C++ Native Functions: com.teracloud.streams.network.parse

This page documents native functions that can be invoked from SPL, including the SPL interfaces that can be used to invoke each of the native functions.

Functions

public uint32 DHCP_ADDRESS_LEASE_TIME()

This parser result function returns the duration of the address lease, in seconds, if DHCP option 51 is included in the message, or zero if not.

public boolean DHCP_ALL_SUBNETS_LOCAL()

This parser result function returns true if all subnets use the same MTU size, if DHCP option 27 is included in the message, or false if not.

public uint32 DHCP_ARP_CACHE_TIMEOUT()

This parser result function returns the timeout for ARP cache entries, in seconds, if DHCP option 35 is included in the message, or zero if not.

public rstring DHCP_BOOTFILE_NAME()

This parser result function returns the pathname of a boot file the client can use, if there is one, or an empty string otherwise. This may be DHCP option 67, depending upon option 52.

public uint16 DHCP_BOOT_FILE_SIZE()

This parser result function returns the size of boot file in 512 byte blocks, if DHCP option 13 is included in the message, or zero if not.

public uint32 DHCP_BROADCAST_ADDRESS()

This parser result function returns the IP version 4 address to use when broadcasting on subnet, if DHCP option 28 is included in the message, or zero if not.

public uint32 DHCP_CLIENT_ADDRESS()

This parser result function returns the DHCP client's IP version 4 address when it requests renewal of its lease.

public list<uint8> DHCP_CLIENT_HARDWARE_ADDRESS()

This parser result function returns the DHCP client's network hardware address, for example, the MAC address of its ethernet adapter.

public uint8 DHCP_CLIENT_HARDWARE_TYPE()

This parser result function returns the client's hardware address type, for example, '1' for ethernet.

public list<uint8> DHCP_CLIENT_IDENTIFIER()

This parser result function returns client-specific information, if DHCP option 61 is included in the message, or an empty list if not.

public list<uint32> DHCP_COOKIE_SERVERS()

This parser result function returns a list of cookie servers, represented as IP version 4 addresses, if DHCP option 8 is included in the message, or an empty list if not.

public list<uint32> DHCP_DNS_SERVERS()

This parser result function returns a list of DNS servers, represented as IP version 4 addresses, if DHCP option 6 is included in the message, or an empty list if not.

public rstring DHCP_DOMAIN_NAME()

This parser result function returns the domain name the client should use with DNS, if DHCP option 15 is included in the message, or an empty string if not.

public rstring DHCP_ERROR_MESSAGE()

This parser result function returns an error message from server, if request failed, if DHCP option 56 is included in the message.

public boolean DHCP_ETHERNET_ENCAPSULATION()

This parser result function returns true when the client should use ethernet encapsulation, if DHCP option 36 is included in the message, or false if not.

public rstring DHCP_EXTENSIONS_PATH()

This parser result function returns BOOTP extensions, if DHCP option 18 is included in the message, or an empty string if not.

public list<uint32> DHCP_FINGER_SERVERS()

This parser result function returns a list of Finger servers, represented as IP version 4 addresses, if DHCP option 73 is included in the message, or an empty list if not.

public uint16 DHCP_FLAGS()

This parser result function returns the DHCP broadcast flag.

public uint8 DHCP_HOP_COUNT()

This parser result function returns the number of relay agents separating the DHCP client and server.

public rstring DHCP_HOST_NAME()

This parser result function returns the hostname of the client, if DHCP option 12 is included in the message, or an empty string if not.

public list<uint32> DHCP_IMPRESS_SERVERS()

This parser result function returns a list of Impress servers, represented as IP version 4 addresses, if DHCP option 10 is included in the message, or an empty list if not.

public uint16 DHCP_INTERFACE_MTU()

This parser result function returns the MTU size to use on this interface, if DHCP option 26 is included in the message, or zero if not.

public uint8 DHCP_IP_DEFAULT_TTL()

This parser result function returns the default IP time-to-live for outgoing packets, if DHCP option 23 is included in the message, or zero if not.

public boolean DHCP_IP_FORWARDING()

This parser result function returns true if the client should forward IP packets, if DHCP option 19 is included in the message, or false if not.

public list<uint32> DHCP_IRC_SERVERS()

This parser result function returns a list of IRC servers, represented as IP version 4 addresses, if DHCP option 74 is included in the message, or an empty list if not.

public list<uint32> DHCP_LOG_SERVERS()

This parser result function returns a list of log servers, represented as IP version 4 addresses, if DHCP option 7 is included in the message, or an empty list if not.

public list<uint32> DHCP_LPR_SERVERS()

This parser result function returns a list of print servers, represented as IP version 4 addresses, if DHCP option 9 is included in the message, or an empty list if not.

public boolean DHCP_MASK_SUPPLIER()

This parser result function returns true when client should respond to subnet mask discovery, if DHCP option 30 is included in the message, or false if not.

public uint16 DHCP_MAXIMUM_MESSAGE_SIZE()

This parser result function returns the maximum size of DHCP message, if DHCP option 57 is included in the message, or zero if not.

public uint16 DHCP_MAXIMUM_REASSEMBLY_SIZE()

This parser result function returns the maximum size of reassembled packets, if DHCP option 22 is included in the message, or zero if not.

public rstring DHCP_MERIT_DUMP_FILE()

This parser result function returns the pathname of a file for client's core dump image, if DHCP option 14 is included in the message, or an empty string if not.

public uint8 DHCP_MESSAGE_TYPE()

This parser result function returns the type of this DHCP message, if DHCP option 53 is included in the message, or zero if not, for example:

'1' for Discover,
'2' for Offer,
'3' for Request,
'4' for Decline,
'5' for Positive Acknowledge,
'6' for Negative Acknowledge,
'7' for Release, or
'8' for Inform.

public list<uint32> DHCP_MOBILE_IP_HOME_AGENTS()

This parser result function returns a list of mobile IP home agents, represented as IP version 4 addresses, if DHCP option 68 is included in the message, or an empty list if not.

public uint32 DHCP_MTU_AGING_TIMEOUT()

This parser result function returns the time to use when aging path MTU values, in seconds, if DHCP option 24 is included in the message, or zero if not.

public list<uint16> DHCP_MTU_PLATEAU_TABLE()

This parser result function returns a list of MTU sizes for path discovery, if DHCP option 25 is included in the message, or an empty list if not.

public list<uint32> DHCP_NAME_SERVERS()

This parser result function returns a list of name servers (not DNS servers, see next option), represented as IP version 4 addresses, if DHCP option 5 is included in the message, or an empty list if not.

public list<uint32> DHCP_NETBIOS_NAME_SERVERS()

This parser result function returns a list of NetBIOS-over-TCP name servers, represented as IP version 4 addresses, if DHCP option 44 is included in the message, or an empty list if not.

public list<uint32> DHCP_NETBIOS_NBDD_SERVERS()

This parser result function returns a list of NetBIOS-over-TCP NBDD servers, represented as IP version 4 addresses, if DHCP option 45 is included in the message, or an empty list if not.

public uint8 DHCP_NETBIOS_NODE_TYPE()

This parser result function returns the type of NetBIOS-over-TCP node, if DHCP option 46 is included in the message, or zero if not.

public rstring DHCP_NETBIOS_SCOPE()

This parser result function returns the client's NetBIOS-over-TCP scope parameter, if DHCP option 47 is included in the message, or an empty string if not.

public rstring DHCP_NISPLUS_DOMAIN()

This parser result function returns the name of the client's NIS+ domain, if DHCP option 64 is included in the message.

public list<uint32> DHCP_NISPLUS_SERVERS()

This parser result function returns a list of NIS+ servers, represented as IP version 4 addresses, if DHCP option 65 is included in the message, or an empty list if not.

public rstring DHCP_NIS_DOMAIN()

This parser result function returns the name of the client's NIS domain, if DHCP option 40 is included in the message, or an empty string if not.

public list<uint32> DHCP_NIS_SERVERS()

This parser result function returns a list of NIS servers, represented as IP version 4 addresses, if DHCP option 41 is included in the message, or an empty list if not.

public list<uint32> DHCP_NNTP_SERVERS()

This parser result function returns a list of NNTP servers, represented as IP version 4 addresses, if DHCP option 71 is included in the message, or an empty list if not.

public list<uint32> DHCP_NONLOCAL_SOURCE_FILTERS()

This parser result function returns a list of IP version 4 address/mask pairs for filtering source packets, if DHCP option 21 is included in the message, or an empty list if not.

public boolean DHCP_NONLOCAL_SOURCE_ROUTING()

This parser result function returns true if the client should forward IP packets with non-local source routing, if DHCP option 20 is included in the message, or false if not.

public list<uint32> DHCP_NTP_SERVERS()

This parser result function returns a list of NTP servers, represented as IP version 4 addresses, if DHCP option 42 is included in the message, or an empty list if not.

public uint8 DHCP_OPCODE()

This parser result function returns the DHCP message type ('1' for request, '2' for reply).

public uint8 DHCP_OPTION_OVERLOAD_FLAGS()

This parser result function returns flags indicating whether the sname and file fields in the DHCP message header contain the server's host name and client's boot file name, or additional DHCP options, if DHCP option 52 is included in the message, or zero if not.

public list<uint8> DHCP_PARAMETER_REQUESTS()

This parser result function returns a list of requested DHCP parameters, expressed as option codes, if DHCP option 55 is included in the message, or an empty list if not.

public boolean DHCP_PERFORM_MASK_DISCOVERY()

This parser result function returns true when client should perform subnet mask discovery, if DHCP option 29 is included in the message, or false if not.

public boolean DHCP_PERFORM_ROUTER_DISCOVERY()

This parser result function returns true when the client should solicit routers, if DHCP option 31 is included in the message, or false if not.

public list<uint32> DHCP_POP3_SERVERS()

This parser result function returns a list of POP3 servers, represented as IP version 4 addresses, if DHCP option 70 is included in the message, or an empty list if not.

public uint32 DHCP_REBINDING_TIME()

This parser result function returns the time from address lease to rebinding, in seconds, if DHCP option 59 is included in the message, or zero if not.

public uint32 DHCP_RELAY_AGENT()

This parser result function returns the IP version 4 address of the relay agent between the DHCP client and server, if there is one, or zero otherwise.

public uint32 DHCP_RENEWAL_TIME()

This parser result function returns then time from address lease to renewal, in seconds, if DHCP option 58 is included in the message, or zero if not.

public uint32 DHCP_REQUESTED_ADDRESS()

This parser result function returns the client's requested address, as an IP version 4 address, if DHCP option 50 is included in the message, or zero if not.

public list<uint32> DHCP_RESOURCE_SERVERS()

This parser result function returns a list of resource location servers, represented as IP version 4 addresses, if DHCP option 11 is included in the message, or an empty list if not.

public rstring DHCP_ROOT_PATH()

This parser result function returns the pathname of the client's root disk (for diskless workstations), if DHCP option 17 is included in the message, or an empty string if not.

public list<uint32> DHCP_ROUTERS()

This parser result function returns a list of routers on client's subnet, represented as IP version 4 addresses, if DHCP option 3 is included in the message, or an empty list if not.

public uint32 DHCP_ROUTER_SOLICITATION_ADDRESS()

This parser result function returns the IP version 4 address to which router solicitations should be sent, if DHCP option 32 is included in the message, or zero if not.

public uint16 DHCP_SECONDS()

This parser result function returns the elased time, in seconds, between the request and the response.

public uint32 DHCP_SERVER_ADDRESS()

This parser result function returns the IP version 4 address of DHCP server, if DHCP option 54 is included in the message, or zero if not.

public rstring DHCP_SERVER_HOSTNAME()

This parser result function returns the name of the DHCP server, if it has one, or an empty string otherwise. This may be DHCP option 66, depending upon option 52.

public uint32 DHCP_SERVER_NEXT()

This parser result function returns the IP version 4 address of the next DHCP server to use.

public list<uint32> DHCP_SMTP_SERVERS()

This parser result function returns a list of SMTP servers, represented as IP version 4 addresses, if DHCP option 69 is included in the message, or an empty list if not.

public list<uint32> DHCP_STATIC_ROUTES()

This parser result function returns a list of IP version 4 address pairs for the client's static routing table, if DHCP option 33 is included in the message, or an empty list if not.

public list<uint32> DHCP_STDA_SERVERS()

This parser result function returns a list of StreetTalk Directory Assistance servers, represented as IP version 4 addresses, if DHCP option 76 is included in the message, or an empty list if not.

public list<uint32> DHCP_STREETTALK_SERVERS()

This parser result function returns a list of StreetTalk servers, represented as IP version 4 addresses, if DHCP option 75 is included in the message, or an empty list if not.

public uint32 DHCP_SUBNET_MASK()

This parser result function returns the mask of the client's subnet, represented as an IP version 4 address, if DHCP option 1 is included in the message, or zero if not.

public uint32 DHCP_SWAP_SERVER()

This parser result function returns the IP version 4 address of the client's swap server, if DHCP option 16 is included in the message.

public uint8 DHCP_TCP_DEFUALT_TTL()

This parser result function returns the default TCP time-to-live for outgoing segments, if DHCP option 37 is included in the message, or zero if not.

public boolean DHCP_TCP_KEEPALIVE_GARBAGE()

This parser result function returns true when the client should send a byte of garbage with TCP keepalive messages, if DHCP option 39 is included in the message, or false if not.

public uint32 DHCP_TCP_KEEPALIVE_INTERVAL()

This parser result function returns the time the client should wait before sending TCP keepalive messages, in seconds, if DHCP option 38 is included in the message, or zero if not.

public int32 DHCP_TIME_OFFSET()

This parser result function returns the time offset of the client's subnet, relative to GMT/UTC, in seconds, if DHCP option 2 is included in the message, or zero if not.

public list<uint32> DHCP_TIME_SERVERS()

This parser result function returns a list of time servers, represented as IP version 4 addresses, if DHCP option 4 is included in the message, or an empty list if not.

public boolean DHCP_TRAILER_ENCAPSULATION()

This parser result function returns true when the client should negotiate trailers, if DHCP option 34 is included in the message, or false if not.

public uint32 DHCP_TRANSACTION_IDENTIFIER()

This parser result function returns the request correlator chosen by the DHCP client in its request and returned to it by server in its response.

public list<uint8> DHCP_VENDOR_IDENTIFIER()

This parser result function returns vendor-specific information, if DHCP option 60 is included in the message, or an empty list if not.

public list<uint8> DHCP_VENDOR_INFORMATION()

This parser result function returns vendor-specific information, if DHCP option 43 is included in the message, or an empty list if not.

public list<uint32> DHCP_WWW_SERVERS()

This parser result function returns a list of WWW servers, represented as IP version 4 addresses, if DHCP option 72 is included in the message, or an empty list if not.

public list<uint32> DHCP_XWINDOW_DISPLAY_MANAGERS()

This parser result function returns a list of X-Windows display managers, represented as IP version 4 addresses, if DHCP option 49 is included in the message, or an empty list if not.

public list<uint32> DHCP_XWINDOW_FONT_SERVERS()

This parser result function returns a list of X-Windows font servers, represented as IP version 4 addresses, if DHCP option 48 is included in the message, or an empty list if not.

public uint32 DHCP_YOUR_ADDRESS()

This parser result function returns the IP version 4 address leased to the client by the DHCP server, if the message is an acknowledgement granting a lease, or zero if not.

public list<uint16> DNS_ADDITIONAL_CLASSES()

This parser result function returns a list of the 'class' fields in the 'additional' resource records in the current message.

public uint16 DNS_ADDITIONAL_COUNT()

This parser result function returns the number of 'additional' resource records in the current message.

public list<rstring> DNS_ADDITIONAL_DATA()

This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message. For resource records containing multiple fields, such as SOA records, only the first field is returned.

public list<rstring> DNS_ADDITIONAL_DATA(rstring)

public list<rstring> DNS_ADDITIONAL_NAMES()

This parser result function returns a list of the 'name' fields in the 'additional' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public list<uint32> DNS_ADDITIONAL_TTLS()

This parser result function returns a list of the 'time to live' fields in the 'additional' resource records in the current message.

public list<uint16> DNS_ADDITIONAL_TYPES()

This parser result function returns a list of the 'type' fields in the 'additional' resource records in the current message.

public rstring DNS_ALL_FIELDS(rstring, rstring, rstring)

public rstring DNS_ALL_FIELDS(rstring, rstring, rstring, list<uint16>)

This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from seleccted DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter. DNS resource records are selected by specifying DNS types in a list of unsigned 16-bit integers as the fourth parameter of the function.

public rstring DNS_ALL_FIELDS(rstring, rstring, rstring, list<uint16>, uint64, uint32, uint32, uint32, uint16, uint16, uint8, uint32, uint16)

public uint16 DNS_ALL_FLAGS()

This parser result function returns a 16-bit value containing all of the DNS header flags from the current message. The value is in host byte order, so, for example, DNS_ALL_FLAGS()& 0x8000 == 0x8000 has the same value as DNS_RESPONSE_FLAG(), DNS_ALL_FLAGS() >> 11 & 0x000F has the same value as DNS_OPCODE(), and DNS_ALL_FLAGS() & 0x000F has the same value as DNS_RESPONSE_CODE().

public rstring DNS_ANSWER_ADDRESS()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as a string value, or an empty string if not.

public list<rstring> DNS_ANSWER_ADDRESSES()

This parser result function returns a list of the 'data' fields in the 'answer' resource records that have a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as string values.

public rstring DNS_ANSWER_CANONICAL()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '5' (meaning, the answer is a canonical domain name from a type 'CNAME' record), or an empty string if not.

public list<uint16> DNS_ANSWER_CLASSES()

This parser result function returns a list of the 'class' fields in the 'answer' resource records in the current message.

public uint16 DNS_ANSWER_COUNT()

This parser result function returns the number of 'answer' resource records in the current message.

public list<rstring> DNS_ANSWER_DATA()

This parser result function returns a list of the 'data' fields in the 'answer' resource records in the current message.

public uint32 DNS_ANSWER_IPV4_ADDRESS()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' (meaning, the answer is an IP version 4 address from a type 'A' record), as a binary value, or zero if not.

public list<uint32> DNS_ANSWER_IPV4_ADDRESSES()

This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '1' (meaning, the answers are IP version 4 addresses from type 'A' records), as a list of binary values.

public list<uint8>[16] DNS_ANSWER_IPV6_ADDRESS()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '28' (meaning, the answer is an IP version 6 address from a type 'AAAA' record), as a binary value, or zero if not.

public list<list<uint8>[16]> DNS_ANSWER_IPV6_ADDRESSES()

This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '28' (meaning, the answers IP version 6 addresses from type 'AAAA' records), as a binary values.

public list<rstring> DNS_ANSWER_NAMES()

This parser result function returns a list of the 'name' fields in the 'answer' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public list<uint32> DNS_ANSWER_TTLS()

This parser result function returns a list of the 'time to live' fields in the 'answer' resource records in the current message.

public list<uint16> DNS_ANSWER_TYPES()

This parser result function returns a list of the 'type' fields in the 'answer' resource records in the current message.

public boolean DNS_AUTHORITATIVE_FLAG()

This parser result function returns true if the 'authoritative' flag is set in the current message, or false if not.

public blob DNS_EXTRA_DATA()

This parser result function returns any extra data in the DNS message that follows the last resource record. Note that the parseError() function returns 'true' if there is any extra data following the last resource record, even though no errors were found in any resource record, and the parseErrorCode() function returns '122'.

public uint16 DNS_IDENTIFIER()

This parser result function returns the DNS client's request correlator in the current message, and returned by the server in its response.

public int32 DNS_INCOMPATIBLE_FLAGS()

This parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found. The error codes are:

1 indicates that the Authoritative flag is set in the DNS header but the Response flag is not set.
2 indicates taht the Truncated flag is set in the DNS header but not the Response flag is not set.
3 indicates that the Authoritative and Truncated flags in the DNS header are both set.
4 indicates that the Authoritative, Truncated, Recursion Desired, and Recursion Available flags in the DNS header are all set.

public list<uint16> DNS_NAMESERVER_CLASSES()

This parser result function returns a list of the 'class' fields in the 'name server' resource records in the current message.

public uint16 DNS_NAMESERVER_COUNT()

This parser result function returns the number of 'name server' resource records in the current message.

public list<rstring> DNS_NAMESERVER_DATA()

This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message. For resource records containing multiple fields, such as SOA records, only the first field is returned.

public list<rstring> DNS_NAMESERVER_DATA(rstring)

public list<rstring> DNS_NAMESERVER_NAMES()

This parser result function returns a list of the 'name' fields in the 'name server' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public list<uint32> DNS_NAMESERVER_TTLS()

This parser result function returns a list of the 'time to live' fields in the 'name server' resource records in the current message.

public list<uint16> DNS_NAMESERVER_TYPES()

This parser result function returns a list of the 'type' fields in the 'name server' resource records in the current message.

public uint8 DNS_OPCODE()

This parser result function returns the operation code requested by the DNS client in the current message, for example,

'1' for standard queries,
'2' for inverse queries, or
'3' for server status requests.

public uint16 DNS_QUESTION_CLASS()

This parser result function returns the 'class' field of the first 'question' resource record in the current message, for example, '1' for Internet adddresses ('IN' records),

public list<uint16> DNS_QUESTION_CLASSES()

This parser result function returns a list of the 'class' fields in the 'question' resource records in the current message.

public uint16 DNS_QUESTION_COUNT()

This parser result function returns the number of 'question' resource records in the current message.

public rstring DNS_QUESTION_NAME()

This parser result function returns the 'name' field of the first 'question' resource record in the current message, if there is one, or an empty string if not. Note that if the DNS message does contain a 'question' resource record, and the name is encoded incorrecty, this function may return an empty or truncated string. In this case, the parseError() function will return true.

public list<rstring> DNS_QUESTION_NAMES()

This parser result function returns a list of the 'name' fields in the 'question' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public uint16 DNS_QUESTION_TYPE()

This parser result function returns the 'type' field of the first 'question' resource record in the current message, for example:

'1' for IP version 4 address to domain name lookup ('A' records),
'5' for domain name to canonical domain name lookup ('CNAME' records),
'12' for domain name to IP address lookup ('TXT' records), or
'28' for IP version 6 address to domain name lookup ('AAAA' records).

public list<uint16> DNS_QUESTION_TYPES()

This parser result function returns a list of the 'type' fields in the 'question' resource records in the current message.

public uint8 DNS_RESPONSE_CODE()

This parser result function returns the response code from the DNS server in the current message, for example,

'0' for OK,
'1' for Format Error,
'2' for Server Failure,
'3' for Name Error,
'4' for not implemented, or
'5' for Server Refused.

public boolean DNS_RESPONSE_FLAG()

This parser result function returns true if the current message is a response sent by a DNS server, or false if it is a request sent by a DNS client.

public boolean DNS_TRUNCATION_FLAG()

This parser result function returns true if the 'truncation' flag is set in the current message, or false if not.

public uint32 IPFIX_bgpDestinationAsNumber()

IPFIX field 17: The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.

public uint32 IPFIX_bgpNextAdjacentAsNumber()

IPFIX field 128: The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.

public uint32 IPFIX_bgpNextHopIPv4Address()

IPFIX field 18: The IPv4 address of the next (adjacent) BGP hop.

public list<uint8>[16] IPFIX_bgpNextHopIPv6Address()

IPFIX field 63: The IPv6 address of the next (adjacent) BGP hop.

public uint32 IPFIX_bgpPrevAdjacentAsNumber()

IPFIX field 129: The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value.

public uint32 IPFIX_bgpSourceAsNumber()

IPFIX field 16: The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.

public uint32 IPFIX_collectorIPv4Address()

IPFIX field 211: An IPv4 address to which the Exporting Process sends Flow information.

public list<uint8>[16] IPFIX_collectorIPv6Address()

IPFIX field 212: An IPv6 address to which the Exporting Process sends Flow information.

public uint16 IPFIX_collectorTransportPort()

IPFIX field 216: The destination port identifier to which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the destination port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.

public uint64 IPFIX_commonPropertiesId()

IPFIX field 137: An identifier of a set of common properties that is unique per Observation Domain and Transport Session. Typically, this Information Element is used to link to information reported in separate Data Records.

public uint32 IPFIX_destinationIPv4Address()

IPFIX field 12: The IPv4 destination address in the IP packet header.

public uint32 IPFIX_destinationIPv4Prefix()

IPFIX field 45: IPv4 destination address prefix.

public uint8 IPFIX_destinationIPv4PrefixLength()

IPFIX field 13: The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element.

public list<uint8>[16] IPFIX_destinationIPv6Address()

IPFIX field 28: The IPv6 destination address in the IP packet header.

public list<uint8>[16] IPFIX_destinationIPv6Prefix()

IPFIX field 169: IPv6 destination address prefix.

public uint8 IPFIX_destinationIPv6PrefixLength()

IPFIX field 30: The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element.

public list<uint8>[6] IPFIX_destinationMacAddress()

IPFIX field 80: The IEEE 802 destination MAC address field.

public uint16 IPFIX_destinationTransportPort()

IPFIX field 11: The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers.

public uint64 IPFIX_droppedOctetDeltaCount()

IPFIX field 132: The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_droppedOctetTotalCount()

IPFIX field 134: The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_droppedPacketDeltaCount()

IPFIX field 133: The number of packets since the previous report (if any) of this Flow dropped by packet treatment.

public uint64 IPFIX_droppedPacketTotalCount()

IPFIX field 135: The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.

public uint32 IPFIX_egressInterface()

IPFIX field 14: The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863.

public list<list<uint8>> IPFIX_enterpriseBasicListFieldAsByteLists(int32)

This function returns the value of the specified IPFIX 'enterprise' field as a list of byte lists, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.

public list<uint64> IPFIX_enterpriseBasicListFieldAsIntegers(int32)

This function returns the value of the specified IPFIX 'enterprise' field as a list of integers, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.

public list<rstring> IPFIX_enterpriseBasicListFieldAsStrings(int32)

This function returns the value of the specified IPFIX 'enterprise' field as a list of strings, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.

public uint16 IPFIX_enterpriseBasicListFieldElementIdentifier(int32)

This function returns the value of the 'element identifier' corresponding to the specified IPFIX 'enterprise' 'field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.

public uint32 IPFIX_enterpriseBasicListFieldEnterpriseIdentifier(int32)

This function returns the value of the 'enterprise identifier' corresponding to the specified IPFIX 'enterprise' field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.

public uint8 IPFIX_enterpriseBasicListFieldSemantic(int32)

This function returns the value of the 'semantic code' corresponding to the specified IPFIX 'enterprise' field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.

public list<uint8> IPFIX_enterpriseFieldAsByteList(int32)

This function returns the value of the specified IPFIX 'enterprise' field as a list of bytes, if it is present in the 'data flow' record, or zero if absent.

public uint64 IPFIX_enterpriseFieldAsInteger(int32)

This function returns the value of the specified IPFIX 'enterprise' field as an integer, if it is present in the 'data flow' record, or zero if absent.

public rstring IPFIX_enterpriseFieldAsString(int32)

This function returns the value of the specified IPFIX 'enterprise' field as a string, if it is present in the 'data flow' record, or zero if absent.

public uint32 IPFIX_enterpriseIdentifier(int32)

This function returns the value of the 'enterprise identifier' corresponding to the specified IPFIX 'field identifier', if one is present in the 'data flow' record, or zero if absent.

public uint32 IPFIX_exportInterface()

IPFIX field 213: The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863.

public uint8 IPFIX_exportProtocolVersion()

IPFIX field 214: The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the Version Number field in the Message Header.

The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A value of 0 indicates that no export protocol is in use.

public uint8 IPFIX_exportTransportProtocol()

IPFIX field 215: The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.

In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet.

public uint64 IPFIX_exportedFlowRecordTotalCount()

IPFIX field 42: The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes Flow Records in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process.

public uint64 IPFIX_exportedMessageTotalCount()

IPFIX field 41: The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process.

public uint64 IPFIX_exportedOctetTotalCount()

IPFIX field 40: The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX Messages that were successfully sent to the Collecting Process. The reported number excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process.

public uint32 IPFIX_exporterIPv4Address()

IPFIX field 130: The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.

public list<uint8>[16] IPFIX_exporterIPv6Address()

IPFIX field 131: The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.

public uint16 IPFIX_exporterTransportPort()

IPFIX field 217: The source port identifier from which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the source port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. This field may be useful for distinguishing multiple Exporting Processes that use the same IP address.

public uint32 IPFIX_exportingProcessId()

IPFIX field 144: An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Exporting Process may be re-started with a different ID.

public uint16 IPFIX_flowActiveTimeout()

IPFIX field 36: The number of seconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets.

public uint8 IPFIX_flowDirection()

IPFIX field 61: The direction of the Flow observed at the Observation Point. There are only two values defined.

public uint32 IPFIX_flowDurationMicroseconds()

IPFIX field 162: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.

public uint32 IPFIX_flowDurationMilliseconds()

IPFIX field 161: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.

public uint32 IPFIX_flowEndDeltaMicroseconds()

IPFIX field 159: This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the last observed packet of this Flow relative to the export time specified in the IPFIX Message Header.

public uint64 IPFIX_flowEndMicroseconds()

IPFIX field 155: The absolute timestamp of the last packet of this Flow.

public uint64 IPFIX_flowEndMilliseconds()

IPFIX field 153: The absolute timestamp of the last packet of this Flow.

public uint64 IPFIX_flowEndNanoseconds()

IPFIX field 157: The absolute timestamp of the last packet of this Flow.

public uint8 IPFIX_flowEndReason()

IPFIX field 136: The reason for Flow termination.

public uint32 IPFIX_flowEndSeconds()

IPFIX field 151: The absolute timestamp of the last packet of this Flow.

public uint32 IPFIX_flowEndSysUpTime()

IPFIX field 21: The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime).

public uint64 IPFIX_flowId()

IPFIX field 148: An identifier of a Flow that is unique within an Observation Domain. This Information Element can be used to distinguish between different Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records.

public uint16 IPFIX_flowIdleTimeout()

IPFIX field 37: A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field.

public uint64 IPFIX_flowKeyIndicator()

IPFIX field 173: This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record with the n-th bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that this is not the case.

If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0.

public uint32 IPFIX_flowLabelIPv6()

IPFIX field 31: The value of the IPv6 Flow Label field in the IP packet header.

public uint32 IPFIX_flowStartDeltaMicroseconds()

IPFIX field 158: This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the first observed packet of this Flow relative to the export time specified in the IPFIX Message Header.

public uint64 IPFIX_flowStartMicroseconds()

IPFIX field 154: The absolute timestamp of the first packet of this Flow.

public uint64 IPFIX_flowStartMilliseconds()

IPFIX field 152: The absolute timestamp of the first packet of this Flow.

public uint64 IPFIX_flowStartNanoseconds()

IPFIX field 156: The absolute timestamp of the first packet of this Flow.

public uint32 IPFIX_flowStartSeconds()

IPFIX field 150: The absolute timestamp of the first packet of this Flow.

public uint32 IPFIX_flowStartSysUpTime()

IPFIX field 22: The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime).

public uint8 IPFIX_fragmentFlags()

IPFIX field 197: Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively.

public uint32 IPFIX_fragmentIdentification()

IPFIX field 54: The value of the Identification field in the IPv4 packet header or in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header.

public uint16 IPFIX_fragmentOffset()

IPFIX field 88: The value of the IP fragment offset field in the IPv4 packet header or the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header.

public uint8 IPFIX_icmpCodeIPv4()

IPFIX field 177: Code of the IPv4 ICMP message.

public uint8 IPFIX_icmpCodeIPv6()

IPFIX field 179: Code of the IPv6 ICMP message.

public uint16 IPFIX_icmpTypeCodeIPv4()

IPFIX field 32: Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.

public uint16 IPFIX_icmpTypeCodeIPv6()

IPFIX field 139: Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.

public uint8 IPFIX_icmpTypeIPv4()

IPFIX field 176: Type of the IPv4 ICMP message.

public uint8 IPFIX_icmpTypeIPv6()

IPFIX field 178: Type of the IPv6 ICMP message.

public uint8 IPFIX_igmpType()

IPFIX field 33: The type field of the IGMP message.

public uint64 IPFIX_ignoredOctetTotalCount()

IPFIX field 165: The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process.

public uint64 IPFIX_ignoredPacketTotalCount()

IPFIX field 164: The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process.

public uint32 IPFIX_ingressInterface()

IPFIX field 10: The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863.

public uint8 IPFIX_ipClassOfService()

IPFIX field 5: For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header.

public uint8 IPFIX_ipDiffServCodePoint()

IPFIX field 195: The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field spans the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively.

This Information Element encodes only the 6 bits of the Differentiated Services field. Therefore, its value may range from 0 to 63.

public uint8 IPFIX_ipHeaderLength()

IPFIX field 189: The length of the IP header. For IPv6, the value of this Information Element is 40.

public uint32 IPFIX_ipNextHopIPv4Address()

IPFIX field 15: The IPv4 address of the next IPv4 hop.

public list<uint8>[16] IPFIX_ipNextHopIPv6Address()

IPFIX field 62: The IPv6 address of the next IPv6 hop.

public uint32 IPFIX_ipPayloadLength()

IPFIX field 204: The effective length of the IP payload.

For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by Information Element totalLengthIPv4) and the length of the IPv4 header (as reported by Information Element headerLengthIPv4).

For IPv6, the value of the Payload Length field in the IPv6 header is reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported.

public uint8 IPFIX_ipPrecedence()

IPFIX field 196: The value of the IP Precedence. The IP Precedence value is encoded in the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively.

This Information Element encodes only these 3 bits. Therefore, its value may range from 0 to 7.

public uint8 IPFIX_ipTTL()

IPFIX field 192: For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value of the Information Element matches the value of the Hop Limit field in the IPv6 packet header.

public uint64 IPFIX_ipTotalLength()

IPFIX field 224: The total length of the IP packet.

public uint8 IPFIX_ipVersion()

IPFIX field 60: The IP version field in the IP packet header.

public uint8 IPFIX_ipv4IHL()

IPFIX field 207: The value of the Internet Header Length (IHL) field in the IPv4 header. It specifies the length of the header in units of 4 octets. Please note that its unit is different from most of the other Information Elements reporting length values.

public uint32 IPFIX_ipv4Options()

IPFIX field 208: IPv4 options in packets of this Flow. The information is encoded in a set of bit fields. For each valid IPv4 option type, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv4 option type. Otherwise, if no observed packet of this Flow contained the respective IPv4 option type, the value of the corresponding bit is 0.

The list of valid IPv4 options is maintained by IANA. Note that for identifying an option not just the 5-bit Option Number, but all 8 bits of the Option Type need to match one of the IPv4 options specified at http://www.iana.org/assignments/ip-parameters.

Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. The mapping is illustrated by the figure below.

public uint32 IPFIX_ipv6ExtensionHeaders()

IPFIX field 64: IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 option header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contained the respective IPv6 extension header, the value of the corresponding bit is 0.

public uint8 IPFIX_isMulticast()

IPFIX field 206: If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero.

The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0.

The second and third bits of this octet are reserved for future use.

The remaining bits of the octet are only set to values other than zero if the IP Destination Address is a reserved IPv6 multicast address. Then the fourth bit of the octet is set to the value of the T flag in the IPv6 multicast address and the remaining four bits are set to the value of the scope field in the IPv6 multicast address.

public uint32 IPFIX_lineCardId()

IPFIX field 141: An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements.

public uint64 IPFIX_maximumIpTotalLength()

IPFIX field 26: Length of the largest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length.

public uint8 IPFIX_maximumTTL()

IPFIX field 53: Maximum TTL value observed for any packet in this Flow.

public uint32 IPFIX_meteringProcessId()

IPFIX field 143: An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Metering Process may be re-started with a different ID.

public uint64 IPFIX_minimumIpTotalLength()

IPFIX field 25: Length of the smallest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length.

public uint8 IPFIX_minimumTTL()

IPFIX field 52: Minimum TTL value observed for any packet in this Flow.

public uint32 IPFIX_mplsLabelStackDepth()

IPFIX field 202: The number of labels in the MPLS label stack.

public uint32 IPFIX_mplsLabelStackLength()

IPFIX field 201: The length of the MPLS label stack in units of octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection10()

IPFIX field 79: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection2()

IPFIX field 71: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection3()

IPFIX field 72: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection4()

IPFIX field 73: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection5()

IPFIX field 74: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection6()

IPFIX field 75: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection7()

IPFIX field 76: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection8()

IPFIX field 77: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public list<uint8>[3] IPFIX_mplsLabelStackSection9()

IPFIX field 78: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

public uint32 IPFIX_mplsPayloadLength()

IPFIX field 194: The size of the MPLS packet without the label stack.

public uint8 IPFIX_mplsTopLabelExp()

IPFIX field 203: The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed.

public uint32 IPFIX_mplsTopLabelIPv4Address()

IPFIX field 47: The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to.

public list<uint8>[16] IPFIX_mplsTopLabelIPv6Address()

IPFIX field 140: The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to.

public list<uint8>[3] IPFIX_mplsTopLabelStackSection()

IPFIX field 70: The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed.

The size of this Information Element is 3 octets.

public uint8 IPFIX_mplsTopLabelTTL()

IPFIX field 200: The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed.

public uint8 IPFIX_mplsTopLabelType()

IPFIX field 46: This field identifies the control protocol that allocated the top-of-stack label. Initial values for this field are listed below. Further values may be assigned by IANA in the MPLS label type registry.

public list<uint8> IPFIX_mplsVpnRouteDistinguisher()

IPFIX field 90: The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets.

public uint8 IPFIX_nextHeaderIPv6()

IPFIX field 193: The value of the Next Header field of the IPv6 header. The value identifies the type of the following IPv6 extension header or of the following IP payload. Valid values are defined in the IANA Protocol Numbers registry.

public uint64 IPFIX_notSentFlowTotalCount()

IPFIX field 166: The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.

public uint64 IPFIX_notSentOctetTotalCount()

IPFIX field 168: The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.

public uint64 IPFIX_notSentPacketTotalCount()

IPFIX field 167: The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.

public uint32 IPFIX_observationDomainId()

IPFIX field 149: An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device.

A value of 0 indicates that no specific Observation Domain is identified by this Information Element.

Typically, this Information Element is used for limiting the scope of other Information Elements.

public uint32 IPFIX_observationPointId()

IPFIX field 138: An identifier of an Observation Point that is unique per Observation Domain. It is RECOMMENDED that this identifier is also unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements.

public uint64 IPFIX_observedFlowTotalCount()

IPFIX field 163: The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point.

public uint64 IPFIX_octetDeltaCount()

IPFIX field 1: The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_octetDeltaSumOfSquares()

IPFIX field 198: The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_octetTotalCount()

IPFIX field 85: The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_octetTotalSumOfSquares()

IPFIX field 199: The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_packetDeltaCount()

IPFIX field 2: The number of incoming packets since the previous report (if any) for this Flow at the Observation Point.

public uint64 IPFIX_packetTotalCount()

IPFIX field 86: The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

public list<uint8> IPFIX_paddingOctets()

IPFIX field 210: The value of this Information Element is always a sequence of 0x00 values.

public uint16 IPFIX_payloadLengthIPv6()

IPFIX field 191: This Information Element reports the value of the Payload Length field in the IPv6 header. Note that IPv6 extension headers belong to the payload. Also note that in case of a jumbo payload option the value of the Payload Length field in the IPv6 header is zero and so will be the value reported by this Information Element.

public uint32 IPFIX_portId()

IPFIX field 142: An identifier of a line port that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements.

public list<uint8>[6] IPFIX_postDestinationMacAddress()

IPFIX field 57: The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint8 IPFIX_postIpClassOfService()

IPFIX field 55: The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint64 IPFIX_postMCastOctetDeltaCount()

IPFIX field 20: The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_postMCastOctetTotalCount()

IPFIX field 175: The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload.

public uint64 IPFIX_postMCastPacketDeltaCount()

IPFIX field 19: The number of outgoing multicast packets since the previous report (if any) sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means.

public uint64 IPFIX_postMCastPacketTotalCount()

IPFIX field 174: The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means.

public uint8 IPFIX_postMplsTopLabelExp()

IPFIX field 237: The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint64 IPFIX_postOctetDeltaCount()

IPFIX field 23: The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint64 IPFIX_postOctetTotalCount()

IPFIX field 171: The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint64 IPFIX_postPacketDeltaCount()

IPFIX field 24: The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint64 IPFIX_postPacketTotalCount()

IPFIX field 172: The definition of this Information Element is identical to the definition of Information Element 'packetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public list<uint8>[6] IPFIX_postSourceMacAddress()

IPFIX field 81: The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint16 IPFIX_postVlanId()

IPFIX field 59: The definition of this Information Element is identical to the definition of Information Element 'vlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

public uint8 IPFIX_protocolIdentifier()

IPFIX field 4: The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.

public uint32 IPFIX_sourceIPv4Address()

IPFIX field 8: The IPv4 source address in the IP packet header.

public uint32 IPFIX_sourceIPv4Prefix()

IPFIX field 44: IPv4 source address prefix.

public uint8 IPFIX_sourceIPv4PrefixLength()

IPFIX field 9: The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element.

public list<uint8>[16] IPFIX_sourceIPv6Address()

IPFIX field 27: The IPv6 source address in the IP packet header.

public list<uint8>[16] IPFIX_sourceIPv6Prefix()

IPFIX field 170: IPv6 source address prefix.

public uint8 IPFIX_sourceIPv6PrefixLength()

IPFIX field 29: The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element.

public list<uint8>[6] IPFIX_sourceMacAddress()

IPFIX field 56: The IEEE 802 source MAC address field.

public uint16 IPFIX_sourceTransportPort()

IPFIX field 7: The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.

public list<uint8> IPFIX_standardFieldAsByteList(int32)

This function returns the value of the specified IPFIX 'standard' field as a list of bytes, if it is present in the 'data flow' record, or zero if absent.

public uint64 IPFIX_standardFieldAsInteger(int32)

This function returns the value of the specified IPFIX 'standard' field as an integer, if it is present in the 'data flow' record, or zero if absent.

public rstring IPFIX_standardFieldAsString(int32)

This function returns the value of the specified IPFIX 'standard' field as a string, if it is present in the 'data flow' record, or zero if absent.

public uint64 IPFIX_systemInitTimeMilliseconds()

IPFIX field 160: The absolute timestamp of the last (re-)initialization of the IPFIX Device.

public uint64 IPFIX_tcpAckTotalCount()

IPFIX field 222: The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set.

public uint32 IPFIX_tcpAcknowledgementNumber()

IPFIX field 185: The acknowledgement number in the TCP header.

public uint16 IPFIX_tcpControlBits()

IPFIX field 6: TCP control bits observed for packets of this Flow. The information is encoded in a set of bit fields. For each TCP control bit, there is a bit in this set. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. A value of 0 for a bit indicates that the corresponding bit was not set in any of the observed packets of this Flow.

public uint16 IPFIX_tcpDestinationPort()

IPFIX field 183: The destination port identifier in the TCP header.

public uint64 IPFIX_tcpFinTotalCount()

IPFIX field 219: The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set.

public uint8 IPFIX_tcpHeaderLength()

IPFIX field 188: The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the TCP header. The Data Offset field indicates the length of the TCP header in units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets.

public uint64 IPFIX_tcpOptions()

IPFIX field 209: TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0.

Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. TCP option numbers are maintained by IANA.

public uint64 IPFIX_tcpPshTotalCount()

IPFIX field 221: The total number of packets of this Flow with TCP "Push Function" (PSH) flag set.

public uint64 IPFIX_tcpRstTotalCount()

IPFIX field 220: The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set.

public uint32 IPFIX_tcpSequenceNumber()

IPFIX field 184: The sequence number in the TCP header.

public uint16 IPFIX_tcpSourcePort()

IPFIX field 182: The source port identifier in the TCP header.

public uint64 IPFIX_tcpSynTotalCount()

IPFIX field 218: The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set.

public uint64 IPFIX_tcpUrgTotalCount()

IPFIX field 223: The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set.

public uint16 IPFIX_tcpUrgentPointer()

IPFIX field 187: The urgent pointer in the TCP header.

public uint16 IPFIX_tcpWindowScale()

IPFIX field 238: The scale of the window field in the TCP header.

public uint16 IPFIX_tcpWindowSize()

IPFIX field 186: The window field in the TCP header. If the TCP window scale is supported, then TCP window scale must be known to fully interpret the value of this information.

public uint16 IPFIX_templateId()

IPFIX field 145: An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain.

Template IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created. Template IDs of Data Sets are numbered from 256 to 65535.

Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned.

public uint16 IPFIX_totalLengthIPv4()

IPFIX field 190: The total length of the IPv4 packet.

public uint16 IPFIX_udpDestinationPort()

IPFIX field 181: The destination port identifier in the UDP header.

public uint16 IPFIX_udpMessageLength()

IPFIX field 205: The value of the Length field in the UDP header.

public uint16 IPFIX_udpSourcePort()

IPFIX field 180: The source port identifier in the UDP header.

public uint16 IPFIX_vlanId()

IPFIX field 58: The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet.

public uint8 IPFIX_wlanChannelId()

IPFIX field 146: The identifier of the 802.11 (Wi-Fi) channel used.

public rstring IPFIX_wlanSSID()

IPFIX field 147: The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used. According to IEEE.802-11.1999, the SSID is encoded into a string of up to 32 characters.

public rstring NETFLOW_APPLICATION_DESCRIPTION()

This parser result function returns the application description. For Netflow version 9, this is field 94.

public rstring NETFLOW_APPLICATION_NAME()

This parser result function returns the name associated with a classification. For Netflow version 9, this is field 96.

public list<uint8> NETFLOW_APPLICATION_TAG()

This parser result function returns 8 bits of engine ID, followed by n bits of classification. For Netflow version 9, this is field 95.

public uint32 NETFLOW_BGP_IPV4_NEXT_HOP()

This parser result function returns the IP version 4 address of the next router in the BGP domain. For Netflow version 9, this is field 18.

public list<uint8>[16] NETFLOW_BPG_IPV6_NEXT_HOP()

This parser result function returns the next router in the BGP domain. For Netflow version 9, this is field 63.

public uint16 NETFLOW_COUNT()

This parser result function returns the number of Netflow records in the current message, including templates, options, and flows.

public uint8 NETFLOW_DIRECTION()

This parser result function returns the direction of the flow, '0' for ingress, '1' for egress. For Netflow version 9, this is field 61.

public uint32 NETFLOW_DST_AS()

This parser result function returns the BGP autonomous system number of the destination endpoint of the current flow. For Netflow version 5, this is the dst_as field. For Netflow version 9, this is field 17.

public uint8 NETFLOW_DST_MASK()

This parser result function returns the number of significant bits in the IP version 4 address of the destination endpoint of the current flow record, if available, or zero if not. For Netflow version 5, this is the dst_mask field. For Netflow version 9, this is field 13.

public uint16 NETFLOW_DST_PORT()

This parser result function returns the TCP or UDP port number of the destination endpoint of the current flow record, if available, or zero if not. For Netflow version 5, this is the dstport field. For Netflow version 9, this is field 11.

public uint8 NETFLOW_DST_TOS()

This parser result function returns the 'type of service' byte setting for the flow when exiting the outgoing interface. For Netflow version 9, this is field 55.

public uint32 NETFLOW_DST_TRAFFIC_INDEX()

This parser result function returns BGP policy accounting destination traffic index. For Netflow version 9, this is field 93.

public uint16 NETFLOW_DST_VLAN()

This parser result function returns the virtual LAN identifier associated with the egress interface. For Netflow version 9, this is field 59.

public uint8 NETFLOW_ENGINE_ID()

This parser result function returns the identifier of the switching engine in the router. For Netflow version 9, this is field 39.

public uint8 NETFLOW_ENGINE_TYPE()

This parser result function returns the type code of the switching engine in the router. For Netflow version 9, this is field 38.

public list<uint8> NETFLOW_FIELD_AS_BYTE_LIST(int32)

This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as list of unsigned bytes, or an empty list if not.

public uint64 NETFLOW_FIELD_AS_INTEGER(int32)

This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as an unsigned integer, or zero if not.

public rstring NETFLOW_FIELD_AS_STRING(int32)

This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as a string, or an empty string if not.

public uint32 NETFLOW_FIRST_SWITCHED()

This parser result function returns the value of NETFLOW_SYSTEM_UPTIME() for the first packet of the current flow, that is, the time that the first packet in this flow passed through the router, relative to when the router was booted, in milliseconds. For Netflow version 5, this is the first field. For Netflow version 9, this is field 22.

public uint64 NETFLOW_FLOWS()

This parser result function returns the number of flows that were aggregated for the current flow record, if available, or zero if not. For Netflow version 9, this is field 3.

public uint16 NETFLOW_FLOW_ACTIVE_TIMEOUT()

This parser result function returns the timeout value, in seconds, for active flow entries in the Netflow cache. For Netflow version 9, this is field 36.

public uint16 NETFLOW_FLOW_INACTIVE_TIMEOUT()

This parser result function returns the timeout value, in seconds, for inactive flow entries in the Netflow cache. For Netflow version 9, this is field 37.

public uint8 NETFLOW_FLOW_SAMPLER_ID()

This parser result function returns the identifier shown in "show flow-sampler". For Netflow version 9, this is field 48.

public uint8 NETFLOW_FLOW_SAMPLER_MODE()

This parser result function returns the sampling mode, when Netflow is sampled, For Netflow version 9, this is field 49.

public uint32 NETFLOW_FLOW_SAMPLER_RANDOM_INTERVAL()

This parser result function returns the packet sampling interval, when Netflow is sampled. For Netflow version 9, this is field 50.

public uint8 NETFLOW_FORWARDING_STATUS()

This parser result function returns the forwarding status, with the 2 left bits giving the status and the 6 remaining bits giving the reason code. For Netflow version 9, this is field 89.

public uint16 NETFLOW_FRAGMENT_OFFSET()

This parser result function returns the fragment offset value from fragmented IP packets. For Netflow version 9, this is field 88.

public uint16 NETFLOW_ICMP_TYPE()

This parser result function returns the ICMP packet type. For Netflow version 9, this is field 32.

public rstring NETFLOW_IF_DESC()

This parser result function returns the router's interface description. For Netflow version 9, this is field 83.

public rstring NETFLOW_IF_NAME()

This parser result function returns the router's interface name. For Netflow version 9, this is field 82.

public uint32 NETFLOW_INPUT_INTERFACE()

This parser result function returns the interface index where the current flow entered the router, if available, or zero if not. For Netflow version 5, this is the input field. For Netflow version 9, this is field 10.

public uint64 NETFLOW_IN_BYTES()

This parser result function returns the number of bytes that entered the router for the current flow record, if available, or zero if not. For Netflow version 5, this is the dOctets field. For Netflow version 9, this is field 1.

public uint64 NETFLOW_IN_PERMANENT_BYTES()

This parser result function returns the running byte counter for a permanent flow. For Netflow version 9, this is field 85.

public uint64 NETFLOW_IN_PERMANENT_PKTS()

This parser result function returns the running packet counter for a permanent flow. For Netflow version 9, this is field 86.

public uint64 NETFLOW_IN_PKTS()

This parser result function returns the number of packets that entered the router for the current flow record, if available, or zero if not. For Netflow version 5, this is the dPkts field. For Netflow version 9, this is field 2.

public uint32 NETFLOW_IPV4_DST_ADDR()

This parser result function returns the IP version 4 address of the destination endpoint of the current flow record, if available, or zero if not. For Netflow version 5, this is the dstaddr field. For Netflow version 9, this is field 12.

public uint32 NETFLOW_IPV4_DST_PREFIX()

This parser result function returns the IP version 4 destination address prefix (specific for Cisco Catalyst architecture). For Netflow version 9, this is field 45.

public uint16 NETFLOW_IPV4_IDENT()

This parser result function returns The IP version 4 identification field of the flow. For Netflow version 9, this is field 54.

public uint32 NETFLOW_IPV4_NEXT_HOP()

This parser result function returns the IP version 4 address of the next router towards the destination endpoint of the current flow. For Netflow version 5, this is the nexthop field. For Netflow version 9, this is field 15.

public uint32 NETFLOW_IPV4_SRC_ADDR()

This parser result function returns the IP version 4 address of the source endpoint of the current flow record, if available, or zero if not. For Netflow version 5, this is the srcaddr field. For Netflow version 9, this is field 8.

public uint32 NETFLOW_IPV4_SRC_PREFIX()

This parser result function returns the IP version 4 source address prefix (specific for Cisco Catalyst architecture). For Netflow version 9, this is field 44.

public list<uint8>[16] NETFLOW_IPV6_DST_ADDR()

This parser result function returns the IP version 6 address of the destination endpoint of the current flow record, if available, or an empty list if not. For Netflow version 9, this is field 28.

public uint8 NETFLOW_IPV6_DST_MASK()

This parser result function returns the number of significant bits in the IP version 6 address of the source endpoint of the current flow record, if available, or zero if not. For Netflow version 9, this is field 30.

public uint32 NETFLOW_IPV6_FLOW_LABEL()

This parser result function returns the IP version 6 flow label. For Netflow version 9, this is field 31.

public list<uint8>[16] NETFLOW_IPV6_NEXT_HOP()

This parser result function returns the IP version 6 address of the next-hop router. For Netflow version 9, this is field 62.

public uint32 NETFLOW_IPV6_OPTION_HEADERS()

This parser result function returns the IP version 6 option headers found in the flow. For Netflow version 9, this is field 64.

public list<uint8>[16] NETFLOW_IPV6_SRC_ADDR()

This parser result function returns the IP version 6 address of the source endpoint of the current flow record, if available, or an empty list if not. For Netflow version 9, this is field 27.

public uint8 NETFLOW_IPV6_SRC_MASK()

public uint8 NETFLOW_IP_PROTOCOL_VERSION()

This parser result function returns the IP version for the flow, either '4' or '6'. For Netflow version 9, this is field 60.

public uint32 NETFLOW_LAST_SWITCHED()

This parser result function returns the value of NETFLOW_SYSTEM_UPTIME() for the last packet of the current flow, that is, the time that the last packet in this flow passed through the router, relative to when the router was booted, in milliseconds. For Netflow version 5, this is the last field. For Netflow version 9, this is field 21.

public list<uint8>[6] NETFLOW_MAC_DST_ADDR_IN()

This parser result function returns the incoming destination MAC address. For Netflow version 9, this is field 80.

public list<uint8>[6] NETFLOW_MAC_DST_ADDR_OUT()

This parser result function returns the incoming destination MAC address for the flow. For Netflow version 9, this is field 56.

public list<uint8>[6] NETFLOW_MAC_SRC_ADDR_IN()

This parser result function returns the incoming source MAC address for the flow. For Netflow version 9, this is field 56.

public list<uint8>[6] NETFLOW_MAC_SRC_ADDR_OUT()

This parser result function returns the outgoing source MAC address. For Netflow version 9, this is field 81.

public uint16 NETFLOW_MAX_PKT_LNGTH()

This parser result function returns the maximum packet length for the current flow. For Netflow version 9, this is field 26.

public uint8 NETFLOW_MAX_TTL()

This parser result function returns the maximum 'time to live' for incoming packets of the flow. For Netflow version 9, this is field 53.

public uint16 NETFLOW_MIN_PKT_LNGTH()

This parser result function returns the minimum packet length for the current flow. For Netflow version 9, this is field 25.

public uint8 NETFLOW_MIN_TTL()

This parser result function returns the minimum 'time to live' for incoming packets of the flow. For Netflow version 9, this is field 52.

public list<uint8> NETFLOW_MPLS_LABEL(int32)

This parser result function returns the MPLS label at the specified position in the stack, where the position is specified with an argument between 1 and 10. This comprises 20 bits of MPLS label, 3 experimental bits and 1 end-of-stack bit. For Netflow version 9, these are fields 71 through 79.

public list<uint8> NETFLOW_MPLS_PAL_RD()

This parser result function returns the MPLS PAL Route Distinguisher. For Netflow version 9, this is field 90.

public uint8 NETFLOW_MPLS_PREFIX_LEN()

This parser result function returns the number of consecutive bits in the MPLS prefix length. For Netflow version 9, this is field 91.

public uint32 NETFLOW_MPLS_TOP_LABEL_IPV4_ADDR()

This parser result function returns the Forwarding Equivalent Class corresponding to the MPLS Top Label. For Netflow version 9, this is field 47.

public uint8 NETFLOW_MPLS_TOP_LABEL_TYPE()

This parser result function returns the MPLS top label type, '0' for UNKNOWN, '1' for TE-MIDPT, '2' for ATOM, '3' for VPN '4' for BGP, '5' for LDP. For Netflow version 9, this is field 46.

public uint64 NETFLOW_MUL_DST_BYTES()

This parser result function returns the number of outgoing multicast bytes in the current flow. For Netflow version 9, this is field 20.

public uint64 NETFLOW_MUL_DST_PKTS()

This parser result function returns the number of outgoing multicast packets in the current flow. For Netflow version 9, this is field 19.

public uint8 NETFLOW_MUL_IGMP_TYPE()

This parser result function returns the IGMP packet type. For Netflow version 9, this is field 33.

public uint32 NETFLOW_OUTPUT_INTERFACE()

This parser result function returns the interface index where the current flow left the router, if available, or zero if not. For Netflow version 5, this is the output field. For Netflow version 9, this is field 14.

public uint64 NETFLOW_OUT_BYTES()

This parser result function returns the number of bytes that left the router for the current flow. For Netflow version 9, this is field 23.

public uint64 NETFLOW_OUT_PKTS()

This parser result function returns the number of packets that left the router for the current flow. For Netflow version 9, this is field 24.

public uint8 NETFLOW_POST_IP_DSCP()

This parser result function returns the value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services Field, after modification. For Netflow version 9, this is field 98.

public uint8 NETFLOW_PROTOCOL()

This parser result function returns the IP protocol number for the current flow record, if available, for example, '17' for UDP, or '6' for TCP, or zero if not. For Netflow version 5, this is the prot field. For Netflow version 9, this is field 4.

public uint32 NETFLOW_REPLICATION_FACTOR()

This parser result function returns the multicast replication factor. For Netflow version 9, this is field 99.

public rstring NETFLOW_SAMPLER_NAME()

This parser result function returns the name of the flow sampler, when Netflow is sampled. For Netflow version 9, this is field 84.

public uint8 NETFLOW_SAMPLING_ALGORITHM()

This parser result function returns the sampling algorithm, when Netflow is sampled, with '1' for deterministic sampling, and '2' for random sampling. For Netflow version 9, this is field 35.

public uint32 NETFLOW_SAMPLING_INTERVAL()

This parser result function returns the sampling rate, when Netflow is sampled, for example, a value of 100 indicates that one of every 100 packets is sampled. For Netflow version 9, this is field 34.

public uint32 NETFLOW_SEQUENCE_NUMBER()

This parser result function returns the sequence number assigned to the current message by the router.

public uint32 NETFLOW_SOURCE_ID()

This parser result function returns the port identifier of the router.

public uint32 NETFLOW_SRC_AS()

This parser result function returns the BGP autonomous system number of the source endpoint of the current flow. For Netflow version 5, this is the src_as field. For Netflow version 9, this is field 16.

public uint8 NETFLOW_SRC_MASK()

This parser result function returns the number of significant bits in the IP version 4 address of the source endpoint of the current flow record, if available, or zero if not. For Netflow version 5, this is the src_mask field. For Netflow version 9, this is field 9.

public uint16 NETFLOW_SRC_PORT()

This parser result function returns the TCP or UDP port number of the source endpoint of the current flow record, if available, or zero if not. For Netflow version 5, this is the srcport field. For Netflow version 9, this is field 7.

public uint8 NETFLOW_SRC_TOS()

This parser result function returns the IP 'type of service' byte for the current flow record on entering the router, if available, or zero if not. For Netflow version 5, this is the tos field. For Netflow version 9, this is field 5.

public uint32 NETFLOW_SRC_TRAFFIC_INDEX()

This parser result function returns BGP policy accounting source traffic index. For Netflow version 9, this is field 92.

public uint16 NETFLOW_SRC_VLAN()

This parser result function returns the virtual LAN identifier associated with the ingress interface. For Netflow version 9, this is field 58.

public uint32 NETFLOW_SYSTEM_UPTIME()

This parser result function returns the elapsed time from when the router started until the current message was sent, in milliseconds.

public uint8 NETFLOW_TCP_FLAGS()

This parser result function returns the cumulative value of all TCP flags in the current flow record, that is, the logical 'or' of the TCP flags in all packets in the flow, if available, or zero if not. For Netflow version 5, this is the tcp_flags field. For Netflow version 9, this is field 6.

public uint64 NETFLOW_TOTAL_BYTES_EXP()

This parser result function returns the number of bytes exported by the Observation Domain. For Netflow version 9, this is field 40.

public uint64 NETFLOW_TOTAL_FLOWS_EXP()

This parser result function returns the number of flows exported by the Observation Domain. For Netflow version 9, this is field 42.

public uint64 NETFLOW_TOTAL_PKTS_EXP()

This parser result function returns the number of packets exported by the Observation Domain. For Netflow version 9, this is field 41.

public uint32 NETFLOW_UNIX_NANOSECONDS()

This parser result function returns the fractional part of NETFLOW_UNIX_SECONDS(), in nanoseconds, for Netflow version 5 messages only.

public uint32 NETFLOW_UNIX_SECONDS()

This parser result function returns the time that the current message was sent, in seconds, according to the router's clock, relative to the beginning of the Unix epoch (at midnight on the first of January in Greenwich, England).

public uint16 NETFLOW_VERSION()

This parser result function returns the Netflow version of the current message, either '5' or '9'.

public uint64 messagesProcessed()

This parser result function returns the number of messages processed by the operator since it started, including the current message.

public boolean parseError()

This parser result function returns true if an encoding error was detected while decoding the current packet, or false otherwise. Note that a value of false does not necessarily mean the packet has no encoding errors, since the operator only decodes the fields needed.

public int32 parseErrorCode()

This parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found. The error codes are:

102 for 'label overruns packet': The length of an uncompressed domain name label extends beyond the end of the DNS message. The packet containing the DNS message may have been truncated.
103 for 'label compression length overruns packet': The length field of a compressed domain name label extends beyond the end of the DNS message. The packet containing the DNS message may have been truncated.
104 for 'label compression offset underruns packet': The offset of a compressed domain name label points before the beginning of the DNS message. The sender misencoded the domain name.
105 for 'label compression offset forward reference': The offset of a compressed domain name label points beyond the current label. The sender misencoded the domain name.
106 for 'label compression offset loop': The offset of a compressed domain name label points to itself. The sender misencoded the domain name.
107 for 'label flags invalid': The flag field of a compressed domain name label is invalid. The sender misencoded the domain name.
108 for 'label limit exceeded': A compressed domain name contains too many labels. The sender misencoded the domain name.
110 for 'resource record missing': The DNS message contains fewer resource records than the 'count' fields in the message header indicate. The DNS message may have been truncated.
111 for 'question resource record truncated': The DNS 'question' resource record was truncated. The packet containing the message was probably truncated.
112 for 'resource record truncated': A DNS resource record was truncated. The packet containing the DNS message was probably truncated.
113 for 'resource record data truncated': The 'rdata' field of a DNS resource record was truncated. The packet containing the DNS message was probably truncated.
114 for 'invalid address family': The 'class' field of a DNS resource record was neither 'AF_INET' nor 'AF_INET6' (meaning IP version 4 or IP version 6, respectively).
116 for 'message too short': The DNS message is shorter than the length of the DNS header. The packet probably does not contain a DNS message.
117 for 'resource record counts too large': A 'count' field in the DNS message header is larger than the maximum supported. The packet probably does not contain a DNS message.
118 for 'text string overruns resource record': The text string length in a DNS 'TXT' resource record is larger than the record's data field. The sender misencoded the resource record.
119 for 'missing data in resource record': The data field of a resource record is too short; some fields may be truncated or missing entirely. The sender misencoded the resource record.
120 for 'extra data in resource record': The data field of a resource record is too long; there is unexpected data following the last field. The sender misencoded the resource record.
121 for 'label compression offset invalid': The offset of a compressed domain name label does not point to a previous label. The sender misencoded the domain name.
122 for 'extra data following resource records': There are extra bytes of data in the DNS message following the last resource record. The sender probably miscalculated the packet length.
123 for 'resource record data too long': The 'data length' field of a resource record is unreasonably large. The packet probably does not contain a DNS message.

Note: RFC 1035 explains the format of DNS messages; in particular, section 4.1.4 explains the format of compressed domain names in DNS messages.

public rstring parseErrorDescription()

This parser result function returns a description of an encoding error found while decoding the current packet, or an empty string if no enoding errors were found.

public uint32 parseErrorOffset()

This parser result function returns the offset from the beginning of the message to the encoding error found, or zero if no encoding errors were found.