Flowmon 11.1
Updated on November 20, 2020

Supported Flow Standards
Technical Specification
Overview

2

NetFlow v5/7

3

NetFlow v9

4

IPFIX

9

IPFIX - Other Vendors

25

sFlow v2/4/5

29

jFlow

31

NetFlow Lite

32

NetStream33

cflowd34

AWS VPC Flow Logs

35

Flowmon Collector - Extra Fields

36

History37

www.flowmon.com

1/37

Flowmon 11.1
Updated on November 20, 2020

Overview
The following document lists all flow standards supported by Flowmon Probe and Flowmon Collector. For each standard, it provides a list of available fields with descriptions and expected input
lengths. Where applicable, it also provides details on the content of specific fields or outlines configuration changes necessary for enabling the export/collection of those fields. Fields marked
with ​Not supported​ are not implemented, fields marked with ​Not applicable​ cannot be, conceptually, supported by the product.
The ​Probe Configuration column in the tables below refers to the configuration options found in ​Flowmon Configuration Center – Monitoring Ports – Global Settings – Advanced
Settings​. There, you can enable the export of specific IPFIX fields by the probe by checking the corresponding checkboxes and saving your configuration. This configuration can also be applied
to each monitoring port separately. Fields will be populated with data only if the required type of network traffic is passing through the probe.
The ​Collector Configuration column in the tables below refers to the configuration options found in ​Flowmon Configuration Center – FMC Configuration – Flow Database Fields​. There,
you can enable the collection of specific fields by checking the corresponding checkboxes and saving your configuration. A collector will be populated with data only if the required fields arepresent in flow data sent to the collector.

www.flowmon.com

2/37

Flowmon 11.1
Updated on November 20, 2020

NetFlow v5/7
Note:​ In the following table, the value “Exported by default” refers to a monitoring port that has been configured to use ​NetFlow v5​ as its export protocol.

Name

Description

Input Length(bytes)

Probe Configuration

Collector Configuration

srcaddr

Source IP address.

4

Exported by default

Collected by default

dstaddrDestination IP address.

4

Exported by default

Collected by default

nexthop

IP address of next hop router.

4

Not applicable

Enabled by
Next HOP IP address

input

SNMP index of input interface.

2

Exported by default

Collected by default

output

SNMP index of output interface.

2

Exported by default
Always set to 0

Collected by default

dPkts

Packets in the flow.

4

Exported by default

Collected by default

dOctets

Total number of Layer 3 bytes in the packets of the flow.

4

Exported by default

Collected by default

First

SysUptime at start of flow.

4

Exported by default

Collected by default

Last

SysUptime at the time the last packet of the flow was received.

4

Exported by default

Collected by default

srcport

TCP/UDP source port number or equivalent.

2

Exported by default

Collected by default

dstport

TCP/UDP destination port number or equivalent.

2

Exported by default

Collected by default

tcp_flags

Cumulative OR of TCP flags.

1

Exported by default

Collected by default

prot

IP protocol type (for example, TCP = 6; UDP = 17).

1

Exported by default

Collected by defaulttos

IP type of service (ToS).

1

Exported by default

Collected by default

src_asAutonomous system number of the source, either origin or peer.

2

dst_asAutonomous system number of the destination, either origin or
peer.

2

src_mask

Source address prefix mask bits.

1

Not supported

dst_mask

Destination address prefix mask bits.

1

Not supportedrouter_sc(​NetFlow v7 only​)

IP address of the router that is bypassed by the Catalyst 5000
series switch. This is the same address the router uses when it
sends NetFlow export packets. This IP address is propagated toall switches bypassing the router through the FCP protocol.

4

Not applicablewww.flowmon.com

Enabled by
Use autonomous system list
Enabled by
Use autonomous system list

Collected by default
Collected by default
Enabled by
SRC/DST mask, (dst) TOS, Direction
Enabled by
SRC/DST mask, (dst) TOS, Direction
Collected by default

3/37

Flowmon 11.1
Updated on November 20, 2020

NetFlow v9
Note:​ In the following table, the value “Exported by default” refers to a monitoring port that has been configured to use ​NetFlow v9​ as its export protocol.

ID

Name

Description
Incoming counter with length N x 8 bits for number of bytes associatedwith an IP Flow.
Incoming counter with length N x 8 bits for the number of packets
associated with an IP Flow.

Input Length(bytes)Probe
Configuration

Collector
Configuration

4/8

Exported by default

Collected by default

4/8

Exported by default

Collected by default

1

NF9_IN_BYTES

2

NF9_IN_PACKETS

3

NF9_FLOWS_AGGR

Number of flows that were aggregated; default for N is 4.

4/8

Not supported

Enabled byCounter aggregated
flows

4

NF9_IN_PROTOCOL

IP protocol byte.

1

Exported by default

Collected by default

5

NF9_SRC_TOSType of Service byte setting when entering the incoming interface.

1

Enabled by
L3/L4 Extended

Collected by default

6

NF9_TCP_FLAGS

Cumulative of all the TCP flags seen for this flow.

1

Exported by default

Collected by default

7

NF9_L4_SRC_PORT

TCP/UDP source port number i.e.: FTP, Telnet, or equivalent.

2

Exported by default

Collected by default

8

NF9_IPV4_SRC_ADDR

IPv4 source address.

4

Exported by default

Collected by default

9

NF9_SRC_MASKThe number of contiguous bits in the source address subnet mask i.e.:the submask in slash notation.

1

Not supported

Enabled by
SRC/DST mask, (dst)
TOS, Direction

10

NF9_INPUT_SNMP

Input interface index; default for N is 2 but higher values could be used.

4/2

Exported by default

Collected by default

11

NF9_L4_DST_PORT

TCP/UDP destination port number i.e.: FTP, Telnet, or equivalent.

2

Exported by default

Collected by default

12

NF9_IPV4_DST_ADDR

IPv4 destination address.

4

Exported by default

Collected by default

13

NF9_DST_MASKThe number of contiguous bits in the destination address subnet mask
i.e.: the submask in slash notation.

1

Not supported

Enabled by
SRC/DST mask, (dst)
TOS, Direction

14

NF9_OUTPUT_SNMP

Output interface index; default for N is 2 but higher values could be used.

4/2

Exported by default
Configurable permonitoring port

Collected by default

15

NF9_V4_NEXT_HOP

IPv4 address of next-hop router.

4

Not applicable

Enabled by
Next HOP IP address

16

NF9_SRC_AS

Source BGP autonomous system number where N could be 2 or 4.

4/2

17

NF9_DST_AS

Destination BGP autonomous system number where N could be 2 or 4.

4/2

www.flowmon.com

Enabled by
Use autonomous
system list
Enabled by
Use autonomous
system list

Collected by default
Collected by default

4/37

Flowmon 11.1
Updated on November 20, 2020

18

NF9_BGP_V4_NEXT_HOP

Next-hop router's IP in the BGP domain.

4

Not applicable

Enabled by
BGP next HOP IP
address

21

NF9_LAST_SWITCHED

System uptime at which the last packet of this flow was switched.

4

Exported by default

Collected by default

22

NF9_FIRST_SWITCHED

System uptime at which the first packet of this flow was switched.

4

Exported by default

Collected by default

23

NF9_OUT_BYTESOutgoing counter with length N x 8 bits for the number of bytes
associated with an IP Flow.

4/8

Not applicable

24

NF9_OUT_PKTS

Outgoing counter with length N x 8 bits for the number of packets
associated with an IP Flow.

4/8

Not applicable

27

NF9_IPV6_SRC_ADDR

IPv6 Source Address.

16

Exported by default

Collected by default

28

NF9_IPV6_DST_ADDR

IPv6 Destination Address.

16

Exported by default

Collected by default

29

NF9_IPV6_SRC_MASK

Length of the IPv6 source mask in contiguous bits.

1

Not supported

30

NF9_IPV6_DST_MASK

Length of the IPv6 destination mask in contiguous bits.

1

Not supported

31

NF9_IPV6_FLOW_LABEL

IPv6 flow label as per RFC 2460 definition.

4

Not supported

Collected by default

32

NF9_ICMP_TYPE

2

Exported by default

Collected by default

34

NF9_SAMPLING_INTERVAL

4

Exported by default

Collected by default

35

NF9_SAMPLING_ALGORITHM

1Exported by default

Collected by default

38

NF9_ENGINE_TYPE

Type of flow switching engine: RP = 0, VIP/Linecard = 1.

1

Not applicableCollected by default

39

NF9_ENGINE_ID

ID number of the flow switching engine.

1

Not applicableCollected by default

48

NF9_FLOW_SAMPLER_ID

Identifier shown in "show flow-sampler".

1/2/4

Not supported

Collected by default

49

NF9_FLOW_SAMPLER_MODE

1

Not supported

Collected by default

50

NF9_FLOW_SAMPLER_RANDOM_INTERVAL

The type of algorithm used for sampling data: 0x02 random sampling.
Use in connection with NF9_FLOW_SAMPLER_ID.
Packet interval at which to sample. Use in connection with
NF9_FLOW_SAMPLER_MODE.

2/4

Not supported

Collected by default

55

NF9_DST_TOS

Type of Service byte setting when exiting outgoing interface.

1

Not applicableCollected by default

56

NF9_IN_SRC_MAC

Incoming source MAC address.

6

Enabled by
MAC

57

NF9_OUT_DST_MAC

Outgoing destination MAC address.

6

Not applicablewww.flowmon.com

Internet Control Message Protocol (ICMP) packet type; reported as((ICMP Type*256) + ICMP code).
When using sampled NetFlow, the rate at which packets are sampled
i.e.: a value of 100 indicates that one of every 100 packets is sampled.
The type of algorithm used for sampled NetFlow: 0x01 Deterministic
Sampling ,0x02 Random Sampling.

Enabled byCounter output bytes
Enabled byCounter output
packets

Enabled by
SRC/DST mask, (dst)
TOS, Direction
Enabled by
SRC/DST mask, (dst)
TOS, Direction

Enabled by
In SRC/out DST MAC
address
Enabled by
In SRC/out DST MAC
address

5/37

Flowmon 11.1
Updated on November 20, 2020

58

NF9_SRC_VLAN

Virtual LAN identifier associated with ingress interface.

2

Enabled by
VLAN

59

NF9_DST_VLAN

Virtual LAN identifier associated with egress interface.

2

Not applicable

61

NF9_DIRECTION

Flow direction: 0 - ingress flow, 1 - egress flow.

1

Not applicable

62

NF9_V6_NEXT_HOP

IPv6 address of the next-hop router.

16

Not applicable

63

NF9_BPG_V6_NEXT_HOP

Next-hop router in the BGP domain.

16

Not applicable

70

NF9_MPLS_LABEL_1

71

NF9_MPLS_LABEL_2

72

NF9_MPLS_LABEL_3

73

NF9_MPLS_LABEL_4

74

NF9_MPLS_LABEL_5

75

NF9_MPLS_LABEL_6

76

NF9_MPLS_LABEL_7

77

NF9_MPLS_LABEL_8

78

NF9_MPLS_LABEL_9

79

NF9_MPLS_LABEL_10

80

NF9_IN_DST_MAC

81

NF9_OUT_SRC_MAC

89

NF9_FORWARDING_STATUS

128

NF9_BGP_ADJ_NEXT_AS

www.flowmon.com

MPLS label at position 1 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 2 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 3 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 4 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 5 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 6 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 7 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 8 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 9 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.
MPLS label at position 10 in the stack. This comprises 20 bits of MPLS
label, 3 EXP (experimental) bits and 1 S (end-of-stack) bit.

3
3
3
3

Enabled by
MPLS
Enabled by
MPLS
Enabled by
MPLS
Enabled by
MPLS

Enabled by
SRC/DST VLAN ID
labelsEnabled by
SRC/DST VLAN ID
labelsEnabled by
SRC/DST mask, (dst)
TOS, Direction
Enabled by
Next HOP IP address
Enabled by
BGP next HOP IP
address
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
MPLS labels 1-10
Enabled by
In DST/out SRC MAC
address
Enabled by
In DST/out SRC MAC
address

3

Not supported

3

Not supported

3

Not supported

3

Not supported

3

Not supported

3

Not supported

Incoming destination MAC address.

6

Enabled by
MAC

Outgoing source MAC address.

6

Not applicable1

Not applicableCollected by default

4

Not applicable

Enabled by
BGP adjacentprev/next AS

Forwarding status is encoded on 1 byte with the 2 left bits giving thestatus and the 6 remaining bits giving the reason code.
The autonomous system (AS) number of the first AS in the AS path tothe destination IP address. The path is deduced by looking up thedestination IP address of the Flow in the BGP routing information base. If
AS path information for this Flow is only available as an unordered AS

6/37

Flowmon 11.1
Updated on November 20, 2020

129

NF9_BGP_ADJ_PREV_AS

95

NF9_NBAR2_APP_TAG

85

set (and not as an ordered AS sequence), then the value of thisInformation Element is 0.
The autonomous system (AS) number of the last AS in the AS path fromthe source IP address. The path is deduced by looking up the source IP
address of the Flow in the BGP routing information base. If AS pathinformation for this Flow is only available as an unordered AS set (andnot as an ordered AS sequence), then the value of this Information
Element is 0. In case of BGP asymmetry, thebgpPrevAdjacentAsNumber might not be able to report the correct value.

Enabled by
BGP adjacentprev/next AS

4

Not applicable

8 bits of engine ID, followed by n bits of classification.

4

Not supported

NF_F_FLOW_BYTES

Running byte counter for a permanent flow.

4/8

Not applicable

148

NF_F_CONN_ID

An identifier of a unique flow for the device.

4

Not applicable

152

NF_F_FLOW_CREATE_TIME_MS
EC

The time that the flow was created, which is included in extended
flow-teardown events in which the flow-create event was not sent earlier.
The flow duration can be determined with the event time for theflow-teardown and flow-create times.

8

Not applicable

Enabled by
NSEL Common block

153

NF_F_FLOW_END_TIME_MSEC

The time when the flow ended.

8

Not applicableCollected by default

176

NF_F_ICMP_TYPE

ICMP type value.

1

Not applicable

177

NF_F_ICMP_CODEICMP code value.

1

Not applicable

178

NF_F_ICMP_TYPE_IPV6

ICMP IPv6 type value.

1

Not applicable

179

NF_F_ICMP_CODE_IPV6

ICMP IPv6 code value.

1

Not applicable

The delta number of bytes from source to destination.

4/8

Not applicable

The delta number of bytes from destination to source.

4/8

Not applicable

Indicates a firewall event.

1

Not applicable8

Not applicableCollected by default

12

Not applicable

Enabled by
NSEL ACL
ingress/egress acl ID

12

Not applicable

Enabled by
NSEL ACL
ingress/egress acl ID

231
232

NF_F_FWD_FLOW_DELTA_BYTES
NF_F_REV_FLOW_DELTA_BYTE
S

233

NF_F_FW_EVENT84323

NF_F_EVENT_TIME_MSEC

33000

NF_F_INGRESS_ACL_ID

33001

NF_F_EGRESS_ACL_ID

www.flowmon.com

The time that the event occurred, which comes from IPFIX. Use 324 fortime in microseconds, and 325 for time in nanoseconds.
The input ACL that permitted or denied the flow. All ACL IDs arecomposed of the following three, four-byte values:
Hash value or ID of the ACL nameHash value, ID, or line of an ACE within the ACL
Hash value or ID of an extended ACE configuration.
The output ACL that permitted or denied a flow.

Enabled by
NBAR2 application
tag
Enabled by
NSEL Common block
Enabled by
NSEL Common block

Enabled by
NSEL Common block
Enabled by
NSEL Common block
Enabled by
NSEL Common block
Enabled by
NSEL Common block
Enabled by
NSEL Common block
Enabled byCounter output bytes
Enabled by
NSEL Common block

7/37

Flowmon 11.1
Updated on November 20, 2020

33002

NF_F_FW_EXT_EVENT

Extended event code. These values provide additional information about
the event.

40000

NF_F_USERNAMEAAA username.

40001

NF_F_XLATE_SRC_ADDR_IPV4

40002

Enabled by
NSEL Common block
Enabled by
NSEL username
Enabled by
NSEL xlate IPv4
address
Enabled by
NSEL xlate IPv4
address
Enabled by
NSEL xlate ports
Enabled by
NSEL xlate ports2

Not applicable

20/65

Not applicable

Source IPv4 address.

4

Not applicable

NF_F_XLATE_DST_ADDR_IPV4

Destination IPv4 address.

4

Not applicable

40003

NF_F_XLATE_SRC_PORT

Post NATT Source Transport Port.

2

Not applicable

40004

NF_F_XLATE_DST_PORT

Post NATT Destination Transport Port.

2

Not applicable

40005

NF_F_FW_EVENT

High-level event code. Values are as follows:
0-Collected by default (ignore),1-Flow created,2-Flow deleted, 3-Flowdenied, 4-Flow alert, 5-Flow update.

1

Not applicable

230

NF_N_NAT_EVENT

Indicates a NAT event.

1

Not applicable

234

NF_N_INGRESS_VRFID

4

Not applicable

225

NF_N_NAT_INSIDE_GLOBAL_IPV
4

4

Not applicable

Enabled by
NEL global IPv4
address226

NF_N_NAT_OUTSIDE_GLOBAL_I
PV4

4

Not applicable

Enabled by
NEL global IPv4
address227

NF_N_POST_NAPT_SRC_PORT

2

Not applicable

Enabled by
NEL Common block

228

NF_N_POST_NAPT_DST_PORT

2

Not applicable

Enabled by
NEL Common block

www.flowmon.com

An unique identifier of the VRF name where the packets of this flow arebeing received. This identifier is unique per Metering Process.
The definition of this Information Element is identical to the definition ofInformation Element 'sourceIPv4Address', except that it reports a
modified value caused by a NAT middlebox function after the packet
passed the Observation Point.
The definition of this Information Element is identical to the definition ofInformation Element 'destinationIPv4Address', except that it reports a
modified value caused by a NAT middlebox function after the packet
passed the Observation Point.
The definition of this Information Element is identical to the definition ofInformation Element 'sourceTransportPort', except that it reports a
modified value caused by a Network Address Port Translation (NAPT)
middlebox function after the packet passed the Observation Point.
The definition of this Information Element is identical to the definition ofInformation Element 'destinationTransportPort', except that it reports a
modified value caused by a Network Address Port Translation (NAPT)
middlebox function after the packet passed the Observation Point.

Enabled by
NSEL Common block
Enabled by
NEL Common block
Enabled by
NEL Common block

8/37

Flowmon 11.1
Updated on November 20, 2020

IPFIX
Note:​ In the following table, the value “Exported by default” refers to a monitoring port that has been configured to use ​IPFIX​ as its export protocol.

PEN

ID

Field

Description
The number of octets since the previous report (ifany) in incoming packets for this Flow at theObservation Point. The
number of octets includes
IP header(s) and IP payload.
The number of incoming packets since the previous
report (if any) for this Flow at the Observation point.
The value of the protocol number in the IP packet
header. The protocol number identifies the IP packet
payload type. Protocol numbers are defined in the
IANA Protocol Numbers registry. In Internet Protocol
version 4 (IPv4), this is carried in the Protocol field.
In Internet Protocol version 6 (IPv6), this is carried in
the Next Header field in the last extension header ofthe packet.
For IPv4 packets, this is the value of the TOS field in
the IPv4 packet header. For IPv6 packets, this is thevalue of the Traffic Class field in the IPv6 packet
header.
TCP control bits observed for packets of this Flow.
The information is encoded in a set of bit fields. For
each TCP control bit, there is a bit in this set. A bit is
set to 1 if any observed packet of this Flow has thecorresponding TCP control bit set to 1. A value of 0
for a bit indicates that the corresponding bit was not
set in any of the observed packets of this Flow.
The source port identifier in the transport header.
For the transport protocols UDP, TCP, and SCTP,
this is the source port number given in the respective
header. This field MAY also be used for futuretransport protocols that have 16-bit source port
identifiers.

Input Length(bytes)Probe
Configuration

Collector
Configuration

8/4

Exported by default

Collected by default

8/4

Exported by default

Collected by default

1

Exported by default

Collected by default

1

Enabled by
L3/L4 Extended

Collected by default

1

Exported by default

Collected by default

2

Exported by default

Collected by default-

1

IPFIX_octetDeltaCount-2

IPFIX_packetDeltaCount-

4

IPFIX_protocolIdentifier-

5

IPFIX_ipClassOfService-

6

IPFIX_tcpControlBits-

7

IPFIX_SourceTransportPort-

8

IPFIX_SourceIPv4Address

The IPv4 source address in the IP packet header.

4

Exported by default

Collected by default-

9

IPFIX_SourceIPv4PrefixLength

The number of contiguous bits that are relevant in
the sourceIPv4Prefix Information Element.

1

Exported by default

Enabled by
SRC/DST mask,(dst) TOS, Direction-

10

IPFIX_ingressInterface

The index of the IP interface where packets of thisFlow are being received. The value matches the

4/2

Exported by default

Collected by default

www.flowmon.com

9/37

Flowmon 11.1
Updated on November 20, 2020-

11

IPFIX_DestinationTransportPort-

12

IPFIX_DestinationIPv4Address-

13

IPFIX_DestinationIPv4PrefixLength

value of the managed object 'ifIndex' as defined in
RFC 2863.
Note that ifIndex values are notassigned statically to an interface and that theinterfaces may be renumbered every time thedevice's management system is re-initialized, as
specified in RFC 2863.
The destination port identifier in the transport
header. For the transport protocols UDP, TCP, andSCTP, this is the destination port number given in
the respective header. This field MAY also be used
for future transport protocols that have 16-bit
destination port identifiers.
The IPv4 destination address in the IP packet
header. Abstract Data Type: ipv4Address.

2

Exported by default

Collected by default

4

Exported by default

Collected by default

The number of contiguous bits that are relevant in
the destinationIPv4Prefix Information Element.

1

Exported by default

Enabled by
SRC/DST mask,(dst) TOS, Direction

4/2

Exported by default
Configurable permonitoring port

Collected by default

4

Not applicable

Enabled by
Next HOP IP
address

4/2

Enabled by
Use autonomous
system list

Collected by default

4/2

Enabled by
Use autonomous
system list

Collected by default

4

Not applicable

Enabled by
BGP next HOP IP
address

4

Not supported

Collected by default

4

Not supported

Collected by default-

14

IPFIX_egressInterface

The index of the IP interface where packets of thisFlow are being sent. The value matches the valueof the managed object 'ifIndex' as defined in RFC
2863. Note that ifIndex values are not assigned
statically to an interface and that the interfaces may
be renumbered every time the device's management
system is re-initialized, as specified in RFC 2863.

-

15

IPFIX_ipNextHopIPv4Address

The IPv4 address of the next IPv4 hop.

-

16

IPFIX_bgpSourceAsNumber-

17

IPFIX_bgpDestinationAsNumber-

18

IPFIX_bgpNextHopIPv4Address-

21

IPFIX_flowEndSysUpTime-

22

IPFIX_flowStartSysUpTime

www.flowmon.com

The autonomous system (AS) number of the source
IP address. If AS path information for this Flow is
only available as an unordered AS set (and not as
an ordered AS sequence), then the value of thisInformation Element is 0.
The autonomous system (AS) number of thedestination IP address. If AS path information for thisFlow is only available as an unordered AS set (andnot as an ordered AS sequence), then the value of
this Information Element is 0.
The IPv4 address of the next (adjacent) BGP hop.
The relative timestamp of the last packet of thisFlow. It indicates the number of milliseconds since
the last (re-)initialization of the IPFIX Device(sysUpTime).
The relative timestamp of the first packet of thisFlow. It indicates the number of milliseconds since

10/37

Flowmon 11.1
Updated on November 20, 2020-

23

IPFIX_postOctetDeltaCount-

24

IPFIX_postPacketDeltaCount-27

IPFIX_SourceIPv6Address

the last (re-)initialization of the IPFIX Device(sysUpTime).
The definition of this Information Element is identicaltothedefinition
ofInformation
Element'octetDeltaCount', except that it reports a potentiallymodified value caused by a middlebox function after
the packet passed the Observation Point.
The definition of this Information Element is identicaltothedefinition
ofInformation
Element'packetDeltaCount', except that it reports apotentially modified value caused by a middlebox
function after the packet passed the Observation
Point.

8/4

Not applicable

Enabled byCounter output
bytes

8/4

Not applicable

Enabled byCounter output
packets

The IPv6 source address in the IP packet header.

16

Exported by default

Collected by default

16

Exported by default

Collected by default-

28

IPFIX_DestinationIPv6Address

The IPv6 destination address in the IP packet
header.

-

29

IPFIX_SourceIPv6PrefixLength

The number of contiguous bits that are relevant in
the sourceIPv6Prefix Information Element.

1

Exported by default-

30

IPFIX_DestinationIPv6PrefixLength

The number of contiguous bits that are relevant in
the destinationIPv6Prefix Information Element.

1

Exported by default-

31

IPFIX_flowLabelIPv6

4

Not supported

Collected by default-

32

IPFIX_icmpTypeCodeIPv4

2

Exported by default

Collected by default-

34

NF9_SAMPLING_INTERVAL

4

Exported by default

Collected by default-

35

NF9_SAMPLING_ALGORITHM

1Exported by default

Collected by default-

48

NF9_FLOW_SAMPLER_ID

1/2/4

Not supported

Collected by default

4

Not supported

Collected by default

2/4

Not supported

Collected by default

1

Not applicable

Enabled by
SRC/DST mask,(dst) TOS, Direction-

49

NF9_FLOW_SAMPLER_MODE-

50

NF9_FLOW_SAMPLER_RANDOM_INTERVAL-

55

IPFIX_postIpClassOfService

www.flowmon.com

The value of the IPv6 Flow Label field in the IP
packet header.
Type and Code of the IPv4 ICMP message. The
combination of both values is reported as (ICMPtype * 256) + ICMP code.
When using sampled NetFlow, the rate at whichpackets are sampled i.e.: a value of 100 indicatesthat one of every 100 packets is sampled.
The type of algorithm used for sampled NetFlow:
0x01 Deterministic Sampling, 0x02 Random
Sampling.
Identifier shown in "show flow-sampler".
The type of algorithm used for sampling data: 0x02
random sampling. Use in connection with
NF9_FLOW_SAMPLER_ID.
Packet interval at which to sample. Use inconnection with NF9_FLOW_SAMPLER_MODE.
The definition of this Information Element is identicaltothedefinition
ofInformation
Element'ipClassOfService', except that it reports a potentiallymodified value caused by a middlebox function after
the packet passed the Observation Point.

Enabled by
SRC/DST mask,(dst) TOS, Direction
Enabled by
SRC/DST mask,(dst) TOS, Direction

11/37

Flowmon 11.1
Updated on November 20, 2020-

56

IPFIX_SourceMacAddress

The IEEE 802 source MAC address field.
The definition of this Information Element is identicaltothedefinition
ofInformation
Element'destinationMacAddress', except that it reports apotentially modified value caused by a middlebox
function after the packet passed the Observation
Point.
The IEEE 802.1Q VLAN identifier (VID) extracted
from the Tag Control Information field that was
attached to the IP packet.
The definition of this Information Element is identicalto the definition of Information Element 'vlanId',
except that it reports a potentially modified valuecaused by a middlebox function after the packet
passed the Observation Point.
The direction of the Flow observed at theObservation Point. There are only two values
defined.

6

Enabled by
MAC

Enabled by
In SRC/out DST
MAC address

6

Not applicable

Enabled by
In SRC/out DST
MAC address

2

Enabled by
VLAN

Enabled by
SRC/DST VLAN ID
labels2

Not applicable

Enabled by
SRC/DST VLAN ID
labels1

Not applicable-

57

IPFIX_postDestinationMacAddress-

58

IPFIX_vlanId-

59

IPFIX_postVlanId-

61

IPFIX_flowDirection-

62

IPFIX_ipNextHopIPv6Address

The IPv6 address of the next IPv6 hop.

16

Not applicable-

63

IPFIX_bgpNextHopIPv6Address

The IPv6 address of the next (adjacent) BGP hop.

16

Not applicable

3

Enabled by
MPLS

Enabled by
MPLS labels 1-10

3Enabled by
MPLS

Enabled by
MPLS labels 1-10

3Enabled by
MPLS

Enabled by
MPLS labels 1-10

3Enabled by
MPLS

Enabled by
MPLS labels 1-10-70

IPFIX_mplsTopLabelStackSection-

71

IPFIX_mplsLabelStackSection2-

72

IPFIX_mplsLabelStackSection3-

73

IPFIX_mplsLabelStackSection4

www.flowmon.com

The Label, Exp, and S fields from the top MPLS
label stack entry, i.e., from the last label that was
pushed. The size of this Information Element is 3
octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported by
mplsTopLabelStackSection. See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection2.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection3.
See the definition of

Enabled by
SRC/DST mask,(dst) TOS, Direction
Enabled by
Next HOP IP
address
Enabled by
BGP next HOP IP
address

12/37

Flowmon 11.1
Updated on November 20, 2020-

74

IPFIX_mplsLabelStackSection5-

75

IPFIX_mplsLabelStackSection6-

76

IPFIX_mplsLabelStackSection7-

77

IPFIX_mplsLabelStackSection8-

78

IPFIX_mplsLabelStackSection9-

79

IPFIX_mplsLabelStackSection10-80

IPFIX_DestinationMacAddress

IPFIX_postSourceMacAddress-

81

www.flowmon.com

mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection4.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection5.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection6.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection7.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection8.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.
The Label, Exp, and S fields from the label stack
entry that was pushed immediately before the label
stack entry that would be reported bymplsLabelStackSection9.
See the definition of
mplsTopLabelStackSection for further details. The
size of this Information Element is 3 octets.

3

Not supported

Enabled by
MPLS labels 1-10

3

Not supported

Enabled by
MPLS labels 1-10

3

Not supported

Enabled by
MPLS labels 1-10

3

Not supported

Enabled by
MPLS labels 1-10

3

Not supported

Enabled by
MPLS labels 1-10

3

Not supported

Enabled by
MPLS labels 1-10

The IEEE 802 destination MAC address field.

6

Enabled by
MAC

Enabled by
In DST/out SRC
MAC address

The definition of this Information Element is identicaltothedefinition
ofInformation
Element'sourceMacAddress', except that it reports apotentially modified value caused by a middlebox
function after the packet passed the Observation
Point.

6

Not applicable

Enabled by
In DST/out SRC
MAC address

13/37

Flowmon 11.1
Updated on November 20, 2020-

85

IPFIX_octetTotalCount-86

IPFIX_packetTotalCount-90

IPFIX_mplsVpnRouteDistinguisher-

95

IPFIX_applicationId-

128

IPFIX_bgpAdjNextAs-

129

IPFIX_bgpAdjPrevAs-

150

IPFIX_flowStartSeconds

www.flowmon.com

The total number of octets in incoming packets forthis Flow at
the Observation Point since theMetering
Process(re-)initializationfor
this
Observation Point. The number of octets includes IP
header(s) and IP payload.
The total number of incoming packets for this Flowat the Observation Point since the Metering Process(re-)initialization for this Observation Point.
The value of the VPN route distinguisher of acorresponding entry in a VPN routing and forwarding
table. Route distinguisher ensures that the same
address can be used in several different MPLS
VPNs and that it is possible for BGP to carry several
completely different routes to that address, one foreach VPN. According to RFC 4364, the size of
mplsVpnRouteDistinguisher is 8 octets. However, in
RFC 4382 an octet string with flexible length waschosen for representing a VPN route distinguisher
by object MplsL3VpnRouteDistinguisher.
This
choice was made in order to be open to futurechanges of the size. This idea was adopted whenchoosing octetArray as an abstract data type for thisInformation Element. The maximum length of thisInformation Element is 256 octets.
Specifies an Application ID.
The autonomous system (AS) number of the first AS
in the AS path to the destination IP address. The
path is deduced by looking up the destination IP
address of the Flow in the BGP routing information
base. If AS path information for this Flow is only
available as an unordered AS set (and not as anordered AS sequence), then the value of thisInformation Element is 0.
The autonomous system (AS) number of the last AS
in the AS path from the source IP address. The pathis deduced by looking up the source IP address ofthe Flow in the BGP routing information base. If AS
path information for this Flow is only available as anunordered AS set (and not as an ordered AS
sequence), then the value of this Information
Element is 0. In case of BGP asymmetry, thebgpPrevAdjacentAsNumber might not be able toreport the correct value.
The absolute timestamp of the first packet of this
Flow.

8/4

Not supported

Collected by default

8/4

Not supported

Collected by default

8

Not applicable

Enabled by
MPLS VPN RouteDistinguisher

4

Enabled by
NBAR2

Enabled by
NBAR2 application
tag

4

Not applicable

Enabled by
BGP adjacentprev/next AS

4

Not applicable

Enabled by
BGP adjacentprev/next AS

4

Not supported

Collected by default

14/37

Flowmon 11.1
Updated on November 20, 2020-

151

IPFIX_flowEndSeconds-

152

IPFIX_flowStartMilliseconds-

153

IPFIX_flowEndMilliseconds-

186

IPFIX_tcpWindowSize-

302

IPFIX_selectorId-

304

IPFIX_selectorAlgorithm-

305

IPFIX_samplingPacketInterval-

306

IPFIX_samplingPakcetSpaceThe absolute timestamp of the last packet of thisFlow.
The absolute timestamp of the first packet of thisFlow.
The absolute timestamp of the last packet of thisFlow.
The window field in the TCP header. If the TCP
window scale is supported, then TCP window scalemust be known to fully interpret the value of thisinformation.
A unique identifier of the application for a specificClassification Engine ID. Note that the Selector ID
length varies depending on the Classification Engine
ID.
This Information Element identifies the Intermediate
Flow Selection Process technique (e.g., Filtering,
Sampling) that is applied by the Intermediate Flow
Selection Process. Most of these techniques haveparameters. Its configuration parameter(s) MUST
be clearly specified.

4

Not supported

Collected by default

8

Exported by default

Collected by default

8

Exported by default

Collected by default

2

Enabled by
L3/L4 Extended

Enabled by
L3/L4 extended
fields8

Not supported

Collected by default

2

Not supported

Collected by default

Interval of packet sampling.

4

Not supported

Collected by default

Packet space sampling.

4

Not supported

Collected by default

39499

1

IPFIX_INVEA_HOST

HTTP Hostname string (last 32 bytes).

32

Enabled by
HTTP

39499

2

IPFIX_INVEA_URL

HTTP URL string (first 64 bytes).

64

Enabled by
HTTP

39499

4

IPFIX_INVEA_HTTP_METHOD_ID

HTTP Method

2

Enabled by
HTTP

39499

12

IPFIX_INVEA_HTTP_STATUS_CODE

HTTP Status Code2

Enabled by
HTTP

39499

22

IPFIX_INVEA_USER_AGENT_OS

Identifies version of host operating system.

2

Enabled by
HTTP

39499

23

IPFIX_INVEA_USER_AGENT_OS_MAJ

Identifies the major version of the used hostoperating system.

2

Enabled by
HTTP

39499

24

IPFIX_INVEA_USER_AGENT_OS_MIN

Identifies the minor version of the used hostoperating system.

2

Enabled by
HTTP

39499

25

IPFIX_INVEA_USER_AGENT_OS_BLD

Identifies build version of used host operating
system.

2

Enabled by
HTTP

www.flowmon.com

Truncated to 31
bytes;
Enabled by
HTTP Hostname
Enabled by
HTTP URL
Enabled by
HTTP method andresultEnabled by
HTTP method andresultEnabled by
HTTP OS &Application info
Enabled by
HTTP OS &Application info
Enabled by
HTTP OS &Application info
Enabled by

15/37

Flowmon 11.1
Updated on November 20, 2020

39499

26

IPFIX_INVEA_USER_AGENT_APP

Identifies versions of used applications.

2

Enabled by
HTTP

39499

27

IPFIX_INVEA_USER_AGENT_APP_MAJ

Identifies the major version of used applications.

2

Enabled by
HTTP

39499

28

IPFIX_INVEA_USER_AGENT_APP_MIN

Identifies the minimal version of used applications.

2

Enabled by
HTTP

39499

29

IPFIX_INVEA_USER_AGENT_APP_BLD

Identifies build version of application build.

2

Enabled by
HTTP

39499

33

IPFIX_INVEA_SIP_CALL_ID

The value of the SIP Call-ID.

64

39499

34

IPFIX_INVEA_SIP_CALLING_PARTY

Parameter that distinguishes the station used tooriginate a call.

48

The addr-spec URI, including any URI parameters,of the SIP P-Called-Party-ID header, as a UTF-8
string, escaped according to SIP rules as received
by the metering process.
The value of the first/top-most Via header as a
UTF-8 string, escaped according to SIP rules asreceived by the metering process.

39499

35

IPFIX_INVEA_SIP_CALLED_PARTY

39499

36

IPFIX_INVEA_SIP_VIA

39499

32

IPFIX_INVEA_VOIP_PACKET_TYPE

Type of VoIP packets.

1

39499

37

IPFIX_INVEA_SIP_INVITE_RINGING_TIMESIP Ringing Time (microsec timestamp).

8

39499

38

IPFIX_INVEA_SIP_OK_TIMESIP OK Time (microsec timestamp).

8

39499

39

IPFIX_INVEA_SIP_BYE_TIME

SIP Bye Time (microsec timestamp).

8

39499

40

IPFIX_INVEA_SIP_RTP_IP4

IPv4 Real time protocol.

4

39499

41

IPFIX_INVEA_SIP_RTP_IP6

IPv6 Real time protocol.

16

39499

42

IPFIX_INVEA_SIP_RTP_AUDIOReal time protocol audio quality.

2

www.flowmon.com

48

48

Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by

HTTP OS &Application info
Enabled by
HTTP OS &Application info
Enabled by
HTTP OS &Application info
Enabled by
HTTP OS &Application info
Enabled by
HTTP OS &Application info
Enabled by
VoIP SIP basic
Enabled by
VoIP SIP basic
Enabled by
VoIP SIP basic
Enabled by
VoIP SIP basic
Enabled by
VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by

16/37

Flowmon 11.1
Updated on November 20, 2020

VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
VoIP​ or ​Extended
VoIP
Enabled by
Extended VoIP
Enabled by
Extended VoIP
Enabled by
Extended VoIP
Enabled by
Extended VoIP
Enabled by
Extended VoIP
Enabled by
Extended VoIP
Enabled by
NPM
Enabled by
NPM
Enabled by
Extended NPM
Enabled by
Extended NPM
Enabled by
Extended NPM
Enabled by
Extended NPM
Enabled by
Extended NPM
Enabled by
Extended NPM
Enabled by
Extended NPM
Enabled by
Extended NPM

39499

43

IPFIX_INVEA_SIP_RTP_VIDEO

Real time protocol video quality.

2

39499

44

IPFIX_INVEA_SIP_STATSSIP statistic.

8

39499

45

IPFIX_INVEA_RTP_CODEC

Type of codec.

1

39499

46

IPFIX_INVEA_RTP_JITTER

Jitter.

4

39499

47

IPFIX_INVEA_RTCP_LOST

Packet loss.

4

39499

48

IPFIX_INVEA_RTCP_PACKETS

Quantity of packets.

8

39499

49

IPFIX_INVEA_RTCP_OCTETS

Quantity of octets.

8

39499

50

IPFIX_INVEA_RTCP_SOURCE_COUNT

Real time control protocol source count.

1

39499

69

IPFIX_INVEA_NPM_RTT

Round trip time.

4

39499

70

IPFIX_INVEA_NPM_SRTServer response time.

4

39499

61

IPFIX_INVEA_NPM_JITTER_DEV

Deviation jitter.

4

39499

62

IPFIX_INVEA_NPM_JITTER_AVG

Average jitter.

4

39499

63

IPFIX_INVEA_NPM_JITTER_MIN

Minimal jitter.

4

39499

64

IPFIX_INVEA_NPM_JITTER_MAX

Maximal jitter.

4

39499

65

IPFIX_INVEA_NPM_DELAY_DEV

Deviation time between packets.

4

39499

66

IPFIX_INVEA_NPM_DELAY_AVG

Average time between packets.

4

39499

67

IPFIX_INVEA_NPM_DELAY_MIN

Minimal time between packets.

4

39499

68

IPFIX_INVEA_NPM_DELAY_MAX

Maximal time between packets.

4

39499

71

IPFIX_INVEA_NPM_RETRANSMISSION

Retransmissions.

4

Enabled by
NPM

39499

72

IPFIX_INVEA_NPM_OUT_OF_ORDER

Out of order packets.

4

Enabled by
NPM

www.flowmon.com

VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by
VoIP SIP advanced
Enabled by
VoIP RTP
Enabled by
VoIP RTP
Enabled by
VoIP RTP
Enabled by
VoIP RTP
Enabled by
VoIP RTP
Enabled by
VoIP RTP
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM Basic Metrics
Enabled by
NPM
Retransmission &Out of Order
Enabled by

17/37

Flowmon 11.1
Updated on November 20, 2020

39499

80

IPFIX_INVEA_TCP_SYN_SIZETCP SYN Size

1

Enabled by
L3/L4 Extended

39499

81

IPFIX_INVEA_TCP_SYN_TTL

TCP SYN TTL

1Enabled by
L3/L4 Extended

39499

110

IPFIX_INVEA_DNS_ID

DNS Identifier.

2

39499

111

IPFIX_INVEA_DNS_FLAGS_CODESDNS Flags (includes Operation Code, Response
Code, Query/Response flag).

2

39499

112

IPFIX_INVEA_DNS_QUESTION_COUNTDNS Questions Count.

2

39499

113

IPFIX_INVEA_DNS_ANSWREC_COUNTDNS Answers Count.

2

39499

114

IPFIX_INVEA_DNS_AUTHREC_COUNTDNS Authority Count.

2

39499

115

IPFIX_INVEA_DNS_ADDTREC_COUNTDNS Additional Count.

2

39499

116

IPFIX_INVEA_DNS_CRR_NAMEDNS Response Name.

64

39499

117

IPFIX_INVEA_DNS_CRR_TYPE

DNS Response Type.

2

39499

118

IPFIX_INVEA_DNS_CRR_CLASSDNS Response Class.

2

39499

119

IPFIX_INVEA_DNS_CRR_TTL

DNS Response TTL.

4

39499

120

IPFIX_INVEA_DNS_CRR_RDATADNS Response Data.

64

39499

121

IPFIX_INVEA_DNS_QNAMEDNS Question Name.

64

39499

122

IPFIX_INVEA_DNS_QTYPEDNS Question Type.

2

39499

123

IPFIX_INVEA_DNS_QCLASSDNS Question Class.

2

39499

124

IPFIX_INVEA_DNS_CRR_RDATA_LEN

DNS Response Data Length.

2

39499

150

IPFIX_INVEA_SMB_CMD

Samba operation code version 2

4

39499

151

IPFIX_INVEA_SMB_TREESamba tree structure

128

39499

152

IPFIX_INVEA_SMB_FILE

Samba file name128

www.flowmon.com

Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled bySamba
Enabled bySamba
Enabled by
Samba

NPM
Retransmission &Out of Order
Enabled by
L3/L4 extended
fieldsEnabled by
L3/L4 extended
fieldsEnabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
DNS Fields
Enabled by
SMB Fields
Enabled by
SMB Fields
Enabled by
SMB Fields

18/37

Flowmon 11.1
Updated on November 20, 2020

Enabled bySamba
Enabled bySamba

Enabled by
SMB Fields
Enabled by
SMB Fields

2

Exported by default

Collected by default

2

Exported by default

Collected by default

Enabled by
DHCP
Enabled by
DHCP
Enabled by
DHCP
Enabled by
DHCP
Enabled by
DHCP
Enabled by
DHCP
Enabled by
DHCP
Enabled by
DHCP
Enabled by
MSSQL
Enabled by
MSSQL
Enabled by
MSSQL
Enabled by
MSSQL
Enabled by
MSSQL
Enabled by
MSSQL
Enabled by
MSSQL

Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
DHCP Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Fields
Enabled by
MSSQL Extended
fieldsEnabled by
MSSQL Extended
fields39499

153

IPFIX_INVEA_SMB_FILE_TYPE

Samba file type

1

39499

154

IPFIX_INVEA_SMB_OP

Samba file operation type

1

39499

190

IPFIX_INVEA_ARP_HRD

ARP Hardware Type

39499

191

IPFIX_INVEA_ARP_OP

ARP Operation Code

39499

200

IPFIX_INVEA_DHCP_OFFERED_IP

DHCP offered IP address

4

39499

201

IPFIX_INVEA_DHCP_HOST_MAC_ADDRDHCP MAC address of host

6

39499

202

IPFIX_INVEA_DHCP_TYPE

DHCP message type

1

39499

203

IPFIX_INVEA_DHCP_IP_LEASE_TIMEDHCP IP address lease time

4

39499

204

IPFIX_INVEA_DHCP_SERVER_IP

DCP server IP address

4

39499

205

IPFIX_INVEA_DHCP_DOMAIN_NAME

DHCP server domain name

32

39499

206

IPFIX_INVEA_DHCP_HOST_NAME

DHCP hostname

32

39499

207

IPFIX_INVEA_DHCP_IP_REQUESTDHCP requested IP address

4

39499

210

IPFIX_INVEA_TDS_REQUEST_TYPE

MSSQL (TDS) request type

1

39499

211

IPFIX_INVEA_TDS_VERSIONMSSQL (TDS) version (protocol type)

4

39499

212

IPFIX_INVEA_TDS_CLIENT_VERSIONMSSQL (TDS) client version

4

39499

213

IPFIX_INVEA_TDS_SERVER_VERSIONMSSQL (TDS) server version

4

39499

214

IPFIX_INVEA_TDS_DATABASEMSSQL (TDS) database context

64

39499

215

IPFIX_INVEA_TDS_USERNAMEMSSQL (TDS) username

64

39499

216

IPFIX_INVEA_TDS_HOSTNAMEMSSQL (TDS) hostname

64

39499

217

IPFIX_INVEA_TDS_RESPONSE_TYPE

MSSQL (TDS) response type1

Enabled by
MSSQL

39499

218

IPFIX_INVEA_TDS_TOKENMSSQL (TDS) token of response

1

Enabled by
MSSQL

39499

219

IPFIX_INVEA_TDS_TMR_TYPE

MSSQL (TDS) transaction manager request type2

Enabled by
MSSQL

www.flowmon.com

Enabled by

19/37

Flowmon 11.1
Updated on November 20, 2020

39499

220

IPFIX_INVEA_TDS_ERROR_CODEMSSQL (TDS) error code4

Enabled by
MSSQL

39499

221

IPFIX_INVEA_TDS_ENVCHANGE_TYPE

MSSQL (TDS) environment change type1

Enabled by
MSSQL

39499

222

IPFIX_INVEA_TDS_SQL_QUERYMSSQL (TDS) SQL query

64

Enabled by
MSSQL

39499

223

IPFIX_INVEA_TDS_RPC_NAMEMSSQL (TDS) remote procedure name64

Enabled by
MSSQL

39499

224

IPFIX_INVEA_TDS_SERVER_NAMEMSSQL (TDS) server name64

Enabled by
MSSQL

39499

250

IPFIX_INVEA_SMTP_EHLO_HELO

SMTP HELO content

64

39499

251

IPFIX_INVEA_SMTP_MAIL_FROM

SMTP FROM content

64

39499

252

IPFIX_INVEA_MAIL_USERNAMESMTP username

64

39499

253

IPFIX_INVEA_MAIL_FAILED_AUTHENTICATION_
COUNTSMTP failed authentication counter

1

39499

254

IPFIX_INVEA_MAIL_IS_ENCRYPTED

SMTP TLS flag

1

39499

290

IPFIX_FLOWMON_MYSQL_PROTOCOL_VERSIONMySQL protocol version

1

39499

291

IPFIX_FLOWMON_MYSQL_SERVER_VERSIONMySQL server version

64

39499

292

IPFIX_FLOWMON_MYSQL_USER_AUTH_STATUSMySQL user authentication status

1

39499

293

IPFIX_FLOWMON_MYSQL_USERNAMEMySQL username

64

39499

294

IPFIX_FLOWMON_MYSQL_AUTH_METHODMySQL authentication method

64

39499

295

IPFIX_FLOWMON_MYSQL_DATABASEMySQL database

64

39499

296

IPFIX_FLOWMON_MYSQL_CPBLT_SERVERMySQL server capabilities

4

Enabled by
MySQL

39499

297

IPFIX_FLOWMON_MYSQL_CPBLT_CLIENTMySQL client capabilities

4

Enabled by
MySQL

www.flowmon.com

Enabled by
EmailEnabled by
EmailEnabled by
EmailEnabled by
EmailEnabled by
EmailEnabled by
MySQL
Enabled by
MySQL
Enabled by
MySQL
Enabled by
MySQL
Enabled by
MySQL
Enabled byMySQLMSSQL Extended
fieldsEnabled by
MSSQL Extended
fieldsEnabled by
MSSQL Extended
fieldsEnabled by
MSSQL Extended
fieldsEnabled by
MSSQL Extended
fieldsEnabled by
MSSQL Extended
fieldsEnabled byE-mail Fields
Enabled byE-mail Fields
Enabled byE-mail Fields
Enabled byE-mail Fields
Enabled byE-mail Fields
Enabled by
MySQL fields
Enabled by
MySQL fields
Enabled by
MySQL fields
Enabled by
MySQL fields
Enabled by
MySQL fields
Enabled by
MySQL fields
Enabled by
MySQL extended
fieldsEnabled by
MySQL extended
fields20/37

Flowmon 11.1
Updated on November 20, 2020

39499

298

IPFIX_FLOWMON_MYSQL_ERRORMySQL error code2

Enabled by
MySQL

39499

299

IPFIX_FLOWMON_MYSQL_COMMANDMySQL command

1

Enabled by
MySQL

39499

300

IPFIX_FLOWMON_MYSQL_SQL_QUERYMySQL SQL query

64

Enabled by
MySQL

39499

310

IPFIX_FLOWMON_PGSQL_PROTOCOL_VERSION

PostgreSQL protocol version

4

39499

311

IPFIX_FLOWMON_PGSQL_SERVER_VERSION

PostgreSQL server version

4

39499

312

IPFIX_FLOWMON_PGSQL_AUTH_METHOD

PostgreSQL authentication method

1

39499

313

IPFIX_FLOWMON_PGSQL_USERNAME

PostgreSQL username

64

39499

314

IPFIX_FLOWMON_PGSQL_DATABASE

PostgreSQL database

64

39499

315

IPFIX_FLOWMON_PGSQL_ERROR_SQLSTATE

PostgreSQL error code5

Enabled by
PostgreSQL

39499

316

IPFIX_FLOWMON_PGSQL_ERROR_SEVERITY

PostgreSQL error severity

1Enabled by
PostgreSQL

39499

317

IPFIX_FLOWMON_PGSQL_SQL_QUERY

PostgreSQL SQL query

64

Enabled by
PostgreSQL

39499

318

IPFIX_FLOWMON_PGSQL_MSG_TYPE_CLIENT

PostgreSQL client message type4

Enabled by
PostgreSQL

39499

319

IPFIX_FLOWMON_PGSQL_MSG_TYPE_SERVER

PostgreSQL server message type4

Enabled by
PostgreSQL

39499

330

IPFIX_FLOWMON_TLS_CONTENT_TYPE

TLS content type

1

39499

331

IPFIX_FLOWMON_TLS_HANDSHAKE_TYPE

TLS handshake type

4

39499

332

IPFIX_FLOWMON_TLS_SETUP_TIME

TLS setup time

8

39499

333

IPFIX_FLOWMON_TLS_SERVER_VERSIONTLS server version

2

39499

334

IPFIX_FLOWMON_TLS_SERVER_RANDOM

TLS server random ID

32

39499

335

IPFIX_FLOWMON_TLS_SERVER_SESSION

TLS server session ID

32

www.flowmon.com

Enabled by
PostgreSQL
Enabled by
PostgreSQL
Enabled by
PostgreSQL
Enabled by
PostgreSQL
Enabled by
PostgreSQL

Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS main

Enabled by
MySQL extended
fieldsEnabled by
MySQL extended
fieldsEnabled by
MySQL extended
fieldsEnabled by
PostgreSQL fields
Enabled by
PostgreSQL fields
Enabled by
PostgreSQL fields
Enabled by
PostgreSQL fields
Enabled by
PostgreSQL fields
Enabled by
PostgreSQL
extended fields
Enabled by
PostgreSQL
extended fields
Enabled by
PostgreSQL
extended fields
Enabled by
PostgreSQL
extended fields
Enabled by
PostgreSQL
extended fields
Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS main fields

21/37

Flowmon 11.1
Updated on November 20, 2020

Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS main
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client
Enabled by
TLS client

39499

336

IPFIX_FLOWMON_TLS_CIPHER_SUITETLS cipher suite

2

39499

337

IPFIX_FLOWMON_TLS_ALPN

TLS application layer protocol negotiation

19

39499

338

IPFIX_FLOWMON_TLS_SNITLS server name indication

64

39499

339

IPFIX_FLOWMON_TLS_SNI_LENGTH

TLS server name indication length

2

39499

340

IPFIX_FLOWMON_TLS_CLIENT_VERSIONTLS client version

2

39499

341

IPFIX_FLOWMON_TLS_CIPHER_SUITESTLS cipher suites

16

39499

342

IPFIX_FLOWMON_TLS_CLIENT_RANDOM

TLS client random ID

32

39499

343

IPFIX_FLOWMON_TLS_CLIENT_SESSION

TLS client session ID

32

39499

344

IPFIX_FLOWMON_TLS_EXTENSION_TYPESTLS extension types

56

39499

345

IPFIX_FLOWMON_TLS_EXTENSION_LENGTHSTLS extension lengths

56

39499

346

IPFIX_FLOWMON_TLS_ELLIPTIC_CURVESTLS elliptic curves

16

39499

347

IPFIX_FLOWMON_TLS_EC_POINT_FORMATS

TLS elliptic curves point formats

4

39499

348

IPFIX_FLOWMON_TLS_CLIENT_KEY_LENGTH

TLS client key length

4

39499

349

IPFIX_FLOWMON_TLS_ISSUER_CN

TLS certificate issuer common name64

Enabled by
TLS certificate

39499

350

IPFIX_FLOWMON_TLS_SUBJECT_CN

TLS subject common name64

Enabled by
TLS certificate

39499

351

IPFIX_FLOWMON_TLS_SUBJECT_ON

TLS subject organization name64

Enabled by
TLS certificate

39499

352

IPFIX_FLOWMON_TLS_VALIDITY_NOT_BEFORE

TLS certificate validity since8

Enabled by
TLS certificate

39499

353

IPFIX_FLOWMON_TLS_VALIDITY_NOT_AFTERTLS certificate validity until

8

Enabled by
TLS certificate

39499

354

IPFIX_FLOWMON_TLS_SIGNATURE_ALG

TLS signature algorithm

2

Enabled by
TLS certificate

39499

355

IPFIX_FLOWMON_TLS_PUBLIC_KEY_ALG

TLS public key algorithm

2

Enabled by
TLS certificate

www.flowmon.com

Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS main fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS client fields
Enabled by
TLS certificate
fieldsEnabled by
TLS certificate
fieldsEnabled by
TLS certificate
fieldsEnabled by
TLS certificate
fieldsEnabled by
TLS certificate
fieldsEnabled by
TLS certificate
fieldsEnabled by

22/37

Flowmon 11.1
Updated on November 20, 2020

39499

356

IPFIX_FLOWMON_TLS_PUBLIC_KEY_LENGTH

TLS public key length

4

39499

357

IPFIX_FLOWMON_TLS_JA3_FINGERPRINTTLS JA3 fingerprint

16

39499

371

IPFIX_FLOWMON_IEC104_FRAME_FMT

IEC104 frame format

1

39499

372

IPFIX_FLOWMON_IEC104_ASDU_TYPE

IEC104 ASDU type

1

39499

373

IPFIX_FLOWMON_IEC104_ASDU_OBJ_COUNT

IEC104 ASDU object count

1

39499

374

IPFIX_FLOWMON_IEC104_ASDU_COT

IEC104 ASDU cause of transmission

1

39499

375

IPFIX_FLOWMON_IEC104_ASDU_ORG

IEC104 ASDU originator address

1

39499

376

IPFIX_FLOWMON_IEC104_ASDU_ADDRESS

IEC104 common ASDU address

2

39499

390

IPFIX_FLOWMON_COAP_VERSION

CoAP version

1

39499

391

IPFIX_FLOWMON_COAP_MID

CoAP message ID

2

39499

392

IPFIX_FLOWMON_COAP_CODE

CoAP code

1

39499

393

IPFIX_FLOWMON_COAP_OPTIONS_COUNTCoAP options count

2

39499

394

IPFIX_FLOWMON_COAP_TYPE

CoAP type

1

39499

395

IPFIX_FLOWMON_COAP_ACCEPT

CoAP accept

2

39499

396

IPFIX_FLOWMON_COAP_CONTENT_FORMAT

CoAP content format

2

39499

397

IPFIX_FLOWMON_COAP_TOKEN_LENGTH

CoAP token length

1

39499

398

IPFIX_FLOWMON_COAP_TOKEN

CoAP token

8

39499

399

IPFIX_FLOWMON_COAP_URI_HOSTCoAP URI host

64

39499

400

IPFIX_FLOWMON_COAP_URI_PATH

CoAP URI path

64

39499

401

IPFIX_FLOWMON_COAP_URI_QUERYCoAP URI query

64

39499

410

IPFIX_FLOWMON_GOOSE_APPIDGOOSE application ID

2

www.flowmon.com

Enabled by
TLS certificate
Enabled by
TLS JA3
Enabled by
IEC 104
Enabled by
IEC 104
Enabled by
IEC 104
Enabled by
IEC 104
Enabled by
IEC 104
Enabled by
IEC 104
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
GOOSE

TLS certificate
fieldsEnabled by
TLS certificate
fieldsEnabled by
TLS JA3 fields
Enabled by
IEC104
Enabled by
IEC104
Enabled by
IEC104
Enabled by
IEC104
Enabled by
IEC104
Enabled by
IEC104
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
COAP
Enabled by
GOOSE

23/37

Flowmon 11.1
Updated on November 20, 2020

39499

411

IPFIX_FLOWMON_GOOSE_CB_REF

GOOSE control block reference

64

39499

412

IPFIX_FLOWMON_GOOSE_DATA_SETGOOSE data set

64

39499

413

IPFIX_FLOWMON_GOOSE_ID

GOOSE id

64

39499

414

IPFIX_FLOWMON_GOOSE_ST_NUM

GOOSE status number

4

39499

420

IPFIX_FLOWMON_MMS_TYPE

MMS message type

1

39499

421

IPFIX_FLOWMON_MMS_CONF_SERVICE_REQ

MMS confirmed service request type

1

39499

422

IPFIX_FLOWMON_MMS_CONF_SERVICE_RESP

MMS confirmed service response type

1

39499

423

IPFIX_FLOWMON_MMS_UNCONF_SERVICE

MMS unconfirmed service type

1

39499

430

IPFIX_FLOWMON_DLMS_TYPEDLMS message type

1

39499

431

IPFIX_FLOWMON_DLMS_SUBTYPEDLMS message subtype

2

39499

432

IPFIX_FLOWMON_DLMS_CLASS_ID

DLMS class id

2

39499

433

IPFIX_FLOWMON_DLMS_OBISDLMS OBIS code

6

39499

434

IPFIX_FLOWMON_DLMS_ATTR_METHOD_IDDLMS attribute/method id

1

39499

435

IPFIX_FLOWMON_DLMS_DATA_TYPEDLMS data type

1

39499

436

IPFIX_FLOWMON_DLMS_DATA_LENGTHDLMS data length

2

39499

437

IPFIX_FLOWMON_DLMS_DATA_ACCESS_RESULT

DLMS data access result

1

39499

438

IPFIX_FLOWMON_DLMS_ACTION_RESULTDLMS action result

1

39499

450

IPFIX_FLOWMON_VXLAN_VNI

VxLAN VNI

4

www.flowmon.com

Enabled by
GOOSE
Enabled by
GOOSE
Enabled by
GOOSE
Enabled by
GOOSE
Enabled by
MMS
Enabled by
MMS
Enabled by
MMS
Enabled by
MMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
VxLAN

Enabled by
GOOSE
Enabled by
GOOSE
Enabled by
GOOSE
Enabled by
GOOSE
Enabled by
MMS
Enabled by
MMS
Enabled by
MMS
Enabled by
MMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
DLMS
Enabled by
VxLAN

24/37

Flowmon 11.1
Updated on November 20, 2020

IPFIX - Other Vendors
Flowmon Collector supports IPFIX flow data from the following vendors:
●
●
●
●
●

Cisco​, PEN = 9.
VMware​, PEN = 6876.
Gigamon​, PEN = 26866.
IXIA​, PEN = 3054.
Nokia (ALU)​, PEN = 637.

Not all IPFIX fields from other vendors are supported. See the table below for a list of supported IPFIX fields.
Note: ​None of the following fields are applicable to Flowmon Probe, they can only be collected by Flowmon Collector.

ID

Field

9

9316

IPFIX_CISCO_ART_CNT_SUM

9

9317

IPFIX_CISCO_ART_CNT_MAX

9

9318

IPFIX_CISCO_ART_CNT_MIN

9

9319

IPFIX_CISCO_ART_SNT_SUM

9

9320

IPFIX_CISCO_ART_SNT_MAX

9

9321

IPFIX_CISCO_ART_SNT_MIN

9

9306

IPFIX_CISCO_ART_SRT_SUM

9

9307

IPFIX_CISCO_ART_SRT_MAX

9

9308

IPFIX_CISCO_ART_SRT_MIN

9

9292

IPFIX_CISCO_ART_CNT_RESPONSES

Number of Req-Rsp pairs received within the monitoring interval.

4

9

9268

IPFIX_CISCO_ART_CLIENT_RETRANSMISSIONSART Count Retransmissions metric is the packet count for all theretransmitted client packets

4

www.flowmon.com

Description

Input Length(bytes)PEN

The round trip time between SYN-ACK & ACK. Collect art client
network time sum.
The round trip time between SYN-ACK & ACK. Collect art client
network time maximum.
The round trip time between SYN-ACK & ACK. Collect art client
network time minimum.
The round trip time between SYN & SYN-ACK and also called
Server Network Delay (SND). Collect art server network timesum.
The round trip time between SYN & SYN-ACK and also called
Server Network Delay (SND). Collect art server network time
maximum.
The round trip time between SYN & SYN-ACK and also called
Server Network Delay (SND). Collect art server network timeminimum.
The time taken by an application to respond to a request. It isalso called Application Delay (AD) or Application Response
Time. Collect art server response time sum.
The time taken by an application to respond to a request. It isalso called Application Delay (AD) or Application Response
Time. Collect art server response time maximum.
The time taken by an application to respond to a request. It isalso called Application Delay (AD) or Application Response
Time. Collect art server response time minimum.

4
4
4

Collector
Configuration
Enabled by
AVC Metrics
Enabled by
AVC Metrics
Enabled by
AVC Metrics

4

Enabled by
AVC Metrics

4

Enabled by
AVC Metrics

4

Enabled by
AVC Metrics

4

Enabled by
AVC Metrics

4

Enabled by
AVC Metrics

4

Enabled by
AVC Metrics
Enabled by
AVC Metrics
Enabled by
AVC Metrics

25/37

Flowmon 11.1
Updated on November 20, 2020

ART Count Retransmissions metric is the packet count for all theretransmitted client packets.
Network Time is known as the round-trip time that is thesummation of CND and SND. It is also called Network Delay(ND).
Number of responses by response time in 7-bucket histogram.
Bucket 1, response time < 2 milliseconds.
Number of responses by response time in 7-bucket histogram.
Bucket 2, response time is between 2-5 milliseconds.
Number of responses by response time in 7-bucket histogram.
Bucket 3, response time is between 5-10 milliseconds.
Number of responses by response time in 7-bucket histogram.
Bucket 4, response time is between 10-50 milliseconds.
Number of responses by response time in 7-bucket histogram.
Bucket 5, response time is between 50-100 milliseconds.
Number of responses by response time in 7-bucket histogram.
Bucket 6, response time is between 100-500 milliseconds.
Number of responses by response time in 7-bucket histogram.
Bucket 7, response time is between 500 - 1000 milliseconds.
Number of responses received after the max Response Time.
Current threshold of timeout is 1 second. Also called Number oflate responses (timeouts).

4

Enabled by
AVC Metrics

4

Enabled by
AVC Metrics

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

4

Enabled by
AVC Histogram

9

9270

IPFIX_CISCO_ART_SERVER_RETRANSMISSIONS

9

9313

IPFIX_CISCO_NETWORK_TIME_SUM

9

9293

IPFIX_CISCO_ART_RES_HIST_1

9

9294

IPFIX_CISCO_ART_RES_HIST_2

9

9295

IPFIX_CISCO_ART_RES_HIST_3

9

9296

IPFIX_CISCO_ART_RES_HIST_4

9

9297

IPFIX_CISCO_ART_RES_HIST_5

9

9298

IPFIX_CISCO_ART_RES_HIST_6

9

9299

IPFIX_CISCO_ART_RES_HIST_7

9

9300

IPFIX_CISCO_ART_RES_LATE

9

12235

IPFIX_CISCO_HTTP_INFO

Cisco HTTP Host and URL

6876

950

IPFIX_VMWARE_RULEID

Firewall rule ID

4

6876

951

IPFIX_VMWARE_VMUUID

Uniquely identifies virtual machine

16

6876

952

IPFIX_VMWARE_VNICINDEX

Index of the VNIC for the specified virtual machine

4

26866

1

IPFIX_GIGAMON_HTTP_REQUEST_URL

Gigamon HTTP Request URL

128

26866

1

IPFIX_GIGAMON_HTTP_RESPONSE_CODE

Gigamon HTTP Response Code

2

26866

201

IPFIX_GIGAMON_DNS_IDENTIFIER

Gigamon DNS identifier generated by the device that creates
DNS query

1

26866

202

IPFIX_GIGAMON_DNS_OP_CODE

Gigamon DNS Op code which specifies query type

1

26866

203

IPFIX_GIGAMON_DNS_DNS_RESPONSE_CODE

Gigamon DNS response code which specifies response

128

26866

204

IPFIX_GIGAMON_DNS_QUERY_NAME

Gigamon DNS query name

128

26866

205

IPFIX_GIGAMON_DNS_REPONSE_NAME

Gigamon DNS response name128

www.flowmon.com

Variable

Enabled by
AVC HTTP
Enabled by
NSX
Enabled by
NSX
Enabled by
NSX
Enabled by
HTTP Host and URL
Enabled by
HTTP Host and URL
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
DNS

26/37

Flowmon 11.1
Updated on November 20, 2020

26866

206

IPFIX_GIGAMON_DNS_REPONSE_TTL

Gigamon DNS response TTL

4

26866

207

IPFIX_GIGAMON_DNS_REPONSE_IPV4_ADDR

Gigamon DNS IPv4 address in the response

4

26866

208

IPFIX_GIGAMON_DNS_REPONSE_IPV6_ADDR

Gigamon DNS IPv6 address in the response

16

26866

101

IPFIX_GIGAMON_SSL_CER_ISSUER_NAME

Gigamon SSL certificate issuer name

Variable

26866

102

IPFIX_GIGAMON_SSL_CER_SUBJECT_NAME

Gigamon SSL certificate subject name

Variable

26866

105

IPFIX_GIGAMON_SSL_CER_VALID_NOT_BEFORE

Gigamon SSL certificate valid not before

13

26866

106

IPFIX_GIGAMON_SSL_CER_VALID_NOT_AFTER

Gigamon SSL certificate valid not after

13

26866

107

IPFIX_GIGAMON_SSL_CER_SERIAL_NUMBER

Gigamon SSL certificate serial number

20

26866

108

IPFIX_GIGAMON_SSL_CER_SIG_ALG

Gigamon SSL certificate signature algorithm

9

26866

109

IPFIX_GIGAMON_SSL_CER_SUBJECT_PUB_ALG

Gigamon SSL certificate subject public algorithm

9

26866

110

IPFIX_GIGAMON_SSL_CER_SUBJECT_PUB_KEY_SIZE

Gigamon SSL certificate subject public algorithm size

2

26866

111

IPFIX_GIGAMON_SSL_CER_SUBJECT_ALT_NAMES

Gigamon SSL certificate subject alternate names

Variable

26866

112

IPFIX_GIGAMON_SSL_SERVER_NAME_INDICATION

Gigamon SSL server name indication

Variable

26866

113

IPFIX_GIGAMON_SSL_SERVER_VERSION

Gigamon SSL server version

2

26866

114

IPFIX_GIGAMON_SSL_SERVER_CIPHER

Gigamon SSL server cipher

2

26866

115

IPFIX_GIGAMON_SSL_SERVER_COMPRESSION_MET
HOD

Gigamon SSL server compression method

1

26866

116

IPFIX_GIGAMON_SSL_SERVER_SESSION_ID

Gigamon SSL server session ID

32

26866

1608

IPFIX_GIGAMON_RADIUS_CALLED_STATION_ID

Gigamon RADIUS Called station ID

Variable

26866

1637

IPFIX_GIGAMON_RADIUS_CALLING_STATION_ID

Gigamon RADIUS Calling station ID

Variable

26866

1647

IPFIX_GIGAMON_RADIUS_LOGIN

Gigamon RADIUS Username

Variable

26866

10002

IPFIX_GIGAMON_RADIUS_NAT_ADDRESS

Gigamon RADIUS NAT IP address

4

26866

10003

IPFIX_GIGAMON_RADIUS_PORT_START

Gigamon RADIUS NAT port start

4

26866

10004

IPFIX_GIGAMON_RADIUS_PORT_END

Gigamon RADIUS NAT port end

4

www.flowmon.com

Enabled by
DNS
Enabled by
DNS
Enabled by
DNS
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
SSL
Enabled by
RADIUS
Enabled by
RADIUS
Enabled by
RADIUS
Enabled by
RADIUS
Enabled by
RADIUS
Enabled by
RADIUS

27/37

Flowmon 11.1
Updated on November 20, 2020

3054

183

IPFIX_IXIA_HTTP_HOSTNAMEIXIA HTTP Hostname

32

3054

184

IPFIX_IXIA_HTTP_URIIXIA HTTP URI

64

637

93

IPFIX_ALU_NAT_SUB_STRING

A string that represents the NAT subscriber construct. The
original IP source address, before NAT is performed is includedin this string. For example: LSN-Host@10.10.10.101

www.flowmon.com

Variable

Enabled by
HTTP Host and URL
Enabled by
HTTP Host and URL
Enabled by
NEL Common
block,
Mapped to an
existing fieldstoring SRC NAT IP

28/37

Flowmon 11.1
Updated on November 20, 2020sFlow v2/4/5
RecordDescription

Collector Configuration

input

SNMP index of input interface.

Collected by default

output

SNMP index of output interface.

Collected by default

src_asAutonomous system number of the source.

Collected by default

dst_asAutonomous system number of the destination.

Collected by default

src_vlan

Source Virtual LAN.

dst_vlanDestination Virtual LAN.

dst_tos

Destination type of service.

dirDirection / Directory.

src_mask

Source address prefix mask bits.

dst_mask

Destination address prefix mask bits.

in_src_mac

Input source MAC address.

out_dst_mac

Output destination MAC address.

nexthop

IP address of next hop router.

bgp_nexthop

BGP Next hop IP address.

first

SysUptime at start of flow.

Collected by default

last

SysUptime at the time the last packet of the flow was received.

Collected by default

fwd_status(sFlow data stored per record)

Collected by default

tcp_flags

Cumulative OR of TCP flags

Collected by default

prot

IP protocol typeCollected by defaulttos

IP type of service (TOS)

Collected by default

srcport

TCP/UDP source port number or equivalentCollected by default

www.flowmon.com

Enabled by
SRC/DST VLAN ID labels
Enabled by
SRC/DST VLAN ID labels
Enabled by
SRC/DST mask, (dst) TOS, Direction
Enabled by
SRC/DST mask, (dst) TOS, Direction
Enabled by
SRC/DST mask, (dst) TOS, Direction
Enabled by
SRC/DST mask, (dst) TOS, Direction
Enabled by
In SRC/out DST MAC address
Enabled by
In SRC/out DST MAC address
Enabled by
Next HOP IP address
Enabled by
BGP next HOP IP address

29/37

Flowmon 11.1
Updated on November 20, 2020

dstport

TCP/UDP destination port number of equivalentCollected by default

scr_ipaddr

Source IP address

Collected by default

dst_ipaddr

Destination IP address

Collected by default

www.flowmon.com

30/37

Flowmon 11.1
Updated on November 20, 2020

jFlow
Supported – compatible with ​NetFlow v5/7​/​9​.
Warning:
jFlow works with NetFlowStart attributes in a different way than traditional flow vendors. The original timestamp of the first packet is preserved even when theflow is exported due to active timeout expiration. As a result, there can be a timeframe of 16:10-16:15 which contains NetFlowStart 14:37. Flowmon can copewith the described approach, but the user needs to be aware of this behavior.

www.flowmon.com

31/37

Flowmon 11.1
Updated on November 20, 2020

NetFlow Lite
Supported – compatible with ​NetFlow v5/7​/​9​.

www.flowmon.com

32/37

Flowmon 11.1
Updated on November 20, 2020

NetStream
Supported – compatible with ​NetFlow v5/7​/​9​.

www.flowmon.com

33/37

Flowmon 11.1
Updated on November 20, 2020

cflowdSupported – compatible with ​NetFlow v5/7​/​9​.

www.flowmon.com

34/37

Flowmon 11.1
Updated on November 20, 2020AWS VPC Flow Logs
Support is enabled via ​Flowmon Configuration Center – FMC Configuration – AWS Flow Logs​. Logs are periodically downloaded, converted to IPFIX and sent to the specified listening portof the local collector. The table below specifies how AWS VPC Flow Logs fields are mapped to supported IPFIX fields.

Field

Maps to, in IPFIX

Collector Configuration

versionNo mapping

Not supported

account-id

No mapping

Not supported

interface-id
srcaddrdstaddr

No mapping, replaced by a generated value for
IPFIX_ingressInterface
IPFIX_SourceIPv4Address
IPFIX_SourceIPv6Address
IPFIX_DestinationIPv4Address
IPFIX_DestinationIPv6Address

Collected by default
Collected by default
Collected by default

srcportIPFIX_SourceTransportPort

Collected by default

dstportIPFIX_DestinationTransportPort

Collected by default

protocol

IPFIX_protocolIdentifierCollected by default

packets

IPFIX_packetTotalCount

Collected by default

bytes

IPFIX_octetTotalCount

Collected by default

start

IPFIX_flowStartMilliseconds

Collected by default

end

IPFIX_flowEndMilliseconds

Collected by default

action

IPFIX_firewallEvent

Not supported

log-status

No mapping

Not supported

www.flowmon.com

35/37

Flowmon 11.1
Updated on November 20, 2020

Flowmon Collector - Extra Fields
Note: The following fields are automatically added by Flowmon Collector irrespective of the flow standard used. Fields containing user identity are populated only when parsing of the user
identity information is enabled in ​Flowmon Configuration Center – System – System Settings – Syslog Server​. For details, please refer to Flowmon User Guide.

Field

Description

Collector Configuration

Source country

Identification of source country

Collected by default

Destination country

Identification of destination country

Collected by default

Source AS number

Autonomous system source number

Collected by default

Destination AS number

Autonomous system destination number

Collected by default

Time packet received

Time packet received

Enabled byTime stamp flow received by collector

User Identity Source Username

User name provided from source identity

Added to each flow from Active Directory logs

User Identity Destination Username

User name provided from destination identity

Added to each flow from Active Directory logs

www.flowmon.com

36/37

Flowmon 11.1
Updated on November 20, 2020

History
Date
November 20, 2020
November 13, 2020www.flowmon.com

Description
Added the ​AWS VPC Flow Logs​ section.
●●●

Added the ​Overview​ section and the ​Probe Configuration​ column in NetFlow ​v5/7​/​9​ and ​IPFIX​.
Renamed the ​Database Field Names​ column to ​Collector Configuration​.
Added ​Nokia (ALU)​ and field ​IPFIX_ALU_NAT_SUB_STRING​ to ​IPFIX - Other Vendors​.

37/37