クラウド時代のネットワークエッジはお宝の山（と、いくつかの実装）という話

# はじめに
この記事はシスコの有志による Cisco Systems Japan Advent Calendar 2022 （一枚目） の 4日目として投稿しています。

2017年版: https://qiita.com/advent-calendar/2017/cisco
2018年版: https://qiita.com/advent-calendar/2018/cisco
2019年版: https://qiita.com/advent-calendar/2019/cisco
2020年版: https://qiita.com/advent-calendar/2020/cisco
2020年版(2枚目): https://qiita.com/advent-calendar/2020/cisco2
2021年版: https://qiita.com/advent-calendar/2021/cisco
2021年版(2枚目): https://qiita.com/advent-calendar/2021/cisco2
2022年版(1,2): https://qiita.com/advent-calendar/2022/cisco

今年も有志50名ですね！すごい！

# 1. これはなに？
- IOS XE CLIからメータリング項目を眺めて妄想（＝ネットワークのビッグデータなのです）
- ネットワークは宝の山なんだよ、とそれっぽいことを言うネタ
- Ciscoのスイッチやルーターってこんなの入ってるんだ、というトリビア的な話題
- Cisco DNA CenterやMerakiの裏側でも使われているという確認
- LANやWANから多くのデータを取り出してもっともっと活用できる可能性がある、という話

## 1.1 背景
- クラウド活用が当たり前になり、キャンパスLANやWAN、SASEなどを組み合わせて企業ネットワークのあり方も相当変わってきたと思います。
- 帯域幅や切替速度といったネットワーク接続性の要件に加えて、アプリケーションの可視化や体感品質の把握、利用者や端末の動き、そこから得られる気づき（インサイト）といった要素に重点が移ってきました。
- 利用者や利用端末の動きから得られるデータを活用したセキュリティの強化やマネタイズ（デジタルマーケティングなど）に繋がる事例が増えています。
- ネットワークの”ビッグデータ”をどう活用するか？ここにもAI活用の可能性があります。
- いわゆるモノやヒトに関するデータは「お宝」なのですが、特にモノやヒトに近いところ（＝ネットワークアクセスまたはエッジ）で取得できる機能とその実装をいくつか見ていきたいと思います。
- ネットワーク技術者はもちろん、アプリケーション開発者の方にとっては特に、ネットワークから様々な情報が取り出せる**可能性がある**ことを知っていただきたいと思います。

## 1.2 ネットワークエッジ装置からのエクスポート（出力）
- 元々ネットワーク可視化のデファクトとして使われてきた NetFlow version 5 では、装置での測定（メータリング）と外部への出力（エクスポート）の両方を意味しました。
- ここには問題があり、メータリングは、装置の機能や能力といった固有の内容であるのに対し、エクスポートは、外部コレクターとやり取りをするための標準手順である（または仕様が公開されている）ことが求められるという点です。
- フローを識別する要素（タプル）も、7タプルとか5タプルとか一般的に言われますが、MACアドレスやVlanによってフローを識別したい人もいます。
- したがって、現在主流である NetFlow version9 または、IPFIX （NetFlow version10ともよばれます）では、完全にメータリングとエクスポートを分離し、プロトコルとしてはエクスポート メカニズムに特化することで、デファクトスタンダード、そして完全な標準化に成功しました（RFC7011, 7012, 7013など）。
- 現在は、オープンソースのものや商用製品など、多岐にわたる NetFlow コレクターが存在します。

## 1.3 ネットワークエッジ装置でのメータリング（測定）
- メータリングに焦点を当ててみましょう。すなわち、装置がどのような内容を計測・出力できるかどうか？
- シスコの実装では、切り離されたメータリング部分を自由にコンフィグでき、その適用箇所やネットワーク用途によって測定内容をチューニングできる機能を、Flexible NetFlow としてリリースしました（2010年頃）。
- 「Flexible NetFlowでメータリング項目を設定し、NetFlow v9 で送信する。」というのが正しい言い方となります。
- 「フロー」を識別するタプル要素も、コンフィグで決められるようになっています。
- 標準化やベンダー共通であるということに重点を置くと、エクスポートメカニズムの共通化が話題の中心になってしまうのですが、あえてこの記事では**メータリングにフォーカス**したいと思います。実に様々な内容が取得できる可能性が考えられた作りになっていることを伝えたいからです。

![ss 2022-11-30 17.49.02.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/157325/aaca3cd2-1f3a-c4a1-8e4f-a55a9fe149bb.png)



# 2. ネットワークエッジでのデータ測定の例
早速コマンドを見ていきます。

~~~
show flow exporter export-ids netflow-v9
show flow exporter export-ids ipfix
~~~

- NetFlow v9/IPFIX（エクスポートメカニズム）による送信可能な測定項目のID一覧を出力
- IOS的に測定項目対象として考慮されている内容を見て**楽しむ**（今回の趣旨）

:::note warn
IOSにコーディングされているだけで、装置/ハードウェアとして未サポートの項目も多々あるので注意
:::

## 2.1 Catalyst 9300の場合

<details><summary>Catalyst 9300の出力を見てみましょう...こんなにあるの？（IOS XE 17.07.01）</summary><div>

~~~
Cat9300TMT3W#show flow exporter export-ids ipfix
Export IDs used by fields in IPFIX export format:
  misc unsupported                           : 37027
  datalink source-vlan-id                    :    58
  datalink destination-vlan-id               :    59
  datalink encap-size                        :   242
  datalink ethertype                         :   256
  datalink length header                     :   240
  datalink length payload                    :   241
  datalink section header                    :   315
  datalink vlan input                        :    58
  datalink dot1q vlan input                  :   243
  datalink dot1q vlan output                 :   254
  datalink dot1q ce-vlan                     :   245
  datalink dot1q priority                    :   244
  datalink dot1q ce-priority                 :   246
  datalink l2vpn metro vcid                  :   247
  datalink l2vpn metro vctype                :   248
  datalink mac source address input          :    56
  datalink mac source address output         :    81
  datalink mac destination address input     :    80
  datalink mac destination address output    :    57
  ip version                                 :    60
  ip tos                                     :     5
  ip dscp                                    :   195
  ip precedence                              :   196
  ip protocol                                :     4
  ip ttl                                     :   192
  ip ttl minimum                             :    52
  ip ttl maximum                             :    53
  ip length header                           :   189
  ip length payload                          :   204
  ip length total                            :   224
  ip length total minimum                    :    25
  ip length total maximum                    :    26
  ip fragmentation flags                     :   197
  ip fragmentation offset                    :    88
  ip fragmentation id                        :    54
  ip section header                          :   313
  ip section payload                         :   314
  routing source as                          :    16
  routing destination as                     :    17
  routing source as peer                     :   129
  routing destination as peer                :   128
  routing source as 4-octet                  :    16
  routing destination as 4-octet             :    17
  routing source as peer 4-octet             :   129
  routing destination as peer 4-octet        :   128
  routing source traffic-index               :    92
  routing destination traffic-index          :    93
  routing forwarding-status                  :    89
  routing is-multicast                       :   206
  routing multicast replication-factor       :    99
  routing vrf input                          :   234
  routing vrf name                           :   236
  routing next-hop address ipv4              :    15
  routing next-hop address ipv4 bgp          :    18
  routing next-hop address ipv6              :    62
  routing next-hop address ipv6 bgp          :    63
  ipv4 header-length                         :   207
  ipv4 total-length                          :   190
  ipv4 source address                        :     8
  ipv4 source prefix                         :    44
  ipv4 source mask                           :     9
  ipv4 destination address                   :    12
  ipv4 destination prefix                    :    45
  ipv4 destination mask                      :    13
  ipv4 option map                            :   208
  ipv6 flow-label                            :    31
  ipv6 next-header                           :   193
  ipv6 payload-length                        :   191
  ipv6 extension map                         :    64
  ipv6 source address                        :    27
  ipv6 source prefix                         :   170
  ipv6 source mask                           :    29
  ipv6 destination address                   :    28
  ipv6 destination prefix                    :   169
  ipv6 destination mask                      :    30
  transport source-port                      :     7
  transport destination-port                 :    11
  transport packets expected counter         : 37014
  transport packets expected counter long    : 37014
  transport packets expected counter permane : 37015
  transport packets lost counter             : 37019
  transport packets lost counter long        : 37019
  transport packets lost counter permanent   : 37020
  transport packets lost rate                : 37021
  transport round-trip-time                  : 37016
  transport event packet-loss counter        : 37017
  transport event packet-loss counter long   : 37017
  transport event packet-loss counter perman : 37018
  transport rtp jitter mean                  : 37023
  transport rtp jitter minimum               : 37024
  transport rtp jitter maximum               : 37025
  transport rtp ssrc                         : 37022
  transport icmp ipv4 type                   :   176
  transport icmp ipv4 code                   :   177
  transport icmp ipv6 type                   :   178
  transport icmp ipv6 code                   :   179
  transport igmp type                        :    33
  transport tcp source-port                  :   182
  transport tcp destination-port             :   183
  transport tcp sequence-number              :   184
  transport tcp acknowledgement-number       :   185
  transport tcp header-length                :   188
  transport tcp window-size                  :   186
  transport tcp urgent-pointer               :   187
  transport tcp flags                        :     6
  transport tcp option map                   :   209
  transport udp source-port                  :   180
  transport udp destination-port             :   181
  transport udp message-length               :   205
  interface input snmp                       :    10
  interface output snmp                      :    14
  interface input snmp short                 :    10
  interface output snmp short                :    14
  interface input physical snmp              :   252
  interface output physical snmp             :   253
  interface name short                       :    82
  interface name long                        :    83
  flow direction                             :    61
  flow exporter                              :   144
  flow sampler                               :    48
  flow sampler algorithm export              :    49
  flow sampler interval                      :    50
  flow sampler name                          :    84
  flow class                                 :    51
  flow class export                          :    95
  flow class name                            :    96
  flow class description                     :    94
  stats error absolute                       :   320
  flow cts source group-tag                  : 34000
  flow cts destination group-tag             : 34001
  counter flows                              :     3
  counter bytes                              :     1
  counter bytes long                         :     1
  counter packets                            :     2
  counter packets long                       :     2
  counter bytes replicated                   :    20
  counter bytes replicated long              :    20
  counter packets replicated                 :    19
  counter packets replicated long            :    19
  counter bytes squared long                 :   198
  counter bytes permanent                    :    85
  counter packets permanent                  :    86
  counter bytes replicated permanent         :   175
  counter packets replicated permanent       :   174
  counter bytes squared permanent            :   199
  counter bytes exported                     :    40
  counter packets exported                   :    41
  counter bytes rate                         : 37003
  counter packets rate                       : 37002
  counter flows exported                     :    42
  counter packets dropped                    : 37000
  counter packets dropped long               : 37000
  counter packets dropped permanent          : 37001
  timestamp sys-uptime first                 :    22
  timestamp sys-uptime last                  :    21
  timestamp interval                         : 37013
  timestamp absolute first                   :   152
  timestamp absolute last                    :   153
  application id                             :    95
  application name                           :    96
  application description                    :    94
  application media bytes counter            : 37004
  application media bytes counter long       : 37004
  application media bytes counter permanent  : 37005
  application media bytes rate               : 37006
  application media packets counter          : 37007
  application media packets counter long     : 37007
  application media packets counter permanen : 37008
  application media packets rate             : 37009
  application media packets rate variation   : 37010
  application media event                    : 37011
  monitor event                              : 37012
  waas dre input                             : 36000
  waas dre output                            : 36001
  waas lz input                              : 36002
  waas lz output                             : 36003
  waas original bytes                        : 36004
  waas optimised bytes                       : 36005
  waas application                           : 36006
  waas class                                 : 36007
  waas connection mode                       : 36008
  art response time sum                      : 42071
  art response time minimum                  : 42073
  art response time maximum                  : 42072
  art server response time sum               : 42074
  art server response time minimum           : 42076
  art server response time maximum           : 42075
  art network time sum                       : 42081
  art network time minimum                   : 42083
  art network time maximum                   : 42082
  art client network time sum                : 42084
  art client network time minimum            : 42086
  art client network time maximum            : 42085
  art server network time sum                : 42087
  art server network time minimum            : 42089
  art server network time maximum            : 42088
  art total response time sum                : 42077
  art total response time minimum            : 42079
  art total response time maximum            : 42078
  art total transaction time sum             : 42041
  art total transaction time minimum         : 42043
  art total transaction time maximum         : 42042
  art count transactions                     : 42040
  art server packets                         :   299
  art server bytes                           :   232
  art count retransmissions                  : 42036
  art client packets                         :   298
  art client bytes                           :   231
  art count new connections                  : 42050
  art count responses                        : 42060
  art count late responses                   : 42068
  waas bytes input                           : 36009
  waas bytes output                          : 36010
  waas optimization segment                  : 42020
  art count responses histogram bucket1      : 42061
  art count responses histogram bucket2      : 42062
  art count responses histogram bucket3      : 42063
  art count responses histogram bucket4      : 42064
  art count responses histogram bucket5      : 42065
  art count responses histogram bucket6      : 42066
  art count responses histogram bucket7      : 42067
  counter server bytes                       :    23
  counter server packets                     :    24
  datalink event                             : 43000
  datalink event extended                    : 43002
  flow end-reason                            :   136
  connection initiator                       :   239
  connection new-connections                 :   278
  connection sum-duration                    :   279
  connection transaction-id                  :   280
  counter bytes rate per-flow                : 37028
  counter bytes rate per-flow min            : 37029
  counter bytes rate per-flow max            : 37030
  counter packets rate per-flow              : 37031
  counter packets rate per-flow min          : 37032
  counter packets rate per-flow max          : 37033
  application media bytes rate per-flow min  : 37035
  application media bytes rate per-flow max  : 37036
  application media packets rate variation m : 37038
  application media packets rate variation m : 37039
  transport rtp flow count                   : 37040
  transport event packet-loss counter min    : 37044
  transport event packet-loss counter max    : 37045
  transport packets lost counter min         : 37042
  transport packets lost counter max         : 37043
  transport tcp flow count                   : 37049
  transport round-trip-time min              : 37052
  transport round-trip-time max              : 37053
  transport round-trip-time sum              : 37050
  transport round-trip-time samples          : 37051
  application media bytes rate per-flow      : 37034
  transport rtp payload-type                 : 37041
  transport packets lost rate min            : 37047
  transport packets lost rate max            : 37048
  flow active timeout                        :    36
  flow end                                   :   153
  package id                                 : 32775
  access string                              : 32789
  info string                                : 32790
  link id                                    : 32810
  mos worst 100                              : 42115
  mos quality                                : 42123
  mos total count                            : 42124
  counter server bytes                       :    23
  counter server packets                     :    24
  flow class wide                            :    95
  counter packets dropped permanent short    : 37001
  transport packets lost counter permanent s : 37020
  transport round-trip-time sum short        : 37050
  transport packet loss                      :    65
  transport unreachability                   :    66
  tranport latency                           :    67
  data points                                :    68
  variance                                   :    69
  pfr br ipv4 address                        : 39000
  pfr status                                 : 39001
  reason id                                  : 39002
  threshold                                  : 39003
  pfr priority                               : 39004
  long-term round-trip-time                  : 39006
  mos below                                  : 39007
  rsvp bw pool                               : 39008
  flow left time                             : 39009
  bw percentage                              : 39010
  bw fee                                     : 39011
  transport source-port min                  : 39012
  transport source-port max                  : 39013
  transport destination-port min             : 39014
  transport destination-port max             : 39015
  application version                        :   105
  application version name                   :   106
  application vendor                         :   107
  metadata global-session-id                 : 37054
  metadata multi-party-session-id            : 37055
  metadata clock-rate                        : 37056
  capacity                                   : 39016
  ingress bw                                 : 39017
  ingress bw long                            : 39017
  max ingress bw                             : 39018
  egress bw                                  : 39019
  egress bw long                             : 39019
  max egress bw                              : 39020
  ingress rollup bw                          : 39021
  egress rollup bw                           : 39022
  kth rollup bw                              : 39023
  link group name                            : 39024
  bgp community                              : 39025
  bgp prepend                                : 39026
  entrance downgrade                         : 39027
  discard rollup count                       : 39028
  l4r server ipv4 address                    : 44000
  l4r server transport port                  : 44001
  l4r server ipv6 address                    : 44002
  l4r event                                  : 44003
  l4r event timestamp                        : 44004
  flow id                                    :   148
  application category name                  : 45000
  application sub category name              : 45001
  application group name                     : 45002
  p2p technology                             :   288
  tunnel technology                          :   289
  encrypted technology                       :   290
  server response time average               : 37059
  refused sessions                           : 37060
  client network delay average               : 37061
  server network delay average               : 37062
  network delay average                      : 37063
  application delay average                  : 37064
  session time minimum                       : 37065
  session time maximum                       : 37066
  session time average                       : 37067
  transaction time average                   : 37068
  closed sessions                            : 37069
  retransmitted packets                      : 37070
  transport bytes out-of-order               : 37071
  client throughput average                  : 37072
  unresponsive sessions                      : 37073
  transport packets out-of-order             : 37074
  IPv4 source observation node               : 37075
  IPv4 destination observation node          : 37076
  IPv6 source observation node               : 37077
  IPv6 destination observation node          : 37078
  pfr one-way-delay sum                      : 37079
  pfr one-way-delay samples                  : 37080
  pfr one-way-delay                          : 37081
  packet arrival timestamp                   : 37082
  transport tcp window-size minimum          : 37083
  transport tcp window-size maximum          : 37084
  transport tcp window-size average          : 37085
  transport tcp maximum-segment-size         : 37086
  sub application tag                        :    97
  sub application name                       :   109
  sub application description                :   110
  datalink vlan output                       :    59
  application http uri statistics            : 42125
  flow sampler hash digest-value             :   326
  c3pl class cce-id                          : 41001
  c3pl class name                            : 41002
  c3pl class type                            : 41003
  c3pl policy cce-id                         : 41004
  c3pl policy name                           : 41005
  c3pl policy type                           : 41006
  mpls label 1 ttl                           :   200
  mpls label 1 exp                           :   203
  mpls label 1 type                          :    46
  mpls label 1 details                       :    70
  mpls label 2 details                       :    71
  mpls label 3 details                       :    72
  mpls label 4 details                       :    73
  mpls label 5 details                       :    74
  mpls label 6 details                       :    75
  time inter-packet-gap histogram            : 42126
  time inter-packet-gap histogram reverse    : 42127
  template parameter range end               :   111
  template identifier                        :   145
  template element identifier                :   303
  transport tcp window-size sum              : 37091
  timestamp absolute monitoring-interval end :   360
  transport rtp jitter mean sum              : 37093
  application media packets rate variation s : 37094
  connection delay response to-server sum    : 42071
  connection delay response to-server min    : 42073
  connection delay response to-server max    : 42072
  connection server counter responses        : 42060
  connection delay response to-server histog : 42061
  connection delay response to-server histog : 42062
  connection delay response to-server histog : 42063
  connection delay response to-server histog : 42064
  connection delay response to-server histog : 42065
  connection delay response to-server histog : 42066
  connection delay response to-server histog : 42067
  connection delay response to-server histog : 42068
  connection delay network to-server sum     : 42087
  connection delay network to-server min     : 42089
  connection delay network to-server max     : 42088
  connection delay network to-client sum     : 42084
  connection delay network to-client min     : 42086
  connection delay network to-client max     : 42085
  connection client counter packets retransm : 42036
  connection delay network client-to-server  : 42081
  connection delay network client-to-server  : 42083
  connection delay network client-to-server  : 42082
  connection delay application sum           : 42074
  connection delay application min           : 42076
  connection delay application max           : 42075
  connection delay response client-to-server : 42077
  connection delay response client-to-server : 42079
  connection delay response client-to-server : 42078
  connection transaction duration sum        : 42041
  connection transaction duration min        : 42043
  connection transaction duration max        : 42042
  connection transaction counter complete    : 42040
  connection server counter bytes long       :   232
  connection server counter packets long     :   299
  connection client counter bytes long       :   231
  connection client counter packets long     :   298
  connection client ipv4 address             : 45004
  connection client transport port           : 45008
  connection client ipv6 address             : 45006
  connection server ipv4 address             : 45005
  connection server transport port           : 45009
  connection server ipv6 address             : 45007
  routing vrf output                         :   235
  services waas segment                      : 42020
  services waas passthrough-reason           : 42021
  policy qos classification hierarchy        : 41000
  policy performance-monitor classification  : 41000
  template enterprise number                 :   346
  policy qos queue index                     : 42128
  policy qos queue drops                     : 42129
  counter bytes layer2                       :   352
  counter bytes layer2 long                  :   352
  counter bytes layer2 permanent             :   353
  transport tcp option map long              :   209
  timestamp absolute monitoring-interval sta :   359
  transport tcp window-size average sum      : 37095
  flow cts source group-tag name             : 34002
  connection id                              : 45010
  application video resolution width last    : 37500
  application video resolution height last   : 37501
  application video frame rate               : 37502
  application video payload bitrate average  : 37503
  application video payload bitrate fluctuat : 37504
  application video frame I counter frames   : 37505
  application video frame I counter packets  : 37506
  application video frame I counter bytes    : 37507
  application video frame STR counter frames : 37508
  application video frame STR counter packet : 37509
  application video frame STR counter bytes  : 37510
  application video frame LTR counter frames : 37511
  application video frame LTR counter packet : 37512
  application video frame LTR counter bytes  : 37513
  application video frame super-P counter fr : 37514
  application video frame super-P counter pa : 37515
  application video frame super-P counter by : 37516
  application video frame NR counter frames  : 37517
  application video frame NR counter packets : 37518
  application video frame NR counter bytes   : 37519
  application video frame I slice-quantizati : 37520
  application video frame STR slice-quantiza : 37521
  application video frame LTR slice-quantiza : 37522
  application video frame super-P slice-quan : 37523
  application video frame NR slice-quantizat : 37524
  application video eMOS compression bitstre : 37525
  application video eMOS compression network : 37526
  application video frame I counter packets  : 37527
  application video frame STR counter packet : 37528
  application video frame LTR counter packet : 37529
  application video frame super-P counter pa : 37530
  application video frame NR counter packets : 37531
  application video frame percentage damaged : 37532
  application video eMOS packet-loss bitstre : 37533
  application video eMOS packet-loss network : 37534
  application video scene-complexity         : 37535
  application video level-of-motion          : 37536
  transport rtp sequence-number              : 37537
  transport rtp sequence-number last         : 37538
  services pfr class-tag-id                  : 39029
  services pfr mc-id                         : 39030
  interface input type                       :   368
  interface output type                      :   369
  interface input fex-node-id                : 41101
  interface output fex-node-id               : 41102
  flow username                              :   371
  interface power                            : 41103
  monitor device-type                        : 41104
  transport tcp maximum-segment-size         : 37086
  wireless ssid                              :   147
  wireless ap mac address                    :   367
  wireless client mac address                :   365
  wireless client ipv4 address               :   366
  ip dscp output                             :    98
  pbhk mapped ipv4 address                   : 44005
  pbhk mapped transport port                 : 44006
  pbhk event                                 : 44007
  pbhk event timestamp                       : 44008
  transport rtp jitter inter arrival sum     : 37096
  transport rtp jitter inter arrival samples : 37097
  transport rtp jitter inter arrival mean    : 37098
  pfr site source id ipv4                    : 37099
  pfr site destination id ipv4               : 37100
  transport bytes lost                       : 37101
  transport bytes expected                   : 37102
  transport bytes lost rate                  : 37103
  transport jitter mean                      :   385
  transport jitter mean                      :   386
  transport jitter mean                      :   387
  connection client counter bytes retransmit : 42035
  connection server counter bytes retransmit : 42037
  connection server counter packets retransm : 42038
  counter bytes long aor                     :     1
  counter packets long aor                   :     2
  timestamp sys-uptime first aor             :    22
  application voice number called            : 37200
  application voice number calling           : 37201
  application voice setup time               : 37202
  application voice call duration            : 37203
  application voice rx bad-packet            : 37204
  application voice rx out-of-sequence       : 37205
  application voice codec id                 : 37206
  application voice play delay current       : 37207
  application voice play delay minimum       : 37208
  application voice play delay maximum       : 37209
  application voice sip call-id              : 37210
  application voice router global-call-id    : 37211
  application voice delay round-trip         : 37212
  application voice delay end-point          : 37213
  application voice r-factor 1               : 37214
  application voice r-factor 2               : 37215
  application voice mos conversation         : 37216
  application voice mos listening            : 37217
  application voice concealment-ratio averag : 37218
  application voice jitter configured type   : 37219
  application voice jitter configured minimu : 37220
  application voice jitter configured maximu : 37221
  application voice jitter configured initia : 37222
  application voice rx early-packet count    : 37223
  application voice rx late-packet count     : 37224
  application voice jitter buffer-overrun    : 37225
  application voice packet conceal-count     : 37226
  flow monitor                               :   143
  application http uri statistics            : 42125
  flow observation point                     :   138
  pfr site source id ipv6                    : 37099
  pfr site destination id ipv6               : 37100
  network delay sum                          : 37104
  network delay sample                       : 37105
  pfr counter event error traffic-class miti : 37106
  pfr counter event error traffic-class miti : 37107
  pfr counter event error traffic-class miti : 37108
  pfr site source prefix ipv4                : 37109
  pfr site destination prefix ipv4           : 37110
  pfr site source prefix ipv6                : 37111
  pfr site destination prefix ipv6           : 37112
  pfr site source prefix mask ipv4           : 37113
  pfr site destination prefix mask ipv4      : 37114
  pfr site source prefix mask ipv6           : 37115
  pfr site destination prefix mask ipv6      : 37116
  connection server counter bytes network lo : 41105
  connection client counter bytes network lo : 41106
  connection server counter bytes transport  :   232
  connection client counter bytes transport  :   231
  connection concurrent-connections          : 42018
  application transaction counter new        : 42019
  connection delay network long-lived to-ser : 42022
  connection delay network long-lived to-cli : 42023
  connection delay network long-lived client : 42024
  connection delay network client-to-server  : 42025
  connection delay network to-server num-sam : 42026
  connection delay network to-client num-sam : 42027
  ipv4 source address nat                    :   225
  ipv4 destination address nat               :   226
  transport source-port nat                  :   227
  transport destination-port nat             :   228
  policy firewall class name                 :   100
  policy firewall event                      :   233
  policy firewall event extended             : 35001
  policy firewall event extended description : 35010
  policy firewall event timestamp            :   323
  policy firewall event level                : 33003
  policy firewall event level id             : 33004
  policy firewall zone-pair id               : 35007
  policy firewall zone-pair name             : 35009
  policy firewall incomplete count           : 35012
  policy firewall incomplete high-watermark  : 35005
  policy firewall incomplete rate            : 35006
  policy firewall blackout time              : 35004
  policy firewall sessions maximum           : 35008
  policy firewall configured value           : 33005
  flow class                                 :    51
  wireless afd drop packets                  : 41107
  wireless afd accept packets                : 41108
  wireless afd drop bytes                    : 41109
  wireless afd accept bytes                  : 41110
  audio rtp packets lost                     : 33050
  audio rtp packets expected                 : 33051
  audio rtp fwd out-of-sequence sum          : 33052
  audio rtp seconds ok                       : 33053
  audio rtp seconds concealed                : 33054
  audio rtp seconds concealed severe         : 33055
  audio rtp jitter ticks                     : 33056
  audio g107 impairment                      : 33057
  audio g107 lossRate                        : 33058
  audio g107 codec baseline                  : 33059
  audio g107 codec baseline bpl              : 33060
  audio g107 impairment one-way-delay        : 33061
  audio concealment ratio now                : 33062
  audio concealment ratio minimum            : 33063
  audio concealment ratio maximum            : 33064
  audio concealment time                     : 33065
  audio speech time                          : 33066
  audio packets ok                           : 33067
  audio packets cs                           : 33068
  audio packets scs                          : 33069
  audio packets rtp                          : 33070
  audio packets silence                      : 33071
  audio duration receive                     : 33072
  audio duration receive voice               : 33073
  audio duration early packet                : 33074
  audio duration clock adjust                : 33075
  audio duration playout increase            : 33076
  audio duration playout decrease            : 33077
  audio duration late discard                : 33078
  audio frame size                           : 33079
  audio frames-per-packet                    : 33080
  audio frame arriving times difference      : 33081
  audio frame arriving times difference vari : 33082
  audio noise level current                  : 33083
  audio noise level average                  : 33084
  audio noise level minimum                  : 33085
  audio noise level maximum                  : 33086
  audio noise level configured               : 33087
  audio snr current                          : 33088
  audio snr average                          : 33089
  audio snr minimum                          : 33090
  audio snr maximum                          : 33091
  audio snr configured                       : 33092
  pfr service provider tag identifier        : 37117
  pfr label identifier                       : 37118
  routing pw destination address             :   432
  flow cts switch derived-sgt                : 34004
  application traffic-class                  : 45011
  application business-relevance             : 45012
  iOAM my node-id                            : 38001
  iOAM my node name                          : 38002
  start timestamp                            : 38003
  end timestamp                              : 38004
  IOAM packet counter                        : 38005
  IOAM byte count                            : 38006
  IOAM cs0 packet counter                    : 38007
  IOAM cs0 byte count                        : 38008
  IOAM cs1 packet counter                    : 38009
  IOAM cs1 byte count                        : 38010
  IOAM cs2 packet counter                    : 38011
  IOAM cs2 byte count                        : 38012
  IOAM cs3 packet counter                    : 38013
  IOAM cs3 byte count                        : 38014
  IOAM cs4 packet counter                    : 38015
  IOAM cs4 byte count                        : 38016
  IOAM cs5 packet counter                    : 38017
  IOAM cs5 byte count                        : 38018
  IOAM cs6 packet counter                    : 38019
  IOAM cs6 byte count                        : 38020
  IOAM cs7 packet counter                    : 38021
  IOAM cs7 byte count                        : 38022
  IOAM lost packet counter                   : 38023
  IOAM duplicate packet counter              : 38024
  IOAM reordered packet counter              : 38025
  IOAM highest PPC sequence number           : 38026
  iOAM node-id                               : 38027
  ipv6 protocol filed                        : 38028
  iOAM E2E Header                            : 38029
  iOAM Path Map                              : 38030
  iOAM number of nodes                       : 38031
  iOAM node1 id                              : 38032
  iOAM node1 in if id                        : 38033
  iOAM node1 eif id                          : 38034
  iOAM node2 id                              : 38035
  iOAM node2 in if id                        : 38036
  iOAM node2 eif id                          : 38037
  iOAM node3 id                              : 38038
  iOAM node3 in if id                        : 38039
  iOAM node3 eif id                          : 38040
  iOAM node4 id                              : 38041
  iOAM node4 in if id                        : 38042
  iOAM node4 eif id                          : 38043
  iOAM Application metadata                  : 38044
  iOAM sfc-id                                : 38045
  iOAM sfc validated count                   : 38046
  iOAM sfc invalidated count                 : 38047
  ipv4 splt                                  : 44941
  ipv4 idp                                   : 44940
  ipv4 bd                                    : 44944
  application set name                       : 44999
  vxlan vnid                                 :   351
  vxlan sgt                                  : 33200
  vxlan flags                                : 33201
  application family name                    : 44998
  overlay session id input                   : 45200
  overlay session id output                  : 45201
  routing vrf service                        : 45202
  tloc table overlay session id              : 45203
  tloc local system ip address               : 45204
  tloc local color                           : 45205
  tloc remote system ip address              : 45206
  tloc remote color                          : 45207
  tloc tunnel protocol                       : 45208
  connection id long                         : 45209
  bandwidth used                             : 37300
  bandwidth used percentage                  : 37301
  Layer3 Virtual-Private-Network ID          :   482
  drop cause id                              : 45210
  counter bytes sdwan dropped long           : 45211
  sdwan sla-not-met                          : 45212
  sdwan preferred-color-not-met              : 45213
  sdwan qos-queue-id                         : 45214
  drop cause name                            : 45215
  counter packets sdwan dropped long         : 37000
  counter packets appqoe fec-d-pkts          : 45216
  counter packets appqoe fec-r-pkts          : 45217
  counter packets appqoe pkt-dup-d-pkts-orig : 45218
  counter packets appqoe pkt-dup-d-pkts-dup  : 45219
  counter packets appqoe pkt-dup-r-pkts      : 45220
  counter packets sdwan pkt-cxp-d-pkts       : 45221
  counter bytes appqoe ssl-read              : 45222
  counter bytes appqoe ssl-written           : 45223
  counter bytes appqoe ssl-en-read           : 45224
  counter bytes appqoe ssl-en-written        : 45225
  counter bytes appqoe ssl-de-read           : 45226
  counter bytes appqoe ssl-de-written        : 45227
  vxlan vtep input                           : 33202
  vxlan vtep output                          : 33203
  appqoe ssl service type                    : 45228
  appqoe ssl traffic type                    : 45229
  appqoe ssl policy action                   : 45230
  sdwan traffic-category                     : 45231
  ulogging fw-zp-id                          : 35007
  ulogging fw-zone-id-array                  : 45232
  ulogging fw-zone-id                        : 45233
  ulogging fw-class-id                       : 41001
  ulogging fw-policy-id                      : 41004
  ulogging fw-proto-id                       : 45234
  ulogging fw-action                         : 45235
  ulogging fw-drop-reason-id                 : 35001
  ulogging fw-end-flow-reason                : 45236
  ulogging fw-src-ipv4-addr-translated       :   225
  ulogging fw-dst-ipv4-addr-translated       :   226
  ulogging fw-src-port-translated            :   227
  ulogging fw-dst-port-translated            :   228
  ulogging fw-zp-name                        : 35009
  ulogging fw-zone-name                      : 45237
  ulogging fw-action-name                    : 45238
  ulogging fw-proto-name                     : 45239
  ulogging fw-drop-reason                    : 35010
  ulogging fw-end-flow-reason-name           : 45240
  ulogging utd-policy-id-array               : 45251
  ulogging utd-policy-id                     : 45252
  ulogging utd-action-id-array               : 45253
  ulogging utd-action-id                     : 45254
  ulogging utd-ips-pri                       : 45255
  ulogging utd-ips-sid                       : 45256
  ulogging utd-ips-gid                       : 45257
  ulogging utd-ips-cid                       : 45258
  ulogging utd-urlf-url-hash                 : 45259
  ulogging utd-urlf-url-category             : 45260
  ulogging utd-urlf-url-reputation           : 45261
  ulogging utd-urlf-app-name                 : 45262
  ulogging utd-amp-dispos                    : 45263
  ulogging utd-amp-filename-hash             : 45264
  ulogging utd-amp-file-type                 : 45265
  ulogging utd-amp-file-hash                 : 45266
  ulogging utd-amp-malname-hash              : 45267
  ulogging utd-drop-reason-id                : 45268
  ulogging sdvt-drop-reason-id               : 45269
  ulogging utd-policy-name                   : 45270
  ulogging utd-urlf-url-str                  : 45271
  ulogging utd-amp-filename                  : 45272
  ulogging utd-amp-malware-name              : 45273
  ulogging utd-action-name                   : 45274
  ulogging utd-amp-dispos-name               : 45275
  ulogging utd-amp-filetype-name             : 45276
  ulogging utd-urlf-category-name            : 45277
  ulogging utd-drop-reason-name              : 45278
  ulogging sdvt-drop-reason-name             : 45279
  counter bytes sdwan pkt-cxp-d-bytes long   : 45280
  appqoe action                              : 45281
  appqoe sn-ip                               : 45282
  appqoe pass-reason                         : 45283
  appqoe dre-input-bytes                     : 45284
  appqoe dre-input-packets                   : 45285
  appqoe flags                               : 45286
  sdwan service-area                         : 45287
  ulogging utd-ips-policy-id                 : 45247
  ulogging utd-ips-action-id                 : 45248
  ulogging utd-urlf-policy-id                : 45249
  ulogging utd-urlf-action-id                : 45250
  ulogging utd-amp-policy-id                 : 45252
  ulogging utd-amp-action-id                 : 45254
  ulogging utd-urlf-reason-id                : 45288
  ulogging utd-urlf-reason-name              : 45289
  ulogging flow-direction                    : 45290
  routing distinguisher                      :    90
  sdwan tenant global id                     : 45291
  sdwan tenant vpn id                        : 45292
~~~
</div></details>

## 2.2 ISR4300 の場合

<details><summary>ISR 4300だと...（ここをクリック）（IOS XE 17.8.1a）</summary><div>

~~~
C4331-02#show flow exporter export-ids ipfix
Export IDs used by fields in IPFIX export format:
  misc unsupported                           : 37027
  datalink source-vlan-id                    :    58
  datalink destination-vlan-id               :    59
  datalink encap-size                        :   242
  datalink ethertype                         :   256
  datalink length header                     :   240
  datalink length payload                    :   241
  datalink section header                    :   315
  datalink vlan input                        :    58
  datalink dot1q vlan input                  :   243
  datalink dot1q vlan output                 :   254
  datalink dot1q ce-vlan                     :   245
  datalink dot1q priority                    :   244
  datalink dot1q ce-priority                 :   246
  datalink l2vpn metro vcid                  :   247
  datalink l2vpn metro vctype                :   248
  datalink mac source address input          :    56
  datalink mac source address output         :    81
  datalink mac destination address input     :    80
  datalink mac destination address output    :    57
  ip version                                 :    60
  ip tos                                     :     5
  ip dscp                                    :   195
  ip precedence                              :   196
  ip protocol                                :     4
  ip ttl                                     :   192
  ip ttl minimum                             :    52
  ip ttl maximum                             :    53
  ip length header                           :   189
  ip length payload                          :   204
  ip length total                            :   224
  ip length total minimum                    :    25
  ip length total maximum                    :    26
  ip fragmentation flags                     :   197
  ip fragmentation offset                    :    88
  ip fragmentation id                        :    54
  ip section header                          :   313
  ip section payload                         :   314
  routing source as                          :    16
  routing destination as                     :    17
  routing source as peer                     :   129
  routing destination as peer                :   128
  routing source as 4-octet                  :    16
  routing destination as 4-octet             :    17
  routing source as peer 4-octet             :   129
  routing destination as peer 4-octet        :   128
  routing source traffic-index               :    92
  routing destination traffic-index          :    93
  routing forwarding-status                  :    89
  routing is-multicast                       :   206
  routing multicast replication-factor       :    99
  routing vrf input                          :   234
  routing vrf name                           :   236
  routing next-hop address ipv4              :    15
  routing next-hop address ipv4 bgp          :    18
  routing next-hop address ipv6              :    62
  routing next-hop address ipv6 bgp          :    63
  ipv4 header-length                         :   207
  ipv4 total-length                          :   190
  ipv4 source address                        :     8
  ipv4 source prefix                         :    44
  ipv4 source mask                           :     9
  ipv4 destination address                   :    12
  ipv4 destination prefix                    :    45
  ipv4 destination mask                      :    13
  ipv4 option map                            :   208
  ipv6 flow-label                            :    31
  ipv6 next-header                           :   193
  ipv6 payload-length                        :   191
  ipv6 extension map                         :    64
  ipv6 source address                        :    27
  ipv6 source prefix                         :   170
  ipv6 source mask                           :    29
  ipv6 destination address                   :    28
  ipv6 destination prefix                    :   169
  ipv6 destination mask                      :    30
  transport source-port                      :     7
  transport destination-port                 :    11
  transport packets expected counter         : 37014
  transport packets expected counter long    : 37014
  transport packets expected counter permane : 37015
  transport packets lost counter             : 37019
  transport packets lost counter long        : 37019
  transport packets lost counter permanent   : 37020
  transport packets lost rate                : 37021
  transport round-trip-time                  : 37016
  transport event packet-loss counter        : 37017
  transport event packet-loss counter long   : 37017
  transport event packet-loss counter perman : 37018
  transport rtp jitter mean                  : 37023
  transport rtp jitter minimum               : 37024
  transport rtp jitter maximum               : 37025
  transport rtp ssrc                         : 37022
  transport icmp ipv4 type                   :   176
  transport icmp ipv4 code                   :   177
  transport icmp ipv6 type                   :   178
  transport icmp ipv6 code                   :   179
  transport igmp type                        :    33
  transport tcp source-port                  :   182
  transport tcp destination-port             :   183
  transport tcp sequence-number              :   184
  transport tcp acknowledgement-number       :   185
  transport tcp header-length                :   188
  transport tcp window-size                  :   186
  transport tcp urgent-pointer               :   187
  transport tcp flags                        :     6
  transport tcp option map                   :   209
  transport udp source-port                  :   180
  transport udp destination-port             :   181
  transport udp message-length               :   205
  interface input snmp                       :    10
  interface output snmp                      :    14
  interface input snmp short                 :    10
  interface output snmp short                :    14
  interface input physical snmp              :   252
  interface output physical snmp             :   253
  interface name short                       :    82
  interface name long                        :    83
  flow direction                             :    61
  flow exporter                              :   144
  flow sampler                               :    48
  flow sampler algorithm export              :    49
  flow sampler interval                      :    50
  flow sampler name                          :    84
  flow class                                 :    51
  flow class export                          :    95
  flow class name                            :    96
  flow class description                     :    94
  stats error absolute                       :   320
  flow cts source group-tag                  : 34000
  flow cts destination group-tag             : 34001
  counter flows                              :     3
  counter bytes                              :     1
  counter bytes long                         :     1
  counter packets                            :     2
  counter packets long                       :     2
  counter bytes replicated                   :    20
  counter bytes replicated long              :    20
  counter packets replicated                 :    19
  counter packets replicated long            :    19
  counter bytes squared long                 :   198
  counter bytes permanent                    :    85
  counter packets permanent                  :    86
  counter bytes replicated permanent         :   175
  counter packets replicated permanent       :   174
  counter bytes squared permanent            :   199
  counter bytes exported                     :    40
  counter packets exported                   :    41
  counter bytes rate                         : 37003
  counter packets rate                       : 37002
  counter flows exported                     :    42
  counter packets dropped                    : 37000
  counter packets dropped long               : 37000
  counter packets dropped permanent          : 37001
  timestamp sys-uptime first                 :    22
  timestamp sys-uptime last                  :    21
  timestamp interval                         : 37013
  timestamp absolute first                   :   152
  timestamp absolute last                    :   153
  application id                             :    95
  application name                           :    96
  application description                    :    94
  application media bytes counter            : 37004
  application media bytes counter long       : 37004
  application media bytes counter permanent  : 37005
  application media bytes rate               : 37006
  application media packets counter          : 37007
  application media packets counter long     : 37007
  application media packets counter permanen : 37008
  application media packets rate             : 37009
  application media packets rate variation   : 37010
  application media event                    : 37011
  monitor event                              : 37012
  waas dre input                             : 36000
  waas dre output                            : 36001
  waas lz input                              : 36002
  waas lz output                             : 36003
  waas original bytes                        : 36004
  waas optimised bytes                       : 36005
  waas application                           : 36006
  waas class                                 : 36007
  waas connection mode                       : 36008
  art response time sum                      : 42071
  art response time minimum                  : 42073
  art response time maximum                  : 42072
  art server response time sum               : 42074
  art server response time minimum           : 42076
  art server response time maximum           : 42075
  art network time sum                       : 42081
  art network time minimum                   : 42083
  art network time maximum                   : 42082
  art client network time sum                : 42084
  art client network time minimum            : 42086
  art client network time maximum            : 42085
  art server network time sum                : 42087
  art server network time minimum            : 42089
  art server network time maximum            : 42088
  art total response time sum                : 42077
  art total response time minimum            : 42079
  art total response time maximum            : 42078
  art total transaction time sum             : 42041
  art total transaction time minimum         : 42043
  art total transaction time maximum         : 42042
  art count transactions                     : 42040
  art server packets                         :   299
  art server bytes                           :   232
  art count retransmissions                  : 42036
  art client packets                         :   298
  art client bytes                           :   231
  art count new connections                  : 42050
  art count responses                        : 42060
  art count late responses                   : 42068
  waas bytes input                           : 36009
  waas bytes output                          : 36010
  waas optimization segment                  : 42020
  art count responses histogram bucket1      : 42061
  art count responses histogram bucket2      : 42062
  art count responses histogram bucket3      : 42063
  art count responses histogram bucket4      : 42064
  art count responses histogram bucket5      : 42065
  art count responses histogram bucket6      : 42066
  art count responses histogram bucket7      : 42067
  counter server bytes                       :    23
  counter server packets                     :    24
  datalink event                             : 43000
  datalink event extended                    : 43002
  flow end-reason                            :   136
  connection initiator                       :   239
  connection new-connections                 :   278
  connection sum-duration                    :   279
  connection transaction-id                  :   280
  counter bytes rate per-flow                : 37028
  counter bytes rate per-flow min            : 37029
  counter bytes rate per-flow max            : 37030
  counter packets rate per-flow              : 37031
  counter packets rate per-flow min          : 37032
  counter packets rate per-flow max          : 37033
  application media bytes rate per-flow min  : 37035
  application media bytes rate per-flow max  : 37036
  application media packets rate variation m : 37038
  application media packets rate variation m : 37039
  transport rtp flow count                   : 37040
  transport event packet-loss counter min    : 37044
  transport event packet-loss counter max    : 37045
  transport packets lost counter min         : 37042
  transport packets lost counter max         : 37043
  transport tcp flow count                   : 37049
  transport round-trip-time min              : 37052
  transport round-trip-time max              : 37053
  transport round-trip-time sum              : 37050
  transport round-trip-time samples          : 37051
  application media bytes rate per-flow      : 37034
  transport rtp payload-type                 : 37041
  transport packets lost rate min            : 37047
  transport packets lost rate max            : 37048
  flow active timeout                        :    36
  flow end                                   :   153
  package id                                 : 32775
  access string                              : 32789
  info string                                : 32790
  link id                                    : 32810
  mos worst 100                              : 42115
  mos quality                                : 42123
  mos total count                            : 42124
  counter server bytes                       :    23
  counter server packets                     :    24
  flow class wide                            :    95
  counter packets dropped permanent short    : 37001
  transport packets lost counter permanent s : 37020
  transport round-trip-time sum short        : 37050
  transport packet loss                      :    65
  transport unreachability                   :    66
  tranport latency                           :    67
  data points                                :    68
  variance                                   :    69
  pfr br ipv4 address                        : 39000
  pfr status                                 : 39001
  reason id                                  : 39002
  threshold                                  : 39003
  pfr priority                               : 39004
  long-term round-trip-time                  : 39006
  mos below                                  : 39007
  rsvp bw pool                               : 39008
  flow left time                             : 39009
  bw percentage                              : 39010
  bw fee                                     : 39011
  transport source-port min                  : 39012
  transport source-port max                  : 39013
  transport destination-port min             : 39014
  transport destination-port max             : 39015
  application version                        :   105
  application version name                   :   106
  application vendor                         :   107
  metadata global-session-id                 : 37054
  metadata multi-party-session-id            : 37055
  metadata clock-rate                        : 37056
  capacity                                   : 39016
  ingress bw                                 : 39017
  ingress bw long                            : 39017
  max ingress bw                             : 39018
  egress bw                                  : 39019
  egress bw long                             : 39019
  max egress bw                              : 39020
  ingress rollup bw                          : 39021
  egress rollup bw                           : 39022
  kth rollup bw                              : 39023
  link group name                            : 39024
  bgp community                              : 39025
  bgp prepend                                : 39026
  entrance downgrade                         : 39027
  discard rollup count                       : 39028
  l4r server ipv4 address                    : 44000
  l4r server transport port                  : 44001
  l4r server ipv6 address                    : 44002
  l4r event                                  : 44003
  l4r event timestamp                        : 44004
  flow id                                    :   148
  application category name                  : 45000
  application sub category name              : 45001
  application group name                     : 45002
  p2p technology                             :   288
  tunnel technology                          :   289
  encrypted technology                       :   290
  server response time average               : 37059
  refused sessions                           : 37060
  client network delay average               : 37061
  server network delay average               : 37062
  network delay average                      : 37063
  application delay average                  : 37064
  session time minimum                       : 37065
  session time maximum                       : 37066
  session time average                       : 37067
  transaction time average                   : 37068
  closed sessions                            : 37069
  retransmitted packets                      : 37070
  transport bytes out-of-order               : 37071
  client throughput average                  : 37072
  unresponsive sessions                      : 37073
  transport packets out-of-order             : 37074
  IPv4 source observation node               : 37075
  IPv4 destination observation node          : 37076
  IPv6 source observation node               : 37077
  IPv6 destination observation node          : 37078
  pfr one-way-delay sum                      : 37079
  pfr one-way-delay samples                  : 37080
  pfr one-way-delay                          : 37081
  packet arrival timestamp                   : 37082
  transport tcp window-size minimum          : 37083
  transport tcp window-size maximum          : 37084
  transport tcp window-size average          : 37085
  transport tcp maximum-segment-size         : 37086
  sub application tag                        :    97
  sub application name                       :   109
  sub application description                :   110
  datalink vlan output                       :    59
  application http uri statistics            : 42125
  flow sampler hash digest-value             :   326
  c3pl class cce-id                          : 41001
  c3pl class name                            : 41002
  c3pl class type                            : 41003
  c3pl policy cce-id                         : 41004
  c3pl policy name                           : 41005
  c3pl policy type                           : 41006
  mpls label 1 ttl                           :   200
  mpls label 1 exp                           :   203
  mpls label 1 type                          :    46
  mpls label 1 details                       :    70
  mpls label 2 details                       :    71
  mpls label 3 details                       :    72
  mpls label 4 details                       :    73
  mpls label 5 details                       :    74
  mpls label 6 details                       :    75
  time inter-packet-gap histogram            : 42126
  time inter-packet-gap histogram reverse    : 42127
  template parameter range end               :   111
  template identifier                        :   145
  template element identifier                :   303
  transport tcp window-size sum              : 37091
  timestamp absolute monitoring-interval end :   360
  transport rtp jitter mean sum              : 37093
  application media packets rate variation s : 37094
  connection delay response to-server sum    : 42071
  connection delay response to-server min    : 42073
  connection delay response to-server max    : 42072
  connection server counter responses        : 42060
  connection delay response to-server histog : 42061
  connection delay response to-server histog : 42062
  connection delay response to-server histog : 42063
  connection delay response to-server histog : 42064
  connection delay response to-server histog : 42065
  connection delay response to-server histog : 42066
  connection delay response to-server histog : 42067
  connection delay response to-server histog : 42068
  connection delay network to-server sum     : 42087
  connection delay network to-server min     : 42089
  connection delay network to-server max     : 42088
  connection delay network to-client sum     : 42084
  connection delay network to-client min     : 42086
  connection delay network to-client max     : 42085
  connection client counter packets retransm : 42036
  connection delay network client-to-server  : 42081
  connection delay network client-to-server  : 42083
  connection delay network client-to-server  : 42082
  connection delay application sum           : 42074
  connection delay application min           : 42076
  connection delay application max           : 42075
  connection delay response client-to-server : 42077
  connection delay response client-to-server : 42079
  connection delay response client-to-server : 42078
  connection transaction duration sum        : 42041
  connection transaction duration min        : 42043
  connection transaction duration max        : 42042
  connection transaction counter complete    : 42040
  connection server counter bytes long       :   232
  connection server counter packets long     :   299
  connection client counter bytes long       :   231
  connection client counter packets long     :   298
  connection client ipv4 address             : 45004
  connection client transport port           : 45008
  connection client ipv6 address             : 45006
  connection server ipv4 address             : 45005
  connection server transport port           : 45009
  connection server ipv6 address             : 45007
  routing vrf output                         :   235
  services waas segment                      : 42020
  services waas passthrough-reason           : 42021
  policy qos classification hierarchy        : 41000
  policy performance-monitor classification  : 41000
  template enterprise number                 :   346
  policy qos queue index                     : 42128
  policy qos queue drops                     : 42129
  counter bytes layer2                       :   352
  counter bytes layer2 long                  :   352
  counter bytes layer2 permanent             :   353
  transport tcp option map long              :   209
  timestamp absolute monitoring-interval sta :   359
  transport tcp window-size average sum      : 37095
  flow cts source group-tag name             : 34002
  connection id                              : 45010
  application video resolution width last    : 37500
  application video resolution height last   : 37501
  application video frame rate               : 37502
  application video payload bitrate average  : 37503
  application video payload bitrate fluctuat : 37504
  application video frame I counter frames   : 37505
  application video frame I counter packets  : 37506
  application video frame I counter bytes    : 37507
  application video frame STR counter frames : 37508
  application video frame STR counter packet : 37509
  application video frame STR counter bytes  : 37510
  application video frame LTR counter frames : 37511
  application video frame LTR counter packet : 37512
  application video frame LTR counter bytes  : 37513
  application video frame super-P counter fr : 37514
  application video frame super-P counter pa : 37515
  application video frame super-P counter by : 37516
  application video frame NR counter frames  : 37517
  application video frame NR counter packets : 37518
  application video frame NR counter bytes   : 37519
  application video frame I slice-quantizati : 37520
  application video frame STR slice-quantiza : 37521
  application video frame LTR slice-quantiza : 37522
  application video frame super-P slice-quan : 37523
  application video frame NR slice-quantizat : 37524
  application video eMOS compression bitstre : 37525
  application video eMOS compression network : 37526
  application video frame I counter packets  : 37527
  application video frame STR counter packet : 37528
  application video frame LTR counter packet : 37529
  application video frame super-P counter pa : 37530
  application video frame NR counter packets : 37531
  application video frame percentage damaged : 37532
  application video eMOS packet-loss bitstre : 37533
  application video eMOS packet-loss network : 37534
  application video scene-complexity         : 37535
  application video level-of-motion          : 37536
  transport rtp sequence-number              : 37537
  transport rtp sequence-number last         : 37538
  services pfr class-tag-id                  : 39029
  services pfr mc-id                         : 39030
  interface input type                       :   368
  interface output type                      :   369
  interface input fex-node-id                : 41101
  interface output fex-node-id               : 41102
  flow username                              :   371
  interface power                            : 41103
  monitor device-type                        : 41104
  transport tcp maximum-segment-size         : 37086
  wireless ssid                              :   147
  wireless ap mac address                    :   367
  wireless client mac address                :   365
  wireless client ipv4 address               :   366
  ip dscp output                             :    98
  pbhk mapped ipv4 address                   : 44005
  pbhk mapped transport port                 : 44006
  pbhk event                                 : 44007
  pbhk event timestamp                       : 44008
  transport rtp jitter inter arrival sum     : 37096
  transport rtp jitter inter arrival samples : 37097
  transport rtp jitter inter arrival mean    : 37098
  pfr site source id ipv4                    : 37099
  pfr site destination id ipv4               : 37100
  transport bytes lost                       : 37101
  transport bytes expected                   : 37102
  transport bytes lost rate                  : 37103
  transport jitter mean                      :   385
  transport jitter mean                      :   386
  transport jitter mean                      :   387
  connection client counter bytes retransmit : 42035
  connection server counter bytes retransmit : 42037
  connection server counter packets retransm : 42038
  counter bytes long aor                     :     1
  counter packets long aor                   :     2
  timestamp sys-uptime first aor             :    22
  application voice number called            : 37200
  application voice number calling           : 37201
  application voice setup time               : 37202
  application voice call duration            : 37203
  application voice rx bad-packet            : 37204
  application voice rx out-of-sequence       : 37205
  application voice codec id                 : 37206
  application voice play delay current       : 37207
  application voice play delay minimum       : 37208
  application voice play delay maximum       : 37209
  application voice sip call-id              : 37210
  application voice router global-call-id    : 37211
  application voice delay round-trip         : 37212
  application voice delay end-point          : 37213
  application voice r-factor 1               : 37214
  application voice r-factor 2               : 37215
  application voice mos conversation         : 37216
  application voice mos listening            : 37217
  application voice concealment-ratio averag : 37218
  application voice jitter configured type   : 37219
  application voice jitter configured minimu : 37220
  application voice jitter configured maximu : 37221
  application voice jitter configured initia : 37222
  application voice rx early-packet count    : 37223
  application voice rx late-packet count     : 37224
  application voice jitter buffer-overrun    : 37225
  application voice packet conceal-count     : 37226
  flow monitor                               :   143
  application http uri statistics            : 42125
  flow observation point                     :   138
  pfr site source id ipv6                    : 37099
  pfr site destination id ipv6               : 37100
  network delay sum                          : 37104
  network delay sample                       : 37105
  pfr counter event error traffic-class miti : 37106
  pfr counter event error traffic-class miti : 37107
  pfr counter event error traffic-class miti : 37108
  pfr site source prefix ipv4                : 37109
  pfr site destination prefix ipv4           : 37110
  pfr site source prefix ipv6                : 37111
  pfr site destination prefix ipv6           : 37112
  pfr site source prefix mask ipv4           : 37113
  pfr site destination prefix mask ipv4      : 37114
  pfr site source prefix mask ipv6           : 37115
  pfr site destination prefix mask ipv6      : 37116
  connection server counter bytes network lo : 41105
  connection client counter bytes network lo : 41106
  connection server counter bytes transport  :   232
  connection client counter bytes transport  :   231
  connection concurrent-connections          : 42018
  application transaction counter new        : 42019
  connection delay network long-lived to-ser : 42022
  connection delay network long-lived to-cli : 42023
  connection delay network long-lived client : 42024
  connection delay network client-to-server  : 42025
  connection delay network to-server num-sam : 42026
  connection delay network to-client num-sam : 42027
  ipv4 source address nat                    :   225
  ipv4 destination address nat               :   226
  transport source-port nat                  :   227
  transport destination-port nat             :   228
  policy firewall class name                 :   100
  policy firewall event                      :   233
  policy firewall event extended             : 35001
  policy firewall event extended description : 35010
  policy firewall event timestamp            :   323
  policy firewall event level                : 33003
  policy firewall event level id             : 33004
  policy firewall zone-pair id               : 35007
  policy firewall zone-pair name             : 35009
  policy firewall incomplete count           : 35012
  policy firewall incomplete high-watermark  : 35005
  policy firewall incomplete rate            : 35006
  policy firewall blackout time              : 35004
  policy firewall sessions maximum           : 35008
  policy firewall configured value           : 33005
  flow class                                 :    51
  wireless afd drop packets                  : 41107
  wireless afd accept packets                : 41108
  wireless afd drop bytes                    : 41109
  wireless afd accept bytes                  : 41110
  audio rtp packets lost                     : 33050
  audio rtp packets expected                 : 33051
  audio rtp fwd out-of-sequence sum          : 33052
  audio rtp seconds ok                       : 33053
  audio rtp seconds concealed                : 33054
  audio rtp seconds concealed severe         : 33055
  audio rtp jitter ticks                     : 33056
  audio g107 impairment                      : 33057
  audio g107 lossRate                        : 33058
  audio g107 codec baseline                  : 33059
  audio g107 codec baseline bpl              : 33060
  audio g107 impairment one-way-delay        : 33061
  audio concealment ratio now                : 33062
  audio concealment ratio minimum            : 33063
  audio concealment ratio maximum            : 33064
  audio concealment time                     : 33065
  audio speech time                          : 33066
  audio packets ok                           : 33067
  audio packets cs                           : 33068
  audio packets scs                          : 33069
  audio packets rtp                          : 33070
  audio packets silence                      : 33071
  audio duration receive                     : 33072
  audio duration receive voice               : 33073
  audio duration early packet                : 33074
  audio duration clock adjust                : 33075
  audio duration playout increase            : 33076
  audio duration playout decrease            : 33077
  audio duration late discard                : 33078
  audio frame size                           : 33079
  audio frames-per-packet                    : 33080
  audio frame arriving times difference      : 33081
  audio frame arriving times difference vari : 33082
  audio noise level current                  : 33083
  audio noise level average                  : 33084
  audio noise level minimum                  : 33085
  audio noise level maximum                  : 33086
  audio noise level configured               : 33087
  audio snr current                          : 33088
  audio snr average                          : 33089
  audio snr minimum                          : 33090
  audio snr maximum                          : 33091
  audio snr configured                       : 33092
  pfr service provider tag identifier        : 37117
  pfr label identifier                       : 37118
  routing pw destination address             :   432
  flow cts switch derived-sgt                : 34004
  application traffic-class                  : 45011
  application business-relevance             : 45012
  iOAM my node-id                            : 38001
  iOAM my node name                          : 38002
  start timestamp                            : 38003
  end timestamp                              : 38004
  IOAM packet counter                        : 38005
  IOAM byte count                            : 38006
  IOAM cs0 packet counter                    : 38007
  IOAM cs0 byte count                        : 38008
  IOAM cs1 packet counter                    : 38009
  IOAM cs1 byte count                        : 38010
  IOAM cs2 packet counter                    : 38011
  IOAM cs2 byte count                        : 38012
  IOAM cs3 packet counter                    : 38013
  IOAM cs3 byte count                        : 38014
  IOAM cs4 packet counter                    : 38015
  IOAM cs4 byte count                        : 38016
  IOAM cs5 packet counter                    : 38017
  IOAM cs5 byte count                        : 38018
  IOAM cs6 packet counter                    : 38019
  IOAM cs6 byte count                        : 38020
  IOAM cs7 packet counter                    : 38021
  IOAM cs7 byte count                        : 38022
  IOAM lost packet counter                   : 38023
  IOAM duplicate packet counter              : 38024
  IOAM reordered packet counter              : 38025
  IOAM highest PPC sequence number           : 38026
  iOAM node-id                               : 38027
  ipv6 protocol filed                        : 38028
  iOAM E2E Header                            : 38029
  iOAM Path Map                              : 38030
  iOAM number of nodes                       : 38031
  iOAM node1 id                              : 38032
  iOAM node1 in if id                        : 38033
  iOAM node1 eif id                          : 38034
  iOAM node2 id                              : 38035
  iOAM node2 in if id                        : 38036
  iOAM node2 eif id                          : 38037
  iOAM node3 id                              : 38038
  iOAM node3 in if id                        : 38039
  iOAM node3 eif id                          : 38040
  iOAM node4 id                              : 38041
  iOAM node4 in if id                        : 38042
  iOAM node4 eif id                          : 38043
  iOAM Application metadata                  : 38044
  iOAM sfc-id                                : 38045
  iOAM sfc validated count                   : 38046
  iOAM sfc invalidated count                 : 38047
  ipv4 splt                                  : 44941
  ipv4 idp                                   : 44940
  ipv4 bd                                    : 44944
  application set name                       : 44999
  vxlan vnid                                 :   351
  vxlan sgt                                  : 33200
  vxlan flags                                : 33201
  application family name                    : 44998
  overlay session id input                   : 45200
  overlay session id output                  : 45201
  routing vrf service                        : 45202
  tloc table overlay session id              : 45203
  tloc local system ip address               : 45204
  tloc local color                           : 45205
  tloc remote system ip address              : 45206
  tloc remote color                          : 45207
  tloc tunnel protocol                       : 45208
  connection id long                         : 45209
  bandwidth used                             : 37300
  bandwidth used percentage                  : 37301
  Layer3 Virtual-Private-Network ID          :   482
  drop cause id                              : 45210
  counter bytes sdwan dropped long           : 45211
  sdwan sla-not-met                          : 45212
  sdwan preferred-color-not-met              : 45213
  sdwan qos-queue-id                         : 45214
  drop cause name                            : 45215
  counter packets sdwan dropped long         : 37000
  counter packets appqoe fec-d-pkts          : 45216
  counter packets appqoe fec-r-pkts          : 45217
  counter packets appqoe pkt-dup-d-pkts-orig : 45218
  counter packets appqoe pkt-dup-d-pkts-dup  : 45219
  counter packets appqoe pkt-dup-r-pkts      : 45220
  counter packets sdwan pkt-cxp-d-pkts       : 45221
  counter bytes appqoe ssl-read              : 45222
  counter bytes appqoe ssl-written           : 45223
  counter bytes appqoe ssl-en-read           : 45224
  counter bytes appqoe ssl-en-written        : 45225
  counter bytes appqoe ssl-de-read           : 45226
  counter bytes appqoe ssl-de-written        : 45227
  vxlan vtep input                           : 33202
  vxlan vtep output                          : 33203
  appqoe ssl service type                    : 45228
  appqoe ssl traffic type                    : 45229
  appqoe ssl policy action                   : 45230
  sdwan traffic-category                     : 45231
  ulogging fw-zp-id                          : 35007
  ulogging fw-zone-id-array                  : 45232
  ulogging fw-zone-id                        : 45233
  ulogging fw-class-id                       : 41001
  ulogging fw-policy-id                      : 41004
  ulogging fw-proto-id                       : 45234
  ulogging fw-action                         : 45235
  ulogging fw-drop-reason-id                 : 35001
  ulogging fw-end-flow-reason                : 45236
  ulogging fw-src-ipv4-addr-translated       :   225
  ulogging fw-dst-ipv4-addr-translated       :   226
  ulogging fw-src-port-translated            :   227
  ulogging fw-dst-port-translated            :   228
  ulogging fw-zp-name                        : 35009
  ulogging fw-zone-name                      : 45237
  ulogging fw-action-name                    : 45238
  ulogging fw-proto-name                     : 45239
  ulogging fw-drop-reason                    : 35010
  ulogging fw-end-flow-reason-name           : 45240
  ulogging utd-policy-id-array               : 45251
  ulogging utd-policy-id                     : 45252
  ulogging utd-action-id-array               : 45253
  ulogging utd-action-id                     : 45254
  ulogging utd-ips-pri                       : 45255
  ulogging utd-ips-sid                       : 45256
  ulogging utd-ips-gid                       : 45257
  ulogging utd-ips-cid                       : 45258
  ulogging utd-urlf-url-hash                 : 45259
  ulogging utd-urlf-url-category             : 45260
  ulogging utd-urlf-url-reputation           : 45261
  ulogging utd-urlf-app-name                 : 45262
  ulogging utd-amp-dispos                    : 45263
  ulogging utd-amp-filename-hash             : 45264
  ulogging utd-amp-file-type                 : 45265
  ulogging utd-amp-file-hash                 : 45266
  ulogging utd-amp-malname-hash              : 45267
  ulogging utd-drop-reason-id                : 45268
  ulogging sdvt-drop-reason-id               : 45269
  ulogging utd-policy-name                   : 45270
  ulogging utd-urlf-url-str                  : 45271
  ulogging utd-amp-filename                  : 45272
  ulogging utd-amp-malware-name              : 45273
  ulogging utd-action-name                   : 45274
  ulogging utd-amp-dispos-name               : 45275
  ulogging utd-amp-filetype-name             : 45276
  ulogging utd-urlf-category-name            : 45277
  ulogging utd-drop-reason-name              : 45278
  ulogging sdvt-drop-reason-name             : 45279
  counter bytes sdwan pkt-cxp-d-bytes long   : 45280
  appqoe action                              : 45281
  appqoe sn-ip                               : 45282
  appqoe pass-reason                         : 45283
  appqoe dre-input-bytes                     : 45284
  appqoe dre-input-packets                   : 45285
  appqoe flags                               : 45286
  sdwan service-area                         : 45287
  ulogging utd-ips-policy-id                 : 45247
  ulogging utd-ips-action-id                 : 45248
  ulogging utd-urlf-policy-id                : 45249
  ulogging utd-urlf-action-id                : 45250
  ulogging utd-amp-policy-id                 : 45252
  ulogging utd-amp-action-id                 : 45254
  ulogging utd-urlf-reason-id                : 45288
  ulogging utd-urlf-reason-name              : 45289
  ulogging flow-direction                    : 45290
  routing distinguisher                      :    90
  sdwan tenant global id                     : 45291
  sdwan tenant vpn id                        : 45292
  application dns requests                   : 50001
  application dns delay response sum         : 50002
~~~
</div></details>

:::note warn
余談
- メータリング項目にはそれぞれIDが割り振られていることに注目
- NetFlow v5では、測定も出力も固定だったので、IDなどは不要でした
- わざわざ出さなくてもいい出力までお節介に出してくれるところが可愛い↓😲

~~~
C4331-02#show flow exporter export-ids ?
  ipfix       IPFIX (Version 10)
  netflow-v5  NetFlow Version 5
  netflow-v9  NetFlow Version 9

C4331-02#show flow exporter export-ids netflow-v5
NetFlow Version 5 does not use IDs.
~~~
:::

## 2.3 フィルターしてみる
眺めてみましょう♪

### 2.3.1 SD-WAN
~~~
C4331-02#show flow exporter export-ids ipfix | i sdwan
  counter bytes sdwan dropped long           : 45211
  sdwan sla-not-met                          : 45212
  sdwan preferred-color-not-met              : 45213
  sdwan qos-queue-id                         : 45214
  counter packets sdwan dropped long         : 37000
  counter packets sdwan pkt-cxp-d-pkts       : 45221
  sdwan traffic-category                     : 45231
  counter bytes sdwan pkt-cxp-d-bytes long   : 45280
  sdwan service-area                         : 45287
  sdwan tenant global id                     : 45291
  sdwan tenant vpn id                        : 45292
~~~

### 2.3.2 AppQoE
~~~
C4331-02#show flow exporter export-ids ipfix | i qoe
  counter packets appqoe fec-d-pkts          : 45216
  counter packets appqoe fec-r-pkts          : 45217
  counter packets appqoe pkt-dup-d-pkts-orig : 45218
  counter packets appqoe pkt-dup-d-pkts-dup  : 45219
  counter packets appqoe pkt-dup-r-pkts      : 45220
  counter bytes appqoe ssl-read              : 45222
  counter bytes appqoe ssl-written           : 45223
  counter bytes appqoe ssl-en-read           : 45224
  counter bytes appqoe ssl-en-written        : 45225
  counter bytes appqoe ssl-de-read           : 45226
  counter bytes appqoe ssl-de-written        : 45227
  appqoe ssl service type                    : 45228
  appqoe ssl traffic type                    : 45229
  appqoe ssl policy action                   : 45230
  appqoe action                              : 45281
  appqoe sn-ip                               : 45282
  appqoe pass-reason                         : 45283
  appqoe dre-input-bytes                     : 45284
  appqoe dre-input-packets                   : 45285
  appqoe flags                               : 45286
~~~

### 2.3.3 ART (Application Response Time)
~~~
C4331-02#show flow exporter export-ids ipfix | i art  
  art response time sum                      : 42071
  art response time minimum                  : 42073
  art response time maximum                  : 42072
  art server response time sum               : 42074
  art server response time minimum           : 42076
  art server response time maximum           : 42075
  art network time sum                       : 42081
  art network time minimum                   : 42083
  art network time maximum                   : 42082
  art client network time sum                : 42084
  art client network time minimum            : 42086
  art client network time maximum            : 42085
  art server network time sum                : 42087
  art server network time minimum            : 42089
  art server network time maximum            : 42088
  art total response time sum                : 42077
  art total response time minimum            : 42079
  art total response time maximum            : 42078
  art total transaction time sum             : 42041
  art total transaction time minimum         : 42043
  art total transaction time maximum         : 42042
  art count transactions                     : 42040
  art server packets                         :   299
  art server bytes                           :   232
  art count retransmissions                  : 42036
  art client packets                         :   298
  art client bytes                           :   231
  art count new connections                  : 42050
  art count responses                        : 42060
  art count late responses                   : 42068
  art count responses histogram bucket1      : 42061
  art count responses histogram bucket2      : 42062
  art count responses histogram bucket3      : 42063
  art count responses histogram bucket4      : 42064
  art count responses histogram bucket5      : 42065
  art count responses histogram bucket6      : 42066
  art count responses histogram bucket7      : 42067
  metadata multi-party-session-id            : 37055
  start timestamp                            : 38003
~~~

### 2.3.4 VXLAN
~~~
C4331-02#show flow exporter export-ids ipfix | i vxlan
  vxlan vnid                                 :   351
  vxlan sgt                                  : 33200
  vxlan flags                                : 33201
  vxlan vtep input                           : 33202
  vxlan vtep output                          : 33203
~~~

### 2.3.5 Wireless
~~~
C4331-02#show flow exporter export-ids ipfix | i wireless
  wireless ssid                              :   147
  wireless ap mac address                    :   367
  wireless client mac address                :   365
  wireless client ipv4 address               :   366
  wireless afd drop packets                  : 41107
  wireless afd accept packets                : 41108
  wireless afd drop bytes                    : 41109
  wireless afd accept bytes                  : 41110
~~~

### 2.3.6 Application
~~~
C4331-02#show flow exporter export-ids ipfix | i application
  application id                             :    95
  application name                           :    96
  application description                    :    94
  application media bytes counter            : 37004
  application media bytes counter long       : 37004
  application media bytes counter permanent  : 37005
  application media bytes rate               : 37006
  application media packets counter          : 37007
  application media packets counter long     : 37007
  application media packets counter permanen : 37008
  application media packets rate             : 37009
  application media packets rate variation   : 37010
  application media event                    : 37011
  waas application                           : 36006
  application media bytes rate per-flow min  : 37035
  application media bytes rate per-flow max  : 37036
  application media packets rate variation m : 37038
  application media packets rate variation m : 37039
  application media bytes rate per-flow      : 37034
  application version                        :   105
  application version name                   :   106
  application vendor                         :   107
  application category name                  : 45000
  application sub category name              : 45001
  application group name                     : 45002
  application delay average                  : 37064
  sub application tag                        :    97
  sub application name                       :   109
  sub application description                :   110
  application http uri statistics            : 42125
  application media packets rate variation s : 37094
  connection delay application sum           : 42074
  connection delay application min           : 42076
  connection delay application max           : 42075
  application video resolution width last    : 37500
  application video resolution height last   : 37501
  application video frame rate               : 37502
  application video payload bitrate average  : 37503
  application video payload bitrate fluctuat : 37504
  application video frame I counter frames   : 37505
  application video frame I counter packets  : 37506
  application video frame I counter bytes    : 37507
  application video frame STR counter frames : 37508
  application video frame STR counter packet : 37509
  application video frame STR counter bytes  : 37510
  application video frame LTR counter frames : 37511
  application video frame LTR counter packet : 37512
  application video frame LTR counter bytes  : 37513
  application video frame super-P counter fr : 37514
  application video frame super-P counter pa : 37515
  application video frame super-P counter by : 37516
  application video frame NR counter frames  : 37517
  application video frame NR counter packets : 37518
  application video frame NR counter bytes   : 37519
  application video frame I slice-quantizati : 37520
  application video frame STR slice-quantiza : 37521
  application video frame LTR slice-quantiza : 37522
  application video frame super-P slice-quan : 37523
  application video frame NR slice-quantizat : 37524
  application video eMOS compression bitstre : 37525
  application video eMOS compression network : 37526
  application video frame I counter packets  : 37527
  application video frame STR counter packet : 37528
  application video frame LTR counter packet : 37529
  application video frame super-P counter pa : 37530
  application video frame NR counter packets : 37531
  application video frame percentage damaged : 37532
  application video eMOS packet-loss bitstre : 37533
  application video eMOS packet-loss network : 37534
  application video scene-complexity         : 37535
  application video level-of-motion          : 37536
  application voice number called            : 37200
  application voice number calling           : 37201
  application voice setup time               : 37202
  application voice call duration            : 37203
  application voice rx bad-packet            : 37204
  application voice rx out-of-sequence       : 37205
  application voice codec id                 : 37206
  application voice play delay current       : 37207
  application voice play delay minimum       : 37208
  application voice play delay maximum       : 37209
  application voice sip call-id              : 37210
  application voice router global-call-id    : 37211
  application voice delay round-trip         : 37212
  application voice delay end-point          : 37213
  application voice r-factor 1               : 37214
  application voice r-factor 2               : 37215
  application voice mos conversation         : 37216
  application voice mos listening            : 37217
  application voice concealment-ratio averag : 37218
  application voice jitter configured type   : 37219
  application voice jitter configured minimu : 37220
  application voice jitter configured maximu : 37221
  application voice jitter configured initia : 37222
  application voice rx early-packet count    : 37223
  application voice rx late-packet count     : 37224
  application voice jitter buffer-overrun    : 37225
  application voice packet conceal-count     : 37226
  application http uri statistics            : 42125
  application transaction counter new        : 42019
  application traffic-class                  : 45011
  application business-relevance             : 45012
  application set name                       : 44999
  application family name                    : 44998
  application dns requests                   : 50001
  application dns delay response sum         : 50002
~~~

:::note info
めちゃめちゃありますね！眺めているだけで想像力をかき立てられるけど、企業向けルーターやスイッチって、こんなに進化しているんだね。
:::

# 3. コントローラーでのネットワークデータ活用例

前半は、IOS XEレベルで、さまざまなメータリングが可能になっているらしき様子を眺めてみました。後半では、それがどのように実際に活用されているのか、コントローラーの観点からみていきましょう。

具体的には、シスコの企業向けコントローラーのフラッグシップであるCisco DNA Centerと、クラウド管理型ネットワークのCisco Merakiを見ていきます。

:::note
特に、Cisco Merakiは2022年6月に、[Catalyst9000スイッチの監視に対応](https://documentation.meraki.com/Cloud_Monitoring_for_Catalyst/Onboarding/Cloud_Monitoring_Overview_and_FAQ_JP)したことが[大きな話題](https://twitter.com/syoshina_jp/status/1536898758583414784)となりました。Cisco MerakiはCatalyst9000に対してどのような設定を投入して活用するのか、気になるところです。ちなみに今なら[キャンペーン中](https://meraki.cisco.com/ja-jp/lp/quote-and-catalyst-monitoring-campaign/#2)だそうです😀
:::

## 3.1 Cisco DNA Centerによるアシュアランスのための設定例

Cisco DNA Centerは、ネットワークの可視化やAI分析のために複数の設定を行います。SyslogやSNMPに加えて、NetFlowやTelemetry Subscriptionをクリッククリックで勝手に設定してくれます。そのため、よく言えばオペレータはコマンドやNetconfの知識がなくても使えてしまうのですが、装置レベルでは何が起こっているのかが見えにくかったりします。

### 3.1.1 DNACアシュアランスが投入するEzPM（イージーピーエム）

まずはDNACがルーターに投入するNetFlowの設定を見ていきます。DNACアシュアランスを利用するための設定は、DNACからテレメトリ有効化時に自動で投入されるため、コマンドラインで手打ちする必要はありません。
![SS 2022-12-01 11.40.04.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/157325/050ec1af-bf3c-6f54-101b-735c8462c1e6.png)

~~~
config t
Enter configuration commands, one per line. End with CNTL/Z.
C4331-02(config)#performance monitor context tesseract profile application-assurance ...(1)
C4331-02(config-perf-mon)#exporter destination 10.71.130.2 source GigabitEthernet0/0/0 transport udp port 6007 ...(2)
C4331-02(config-perf-mon)#traffic-monitor assurance-monitor ...(3)
C4331-02(config-perf-mon)#traffic-monitor assurance-rtp-monitor ...(3)
C4331-02(config-perf-mon)#interface GigabitEthernet0/0/1
C4331-02(config-if)#performance monitor context tesseract ...(4)
C4331-02(config-if)#do write mem
Building configuration...
[OK]
C4331-02(config-if)#
~~~

**これだけ！？？** と思われるかもしれません。実はこれはEzPM (Easy Performance Monitor)という仕組みで、特に大量のパラメーターを設定するFlexible NetFlowという機能に対して、ユースケースごとに一気に設定できるようにFlexible NetFlowの設定を固めた、マクロのようなIOS XEの機能です。

解説。

1. パフォーマンスモニターのコンテクストを作って...
2. その中にExporterも書いちゃって...
3. トラフィックモニターの塊を割り当てて...
4. コンテクストをインターフェースにアタッチします。

:::note info
EzPMの設定内のメータリング部分は、「プロファイル > トラフィックモニター」という構造になっています。この例では **application-assurance** プロファイルの中の **assurance-monitor** と **assurance-rtp-monitor** の二つを使っていることが分かります。
:::

:::note info
ここで出てくる任意コンテクスト名で使われている **Tesseract** というのは、DNACアシュアランスのコードネームだそうです。
:::

それでは、DNACが投入したEzPMコンテクストであるTesseractの中身は、以下のコマンドで確認できます。これによって、DNACアシュアランスが使うNetFlow設定の実態が確認できました（2022/12現在）。

~~~
show performance monitor context tesseract configuration 
~~~

### 3.1.2 DNACアシュアランスが投入するNetFlowの中身

<details><summary>DNACによって設定されたEzPMコンテクストの中身。こちらをクリック。</summary><div>

~~~
C4331-02#show performance monitor context tesseract configuration 
!===============================================================================
!                 Equivalent Configuration of Context tesseract                !
!===============================================================================
!Exporters
!==========
!
flow exporter tesseract-1
 description performance monitor context tesseract exporter
 destination 10.71.130.2
 source GigabitEthernet0/0/0
 transport udp 6007
 export-protocol ipfix
 template data timeout 300
 option interface-table timeout 300
 option vrf-table timeout 300
 option sampler-table timeout 300
 option application-table timeout 300
 option application-attributes timeout 300
!
!Access Lists
!=============
!Class-maps
!===========
!Samplers 
!=========
!Records and Monitors
!=====================
!
flow record tesseract-app_assurance_ipv4
 description ezPM record
 match ipv4 version
 match ipv4 protocol
 match application name
 match connection client ipv4 address
 match connection server ipv4 address
 match connection server transport port
 match flow observation point
 collect routing vrf input
 collect flow direction
 collect timestamp absolute first
 collect timestamp absolute last
 collect connection initiator
 collect connection new-connections
 collect connection server counter responses
 collect connection delay network to-server sum
 collect connection client counter packets retransmitted
 collect connection delay network client-to-server sum
 collect connection delay application sum
 collect connection server counter packets long
 collect connection client counter packets long
 collect connection server counter packets retransmitted
 collect connection server counter bytes network long
 collect connection client counter bytes network long
!
!
flow monitor tesseract-app_assurance_ipv4
 description ezPM monitor
 exporter tesseract-1
 cache timeout active 60
 cache entries 1350
 record tesseract-app_assurance_ipv4
!
!
flow record tesseract-app_assurance_ipv6
 description ezPM record
 match ipv6 version
 match ipv6 protocol
 match application name
 match connection client ipv6 address
 match connection server transport port
 match connection server ipv6 address
 match flow observation point
 collect routing vrf input
 collect flow direction
 collect timestamp absolute first
 collect timestamp absolute last
 collect connection initiator
 collect connection new-connections
 collect connection server counter responses
 collect connection delay network to-server sum
 collect connection client counter packets retransmitted
 collect connection delay network client-to-server sum
 collect connection delay application sum
 collect connection server counter packets long
 collect connection client counter packets long
 collect connection server counter packets retransmitted
 collect connection server counter bytes network long
 collect connection client counter bytes network long
!
!
flow monitor tesseract-app_assurance_ipv6
 description ezPM monitor
 exporter tesseract-1
 cache timeout active 60
 cache entries 1350
 record tesseract-app_assurance_ipv6
!
!
flow record tesseract-app_assurance_rtp_ipv4
 description ezPM record
 match ipv4 version
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match transport rtp ssrc
 match flow direction
 match flow observation point
 collect routing vrf input
 collect transport packets lost counter
 collect counter bytes long
 collect counter packets long
 collect timestamp absolute first
 collect timestamp absolute last
 collect application name
 collect connection initiator
 collect transport rtp payload-type
 collect transport rtp jitter mean sum
!
!
flow monitor tesseract-app_assurance_rtp_ipv4
 description ezPM monitor
 exporter tesseract-1
 cache timeout active 60
 cache entries 200
 record tesseract-app_assurance_rtp_ipv4
!
!
flow record tesseract-app_assurance_rtp_ipv6
 description ezPM record
 match ipv6 version
 match ipv6 protocol
 match ipv6 source address
 match ipv6 destination address
 match transport source-port
 match transport destination-port
 match transport rtp ssrc
 match flow direction
 match flow observation point
 collect routing vrf input
 collect transport packets lost counter
 collect counter bytes long
 collect counter packets long
 collect timestamp absolute first
 collect timestamp absolute last
 collect application name
 collect connection initiator
 collect transport rtp payload-type
 collect transport rtp jitter mean sum
!
!
flow monitor tesseract-app_assurance_rtp_ipv6
 description ezPM monitor
 exporter tesseract-1
 cache timeout active 60
 cache entries 200
 record tesseract-app_assurance_rtp_ipv6
!
!Interface Attachments
!======================
interface GigabitEthernet0/0/1
 ip flow monitor tesseract-app_assurance_ipv4 input
 ip flow monitor tesseract-app_assurance_ipv4 output
 ipv6 flow monitor tesseract-app_assurance_ipv6 input
 ipv6 flow monitor tesseract-app_assurance_ipv6 output
 ip flow monitor tesseract-app_assurance_rtp_ipv4 input
 ip flow monitor tesseract-app_assurance_rtp_ipv4 output
 ipv6 flow monitor tesseract-app_assurance_rtp_ipv6 input
 ipv6 flow monitor tesseract-app_assurance_rtp_ipv6 output
~~~
</div></details>

測定パラメーターが多いこと自体は良いのですが、これだけの内容を手打ちするはほぼ不可能というか、組み合わせパターンを考えるのも現実的ではないですよね。コントローラー側の要件に合わせた設定を、コントローラーから、GUIのみで投入できる形態が増えてます。

ネットワーク装置の観点では、もちろん汎用プロトコルに対応したあらゆるNMS/コントローラーに対応するのですが、このように装置の膨大な測定項目を簡単に扱えるようになっているところが、専用コントローラーの強みと言えますね。

:::note info
DNACからルーターに対して、EzPMを使って設定を投入しているところが、また可愛いポイントです。
:::

### 3.1.3 EzPM Profiles

私がテストしているISR4331では、6つのプロファイルが確認できます。これらのプロファイルがそれぞれ、設定を束ねたマクロの単位になっています。（DNACはapplication-assuranceのプロファイルを使っていました）

~~~
C4331-02#show performance monitor profile ?
  application-assurance    Application assurance profile
  application-experience   Application eXperience performance monitor profile
  application-performance  Application performance profile
  application-statistics   Application statistics profile
  sdwan-fnf                SDWAN NetFlow profile
  sdwan-performance        SDWAN performance profile
~~~

### 3.1.4 EzPM Profile: sdwan-performance
参考までに、sdwan-performanceプロファイルの中身を貼り付けておきます。一つ一つの設定項目を超えて、このように使って欲しいという、開発側の意図が見えて面白いし、監視を考える上で非常に参考になります。

<details><summary>EzPM Profile: sdwan-performance</summary><div>

~~~
C4331-02#show performance monitor profile sdwan-performance 
!! Performance monitor profile: sdwan-performance

  !! description: SDWAN performance profile
  !! Performance Monitor based profile
  !! Fine-grain NBAR based profile
  !! CLI 'traffic-monitor all' is enabled

  !! Exporter template:
      flow exporter ezpm_exporter
        description performance monitor context %s exporter
        source loopback 0
        destination 10.10.10.0
        export-protocol ipfix
        template data timeout 600
        option application-table timeout 600
        option sampler-table timeout 600
        option sub-application-table timeout 600
        option application-attributes timeout 600
        option interface-table timeout 600
        option tunnel-tloc-table timeout 600
      exit

  !! Traffic monitor: art-cor-saas

    !! Attr: customizable
    !! User knobs: ipv4/ipv6 cache-size class-and class-replace cache-type interval-timeout

    !! Classification (ACL):
      ip access-list extended art_cxp_ipv4_tcp  ! Attr: ipv4-in ipv4-out
        permit tcp any any
      exit

    !! Classification (Class-maps):
      class-map match-all art_cxp_ipv4 ! Attr: ipv4-in ipv4-out child
        !! match class-map UserDefined
        match access-group name art_cxp_ipv4_tcp
      exit
      class-map match-all art_cxp_art_ipv4 ! Attr: ipv4-in ipv4-out parent
        match class-map art_cxp_ipv4
        match class-map art_ipv4
      exit

    !! Flow monitors and records:
      flow record type performance-monitor art_cxp_ipv4
        match ipv4 protocol 
        match application name 
        match connection client ipv4 address 
        match connection server ipv4 address 
        match connection server transport port 
        match timestamp absolute monitoring-interval start 
        match flow observation point 
        match routing vrf service 
        collect ipv4 dscp 
        collect interface input 
        collect interface output 
        collect flow sampler 
        collect timestamp absolute first 
        collect timestamp absolute last 
        collect connection new-connections 
        collect connection server counter responses 
        collect connection delay network to-server sum 
        collect connection delay network to-server min 
        collect connection delay network to-server max 
        collect connection delay network to-client sum 
        collect connection delay network to-client min 
        collect connection delay network to-client max 
        collect connection client counter packets retransmitted 
        collect connection delay application sum 
        collect connection delay application min 
        collect connection delay application max 
        collect connection server counter packets long 
        collect connection client counter packets long 
        collect connection client counter bytes retransmitted 
        collect connection server counter bytes retransmitted 
        collect connection server counter packets retransmitted 
        collect connection server counter bytes network long 
        collect connection client counter bytes network long 
        collect overlay session id input 
        collect overlay session id output 
        collect counter packets sdwan pkt-cxp-d-pkts 
        collect sdwan traffic-category 
        collect counter bytes sdwan pkt-cxp-d-bytes long 
        collect sdwan service-area 
      exit
      flow monitor type performance-monitor art_cxp_ipv4 ! Attr: ipv4-in ipv4-out
        record art_cxp_ipv4
        history size 0
        cache type synchronized
        cache timeout synchronized 60
        cache timeout active 60
        cache timeout inactive 15
        cache entries 900
      exit
  !! end Traffic monitor: art-cor-saas
          
  !! Traffic monitor: application-response-time

    !! Attr: customizable
    !! User knobs: ipv4/ipv6 cache-size class-and class-replace cache-type interval-timeout

    !! Classification (ACL):
      ip access-list extended art_ipv4_tcp  ! Attr: ipv4-in ipv4-out
        permit tcp any any
      exit

    !! Classification (Class-maps):
      class-map match-all art_ipv4 ! Attr: ipv4-in ipv4-out child
        !! match class-map UserDefined
        match access-group name art_ipv4_tcp
      exit
      class-map match-all art_cxp_art_ipv4 ! Attr: ipv4-in ipv4-out parent
        match class-map art_cxp_ipv4
        match class-map art_ipv4
      exit

    !! Flow monitors and records:
      flow record type performance-monitor art_ipv4
        match ipv4 protocol 
        match application name 
        match connection client ipv4 address 
        match connection server ipv4 address 
        match connection server transport port 
        match timestamp absolute monitoring-interval start 
        match flow observation point 
        match routing vrf service 
        collect ipv4 dscp 
        collect ipv4 ttl 
        collect interface input 
        collect interface output 
        collect flow direction 
        collect flow sampler 
        collect timestamp absolute first 
        collect timestamp absolute last 
        collect connection initiator 
        collect connection new-connections 
        collect connection sum-duration 
        collect connection delay response to-server sum 
        collect connection server counter responses 
        collect connection delay response to-server histogram late 
        collect connection delay network to-server sum 
        collect connection delay network to-client sum 
        collect connection client counter packets retransmitted 
        collect connection delay network client-to-server sum 
        collect connection delay application sum 
        collect connection delay response client-to-server sum 
        collect connection transaction duration sum 
        collect connection transaction duration min 
        collect connection transaction duration max 
        collect connection transaction counter complete 
        collect connection server counter bytes long 
        collect connection server counter packets long 
        collect connection client counter bytes long 
        collect connection client counter packets long 
        collect connection client counter bytes retransmitted 
        collect connection server counter bytes retransmitted 
        collect connection server counter packets retransmitted 
        collect connection server counter bytes network long 
        collect connection client counter bytes network long 
        collect connection delay network client-to-server num-samples 
        collect connection delay network to-server num-samples 
        collect connection delay network to-client num-samples 
        collect overlay session id input 
        collect overlay session id output 
      exit
      flow monitor type performance-monitor art_ipv4 ! Attr: ipv4-in ipv4-out
        record art_ipv4
        history size 0
        cache type synchronized
        cache timeout synchronized 60
        cache timeout active 60
        cache timeout inactive 15
        cache entries 900
      exit
  !! end Traffic monitor: application-response-time

  !! Traffic monitor: media

    !! Attr: customizable
    !! User knobs: ipv4/ipv6 cache-size class-and class-replace interval-timeout

    !! Classification (ACL):
      ip access-list extended media_ipv4_udp  ! Attr: ipv4-in ipv4-out
        permit udp any any
      exit

    !! Classification (Class-maps):
      class-map match-any media_app ! Attr: ipv4-in ipv4-out
        match protocol rtp in-app-hierarchy
      exit
      class-map match-all media_ipv4 ! Attr: ipv4-in ipv4-out
        !! match class-map UserDefined
        match access-group name media_ipv4_udp
        match class-map media_app
      exit

    !! Flow monitors and records:
      flow record type performance-monitor media_ipv4
        match ipv4 protocol 
        match ipv4 source address 
        match ipv4 destination address 
        match transport source-port 
        match transport destination-port 
        match transport rtp ssrc 
        match flow direction 
        match timestamp absolute monitoring-interval start 
        match flow observation point 
        collect routing forwarding-status 
        collect ipv4 dscp 
        collect ipv4 ttl 
        collect transport packets expected counter 
        collect transport packets lost counter 
        collect transport packets lost rate 
        collect transport rtp jitter mean 
        collect transport rtp jitter minimum 
        collect transport rtp jitter maximum 
        collect interface input 
        collect interface output 
        collect flow sampler 
        collect counter bytes long 
        collect counter packets 
        collect counter bytes rate 
        collect timestamp absolute first 
        collect timestamp absolute last 
        collect application name 
        collect application media bytes counter 
        collect application media bytes rate 
        collect application media packets counter 
        collect application media packets rate 
        collect connection initiator 
        collect connection new-connections 
        collect transport rtp payload-type 
        collect transport rtp jitter mean sum 
        collect overlay session id input 
        collect overlay session id output 
        collect routing vrf service 
      exit
      flow monitor type performance-monitor media_ipv4 ! Attr: ipv4-in ipv4-out fixed-cache-sz
        record media_ipv4
        history size 0
        cache type synchronized
        cache timeout synchronized 60
        cache entries 16000
      exit
  !! end Traffic monitor: media
  !! end (Traffic monitors)

  policy-map type performance-monitor policy-in ! Attr: account-on-resolution 
    parameter default account-on-resolution
       class art_cxp_art_ipv4        ! application-response-time
        flow monitor art_ipv4
        flow monitor art_cxp_ipv4
       class art_cxp_art_ipv4        ! art-cor-saas
        flow monitor art_ipv4
        flow monitor art_cxp_ipv4
       class art_cxp_ipv4        ! art-cor-saas
        flow monitor art_cxp_ipv4
       class art_ipv4        ! application-response-time
        flow monitor art_ipv4
       class media_ipv4        ! media
        flow monitor media_ipv4
    exit
  exit

!! Policy-map attachment to interface:


!! service-policy type performance-monitor input policy-in


  policy-map type performance-monitor policy-out ! Attr: account-on-resolution 
    parameter default account-on-resolution
       class art_cxp_art_ipv4        ! application-response-time
        flow monitor art_ipv4
        flow monitor art_cxp_ipv4
       class art_cxp_art_ipv4        ! art-cor-saas
        flow monitor art_ipv4
        flow monitor art_cxp_ipv4
       class art_cxp_ipv4        ! art-cor-saas
        flow monitor art_cxp_ipv4
       class art_ipv4        ! application-response-time
        flow monitor art_ipv4
       class media_ipv4        ! media
        flow monitor media_ipv4
    exit
  exit

!! Policy-map attachment to interface:


!! service-policy type performance-monitor output policy-out


!! end of sdwan-performance profile definition
~~~
</div></details>

### 3.1.5 DNACが装置に投入するテレメトリサブスクリプション

※本記事では深掘りしませんが、DNACが装置に投入するテレメトリサブスクリプションの設定も参考までに記録しておきます。

<details><summary>DNACが装置に対して投入するテレメトリサブスクリプションのNetconfコールのボディ例</summary><div>

~~~xml
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="1">
<edit-config>
<target>
<running/>
</target>
<default-operation>merge</default-operation>
<config>
<mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
<mdt-subscription>
<subscription-id>602</subscription-id>
<base>
<rcvr-type>rcvr-type-protocol</rcvr-type>
<stream><![CDATA[native]]></stream>
<encoding><![CDATA[encode-tdl]]></encoding>
<period><![CDATA[360000]]></period>
<tdl-uri><![CDATA[/services;serviceName=ios_emul_oper/lisp_routers;top_id=0/sessions]]></tdl-uri>
<source-address>10.71.130.25</source-address>
</base>
<mdt-receiver-names>
<mdt-receiver-name>
<name><![CDATA[DNAC_ASSURANCE_RECEIVER]]></name>
</mdt-receiver-name>
</mdt-receiver-names>
</mdt-subscription>
</mdt-config-data>
<mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
<mdt-subscription>
<subscription-id>603</subscription-id>
<base>
<rcvr-type>rcvr-type-protocol</rcvr-type>
<stream><![CDATA[native]]></stream>
<encoding><![CDATA[encode-tdl]]></encoding>
<no-synch-on-start><![CDATA[false]]></no-synch-on-start>
<tdl-uri><![CDATA[/services;serviceName=iosevent/lisp_tcp_session_state]]></tdl-uri>
<source-address>10.71.130.25</source-address>
</base>
<mdt-receiver-names>
<mdt-receiver-name>
<name><![CDATA[DNAC_ASSURANCE_RECEIVER]]></name>
</mdt-receiver-name>
</mdt-receiver-names>
</mdt-subscription>
</mdt-config-data>
<mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
<mdt-subscription>
<subscription-id>604</subscription-id>
<base>
<rcvr-type>rcvr-type-protocol</rcvr-type>
<stream><![CDATA[native]]></stream>
<encoding><![CDATA[encode-tdl]]></encoding>
<period><![CDATA[360000]]></period>
<nested-uri><![CDATA[/services;serviceName=ios_emul_oper/lisp_routers;top_id=0/instances;iid=0/af;iaftype=LISP_TDL_IAF_IPV4/lisp_publisher]]></nested-uri>
<source-address>10.71.130.25</source-address>
</base>
<mdt-receiver-names>
<mdt-receiver-name>
<name><![CDATA[DNAC_ASSURANCE_RECEIVER]]></name>
</mdt-receiver-name>
</mdt-receiver-names>
</mdt-subscription>
</mdt-config-data>
<mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
<mdt-subscription>
<subscription-id>605</subscription-id>
<base>
<rcvr-type>rcvr-type-protocol</rcvr-type>
<stream><![CDATA[native]]></stream>
<encoding><![CDATA[encode-tdl]]></encoding>
<no-synch-on-start><![CDATA[false]]></no-synch-on-start>
<tdl-uri><![CDATA[/services;serviceName=iosevent/lisp_pubsub_session_state]]></tdl-uri>
<source-address>10.71.130.25</source-address>
</base>
<mdt-receiver-names>
<mdt-receiver-name>
<name><![CDATA[DNAC_ASSURANCE_RECEIVER]]></name>
</mdt-receiver-name>
</mdt-receiver-names>
</mdt-subscription>
</mdt-config-data>
<mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
<mdt-subscription>
<subscription-id>606</subscription-id>
<base>
<rcvr-type>rcvr-type-protocol</rcvr-type>
<stream><![CDATA[native]]></stream>
<encoding><![CDATA[encode-tdl]]></encoding>
<period><![CDATA[360000]]></period>
<nested-uri><![CDATA[/services;serviceName=ios_emul_oper/lisp_routers;top_id=0/remote_locator_sets;name=default-etr-locator-set-ipv4/rem_loc_set_rlocs_si]]></nested-uri>
<source-address>10.71.130.25</source-address>
</base>
<mdt-receiver-names>
<mdt-receiver-name>
<name><![CDATA[DNAC_ASSURANCE_RECEIVER]]></name>
</mdt-receiver-name>
</mdt-receiver-names>
</mdt-subscription>
</mdt-config-data>
<mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
<mdt-subscription>
<subscription-id>607</subscription-id>
<base>
<rcvr-type>rcvr-type-protocol</rcvr-type>
<stream><![CDATA[native]]></stream>
<encoding><![CDATA[encode-tdl]]></encoding>
<no-synch-on-start><![CDATA[false]]></no-synch-on-start>
<tdl-uri><![CDATA[/services;serviceName=iosevent/lisp_etr_si_type]]></tdl-uri>
<source-address>10.71.130.25</source-address>
</base>
<mdt-receiver-names>
<mdt-receiver-name>
<name><![CDATA[DNAC_ASSURANCE_RECEIVER]]></name>
</mdt-receiver-name>
</mdt-receiver-names>
</mdt-subscription>
</mdt-config-data>
</config>
</edit-config>
</rpc>
~~~
</div></details>

<details><summary>投入されたテレメトリ設定。ルーターの場合は少ないです。</summary><div>

~~~
C4331-02#show run | sec telemetry
telemetry ietf subscription 602
 encoding encode-tdl
 filter tdl-uri /services;serviceName=ios_emul_oper/lisp_routers;top_id=0/sessions
 receiver-type protocol
 source-address 10.71.130.25
 stream native
 update-policy periodic 360000
 receiver name DNAC_ASSURANCE_RECEIVER
telemetry ietf subscription 603
 encoding encode-tdl
 filter tdl-uri /services;serviceName=iosevent/lisp_tcp_session_state
 receiver-type protocol
 source-address 10.71.130.25
 stream native
 update-policy on-change
 receiver name DNAC_ASSURANCE_RECEIVER
telemetry ietf subscription 604
 encoding encode-tdl
 filter nested-uri /services;serviceName=ios_emul_oper/lisp_routers;top_id=0/instances;iid=0/af;iaftype=LISP_TDL_IAF_IPV4/lisp_publisher
 receiver-type protocol
 source-address 10.71.130.25
 stream native
 update-policy periodic 360000
 receiver name DNAC_ASSURANCE_RECEIVER
telemetry ietf subscription 605
 encoding encode-tdl
 filter tdl-uri /services;serviceName=iosevent/lisp_pubsub_session_state
 receiver-type protocol
 source-address 10.71.130.25
 stream native
 update-policy on-change
 receiver name DNAC_ASSURANCE_RECEIVER
telemetry ietf subscription 606
 encoding encode-tdl
 filter nested-uri /services;serviceName=ios_emul_oper/lisp_routers;top_id=0/remote_locator_sets;name=default-etr-locator-set-ipv4/rem_loc_set_rlocs_si
 receiver-type protocol
 source-address 10.71.130.25
 stream native
 update-policy periodic 360000
 receiver name DNAC_ASSURANCE_RECEIVER
telemetry ietf subscription 607
 encoding encode-tdl
 filter tdl-uri /services;serviceName=iosevent/lisp_etr_si_type
 receiver-type protocol
 source-address 10.71.130.25
 stream native
 update-policy on-change
 receiver name DNAC_ASSURANCE_RECEIVER
telemetry receiver protocol DNAC_ASSURANCE_RECEIVER
 host ip-address 10.71.130.2 25103
 protocol tls-native profile sdn-network-infra-iwan
~~~
</div></details>

:::note info
どこで使われているのかわかりにくいNetconfやTelemetryが、こんな風に浸透して活用されてたのですね！！
:::

## 3.2 Meraki クラウドによる Catalystスイッチの監視

2022年6月のCiscoLiveイベントにて、MerakiクラウドからCatalyst9000シリーズスイッチ(の一部）が管理できる機能が発表され、Merakiダッシュボードから即日利用可能となりました！

![SS 2022-11-29 15.29.35.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/157325/ff5939ae-7b55-d0de-06d7-8b05c2ab08fc.png)

詳しい設定や機能については本家を参照いただくとして、以下のアプリを使ってCatalyst9000スイッチをMerakiダッシュボードに登録するときのNetFlow設定（とテレメトリ設定）に注目してみます。

<img src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/157325/d11da4bf-3a8c-822e-fa5e-f868c102c035.png"  width="300px">

### 3.2.1 MerakiクラウドオンボーディングアプリがCatalyst9000スイッチに投入するNetFlow設定

Merakiクラウドに登録時に自動投入されたFlow関連の設定は以下です。collect application http hostは個別にアクセスしたURI Hostアドレスを取得する設定ですが、こんなことまでスイッチにやらせるのですね😀

~~~cisco:MerakiクラウドオンボーディングアプリがCatalyst9000スイッチに投入するNetFlow設定
+flow record MERAKI_AVC_HTTP_SSL_IPV4
 +match application name
 +match connection client ipv4 address
 +match connection server ipv4 address
 +match connection server transport port
 +match flow observation point
 +match ipv4 protocol
 +match ipv4 version
 +collect application http host
 +collect application ssl common-name
 +collect connection client counter bytes network long
 +collect connection client counter packets long
 +collect connection initiator
 +collect connection new-connections
 +collect connection server counter bytes network long
 +collect connection server counter packets long
 +collect datalink mac source address input
 +collect datalink mac source address output
 +collect flow direction
 +collect timestamp absolute first
 +collect timestamp absolute last
+flow record MERAKI_AVC_HTTP_SSL_IPV6
 +match application name
 +match connection client ipv6 address
 +match connection server ipv6 address
 +match connection server transport port
 +match flow observation point
 +match ipv6 protocol
 +match ipv6 version
 +collect application http host
 +collect application ssl common-name
 +collect connection client counter bytes network long
 +collect connection client counter packets long
 +collect connection initiator
 +collect connection new-connections
 +collect connection server counter bytes network long
 +collect connection server counter packets long
 +collect datalink mac source address input
 +collect datalink mac source address output
 +collect flow direction
 +collect timestamp absolute first
 +collect timestamp absolute last
+flow exporter MERAKI_AVC
 +destination local file-export default <--- ★17.2以降
 +export-protocol ipfix
 +option interface-table timeout 300
 +option application-table
 +option application-attributes
+flow monitor MERAKI_AVC_IPV4
 +exporter MERAKI_AVC
 +cache timeout inactive 60
 +cache timeout active 300
 +cache entries 65536
 +record MERAKI_AVC_HTTP_SSL_IPV4
+flow monitor MERAKI_AVC_IPV6
 +exporter MERAKI_AVC
 +cache timeout inactive 60
 +cache timeout active 300
 +cache entries 65536
 +record MERAKI_AVC_HTTP_SSL_IPV6
+flow file-export default <--- ★17.2以降、パブリックなネットワーク越しに測定データをHTTPで送る仕組み
 +destination 18.232.244.158 transport http dest-port 18088 upload-path api/ipfixfilecollector/890f52f0-c986-4721-bbad-be211d0bc536/f3c9ddb3-da52-4354-aee1-62bd28084480/92564474-3d7b-40ef-875a-f5bbf1a9c481/post_file
 +file max-size 10
 +file max-count 2
 +file max-create-interval 5
~~~

### 3.2.2 Catalyst9000 スイッチから MerakiクラウドへのFlow Exportがシブい
一つ注目すべき点は、Flow exportは通常の企業ネットワーク内部ではUDPを使って送信するのですが、Merakiクラウドはインターネット上にあるため、Exportの仕組みに工夫が加えられています。これはIOS XE17.2以降でサポートされた機能ですが、フローコレクタに対して直接送信するのではなく、一旦ローカルにファイルを作成して、それをHTTPSを使ってMerakiクラウドに対して送信しています。

この部分です。

~~~
+flow exporter MERAKI_AVC
 +destination local file-export default <--- ★17.2以降
 +export-protocol ipfix
 +option interface-table timeout 300
 +option application-table
 +option application-attributes
+flow file-export default <--- ★17.2以降、パブリックなネットワーク越しに測定データをHTTPで送る仕組み
 +destination 18.232.244.158 transport http dest-port 18088 upload-path api/ipfixfilecollector/890f52f0-c986-4721-bbad-be211d0bc536/f3c9ddb3-da52-4354-aee1-62bd28084480/92564474-3d7b-40ef-875a-f5bbf1a9c481/post_file
 +file max-size 10
 +file max-count 2
 +file max-create-interval 5
~~~

昔からのNetFlow屋さんにとっては、おっ！？？と思うポイントでした。パブリッククラウド時代に合わせた機能拡張ですね。

### 3.2.3 Merakiクラウドオンボーディングアプリが装置に投入するテレメトリサブスクリプション
本記事では深掘りしませんが、Merakiクラウドオンボーディングアプリが装置に投入するテレメトリサブスクリプションの設定も参考までに記録しておきます。こちらはIP直書きなど生々しいですが、特に上の設定と対比してみると、フローとして測定されて送信される内容と、装置の情報やイベントとしてPubSub型で送信される内容が使い分けられていることがよくわかります。

<details><summary>MerakiクラウドオンボーディングアプリがCatalyst9000スイッチを監視する際に投入するテレメトリ設定</summary><div>

~~~
+telemetry ietf subscription 1001
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=sman_oper/control_process
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1002
 +encoding encode-tdl
 +filter tdl-transform MERAKI_INTF_STATS_DELTA
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1003
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/cdp_neighbor_detail
 +stream native
 +update-policy on-change
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1004
 +encoding encode-tdl
 +filter nested-uri /services;serviceName=sman_oper/control_process;fru=BINOS_FRU_RP;slotnum=0;baynum=0;chassisnum=1?load_avg_minute
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1007
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/platform_component
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1011
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=smevent/sessionevent
 +stream native
 +update-policy on-change
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1012
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=sessmgr_oper/session_context_data
 +stream native
 +update-policy periodic 360000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1013
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=iosevent/sisf_mac_oper_state
 +stream native
 +update-policy on-change
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1014
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/sisf_db_wired_mac
 +stream native
 +update-policy periodic 360000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1015
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/poe_port_detail
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1016
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/poe_module
 +stream native
 +update-policy periodic 60000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1018
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/cdp_neighbor_detail
 +stream native
 +update-policy periodic 360000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1020
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=stkmevent/stkmevent
 +stream native
 +update-policy on-change
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1021
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_oper/switch_oper_info
 +stream native
 +update-policy on-change
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1030
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=iosevent/platform_component_state_update
 +stream native
 +update-policy on-change
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 1031
 +encoding encode-tdl
 +filter tdl-uri /services;serviceName=ios_emul_oper/entity_information
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry ietf subscription 2002
 +encoding encode-tdl
 +filter tdl-transform MERAKI_PORTCHANNEL_STATS_DELTA
 +stream native
 +update-policy periodic 30000
 +receiver ip address 18.232.244.158 25103 protocol cloud-native
+telemetry transform MERAKI_INTF_STATS_DELTA
 +input table tbl_interfaces_state
  +field ipv4
  +field name
  +field speed
  +field if_index
  +field description
  +field oper_status
  +field admin_status
  +field phys_address
  +field interface_type
  +field statistics.rx_pps
  +field statistics.tx_pps
  +field statistics.in_octets
  +field statistics.out_errors
  +field ether_state.media_type
  +field statistics.in_errors_64
  +field statistics.out_discards
  +field statistics.in_crc_errors
  +field statistics.out_octets_64
  +field intf_ext_state.error_type
  +field statistics.in_discards_64
  +field statistics.in_unicast_pkts
  +field statistics.out_unicast_pkts
  +field ether_stats.in_jabber_frames
  +field statistics.in_broadcast_pkts
  +field statistics.in_multicast_pkts
  +field statistics.out_broadcast_pkts
  +field statistics.out_multicast_pkts
  +field ether_stats.in_fragment_frames
  +field ether_stats.in_oversize_frames
  +field ether_stats.in_mac_pause_frames
  +field statistics.in_unknown_protos_64
  +field ether_stats.out_mac_pause_frames
  +field intf_ext_state.port_error_reason
  +field ether_state.negotiated_port_speed
  +field ether_state.negotiated_duplex_mode
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_fcs_errors
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_duplex_status
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_symbol_errors
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_frame_too_longs
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_late_collisions
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_alignment_errors
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_carrier_sense_errors
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_excessive_collisions
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_single_collision_frames
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_multiple_collision_frames
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_internal_mac_receive_errors
  +field ether_stats.dot3_counters.dot3_error_counters_v2.dot3_internal_mac_transmit_errors
  +join-key name
  +logical-op and
  +type mandatory
  +uri /services;serviceName=ios_emul_oper/interface
 +operation 1
  +output-field 1
   +field tbl_interfaces_state.name
  +output-field 2
   +field tbl_interfaces_state.if_index
  +output-field 3
   +field tbl_interfaces_state.interface_type
  +output-field 4
   +field tbl_interfaces_state.description
  +output-field 5
   +field tbl_interfaces_state.admin_status
  +output-field 6
   +field tbl_interfaces_state.oper_status
  +output-field 7
   +field tbl_interfaces_state.speed
  +output-field 8
   +field tbl_interfaces_state.ipv4
  +output-field 9
   +field tbl_interfaces_state.phys_address
  +output-field 10
   +field tbl_interfaces_state.statistics.in_unknown_protos_64
  +output-field 11
   +field tbl_interfaces_state.statistics.in_octets
  +output-field 12
   +field tbl_interfaces_state.statistics.out_octets_64
  +output-field 13
   +field tbl_interfaces_state.statistics.in_errors_64
  +output-field 14
   +field tbl_interfaces_state.statistics.out_errors
  +output-field 15
   +field tbl_interfaces_state.statistics.in_unicast_pkts
  +output-field 16
   +field tbl_interfaces_state.statistics.out_unicast_pkts
  +output-field 17
   +field tbl_interfaces_state.statistics.in_multicast_pkts
  +output-field 18
   +field tbl_interfaces_state.statistics.out_multicast_pkts
  +output-field 19
   +field tbl_interfaces_state.statistics.in_broadcast_pkts
  +output-field 20
   +field tbl_interfaces_state.statistics.out_broadcast_pkts
  +output-field 21
   +field tbl_interfaces_state.statistics.in_discards_64
  +output-field 22
   +field tbl_interfaces_state.statistics.out_discards
  +output-field 23
   +field tbl_interfaces_state.statistics.tx_pps
  +output-field 24
   +field tbl_interfaces_state.statistics.rx_pps
  +output-field 25
   +field tbl_interfaces_state.ether_state.media_type
  +output-field 26
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_single_collision_frames
  +output-field 27
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_multiple_collision_frames
  +output-field 28
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_late_collisions
  +output-field 29
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_excessive_collisions
  +output-field 30
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_frame_too_longs
  +output-field 31
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_alignment_errors
  +output-field 32
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_fcs_errors
  +output-field 33
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_carrier_sense_errors
  +output-field 34
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_internal_mac_receive_errors
  +output-field 35
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_internal_mac_transmit_errors
  +output-field 36
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_symbol_errors
  +output-field 37
   +field tbl_interfaces_state.ether_stats.dot3_counters.dot3_error_counters_v2.dot3_duplex_status
  +output-field 38
   +field tbl_interfaces_state.ether_stats.in_mac_pause_frames
  +output-field 39
   +field tbl_interfaces_state.ether_stats.out_mac_pause_frames
  +output-field 40
   +field tbl_interfaces_state.ether_stats.in_oversize_frames
  +output-field 41
   +field tbl_interfaces_state.ether_stats.in_jabber_frames
  +output-field 42
   +field tbl_interfaces_state.ether_stats.in_fragment_frames
  +output-field 43
   +field tbl_interfaces_state.ether_state.negotiated_duplex_mode
  +output-field 44
   +field tbl_interfaces_state.ether_state.negotiated_port_speed
  +output-field 45
   +field tbl_interfaces_state.statistics.in_crc_errors
  +output-field 46
   +field tbl_interfaces_state.intf_ext_state.error_type
  +output-field 47
   +field tbl_interfaces_state.intf_ext_state.port_error_reason
 +specified
+telemetry transform MERAKI_PORTCHANNEL_STATS_DELTA
 +input table tbl_interfaces_state
  +field ipv4
  +field name
  +field speed
  +field if_index
  +field description
  +field oper_status
  +field admin_status
  +field phys_address
  +field interface_type
  +field interface_class
  +field statistics.rx_pps
  +field statistics.tx_pps
  +field statistics.in_octets
  +field statistics.out_errors
  +field statistics.in_errors_64
  +field statistics.out_discards
  +field statistics.out_octets_64
  +field statistics.in_discards_64
  +field statistics.in_unicast_pkts
  +field statistics.out_unicast_pkts
  +field statistics.in_broadcast_pkts
  +field statistics.in_multicast_pkts
  +field statistics.out_broadcast_pkts
  +field statistics.out_multicast_pkts
  +field statistics.in_unknown_protos_64
  +join-key name
  +logical-op and
  +type mandatory
  +uri /services;serviceName=ios_emul_oper/interface
 +operation 1
  +filter 1
   +condition operator eq
   +condition value INTF_CLASS_UNSPECIFIED
   +field tbl_interfaces_state.interface_class
   +logical-op and
   +logical-op next and
  +filter 2
   +event on-change
   +field tbl_interfaces_state.name
   +logical-op next or
   +logical-op or
  +output-field 1
   +field tbl_interfaces_state.name
  +output-field 2
   +field tbl_interfaces_state.if_index
  +output-field 3
   +field tbl_interfaces_state.interface_type
  +output-field 4
   +field tbl_interfaces_state.description
  +output-field 5
   +field tbl_interfaces_state.admin_status
  +output-field 6
   +field tbl_interfaces_state.oper_status
  +output-field 7
   +field tbl_interfaces_state.speed
  +output-field 8
   +field tbl_interfaces_state.ipv4
  +output-field 9
   +field tbl_interfaces_state.phys_address
  +output-field 10
   +field tbl_interfaces_state.statistics.in_unknown_protos_64
  +output-field 11
   +field tbl_interfaces_state.statistics.in_octets
  +output-field 12
   +field tbl_interfaces_state.statistics.out_octets_64
  +output-field 13
   +field tbl_interfaces_state.statistics.in_errors_64
  +output-field 14
   +field tbl_interfaces_state.statistics.out_errors
  +output-field 15
   +field tbl_interfaces_state.statistics.in_unicast_pkts
  +output-field 16
   +field tbl_interfaces_state.statistics.out_unicast_pkts
  +output-field 17
   +field tbl_interfaces_state.statistics.in_multicast_pkts
  +output-field 18
   +field tbl_interfaces_state.statistics.out_multicast_pkts
  +output-field 19
   +field tbl_interfaces_state.statistics.in_broadcast_pkts
  +output-field 20
   +field tbl_interfaces_state.statistics.out_broadcast_pkts
  +output-field 21
   +field tbl_interfaces_state.statistics.in_discards_64
  +output-field 22
   +field tbl_interfaces_state.statistics.out_discards
  +output-field 23
   +field tbl_interfaces_state.statistics.tx_pps
  +output-field 24
   +field tbl_interfaces_state.statistics.rx_pps
 +specified
~~~
</div></details>

# 4. まとめ
自分で言うのもアレですけど長い...。万が一、最後まで見ていただいた方いらっしゃれば本当にありがとうございます。元々、2017年に書いたブログ[「ネットワークで計測」を深掘り](https://gblogs.cisco.com/jp/2017/04/deepdive-netflow/)を更新したいな〜と思って書き始めた本記事ですが、せっかくなのでDNACやMerakiの話も入れてみようと思って強引に一つにしたところ長くなってしまいました。

ネットワーク装置でリッチなデータを収集できること、効率的に取り出して利活用すること、それらがスケーラビリティや転送性能と両立すること、これは今後もますます大事になってきます。今日現在においても、ネットワークデータの活用レベルは、特にエンタープライズITでは高いとは言えず、もっと活用されるべきと考えています。

クラウド時代においてもネットワークアクセス層から得られるお宝をじゃんじゃん活用して、セキュリティや容量設計にとどまらず、人の動きやふるまいのトラッキング、たえず進化するアプリケーションの動きに追随するネットワークなど、いろんなところに役立つソリューションを提供していきたいです。また、データそのものを汎用的に取り出せる仕組みも進化しています（装置のAPIやコントローラーのAPIなど）。われわれネットワークエンジニアだけでなく、アプリケーション開発者をはじめ、世の中のデータエンジニアとの接点がもっと増えることも期待しています。

:::note warn
この記事では、メーカーのエンジニアとして面白いなぁと思うポイントを、装置およびコントローラーの両面から深掘りしました。これは単に私が興味がある内容であって、あまりセミナー等で説明する枠がなかったりするのですが、もしどなたか似たような関心や興味をお持ちの方に届くと嬉しいです。
:::

:::note info
ルーターやスイッチといったネットワーク装置と、DNACやMerakiのようなコントローラーを組み合わせたユースケースはどんどん進化しています。いい意味で破壊的なユースケースを、シンプルな運用管理性とともに提示していくことはメーカーエンジニアにとってはとってもクリエイティブなお仕事だと思っています。
:::