
* `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH: /etc/elastiflow/metadata/ipaddrs.yml`
  * this setting can be configured to any location. The only requirement is that it is set to something.

See additional configuration documentation for [NetObserv Flow](/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_udm/enrich_ip_udm) or NetObserv SNMP

### API Common Configuration <a href="#api-common-configuration" id="api-common-configuration"></a>

This API adheres to the same common config that our other APIs use. This includes:

* optionally configuring basic auth to be required
* optionally configuring TLS
* optionally configuring a different port

See [API Reference Overview](/flowcoll/overview) for more details of what you can configure.

## API Context <a href="#api-context" id="api-context"></a>

### API Replaces YAML File Usage <a href="#api-replaces-yaml-file-usage" id="api-replaces-yaml-file-usage"></a>

Using this API will replace manually updating the UDM YAML file.

When you use this API, it will update the YAML file to represent latest state. In exchange, the product will not notice any updates to the YAML file, nor will it re-read that file.

Using any of the create or update calls (e.g. `CreateUdm`) will delete all comments in the YAML file, and probably change the order of stanzas in the file. The resulting file will be just the data in the file, not the comments or other formatting. So if you plan to make updates via the API, make sure there's no important information in the comments.

### API Concurrency and Error Response <a href="#api-concurrency-and-error-response" id="api-concurrency-and-error-response"></a>

All RPCs are safe to call concurrently. The "read" RPCs will not block normal functioning of the collector, but the "write" RPCs will (very briefly), while the database is being updated and saved to disk.

Write operations are atomic and include updating the YAML file. If a write operation fails for any reason (returns an error), then neither the internal database nor the external YAML file were updated.

Keys are given as strings and parsed as IP addresses, CIDRs (IP prefixes), or IP ranges (a "from" IP and a "to" IP). In the API, if any key cannot be parsed, the operation will abort and return an error listing the problematic key.

### Warning about Caching <a href="#warning-about-caching" id="warning-about-caching"></a>

NetObserv will cache any UDM entries in memory. Even if you make modifications via this API, it will not take immediatetly take effect because of caching. The default length for this cache is two hours.

## API Methods <a href="#api-methods" id="api-methods"></a>

### CountUdms `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/CountUdms` <a href="#countudms-post-apiv1enrichipaddrudmv1udmservicecountudms" id="countudms-post-apiv1enrichipaddrudmv1udmservicecountudms"></a>

Return the number of items in the DB.

<details>

<summary>The below examples assume you start with this set of UDM entries:</summary>

```
# Example ipaddrs.yml file
192.0.2.0/24:
  internal: true
192.0.2.192/26:
  name: atlanta_guest_wifi
  vlan: 1001
  tags:
    - wifi
    - dhcp
  metadata:
    dhcp.pool.name: atlanta_guest_wifi
    .site.id: atlanta
192.0.2.194-192.0.2.198:
  metadata:
    .site.bldg.id: hq
    .site.floor.id: 2
    .site.rack.id: 1
192.0.2.194:
  metadata:
    device.type.name: wifi_ap

```

</details>

**Example**

```
# using curl
curl --json "{}" http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/CountUdms

# using grpcurl
grpcurl -plaintext localhost:8080 udm.v1.UdmService/CountUdms
```

**Output**

```
{
  "count": 4
}
```

### ListUdms `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdms` <a href="#listudms-post-apiv1enrichipaddrudmv1udmservicelistudms" id="listudms-post-apiv1enrichipaddrudmv1udmservicelistudms"></a>

Return the records matching the given key. Non-string metadata values (e.g., numbers) are returned as strings.

**Detailed Logic**

If no key is given, it returns the entire DB.

If `exact` option is true, the key is matched exactly.

If `exact` option is false, all DB entries matching the requested key are returned, using the following rules:

* `key` is a key as listed in the `ipaddrs.yml` file

  If `key` is not specified, then `exact` is ignored and all Udms will be returned.
* If the key is:
  * An IP address
    * That IP will be returned if it exists.
    * Any CIDR that contains the given IP will be returned.
    * Any Range that contains the given IP will be returned.
  * A CIDR
    * Any IP within the given CIDR will be returned.
    * Any CIDR within the given CIDR will be returned.
    * Any Range within the given CIDR will be returned. That is, if the first and last IP in the range is in the given CIDR.
  * A Range
    * Any IP within the given Range will be returned.
    * Any CIDR within the given Range will be returned. That is, the first and last IP in the CIDR are in the given Range. E.g., the first and last IPs in 192.168.1.0/24 are 192.168.1.0 and 192.168.1.255.
    * Any Range within the given Range will be returned. That is, for a given range R1, a range R2 in the database will be returned if R1.From <= R2.From AND R2.To <= R1.To.

As mentioned above, `ListUdms` is safe to call concurrently; if you have multiple keys to query, you can safely call `ListUdms` concurrently for each key.

<details>

<summary>The below examples assume you start with this set of UDM entries:</summary>

```
# Example ipaddrs.yml file
192.0.2.0/24:
  internal: true
192.0.2.192/26:
  name: atlanta_guest_wifi
  vlan: 1001
  tags:
    - wifi
    - dhcp
  metadata:
    dhcp.pool.name: atlanta_guest_wifi
    .site.id: atlanta
192.0.2.194-192.0.2.198:
  metadata:
    .site.bldg.id: hq
    .site.floor.id: 2
    .site.rack.id: 1
192.0.2.194:
  metadata:
    device.type.name: wifi_ap

```

</details>

**Example: List all UDM Entries**

```
# using curl
curl --json "{}" http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdms

# using grpcurl
grpcurl -plaintext localhost:8080 udm.v1.UdmService/ListUdms
```

**Output**

```
{
  "udms": [
    {
      "key": "192.0.2.194-192.0.2.198",
      "metadata": {
        ".site.bldg.id": "hq",
        ".site.floor.id": "2",
        ".site.rack.id": "1"
      }
    },
    {
      "key": "192.0.2.194",
      "metadata": {
        "device.type.name": "wifi_ap"
      }
    },
    {
      "key": "192.0.2.0/24",
      "internal": true
    },
    {
      "key": "192.0.2.192/26",
      "name": "atlanta_guest_wifi",
      "tags": [
        "wifi",
        "dhcp"
      ],
      "vlan": "1001",
      "metadata": {
        ".site.id": "atlanta",
        "dhcp.pool.name": "atlanta_guest_wifi"
      }
    }
  ]
}
```

**Example: Search UDM Entries**

```
# using curl
curl --json '{"key":"192.0.2.200", "exact":false}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdms

# using grpcurl
grpcurl -plaintext -d '{"key":"192.0.2.200", "exact":false}' localhost:8080 udm.v1.UdmService/ListUdms
```

**Output**

```
{
  "udms": [
    {
      "key": "192.0.2.192/26",
      "name": "atlanta_guest_wifi",
      "tags": [
        "wifi",
        "dhcp"
      ],
      "vlan": "1001",
      "metadata": {
        ".site.id": "atlanta",
        "dhcp.pool.name": "atlanta_guest_wifi"
      }
    },
    {
      "key": "192.0.2.0/24",
      "internal": true
    }
  ]
}
```

### ListUdmKeys `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys` <a href="#listudmkeys-post-apiv1enrichipaddrudmv1udmservicelistudmkeys" id="listudmkeys-post-apiv1enrichipaddrudmv1udmservicelistudmkeys"></a>

Return keys matching the given key. This API is logically equivalent to calling `ListUdms` on the given key, and then returning only the keys of the returned Udms. If no key is given, returns all keys.

The rules for searching work the same as [ListUdm Method](http://localhost:3000/docs/api_ref/enrich_ip_udm_api#detailed-logic)

<details>

<summary>The below examples assume you start with this set of UDM entries:</summary>

```
# Example ipaddrs.yml file
192.0.2.0/24:
  internal: true
192.0.2.192/26:
  name: atlanta_guest_wifi
  vlan: 1001
  tags:
    - wifi
    - dhcp
  metadata:
    dhcp.pool.name: atlanta_guest_wifi
    .site.id: atlanta
192.0.2.194-192.0.2.198:
  metadata:
    .site.bldg.id: hq
    .site.floor.id: 2
    .site.rack.id: 1
192.0.2.194:
  metadata:
    device.type.name: wifi_ap

```

</details>

**List All Keys**

```
# using curl
curl --json '{}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys

# using grpcurl
grpcurl '{}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys
```

**Output**

```
{
  "keys": [
    "192.0.2.0/24",
    "192.0.2.192/26",
    "192.0.2.194-192.0.2.198",
    "192.0.2.194"
  ]
}
```

**List a specific key**

```
# using curl
curl --json '{"key":"192.0.2.194", "exact":true}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys

# using grpcurl
grpcurl -d '{"key":"192.0.2.194", "exact":true}' localhost:8080 udm.v1.UdmService/ListUdmKeys
```

**Output**

```
{
  "keys": [
    "192.0.2.194"
  ]
}
```

**List all keys matching a given key**

```
# using curl
curl --json '{"key":"192.0.2.200", "exact":false}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys

# using grpcurl
grpcurl -d '{"key":"192.0.2.200", "exact":false}' localhost:8080 udm.v1.UdmService/ListUdmKeys
```

**Output**

```
{
  "keys": [
    # Both of these CIDRs contain the given IP.
    "192.0.2.0/24",
    "192.0.2.192/26"
  ]
}
```

### CreateUdm `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/CreateUdm` <a href="#createudm-post-apiv1enrichipaddrudmv1udmservicecreateudm" id="createudm-post-apiv1enrichipaddrudmv1udmservicecreateudm"></a>

Create a new UDM entry. Return an error if the given key already exists.

```
# using curl
curl --json '{"udm": { "key": "192.0.3.0/24", "name": "my_udm", "vlan": 2, "tags":["tag1", "tag2"]}}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/CreateUdm

# using grpcurl
grpcurl -d '{"udm": { "key": "192.0.3.0/24", "name": "my_udm", "vlan": 2, "tags":["tag1", "tag2"]}}' localhost:8080 udm.v1.UdmService/CreateUdm
```

**Output**

```
{
  "key": "192.0.3.0/24",
  "name": "my_udm",
  "tags": [
    "tag1",
    "tag2"
  ],
  "vlan": "2"
}
```

### BatchCreateUdms `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/BatchCreateUdms` <a href="#batchcreateudms-post-apiv1enrichipaddrudmv1udmservicebatchcreateudms" id="batchcreateudms-post-apiv1enrichipaddrudmv1udmservicebatchcreateudms"></a>

Create the given set of Udms and return them. Return an error if any of the given Udms already exist.

Creates are atomic, and include saving the updates to the yml file.

```
# using curl
curl --json '{"requests":[ 
{"udm": { "key": "192.0.4.0/24", "name": "my_udm2", "vlan": 4, "tags":["tag3", "tag4"]}},
{"udm": { "key": "192.0.5.0/24", "name": "my_udm3", "vlan": 5, "tags":["tag5", "tag6"]}}
]}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/BatchCreateUdms

# using grpcurl
grpcurl -d '{"requests":[
{"udm": { "key": "192.0.4.0/24", "name": "my_udm2", "vlan": 4, "tags":["tag3", "tag4"]}},
{"udm": { "key": "192.0.5.0/24", "name": "my_udm3", "vlan": 5, "tags":["tag5", "tag6"]}}
]}' localhost:8080 udm.v1.UdmService/BatchCreateUdms
```

**Output**

```
{
  "udms": [
    {
      "key": "192.0.4.0/24",
      "name": "my_udm2",
      "tags": [
        "tag3",
        "tag4"
      ],
      "vlan": "4"
    },
    {
      "key": "192.0.5.0/24",
      "name": "my_udm3",
      "tags": [
        "tag5",
        "tag6"
      ],
      "vlan": "5"
    }
  ]
}
```

The status of the DB after running the above example commands:

```
curl --json '{}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys
{
  "keys": [
    "192.0.2.0/24",
    "192.0.2.192/26",
    "192.0.3.0/24",
    "192.0.4.0/24",
    "192.0.5.0/24",
    "192.0.2.194-192.0.2.198",
    "192.0.2.194"
  ]
}
```

### DeleteUdm `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/DeleteUdm` <a href="#deleteudm-post-apiv1enrichipaddrudmv1udmservicedeleteudm" id="deleteudm-post-apiv1enrichipaddrudmv1udmservicedeleteudm"></a>

Deletes the given Udm; the key must match exactly

Deletes are atomic and include updating the yml file.

**Example**

```
# using curl
curl --json '{"key": "192.0.3.0/24"}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/DeleteUdm

# using grpcurl
grpcurl -d '{"key": "192.0.3.0/24"}' localhost:8080 udm.v1.UdmService/DeleteUdm
```

**Output**

```
{}
```

Result

```
curl --json '{}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/ListUdmKeys
{
  "keys": [
    "192.0.2.0/24",
    "192.0.2.192/26",
    # note 192.0.3.0/24 is gone
    "192.0.4.0/24",
    "192.0.5.0/24",
    "192.0.2.194-192.0.2.198",
    "192.0.2.194"
  ]
}
```

### UpdateUdm `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/UpdateUdm` <a href="#updateudm-post-apiv1enrichipaddrudmv1udmserviceupdateudm" id="updateudm-post-apiv1enrichipaddrudmv1udmserviceupdateudm"></a>

Update the given Udm with the given data. The `UpdateMask` field inside the request specifies which fields to update. If the `UpdateMask` is empty, all fields are updated, including those that were not specified in the update call (which will be set to their "zero value"). (See the example below for more details.)

Return the updated Udm or an error if the given key does not exist.

**Example: Without an `update_mask`**

Assuming this starting content

```
{
  "udms": [
    {
      "key": "192.0.4.0/24",
      "name": "my_udm2",
      "tags": [
        "tag3",
        "tag4"
      ],
      "vlan": "4"
    }
  ]
}
```

```
# using curl
curl --json '{"udm":{"key": "192.0.4.0/24", "vlan": 5}}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/UpdateUdm

# using grpcurl
grpcurl '{"udm":{"key": "192.0.4.0/24", "vlan": 5}}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/UpdateUdm
```

**Output**

```
{
  "key": "192.0.4.0/24",
  "vlan": "5"
}
```

This command didn't give an `update_mask`, so all the fields not specified in the `udm` object were cleared.

**With an `update_mask`**

assuming

```
{
  "udms": [
    {
      "key": "192.0.5.0/24",
      "name": "my_udm3",
      "tags": [
        "tag5",
        "tag6"
      ],
      "vlan": "5"
    }
  ]
}
```

```
# Only update vlan and tags fields

# using curl
curl --json '{"udm":{"key": "192.0.5.0/24", "vlan": 6, "tags":["tag7"]}, "update_mask": "vlan,tags"}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/UpdateUdm

# using grpcurl
# Note the different format of the update_mask field for grpcurl
grpcurl -d '{"udm":{"key": "192.0.5.0/24", "vlan": 6, "tags":["tag7"]}, "update_mask": {"paths":["vlan","tags"]}}' localhost:8080 udm.v1.UdmService/UpdateUdm
```

**Output**

```
{
  "key": "192.0.5.0/24",
  "name": "my_udm3", // name not changed
  "tags": [          // all tags replaced
    "tag7"
  ],
  "vlan": "6"        // vlan updated
}
```

This command did give an `update_mask`, so only the `vlan` and `tags` fields were updated.

### BatchUpdateUdms `POST /api/v1/enrich/ipaddr/udm.v1.UdmService/BatchUpdateUdms` <a href="#batchupdateudms-post-apiv1enrichipaddrudmv1udmservicebatchupdateudms" id="batchupdateudms-post-apiv1enrichipaddrudmv1udmservicebatchupdateudms"></a>

Update the given Udms with the given data. The `UpdateMask` field inside the request specifies which fields to update. If `UpdateMask` is empty, all fields are updated, including those that were not specified in the update call (which will be set to their "zero value"). (See the example below for more details.)

Return the updated Udms or an error if any of the given keys do not exist.

Updates are atomic and include saving the updates to the yml file.

Implementation note: `BatchUpdateUdms` accepts a single `BatchUpdatUdmsRequest` struct containing a slice of `UpdateUdmRequest` structs, and a single `UpdateMask` field, which is used for the entire batch of updates. Each `UpdateUdmRequest` struct also has its own `UpdateMask`, which is ignored.

**Without an `update_mask`**

```
# using curl
curl --json '{"requests":[ {"udm": { "key": "192.0.2.0/24", "name": "new_name"}},
{"udm": { "key": "192.0.2.194", "name": "new_name2"}} ]}' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/BatchUpdateUdms

# using grpcurl
% grpcurl -d '{"requests":[ {"udm": { "key": "192.0.2.0/24", "name": "new_name"}},
{"udm": { "key": "192.0.2.194", "name": "new_name2"}} ]}' localhost:8080 udm.v1.UdmService/BatchUpdateUdms
```

**Output**

```
{
  "udms": [
    {
      "key": "192.0.2.0/24",
      "name": "new_name"
    },
    {
      "key": "192.0.2.194",
      "name": "new_name2"
    }
  ]
}
```

As above, since no `update_mask` was specified, all fields not mentioned were cleared.

**With an `update_mask`**

* Update only the `tags` and `metadata` fields.
* Even though `vlan` is listed in the first UDM entry, it is not updated.
* Even though `name` is listed in both UDMs, it is not updated.
* Only the top-level `update_mask` field is valid. Even though the first request says `"update_mask":"name"`, this is ignored.

```
### Update only the tags and metadata fields; inner "update_mask":"name" is ignored

# using curl
curl --json '{"requests":[
    {"udm": { "key": "192.0.2.0/24", "name": "not_changed", "vlan":2, "tags":["tag8"]}, "update_mask": "name"},
    {"udm": { "key": "192.0.2.194", "name": "also_not_changed", "metadata":{"key":"value"}}}
],
"update_mask": "tags,metadata" }' http://localhost:8080/api/v1/enrich/ipaddr/udm.v1.UdmService/BatchUpdateUdms

# using grpcurl
% grpcurl -d '{"requests":[
    {"udm": { "key": "192.0.2.0/24", "name": "not_changed", "vlan":2, "tags":["tag8"]}, "update_mask": {"paths":["name"]}},
    {"udm": { "key": "192.0.2.194", "name": "also_not_changed", "metadata":{"key":"value"}}}
],
"update_mask": {"paths": ["tags","metadata"]} }' localhost:8080 udm.v1.UdmService/BatchUpdateUdms
```

**Output**

```
{
  "udms": [
    {
      "key": "192.0.2.0/24",
      "name": "new_name",
      "tags": [
        "tag8"
      ]
    },
    {
      "key": "192.0.2.194",
      "name": "new_name2",
      "metadata": {
        "key": "value"
      }
    }
  ]
}
```

note

In a `BatchUpdateUdms` request, only the top-level `update_mask` field is used; the `update_mask` field in each request object is ignored.

## GRPC Interface Details <a href="#grpc-interface-details" id="grpc-interface-details"></a>

We expose all the exact same methods via gRPC in addition to HTTP/REST. The [gRPC protocol](https://grpc.io/) is a different protocol than HTTP/REST. You do not need to use the gRPC interface if you do not want to.

For those that are interested, below are some additional details regarding the gRPC interface to this API.

#### Inspecting the Schema With grpcurl <a href="#inspecting-the-schema-with-grpcurl" id="inspecting-the-schema-with-grpcurl"></a>

You can use `grpcurl` command to inspect and navigate the grpc schema.

```
% grpcurl -plaintext localhost:8080 list
udm.v1.UdmService

% grpcurl -plaintext localhost:8080 describe
udm.v1.UdmService is a service:
service UdmService {
  rpc BatchCreateUdms ( .udm.v1.BatchCreateUdmsRequest ) returns ( .udm.v1.BatchCreateUdmsResponse );
  rpc BatchUpdateUdms ( .udm.v1.BatchUpdateUdmsRequest ) returns ( .udm.v1.BatchUpdateUdmsResponse );
  rpc CountUdms ( .google.protobuf.Empty ) returns ( .udm.v1.CountUdmsResponse );
  rpc CreateUdm ( .udm.v1.CreateUdmRequest ) returns ( .udm.v1.Udm );
  rpc DeleteUdm ( .udm.v1.DeleteUdmRequest ) returns ( .google.protobuf.Empty );
  rpc ListUdmKeys ( .udm.v1.ListUdmKeysRequest ) returns ( .udm.v1.ListUdmKeysResponse );
  rpc ListUdms ( .udm.v1.ListUdmsRequest ) returns ( .udm.v1.ListUdmsResponse );
  rpc UpdateUdm ( .udm.v1.UpdateUdmRequest ) returns ( .udm.v1.Udm );
}

% grpcurl -plaintext localhost:8080 describe .udm.v1.BatchCreateUdmsRequest
udm.v1.BatchCreateUdmsRequest is a message:
message BatchCreateUdmsRequest {
  repeated .udm.v1.CreateUdmRequest requests = 1;
}

% grpcurl -plaintext localhost:8080 describe .udm.v1.CreateUdmRequest
udm.v1.CreateUdmRequest is a message:
message CreateUdmRequest {
  .udm.v1.Udm udm = 1;
}

% grpcurl -plaintext localhost:8080 describe .udm.v1.Udm
udm.v1.Udm is a message:
message Udm {
  string key = 1;
  string name = 2;
  repeated string tags = 3;
  uint64 vlan = 4;
  bool internal = 5;
  map<string, string> metadata = 6;
}
```

See the [grpcurl documentation](https://github.com/fullstorydev/grpcurl) for more details on using the gRPC reflection API.

#### Proto file <a href="#proto-file" id="proto-file"></a>

```
syntax = "proto3";

package udm.v1;

import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";

// Udm represents an IP enrichment entry.
message Udm {
  string key = 1; // The key field will be populated from the yaml key when returning Udms.
  string name = 2;
  repeated string tags = 3;
  uint64 vlan = 4;
  bool internal = 5;
  map<string, string> metadata = 6;
}

// CreateUdmRequest is the request for the CreateUdm RPC.
message CreateUdmRequest {
  Udm udm = 1;
}

// BatchCreateUdmsRequest is the request for the BatchCreateUdms RPC.
message BatchCreateUdmsRequest {
  repeated CreateUdmRequest requests = 1;
}

// BatchCreateUdmsResponse is the response for the BatchCreateUdms RPC.
message BatchCreateUdmsResponse {
  // Udms created
  repeated Udm udms = 1;
}

// UpdateUdmRequest is the request for the UpdateUdm RPC.
message UpdateUdmRequest {
  Udm udm = 1;
  optional google.protobuf.FieldMask update_mask = 2;
}

// BatchUpdateUdmsRequest is the request for the BatchUpdateUdms RPC.
message BatchUpdateUdmsRequest {
  repeated UpdateUdmRequest requests = 1;
  // update_mask fields in requests list are ignored
  optional google.protobuf.FieldMask update_mask = 2;
}

message google.protobuf.FieldMask {
  repeated string paths = 1;
}

// BatchUpdateUdmsResponse is the response for the BatchUpdateUdms RPC.
message BatchUpdateUdmsResponse {
  repeated Udm udms = 1;
}

// ListUdmsRequest is the request for the ListUdms RPC.
message ListUdmsRequest {
  string key = 1;
  bool exact = 2;
}

// ListUdmsResponse is the response for the ListUdms RPC.
message ListUdmsResponse {
  repeated Udm udms = 1;
}

// CountUdmsResponse is the response for the CountUdms RPC.
message CountUdmsResponse {
  int32 count = 1;
}

// ListUdmKeysRequest is the request for the ListUdmKeys RPC.
message ListUdmKeysRequest {
  string key = 1;
  bool exact = 2;
}

// ListUdmKeysResponse is the response for the ListUdmKeys RPC.
message ListUdmKeysResponse {
  repeated string keys = 1;
}

// DeleteUdmRequest is the request for the DeleteUdm RPC.
message DeleteUdmRequest {
  string key = 1;
}
```

&#x20;


# NetObserv SNMP

NetObserv SNMP is more than a simple SNMP poller. It has been designed to meet the requirements of the most demanding production environments, with particular attention on the following attributes:

#### Turnkey

NetObserv SNMP puts an end to countless hours of building polling configurations, and the error-prone copy-pasting necessary to poll new devices, which is required of other solutions. SNMP MIB attributes must be defined only once and can be flexibly referenced by the devices to which they are applicable.

NetObserv SNMP includes a growing collection of out-of-the-box MIB Object definitions, as well as Object Groups and Device Groups, which make it quick and easy to get started polling your environment. This enables the collector to understand how to poll a Juniper EX-Series differently than a Cisco Catalyst. Adding a device is as simple as providing an IP address, credentials and one or more Device Groups, e.g. `juniper_ex`.

![snmp\_definitions](https://user-images.githubusercontent.com/10326954/203154862-64b96560-a053-4fad-bea4-22cbe04863c0.png)

#### Extensible

NetObserv SNMP includes pre-built support for some of the most popular network equipment, which will continue to grow in the future. However there will always be new, rare or custom devices which are not yet part of our pre-built options. In this scenario, it is easy for users to add configurations or even modify existing definitions.

#### Efficient

The key to using SNMP with a minimal impact on network bandwidth and device resources is efficient polling. NetObserv SNMP achieves this by first performing a low-touch discovery of Objects applicable to the target device. The resulting *SNMP object inventory* is leveraged by the scheduler to poll devices in the most efficient manner possible. It is not uncommon for our pollers to collect 50 or more OIDs in a single poll. This greatly reduces the number of packets sent out over the network, as well as the load on the limited resources found in many devices.

#### Adaptive

It isn’t uncommon for devices to be reconfigured or restarted for maintenance or other operational requirements. NetObserv SNMP can respond dynamically to detected changes, modifying the polling schedule to remove objects and attributes which are no longer available, or automatically trigger a rediscovery when warranted by a device’s new state.

#### Scalable

ElastiFlow has proven itself as perhaps the most scalable Flow Collector available, especially when considering its depth of processing and features. NetObserv SNMP provides this same level of scalability by:

1. Leveraging a large (and configurable) pool of concurrent poller workers.
2. Taking advantage of the same processing techniques and outputs as NetObserv Flow.

### Enabling SNMP Collection

To enable NetObserv SNMP, refer to the configuration reference [HERE](/snmpcoll/configuration/input_snmp). Devices can be added as explained [HERE](/snmpcoll/configuration/def_devices).


# Supported MIBs

Here is a list of current MIBs supported out-of-the-box. Please let us know if there are any MIBs that you would like to add. A more current list can be found at

<https://github.com/elastiflow/snmp/tree/main/objects>

* airespace
  * AIRESPACE-WIRELESS-MIB.yml
* apc
  * PowerNet-MIB.yml
* arista
  * ARISTA-ASIC-COUNTERS-MIB.yml
  * ARISTA-BGP4V2-MIB.yml
  * ARISTA-BRIDGE-EXT-MIB.yml
  * ARISTA-CONFIG-COPY-MIB.yml
  * ARISTA-CONFIG-MAN-MIB.yml
  * ARISTA-DAEMON-MIB.yml
  * ARISTA-ENTITY-SENSOR-MIB.yml
  * ARISTA-FIB-STATS-MIB.yml
  * ARISTA-HARDWARE-UTILIZATION-MIB.yml
  * ARISTA-IF-MIB.yml
  * ARISTA-IP-MIB.yml
  * ARISTA-NEXTHOP-GROUP-MIB.yml
  * ARISTA-PFC-MIB.yml
  * ARISTA-QOS-MIB.yml
  * ARISTA-QUEUE-MIB.yml
  * ARISTA-REDUNDANCY-MIB.yml
  * ARISTA-SW-IP-FORWARDING-MIB.yml
  * ARISTA-TAPAGG-MIB.yml
  * ARISTA-VRF-MIB.yml
  * ARISTA-VXLAN-MIB.yml
  * ARISTA-XCVR-DWDM-MIB.yml
  * ARISTA-XGS-MIB.yml
* aten
  * ATEN-IPMI-MIB.yml
* calix
  * AXOS-ALARM-MIB.yml
  * Axos-Card-MIB.yml
  * Axos-Ont-MIB.yml
  * Axos-System-MIB.yml
* cisco
  * CISCO-AAA-SERVER-MIB.yml
  * CISCO-AAA-SESSION-MIB.yml
  * CISCO-ACCESS-ENVMON-MIB.yml
  * CISCO-ASPP-MIB.yml
  * CISCO-BCP-MIB.yml
  * CISCO-BGP-POLICY-ACCOUNTING-MIB.yml
  * CISCO-BGP4-MIB.yml
  * CISCO-CAR-MIB.yml
  * CISCO-CCM-MIB.yml
  * CISCO-CDP-MIB.yml
  * CISCO-CIRCUIT-INTERFACE-MIB.yml
  * CISCO-CONFIG-MAN-MIB.yml
  * CISCO-DIAL-CONTROL-MIB.yml
  * CISCO-EIGRP-MIB.yml
  * CISCO-ENTITY-EXT-MIB.yml
  * CISCO-ENTITY-FRU-CONTROL-MIB.yml
  * CISCO-ENTITY-SENSOR-MIB.yml
  * CISCO-ENVMON-MIB.yml
  * CISCO-ETHERLIKE-EXT-MIB.yml
  * CISCO-HSRP-EXT-MIB.yml
  * CISCO-HSRP-MIB.yml
  * CISCO-IF-EXTENSION-MIB.yml
  * CISCO-IGMP-SNOOPING-MIB.yml
  * CISCO-IP-STAT-MIB.yml
  * CISCO-IP-URPF-MIB.yml
  * CISCO-IPSEC-FLOW-MONITOR-MIB.yml
  * CISCO-ISDN-MIB.yml
  * CISCO-LWAPP-AP-MIB.yml
  * CISCO-LWAPP-CDP-MIB.yml
  * CISCO-LWAPP-DOT11-CLIENT-MIB.yml
  * CISCO-LWAPP-DOT11-MIB.yml
  * CISCO-LWAPP-DOWNLOAD-MIB.yml
  * CISCO-LWAPP-HA-MIB.yml
  * CISCO-LWAPP-MESH-MIB.yml
  * CISCO-LWAPP-ROGUE-MIB.yml
  * CISCO-LWAPP-TSM-MIB.yml
  * CISCO-LWAPP-TUNNEL-MIB.yml
  * CISCO-LWAPP-WLAN-MIB.yml
  * CISCO-MEMORY-POOL-MIB.yml
  * CISCO-NHRP-EXT-MIB.yml
  * CISCO-NTP-MIB.yml
  * CISCO-OSPF-MIB.yml
  * CISCO-PIM-MIB.yml
  * CISCO-PORT-STORM-CONTROL-MIB.yml
  * CISCO-PROCESS-MIB.yml
  * CISCO-PTP-MIB.yml
  * CISCO-QUEUE-MIB.yml
  * CISCO-SESS-BORDER-CTRLR-EVENT-MIB.yml
  * CISCO-SESS-BORDER-CTRLR-STATS-MIB.yml
  * CISCO-SIP-UA-MIB.yml
  * CISCO-STACK-MIB.yml
  * CISCO-SWITCH-MULTICAST-MIB.yml
  * CISCO-SYSLOG-MIB.yml
  * CISCO-TELEPRESENCE-CALL-MIB.yml
  * CISCO-TELEPRESENCE-MIB.yml
  * CISCO-TEMPERATURE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-AAA-MIB.yml
  * CISCO-UNIFIED-COMPUTING-ADAPTOR-MIB.yml
  * CISCO-UNIFIED-COMPUTING-BIOS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-BMC-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CALLHOME-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CAPABILITY-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CHANGE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CIMCVMEDIA-MIB.yml
  * CISCO-UNIFIED-COMPUTING-COMM-MIB.yml
  * CISCO-UNIFIED-COMPUTING-COMPUTE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CONFIG-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CONTROLLER-MIB.yml
  * CISCO-UNIFIED-COMPUTING-CPMAINT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-DCX-MIB.yml
  * CISCO-UNIFIED-COMPUTING-DHCP-MIB.yml
  * CISCO-UNIFIED-COMPUTING-DIAG-MIB.yml
  * CISCO-UNIFIED-COMPUTING-DOMAIN-MIB.yml
  * CISCO-UNIFIED-COMPUTING-DPSEC-MIB.yml
  * CISCO-UNIFIED-COMPUTING-DUPE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-EPQOS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-EQUIPMENT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-ETHER-MIB.yml
  * CISCO-UNIFIED-COMPUTING-EVENT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-EXTMGMT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-EXTPOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-EXTVMM-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FABRIC-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FAULT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FC-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FCPOOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FEATURE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FIRMWARE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FLOWCTRL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-FSM-MIB.yml
  * CISCO-UNIFIED-COMPUTING-GMETA-MIB.yml
  * CISCO-UNIFIED-COMPUTING-GRAPHICS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-HOSTIMG-MIB.yml
  * CISCO-UNIFIED-COMPUTING-IDENT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-IMGPROV-MIB.yml
  * CISCO-UNIFIED-COMPUTING-IMGSEC-MIB.yml
  * CISCO-UNIFIED-COMPUTING-INITIATOR-MIB.yml
  * CISCO-UNIFIED-COMPUTING-IP-MIB.yml
  * CISCO-UNIFIED-COMPUTING-IPPOOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-IQNPOOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-ISCSI-MIB.yml
  * CISCO-UNIFIED-COMPUTING-LICENSE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-LLDP-MIB.yml
  * CISCO-UNIFIED-COMPUTING-LS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-LSBOOT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-LSMAINT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-LSTORAGE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-MACPOOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-MAPPINGS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-MEMORY-MIB.yml
  * CISCO-UNIFIED-COMPUTING-MGMT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-MO-MIB.yml
  * CISCO-UNIFIED-COMPUTING-MOREF-MIB.yml
  * CISCO-UNIFIED-COMPUTING-NETWORK-MIB.yml
  * CISCO-UNIFIED-COMPUTING-NFS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-NWCTRL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-OBSERVE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-ORG-MIB.yml
  * CISCO-UNIFIED-COMPUTING-OS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-PCI-MIB.yml
  * CISCO-UNIFIED-COMPUTING-PKI-MIB.yml
  * CISCO-UNIFIED-COMPUTING-POLICY-MIB.yml
  * CISCO-UNIFIED-COMPUTING-PORT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-POWER-MIB.yml
  * CISCO-UNIFIED-COMPUTING-PROC-MIB.yml
  * CISCO-UNIFIED-COMPUTING-PROCESSOR-MIB.yml
  * CISCO-UNIFIED-COMPUTING-QOSCLASS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-QUERYRESULT-MIB.yml
  * CISCO-UNIFIED-COMPUTING-SECURITY-MIB.yml
  * CISCO-UNIFIED-COMPUTING-SES-MIB.yml
  * CISCO-UNIFIED-COMPUTING-SOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-STATS-MIB.yml
  * CISCO-UNIFIED-COMPUTING-STORAGE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-SYSDEBUG-MIB.yml
  * CISCO-UNIFIED-COMPUTING-SYSFILE-MIB.yml
  * CISCO-UNIFIED-COMPUTING-TOP-MIB.yml
  * CISCO-UNIFIED-COMPUTING-TRIG-MIB.yml
  * CISCO-UNIFIED-COMPUTING-UUIDPOOL-MIB.yml
  * CISCO-UNIFIED-COMPUTING-VERSION-MIB.yml
  * CISCO-UNIFIED-COMPUTING-VM-MIB.yml
  * CISCO-UNIFIED-COMPUTING-VNIC-MIB.yml
  * CISCO-UNITY-MIB.yml
  * CISCO-VOICE-APPS-MIB.yml
  * CISCO-VOICE-COMMON-DIAL-CONTROL-MIB.yml
  * CISCO-VOICE-DIAL-CONTROL-MIB.yml
  * CISCO-VTP-MIB.yml
  * OLD-CISCO-IP-MIB.yml
  * OLD-CISCO-SYS-MIB.yml
* cloudgenix
  * CGX-ENV-MIB.yml
  * CGX-STATUS-MIB.yml
* f5
  * F5-BIGIP-APM-MIB.yml
  * F5-BIGIP-GLOBAL-MIB.yml
  * F5-BIGIP-LOCAL-MIB.yml
  * F5-BIGIP-SYSTEM-MIB.yml
  * F5-BIGIP-WAM-MIB.yml
  * UROAM-SNMP-MIB.yml
* fortinet
  * FORTINET-CORE-MIB.yml
  * FORTINET-FORTIGATE-MIB.yml
* ieee
  * IEEE8023-LAG-MIB.yml
  * LLDP-MIB.yml
  * LLDP-V2-MIB.yml
* ietf
  * ADSL-DMT-LINE-MIB.yml
  * ADSL-LINE-MIB.yml
  * BGP4-MIB.yml
  * BRIDGE-MIB.yml
  * DIAL-CONTROL-MIB.yml
  * ENTITY-MIB.yml
  * ENTITY-SENSOR-MIB.yml
  * ENTITY-STATE-MIB.yml
  * ETHER-WIS.yml
  * EtherLike-MIB.yml
  * GMPLS-LABEL-STD-MIB.yml
  * GMPLS-LSR-STD-MIB.yml
  * GMPLS-TE-STD-MIB.yml
  * HOST-RESOURCES-MIB.yml
  * IF-MIB.yml
  * IGMP-MIB.yml
  * IGMP-STD-MIB.yml
  * IP-FORWARD-MIB.yml
  * IP-MIB.yml
  * IPV6-ICMP-MIB.yml
  * IPV6-MIB.yml
  * ISIS-MIB.yml
  * MPLS-L3VPN-STD-MIB.yml
  * MPLS-LDP-STD-MIB.yml
  * MPLS-LSR-STD-MIB.yml
  * MPLS-TE-STD-MIB.yml
  * MTA-MIB.yml
  * NAT-MIB.yml
  * NETWORK-SERVICES-MIB.yml
  * NHRP-MIB.yml
  * NTPv4-MIB.yml
  * OSPF-MIB.yml
  * OSPFv3-MIB.yml
  * P-BRIDGE-MIB.yml
  * POWER-ETHERNET-MIB.yml
  * PW-STD-MIB.yml
  * Printer-MIB.yml
  * Q-BRIDGE-MIB.yml
  * RIPv2-MIB.yml
  * RMON-MIB.yml
  * RSTP-MIB.yml
  * SNMP-FRAMEWORK-MIB.yml
  * SNMP-MPD-MIB.yml
  * SNMP-TARGET-MIB.yml
  * SNMP-USER-BASED-SM-MIB.yml
  * SNMPv2-MIB.yml
  * SONET-MIB.yml
  * SOURCE-ROUTING-MIB.yml
  * TCP-MIB.yml
  * TUNNEL-MIB.yml
  * UDP-MIB.yml
  * UDPLITE-MIB.yml
  * UPS-MIB.yml
  * VPLS-GENERIC-MIB.yml
  * VRRP-MIB.yml
  * VRRPV3-MIB.yml
* isilon
  * ISILON-MIB.yml
  * ONEFS-SNAPSHOT-MIB.yml
* juniper
  * BGP4-V2-MIB-JUNIPER.yml
  * JUNIPER-ALARM-MIB.yml
  * JUNIPER-CFGMGMT-MIB.yml
  * JUNIPER-COLLECTOR-MIB.yml
  * JUNIPER-COS-MIB.yml
  * JUNIPER-EX-MAC-NOTIFICATION-MIB.yml
  * JUNIPER-FABRIC-MIB.yml
  * JUNIPER-FIREWALL-MIB.yml
  * JUNIPER-FRU-MIB.yml
  * JUNIPER-HOSTRESOURCES-MIB.yml
  * JUNIPER-IDP-MIB.yml
  * JUNIPER-IF-ACCOUNTING-MIB.yml
  * JUNIPER-IF-MIB.yml
  * JUNIPER-IPv6-MIB.yml
  * JUNIPER-LICENSE-MIB.yml
  * JUNIPER-MAC-MIB.yml
  * JUNIPER-MAG-MIB.yml
  * JUNIPER-MIB.yml
  * JUNIPER-MIMSTP-MIB.yml
  * JUNIPER-MPLS-LDP-MIB.yml
  * JUNIPER-VIRTUALCHASSIS-MIB.yml
  * JUNIPER-VLAN-MIB.yml
  * JUNIPER-VPN-MIB.yml
  * MPLS-MIB.yml
  * OSPFV3-MIB-JUNIPER.yml
  * VPLS-GENERIC-DRAFT-01-MIB.yml
* meraki
  * MERAKI-CLOUD-CONTROLLER-MIB.yml
* mikrotik
  * MIKROTIK-MIB.yml
* netapp
  * NETAPP-MIB.yml
* netscaler
  * NS-ROOT-MIB.yml
* nutanix
  * NUTANIX-MIB.yml
* paloalto
  * PAN-COMMON-MIB.yml
  * PAN-ENTITY-EXT-MIB.yml
  * PAN-LC-MIB.yml
* purestorage
  * PURESTORAGE-MIB.yml
* riverbed
  * CMC-MIB.yml
  * CONTROLLER-MIB.yml
  * GC-MIB.yml
  * INTERCEPTOR-MIB.yml
  * SHARK-MIB.yml
  * STEELHEAD-EX-MIB.yml
  * STEELHEAD-MIB.yml
* rubrik
  * RUBRIK-MIB.yml
* sonicwall
  * SNWL-COMMON-MIB.yml
* synology
  * SYNOLOGY-DISK-MIB.yml
  * SYNOLOGY-EBOX-MIB.yml
  * SYNOLOGY-FLASHCACHE-MIB.yml
  * SYNOLOGY-GPUINFO-MIB.yml
  * SYNOLOGY-ISCSILUN-MIB.yml
  * SYNOLOGY-ISCSITarget-MIB.yml
  * SYNOLOGY-NFS-MIB.yml
  * SYNOLOGY-PORT-MIB.yml
  * SYNOLOGY-RAID-MIB.yml
  * SYNOLOGY-SERVICES-MIB.yml
  * SYNOLOGY-SHA-MIB.yml
  * SYNOLOGY-SMART-MIB.yml
  * SYNOLOGY-SPACEIO-MIB.yml
  * SYNOLOGY-STORAGEIO-MIB.yml
  * SYNOLOGY-SYSTEM-MIB.yml
  * SYNOLOGY-UPS-MIB.yml
* ubiquiti
  * UBNT-UniFi-MIB.yml
* ucdavis
  * LM-SENSORS-MIB.yml
  * UCD-DISKIO-MIB.yml
  * UCD-DLMOD-MIB.yml
  * UCD-SNMP-MIB.yml
* unix
  * SMUX-MIB.yml
* wheelgroup
  * NETRANGER.yml


# Installation


# System Requirements

### Requirements based on device tier

NetObserv SNMP has been designed for the efficiency required to monitor large networks. To ensure smooth operation, we recommend that you don't exceed 300-500 devices per NetObserv SNMP instance. The device limit per instance really depends on the number of objects you are polling from each device. Ideally you should not poll more than 50,000 objects per NetObserv SNMP instance, which roughly corresponds to polling 400 devices with 125 polled objects per device. Here is a table to give you an idea of the number ob NetObserv SNMP instances you might want to deploy depending on the total number of devices polled:

| Polled Devices | Recommended NetObserv SNMP instances |
| -------------- | ------------------------------------ |
| 25             | 1                                    |
| 100            | 1                                    |
| 200            | 1                                    |
| 500            | 1 - 2                                |
| 1000           | 2 - 3                                |
| 2500           | 5 - 8                                |
| 5000           | 10 - 16                              |
| 10000          | 20 - 32                              |
| 20000          | 40 - 64                              |
| 30000          | 60 - 96                              |
| 40000          | 80 - 192                             |

### Required Resources

Each NetObserv SNMP instance can be run on 4GB of RAM and 4 CPUs without regularly exceeding 50% of CPU and memory usage. This data is based on the default polling interval of 1 minute and assumes roughly 50,000 objects being polled. When increasing the the polling intervall to e.g. 3 or 5 minutes, resource consumption will decrease, but not linearly, as there will be spikes during the polls and a lot of idle time once all polls are completed.

### Deployment

Each NetObserv SNMP instance should have its own IP address. It is therefore not advised to run multiple instances on the same host, unless dedicated interfaces are available. The preferred deployment in this case would be to deploy a new VM for each SNMP instance, which can then share the underlying resources of the host.


# Linux

{% hint style="info" %}
This section provides the installation steps for NetObserv SNMP. Many users get started using ElastiFlow with the Elastic Stack (Elasticsearch and Kibana). To install and configure the Elastic Stack step-by-step instructions are provided for both [**Ubuntu/Debian**](/data_platforms/elastic/install_ubuntu) and [**RedHat/AlmaLinux**](/data_platforms/elastic/install_redhat).
{% endhint %}

NetObserv SNMP can be installed natively on Linux. Packages are currently provided for and supported on the Linux distributions and versions listed in the following table.

| Distribution              | Versions             |
| ------------------------- | -------------------- |
| Ubuntu                    | 22.04 LTS, 24.04 LTS |
| Debian                    | 12                   |
| RHEL/RockyLinux/AlmaLinux | 8.x, 9.x             |

### Ubuntu/Debian Installation (deb)

The Debian package for the NetObserv SNMP can be downloaded from [here](https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector_7.25.0_linux_amd64.deb). It can be used for installation on most Debian-based systems such as Debian and Ubuntu.

#### Download the `.deb` Package

The package can be easily downloaded using either the `wget` or `curl` command:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

<pre><code>curl https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb --output snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

#### Verify the Package

**Checksum Verification**

To ensure the downloaded file was fully downloaded and wasn't corrupted or tampered with, you can verify the provided checksum matches.

<pre><code># get checksum of the downloaded file:
sha256sum snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb

# verify the checksum provided from the previous command matches the checksum here:
https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb.sha256
</code></pre>

**GPG Verification**

ElastiFlow signs the Debian package with a GNU Privacy Guard (GPG) key. To verify the Debian package, download and import the ElastiFlow GPG public key:

```shell
curl -o- https://elastiflow-releases.s3.us-east-2.amazonaws.com/elastiflow.pgp | gpg --import -
```

Next, download the signature file:

<pre><code>curl -SLO https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb.sig
</code></pre>

Finally, verify the file with the signature:

<pre><code>gpg --verify snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb.sig snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

The collector requires `libpcap-dev`. Check if the `libpcap-dev` package is installed:

```shell
sudo dpkg-query -l | grep libpcap-dev
```

If installed, the output will look similar to the follow:

```shell
ii  libpcap-dev:amd64      1.9.1-3      amd64      development library for libpcap (transitional package)
```

If it is not present, install it:

```shell
sudo apt install libpcap-dev
```

#### Install the `.deb` Package

There are two methods to install the NetObserv SNMP package, `apt` or `dpkg`.

**Install with `apt`**

<pre><code>sudo apt install ./snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

**Install with `dpkg`**&#x20;

<pre><code>curl https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb --output snmp-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

### RedHat/AlmaLinux Installation (rpm)

The RPM package for the NetObserv SNMP can be downloaded from [here](https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector-7.25.0-1.x86_64.rpm). It can be used for installation on most RedHat-based systems such as RHEL and CentOS.

#### Download the `.rpm` Package

The package can be easily downloaded using `wget` or `curl`:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm

</code></pre>

<pre><code>curl https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm --output snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

#### Verify the Package

**Checksum Verification**

To ensure the downloaded file was fully downloaded and wasn't corrupted or tampered with, you can verify the provided checksum matches.

<pre><code># get checksum of the downloaded file:
sha256sum snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm

# verify the checksum provided from the previous command matches the checksum here:
https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm.sha256
</code></pre>

**GPG Verification**

ElastiFlow signs the RPM package with a GNU Privacy Guard (GPG) key. To verify the RPM package, download and import the ElastiFlow GPG public key:

```shell
# import public key into gpg keychain
curl -o- https://elastiflow-releases.s3.us-east-2.amazonaws.com/elastiflow.pgp | gpg --import -

# trust the public key
echo "6A2E26EFDE24AA7A634A442ED5C0572E5D212F6B:6:" | gpg --import-ownertrust

# import public key into rpm trust store
rpm --import https://elastiflow-releases.s3.us-east-2.amazonaws.com/elastiflow.pgp
```

Next, download the signature file:

<pre><code>curl -SLO https://elastiflow-releases.s3.us-east-2.amazonaws.com/snmp-collector/snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm.sig
</code></pre>

Finally, verify the file with the signature:

<pre><code>gpg --verify snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm.sig snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

#### Ensure that `libpcap` and `libpcap-devel` are Installed

The collector requires `libpcap` and `libpcap-devel`. Check if the packages are installed:

```shell
rpm -q libpcap libpcap-devel
```

If installed, the output will look similar to the following:

```shell
libpcap-1.9.1-5.el8.x86_64
libpcap-devel-1.9.1-5.el8.x86_64
```

If the packages are not present, install them:

**RHEL 8.x based Distributions (Alma, Rocky, Fedora, etc.)**

```shell
sudo dnf --enablerepo=powertools install libpcap libpcap-devel -y
```

**RHEL 9.x based Distributions (Alma, Rocky, Fedora, etc.)**

```shell
sudo dnf --enablerepo=crb install libpcap libpcap-devel -y
```

**RHEL 9.x based Distributions (Official RedHat distribution)**

```shell
sudo dnf --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install libpcap libpcap-devel -y
```

#### Install/Upgrade the `.rpm` Package

If installing the NetObserv SNMP package for the first time, i.e. NOT upgrading, run the following:

<pre><code>sudo yum install -y snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

If upgrading from a previously installed NetObserv SNMP package, run the following:

<pre><code>sudo rpm -Uhv snmp-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

### Configuration

The NetObserv SNMP will be installed to run as a daemon managed by `systemd`. Configuration of the collector is provided via environment variables and, depending on the enabled options, via various configuration files which by default are located within `/etc/elastiflow`.

To configure the variables, edit the file `/etc/elastiflow/snmpcoll.yml`. For details on all the configuration options, please refer to the [Configuration Reference](/snmpcoll/configuration).

{% hint style="info" %}
At a minimum the NetObserv SNMP must point to a valid data store. The most common installation uses Elasticsearch and Kibana as the data store. To install and configure the Elastic Stack step-by-step instructions are provided for both [**Ubuntu/Debian**](/data_platforms/elastic/install_ubuntu) and [**RedHat/AlmaLinux**](/data_platforms/elastic/install_redhat).
{% endhint %}

{% hint style="info" %}
NetObserv SNMP will set CAP\_NET\_RAW capability for itself. It must have permission to create/send ping requests to detect 'degraded' device status. In some Linux distributions, that permission is not automatic, so the systemd service file adds it explicitly. CAP\_NET\_RAW grants the process the capability to use RAW and PACKET sockets and to bind to any address for transparent proxying.
{% endhint %}

### Checking the SNMP Definition Files

If you are upgrading NetObserv, and the [changelog](/changelog) mentions that 'SNMP definition' files have been updated, then consult [this page](https://github.com/elastiflow/documentation/blob/main/docs/kb/install/def_download/README.md) for how to make sure you receive those changes.

### Running the Collector

To start the collector, execute the follow commands:

```shell
sudo systemctl daemon-reload && sudo systemctl start snmpcoll.service
```

To ensure the collector has started and is running, execute:

```shell
sudo systemctl status snmpcoll.service
```

The collector can be stopped using:

```shell
sudo systemctl stop snmpcoll.service
```

If you want the collector to be started automatically when the system is booted, it must be enabled:

```shell
sudo systemctl enable snmpcoll.service
```


# Docker

A Docker container for NetObserv SNMP is available on [Docker Hub](https://hub.docker.com/r/elastiflow/snmp-collector). [docker-compose](https://docs.docker.com/compose/) is a good way to run the container. It allows for the various environment variables, used to configure the collector, to be easily managed in one place without having to enter them on the command line.

### docker-compose.yml

The following `docker-compose.yml` file provides a starting point that can be further customized for your environment and needs.

<pre data-overflow="wrap"><code>
services:
  # ElastiFlow NetObserv SNMP
  snmp-collector:
    image: elastiflow/snmp-collector:<code class="expression">space.vars.current_version</code>
    container_name: snmp-collector
    restart: 'unless-stopped'
    volumes:
      - /etc/elastiflow:/etc/elastiflow
    environment:
      EF_LICENSE_ACCEPTED: 'false'
      #EF_ACCOUNT_ID: ''

      #EF_LICENSE_KEY: ''
      #EF_LICENSE_TELEMETRY_HOSTS:

      #EF_INSTANCE_NAME: default
      #EF_API_PORT: 8080
      #EF_API_TLS_ENABLE: ''
      #EF_API_TLS_CERT_FILEPATH: ''
      #EF_API_TLS_KEY_FILEPATH: ''
      #EF_API_BASIC_AUTH_ENABLE: 'false'
      #EF_API_BASIC_AUTH_USERNAME: ''
      #EF_API_BASIC_AUTH_PASSWORD: ''

      #EF_LOGGER_LEVEL: 'info'
      #EF_LOGGER_ENCODING: 'json'
      #EF_LOGGER_FILE_LOG_ENABLE: 'false'
      #EF_LOGGER_FILE_LOG_FILENAME: '/var/log/elastiflow/flowcoll/flowcoll.log'
      #EF_LOGGER_FILE_LOG_MAX_SIZE: 100
      #EF_LOGGER_FILE_LOG_MAX_AGE: ''
      #EF_LOGGER_FILE_LOG_MAX_BACKUPS: 4
      #EF_LOGGER_FILE_LOG_COMPRESS: 'false'

      #EF_INPUT_SNMP_POLLER_WORKER_POOL_SIZE:  # defaults to the number of CPU threads * 4
      #EF_INPUT_SNMP_POLLER_ERROR_HANDLING: 'partial'
      #EF_INPUT_SNMP_DEVICE_DEFINITIONS_DIRECTORY_PATH: '/etc/elastiflow/snmp/devices'
      #EF_INPUT_SNMP_DEVICE_GROUP_DEFINITIONS_DIRECTORY_PATH: '/etc/elastiflow/snmp/device_groups'
      #EF_INPUT_SNMP_OBJECT_GROUP_DEFINITIONS_DIRECTORY_PATH: '/etc/elastiflow/snmp/object_groups'
      #EF_INPUT_SNMP_OBJECT_DEFINITIONS_DIRECTORY_PATH: '/etc/elastiflow/snmp/objects'
      #EF_INPUT_SNMP_PERSIST_ENABLE: 'true'
      #EF_INPUT_SNMP_PERSIST_DIRECTORY_PATH: '/usr/share/elastiflow/snmpcoll'

      #EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH: '/etc/elastiflow/snmp/enums'
      #EF_PROCESSOR_POOL_SIZE:
      #EF_PROCESSOR_TRANSLATE_KEEP_IDS: 'default'

      #EF_PROCESSOR_ENRICH_IPADDR_TTL: 7200

      EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE: 'false'
      #EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH: '/etc/elastiflow/metadata/ipaddrs.yml'
      #EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE: 15

      EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE: 'false'
      EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_IP: ''
      EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_TIMEOUT: 3000
      #EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PRIVATE: 'true'
      #EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PUBLIC: 'true'
      #EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH: '/etc/elastiflow/hostname/user_defined.yml'
      #EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_REFRESH_RATE: 15
      #EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_PATH: '/etc/elastiflow/hostname/incl_excl.yml'
      #EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_REFRESH_RATE: 15

      #EF_PROCESSOR_DURATION_PRECISION: 'ms'
      #EF_PROCESSOR_TIMESTAMP_PRECISION: 'ms'
      #EF_PROCESSOR_PERCENT_NORM: 100
      #EF_PROCESSOR_KEEP_CPU_TICKS: 'false'

      #EF_PROCESSOR_DROP_FIELDS: ''

      # stdout
      #EF_OUTPUT_STDOUT_ENABLE: 'false'
      #EF_OUTPUT_STDOUT_FORMAT: 'json_pretty'

      # monitor
      #EF_OUTPUT_MONITOR_ENABLE: 'false'
      #EF_OUTPUT_MONITOR_INTERVAL: 300

      # Elasticsearch
      EF_OUTPUT_ELASTICSEARCH_ENABLE: 'false'
      EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE: 'false'
      #EF_OUTPUT_ELASTICSEARCH_BATCH_DEADLINE: 2000
      #EF_OUTPUT_ELASTICSEARCH_BATCH_MAX_BYTES: 8388608
      #EF_OUTPUT_ELASTICSEARCH_TIMESTAMP_SOURCE: 'collect'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD: 'rollover'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_SUFFIX: ''
      #EF_OUTPUT_ELASTICSEARCH_DROP_FIELDS: ''
      #EF_OUTPUT_ELASTICSEARCH_ALLOWED_RECORD_TYPES: 'as_path_hop,flow_option,flow,telemetry'

      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ENABLE: 'true'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_OVERWRITE: 'true'
      EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_SHARDS: 1
      EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_REPLICAS: 0
      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_REFRESH_INTERVAL: '10s'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_CODEC: 'best_compression'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ILM_LIFECYCLE: 'elastiflow'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_PIPELINE_DEFAULT: '_none'
      #EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_PIPELINE_FINAL: '_none'

      # A comma separated list of Elasticsearch nodes to use. DO NOT include "http://" or "https://"
      EF_OUTPUT_ELASTICSEARCH_ADDRESSES: '127.0.0.1:9200'
      EF_OUTPUT_ELASTICSEARCH_USERNAME: 'elastic'
      EF_OUTPUT_ELASTICSEARCH_PASSWORD: 'changeme'
      #EF_OUTPUT_ELASTICSEARCH_CLOUD_ID: ''
      #EF_OUTPUT_ELASTICSEARCH_API_KEY: ''
      #EF_OUTPUT_ELASTICSEARCH_CLIENT_CA_CERT_FILEPATH:
      #EF_OUTPUT_ELASTICSEARCH_CLIENT_CERT_FILEPATH:
      #EF_OUTPUT_ELASTICSEARCH_CLIENT_KEY_FILEPATH:

      EF_OUTPUT_ELASTICSEARCH_TLS_ENABLE: 'false'
      EF_OUTPUT_ELASTICSEARCH_TLS_SKIP_VERIFICATION: 'false'
      EF_OUTPUT_ELASTICSEARCH_TLS_CA_CERT_FILEPATH: ''

      #EF_OUTPUT_ELASTICSEARCH_RETRY_ENABLE: 'true'
      #EF_OUTPUT_ELASTICSEARCH_RETRY_ON_TIMEOUT_ENABLE: 'true'
      #EF_OUTPUT_ELASTICSEARCH_MAX_RETRIES: 3
      #EF_OUTPUT_ELASTICSEARCH_RETRY_BACKOFF: 1000

      # OpenSearch
      EF_OUTPUT_OPENSEARCH_ENABLE: 'false'
      EF_OUTPUT_OPENSEARCH_ECS_ENABLE: 'false'
      #EF_OUTPUT_OPENSEARCH_BATCH_DEADLINE: 2000
      #EF_OUTPUT_OPENSEARCH_BATCH_MAX_BYTES: 8388608
      #EF_OUTPUT_OPENSEARCH_TIMESTAMP_SOURCE: 'collect'
      #EF_OUTPUT_OPENSEARCH_INDEX_PERIOD: 'daily'
      #EF_OUTPUT_OPENSEARCH_INDEX_SUFFIX: ''
      #EF_OUTPUT_OPENSEARCH_DROP_FIELDS: ''
      #EF_OUTPUT_OPENSEARCH_ALLOWED_RECORD_TYPES: 'as_path_hop,flow_option,flow,telemetry'

      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_ENABLE: 'true'
      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_OVERWRITE: 'true'
      EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_SHARDS: 1
      EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_REPLICAS: 0
      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_REFRESH_INTERVAL: '10s'
      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_CODEC: 'best_compression'
      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_ISM_POLICY: 'elastiflow'
      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_PIPELINE_DEFAULT: '_none'
      #EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_PIPELINE_FINAL: '_none'

      # A comma separated list of OpenSearch nodes to use. DO NOT include "http://" or "https://"
      EF_OUTPUT_OPENSEARCH_ADDRESSES: '127.0.0.1:9200'
      EF_OUTPUT_OPENSEARCH_USERNAME: 'elastic'
      EF_OUTPUT_OPENSEARCH_PASSWORD: 'changeme'
      #EF_OUTPUT_OPENSEARCH_CLIENT_CA_CERT_FILEPATH:
      #EF_OUTPUT_OPENSEARCH_CLIENT_CERT_FILEPATH:
      #EF_OUTPUT_OPENSEARCH_CLIENT_KEY_FILEPATH:

      EF_OUTPUT_OPENSEARCH_TLS_ENABLE: 'false'
      EF_OUTPUT_OPENSEARCH_TLS_SKIP_VERIFICATION: 'false'
      EF_OUTPUT_OPENSEARCH_TLS_CA_CERT_FILEPATH: ''

      #EF_OUTPUT_OPENSEARCH_RETRY_ENABLE: 'true'
      #EF_OUTPUT_OPENSEARCH_RETRY_ON_TIMEOUT_ENABLE: 'true'
      #EF_OUTPUT_OPENSEARCH_MAX_RETRIES: 3
      #EF_OUTPUT_OPENSEARCH_RETRY_BACKOFF: 1000

      # Splunk
      EF_OUTPUT_SPLUNK_HEC_ENABLE: 'false'
      #EF_OUTPUT_SPLUNK_HEC_CIM_ENABLE: 'false'
      EF_OUTPUT_SPLUNK_HEC_ADDRESSES: '127.0.0.1:8088'
      EF_OUTPUT_SPLUNK_HEC_TOKEN: ''
      #EF_OUTPUT_SPLUNK_HEC_BATCH_MAX_BYTES: 8388608
      #EF_OUTPUT_SPLUNK_HEC_BATCH_DEADLINE: 2000
      #EF_OUTPUT_SPLUNK_HEC_TLS_ENABLE: 'true'
      #EF_OUTPUT_SPLUNK_HEC_TLS_SKIP_VERIFICATION: 'false'
      #EF_OUTPUT_SPLUNK_HEC_TLS_CA_CERT_FILEPATH: ''
      #EF_OUTPUT_SPLUNK_HEC_DROP_FIELDS: ''

      # Kafka
      EF_OUTPUT_KAFKA_ENABLE: 'false'
      EF_OUTPUT_KAFKA_BROKERS: ''
      #EF_OUTPUT_KAFKA_VERSION: '1.0.0'
      #EF_OUTPUT_KAFKA_TOPIC: 'elastiflow-flow-codex'
      #EF_OUTPUT_KAFKA_PARTITION_KEY: 'flow.export.ip.addr'
      #EF_OUTPUT_KAFKA_CLIENT_ID: 'elastiflow-flowcoll'
      #EF_OUTPUT_KAFKA_RACK_ID: ''
      #EF_OUTPUT_KAFKA_TIMEOUT: 30
      #EF_OUTPUT_KAFKA_DROP_FIELDS: ''
      #EF_OUTPUT_KAFKA_ALLOWED_RECORD_TYPES: 'as_path_hop,flow_option,flow,telemetry'
      #EF_OUTPUT_KAFKA_FLAT_RECORD_ENABLE: 'true'

      EF_OUTPUT_KAFKA_SASL_ENABLE: 'false'
      #EF_OUTPUT_KAFKA_SASL_USERNAME: ''
      #EF_OUTPUT_KAFKA_SASL_PASSWORD: ''

      #EF_OUTPUT_KAFKA_TLS_ENABLE: 'false'
      #EF_OUTPUT_KAFKA_TLS_CA_CERT_FILEPATH: ''
      #EF_OUTPUT_KAFKA_TLS_CERT_FILEPATH: ''
      #EF_OUTPUT_KAFKA_TLS_KEY_FILEPATH: ''
      #EF_OUTPUT_KAFKA_TLS_SKIP_VERIFICATION: 'false'

      #EF_OUTPUT_KAFKA_PRODUCER_MAX_MESSAGE_BYTES: 1000000
      #EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS: 1
      #EF_OUTPUT_KAFKA_PRODUCER_TIMEOUT: 10
      #EF_OUTPUT_KAFKA_PRODUCER_COMPRESSION: 3
      #EF_OUTPUT_KAFKA_PRODUCER_COMPRESSION_LEVEL: -1000
      #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_BYTES: 1000000
      #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_MESSAGES: 1024
      #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_FREQUENCY: 1000
      #EF_OUTPUT_KAFKA_PRODUCER_FLUSH_MAX_MESSAGES: 0
      #EF_OUTPUT_KAFKA_PRODUCER_RETRY_MAX: 3
      #EF_OUTPUT_KAFKA_PRODUCER_RETRY_BACKOFF: 100

      # Cribl
      EF_OUTPUT_CRIBL_ENABLE: 'false'
      EF_OUTPUT_CRIBL_ADDRESSES: '127.0.0.1:10080'
      EF_OUTPUT_CRIBL_TOKEN: ''
      #EF_OUTPUT_CRIBL_BATCH_DEADLINE: 2000
      #EF_OUTPUT_CRIBL_BATCH_MAX_BYTES: 8388608
      #EF_OUTPUT_CRIBL_TLS_ENABLE: 'false'
      #EF_OUTPUT_CRIBL_TLS_SKIP_VERIFICATION: 'false'
      #EF_OUTPUT_CRIBL_TLS_CA_CERT_FILEPATH: ''
      #EF_OUTPUT_CRIBL_DROP_FIELDS: ''

      # Generic HTTP
      EF_OUTPUT_GENERIC_HTTP_ENABLE: 'false'
      EF_OUTPUT_GENERIC_HTTP_ECS_ENABLE: 'false'
      #EF_OUTPUT_GENERIC_HTTP_BATCH_DEADLINE: 2000
      #EF_OUTPUT_GENERIC_HTTP_BATCH_MAX_BYTES: 8388608
      EF_OUTPUT_GENERIC_HTTP_ADDRESSES: ''
      #EF_OUTPUT_GENERIC_HTTP_USERNAME: ''
      #EF_OUTPUT_GENERIC_HTTP_PASSWORD: ''
      #EF_OUTPUT_GENERIC_HTTP_TLS_ENABLE: 'false'
      #EF_OUTPUT_GENERIC_HTTP_TLS_SKIP_VERIFICATION: 'false'
      #EF_OUTPUT_GENERIC_HTTP_TLS_CA_CERT_FILEPATH: ''
      #EF_OUTPUT_GENERIC_HTTP_DROP_FIELDS: ''
      #EF_OUTPUT_GENERIC_HTTP_TIMESTAMP_SOURCE: 'collect'
</code></pre>

#### image

The name of the current released image is elastiflow/snmp-collector:<code class="expression">space.vars.current\_version</code>.

#### restart

`restart` is set to `unless-stopped` so that the collector will restart automatically if it fails for some reason.

#### volumes

There are a few scenarios where it is necessary to make files on the host file system available to the collector.

In the example above, `/etc/elastiflow` on the host's filesystem is mapped into the same path within the container. It is recommended to place the SNMP poller definition files in `/etc/elastiflow/snmp`.

{% hint style="info" %}
It is also possible to build a new container, adding additional files as needed. This may the best choice if running the container in a dynamically orchestrated environment (e.g. running in Kubernetes). However for an instance dedicated to a specific host, using bind mounted volumes can be very convenient.
{% endhint %}

#### environment variables

NetObserv SNMP is configured using environment variables.

For a complete reference of all configuration options please refer to the [Configuration Reference](/snmpcoll/configuration).

#### Running the Container

After completing configuration of the collector in the `docker-compose.yml` file, you can start the container using one of the following commands...

From within the same path as the `docker-compose.yml` file:

```
docker-compose up -d
```

From a path different from the location of the `docker-compose.yml` file:

```
docker-compose -f /PATH/TO/docker-compose.yml up -d
```

To view the logs written by the container run:

```
docker logs -f NAME_OF_CONTAINER
```

To stop the container run:

```
docker-compose down
```

or:

```
docker-compose -f /PATH/TO/docker-compose.yml down
```


# Configuration


# Devices

&#x20;NetObserv SNMP makes it simple to add devices providing little more than an IP address, SNMP credentials and one or more [Device Groups](/snmpcoll/configuration/snmp-definition-files/def_device_groups).

### Adding Devices

#### Automatically Discovering Devices

ElastiFlow provides a way to [automatically discover devices](/snmpcoll/configuration/def_devices/autodiscovery) in your network.

#### Manually Configuring Devices

1. Create (or update an existing) yml file in `/etc/elastiflow/snmp/devices` (or wherever [`EF_INPUT_SNMP_DEVICE_DEFINITIONS_DIRECTORY_PATH`](/snmpcoll/configuration/input_snmp#ef_input_snmp_device_definitions_directory_path) is configured)
2. Define the ip address to reach the device
3. Define either community strings to use (for SNMP v1/v2c), or define credentials to use for devices you want to use SNMP v3 to access.
4. Add "device groups". This is how you tell NetObserv SNMP which types of OIDs to look for.
   1. Usually you only need to find the device group for the device type this device is. The reason for having device groups is to make this configuration step easy.
   2. To see the full list of device groups available for you to use, see `/etc/elastiflow/snmp/device_groups` (or wherever [`EF_INPUT_SNMP_DEVICE_GROUP_DEFINITIONS_DIRECTORY_PATH`](/snmpcoll/configuration/input_snmp#ef_input_snmp_device_group_definitions_directory_path) is configured)

### SNMP v1/v2c Example

**Full configuration:**

```yaml
example1.elastiflow.com:
  ip: 192.0.2.1
  port: 161
  poll_intervals:
    active: 300
  timeout: 3000
  retries: 2
  exponential_timeout: false
  version: 2c
  communities:
    - public
  device_groups:
    - cisco_c1000
  max_concurrent_polls: 4
```

**When using the defaults:**

```yaml
example1.elastiflow.com:
  ip: 192.0.2.1
  version: 2c
  communities:
    - public
  device_groups:
    - cisco_c1000
```

#### SNMP v3 Example

**Full configuration:**

```yaml
example2.elastiflow.com:
  ip: 192.0.2.2
  port: 161
  poll_intervals:
    active: 300
  timeout: 3000
  retries: 2
  exponential_timeout: false
  version: 3
  v3_credentials:
    - username: elastiflow
      authentication_protocol: sha
      authentication_passphrase: efauthpassword
      privacy_protocol: des
      privacy_passphrase: efprivpassword
  device_groups:
    - cisco_c1000
  max_concurrent_polls: 4
```

**When using the defaults:**

```yaml
example2.elastiflow.com:
  ip: 192.0.2.2
  version: 3
  v3_credentials:
    - username: elastiflow
      authentication_protocol: sha
      authentication_passphrase: efauthpassword
      privacy_protocol: des
      privacy_passphrase: efprivpassword
  device_groups:
    - cisco_c1000
```

### Global Device Defaults

The location of the global default device definition file is specified by `EF_INPUT_SNMP_DEFAULTS_DIRECTORY_PATH` in the collector's configuration options. The file in this directory must be named `device.yml`. The default location is `/etc/elastiflow/snmp/defaults`. This file will apply default values to every device definition where values are not provided (except the `ip` field).

#### Device Defaults Example

**Defaults file:**

```yaml
default:
  port: 200
  timeout: 4000
  retries: 4
  exponential_timeout: true
  version: 2c
  communities:
    - sith
    - lord
  device_groups:
    - generic
  poll_intervals:
    dynamic: 60
    active: 300
    stable: 3600
    immutable: 86400
  max_oids: 64
  max_concurrent_polls: 5
```

**Device file:**

```yaml
mydevice:
  ip: 192.0.2.1
```

**Resulting definition:**

```yaml
mydevice:
  ip: 192.0.2.1
  port: 200
  timeout: 4000
  retries: 4
  exponential_timeout: true
  version: 2c
  communities:
    - sith
    - lord
  device_groups:
    - generic
  poll_intervals:
    dynamic: 60
    active: 300
    stable: 3600
    immutable: 86400
  max_oids: 64
  max_concurrent_polls: 5
```

### Configuration Attributes

#### ip

The IP address of the device to which SNMP requests will be sent.

EXAMPLE: `ip: 192.0.2.2`

#### port (optional)

The UDP port on which the device listens for SNMP requests.

* Default
  * `161`

#### poll\_intervals (optional) <a href="#device_poll_intervals" id="device_poll_intervals"></a>

{% hint style="info" %}
Introduced in NetObserv `7.22.0`
{% endhint %}

This configuration parameter allows for device-specific overrides of the per object type `poll_interval` values defined in `/etc/elastiflow/snmp/default/object_types.yml`.

The duration, in seconds, between SNMP polling cycles.&#x20;

The default, NetObserv SNMP object types are defined in `/etc/elastiflow/snmp/default/object_types.yml` as follows:

* `dynamic`
  * Highly volatile metrics and critical operational states. Use for data requiring near high granularity or immediate alerting.
  * Examples: ifInOctets/ifOutOctets (traffic counters), CPU utilization.
  * Default: `60`
* `active`
  * Routine metrics that fluctuate regularly but do not require high granularity tracking.
  * Examples: Environmental sensors (temperature/fans), connection counts, active processes.
  * Default: `300`
* `stable`
  * Slow-moving data and logical topology states that change infrequently. Use for heavy tables that are too expensive to poll frequently, but change often enough to need regular tracking
  * Examples: LLDP neighbor tables and ARP caches (ipNetToMediaTable).
  * Default: `3600`
* `immutable`
  * Static inventory and administrative metadata that rarely, if ever, changes. Use for physical hardware tracking and system-level settings.
  * Examples: entPhysicalTable (serial numbers, hardware models), firmware versions.
  * Default: `86400`

The following is an example of how these values can be overridden for a specific device using this `poll_intervals` parameter in the device's configuration.

Example:

```yaml
mydevice:
  ip: 192.0.2.1
  poll_intervals:
    active: 300
    immutable: 3000
```

#### poll\_interval (optional)

{% hint style="info" %}
In version `7.22.0` the ability to specify polling intervals per object type was added. NetObserv `7.22.0` is preloaded with the types as explained above for `poll_intervals`. When present `poll_intervals` will be used, rather than `poll_interval`.

See [/pages/J7nIU3p3GzF3LhPE3mqm#id-7.22.0-mar-20-2026](https://docs.elastiflow.com/snmpcoll/configuration/pages/J7nIU3p3GzF3LhPE3mqm#id-7.22.0-mar-20-2026 "mention")
{% endhint %}

The duration, in seconds, between SNMP polling cycles. This will only apply to SNMP objects which do not have a `type` defined.

* Default
  * `60`

#### timeout (optional)

The time to wait, in milliseconds, for a response to an SNMP request.

* Default
  * `3000`

#### retries (optional)

The number of times to retry a failed SNMP request before the task is cancelled.

* Default
  * `2`

#### exponential\_timeout (optional)

Defines whether the timeout interval should remain static (`false`) for each retry, or increase exponentially (`true`).

* Default
  * `false`

#### version

Specifies the SNMP version to use when polling this device. Valid values are:

* Valid Values
  * `1`, `2c`, `3`

#### communities

If `version` is `1` or `2c` a list of communities **must** be provided. The collector will attempt to find a valid community from the list and will use that community for all subsequent polls.

EXAMPLE:

```yaml
communities:
  - public
  - elastiflow
```

#### v3\_credentials

If `version` is `3` a list of SNMPv3 credentials **must** be provided. The collector will attempt to find valid credentials from the list and will use those credentials for all subsequent polls.

EXAMPLE:

```yaml
v3_credentials:
  - username: elastiflow
    authentication_protocol: sha
    authentication_passphrase: efauthpassword
    privacy_protocol: des
    privacy_passphrase: efprivpassword
```

**username**

The username used to authenticate with the device using SNMPv3.

**authentication\_protocol**

The authentication protocol used to authenticate the username with the device using SNMPv3.

Options include: "noauth" "md5" "sha" "sha128" "sha224" "sha256" "sha384" "sha512"

**authentication\_passphrase**

The authentication passphrase used to authenticate the username with the device using SNMPv3.

**privacy\_protocol**

The privacy protocol used to encrypt SNMPv3 traffic between the SNMP input and the device.

Options include: "nopriv" "des" "aes" "aes192" "aes256" "aes192c" "aes256c"

**privacy\_passphrase**

The privacy passphrase used to encrypt SNMPv3 traffic between the SNMP input and the device.

#### device\_groups

Defines a list of [Device Groups](/snmpcoll/configuration/snmp-definition-files/def_device_groups) which the Device may implement.

#### max\_concurrent\_polls (optional)

The maximum number of concurrent polls that can be performed against this device. This is useful for throttling or increasing the number of concurrent polls to a device depending on the device's capabilities.

* Default
  * `4`

#### cisco\_qos\_enabled (optional)

Defines whether the device supports Cisco QoS MIBs and signals to the collector to enable enrichment of QoS policy data.


# Auto-Discovery of Devices

{% hint style="info" %}
Device auto-discovery is currently a *technology preview*. The design and implementation are less mature than stable features and subject to change.
{% endhint %}

### Overview

ElastiFlow can automatically discover SNMP-enabled devices. To do this, you will install and use a command-line tool called `netobserv`.

{% hint style="info" %}
You will need to have NetObserv SNMP 7.12.0 (or later) already installed. That will have the latest version of the SNMP definition files. If upgrading to 7.12.0, make sure you follow the [manual upgrade steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).
{% endhint %}

You can install `netobserv` CLI tool via our `deb` or `rpm` packages.

Assuming you use default settings for NetObserv SNMP, here's how you run auto-discovery:

1. Define a "networks" input file at `/etc/elastiflow/snmp/autodiscover/networks.yml`, and specify the network ranges you want to scan.
   1. You can do this by copying the example file found at `/etc/elastiflow/snmp/autodiscover/networks.yml.EXAMPLE` and then editing it.
   2. Details are found below on what the file format looks like.
2. Run `/usr/share/elastiflow/bin/netobserv autodiscover snmp`.
   1. There are also additional flags to customize behavior if you want.
3. Trigger the [apply-definitions API](/snmpcoll/api-reference-overview/snmp) to reload the device YAML config for NetObserv SNMP.

#### Known Issues

Routers can have indirect duplicates sometimes. If a router does not have a non-local loopback interface, as of 7.12.0 release, the device YAML output will likely have all separate addresses of that router listed as separate device entries.

### How Device Auto-Discovery Works

Device auto-discovery will:

1. Receive a list of IP ranges you want to scan for devices.
2. Ping sweep all addresses in the ranges you provided to find what devices exist.
3. Use SNMP to get the sysOID value (this specifies what device type it is).
4. Figure out what device\_group name NetObserv associates with that sysOID. In other words, NetObserv ships with prebuilt lists of OIDs for various device types, and this step will find that prebuilt list for the given device type.
5. Output YAML file(s) that NetObserv SNMP can read to know what devices to poll. You have to tell NetObserv SNMP to reload config.

Concerning routers: auto-discovery will query every router for its administrative loopback IP address and use that IP address instead. Whichever loopback interface appears first in the list will be the loopback IP used in auto-discovery.

You can safely rerun auto-discovery as many times as you like. If a defined 'group' of network blocks was already scanned, it will not re-scan them. See the "Output" section for more details, including how to force a re-scan.

Devices found in earlier network groups will be excluded from subsequent groups to avoid duplicate definitions.

The command will create the output directory if it doesn't exist. Default location is `/etc/elastiflow/snmp/devices`

If the auto-discovery process is taking too long or too much bandwidth, you can experiment with the `--concurrency` flag to balance speed and network load.

Auto-discovery will ignore these 'local' address ranges:

* 127.0.0.0/8
* 169.254.0.0/16
* fe80::1/10
* ::1/128

### Installing \`netobserv\` CLI Tool <a href="#install-cli-tool" id="install-cli-tool"></a>

You can download and install the `netobserv` CLI tool on Linux machines via our `deb` or `rpm` packages.

`deb`:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
sudo apt install ./netobserv_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
</code></pre>

`rpm`:

<pre><code>wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
sudo yum install -y netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

If upgrading from a previously installed `rpm`, run the following:

<pre><code>sudo rpm -Uhv netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
</code></pre>

### Running Device Auto-Discovery

{% hint style="info" %}
You will need to have NetObserv SNMP 7.12.0 (or later) already installed. That will have the latest version of the SNMP definition files. If upgrading to 7.12.0, make sure you follow the [manual upgrade steps for SNMP definition files](/additional-resources-reference-articles/faq/def_download).
{% endhint %}

#### 1. Creating the "Networks" File Input

You must tell auto-discovery which network ranges to scan. This is done via a YAML file. This file will contain:

* SNMP credentials to use for authentication
* Connection parameters (port, timeout, retries, etc.)
* Network ranges to scan

Example `networks.yml`:

```yaml
# Note: the key name "public", in this example, can be replaced with any string.
# The keys here are arbitrary strings you want to use to identify each 'set'
# of network ranges to scan.
# When auto-discovery is done, it will create new YAML files using this name.
# In this example, it will create a file called "public.yml"
# (the default location would be /etc/elastiflow/snmp/devices/public.yml)
public:
  credentials:
    - version: "1"
      community: public
    - version: "2c"
      community: public
  port: 161
  poll_interval: 60
  timeout: 2000
  retries: 2
  exponential_timeout: false
  networks:
    - 10.101.2.0/24
    - 10.101.3.0/24
    - 10.101.254.0/24

secure_network:
  credentials:
    version: "3"
    username: admin
    authentication_protocol: SHA
    authentication_passphrase: authpass
    privacy_protocol: AES
    privacy_passphrase: privpass
  networks:
    - 192.168.1.0/24
```

Details about this file format:

| Option                | Description                                                                                                                                                     |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `credentials`         | List of SNMP credential configurations to try when connecting to devices                                                                                        |
| `port`                | SNMP port to connect to (default: 161)                                                                                                                          |
| `poll_interval`       | Interval in seconds between SNMP polls (default: 60)                                                                                                            |
| `timeout`             | Timeout in milliseconds for SNMP requests (default: 3000)                                                                                                       |
| `retries`             | Number of retries for failed SNMP requests (default: 2)                                                                                                         |
| `exponential_timeout` | Whether to use exponential backoff for retries (default: false)                                                                                                 |
| `networks`            | List of network ranges to scan. Either in CIDR notation (e.g., 10.0.0.0/24) or hyphenated rang (e.g., 10.0.200.0-10.0.203.0). You can also list individual IPs. |

#### 2. Running Auto-Discovery Command

If you use all the default values, you can just run `netobserv autodiscover snmp` to do auto-discovery. Otherwise, use one of the below flags to configure how it runs.

**Command Line Interface**

```shell
netobserv autodiscover snmp [flags]
```

<table><thead><tr><th width="151">Flag</th><th width="278.359375">Default</th><th width="329.95703125">Description</th></tr></thead><tbody><tr><td><p><code>--networks</code> </p><p><code>-n</code></p></td><td><code>/etc/elastiflow/snmp/autodiscover/networks.yml</code></td><td>YAML file containing the list of network groups to discover devices from.</td></tr><tr><td><p><code>--output</code> </p><p><code>-o</code></p></td><td><code>/etc/elastiflow/snmp/devices</code></td><td>Output directory where discovered devices will be stored.</td></tr><tr><td><p><code>--mappings</code> </p><p><code>-m</code></p></td><td><code>/etc/elastiflow/snmp/autodiscover/sysoids</code></td><td>YAML file containing <code>sysObjectID</code> to device group mappings. NetObserv (starting at 7.12.0) ships with mappings.</td></tr><tr><td><p><code>--concurrency</code> </p><p><code>-c</code></p></td><td><code>100</code></td><td>Number of concurrent workers to use for device discovery.</td></tr><tr><td><p><code>--timeout</code> </p><p><code>-t</code></p></td><td><code>3000</code></td><td>Default timeout in milliseconds for each SNMP request (can be overridden in the networks file).</td></tr><tr><td><p><code>--retries</code> </p><p><code>-r</code></p></td><td><code>2</code></td><td>Default number of retries for each SNMP request (can be overridden in the networks file).</td></tr><tr><td><p><code>--poll-interval</code> </p><p><code>-p</code></p></td><td><code>60</code></td><td>Default interval in seconds between each SNMP poll when running NetObserv SNMP (can be overridden in the networks file).</td></tr><tr><td><p><code>--verbose</code> </p><p><code>-v</code></p></td><td><code>false</code></td><td>Enable verbose output (debug logging).</td></tr><tr><td><code>--overwrite</code></td><td></td><td>Normally, auto-discovery will not rescan devices for network groups it already scanned. This flag will rescan, and overwrite output files.</td></tr></tbody></table>

**Output**

When auto-discovery finishes, you can run `ls /etc/elastiflow/snmp/devices` to see additional YAML files created. Those files will have devices defined, which NetObserv SNMP will automatically load when you tell it to reapply definitions (next step).

Here's an example output file for the example input file from above:

```yaml
# /etc/elastiflow/snmp/devices/public.yml
router1_10.101.2.1:
  ip: 10.101.2.1
  port: 161
  version: 2c
  communities:
    - public
  device_groups:
    - generic

switch1_10.101.3.5:
  ip: 10.101.3.5
  port: 161
  version: 2c
  communities:
    - public
  device_groups:
    - cisco_cat_2960 # This was derived from the sysOID of the device.
```

```yaml
# /etc/elastiflow/snmp/devices/secure_network.yml
re-router:
  ip: 192.168.1.1
  port: 161
  version: 3
  v3_credentials:
    - username: admin
      authentication_protocol: SHA
      authentication_passphrase: authpass
      privacy_protocol: AES
      privacy_passphrase: privpass
  device_groups:
    - generic
```

If an output file already exists, it is preserved and unchanged. Auto-discovery will skip scanning any addresses in that network 'group.'

You can use the `--overwrite` feature to forget perviously scanned results and rescan and recreate output again.

**Explaining SysObjectID Mappings**

The `--mapping` (`-m`) flag is optional. When using this flag, you can provide a YAML file that maps SNMP sysObjectIDs to device group names. This helps categorize discovered devices based on their system object identifiers.

If the `-s` flag is not provided or if a device's `sysObjectID` does not match any mapping in the file, the device definition will use the "generic" device group by default.

ElastiFlow's comprehensive [set of sysObjectID to device group mappings](https://github.com/elastiflow/snmp/tree/main/autodiscover/sysoids) is both publicly available for download and shipped with NetObserv SNMP product.

Example `sysoid-mappings.yml`:

```yaml
.1.3.6.1.4.1.9.1.12: 'cisco_7000' # Cisco 7000 CISCO7010
.1.3.6.1.4.1.9.1.13: 'cisco_2500' # Cisco 2500 CISCO2500
.1.3.6.1.4.1.9.1.14: 'cisco_4000' # Cisco 4000 CISCO4500
```

Each entry maps a sysObjectID (OID) to a device group name. When a device is discovered with a matching sysObjectID, it will be associated with the specified device group.

#### 3. Telling NetObserv SNMP to Re-Read Device Files

Trigger the [apply-definitions API](/snmpcoll/api-reference-overview/snmp) to reload device YAML configurations.

`POST localhost:8080/api/v1/snmp/apply-definitions` should work, assuming all default settings for NetObserv SNMP.


# Device File Encryption

NetObserv SNMP supports user friendly and secure device file encryption using sops and AGE.

### Getting Started

#### Environmental Dependencies

1. Ensure [sops](https://github.com/getsops/sops) is installed in your local environment:

   ```shell
   # Change sops-v3.8.1.linux.amd64 if needed based on your environment
   curl -LO https://github.com/getsops/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64
   sudo mv sops-v3.8.1.linux.amd64 /usr/local/bin/sops
   sops --version # to verify install
   ```
2. Also ensure [age](https://github.com/FiloSottile/age) is installed in your local environment to edit via CLI:

   ```shell
   sudo apt install age # Debian based linux
   brew install age # macos
   age --version # to verify install
   ```

#### SNMP Device Encryption Configuration Settings

Please visit [Device File Encryption Settings](/snmpcoll/configuration/def_devices/device-file-encryption/device-file-encryption-settings) to learn more.

### Recommended Usage

#### Setup

The easiest and most recommended way to get started is to simply set the following as below:

```shell
EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_ENABLE=true
EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_CREATE=true
EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_TYPE="sops"
EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_PASSWORD="YourPassword"
EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_PRIVATE_KEY_FILE_PATH="/etc/elastiflow/snmp/.age/key.age"
EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_PUBLIC_KEY_FILE_PATH="/etc/elastiflow/snmp/.age/public-age-keys.txt"
```

The following behavior will occur when the SNMP collector is next restarted:

1. Generate password protected age keys at the configured file paths.
2. Encrypt device configuration .yaml files using those keys.

Once successfully encrypted with sops, the following device configuration file:

```yaml
example1:
    ip: 192.0.2.1
    port: 161
    poll_interval: 60
    timeout: 3000
    retries: 2
    exponential_timeout: false
    version: 2c
    communities:
        - public
    device_groups:
        - cisco_c1000
example2:
    ip: 192.0.2.2
    port: 161
    poll_interval: 60
    timeout: 3000
    retries: 2
    exponential_timeout: false
    version: 3
    v3_credentials:
        - username: elastiflow
          authentication_protocol: sha
          authentication_passphrase: efauthpassword
          privacy_protocol: des
          privacy_passphrase: efprivpassword
    device_groups:
        - cisco_c1000
```

will look like this:

```yaml
example1:
    ip: ENC[AES256_GCM,data:gpjHnCJA1nrz,iv:2lYG8FRUkx71aRoFHaEVcnt/6xbZPXzwuvWZTPwkFfo=,tag:SHmLptFdH3W08cmz42cTGQ==,type:str]
    port: ENC[AES256_GCM,data:Qj4t,iv:CuWtdUOnCUnWASps/8S4pt7oALlOJkaLLnqgu3IOagU=,tag:ieulT2ZnV3JeatzKTggQ6Q==,type:int]
    poll_interval: ENC[AES256_GCM,data:L2I=,iv:rAUV9i3BWCHIOh+/YrkYAhkeVyBAhvA5ZPFQTA29maY=,tag:VqhjZnn5wOtiBUpxiZRHiA==,type:int]
    timeout: ENC[AES256_GCM,data:90Vgiw==,iv:qNxs1ixW8Fk8hkZwqDegZD2j+TdGxUxTvuoZtnIT7Zs=,tag:JMKKLmKcjob5sNfwxw8Ohg==,type:int]
    retries: ENC[AES256_GCM,data:pg==,iv:ntHpk0LQ4EEJXxrYMyVgc18/8rJpZeu5zb9TwxrDVns=,tag:jbSzyKgIaH8pZCi9vhpcRw==,type:int]
    exponential_timeout: ENC[AES256_GCM,data:70ObBtA=,iv:a7/hLZdXrYqkT3Ttqp7fZVj07IepGYj22WPYYxKubfA=,tag:jZWy+yh51M9XSJ2+IAg7uQ==,type:bool]
    version: ENC[AES256_GCM,data:dtM=,iv:Z3CUC9LL7nScQzyGTHdz0ekCJ5EOKUz0H2LWU+E9np0=,tag:WH5zbMQNE0DORcVVC/Ue2A==,type:str]
    communities:
        - ENC[AES256_GCM,data:66KS7TMJ,iv:1d78b98arCfjEAIWJBl21sHmrVZBF078yoPp8hREizs=,tag:IYA+3w4+i/lG5aIEbWDz/w==,type:str]
    device_groups:
        - ENC[AES256_GCM,data:S58lX6Cy0Z+AhLA=,iv:SH8KJ1w6d4tHpSVm1PqJ/4XrVhUo6hZWFhGCMQVAJbg=,tag:q5Lsuvfv/mgv/fwX1ezlIA==,type:str]
example2:
    ip: ENC[AES256_GCM,data:WBH+84Cw2Zr8,iv:wdXcIaqrvTPscE50IhJh+JNHBKhhxAqlAR8oSBh0edg=,tag:dsUAIcVGLbm9oIj2XQMoPA==,type:str]
    port: ENC[AES256_GCM,data:OWMD,iv:bTRT7fufGSYjY+5hMgCOR73bypq113INIPAa5srQAzk=,tag:/0iO86Ky4WxLCFHPpfEqLg==,type:int]
    poll_interval: ENC[AES256_GCM,data:WGQ=,iv:Yo06+WSNM3FVsxNq4D1DuMwzw33Z3Wkb+jaejl1fFlc=,tag:UgdkI7WTdRvYmlH+RwYAcg==,type:int]
    timeout: ENC[AES256_GCM,data:8aodzQ==,iv:GC5cVU8ogqdV3wqVGudQL8kiw6vTwDRgPKOsfzZaMHs=,tag:P8pGX+BCrhQja+ggcCzdPA==,type:int]
    retries: ENC[AES256_GCM,data:Sg==,iv:6R/UTJ/UxDwOoYIwxdaNSMb8FsLdEHOvhCVPxXucr5w=,tag:ZHT31wPKwIoHQsnFueZsTA==,type:int]
    exponential_timeout: ENC[AES256_GCM,data:MAWJFDo=,iv:ajyXshSJN6ppJs16/8VZ49sOsd0LGrIbX/tdFDrFhdw=,tag:Z+oKJiMHywhzMEFyoW5rVw==,type:bool]
    version: ENC[AES256_GCM,data:nQ==,iv:whZat6BvmokGSuc99ZEWSCHY/f7hrEgbTXWPeYO7tUA=,tag:rPrEPendlnj6KX4cXSpsgg==,type:int]
    v3_credentials:
        - username: ENC[AES256_GCM,data:U3C33op0xlVI9w==,iv:TBe9m5WLcbJJA3xFeZGsBnfmYde3LqQ+XPrwKVObfxM=,tag:Vk6taTCEG5HUhsrR0xdAEg==,type:str]
          authentication_protocol: ENC[AES256_GCM,data:svZM,iv:aKP8V1z1MZpytsqTFnMXEmIEdD10WOrQSYv0Jy5gl24=,tag:TcPJoustC+4jgCN/46gOwg==,type:str]
          authentication_passphrase: ENC[AES256_GCM,data:50joswMhZyQLIav1jsM=,iv:Fk5UWMmb2yXl7cH0VW314qdyTAHGMXcWXYCAmK/OWLY=,tag:mX672yhoXFAv0jL1xAfyHw==,type:str]
          privacy_protocol: ENC[AES256_GCM,data:lXm0,iv:CVfu7stiua+8t6GqJJ9xeShwpkWb5n3ivwVZOHNqyMs=,tag:E4lnqh9xw19C/yxivypciQ==,type:str]
          privacy_passphrase: ENC[AES256_GCM,data:P39UX0UKK8kesM23Yug=,iv:CCh4x6Tp2vbkRfPqQ/cXyG99uHGbKaR1W6mBvNnDTBQ=,tag:nCE9XfaIWNiFhYSGeObqpw==,type:str]
    device_groups:
        - ENC[AES256_GCM,data:ayAD/+D3+Et71x0=,iv:r9HuTYYKPhPeNClUpJDvB71MJ1H7AvrFGamSKTbOwJw=,tag:h++ge/puz/KajkqJibjLNQ==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1l209t8c77xaysqjy5usjzknv4fzgcj4x65gjwnvrgx0chlrk6c6qna9r9d
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUEx4cUVrK0ZRMkdBUHJi
            UzlOUUx1R3BCL3lRTmgvSXQ2N2ZDQk1TemcwCkk1clBnRGV0cmFXYWNnMlZGUFEz
            akttUlR1VmgzL2taWUdJMzgwZzBBaDAKLS0tIGR6K1dtRVZMTnhJbGVPdVhNMXRD
            QkJPZG5ISlVZclRIYmQ5Y2U4UnVnYUUKlX+RKl/l+p4Banls4tIBcdi3N0XFNxVd
            g42uDbAxdy8rfBc4elKlkv4C8ruC6xh3/yBZyHeBceqjqWxkOSTVyA==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-06-11T02:16:28Z"
    mac: ENC[AES256_GCM,data:8ictB7la+azEBuLwotnHp4gEZjLb8bTEkDfyaFOmKOb2+AVxDhQ7kNvoBUrJ59ZqPB4xxveFHmCF1El1mYWMEonFuHsde9HZzgpeGNu2dlONonmjOlGlrisfcIivYCAGn+bD9DaGzkP/YMO/zjdJaCgwf+6WkxrviV29IAPoAG8=,iv:tAtcC+dMzSOFbc1EA++Q4GTDmPfjnVaWZdetkPkyhzw=,tag:gy1dLA4usoMMjnBjDlhsaQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1

```

#### Editing Encrypted Files

**It is important to note that encrypted files should not be manually edited outside of the sops CLI editor.**

To securely edit device configuration files, please use sops via the CLI:

* Non-password protected key:

  ```shell
  SOPS_AGE_RECIPIENTS=$(</etc/elastiflow/snmp/.age/public-age-keys.txt) \
  SOPS_AGE_KEY_FILE=/etc/elastiflow/snmp/.age/key.age \
  sops device.yaml
  ```
* Password protected key:

  ```shell
  SOPS_AGE_RECIPIENTS=$(</etc/elastiflow/snmp/.age/public-age-keys.txt) \
  SOPS_AGE_KEY=$(age -d /etc/elastiflow/snmp/.age/key.age) sops device.yaml
  ```

These commands will decrypt the file in memory and open with a text editor of your choice. By default, the editor used will be vim:

<figure><img src="/files/fsbqoqRK4zvAv9xCTFSl" alt=""><figcaption></figcaption></figure>

* Using nano instead of vim:

  ```shell
  EDITOR=nano \
  SOPS_AGE_RECIPIENTS=$(</etc/elastiflow/snmp/.age/public-age-keys.txt) \
  SOPS_AGE_KEY=$(age -d /etc/elastiflow/snmp/.age/key.age) sops device.yaml
  ```

Once changes are made, save and exit to update the encrypted file stored on the disk drive.


# Device File Encryption Settings

The SNMP collector can be configured to securely encrypt the SNMP device definition files using industry standard AGE encryption.

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_ENABLE

Specifies whether the device definition files will be encrypted.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_CREATE

If device file encryption is enabled (`EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_ENABLE` is `true`) this setting specifies that a keystore will automatically be created if one does not already exist.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_TYPE

If device file encryption is enabled (`EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_ENABLE` is `true`) this setting specifies the type of encryption manager the user wants to use. The two options are `sops` and `standard`. `sops` is the default option, it will only encrypt the configuration values of the configuration file, leaving the file structure intact. `standard` will simply encrypt the entire configuration file using AGE encryption.

* Valid Values
  * `sops`, `standard`
* Default
  * `sops`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_PASSWORD

The file specified in `EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_PRIVATE_KEY_FILE_PATH` can be encrypted for added security. If used in conjunction with `EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_CREATE`, then the keystore will be configured with a password protected private key.

* Default
  * `''`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_PRIVATE\_KEY\_FILE\_PATH

Sets the filepath location of the private key file. If used in conjunction with `EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_CREATE`, then the private key used in the keystore will be generated at this location.

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/snmp/.age/key.age`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_PUBLIC\_KEY\_FILE\_PATH

Sets the filepath location of the public key file. If used in conjunction with `EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_CREATE`, then the public key used in the keystore will be generated at this location.

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/snmp/.age/public-age-keys.txt`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_SECURE\_STORE\_PUBLIC\_KEY

This setting can be used in place of `EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_PUBLIC_KEY_FILE_PATH` to directly assign the public key. Cannot be used in conjunction with `EF_INPUT_SNMP_DEVICE_DEFINITIONS_SECURE_STORE_CREATE`.

* Default
  * `''`


# MIB Support

All the rules for which OIDs NetObserv SNMP will poll are tracked inside yml configuration files.

In general, you will not need to configure how OID polling works beyond what you configure in the [device configuration](/snmpcoll/configuration/def_devices).

Whenever you upgrade NetObserv, make sure you read the changelog. It will inform you if there are any additions to these OID polling settings that you need to be aware of.


# Objects

Objects define the SNMP objects and attributes that may be polled by the SNMP Input.

The location of the object definition files is specified by `EF_INPUT_SNMP_OBJECT_DEFINITIONS_DIRECTORY_PATH` in the collectors configuration options. The default location is `/etc/elastiflow/snmp/objects`.

### Configuration Example

```yaml
IF-MIB::ifEntry:
  mib: IF-MIB
  object: ifEntry
  index:
    - type: Integer
      oid: .1.3.6.1.2.1.2.2.1.1
      name: netif
      syntax: InterfaceIndex
  discovery_attribute: ifDescr
  attributes:
    ifDescr:
      oid: .1.3.6.1.2.1.2.2.1.2
      tag: true
      name: netif.descr
      syntax: DisplayString
    ifType:
      oid: .1.3.6.1.2.1.2.2.1.3
      tag: true
      name: netif.type
      syntax: IANAifType
    ifSpeed:
      oid: .1.3.6.1.2.1.2.2.1.5
      name: netif.bandwidth.bw
      syntax: Gauge32
    ifPhysAddress:
      oid: .1.3.6.1.2.1.2.2.1.6
      tag: true
      name: netif.mac
      syntax: PhysAddress
    ifAdminStatus:
      oid: .1.3.6.1.2.1.2.2.1.7
      name: netif.state.admin
      syntax: EnumInteger
    ifOperStatus:
      oid: .1.3.6.1.2.1.2.2.1.8
      name: netif.state.oper
      syntax: EnumInteger
    ifInOctets:
      oid: .1.3.6.1.2.1.2.2.1.10
      name: netif.bytes.in
      syntax: Counter32
    ifInUcastPkts:
      oid: .1.3.6.1.2.1.2.2.1.11
      name: netif.packets.ucast.in
      syntax: Counter32
    ifInDiscards:
      oid: .1.3.6.1.2.1.2.2.1.13
      name: netif.packets.discard.in
      syntax: Counter32
    ifInErrors:
      oid: .1.3.6.1.2.1.2.2.1.14
      name: netif.packets.error.in
      syntax: Counter32
    ifInUnknownProtos:
      oid: .1.3.6.1.2.1.2.2.1.15
      name: netif.packets.unkproto.in
      syntax: Counter32
    ifOutOctets:
      oid: .1.3.6.1.2.1.2.2.1.16
      name: netif.bytes.out
      syntax: Counter32
    ifOutUcastPkts:
      oid: .1.3.6.1.2.1.2.2.1.17
      name: netif.packets.ucast.out
      syntax: Counter32
    ifOutDiscards:
      oid: .1.3.6.1.2.1.2.2.1.19
      name: netif.packets.discard.out
      syntax: Counter32
    ifOutErrors:
      oid: .1.3.6.1.2.1.2.2.1.20
      name: netif.packets.error.out
      syntax: Counter32
```

### Configuration Attributes

#### mib

Contains the name of the SNMP MIB where the object is defined.

EXAMPLE: `mib: IF-MIB`

#### object

Contains the name of the SNMP object which the attributes. This is usually one level up from where the attributes are defined.

EXAMPLE: `object: ifEntry`

#### index (optional)

The Object Identifier (OID) of a value provided by an agent is made of the OID of the values definition and the ID of the index of the value within the agent. Scalar SNMP values will always have an index of `.0`. The index of values within an SNMP conceptual table is defined in the MIB by the `INDEX` clause.

This option describes the contents of the index, and how the collector will process them. The following are examples of index definitions.

{% hint style="warning" %}
Unless the object's attributes are only scalar values, you **must** include either `index` or `augments` definition.
{% endhint %}

A single value `index`:

```yaml
index:
  - type: Integer
    oid: .1.3.6.1.2.1.2.2.1.1
    name: netif
    syntax: InterfaceIndex
```

A multi-value `index`:

```yaml
index:
  - type: IpAddress
    oid: .1.3.6.1.2.1.14.17.1.1
    name: ospf.lsdb.link_local.lsa.netif # ospfLocalLsdbIpAddress
    syntax: IpAddress
  - type: Integer32
    oid: .1.3.6.1.2.1.14.17.1.2
    name: ospf.lsdb.link_local.lsa.netif # ospfLocalLsdbAddressLessIf
    syntax: InterfaceIndexOrZero
  - type: Integer
    oid: .1.3.6.1.2.1.14.17.1.3
    name: ospf.lsdb.link_local.lsa.type # ospfLocalLsdbType
    syntax: EnumInteger
  - type: IpAddress
    oid: .1.3.6.1.2.1.14.17.1.4
    name: ospf.lsdb.link_local.lsa.lsid # ospfLocalLsdbLsid
    syntax: IpAddressNoSuffix
  - type: IpAddress
    oid: .1.3.6.1.2.1.14.17.1.5
    name: ospf.lsdb.link_local.lsa.router.id # ospfLocalLsdbRouterId
    syntax: IpAddressNoSuffix # RouterID
```

**type**

Defines the type of the index value. Valid values are:

* `Integer`
* `OctetString`
* `ImplicitOctetString`
* `ObjectIdentifier`
* `ImplicitObjectIdentifier`
* `Integer32`
* `IpAddress`
* `MacAddress`
* `Unsigned32`
* `Opaque`

**oid**

The OID of the index value's MIB definition.

EXAMPLE: `oid: .1.3.6.1.2.1.2.2.1.1`

**name**

The name of the field in the output record to which the value will be assigned.

**syntax**

The syntax of the value. See below for details on all supported `syntax` values.

#### augments (optional)

An object which "augments" another object shares the `index` definition of that object.

{% hint style="warning" %}
Unless the object's attributes are only scalar values, you **must** include either `index` or `augments` definition.
{% endhint %}

EXAMPLE: `augments: IF-MIB::ifEntry`

#### discovery\_attribute

The attribute defined in the `attributes` section which will be inspected to discover all available indices.

#### attributes

The attributes section contains a list of SNMP MIB values to collect for this object.

**oid**

The OID of the value's MIB definition.

EXAMPLE: `oid .1.3.6.1.2.1.31.1.1.1.6`

**tag (optional)**

Specifies whether the attribute is "tag", also referred to as a "label" or "dimension" by various time-series datastores, or a metric value.

Default: `tag: false`

**name**

The name of the field in the output record to which the attribute's value will be assigned.

**syntax**

The syntax of the value. See below for details on all supported `syntax` values.

**overrides (optional)**

A common SNMP pattern is the instrumentation of both 32-bit and 64-bit variations of a value. In such scenarios it is unnecessary to collect both values. For example, when the 64-bit value is available it should be preferred, or "override" the 32-bit version.

This attribute defines the object and attribute that an attribute should override, if available.

EXAMPLE:

```yaml
overrides:
  object: IF-MIB::ifEntry
  attribute: ifOutOctets
```

**object**

The object of the attribute to be overridden.

**attribute**

The attribute of to be overridden.

**rediscover**

Defines whether the attribute can trigger a rediscovery, and how the value is evaluated to trigger the rediscovery. Valid values are:

* `OnChange` - Any change in the value compared to the previous poll.
* `OnReset` - A reduction in the value compared to the previous poll.

### Supported `syntax` Types

The `syntax` field specifies how the raw SNMP values should be interpreted by NetObserv SNMP. Object index and attribute definitions support the follow `syntax` values.

#### SNMPv2-SMI (RFC 2578) Types

| syntax                | output type                                                                               |
| --------------------- | ----------------------------------------------------------------------------------------- |
| Integer               | 64-bit integer                                                                            |
| IntegerAsID           | 64-bit integer, which may be stored as a string/keyword                                   |
| Integer32             | 64-bit integer                                                                            |
| UnsignedAsID          | 64-bit unsigned, which may be stored as a string/keyword                                  |
| Unsigned32            | 64-bit unsigned                                                                           |
| Gauge32               | 64-bit unsigned                                                                           |
| Counter32             | 64-bit unsigned                                                                           |
| Counter64             | 64-bit unsigned                                                                           |
| OctetString           | hex string                                                                                |
| ObjectIdentifier      | string                                                                                    |
| IpAddress             | IPv4 or IPv6 address, output with `.ip.addr` suffix added                                 |
| IpAddressNoSuffix     | IPv4 or IPv6 address, output without an added suffix                                      |
| IpAddressRoutePrefix  | IPv4 or IPv6 address with Route Distinguisher (RD) prefix, output without an added suffix |
| IpAddressAsID         | IPv4 address, output as an IP, which may be stored as a string/keyword                    |
| IpAddressAsUnsigned32 | IPv4 address, output as a unsigned 32-bit integer                                         |
| TimeTicks             | 64-bit unsigned                                                                           |
| Opaque                | hex string                                                                                |

#### SNMPv2-TC (RFC 2579) Types

| syntax             | output type                                                                                               |
| ------------------ | --------------------------------------------------------------------------------------------------------- |
| DisplayString      | string                                                                                                    |
| PhysAddress        | MAC-formatted string                                                                                      |
| MacAddress         | MAC-formatted string, output with `.addr` suffix added                                                    |
| MacAddressNoSuffix | MAC-formatted string, output without an added suffix                                                      |
| TruthValue         | enumerated `.value` & `.state`                                                                            |
| AutonomousType     | string                                                                                                    |
| InstancePointer    | string                                                                                                    |
| VariablePointer    | string                                                                                                    |
| RowPointer         | string                                                                                                    |
| RowStatus          | enumerated ID & name                                                                                      |
| TimeStamp          | duration normalized to [EF\_PROCESSOR\_DURATION\_PRECISION](/snmpcoll/configuration/enrichment-options)   |
| TimeInterval       | duration normalized to [EF\_PROCESSOR\_DURATION\_PRECISION](/snmpcoll/configuration/enrichment-options)   |
| DateAndTime        | timestamp normalized to [EF\_PROCESSOR\_TIMESTAMP\_PRECISION](/snmpcoll/configuration/enrichment-options) |
| StorageType        | enumerated ID & name                                                                                      |
| TDomain            | string                                                                                                    |
| TAddress           | hex string                                                                                                |

#### FLOAT-TC-MIB (RFC 6340) Types

| syntax  | output type  |
| ------- | ------------ |
| Float32 | 64-bit float |
| Float64 | 64-bit float |

#### HCNUM-TC (RFC 2856) Types

| syntax              | output type     |
| ------------------- | --------------- |
| CounterBasedGauge64 | 64-bit unsigned |
| ZeroBasedCounter64  | 64-bit unsigned |

#### Common MIB-defined Types

| syntax               | output type                       |
| -------------------- | --------------------------------- |
| IanaL4Proto          | enumerated `.id` & `.name`        |
| IanaSafi             | enumerated `.id` & `.name`        |
| IANAifType           | enumerated `.id` & `.name`        |
| InterfaceIndex       | output with `.index` suffix added |
| InterfaceIndexOrZero | output with `.index` suffix added |
| InetAddressType      | enumerated `.id` & `.name`        |
| InetVersion          | enumerated `.id` & `.name`        |

#### Enumerated Types

| syntax                      | output type                                                                                                |
| --------------------------- | ---------------------------------------------------------------------------------------------------------- |
| EnumBitmap                  | enumerated `.bits` & `.tags` - see [Enumerations](/snmpcoll/configuration/snmp-definition-files/def_enums) |
| EnumInteger                 | enumerated `.id` & `.name` - see [Enumerations](/snmpcoll/configuration/snmp-definition-files/def_enums)   |
| EnumIntegerKeepID           | enumerated `.id` & `.name` - see [Enumerations](/snmpcoll/configuration/snmp-definition-files/def_enums)   |
| EnumObjectIdentifier        | enumerated `.oid` & `.name` - see [Enumerations](/snmpcoll/configuration/snmp-definition-files/def_enums)  |
| EnumObjectIdentifierKeepOID | enumerated `.oid` & `.name` - see [Enumerations](/snmpcoll/configuration/snmp-definition-files/def_enums)  |

#### Unit Types

Unit types can be defined for any attribute with an underlying type of `Integer`, `Integer32`, `Unsigned32`, `Gauge32`, `Counter32`, `Counter64`, `Float32` or `Float64`.

**Bandwidth Types**

Bandwidth types are normalized to **bits/sec** and output as a **64-bit unsigned** value.

| syntax          | description                      |
| --------------- | -------------------------------- |
| BandwidthBits   | bits                             |
| BandwidthKBits  | kilobits (`1000` bits)           |
| BandwidthMBits  | megabits (`1000000` bits)        |
| BandwidthGBits  | gigabits (`1000000000` bits)     |
| BandwidthTBits  | terabits (`1000000000000` bits)  |
| BandwidthBytes  | bytes (`8` bits)                 |
| BandwidthKBytes | kilobytes (`8000` bits)          |
| BandwidthMBytes | megabytes (`8000000` bits)       |
| BandwidthGBytes | gigabytes (`8000000000` bits)    |
| BandwidthTBytes | terabytes (`8000000000000` bits) |

**Byte Types**

Byte types are normalized to **bytes** and output as a **64-bit unsigned** value.

| syntax   | description                       |
| -------- | --------------------------------- |
| BytesB   | bytes                             |
| BytesB4  | 4-byte units                      |
| BytesKB  | kilobytes (`1000` bytes)          |
| BytesMB  | megabytes (`1000000` bytes)       |
| BytesGB  | gigabytes (`1000000000` bytes)    |
| BytesTB  | terabytes (`1000000000000` bytes) |
| BytesKiB | kibibytes (`1024` bytes)          |
| BytesMiB | mebibytes (`1048576` bytes)       |
| BytesGiB | gibibytes (`1073741824` bytes)    |
| BytesTiB | tibibytes (`1099511627776` bytes) |

**Decibel Types**

Decibel types are normalized to **decibels** and output as a **64-bit float** value.

| syntax  | description |
| ------- | ----------- |
| Decibel | decibels    |

**Signal Level Types**

Signal Level types are normalized to **dBm** and output as a **64-bit float** value.

| syntax         | description       |
| -------------- | ----------------- |
| SignalDBm      | dBm               |
| SignalDeciDBm  | 1/10th of a dBm   |
| SignalCentiDBm | 1/100th of a dBm  |
| SignalMilliDBm | 1/1000th of a dBm |

**Current Types**

Current types are normalized to **amps** and output as a **64-bit float** value.

| syntax          | description       |
| --------------- | ----------------- |
| CurrentKiloAmp  | kiloamps          |
| CurrentAmp      | amps              |
| CurrentDeciAmp  | 1/10th of an amp  |
| CurrentCentiAmp | 1/100th of an amp |
| CurrentMilliAmp | milliamps         |
| CurrentMicroAmp | microamps         |
| CurrentNanoAmp  | nanoamps          |

**Energy Types**

Energy types are normalized to **joules** and output as a **64-bit float** value.

| syntax           | description        |
| ---------------- | ------------------ |
| EnergyGigaJoule  | gigajoules         |
| EnergyMegaJoule  | megajoules         |
| EnergyKiloJoule  | kilojoules         |
| EnergyJoule      | joules             |
| EnergyDeciJoule  | 1/10th of a joule  |
| EnergyCentiJoule | 1/100th of a joule |
| EnergyMilliJoule | millijoules        |
| EnergyMicroJoule | microjoules        |
| EnergyNanoJoule  | nanojoules         |

**Timestamp Types**

Timestamp types are normalized to **a quantity of time units since epoch**, as specified by [EF\_PROCESSOR\_TIMESTAMP\_PRECISION](/snmpcoll/configuration/enrichment-options), and output as a **64-bit unsigned** value.

| syntax        | description                      |
| ------------- | -------------------------------- |
| EpochSec      | seconds since epoch              |
| EpochDeciSec  | 1/10ths of a second since epoch  |
| EpochCentiSec | 1/100ths of a second since epoch |
| EpochMilliSec | milliseconds since epoch         |
| EpochMicroSec | microseconds since epoch         |
| EpochNanoSec  | nanoseconds since epoch          |

**Frequency Types**

Frequency types are normalized to **hertz** and output as a **64-bit float** value.

| syntax      | description |
| ----------- | ----------- |
| FreqGHz     | gigahertz   |
| FreqMHz     | megahertz   |
| FreqKHz     | kilohertz   |
| FreqHz      | hertz       |
| FreqDeciHz  | decihertz   |
| FreqCentiHz | centihertz  |
| FreqMilliHz | millihertz  |

**Length Types**

Length types are normalized to **meters** and output as a **64-bit float** value.

| syntax           | description |
| ---------------- | ----------- |
| LengthKiloMeter  | kilometers  |
| LengthMeter      | meters      |
| LengthDeciMeter  | decimeters  |
| LengthCentiMeter | centimeters |
| LengthMilliMeter | millimeters |
| LengthMicroMeter | micrometers |
| LengthNanoMeter  | nanometers  |

**Operation Duration Types**

Operation Duration types are normalized to **nanoseconds** and output as a **64-bit float** value.

| syntax                 | description          |
| ---------------------- | -------------------- |
| OpTicksSec             | seconds              |
| OpTicksDeciSec         | 1/10ths of a second  |
| OpTicksCentiSec        | 1/100ths of a second |
| OpTicksMilliSec        | milliseconds         |
| OpTicksHundredMicroSec | 100 microseconds     |
| OpTicksTenMicroSec     | 10 microseconds      |
| OpTicksMicroSec        | microseconds         |
| OpTicksHundredNanoSec  | 100 nanoseconds      |
| OpTicksTenNanoSec      | 10 nanoseconds       |
| OpTicksNanoSec         | nanoseconds          |
| OpTicksHundredPicoSec  | 100 picoseconds      |
| OpTicksTenPicoSec      | 10 picoseconds       |
| OpTicksPicoSec         | picoseconds          |

**Percentage Types**

Percentage types are normalized to **either a 0-1 or 0-100 based percentage**, as specified by [EF\_PROCESSOR\_PERCENT\_NORM](/snmpcoll/configuration/enrichment-options), and output as a **64-bit float** value.

| syntax          | description                                      |
| --------------- | ------------------------------------------------ |
| Percent1        | 0-1 based percentage                             |
| PercentDeci1    | 0-1 based percentage in 1/10ths of a percent     |
| PercentCenti1   | 0-1 based percentage in 1/100ths of a percent    |
| PercentMilli1   | 0-1 based percentage in 1/1000ths of a percent   |
| Percent100      | 0-100 based percentage                           |
| PercentDeci100  | 0-100 based percentage in 1/10ths of a percent   |
| PercentCenti100 | 0-100 based percentage in 1/100ths of a percent  |
| PercentMilli100 | 0-100 based percentage in 1/1000ths of a percent |

**Power Types**

Power types are normalized to **watts** and output as a **64-bit float** value.

| syntax         | description |
| -------------- | ----------- |
| PowerGigaWatt  | gigawatts   |
| PowerMegaWatt  | megawatts   |
| PowerKiloWatt  | kilowatts   |
| PowerWatt      | watts       |
| PowerDeciWatt  | deciwatts   |
| PowerCentiWatt | centiwatts  |
| PowerMilliWatt | milliwatts  |
| PowerMicroWatt | microwatts  |
| PowerNanoWatt  | nanowatts   |

**Rate Types**

Rate types are normalized to **quantity/sec** and output as a **64-bit float** value.

| syntax       | description                        |
| ------------ | ---------------------------------- |
| RateMin      | a quantity per minute              |
| RateSec      | a quantity per second              |
| RateDeciSec  | a quantity per 1/10th of a second  |
| RateCentiSec | a quantity per 1/100th of a second |
| RateMilliSec | a quantity per millisecond         |
| RateMicroSec | a quantity per microsecond         |
| RateNanoSec  | a quantity per nanosecond          |

**Temperature Types**

Temperature types are normalized to **degrees celsius** and output as a **64-bit float** value.

| syntax            | description              |
| ----------------- | ------------------------ |
| TemperatureC      | degrees celsius          |
| TemperatureDeciC  | 1/10th degrees celsius   |
| TemperatureCentiC | 1/100th degrees celsius  |
| TemperatureMilliC | 1/1000th degrees celsius |

**Duration Types**

Duration types are normalized to **a quantity of time units**, as specified by [EF\_PROCESSOR\_DURATION\_PRECISION](/snmpcoll/configuration/enrichment-options), and output as a **64-bit unsigned** value.

| syntax        | description          |
| ------------- | -------------------- |
| TicksMin      | minutes              |
| TicksSec      | seconds              |
| TicksDeciSec  | 1/10ths of a second  |
| TicksCentiSec | 1/100ths of a second |
| TicksMilliSec | milliseconds         |
| TicksMicroSec | microseconds         |
| TicksNanoSec  | nanoseconds          |

**Voltage Types**

Voltage types are normalized to **volts** and output as a **64-bit float** value.

| syntax           | description        |
| ---------------- | ------------------ |
| VoltageKiloVolt  | kilovolts          |
| VoltageVolt      | volts              |
| VoltageDeciVolt  | 1/10ths of a volt  |
| VoltageCentiVolt | 1/100ths of a volt |
| VoltageMilliVolt | millivolts         |
| VoltageMicroVolt | microvolts         |
| VoltageNanoVolt  | nanovolts          |

**Wavelength Types**

Wavelength types are normalized to **nanometers** and output as a **64-bit float** value.

| syntax               | description |
| -------------------- | ----------- |
| WavelengthKiloMeter  | kilometers  |
| WavelengthMeter      | meters      |
| WavelengthDeciMeter  | decimeters  |
| WavelengthCentiMeter | centimeters |
| WavelengthMilliMeter | millimeters |
| WavelengthMicroMeter | micrometers |
| WavelengthNanoMeter  | meters      |


# Object Groups

Object Groups organize [Objects](/snmpcoll/configuration/snmp-definition-files/def_objects) together which may be implemented by a managed entity. For example, a network interface may contain attributes from the standard interfaces tables, ethernet tables and vendor-specific extension tables. These objects can be organized into a common object group so that they can be easily applied to applicable [Device Groups](/snmpcoll/configuration/snmp-definition-files/def_device_groups).

The location of the object group definition files is specified by `EF_INPUT_SNMP_OBJECT_GROUP_DEFINITIONS_DIRECTORY_PATH` in the collectors configuration options. The default location is `/etc/elastiflow/snmp/object_groups`.

### Configuration Example

```yaml
netif:
  objects:
    - IF-MIB::system
    - IF-MIB::ifEntry
    - IF-MIB::ifXEntry
    - EtherLike-MIB::dot3StatsEntry
    - EtherLike-MIB::dot3ControlEntry
    - EtherLike-MIB::dot3PauseEntry
    - EtherLike-MIB::dot3HCStatsEntry
```

#### objects

Defines a list of [Objects](/snmpcoll/configuration/snmp-definition-files/def_objects) which are included in the Object Group.


# Device Groups

Device Groups organize [Object Groups](/snmpcoll/configuration/snmp-definition-files/def_object_groups) together which may be instrumented by a model or series of device. For example, a Juniper MX-series router will include object groups for various standards-based entities, such as interfaces and routing protocols, and Juniper-specific entities like chassis components and protocol extensions.

The location of the device group definition files is specified by `EF_INPUT_SNMP_DEVICE_GROUP_DEFINITIONS_DIRECTORY_PATH` in the collectors configuration options. The default location is `/etc/elastiflow/snmp/device_groups`.

### Configuration Example

```yaml
generic:
  object_groups:
    - system
    - host
    - netif
    - ip
    - icmp
    - tcp
    - udp
    - snmp
```

#### object\_groups

Defines a list of [Object Groups](/snmpcoll/configuration/snmp-definition-files/def_object_groups) which are included in the Device Group.


# Enumerations

Enumeration allow for integer and OID values to be translated to their text values.

The location of the enumeration definition files is specified by `EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH` in the collectors configuration options. The default location is `/etc/elastiflow/snmp/enums`. Enumeration lookups must also be enabled by setting `EF_PROCESSOR_SNMP_ENUM_ENABLE` to `true`.

### Bitmap Enumerations

Bitmap enumerations are evaluated when the attribute `syntax` is `EnumBitmap`.

EXAMPLE:

```yaml
# mplsTunnelCRLDPResFlags
.1.3.6.1.2.1.10.166.3.2.10.1.5:
  0: 'PDR' # PDR
  1: 'PBS' # PBS
  2: 'CDR' # CDR
  3: 'CBS' # CBS
  4: 'EBS' # EBS
  5: 'weight' # Weight
```

### Integer Enumerations

Integer enumerations are evaluated when the attribute `syntax` is `EnumInteger` or `EnumIntegerKeepID`.

EXAMPLE:

```yaml
#ifOperStatus
.1.3.6.1.2.1.2.2.1.8:
  1: 'up' # up
  2: 'down' # down
  3: 'testing' # testing
  4: 'unknown' # unknown
  5: 'dormant' # dormant
  6: 'not present' # notPresent
  7: 'lower-layer down' # lowerLayerDown
```

### Object Identifier (OID) Enumerations

Object Identifier (OID) enumerations are evaluated when the attribute `syntax` is `EnumObjectIdentifier` or `EnumObjectIdentifierKeepOID`.

EXAMPLE:

```yaml
# hrStorageType - hrStorageTypes
.1.3.6.1.2.1.25.2.1.1: 'other' # hrStorageOther
.1.3.6.1.2.1.25.2.1.2: 'RAM' # hrStorageRam
.1.3.6.1.2.1.25.2.1.3: 'virtual memory' # hrStorageVirtualMemory
.1.3.6.1.2.1.25.2.1.4: 'fixed disk' # hrStorageFixedDisk
.1.3.6.1.2.1.25.2.1.5: 'removable disk' # hrStorageRemovableDisk
.1.3.6.1.2.1.25.2.1.6: 'floppy disk' # hrStorageFloppyDisk
.1.3.6.1.2.1.25.2.1.7: 'compact disc' # hrStorageCompactDisc
.1.3.6.1.2.1.25.2.1.8: 'RAM disk' # hrStorageRamDisk
.1.3.6.1.2.1.25.2.1.9: 'flash memory' # hrStorageFlashMemory
.1.3.6.1.2.1.25.2.1.10: 'network disk' # hrStorageNetworkDisk
```


# General Configuration


# Licensing

#### Requesting a License

You can request a [Basic License](https://www.elastiflow.com/basic-license) via the [ElastiFlow website](https://www.elastiflow.com/basic-license). This license will be good for one year, after which it can be renewed by requesting a new license. The Basic License only supports polling of Standard MIBS (IEEE and IETF).

You can also request a [30-day Premium Trial License](https://www.elastiflow.com/trial) via the [ElastiFlow website](https://www.elastiflow.com/trial). This license can only be renewed with approval of ElastiFlow. To request an extension, please send an email to <sales@elastiflow.com>.

The license key for ElastiFlow Premium Tier customers will be made available through our support system. A ticket will be opened, from which an authorized user can download the license key.

#### Adding a License

The following is an example of a license configuration, as defined in a docker-compose file:

```yaml
EF_LICENSE_ACCEPTED: 'true'
EF_ACCOUNT_ID: '606abcdefe3546eee123456a'

EF_LICENSE_KEY: 'eyJhbGciOiJIUzI1HghIEjTUI6IkpXVCJ9.eyJhdWQiOiJKNHHFYTFKNJKHgkjKjknhLjKJkhyiiutUYfyrdIutKjsYXN0aWZsb3ciLCJzdWIiOiI2MDNkODUwMDMzZDg2YjA3OTE5YjE5Y2EiLCJjb3IiOjEyOCwibHZsIjo5fQ.FQtYWSWutfjn9q6876GHgf5fghir45vsuDnxrDldbd7xR8'
```

and as defined in the systemd configuration:

```conf
export EF_LICENSE_ACCEPTED=true
export EF_ACCOUNT_ID=606abcdefe3546eee123456a

export EF_LICENSE_KEY=eyJhbGciOiJIUzI1HghIEjTUI6IkpXVCJ9.eyJhdWQiOiJKNHHFYTFKNJKHgkjKjknhLjKJkhyiiutUYfyrdIutKjsYXN0aWZsb3ciLCJzdWIiOiI2MDNkODUwMDMzZDg2YjA3OTE5YjE5Y2EiLCJjb3IiOjEyOCwibHZsIjo5fQ.FQtYWSWutfjn9q6876GHgf5fghir45vsuDnxrDldbd7xR8
```

### Licensing Configuration

#### EF\_LICENSE\_ACCEPTED

To use ElastiFlow NetObserv it is necessary to accept the terms of the License Agreement. By running this software, you and/or the organization using the software agree and are bound to the terms of an ElastiFlow Inc. End-User License Agreement (EULA). For the Community (no license key), Basic and Trial tiers, the applicable license is the ElastiFlow Community EULA, which may be found at: <https://www.elastiflow.com/community-license>. For Standard and Premium Commercial tiers the applicable license is the ElastiFlow Standard EULA, or other terms agreed in writing with ElastiFlow Inc. The ElastiFlow Standard EULA may be found at: <https://www.elastiflow.com/commercial-license>.

* Default
  * `false`

#### EF\_ACCOUNT\_ID

License keys are generated per account. This field must contain the Account ID for the License Key specified in `EF_LICENSE_KEY`.

#### EF\_LICENSE\_KEY

This field contains the License Key issued for this instance of collector. EF\_ACCOUNT\_ID must also contain the Account ID to which this key belongs.

#### EF\_LICENSE\_TELEMETRY\_HOSTS

NetObserv SNMP is licensed by telemetry hosts, the number of SNMP devices polled by the collector. The maximum number of telemetry hosts will be set based on the provided license key. However, this maximum can be configured manually for a given instance. This is usually done when it is desired to use multiple instances of the collector. For example, a subscription for 100 telemetry hosts can be split into 2 instances, of 50 telemetry hosts each, by setting `EF_LICENSE_TELEMETRY_HOSTS: 50` for each instance. If set to a value greater than allowed by the license key, the instances will be started with the telemetry hosts based on the license key.

* Default
  * `0` (uses the telemetry hosts based on the license)

#### EF\_SNMP\_LICENSED\_UNITS

{% hint style="danger" %}
This configuration option is only relevant for legacy license keys that license the collector based on units. The concept of units is marked for deprecation. New license keys will license the collector based on telemetry hosts and the `EF_LICENSE_TELEMETRY_HOSTS` should be used.
{% endhint %}

NetObserv SNMP is licensed by ***units*** of 4000 *objects*, where an *object* is a unique instance of an [object definition](/snmpcoll/configuration/snmp-definition-files/def_objects) for which data is being collected.

By default, the number of ***units*** will be set based on the provided license key. However, the number of ***units*** to be used by an instance can be configured manually. This is usually done when it is desired to use multiple instances of the collector. For example, a subscription for 8 licensed ***units*** can be split into 2 instances, of 4 ***units*** each, by setting `EF_SNMP_LICENSED_UNITS: 4` for each instance. If set to a value greater than allowed by the license key, the instances will be started with the number of ***units*** from the license key.

The default value of `1` is the number of ***units*** allowed under the `community` and `basic` subscription tiers. See <https://www.elastiflow.com/subscriptions> for more details about subscription options.

* Default
  * `1`


# Logging

By default NetObserv can be configured to log to stdout or to a file. It can also be configured to log with `json` or `console` formatting. If logging to a file, log rotation can be configured to manage the volume of logs.

#### EF\_LOGGER\_LEVEL

Specifies the output level for logging.

* Valid Values
  * `debug`, `info`, `warn`, `error`, `panic`, `fatal`
* Default
  * `info`

#### EF\_LOGGER\_ENCODING

Specifies the output format of the produced logs.

* Valid Values
  * `console`, `json`
* Default
  * `json`

#### EF\_LOGGER\_FILE\_LOG\_ENABLE

Set to `true` to enable writing logs to a file.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_LOGGER\_FILE\_LOG\_FILENAME

If file logging is enabled (`EF_LOGGER_FILE_LOG_ENABLE` is `true`) this option specifies the path to the file where the logs will be written.

* Default
  * NetObserv Flow: `/var/log/elastiflow/flowcoll/flowcoll.log`
  * NetObserv SNMP: `/var/log/elastiflow/snmpcoll/snmpcoll.log`

#### EF\_LOGGER\_FILE\_LOG\_MAX\_SIZE

This option specifies the maximum size in megabytes of the log file before it is rotated. The default is `100` megabytes.

* Valid Values
  * Any integer greater than `1`.
* Min Value
  * `1`
* Default
  * `100`

#### EF\_LOGGER\_FILE\_LOG\_MAX\_AGE

This option specifies the maximum number of days to retain old log files based on the timestamp encoded in their filename. Note that a day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc. The default is not to remove old log files based on age.

* Valid Values
  * Any integer greater than or equal to `0`.
* Default
  * `''`

#### EF\_LOGGER\_FILE\_LOG\_MAX\_BACKUPS

This option specifies the maximum number of old log files to retain. The default is to retain 4 old log files.

{% hint style="info" %}
Log files may be removed due to there age, as configured by `EF_LOGGER_FILE_LOG_MAX_AGE`, even if the maximum number of backups isn't reached.
{% endhint %}

* Valid Values
  * Any integer greater than or equal to `0`.
* Default
  * `4`

#### EF\_LOGGER\_FILE\_LOG\_COMPRESS

Set to `true` to enable compression of log files.

* Valid Values
  * `true`, `false`
* Default
  * `false`


# SNMP Poller Input

NetObserv SNMP can poll devices for metrics, status and other telemetry using SNMP.

#### EF\_INPUT\_SNMP\_POLLER\_WORKER\_POOL\_SIZE

When objects are scheduled for SNMP polling, a pool of pollers is initialized to allow concurrent polls for that specific device. This configuration controls the maximum number of pollers allowed across all devices. If a device is scheduled and the total number of pollers exceeds this value, a warning will be logged while still initializing all pollers. The default size of this pool is 4 times the number of CPU threads (real cores + HT/SMT threads). This setting allows a specific pool size to be configured.

* Minimum Value
  * `1`
* Default
  * `CPU threads * 4`

#### EF\_INPUT\_SNMP\_POLLER\_ERROR\_HANDLING

This configuration determines the approach of the SNMP poller in managing SNMP Get request errors. There are three modes:

1. Full Error Handling: The SNMP poller will drop objects for all types of Get request errors for that object. However, this mode is not advised for production environments, as it may lead to unnecessary dropping of objects.
2. Partial Error Handling: In this mode, the SNMP poller drops objects only for errors that are not transient. This is more selective and avoids reacting to temporary issues.
3. No Error Handling: The SNMP poller will not drop any objects.

* Valid Values
  * `none`, `partial`, `full`
* Default
  * `partial`

#### EF\_INPUT\_SNMP\_DEVICE\_DEFINITIONS\_DIRECTORY\_PATH

This setting specifies the path to the directory where the [Device](/snmpcoll/configuration/def_devices) definitions files are located.

* Default
  * `/etc/elastiflow/snmp/devices`

#### EF\_INPUT\_SNMP\_DEVICE\_GROUP\_DEFINITIONS\_DIRECTORY\_PATH

This setting specifies the path to the directory where the [Device Group](/snmpcoll/configuration/snmp-definition-files/def_device_groups) definitions files are located.

* Default
  * `/etc/elastiflow/snmp/device_groups`

#### EF\_INPUT\_SNMP\_OBJECT\_GROUP\_DEFINITIONS\_DIRECTORY\_PATH

This setting specifies the path to the directory where the [Object Group](/snmpcoll/configuration/snmp-definition-files/def_object_groups) definitions files are located.

* Default
  * `/etc/elastiflow/snmp/object_groups`

#### EF\_INPUT\_SNMP\_OBJECT\_DEFINITIONS\_DIRECTORY\_PATH

This setting specifies the path to the directory where the [Object](/snmpcoll/configuration/snmp-definition-files/def_objects) definitions files are located.

* Default
  * `/etc/elastiflow/snmp/objects`

#### EF\_INPUT\_SNMP\_DEFAULTS\_DIRECTORY\_PATH

This setting specifies the path to the directory where the [Device](/snmpcoll/configuration/def_devices) default definition files are located.

* Default
  * `/etc/elastiflow/snmp/defaults`

#### EF\_INPUT\_SNMP\_PERSIST\_ENABLE

NetObserv SNMP can persist the discovered inventory of SNMP objects, preventing the need for the inventory to be rebuilt when the collector is restarted. This setting specifies whether this feature is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `true`

#### EF\_INPUT\_SNMP\_PERSIST\_DIRECTORY\_PATH

When inventory persistence is enabled (`EF_INPUT_SNMP_PERSIST_ENABLE` is `true`), this setting specifies the path to the directory where the files will be written.

* Default
  * `/usr/share/elastiflow/snmpcoll`


# SNMP Processor

### Processor Configuration Options

#### EF\_PROCESSOR\_POOL\_SIZE[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_pool_size) <a href="#ef_processor_pool_size" id="ef_processor_pool_size"></a>

Specifies the number of 'processors' to start. In other words, how many logical threads of execution to run at once when processing input. For NetObserv Flow, you will need at least one (1) processor for every 2000 records/second. Increasing the number of processors will allow the collector to better handle a high volume of high latency enrichment tasks such as DNS lookups for IP addresses. We see diminishing returns for a processor pool size of greater than 32.

{% hint style="info" %}
While increasing the number of processors can be beneficial, there are diminishing returns at higher processor counts. This is especially true when the number of processors exceeds the number of available CPU threads (real cores + SMT threads) or vCPUs. If you require more than 64 processors, and are using a Standard or Premium License, it may be more beneficial to use multiple collector instances.
{% endhint %}

The minimum value is `2`. If you configure this to be '1', it will change to '2'.

If you configure it to '0', it will use the default value, as explained below (the same as not setting it at all).

* Default
  * `4 * the number of 'units' supported`
    * for NetObserv Flow, a 'unit' equals `flows per second supported / 4000`
    * for NetObserv SNMP, a 'unit' equals `hosts supported / 40`
    * for NetObserv SNMP Trap, a 'unit' equals `hosts supported / 40`

{% hint style="info" %}
Your license (if you are using one) will support a certain amount of flows per second (for NetObserv Flow) and/or hosts per second (for NetObserv SNMP and NetObserv SNMP Trap). However, you can manually configure any instance of NetObserv to use *less* than the maximum supported by the license. This helps support horizontal scaling. If you do that, the default value will base its calculation off of the manually configured limit.
{% endhint %}

#### EF\_PROCESSOR\_TRANSLATE\_KEEP\_IDS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_translate_keep_ids) <a href="#ef_processor_translate_keep_ids" id="ef_processor_translate_keep_ids"></a>

Specifies which identifier values will be included in the final dataset.

* Valid Values
  * `none` - All identifiers are removed from the final dataset.
  * `default` - Most identifiers are removed from the final dataset. However, some identifiers which are required for common use-cases (e.g. raw protocol port values) are included.
  * `all` - All identifiers are included in the final dataset.
* Default
  * `default`

#### EF\_PROCESSOR\_DURATION\_PRECISION[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_duration_precision) <a href="#ef_processor_duration_precision" id="ef_processor_duration_precision"></a>

The desired precision of duration-related values. Values received at a different precision than specified will be converted to the desired precision.

* Valid Values
  * `sec` - seconds
  * `ds` - deciseconds
  * `cs` - centiseconds
  * `ms` - milliseconds
  * `us` - microseconds
  * `ns` - nanoseconds
* Default
  * `ms`

{% hint style="info" %}
For most data sources this should milliseconds (`ms`)
{% endhint %}

#### EF\_PROCESSOR\_TIMESTAMP\_PRECISION[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_timestamp_precision) <a href="#ef_processor_timestamp_precision" id="ef_processor_timestamp_precision"></a>

The desired precision of timestamp values. Values received at a different precision than specified will be converted to the desired precision.

* Valid Values
  * `sec` - seconds
  * `ds` - deciseconds
  * `cs` - centiseconds
  * `ms` - milliseconds
  * `us` - microseconds
  * `ns` - nanoseconds
* Default
  * `ms`

{% hint style="info" %}
For most data stores, e.g. Elasticsearch, this should milliseconds (`ms`)
{% endhint %}

#### EF\_PROCESSOR\_PERCENT\_NORM[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_percent_norm) <a href="#ef_processor_percent_norm" id="ef_processor_percent_norm"></a>

The desired representation of percentages. Values received with a different representation than specified will be converted to the desired representation.

* Valid Values
  * `1` - values will be based on a scale of 0-1.
  * `100` - values will be based on a scale of 0-100.
* Default
  * `100`

#### EF\_PROCESSOR\_KEEP\_CPU\_TICKS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_keep_cpu_ticks) <a href="#ef_processor_keep_cpu_ticks" id="ef_processor_keep_cpu_ticks"></a>

For telemetry sources which provide CPU usage as timeticks, utilization percentages will be calculated. If this setting is set `false` the timetick values will be removed from the final dataset. If `true` they will be kept, in addition to the utilization values.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_PROCESSOR\_DROP\_FIELDS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_drop_fields) <a href="#ef_processor_drop_fields" id="ef_processor_drop_fields"></a>

This setting allows for a comma-separated list of fields that are to be removed from all records. The fields are dropped after all enrichment and *PRIOR* to the records being sent to the enabled outputs.

{% hint style="info" %}
The conversion from the default CODEX schema to alternate schemas, e.g. Elastic's ECS or Splunk's CIM, happens within the respective outputs. As fields are dropped *PRIOR* to the outputs, CODEX field names must be used to configure this option.
{% endhint %}

* Valid Values
  * any CODEX-schema field names, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`


# User-Defined Metadata

The IP address enrichment module provides supplemental information for IP addresses, such as hostname and additional user-defined metadata. Values are cached for improved performance and flow record throughput. For more control of when enrichment is applied, IP addresses can be included or excluded from various enrichers by CIDR, IP range or individual IP address.

This page provide detailed information about [User-Defined Metadata Enrichment](#user-defined-metadata-enrichment) and [Scoping Enrichment with Include/Exclude](#scoping).

### User-Defined Metadata Enrichment

An example of the format of this file is:

```yaml
# Additional options are name, vlan, tags and metadata.
192.0.2.192/26:
  name: atlanta_guest_wifi
  tags:
    - wifi
    - dhcp
  metadata:
    dhcp.pool.name: atlanta_guest_wifi
    .site.id: atlanta

# Metadata fields beginning with a . will be organized under the object containing the IP address.
192.0.2.194-192.0.2.198:
  metadata:
    .site.bldg.id: hq
    .site.floor.id: 2
    .site.rack.id: 1

# An individual IP address.
192.0.2.194:
  metadata:
    device.type.name: wifi_ap
```

#### Metadata Types

The User-Defined Metadata enricher supports a combination of pre-defined metadata types as well as the ability to provide custom data as key-value pairs. This section describes the various metadata types. The following table provides a summary of these types.

| Attribute  | Data Type              | Field Populated                        | Description                                                            |
| ---------- | ---------------------- | -------------------------------------- | ---------------------------------------------------------------------- |
| `name`     | string                 | `<object>.ip.subnet.name`              | The name given to this subnet.                                         |
| `tags`     | array of strings       | `<object>.ip.subnet.tags`              | Tags that describe attributes of the subnet or IP.                     |
| `metadata` | sequence of attributes | `<object><attribute>` or `<attribute>` | Key-value pairs which will be added at the IP object or record levels. |

**name**

`name` is a string attribute to provide a user-friendly name to a subnet which is relevant to the user or organization.

{% hint style="danger" %}
Only a single `name` value is returned for a given IP address. Care should be taken to ensure that there are no conflicting names among overlapping CIDRs, Ranges and IP addresses. If you must assign multiple values, these should be add to the `tags` attribute.
{% endhint %}

**tags**

`tags` is an array of string values for attributes that further describe the CIDR, Range or IP address.

**metadata**

`metadata` is a list of key-value pairs which will be added as fields to the record. These can either be *custom* fields specific to the needs of the user, or existing fields from the ElastiFlow CODEX schema. When CODEX fields are specified, the configured metadata value will override any values that already exist in the record.

{% hint style="info" %}
If you have enabled ECS (Elasticsearch/OpenSearch) or CIM (Splunk) support and want to override values from these schemas, you must specify the CODEX equivalent fields in the `metadata` attribute. Metadata is applied in the decoder portion of the collector, where all data is still in the CODEX schema. Conversion to other schemas is output-specific and thus occurs at a later phase of processing.
{% endhint %}

Key names can be specified with or without a leading `.`.

* If specified ***with*** a leading `.`, the field will be placed within the parent object containing the IP address.
* If specified ***without*** a leading `.`, the field will be placed at the root of the record.

Consider an IP address from `system.ip.addr`:

* If the metadata key is defined as `.site.name`, the value would be assigned to `system.site.name`.
* If the metadata key is defined as `site.name`, the value would be assigned directly to `site.name`.

#### Merging Values from Multiple Definitions

Attribute values for an IP address which matches multiple CIDR, Range or IP address entries will be merged into a single result set. Consider the following example:

```yaml
192.168.0.0/16:
  metadata:
    .geo.loc.coord: 48.167106,11.486918
    .geo.city.name: Munich
    .geo.country.code: DE
    .geo.country.name: Germany
    .geo.tz.name: Europe/Berlin

192.168.1.0/24:
  name: munich_hq
  tags:
    - campus
  metadata:
    sec.zone.name: campus

192.168.1.151-192.168.1.200:
  tags:
    - guest_wifi
    - dhcp
  metadata:
    .host.name: guest_wifi
    .ip.addr: 192.168.1.0
```

Here you have:

* the whole Class C private network `192.168.0.0/16` with some location metadata.
* a `/24` block of that network that is tagged as the campus network, and also the firewall zone to which it belongs.
* a range of those IP addresses that belong to the guest WiFi and are provided by DHCP.

Given a value for `system.ip.addr` of `192.168.1.152`, which matches all three entries in the above configuration, the resulting enrichment fields added to the record would be:

```yaml
system.ip.subnet.name: munich_hq
system.ip.subnet.tags: [campus guest_wifi dhcp]
system.geo.loc.coord: 48.167106,11.486918
system.geo.city.name: Munich
system.geo.country.code: DE
system.geo.country.name: Germany
system.geo.tz.name: Europe/Berlin
sec.zone.name: campus
system.host.name: guest_wifi
system.ip.addr: 192.168.1.0
```

{% hint style="info" %}
The last two values above demonstrate one of the use-cases for User-Defined Metadata. The `host.name` and `ip.addr` have been overridden to more generic static values, thus anonymizing the individual guest WiFi users. This allows the traffic to still be collected and analyzed, without tracking each guest individually. Network or security operations can investigate suspect traffic which they may want to block, while preserving individual guests' privacy.
{% endhint %}

### Scoping Enrichment with Include/Exclude <a href="#scoping" id="scoping"></a>

The Hostname/DNS enrichment can be scoped to a subset of IP addresses by specifying specific Autonomous Systems or CIDRs to be included or excluded. These include/exclude definitions are provided via a YAML file which can be updated and refreshed without the need to restart the collector.

**An Example of include/exclude definitions:**

```yaml
include:
  asn:
    - 14168
  cidr:
    - 10.0.0.0/8
    - 192.168.0.0/16
exclude:
  #asn:
  #  -
  cidr:
    - 192.168.100.0/24
```

#### Evaluation of Include/Exclude Definitions

It is important to understand how include/exclude definitions are evaluated to ensure your configuration provides the desired outcome. The following rules apply:

1. If no specific include values are defined, ***everything*** is included.
2. Exclude values are evaluated within the scope of included values.

Consider the following examples:

{% hint style="info" %}
While the following examples use only CIDRs, the same logic applies when ASN values are specified.
{% endhint %}

**no include/exclude definitions**

```yaml
# no path provided or an empty file
```

If no include/excludes are defined, ***everything*** is included.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✓**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✓**     |

**only include is defined**

```yaml
include:
  cidr:
    - 10.0.0.0/8
```

Only those IP addresses within a defined AS or CIDR are included. In this example, only IPs within the CIDR `10.0.0.0/8` are included.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✕**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✓**     |

**only exclude is defined**

```yaml
exclude:
  cidr:
    - 10.111.0.0/16
```

All IP addresses that are ***not*** specifically excluded by the defined AS or CIDR are included. In this example, all IPs *except* those within the CIDR `10.111.0.0/16` are included.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✓**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✕**     |

**both include and exclude are defined**

```yaml
include:
  cidr:
    - 10.0.0.0/8
exclude:
  cidr:
    - 10.111.0.0/16
```

Only those IP addresses within a specified AS or CIDR are included, ***EXCEPT*** those within an excluded AS or CIDR.

| IP Address  | Included? |
| ----------- | --------- |
| 192.168.0.1 | **✕**     |
| 10.0.0.1    | **✓**     |
| 10.111.0.1  | **✕**     |

* `192.168.0.1` is ***not*** included as it is not within an included AS or CIDR.
* `10.0.0.1` is included as it is within an included AS or CIDR.
* `10.111.0.1` is ***not*** included. While is does fall within the range of an included CIDR, it is also with a CIDR than is specifically excluded.


# Metadata Configuration Options

The User-Defined Metadata allows for additional information to be added to a record for a given IP address. It can also be used to override existing fields. Metadata maybe specified for CIDR blocks, IP ranges or individual IP addresses.

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_ENABLE

Specifies whether the user-defined metadata enrichment is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_USERDEF\_PATH

If the user-defined metadata enrichment is enabled (`EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE` is `true`) this setting specifies the path to the metadata file. If this value is undefined or empty, metadata enrichment will be disabled.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality, refer to: [User-Defined Metadata Enrichment](/snmpcoll/configuration/enrichment-options/enrich_ip_udm#user-defined-metadata-enrichment)

* Default
  * `''`
* Recommended
  * `/etc/elastiflow/metadata/ipaddrs.yml`

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_REFRESH\_RATE

The file specified in `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH` can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of `0` disables refreshing of the values.

* Default
  * `15`&#x20;

### EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_API\_ENABLE

Enable the REST/gRPC/connectrpc [API for User-Defined Metadata](/flowcoll/overview/api-based-metadata-enrichment). To enable this feature, [`EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE`](#ef_processor_enrich_ipaddr_metadata_enable) must also be set to `true`.

If the API is enabled, after startup of NetObserv, the file configured with `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH` is never re-read, and should not be modified by hand, only via the API.

If this field is `false` (and `EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE` is `true`), then the API is disabled, and any updates to the `EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH` file must be done manually. As mentioned above, in that case the refresh rate can be configured using `EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE`.

* Valid Values
  * `true`, `false`
* Default
  * `false`


# Network Interfaces

TO-DO!!! - This page is not linked in the sidebar, as the feature is not yet added to NetObserv SNMP. Flow records generally include the index of ingress and egress interfaces by which the network traffic traversed the exporting device. The Unified Flow Collector will attempt to determine the names, and additional attributes, of these interfaces as learned from Netflow v9 or IPFIX option records, determined by polling the exporting device using SNMP or specified in user-defined metadata.

The network interface enrichment module provides supplemental information for network interface, such as name (ifName), description (ifDescr), alias (ifAlias), type (ifType), bandwidth (ifSpeed/ifHighSpeed), committed information rate (CIR), user-defined tags, and additional user-defined metadata. Values are cached for improved performance and flow record throughput.

This page provide detailed information about [User-Defined Metadata Enrichment](#user-defined-metadata-enrichment).

### User-Defined Metadata Enrichment

An example of the format of this file is:

```yaml
10.0.0.1:
  1:
    ifName: lo
    ifDescr: lo
    ifAlias: lo
    ifType: 24
    ifSpeed: 10000000
    tags:
      - router_mgmt
    metadata:
      sec.zone.name: network
  3:
    internal: false
    ifName: eth0
    ifDescr: eth0
    ifAlias: internet
    ifType: 6
    ifSpeed: 1000000000
    cirIn: 200000000
    cirOut: 12000000
    tags:
      - verizon
    metadata:
      sec.zone.name: internet

10.0.0.2:
  501:
    ifName: vlan
    ifDescr: vlan
    ifSpeed: 1000000000
  502:
    ifName: ge-0/0/0
    ifDescr: ge-0/0/0
    ifSpeed: 1000000000
```

#### Metadata Types

The User-Defined Metadata enricher supports a combination of pre-defined metadata types as well as the ability to provide custom data as key-value pairs. This section describes the various metadata types. The following table provideas a summary of these types.

| Attribute  | Data Type              | Field Populated                                      | Description                                                                                                                                                                                                            |
| ---------- | ---------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ifName`   | string                 | `<object>.netif.name`                                | The textual name of the interface. The value of this object should be the name of the network interface as assigned by the device.                                                                                     |
| `ifDescr`  | string                 | `<object>.netif.descr`                               | A textual string containing information about the network interface.                                                                                                                                                   |
| `ifAlias`  | string                 | `<object>.netif.alias`                               | An administratively defined "alias" name for the interface.                                                                                                                                                            |
| `ifType`   | unsigned               | `<object>.netif.type.id`, `<object>.netif.type.name` | The type of interface as specified in IF-MIB (RFC 2233). Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA) via updates to the syntax of the `IANAifType` textual convention. |
| `ifSpeed`  | unsigned               | `<object>.netif.bandwidth.bw`                        | The interface's bandwidth in bits per second.                                                                                                                                                                          |
| `cirIn`    | unsigned               | `<object>.netif.bandwidth.prov.in`                   | The interface's ingress provisioned maximum bandwidth in bits per second.                                                                                                                                              |
| `cirOut`   | unsigned               | `<object>.netif.bandwidth.prov.out`                  | The interface's egress provisioned maximum bandwidth in bits per second.                                                                                                                                               |
| `internal` | bool                   | `<object>.isInternal`                                | Specifies whether or not the network interface is connected to a network considered to be "internal".                                                                                                                  |
| `tags`     | array of strings       | `<object>.netif.tags`                                | Tags that describe attributes of the network interface.                                                                                                                                                                |
| `metadata` | sequence of attributes | `<object><attribute>` or `<attribute>`               | Key-value pairs which will be added at the network interface object or record levels.                                                                                                                                  |

**metadata**

`metadata` is a list of key-value pairs which will be added as fields to the record. These can either be *custom* fields specific to the needs of the user, or existing fields from the ElastiFlow CODEX schema. When CODEX fields are specified, the configured metadata value will override any values that already exist in the record.

{% hint style="info" %}
If you have enabled ECS (Elasticsearch/OpenSearch) or CIM (Splunk) support and want to override values from these schemas, you must specify the CODEX equivalent fields in the `metadata` attribute. Metadata is applied in the decoder portion of the collector, where all data is still in the CODEX schema. Conversion to other schemas is output-specific and thus occurs at a later phase of processing.
{% endhint %}

Key names can be specified with or without a leading `.`.

* If specified ***with*** a leading `.`, the field will be placed within the parent object containing the network interface.
* If specified ***witouth*** a leading `.`, the field will be placed at the root of the record.

Consider a network interface from `flow.in.netif.index`:

* If the metadata key is defined as `.circuit.name`, the value would be assigned to `flow.in.netif.circuit.name`.
* If the metadata key is defined as `circuit.name`, the value would be assigned directly to `circuit.name`.


# Outputs


# Elasticsearch

The Elasticsearch output can be used to send records to Elasticsearch and Elastic Cloud.

### Download Kibana Objects

ElastiFlow's Kibana dashboards and related configuration artifacts can be easily imported. You must first download the relevant import file, depending on the configuration of your environment.

#### Kibana Objects for SNMP Telemetry Data

| Version                      | Schema | Saved Objects                                                                                                                                                                 |
| ---------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 8.2.0 and later              | CODEX  | [kibana-8.2.x-snmp-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/snmp/kibana-8.2.x-snmp-codex.ndjson)                 |
| 8.2.0 and later              | ECS    | [kibana-8.2.x-snmp-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/snmp/kibana-8.2.x-snmp-ecs.ndjson)                     |
| 7.17.x - 8.1.x (unsupported) | CODEX  | [kibana-7.17.x-snmp-codex.ndjson (unsupported)](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/snmp/kibana-7.17.x-snmp-codex.ndjson) |
| 7.17.x - 8.1.x (unsupported) | ECS    | [kibana-7.17.x-snmp-ecs.ndjson (unsupported)](https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/snmp/kibana-7.17.x-snmp-ecs.ndjson)     |

### Import Kibana Objects

#### Importing via the User Interface

To import the configuration, in Kibana go to *Stack Management* --> *Saved Objects* and click *Import* in the upper right corner.

![Saved Objects Before](https://user-images.githubusercontent.com/10326954/109737687-c132b900-7bc6-11eb-8ec7-843e8d48dcdc.png)

A sidebar will appear. Again click *Import* at the top of the sidebar.

![Import](https://user-images.githubusercontent.com/10326954/109737831-05be5480-7bc7-11eb-942f-33e3958ee44b.png)

Select the file which you downloaded, and click the *Import* button at the bottom of the sidebar.

The configuration will be imported, and you will see all of the imported objects.

![Imported](https://user-images.githubusercontent.com/10326954/109738035-651c6480-7bc7-11eb-929d-d42ce9263c1d.png)

Close the sidebar. You will also see all of the imported objects in the *Saved Objects* list.

![Saved Objects After](https://user-images.githubusercontent.com/10326954/109738146-972dc680-7bc7-11eb-946c-156799f3487e.png)

#### Importing via the API

```shell
curl -XPOST "https://username:password@IPORHOSTOFKIBANA:5601/api/saved_objects/_import?overwrite=true" -k -H "kbn-xsrf: true" -H "securitytenant: global" --form file=@kibana-7.14.x-ecs-light.ndjson
```

#### Troubleshooting Import Problems

When the Kibana import fails, neither the import UI nor the Kibana logs will provide any useful information. However, attempting to import via `curl` will usually provide more detail.

The most common issue is related to the relative large size of the Kibana Saved Objects file. This can cause the import to fail unless the maximum allowed payload size is increased. The Kibana setting is `server.maxPayloadBytes` (or `SERVER_MAXPAYLOADBYTES` if using Docker), which should also be set to `8388608`.

If you have a reverse proxy in front of Kibana, you may have to modify your proxy settings as well. Many reverse proxies also have relatively low values for the maximum body size. For example, the NGINX default is only 1MB. This can be increased by setting `client_max_body_size` to `8388608`. Refer to the documentation for your proxy software to similarly modify its behavior.

### Recommended Kibana Advanced Settings

#### Settings for All Kibana Distributions

You may find that modifying a few of the Kibana advanced settings will produce a more user-friendly experience while using ElastiFlow. These settings are made in Kibana, under `Stack Management -> Kibana -> Advanced Settings`.

| Advanced Setting              | Value             | Why make the change?                                                                                                                                                                                                                                                               |
| ----------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| filters:pinnedByDefault       | `true`            | Pinning a filter allows it to persist when you are changing dashboards. This is very useful when drilling-down into something of interest and you want to change dashboards for a different perspective of the same data. This is the #1 setting we recommend changing.            |
| defaultRoute                  | *see description* | If your primary or only use-case for Kibana is ElastiFlow, set this the URL path for the dashboard to which you which to load immediately after logging in, or when returning to "home". The format of this value is `/app/dashboards#/view/4a608bc0-3d3e-11eb-bc2c-c5758316d788`. |
| doc\_table:highlight          | `false`           | There be a query performance penalty that comes with using the highlighting feature. As it isn't very useful for this use-case, it is better to just turn it off.                                                                                                                  |
| state:storeInSessionStorage   | `true`            | Kibana URLs can get pretty large. Especially when working with Vega visualizations. This will likely result in error messages for users of Internet Explorer. Using in-session storage will fix this issue for these users.                                                        |
| theme:darkMode                | `true` or `false` | Enable dark mode for the Kibana UI. This setting should match the `ndjson` import file discussed above.                                                                                                                                                                            |
| timepicker:timeDefaults       | *see below*       | The Time Picker Quick Range to use when Kibana is started without one.                                                                                                                                                                                                             |
| timepicker:quickRanges        | *see below*       | The default options in the Time Picker are less than optimal, for most logging and monitoring use-cases. Fortunately Kibana now allows you to customize the time picker. Our recommended settings can be found below.                                                              |
| format:number:defaultPattern  | `0,0.[00]`        | Default numeral format for the "number" format.                                                                                                                                                                                                                                    |
| format:percent:defaultPattern | `0,0.[00]%`       | Default numeral format for the "percent" format.                                                                                                                                                                                                                                   |

**Recommended Time Picker Time Defaults (timepicker:timeDefaults)**

We find that the following Time Picker Time Default provides more useful views of the data for network flow-related use-cases.

```json
{
  "from": "now-1h/m",
  "to": "now"
}
```

**Recommended Time Picker Quick Ranges (timepicker:quickRanges)**

We find that the following set of Time Picker Quick Ranges provides more useful views of the data for network flow-related use-cases.

```json
[
  {
    "from": "now-15m/m",
    "to": "now/m",
    "display": "Last 15 minutes"
  },
  {
    "from": "now-30m/m",
    "to": "now/m",
    "display": "Last 30 minutes"
  },
  {
    "from": "now-1h/m",
    "to": "now/m",
    "display": "Last 1 hour"
  },
  {
    "from": "now-2h/m",
    "to": "now/m",
    "display": "Last 2 hours"
  },
  {
    "from": "now-4h/m",
    "to": "now/m",
    "display": "Last 4 hours"
  },
  {
    "from": "now-12h/m",
    "to": "now/m",
    "display": "Last 12 hours"
  },
  {
    "from": "now-24h/m",
    "to": "now/m",
    "display": "Last 24 hours"
  },
  {
    "from": "now-48h/m",
    "to": "now/m",
    "display": "Last 48 hours"
  },
  {
    "from": "now-7d/m",
    "to": "now/m",
    "display": "Last 7 days"
  },
  {
    "from": "now-30d/m",
    "to": "now/m",
    "display": "Last 30 days"
  },
  {
    "from": "now-60d/m",
    "to": "now/m",
    "display": "Last 60 days"
  },
  {
    "from": "now-90d/m",
    "to": "now/m",
    "display": "Last 90 days"
  }
]
```

#### Settings for Elastic's X-Pack Features

The following settings require that NetObserv Flow is used with an Elastic Stack deployment licensed for X-Pack Basic or higher. The collector's Elasticsearch output must also be configured with ECS-support enabled (set `EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE` to `true`).

| Advanced Setting                   | Value                       | Why make the change?                                                                                                                          |
| ---------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| securitySolution:ipReputationLinks | *see below*                 | Modifying these settings provides a more seamless integration with the ElastiFlow NetIntel service while using Kibana's Security app.         |
| securitySolution:defaultIndex      | add `elastiflow-flow-ecs-*` | Add the ElastiFlow index pattern, with support for ECS, to populate the Kibana's Security app with data network flow records from ElastiFlow. |
| securitySolution:timeDefaults      | *see below*                 | For the best experience set this value similar to `timepicker:timeDefaults`.                                                                  |

**Recommended IP Reputation Links (securitySolution:ipReputationLinks)**

```json
[
  { "name": "ElastiFlow NetIntel", "url_template": "https://elastiflow.com/netintel/search?ip={{ip}}" },
  { "name": "VirusTotal", "url_template": "https://www.virustotal.com/gui/search/{{ip}}" }
]
```

**Recommended Security Solution Time Defaults (securitySolution:timeDefaults)**

We find that the following Security Solution Time Default provides more useful views of the data for network flow-related use-cases.

```json
{
  "from": "now-1h/m",
  "to": "now"
}
```


# Elasticsearch Configuration Options

## EF\_OUTPUT\_ELASTICSEARCH\_ENABLE

Specifies whether the Elasticsearch output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to the Elasticsearch bulk API.

* Default
  * `2000`

## EF\_OUTPUT\_ELASTICSEARCH\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to the Elasticsearch bulk API.

* Default
  * `8388608`

## EF\_OUTPUT\_ELASTICSEARCH\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Elasticsearch output's default value for this setting was changed to `collect`. This will allow the collector to handle a wider variety of situations without additional configuration. If you wish to continue to use the old default setting of `end`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_PERIOD

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Elasticsearch output's default value for this setting was changed to `rollover`. This will enable the use of Index Lifecycle Management (ILM) to manage retention of ElastiFlow indices. If you wish to continue to use the old default setting of `daily`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `daily` - New indices will be created each day. The format of the time period suffix will be `-yyyy.MM.dd`.
  * `weekly` - New indices will be created each week. The format of the time period suffix will be `-yyyy.'w'ww`.
  * `monthly` - New indices will be created each month. The format of the time period suffix will be `-yyyy.MM`.
  * `rollover` - Index Lifecycle Management (ILM) will be used to handle the creation and deletion of indices. If no ILM policy is defined, a default policy will be created. The rollover alias is determined automatically. If the rollover alias does not exist, an initial write index will be bootstrapped with the rollover alias.
* Default
  * `rollover`

## EF\_OUTPUT\_ELASTICSEARCH\_TSDS\_ENABLE

{% hint style="info" %}
Only supported in NetObserv Flow and NetObserv SNMP. For NetObserv SNMP, support was introduced in 7.13.0
{% endhint %}

Elasticsearch 8.7 introduced TSDS (time series data stream) feature. Storing flow and telemetry data using TSDS can result in a storage savings of 50-70% depending on the content of the flow records. TSDS also supports downsampling (initially for bytes and packets fields) which can result in even less storage capacity needed for historical data. Enabling TSDS does increase the ingest-related CPU load for Elasticsearch. Setting this value to `true` will enable TSDS support.

{% hint style="info" %}
Enabling TSDS requires NetObserv to push new index templates. Please shut down the collector and remove ElastiFlow index templates before you enable TSDS. After you restart the collector you should see new index templates being created.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `false`

If set to `true`:

* the option `EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD` will be set to `rollover`, overriding any user-provided value.
* the option `EF_OUTPUT_ELASTICSEARCH_STORAGE_OPTIMIZATION_ENABLE` will be set to `false`, overriding any user-provided value.

### TSDS Metric Support Note

For NetObserv SNMP, only some fields will be marked as a '[metric](https://www.elastic.co/docs/manage-data/data-store/data-streams/time-series-data-stream-tsds#time-series-metric)' to Elasticsearch, which impacts downsampling. More specifically, the `time_series_metric` field is only set for a subset of fields in the Elasticsearch templates that NetObserv SNMP creates when it starts.

Initially, only IETF MIB objects will have TSDS metric support. ElastiFlow leverages the [snmp definition files](https://github.com/elastiflow/snmp/tree/main) (which ship with the product) to control which fields are supported as a TSDS metric. If you see the field "metric" assigned to a field (see [IP-MIB](https://github.com/elastiflow/snmp/blob/main/objects/ietf/IP-MIB.yml) for an example), it means that those fields will have time\_series\_metric defined in the Elaticsearch templates that NetObserv SNMP creates.

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_SUFFIX

It can sometimes be useful to have separate indices for different environments, locations or other organizational units. This setting allows you to specify a suffix that will be added to the index for such purposes.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ENABLE

Specifies whether the output should attempt to add the required index template to Elasticsearch.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_OVERWRITE

If the output is configured to add the index template to Elasticsearch (`EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ENABLE` is `true`), this setting determines whether the index template should be overwritten if it already exists.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_SHARDS

The number of shards with which the index should be created. As a general rule, additional shards increase ingest performance, assuming there are sufficient data nodes across which the shards can be distributed.

* Recommended
  * Equal to the number of Elasticsearch data nodes to which data will be indexed.
* Default
  * `3`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REPLICAS

The number of replicas that should be created for each shard. If using a multi-node cluster and data redundancy is desired, this value must be at least `1`.

In general, additional replicas will increase query performance, assuming there are sufficient data nodes across which the replicas can be distributed.

* Recommended
  * `1` if indexing data to a multi-node cluster.
  * `0` for a single-node.
* Default
  * `1`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL

Specifies the period for the refresh interval. The refresh interval is the time window in which newly ingested documents are added to a segment, prior to the segment being added to the index. Only after the refresh interval has ended and the segment has been added to the index do the documents become searchable.

* Recommended
  * `5s` - If the data needs to become available for queries more quickly. However shorter refresh intervals will negatively impact ingest performance.
  * `30s` - (or longer) If maximizing ingest performance is the highest priority. Longer refresh intervals negatively impact the real-time accessibility of new records.
  * `10s` or `20s` - This is a reasonable compromise between ingest performance and data accessibility for most network traffic analytics use-cases.
* Default
  * `20s`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_CODEC

The setting determines the level of compression used for stored values.

* Valid Values
  * `default` - Stored values are compressed using LZ4.
  * `best_compression` - Stored values are compressed using DEFLATE. This reduces disk capacity requirements with the trade-off of slightly higher CPU utilization.
* Default
  * `best_compression`

{% hint style="info" %}
This setting configures the index template sent to Elasticsearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ILM\_LIFECYCLE

If data is being stored to an Elasticsearch cluster with Index Lifecycle Management (ILM) features enabled, this setting specifies the name of the ILM Lifecycle that should be applied to the indices.

{% hint style="info" %}
The ILM Lifecycle itself MUST be configured separately in Elasticsearch.
{% endhint %}

* Default
  * `elastiflow`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT

If it is desired to process the incoming with an Elasticsearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the default pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL

If it is desired to process the incoming with an Elasticsearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the final pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_SYNTHETIC\_SOURCE\_ENABLE

If set to `true`, this setting will configure the index template to use the synthetic `_source` field. This will improve storage efficiency, but may reduce the performance of some queries.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_ADDRESSES

This setting specifies the Elasticsearch servers to which the output should connect. It is a comma-separated list of Elasticsearch nodes, including port number. We recommend specifying a maximum of 6 to 8 Elasticsearch servers here. If you require sending data directly to more than 6 to 8 servers, consider using an Elastic "coordinating node".

{% hint style="danger" %}
Do **NOT** include `http://` or `https://` in the provided value. TLS communications is enabled/disabled using `EF_OUTPUT_ELASTICSEARCH_TLS_ENABLE`.
{% endhint %}

* Default
  * `127.0.0.1:9200`

## EF\_OUTPUT\_ELASTICSEARCH\_USERNAME

The username to use when connecting to Elasticsearch.

* Default
  * `elastic`

## EF\_OUTPUT\_ELASTICSEARCH\_PASSWORD

The password to use when connecting to Elasticsearch.

* Default
  * `changeme`

## EF\_OUTPUT\_ELASTICSEARCH\_CLOUD\_ID

The URI for the Elastic Cloud endpoint to which the output should connect. If set, this value overrides `EF_OUTPUT_ELASTICSEARCH_ADDRESSES`.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_API\_KEY

The base64-encoded token to use for authorization.

Elasticsearch provides [Security APIs](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api.html#security-api-keys) to:

* [Create API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html)
* [Get API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-api-key.html)
* [Invalidate API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-invalidate-api-key.html)
* [Clear API key cache](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-api-key-cache.html)
* [Grant API key](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-grant-api-key.html)

If set, this value overrides `EF_OUTPUT_ELASTICSEARCH_USERNAME` and `EF_OUTPUT_ELASTICSEARCH_PASSWORD`.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for client PKI authentication.

* Default
  * `''`

To use PKI authentication, your Elasticsearch cluster needs to be configured for such a setup. Here is a [guide](https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication). The collectors require the use of a [role mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role-mapping.html) with a "superuser" role. Alternatively, a custom role that can contain the privileges allowing the collectors to read/create/update/delete indices, and read/create/update/delete data to/from indices.

## EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CERT\_FILEPATH

The path to the client certificate to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_KEY\_FILEPATH

The path to the client key to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Elasticsearch.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Elasticsearch server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_ELASTICSEARCH\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the Elasticsearch server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_ENABLE

Specifies whether to retry connecting to Elasticsearch after a connection has failed.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE

Specifies whether to retry bulk indexing requests which have timed-out.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_MAX\_RETRIES

Specifies the number of times to retry bulk indexing requests which have timed-out.

* Default
  * `3`

## EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_BACKOFF

If set, this value specifies the quantity of milliseconds that the output should "backoff" prior to retrying a failed bulk request.

* Default
  * `1000`

## EF\_OUTPUT\_ELASTICSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE

This setting is used to enable/disable the storage optimization feature. This feature will configure the index sort setting in the index template to optimize the storage of the data.

{% hint style="info" %}
`EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD` will be overridden to `rollover` when this setting is enabled.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_ELASTICSEARCH\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_ELASTICSEARCH\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. This is particularly useful when used with multiple namespaced outputs, e.g. sending flow records to one datastore and telemetry to another.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric'`


# OpenSearch

The OpenSearch output can be used to send records to [OpenSearch](https://opensearch.org/) and [Amazon OpenSearch Service](https://aws.amazon.com/opensearch-service/).

OpenSearch Dashboards enable you to interactively explore, visualize, and share insights into your network flow data, as well as manage and monitor OpenSearch.

### Download OpenSearch Dashboards Objects

The OpenSearch dashboards and related configuration artifacts can be easily imported. You must first download the relevant import file, depending on the configuration of your environment.

#### Dashboards for SNMP Telemetry Data

| Version           | Schema | Saved Objects                                                                                                                                                        |
| ----------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 2.x               | CODEX  | [dashboards-2.0.x-snmp-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/snmp/dashboards-2.0.x-snmp-codex.ndjson) |
| 2.x               | ECS    | [dashboards-2.0.x-snmp-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/snmp/dashboards-2.0.x-snmp-ecs.ndjson)     |
| 1.x (unsupported) | CODEX  | [dashboards-1.0.x-snmp-codex.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/snmp/dashboards-1.0.x-snmp-codex.ndjson) |
| 1.x (unsupported) | ECS    | [dashboards-1.0.x-snmp-ecs.ndjson](https://raw.githubusercontent.com/elastiflow/elastiflow_for_opensearch/main/dashboards/snmp/dashboards-1.0.x-snmp-ecs.ndjson)     |

### Import OpenSearch Dashboards Objects

#### Importing via the User Interface

To import the configuration, in OpenSearch Dashboards go to *Stack Management* --> *Saved Objects* and click *Import* in the upper right corner.

#### Importing via the API

```shell
curl -XPOST "https://username:password@IPORHOST:5601/api/saved_objects/_import?overwrite=true" -k -H "osd-xsrf: true" -H "securitytenant: global" --form file=@dashboards-1.0.x-codex-light.ndjson
```

#### Troubleshooting Import Problems

When the OpenSearch Dashboards import fails, neither the import UI nor the OpenSearch Dashboards logs will provide any useful information. However, attempting to import via `curl` will usually provide more detail.

The most common issue is related to the relative large size of the OpenSearch Dashboards Saved Objects file. This can cause the import to fail unless the maximum allowed payload size is increased. The OpenSearch Dashboards setting is `server.maxPayloadBytes` (or `SERVER_MAXPAYLOADBYTES` if using Docker), which should also be set to `8388608`.

If you have a reverse proxy in front of OpenSearch Dashboards, you may have to modify your proxy settings as well. Many reverse proxies also have relatively low values for the maximum body size. For example, the NGINX default is only 1MB. This can be increased by setting `client_max_body_size` to `8388608`. Refer to the documentation for your proxy software to similarly modify its behavior.

### Recommended OpenSearch Dashboards Advanced Settings

You may find that modifying a few of the OpenSearch Dashboards advanced settings will produce a more user-friendly experience while using ElastiFlow. These settings are made in OpenSearch Dashboards, under `Stack Management -> Advanced Settings`.

<table><thead><tr><th width="197.42578125">Advanced Setting</th><th width="108.68359375">Value</th><th>Why make the change?</th></tr></thead><tbody><tr><td>filters:pinnedByDefault</td><td><code>true</code></td><td>Pinning a filter allows it to persist when you are changing dashboards. This is very useful when drilling-down into something of interest and you want to change dashboards for a different perspective of the same data. This is the #1 setting we recommend changing.</td></tr><tr><td>defaultRoute</td><td><em>see description</em></td><td>If your primary or only use-case for OpenSearch Dashboards is ElastiFlow, set this the URL path for the dashboard to which you which to load immediately after logging in, or when returning to "home". The format of this value is <code>/app/dashboards#/view/4a608bc0-3d3e-11eb-bc2c-c5758316d788</code>.</td></tr><tr><td>doc_table:highlight</td><td><code>false</code></td><td>There be a query performance penalty that comes with using the highlighting feature. As it isn't very useful for this use-case, it is better to just turn it off.</td></tr><tr><td>state:storeInSessionStorage</td><td><code>true</code></td><td>OpenSearch Dashboards URLs can get pretty large. Especially when working with Vega visualizations. This will likely result in error messages for users of Internet Explorer. Using in-session storage will fix this issue for these users.</td></tr><tr><td>theme:darkMode</td><td><code>true</code> or <code>false</code></td><td>Enable dark mode for the OpenSearch Dashboards UI. This setting should match the <code>ndjson</code> import file discussed above.</td></tr><tr><td>timepicker:timeDefaults</td><td><em>see below</em></td><td>The Time Picker Quick Range to use when OpenSearch Dashboards is started without one.</td></tr><tr><td>timepicker:quickRanges</td><td><em>see below</em></td><td>The default options in the Time Picker are less than optimal, for most logging and monitoring use-cases. Fortunately OpenSearch Dashboards now allows you to customize the time picker. Our recommended settings can be found below.</td></tr><tr><td>format:number:defaultPattern</td><td><code>0,0.[00]</code></td><td>Default numeral format for the "number" format.</td></tr><tr><td>format:percent:defaultPattern</td><td><code>0,0.[00]%</code></td><td>Default numeral format for the "percent" format.</td></tr></tbody></table>

#### Recommended Time Picker Time Defaults (timepicker:timeDefaults)

We find that the following Time Picker Time Default provides more useful views of the data for network flow-related use-cases.

```json
{
  "from": "now-1h/m",
  "to": "now"
}
```

#### Recommended Time Picker Quick Ranges (timepicker:quickRanges)

We find that the following set of Time Picker Quick Ranges provides more useful views of the data for network flow-related use-cases.

```json
[
  {
    "from": "now-15m/m",
    "to": "now/m",
    "display": "Last 15 minutes"
  },
  {
    "from": "now-30m/m",
    "to": "now/m",
    "display": "Last 30 minutes"
  },
  {
    "from": "now-1h/m",
    "to": "now/m",
    "display": "Last 1 hour"
  },
  {
    "from": "now-2h/m",
    "to": "now/m",
    "display": "Last 2 hours"
  },
  {
    "from": "now-4h/m",
    "to": "now/m",
    "display": "Last 4 hours"
  },
  {
    "from": "now-12h/m",
    "to": "now/m",
    "display": "Last 12 hours"
  },
  {
    "from": "now-24h/m",
    "to": "now/m",
    "display": "Last 24 hours"
  },
  {
    "from": "now-48h/m",
    "to": "now/m",
    "display": "Last 48 hours"
  },
  {
    "from": "now-7d/m",
    "to": "now/m",
    "display": "Last 7 days"
  },
  {
    "from": "now-30d/m",
    "to": "now/m",
    "display": "Last 30 days"
  },
  {
    "from": "now-60d/m",
    "to": "now/m",
    "display": "Last 60 days"
  },
  {
    "from": "now-90d/m",
    "to": "now/m",
    "display": "Last 90 days"
  }
]
```


# OpenSearch Configuration Options

## EF\_OUTPUT\_OPENSEARCH\_ENABLE

Specifies whether the OpenSearch output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to the OpenSearch bulk API.

* Default
  * `2000`

## EF\_OUTPUT\_OPENSEARCH\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to the OpenSearch bulk API.

* Default
  * `8388608`

## EF\_OUTPUT\_OPENSEARCH\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the OpenSearch output's default value for this setting was changed to `collect`. This will allow the collector to handle a wider variety of situations without additional configuration. If you wish to continue to use the old default setting of `end`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_PERIOD

{% hint style="info" %}
Beginning with ElastiFlow `7.11.0` the OpenSearch output's default value for this setting will be changed to `rollover`. This will enable the use of Index State Management (ISM) to manage retention of ElastiFlow indices. If you wish to continue to use the old default setting of `daily`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `daily` - New indices will be created each day. The format of the time period suffix will be `-yyyy.MM.dd`.
  * `weekly` - New indices will be created each week. The format of the time period suffix will be `-yyyy.'w'ww`.
  * `monthly` - New indices will be created each month. The format of the time period suffix will be `-yyyy.MM`.
  * `rollover` - Index State Management will be used to handle the creation and deletion of indices.
* Default
  * `rollover`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_SUFFIX

It can sometimes be useful to have separate indices for different environments, locations or other organizational units. This setting allows you to specify a suffix that will be added to the index for such purposes.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ENABLE

Specifies whether the output should attempt to add the required index template to OpenSearch.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_OVERWRITE

If the output is configured to add the index template to OpenSearch (`EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_ENABLE` is `true`), this setting determines whether the index template should be overwritten if it already exists.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_SHARDS

The number of shards with which the index should be created. As a general rule, additional shards increase ingest performance, assuming there are sufficient data nodes across which the shards can be distributed.

* Recommended
  * Equal to the number of OpenSearch data nodes to which data will be indexed.
* Default
  * `3`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REPLICAS

The number of replicas that should be created for each shard. If using a multi-node cluster and data redundancy is desired, this value must be at least `1`.

In general, additional replicas will increase query performance, assuming there are sufficient data nodes across which the replicas can be distributed.

* Recommended
  * `1` if indexing data to a multi-node cluster.
  * `0` for a single-node.
* Default
  * `1`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL

Specifies the period for the refresh interval. The refresh interval is the time window in which newly ingested documents are added to a segment, prior to the segment being added to the index. Only after the refresh interval has ended and the segment has been added to the index do the documents become searchable.

* Recommended
  * `5s` - If the data needs to become available for queries more quickly. However, shorter refresh intervals will negatively impact ingest performance.
  * `30s` - (or longer) If maximizing ingest performance is the highest priority. Longer refresh intervals negatively impact the real-time accessibility of new records.
  * `10s` or `20s` - This is a reasonable compromise between ingest performance and data accessibility for most network traffic analytics use-cases.
* Default
  * `20s`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_CODEC

The setting determines the level of compression used for stored values.

* Valid Values
  * `default` - Stored values are compressed using LZ4.
  * `best_compression` - Stored values are compressed using DEFLATE. This reduces disk capacity requirements with the trade-off of slightly higher CPU utilization.
* Default
  * `best_compression`

{% hint style="info" %}
This setting configures the index template sent to OpenSearch. It does NOT change any existing indices.
{% endhint %}

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ISM\_POLICY

If data is being stored to an Open Distro for OpenSearch cluster, this setting specifies the Index State Management (ISM) Policy ID that should be applied to the indices.

{% hint style="info" %}
The ISM Policy itself MUST be configured separately in OpenSearch. If `EF_OUTPUT_OPENSEARCH_INDEX_PERIOD` is set to `rollover` a default ISM policy will be added automatically with the name defined in this setting.
{% endhint %}

* Default
  * `elastiflow`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT

If it is desired to process the incoming with an OpenSearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the default pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL

If it is desired to process the incoming with an OpenSearch Ingest Pipeline prior to it being indexed, this setting specifies the name of the final pipeline.

* Default
  * `_none`

## EF\_OUTPUT\_OPENSEARCH\_ADDRESSES

This setting specifies the OpenSearch servers to which the output should connect. It is a comma-separated list of OpenSearch nodes, including port number.

{% hint style="danger" %}
Do **NOT** include `http://` or `https://` in the provided value. TLS communications is enabled/disabled using `EF_OUTPUT_OPENSEARCH_TLS_ENABLE`.
{% endhint %}

* Default
  * `127.0.0.1:9200`

## EF\_OUTPUT\_OPENSEARCH\_USERNAME

The username to use when connecting to OpenSearch.

* Default
  * `admin`

## EF\_OUTPUT\_OPENSEARCH\_PASSWORD

The password to use when connecting to OpenSearch.

* Default
  * `admin`

## EF\_OUTPUT\_OPENSEARCH\_AWS\_ACCESS\_KEY

The AWS Access key to use when connecting to OpenSearch via Auth Sig V4

## EF\_OUTPUT\_OPENSEARCH\_AWS\_SECRET\_KEY

The AWS Secret key to use when connecting to OpenSearch via Auth Sig V4

## EF\_OUTPUT\_OPENSEARCH\_AWS\_REGION

The AWS Region to use when connecting to OpenSearch via Auth Sig V4

## EF\_OUTPUT\_OPENSEARCH\_CLIENT\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_CLIENT\_CERT\_FILEPATH

The path to the client certificate to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_CLIENT\_KEY\_FILEPATH

The path to the client key to use for client PKI authentication.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to OpenSearch.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the OpenSearch server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_OPENSEARCH\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the OpenSearch server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_RETRY\_ENABLE

Specifies whether to retry connecting to OpenSearch after a connection has failed.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE

Specifies whether to retry bulk indexing requests which have timed-out.

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_MAX\_RETRIES

Specifies the number of times to retry bulk indexing requests which have timed-out.

* Default
  * `3`

## EF\_OUTPUT\_OPENSEARCH\_RETRY\_BACKOFF

If set, this value specifies the quantity of milliseconds that the output should "backoff" prior to retrying a failed bulk request.

* Default
  * `1000`

## EF\_OUTPUT\_OPENSEARCH\_STORAGE\_OPTIMIZATION\_ENABLE

This setting is used to enable/disable the storage optimization feature. This feature will configure the index sort setting in the index template to optimize the storage of the data.

{% hint style="info" %}
`EF_OUTPUT_OPENSEARCH_INDEX_PERIOD` will be overridden to `rollover` when this setting is enabled.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_OPENSEARCH\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_OPENSEARCH\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. This is particularly useful when used with multiple namespaced outputs, e.g. sending flow records to one datastore and telemetry to another.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Cribl

{% hint style="info" %}
The Cribl output is currently a *technology preview*. The design and implementation are less mature than stable features and subject to change.
{% endhint %}

The Cribl output can be used to send records to the [Cribl LogStream HTTP/S (Bulk API)](https://docs.cribl.io/logstream/sources-https).

## EF\_OUTPUT\_CRIBL\_ENABLE

Specifies whether the Cribl output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_CRIBL\_ADDRESSES

This setting specifies the Cribl workers to which the output should connect. It is a comma-separated list of Cribl workers, including port number.

{% hint style="danger" %}
Do \*\*NOT\*\* include \`http\://\` or \`https\://\` in the provided value. TLS communications is enabled/disabled using \`EF\_OUTPUT\_CRIBL\_TLS\_ENABLE\`.
{% endhint %}

* Default
  * `127.0.0.1:10080`

## EF\_OUTPUT\_CRIBL\_TOKEN

The Cribl data shipping token that the collector will use to send data.

* Default
  * `''`

## EF\_OUTPUT\_CRIBL\_BATCH\_DEADLINE

The maximum time, in milliseconds, to wait for a batch of records to fill before being sent to Cribl.

* Default
  * `2000`

## EF\_OUTPUT\_CRIBL\_BATCH\_MAX\_BYTES

The maximum size, in bytes, for a batch of records being sent to Cribl.

* Default
  * `8388608`

## EF\_OUTPUT\_CRIBL\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Cribl Logstream.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_CRIBL\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Cribl Logstream server to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_CRIBL\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for verification of the Cribl Logstream server to which the output is attempting to connect.

* Default
  * `''`

## EF\_OUTPUT\_CRIBL\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_CRIBL\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. If left empty, all types will be allowed by default.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Kafka

The Kafka output can be used to send records to [Apache Kafka](https://kafka.apache.org), [Confluent Platform](https://www.confluent.io/product/confluent-platform/), [Confluent Cloud](https://www.confluent.io/confluent-cloud/), [Redpanda](https://redpanda.com) and [Amazon Managed Streaming for Apache Kafka (Amazon MSK)](https://aws.amazon.com/msk/).

## EF\_OUTPUT\_KAFKA\_ENABLE

Specifies whether the Kafka output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_POOL\_SIZE

Specifies the number of Kafka output workers to start. An output worker is an instance of a Kafka producer.

* Default
  * Based on the number of licensed flows or devices, depending on the collector.

## EF\_OUTPUT\_KAFKA\_BROKERS

A comma-separated list of brokers, IP address and port number, to which the collector is to connect.

* Example
  * `192.0.2.11:9092,192.0.2.12:9092,broker1.example.com:9092`
* Default
  * `127.0.0.1:9092`

## EF\_OUTPUT\_KAFKA\_VERSION

The version of Kafka to which the collector will assume it is connecting.

{% hint style="danger" %}
Kafka provides backwards-compatibility, so specifying an older version is OK. However, specifying a version greater than the brokers will likely cause issues.
{% endhint %}

* Default
  * `1.0.0`

## EF\_OUTPUT\_KAFKA\_CLIENT\_ID

A user-provided string sent with every request to the Kafka brokers for logging, debugging, and auditing purposes.

* Default
  * `elastiflow`

## EF\_OUTPUT\_KAFKA\_RACK\_ID

A rack identifier. This can be any string value which indicates where the collector is physically located.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_TIMEOUT

The amount of time, in seconds, that the client will wait for the connection to be established.

* Default
  * `30`

## EF\_OUTPUT\_KAFKA\_TOPIC

The Kafka topic to which messages will be produced.

* Default
  * `elastiflow-flow-codex`

## EF\_OUTPUT\_KAFKA\_PARTITION\_KEY

Defines a field from the message which will be used to set the partitioning key.

* Default
  * `flow.export.ip.addr`

## EF\_OUTPUT\_KAFKA\_DROP\_FIELDS

This setting allows for a comma-separated list of fields that are to be removed from all records.

{% hint style="info" %}
Fields are dropped after any output specific fields have been added and after any schema conversion. This means that you should use the field names as you see them in the user interface.
{% endhint %}

* Valid Values
  * any field names related to the enabled schema, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. This is particularly useful when used with multiple namespaced outputs, e.g. sending flow records to one datastore and telemetry to another.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric'`

## EF\_OUTPUT\_KAFKA\_SASL\_ENABLE

Specifies whether SASL based authentication is used when connecting to the Kafka brokers. While there are multiple SASL authentication methods, the current implementation is limited to plaintext (SASL/PLAIN) authentication.

* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_SASL\_USERNAME

The authentication identity (authcid) to present for SASL/PLAIN authentication.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_SASL\_PASSWORD

The password to use for SASL/PLAIN authentication.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_TLS\_ENABLE

This setting is used to enable/disable TLS connections to Kafka.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_TLS\_CA\_CERT\_FILEPATH

The path to the Certificate Authority (CA) certificate to use for connecting to the Kafka brokers.

* Default
  * `''`

## EF\_OUTPUT\_KAFKA\_TLS\_CERT\_FILEPATH

The path to the TLS certificate to use for connecting to the Kafka brokers.

* Default
  * `''`

* Default
  \*

## EF\_OUTPUT\_KAFKA\_TLS\_SKIP\_VERIFICATION

This setting is used to enable/disable TLS verification of the Kafka brokers to which the output is attempting to connect.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_MAX\_MESSAGE\_BYTES

The maximum permitted size of a message (defaults to 1\_000\_000). Should be set equal to or smaller than the broker's `message.max.bytes`.

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `1048576`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_REQUIRED\_ACKS

The level of acknowledgement reliability needed from the broker (defaults to 1 - WaitForLocal).

* Valid Values
  * `0` - (NoResponse) Doesn't require any acknowledgement other than the TCP ACK that the message payload was received.
  * `1` - (WaitForLocal) Waits for only the receiving broker to acknowledge commitment of the message.
  * `-1` - (WaitForAll) Waits for the topic's minimum in-sync replicas to acknowledge commitment of the message. The minimum number of in-sync replicas is configured for a Kafka topic via the `min.insync.replicas` attribute.
* Default
  * `1`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_TIMEOUT

The maximum duration, in seconds, that the producer will wait for the RequiredAcks defined in `EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS`. This is only relevant when `EF_OUTPUT_KAFKA_PRODUCER_REQUIRED_ACKS` is set to `-1` (WaitForAll).

* Default
  * `10`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION

The type of compression to use on messages (defaults to no compression).

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Kafka output's default value for this setting was changed to `3` (LZ4). Performance testing has shown that this change can improve throughput. If you wish to continue to use the old default setting of `0` (none), you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `0` - none
  * `1` - Gzip
  * `2` - snappy
  * `3` - LZ4
  * `4` - ZSTD
* Default
  * `3`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION\_LEVEL

The level of compression to use on messages. The meaning depends on the actual compression type used and defaults to the compression codec's default level.

* Default
  * `-1000` (use the codec's default level)

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_BYTES

The best-effort number of bytes needed to trigger a flush. This setting is per broker. If no partition key is set, i.e. messages are distributed to partitions round-robin, each broker will receive approximately the same number of bytes. If a broker has two partitions of the topic, messages will be split between the two partitions. A partition which is the only partition of the topic on the broker will receive all of the produced messages and have approximately twice the volume of messages as on the broker with two partitions.

{% hint style="danger" %}
`EF_OUTPUT_KAFKA_PRODUCER_FLUSH_BYTES` should not be set to a value larger than the `message.max.bytes` setting of the Kafka topic to which records are to be written.
{% endhint %}

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `1048576`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MESSAGES

The best-effort number of messages needed to trigger a flush. This setting is per broker. If no partition key is set, i.e. messages are distributed to partitions round-robin, each broker will receive the same number of messages. If a broker has two partitions of the topic, messages will be split between the two partitions. A partition which is the only partition of the topic on the broker will receive all of the produced messages and have approximately twice as many messages as on the broker with two partitions.

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `1024`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_FREQUENCY

The best-effort frequency of flushes, in milliseconds. This setting is per partition. If multiple partitions for the same topic are on the same broker, messages will be flushed to each partition at this interval. If no partition key is set, i.e. messages are distributed to partitions round-robin, a broker with two partitions will receive approximately twice as many messages as a broker with only one partition.

{% hint style="danger" %}
Beginning with ElastiFlow `7.17.0` the Kafka output's default value for this setting was changed to `2000`. Performance testing has shown that this change can improve throughput. If you wish to continue to use the old default setting of `1000`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `2000`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MAX\_MESSAGES

The maximum number of messages the producer will send in a single broker request.

* Valid Values
  * `0` (unlimited)
  * `>=1`
* Default
  * `0`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_MAX

The total number of times to retry sending a message.

* Default
  * `3`

## EF\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_BACKOFF

The period of time, in milliseconds, to wait for the Kafka cluster to settle between retries.

* Default
  * `100`

## EF\_OUTPUT\_KAFKA\_FLAT\_RECORD\_ENABLE

The Kafka output can send JSON records using nested or flattened field names. Historically only nested records were supported, which is why the default value for this setting is `false`. However, a record consisting of flattened field names reduces resource requirements and improves throughput.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Kafka output's default value for this setting was changed to `true`. Performance testing has shown that this change can improve throughput. If you wish to continue to use the old default setting of `false`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `true`, `false`
* Default
  * `true`

## EF\_OUTPUT\_KAFKA\_ECS\_ENABLE

Specifies whether the data will be sent using Elastic Common Schema (ECS).

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_KAFKA\_TIMESTAMP\_SOURCE

Determines the timestamp source to be used to set the `@timestamp` field. Usually `end` would be the best setting. However, in the case of poorly behaving or misconfigured devices, `collect` may be the better option.

{% hint style="info" %}
Beginning with ElastiFlow `6.3.0` the Kafka output's default value for this setting was changed to `collect`. This will allow the collector to handle a wider variety of situations without additional configuration. If you wish to continue to use the old default setting of `end`, you should ensure that it is specifically set in your configuration.
{% endhint %}

* Valid Values
  * `start` - Use the timestamp from `flow.start.timestamp`. The flow start time indicated in the flow.
  * `end` - Use the timestamp from `flow.end.timestamp`. The flow end time (or last reported time).
  * `export` - Use the timestamp from `flow.export.timestamp`. The time from the flow record header.
  * `collect` - Use the timestamp from `flow.collect.timestamp`. The time that the collector processed the flow record.
* Default
  * `collect`


# Standard Out

The stdout output is used to output JSON-formatted records to stdout. It is useful for during initial installation and while troubleshooting issues to see the output of the collector directly in the terminal or logs.

{% hint style="info" %}
At anything more than a few flow records per second, the data will scroll too fast to be useful. For this reason the `stdout` output should be used primarily for manual testing.
{% endhint %}

## EF\_OUTPUT\_STDOUT\_ENABLE

Specifies whether the `stdout` output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_STDOUT\_FORMAT

* Valid Values
  * `json` - Output as a single JSON-formatted record per line.
  * `json_pretty` - Output each record as a "pretty" formatted JSON document.
* Default
  * `json_pretty`

## EF\_OUTPUT\_STDOUT\_ALLOWED\_RECORD\_TYPES

This setting allows for a comma-separated list of record types that the output will send will emit. If left empty, all types will be allowed by default.

* Valid Values
  * `as_path_hop`, `flow_option`, `flow`, `ifa_hop`, `telemetry`, `metric`, `log`
* Default
  * `'as_path_hop,flow_option,flow,ifa_hop,telemetry,metric,log'`


# Monitor

## EF\_OUTPUT\_MONITOR\_ENABLE

The monitor output generates a log message containing the rate of records received and decoded by the collector over the past interval specified in `EF_OUTPUT_MONITOR_INTERVAL`. This can be useful for sizing or troubleshooting. This setting specifies whether the monitor output is enabled.

* Valid Values
  * `true`, `false`
* Default
  * `false`

## EF\_OUTPUT\_MONITOR\_INTERVAL

Specifies the interval, in seconds, after which the rate of records will be calculated and logged.

* Default
  * `300` (5 minutes)




---

[Next Page](/llms-full.txt/1)