Namespace com.teracloud.streams.network.parse

Operators

  • DHCPMessageParser: DHCPMessageParser is an operator for the Streams product that parses individual fields of DHCP messages received in input tuples, and emits tuples containing message data.
  • DNSMessageParser: DNSMessageParser is an operator for the Streams product that parses individual fields of DNS messages received in input tuples, and emits tuples containing message data.
  • IPFIXMessageParser: IPFIXMessageParser is an operator for the Streams product that parses individual fields of IPFIX messages received in input tuples, and emits tuples containing message data.
  • NetflowMessageParser: NetflowMessageParser is an operator for the Streams product that parses individual fields of Netflow messages received in input tuples, and emits tuples containing message data.

Functions

  • DHCP_ADDRESS_LEASE_TIME(): This parser result function returns the duration of the address lease, in seconds, if DHCP option 51 is included in the message, or zero if not.
  • DHCP_ALL_SUBNETS_LOCAL(): This parser result function returns true if all subnets use the same MTU size, if DHCP option 27 is included in the message, or false if not.
  • DHCP_ARP_CACHE_TIMEOUT(): This parser result function returns the timeout for ARP cache entries, in seconds, if DHCP option 35 is included in the message, or zero if not.
  • DHCP_BOOTFILE_NAME(): This parser result function returns the pathname of a boot file the client can use, if there is one, or an empty string otherwise.
  • DHCP_BOOT_FILE_SIZE(): This parser result function returns the size of boot file in 512 byte blocks, if DHCP option 13 is included in the message, or zero if not.
  • DHCP_BROADCAST_ADDRESS(): This parser result function returns the IP version 4 address to use when broadcasting on subnet, if DHCP option 28 is included in the message, or zero if not.
  • DHCP_CLIENT_ADDRESS(): This parser result function returns the DHCP client's IP version 4 address when it requests renewal of its lease.
  • DHCP_CLIENT_HARDWARE_ADDRESS(): This parser result function returns the DHCP client's network hardware address, for example, the MAC address of its ethernet adapter.
  • DHCP_CLIENT_HARDWARE_TYPE(): This parser result function returns the client's hardware address type, for example, '1' for ethernet.
  • DHCP_CLIENT_IDENTIFIER(): This parser result function returns client-specific information, if DHCP option 61 is included in the message, or an empty list if not.
  • DHCP_COOKIE_SERVERS(): This parser result function returns a list of cookie servers, represented as IP version 4 addresses, if DHCP option 8 is included in the message, or an empty list if not.
  • DHCP_DNS_SERVERS(): This parser result function returns a list of DNS servers, represented as IP version 4 addresses, if DHCP option 6 is included in the message, or an empty list if not.
  • DHCP_DOMAIN_NAME(): This parser result function returns the domain name the client should use with DNS, if DHCP option 15 is included in the message, or an empty string if not.
  • DHCP_ERROR_MESSAGE(): This parser result function returns an error message from server, if request failed, if DHCP option 56 is included in the message.
  • DHCP_ETHERNET_ENCAPSULATION(): This parser result function returns true when the client should use ethernet encapsulation, if DHCP option 36 is included in the message, or false if not.
  • DHCP_EXTENSIONS_PATH(): This parser result function returns BOOTP extensions, if DHCP option 18 is included in the message, or an empty string if not.
  • DHCP_FINGER_SERVERS(): This parser result function returns a list of Finger servers, represented as IP version 4 addresses, if DHCP option 73 is included in the message, or an empty list if not.
  • DHCP_FLAGS(): This parser result function returns the DHCP broadcast flag.
  • DHCP_HOP_COUNT(): This parser result function returns the number of relay agents separating the DHCP client and server.
  • DHCP_HOST_NAME(): This parser result function returns the hostname of the client, if DHCP option 12 is included in the message, or an empty string if not.
  • DHCP_IMPRESS_SERVERS(): This parser result function returns a list of Impress servers, represented as IP version 4 addresses, if DHCP option 10 is included in the message, or an empty list if not.
  • DHCP_INTERFACE_MTU(): This parser result function returns the MTU size to use on this interface, if DHCP option 26 is included in the message, or zero if not.
  • DHCP_IP_DEFAULT_TTL(): This parser result function returns the default IP time-to-live for outgoing packets, if DHCP option 23 is included in the message, or zero if not.
  • DHCP_IP_FORWARDING(): This parser result function returns true if the client should forward IP packets, if DHCP option 19 is included in the message, or false if not.
  • DHCP_IRC_SERVERS(): This parser result function returns a list of IRC servers, represented as IP version 4 addresses, if DHCP option 74 is included in the message, or an empty list if not.
  • DHCP_LOG_SERVERS(): This parser result function returns a list of log servers, represented as IP version 4 addresses, if DHCP option 7 is included in the message, or an empty list if not.
  • DHCP_LPR_SERVERS(): This parser result function returns a list of print servers, represented as IP version 4 addresses, if DHCP option 9 is included in the message, or an empty list if not.
  • DHCP_MASK_SUPPLIER(): This parser result function returns true when client should respond to subnet mask discovery, if DHCP option 30 is included in the message, or false if not.
  • DHCP_MAXIMUM_MESSAGE_SIZE(): This parser result function returns the maximum size of DHCP message, if DHCP option 57 is included in the message, or zero if not.
  • DHCP_MAXIMUM_REASSEMBLY_SIZE(): This parser result function returns the maximum size of reassembled packets, if DHCP option 22 is included in the message, or zero if not.
  • DHCP_MERIT_DUMP_FILE(): This parser result function returns the pathname of a file for client's core dump image, if DHCP option 14 is included in the message, or an empty string if not.
  • DHCP_MESSAGE_TYPE(): This parser result function returns the type of this DHCP message, if DHCP option 53 is included in the message, or zero if not, for example:
  • DHCP_MOBILE_IP_HOME_AGENTS(): This parser result function returns a list of mobile IP home agents, represented as IP version 4 addresses, if DHCP option 68 is included in the message, or an empty list if not.
  • DHCP_MTU_AGING_TIMEOUT(): This parser result function returns the time to use when aging path MTU values, in seconds, if DHCP option 24 is included in the message, or zero if not.
  • DHCP_MTU_PLATEAU_TABLE(): This parser result function returns a list of MTU sizes for path discovery, if DHCP option 25 is included in the message, or an empty list if not.
  • DHCP_NAME_SERVERS(): This parser result function returns a list of name servers (not DNS servers, see next option), represented as IP version 4 addresses, if DHCP option 5 is included in the message, or an empty list if not.
  • DHCP_NETBIOS_NAME_SERVERS(): This parser result function returns a list of NetBIOS-over-TCP name servers, represented as IP version 4 addresses, if DHCP option 44 is included in the message, or an empty list if not.
  • DHCP_NETBIOS_NBDD_SERVERS(): This parser result function returns a list of NetBIOS-over-TCP NBDD servers, represented as IP version 4 addresses, if DHCP option 45 is included in the message, or an empty list if not.
  • DHCP_NETBIOS_NODE_TYPE(): This parser result function returns the type of NetBIOS-over-TCP node, if DHCP option 46 is included in the message, or zero if not.
  • DHCP_NETBIOS_SCOPE(): This parser result function returns the client's NetBIOS-over-TCP scope parameter, if DHCP option 47 is included in the message, or an empty string if not.
  • DHCP_NISPLUS_DOMAIN(): This parser result function returns the name of the client's NIS+ domain, if DHCP option 64 is included in the message.
  • DHCP_NISPLUS_SERVERS(): This parser result function returns a list of NIS+ servers, represented as IP version 4 addresses, if DHCP option 65 is included in the message, or an empty list if not.
  • DHCP_NIS_DOMAIN(): This parser result function returns the name of the client's NIS domain, if DHCP option 40 is included in the message, or an empty string if not.
  • DHCP_NIS_SERVERS(): This parser result function returns a list of NIS servers, represented as IP version 4 addresses, if DHCP option 41 is included in the message, or an empty list if not.
  • DHCP_NNTP_SERVERS(): This parser result function returns a list of NNTP servers, represented as IP version 4 addresses, if DHCP option 71 is included in the message, or an empty list if not.
  • DHCP_NONLOCAL_SOURCE_FILTERS(): This parser result function returns a list of IP version 4 address/mask pairs for filtering source packets, if DHCP option 21 is included in the message, or an empty list if not.
  • DHCP_NONLOCAL_SOURCE_ROUTING(): This parser result function returns true if the client should forward IP packets with non-local source routing, if DHCP option 20 is included in the message, or false if not.
  • DHCP_NTP_SERVERS(): This parser result function returns a list of NTP servers, represented as IP version 4 addresses, if DHCP option 42 is included in the message, or an empty list if not.
  • DHCP_OPCODE(): This parser result function returns the DHCP message type ('1' for request, '2' for reply).
  • DHCP_OPTION_OVERLOAD_FLAGS(): This parser result function returns flags indicating whether the sname and file fields in the DHCP message header contain the server's host name and client's boot file name, or additional DHCP options, if DHCP option 52 is included in the message, or zero if not.
  • DHCP_PARAMETER_REQUESTS(): This parser result function returns a list of requested DHCP parameters, expressed as option codes, if DHCP option 55 is included in the message, or an empty list if not.
  • DHCP_PERFORM_MASK_DISCOVERY(): This parser result function returns true when client should perform subnet mask discovery, if DHCP option 29 is included in the message, or false if not.
  • DHCP_PERFORM_ROUTER_DISCOVERY(): This parser result function returns true when the client should solicit routers, if DHCP option 31 is included in the message, or false if not.
  • DHCP_POP3_SERVERS(): This parser result function returns a list of POP3 servers, represented as IP version 4 addresses, if DHCP option 70 is included in the message, or an empty list if not.
  • DHCP_REBINDING_TIME(): This parser result function returns the time from address lease to rebinding, in seconds, if DHCP option 59 is included in the message, or zero if not.
  • DHCP_RELAY_AGENT(): This parser result function returns the IP version 4 address of the relay agent between the DHCP client and server, if there is one, or zero otherwise.
  • DHCP_RENEWAL_TIME(): This parser result function returns then time from address lease to renewal, in seconds, if DHCP option 58 is included in the message, or zero if not.
  • DHCP_REQUESTED_ADDRESS(): This parser result function returns the client's requested address, as an IP version 4 address, if DHCP option 50 is included in the message, or zero if not.
  • DHCP_RESOURCE_SERVERS(): This parser result function returns a list of resource location servers, represented as IP version 4 addresses, if DHCP option 11 is included in the message, or an empty list if not.
  • DHCP_ROOT_PATH(): This parser result function returns the pathname of the client's root disk (for diskless workstations), if DHCP option 17 is included in the message, or an empty string if not.
  • DHCP_ROUTERS(): This parser result function returns a list of routers on client's subnet, represented as IP version 4 addresses, if DHCP option 3 is included in the message, or an empty list if not.
  • DHCP_ROUTER_SOLICITATION_ADDRESS(): This parser result function returns the IP version 4 address to which router solicitations should be sent, if DHCP option 32 is included in the message, or zero if not.
  • DHCP_SECONDS(): This parser result function returns the elased time, in seconds, between the request and the response.
  • DHCP_SERVER_ADDRESS(): This parser result function returns the IP version 4 address of DHCP server, if DHCP option 54 is included in the message, or zero if not.
  • DHCP_SERVER_HOSTNAME(): This parser result function returns the name of the DHCP server, if it has one, or an empty string otherwise.
  • DHCP_SERVER_NEXT(): This parser result function returns the IP version 4 address of the next DHCP server to use.
  • DHCP_SMTP_SERVERS(): This parser result function returns a list of SMTP servers, represented as IP version 4 addresses, if DHCP option 69 is included in the message, or an empty list if not.
  • DHCP_STATIC_ROUTES(): This parser result function returns a list of IP version 4 address pairs for the client's static routing table, if DHCP option 33 is included in the message, or an empty list if not.
  • DHCP_STDA_SERVERS(): This parser result function returns a list of StreetTalk Directory Assistance servers, represented as IP version 4 addresses, if DHCP option 76 is included in the message, or an empty list if not.
  • DHCP_STREETTALK_SERVERS(): This parser result function returns a list of StreetTalk servers, represented as IP version 4 addresses, if DHCP option 75 is included in the message, or an empty list if not.
  • DHCP_SUBNET_MASK(): This parser result function returns the mask of the client's subnet, represented as an IP version 4 address, if DHCP option 1 is included in the message, or zero if not.
  • DHCP_SWAP_SERVER(): This parser result function returns the IP version 4 address of the client's swap server, if DHCP option 16 is included in the message.
  • DHCP_TCP_DEFUALT_TTL(): This parser result function returns the default TCP time-to-live for outgoing segments, if DHCP option 37 is included in the message, or zero if not.
  • DHCP_TCP_KEEPALIVE_GARBAGE(): This parser result function returns true when the client should send a byte of garbage with TCP keepalive messages, if DHCP option 39 is included in the message, or false if not.
  • DHCP_TCP_KEEPALIVE_INTERVAL(): This parser result function returns the time the client should wait before sending TCP keepalive messages, in seconds, if DHCP option 38 is included in the message, or zero if not.
  • DHCP_TIME_OFFSET(): This parser result function returns the time offset of the client's subnet, relative to GMT/UTC, in seconds, if DHCP option 2 is included in the message, or zero if not.
  • DHCP_TIME_SERVERS(): This parser result function returns a list of time servers, represented as IP version 4 addresses, if DHCP option 4 is included in the message, or an empty list if not.
  • DHCP_TRAILER_ENCAPSULATION(): This parser result function returns true when the client should negotiate trailers, if DHCP option 34 is included in the message, or false if not.
  • DHCP_TRANSACTION_IDENTIFIER(): This parser result function returns the request correlator chosen by the DHCP client in its request and returned to it by server in its response.
  • DHCP_VENDOR_IDENTIFIER(): This parser result function returns vendor-specific information, if DHCP option 60 is included in the message, or an empty list if not.
  • DHCP_VENDOR_INFORMATION(): This parser result function returns vendor-specific information, if DHCP option 43 is included in the message, or an empty list if not.
  • DHCP_WWW_SERVERS(): This parser result function returns a list of WWW servers, represented as IP version 4 addresses, if DHCP option 72 is included in the message, or an empty list if not.
  • DHCP_XWINDOW_DISPLAY_MANAGERS(): This parser result function returns a list of X-Windows display managers, represented as IP version 4 addresses, if DHCP option 49 is included in the message, or an empty list if not.
  • DHCP_XWINDOW_FONT_SERVERS(): This parser result function returns a list of X-Windows font servers, represented as IP version 4 addresses, if DHCP option 48 is included in the message, or an empty list if not.
  • DHCP_YOUR_ADDRESS(): This parser result function returns the IP version 4 address leased to the client by the DHCP server, if the message is an acknowledgement granting a lease, or zero if not.
  • DNS_ADDITIONAL_CLASSES(): This parser result function returns a list of the 'class' fields in the 'additional' resource records in the current message.
  • DNS_ADDITIONAL_COUNT(): This parser result function returns the number of 'additional' resource records in the current message.
  • DNS_ADDITIONAL_DATA(): This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message.
  • DNS_ADDITIONAL_DATA(rstring): This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message.
  • DNS_ADDITIONAL_NAMES(): This parser result function returns a list of the 'name' fields in the 'additional' resource records in the current message.
  • DNS_ADDITIONAL_TTLS(): This parser result function returns a list of the 'time to live' fields in the 'additional' resource records in the current message.
  • DNS_ADDITIONAL_TYPES(): This parser result function returns a list of the 'type' fields in the 'additional' resource records in the current message.
  • DNS_ALL_FIELDS(rstring, rstring, rstring): This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from all DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter.
  • DNS_ALL_FIELDS(rstring, rstring, rstring, list<uint16>): This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from seleccted DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter.
  • DNS_ALL_FIELDS(rstring, rstring, rstring, list<uint16>, uint64, uint32, uint32, uint32, uint16, uint16, uint8, uint32, uint16): This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from seleccted DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter.
  • DNS_ALL_FLAGS(): This parser result function returns a 16-bit value containing all of the DNS header flags from the current message.
  • DNS_ANSWER_ADDRESS(): This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as a string value, or an empty string if not.
  • DNS_ANSWER_ADDRESSES(): This parser result function returns a list of the 'data' fields in the 'answer' resource records that have a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as string values.
  • DNS_ANSWER_CANONICAL(): This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '5' (meaning, the answer is a canonical domain name from a type 'CNAME' record), or an empty string if not.
  • DNS_ANSWER_CLASSES(): This parser result function returns a list of the 'class' fields in the 'answer' resource records in the current message.
  • DNS_ANSWER_COUNT(): This parser result function returns the number of 'answer' resource records in the current message.
  • DNS_ANSWER_DATA(): This parser result function returns a list of the 'data' fields in the 'answer' resource records in the current message.
  • DNS_ANSWER_IPV4_ADDRESS(): This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' (meaning, the answer is an IP version 4 address from a type 'A' record), as a binary value, or zero if not.
  • DNS_ANSWER_IPV4_ADDRESSES(): This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '1' (meaning, the answers are IP version 4 addresses from type 'A' records), as a list of binary values.
  • DNS_ANSWER_IPV6_ADDRESS(): This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '28' (meaning, the answer is an IP version 6 address from a type 'AAAA' record), as a binary value, or zero if not.
  • DNS_ANSWER_IPV6_ADDRESSES(): This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '28' (meaning, the answers IP version 6 addresses from type 'AAAA' records), as a binary values.
  • DNS_ANSWER_NAMES(): This parser result function returns a list of the 'name' fields in the 'answer' resource records in the current message.
  • DNS_ANSWER_TTLS(): This parser result function returns a list of the 'time to live' fields in the 'answer' resource records in the current message.
  • DNS_ANSWER_TYPES(): This parser result function returns a list of the 'type' fields in the 'answer' resource records in the current message.
  • DNS_AUTHORITATIVE_FLAG(): This parser result function returns true if the 'authoritative' flag is set in the current message, or false if not.
  • DNS_EXTRA_DATA(): This parser result function returns any extra data in the DNS message that follows the last resource record.
  • DNS_IDENTIFIER(): This parser result function returns the DNS client's request correlator in the current message, and returned by the server in its response.
  • DNS_INCOMPATIBLE_FLAGS(): This parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found.
  • DNS_NAMESERVER_CLASSES(): This parser result function returns a list of the 'class' fields in the 'name server' resource records in the current message.
  • DNS_NAMESERVER_COUNT(): This parser result function returns the number of 'name server' resource records in the current message.
  • DNS_NAMESERVER_DATA(): This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message.
  • DNS_NAMESERVER_DATA(rstring): This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message.
  • DNS_NAMESERVER_NAMES(): This parser result function returns a list of the 'name' fields in the 'name server' resource records in the current message.
  • DNS_NAMESERVER_TTLS(): This parser result function returns a list of the 'time to live' fields in the 'name server' resource records in the current message.
  • DNS_NAMESERVER_TYPES(): This parser result function returns a list of the 'type' fields in the 'name server' resource records in the current message.
  • DNS_OPCODE(): This parser result function returns the operation code requested by the DNS client in the current message, for example,
  • DNS_QUESTION_CLASS(): This parser result function returns the 'class' field of the first 'question' resource record in the current message, for example, '1' for Internet adddresses ('IN' records),
  • DNS_QUESTION_CLASSES(): This parser result function returns a list of the 'class' fields in the 'question' resource records in the current message.
  • DNS_QUESTION_COUNT(): This parser result function returns the number of 'question' resource records in the current message.
  • DNS_QUESTION_NAME(): This parser result function returns the 'name' field of the first 'question' resource record in the current message, if there is one, or an empty string if not.
  • DNS_QUESTION_NAMES(): This parser result function returns a list of the 'name' fields in the 'question' resource records in the current message.
  • DNS_QUESTION_TYPE(): This parser result function returns the 'type' field of the first 'question' resource record in the current message, for example:
  • DNS_QUESTION_TYPES(): This parser result function returns a list of the 'type' fields in the 'question' resource records in the current message.
  • DNS_RESPONSE_CODE(): This parser result function returns the response code from the DNS server in the current message, for example,
  • DNS_RESPONSE_FLAG(): This parser result function returns true if the current message is a response sent by a DNS server, or false if it is a request sent by a DNS client.
  • DNS_TRUNCATION_FLAG(): This parser result function returns true if the 'truncation' flag is set in the current message, or false if not.
  • IPFIX_bgpDestinationAsNumber(): IPFIX field 17: The autonomous system (AS) number of the destination IP address.
  • IPFIX_bgpNextAdjacentAsNumber(): IPFIX field 128: The autonomous system (AS) number of the first AS in the AS path to the destination IP address.
  • IPFIX_bgpNextHopIPv4Address(): IPFIX field 18: The IPv4 address of the next (adjacent) BGP hop.
  • IPFIX_bgpNextHopIPv6Address(): IPFIX field 63: The IPv6 address of the next (adjacent) BGP hop.
  • IPFIX_bgpPrevAdjacentAsNumber(): IPFIX field 129: The autonomous system (AS) number of the last AS in the AS path from the source IP address.
  • IPFIX_bgpSourceAsNumber(): IPFIX field 16: The autonomous system (AS) number of the source IP address.
  • IPFIX_collectorIPv4Address(): IPFIX field 211: An IPv4 address to which the Exporting Process sends Flow information.
  • IPFIX_collectorIPv6Address(): IPFIX field 212: An IPv6 address to which the Exporting Process sends Flow information.
  • IPFIX_collectorTransportPort(): IPFIX field 216: The destination port identifier to which the Exporting Process sends Flow information.
  • IPFIX_commonPropertiesId(): IPFIX field 137: An identifier of a set of common properties that is unique per Observation Domain and Transport Session.
  • IPFIX_destinationIPv4Address(): IPFIX field 12: The IPv4 destination address in the IP packet header.
  • IPFIX_destinationIPv4Prefix(): IPFIX field 45: IPv4 destination address prefix.
  • IPFIX_destinationIPv4PrefixLength(): IPFIX field 13: The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element.
  • IPFIX_destinationIPv6Address(): IPFIX field 28: The IPv6 destination address in the IP packet header.
  • IPFIX_destinationIPv6Prefix(): IPFIX field 169: IPv6 destination address prefix.
  • IPFIX_destinationIPv6PrefixLength(): IPFIX field 30: The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element.
  • IPFIX_destinationMacAddress(): IPFIX field 80: The IEEE 802 destination MAC address field.
  • IPFIX_destinationTransportPort(): IPFIX field 11: The destination port identifier in the transport header.
  • IPFIX_droppedOctetDeltaCount(): IPFIX field 132: The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment.
  • IPFIX_droppedOctetTotalCount(): IPFIX field 134: The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.
  • IPFIX_droppedPacketDeltaCount(): IPFIX field 133: The number of packets since the previous report (if any) of this Flow dropped by packet treatment.
  • IPFIX_droppedPacketTotalCount(): IPFIX field 135: The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.
  • IPFIX_egressInterface(): IPFIX field 14: The index of the IP interface where packets of this Flow are being sent.
  • IPFIX_enterpriseBasicListFieldAsByteLists(int32): This function returns the value of the specified IPFIX 'enterprise' field as a list of byte lists, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.
  • IPFIX_enterpriseBasicListFieldAsIntegers(int32): This function returns the value of the specified IPFIX 'enterprise' field as a list of integers, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.
  • IPFIX_enterpriseBasicListFieldAsStrings(int32): This function returns the value of the specified IPFIX 'enterprise' field as a list of strings, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.
  • IPFIX_enterpriseBasicListFieldElementIdentifier(int32): This function returns the value of the 'element identifier' corresponding to the specified IPFIX 'enterprise' 'field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.
  • IPFIX_enterpriseBasicListFieldEnterpriseIdentifier(int32): This function returns the value of the 'enterprise identifier' corresponding to the specified IPFIX 'enterprise' field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.
  • IPFIX_enterpriseBasicListFieldSemantic(int32): This function returns the value of the 'semantic code' corresponding to the specified IPFIX 'enterprise' field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.
  • IPFIX_enterpriseFieldAsByteList(int32): This function returns the value of the specified IPFIX 'enterprise' field as a list of bytes, if it is present in the 'data flow' record, or zero if absent.
  • IPFIX_enterpriseFieldAsInteger(int32): This function returns the value of the specified IPFIX 'enterprise' field as an integer, if it is present in the 'data flow' record, or zero if absent.
  • IPFIX_enterpriseFieldAsString(int32): This function returns the value of the specified IPFIX 'enterprise' field as a string, if it is present in the 'data flow' record, or zero if absent.
  • IPFIX_enterpriseIdentifier(int32): This function returns the value of the 'enterprise identifier' corresponding to the specified IPFIX 'field identifier', if one is present in the 'data flow' record, or zero if absent.
  • IPFIX_exportInterface(): IPFIX field 213: The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device.
  • IPFIX_exportProtocolVersion(): IPFIX field 214: The protocol version used by the Exporting Process for sending Flow information.
  • IPFIX_exportTransportProtocol(): IPFIX field 215: The value of the protocol number used by the Exporting Process for sending Flow information.
  • IPFIX_exportedFlowRecordTotalCount(): IPFIX field 42: The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process.
  • IPFIX_exportedMessageTotalCount(): IPFIX field 41: The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process.
  • IPFIX_exportedOctetTotalCount(): IPFIX field 40: The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process.
  • IPFIX_exporterIPv4Address(): IPFIX field 130: The IPv4 address used by the Exporting Process.
  • IPFIX_exporterIPv6Address(): IPFIX field 131: The IPv6 address used by the Exporting Process.
  • IPFIX_exporterTransportPort(): IPFIX field 217: The source port identifier from which the Exporting Process sends Flow information.
  • IPFIX_exportingProcessId(): IPFIX field 144: An identifier of an Exporting Process that is unique per IPFIX Device.
  • IPFIX_flowActiveTimeout(): IPFIX field 36: The number of seconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets.
  • IPFIX_flowDirection(): IPFIX field 61: The direction of the Flow observed at the Observation Point.
  • IPFIX_flowDurationMicroseconds(): IPFIX field 162: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.
  • IPFIX_flowDurationMilliseconds(): IPFIX field 161: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.
  • IPFIX_flowEndDeltaMicroseconds(): IPFIX field 159: This is a relative timestamp only valid within the scope of a single IPFIX Message.
  • IPFIX_flowEndMicroseconds(): IPFIX field 155: The absolute timestamp of the last packet of this Flow.
  • IPFIX_flowEndMilliseconds(): IPFIX field 153: The absolute timestamp of the last packet of this Flow.
  • IPFIX_flowEndNanoseconds(): IPFIX field 157: The absolute timestamp of the last packet of this Flow.
  • IPFIX_flowEndReason(): IPFIX field 136: The reason for Flow termination.
  • IPFIX_flowEndSeconds(): IPFIX field 151: The absolute timestamp of the last packet of this Flow.
  • IPFIX_flowEndSysUpTime(): IPFIX field 21: The relative timestamp of the last packet of this Flow.
  • IPFIX_flowId(): IPFIX field 148: An identifier of a Flow that is unique within an Observation Domain.
  • IPFIX_flowIdleTimeout(): IPFIX field 37: A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field.
  • IPFIX_flowKeyIndicator(): IPFIX field 173: This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key.
  • IPFIX_flowLabelIPv6(): IPFIX field 31: The value of the IPv6 Flow Label field in the IP packet header.
  • IPFIX_flowStartDeltaMicroseconds(): IPFIX field 158: This is a relative timestamp only valid within the scope of a single IPFIX Message.
  • IPFIX_flowStartMicroseconds(): IPFIX field 154: The absolute timestamp of the first packet of this Flow.
  • IPFIX_flowStartMilliseconds(): IPFIX field 152: The absolute timestamp of the first packet of this Flow.
  • IPFIX_flowStartNanoseconds(): IPFIX field 156: The absolute timestamp of the first packet of this Flow.
  • IPFIX_flowStartSeconds(): IPFIX field 150: The absolute timestamp of the first packet of this Flow.
  • IPFIX_flowStartSysUpTime(): IPFIX field 22: The relative timestamp of the first packet of this Flow.
  • IPFIX_fragmentFlags(): IPFIX field 197: Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively.
  • IPFIX_fragmentIdentification(): IPFIX field 54: The value of the Identification field in the IPv4 packet header or in the IPv6 Fragment header, respectively.
  • IPFIX_fragmentOffset(): IPFIX field 88: The value of the IP fragment offset field in the IPv4 packet header or the IPv6 Fragment header, respectively.
  • IPFIX_icmpCodeIPv4(): IPFIX field 177: Code of the IPv4 ICMP message.
  • IPFIX_icmpCodeIPv6(): IPFIX field 179: Code of the IPv6 ICMP message.
  • IPFIX_icmpTypeCodeIPv4(): IPFIX field 32: Type and Code of the IPv4 ICMP message.
  • IPFIX_icmpTypeCodeIPv6(): IPFIX field 139: Type and Code of the IPv6 ICMP message.
  • IPFIX_icmpTypeIPv4(): IPFIX field 176: Type of the IPv4 ICMP message.
  • IPFIX_icmpTypeIPv6(): IPFIX field 178: Type of the IPv6 ICMP message.
  • IPFIX_igmpType(): IPFIX field 33: The type field of the IGMP message.
  • IPFIX_ignoredOctetTotalCount(): IPFIX field 165: The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process.
  • IPFIX_ignoredPacketTotalCount(): IPFIX field 164: The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process.
  • IPFIX_ingressInterface(): IPFIX field 10: The index of the IP interface where packets of this Flow are being received.
  • IPFIX_ipClassOfService(): IPFIX field 5: For IPv4 packets, this is the value of the TOS field in the IPv4 packet header.
  • IPFIX_ipDiffServCodePoint(): IPFIX field 195: The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field.
  • IPFIX_ipHeaderLength(): IPFIX field 189: The length of the IP header.
  • IPFIX_ipNextHopIPv4Address(): IPFIX field 15: The IPv4 address of the next IPv4 hop.
  • IPFIX_ipNextHopIPv6Address(): IPFIX field 62: The IPv6 address of the next IPv6 hop.
  • IPFIX_ipPayloadLength(): IPFIX field 204: The effective length of the IP payload.
  • IPFIX_ipPrecedence(): IPFIX field 196: The value of the IP Precedence.
  • IPFIX_ipTTL(): IPFIX field 192: For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header.
  • IPFIX_ipTotalLength(): IPFIX field 224: The total length of the IP packet.
  • IPFIX_ipVersion(): IPFIX field 60: The IP version field in the IP packet header.
  • IPFIX_ipv4IHL(): IPFIX field 207: The value of the Internet Header Length (IHL) field in the IPv4 header.
  • IPFIX_ipv4Options(): IPFIX field 208: IPv4 options in packets of this Flow.
  • IPFIX_ipv6ExtensionHeaders(): IPFIX field 64: IPv6 extension headers observed in packets of this Flow.
  • IPFIX_isMulticast(): IPFIX field 206: If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero.
  • IPFIX_lineCardId(): IPFIX field 141: An identifier of a line card that is unique per IPFIX Device hosting an Observation Point.
  • IPFIX_maximumIpTotalLength(): IPFIX field 26: Length of the largest packet observed for this Flow.
  • IPFIX_maximumTTL(): IPFIX field 53: Maximum TTL value observed for any packet in this Flow.
  • IPFIX_meteringProcessId(): IPFIX field 143: An identifier of a Metering Process that is unique per IPFIX Device.
  • IPFIX_minimumIpTotalLength(): IPFIX field 25: Length of the smallest packet observed for this Flow.
  • IPFIX_minimumTTL(): IPFIX field 52: Minimum TTL value observed for any packet in this Flow.
  • IPFIX_mplsLabelStackDepth(): IPFIX field 202: The number of labels in the MPLS label stack.
  • IPFIX_mplsLabelStackLength(): IPFIX field 201: The length of the MPLS label stack in units of octets.
  • IPFIX_mplsLabelStackSection10(): IPFIX field 79: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9.
  • IPFIX_mplsLabelStackSection2(): IPFIX field 71: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection.
  • IPFIX_mplsLabelStackSection3(): IPFIX field 72: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2.
  • IPFIX_mplsLabelStackSection4(): IPFIX field 73: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3.
  • IPFIX_mplsLabelStackSection5(): IPFIX field 74: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4.
  • IPFIX_mplsLabelStackSection6(): IPFIX field 75: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5.
  • IPFIX_mplsLabelStackSection7(): IPFIX field 76: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6.
  • IPFIX_mplsLabelStackSection8(): IPFIX field 77: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7.
  • IPFIX_mplsLabelStackSection9(): IPFIX field 78: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8.
  • IPFIX_mplsPayloadLength(): IPFIX field 194: The size of the MPLS packet without the label stack.
  • IPFIX_mplsTopLabelExp(): IPFIX field 203: The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed.
  • IPFIX_mplsTopLabelIPv4Address(): IPFIX field 47: The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to.
  • IPFIX_mplsTopLabelIPv6Address(): IPFIX field 140: The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to.
  • IPFIX_mplsTopLabelStackSection(): IPFIX field 70: The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed.
  • IPFIX_mplsTopLabelTTL(): IPFIX field 200: The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed.
  • IPFIX_mplsTopLabelType(): IPFIX field 46: This field identifies the control protocol that allocated the top-of-stack label.
  • IPFIX_mplsVpnRouteDistinguisher(): IPFIX field 90: The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table.
  • IPFIX_nextHeaderIPv6(): IPFIX field 193: The value of the Next Header field of the IPv6 header.
  • IPFIX_notSentFlowTotalCount(): IPFIX field 166: The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.
  • IPFIX_notSentOctetTotalCount(): IPFIX field 168: The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.
  • IPFIX_notSentPacketTotalCount(): IPFIX field 167: The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.
  • IPFIX_observationDomainId(): IPFIX field 149: An identifier of an Observation Domain that is locally unique to an Exporting Process.
  • IPFIX_observationPointId(): IPFIX field 138: An identifier of an Observation Point that is unique per Observation Domain.
  • IPFIX_observedFlowTotalCount(): IPFIX field 163: The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point.
  • IPFIX_octetDeltaCount(): IPFIX field 1: The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point.
  • IPFIX_octetDeltaSumOfSquares(): IPFIX field 198: The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point.
  • IPFIX_octetTotalCount(): IPFIX field 85: The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
  • IPFIX_octetTotalSumOfSquares(): IPFIX field 199: The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
  • IPFIX_packetDeltaCount(): IPFIX field 2: The number of incoming packets since the previous report (if any) for this Flow at the Observation Point.
  • IPFIX_packetTotalCount(): IPFIX field 86: The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
  • IPFIX_paddingOctets(): IPFIX field 210: The value of this Information Element is always a sequence of 0x00 values.
  • IPFIX_payloadLengthIPv6(): IPFIX field 191: This Information Element reports the value of the Payload Length field in the IPv6 header.
  • IPFIX_portId(): IPFIX field 142: An identifier of a line port that is unique per IPFIX Device hosting an Observation Point.
  • IPFIX_postDestinationMacAddress(): IPFIX field 57: The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postIpClassOfService(): IPFIX field 55: The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postMCastOctetDeltaCount(): IPFIX field 20: The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain.
  • IPFIX_postMCastOctetTotalCount(): IPFIX field 175: The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization.
  • IPFIX_postMCastPacketDeltaCount(): IPFIX field 19: The number of outgoing multicast packets since the previous report (if any) sent for packets of this Flow by a multicast daemon within the Observation Domain.
  • IPFIX_postMCastPacketTotalCount(): IPFIX field 174: The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the Metering Process (re-)initialization.
  • IPFIX_postMplsTopLabelExp(): IPFIX field 237: The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postOctetDeltaCount(): IPFIX field 23: The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postOctetTotalCount(): IPFIX field 171: The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postPacketDeltaCount(): IPFIX field 24: The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postPacketTotalCount(): IPFIX field 172: The definition of this Information Element is identical to the definition of Information Element 'packetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postSourceMacAddress(): IPFIX field 81: The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_postVlanId(): IPFIX field 59: The definition of this Information Element is identical to the definition of Information Element 'vlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
  • IPFIX_protocolIdentifier(): IPFIX field 4: The value of the protocol number in the IP packet header.
  • IPFIX_sourceIPv4Address(): IPFIX field 8: The IPv4 source address in the IP packet header.
  • IPFIX_sourceIPv4Prefix(): IPFIX field 44: IPv4 source address prefix.
  • IPFIX_sourceIPv4PrefixLength(): IPFIX field 9: The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element.
  • IPFIX_sourceIPv6Address(): IPFIX field 27: The IPv6 source address in the IP packet header.
  • IPFIX_sourceIPv6Prefix(): IPFIX field 170: IPv6 source address prefix.
  • IPFIX_sourceIPv6PrefixLength(): IPFIX field 29: The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element.
  • IPFIX_sourceMacAddress(): IPFIX field 56: The IEEE 802 source MAC address field.
  • IPFIX_sourceTransportPort(): IPFIX field 7: The source port identifier in the transport header.
  • IPFIX_standardFieldAsByteList(int32): This function returns the value of the specified IPFIX 'standard' field as a list of bytes, if it is present in the 'data flow' record, or zero if absent.
  • IPFIX_standardFieldAsInteger(int32): This function returns the value of the specified IPFIX 'standard' field as an integer, if it is present in the 'data flow' record, or zero if absent.
  • IPFIX_standardFieldAsString(int32): This function returns the value of the specified IPFIX 'standard' field as a string, if it is present in the 'data flow' record, or zero if absent.
  • IPFIX_systemInitTimeMilliseconds(): IPFIX field 160: The absolute timestamp of the last (re-)initialization of the IPFIX Device.
  • IPFIX_tcpAckTotalCount(): IPFIX field 222: The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set.
  • IPFIX_tcpAcknowledgementNumber(): IPFIX field 185: The acknowledgement number in the TCP header.
  • IPFIX_tcpControlBits(): IPFIX field 6: TCP control bits observed for packets of this Flow.
  • IPFIX_tcpDestinationPort(): IPFIX field 183: The destination port identifier in the TCP header.
  • IPFIX_tcpFinTotalCount(): IPFIX field 219: The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set.
  • IPFIX_tcpHeaderLength(): IPFIX field 188: The length of the TCP header.
  • IPFIX_tcpOptions(): IPFIX field 209: TCP options in packets of this Flow.
  • IPFIX_tcpPshTotalCount(): IPFIX field 221: The total number of packets of this Flow with TCP "Push Function" (PSH) flag set.
  • IPFIX_tcpRstTotalCount(): IPFIX field 220: The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set.
  • IPFIX_tcpSequenceNumber(): IPFIX field 184: The sequence number in the TCP header.
  • IPFIX_tcpSourcePort(): IPFIX field 182: The source port identifier in the TCP header.
  • IPFIX_tcpSynTotalCount(): IPFIX field 218: The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set.
  • IPFIX_tcpUrgTotalCount(): IPFIX field 223: The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set.
  • IPFIX_tcpUrgentPointer(): IPFIX field 187: The urgent pointer in the TCP header.
  • IPFIX_tcpWindowScale(): IPFIX field 238: The scale of the window field in the TCP header.
  • IPFIX_tcpWindowSize(): IPFIX field 186: The window field in the TCP header.
  • IPFIX_templateId(): IPFIX field 145: An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain.
  • IPFIX_totalLengthIPv4(): IPFIX field 190: The total length of the IPv4 packet.
  • IPFIX_udpDestinationPort(): IPFIX field 181: The destination port identifier in the UDP header.
  • IPFIX_udpMessageLength(): IPFIX field 205: The value of the Length field in the UDP header.
  • IPFIX_udpSourcePort(): IPFIX field 180: The source port identifier in the UDP header.
  • IPFIX_vlanId(): IPFIX field 58: The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet.
  • IPFIX_wlanChannelId(): IPFIX field 146: The identifier of the 802.11 (Wi-Fi) channel used.
  • IPFIX_wlanSSID(): IPFIX field 147: The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used.
  • NETFLOW_APPLICATION_DESCRIPTION(): This parser result function returns the application description.
  • NETFLOW_APPLICATION_NAME(): This parser result function returns the name associated with a classification.
  • NETFLOW_APPLICATION_TAG(): This parser result function returns 8 bits of engine ID, followed by n bits of classification.
  • NETFLOW_BGP_IPV4_NEXT_HOP(): This parser result function returns the IP version 4 address of the next router in the BGP domain.
  • NETFLOW_BPG_IPV6_NEXT_HOP(): This parser result function returns the next router in the BGP domain.
  • NETFLOW_COUNT(): This parser result function returns the number of Netflow records in the current message, including templates, options, and flows.
  • NETFLOW_DIRECTION(): This parser result function returns the direction of the flow, '0' for ingress, '1' for egress.
  • NETFLOW_DST_AS(): This parser result function returns the BGP autonomous system number of the destination endpoint of the current flow.
  • NETFLOW_DST_MASK(): This parser result function returns the number of significant bits in the IP version 4 address of the destination endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_DST_PORT(): This parser result function returns the TCP or UDP port number of the destination endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_DST_TOS(): This parser result function returns the 'type of service' byte setting for the flow when exiting the outgoing interface.
  • NETFLOW_DST_TRAFFIC_INDEX(): This parser result function returns BGP policy accounting destination traffic index.
  • NETFLOW_DST_VLAN(): This parser result function returns the virtual LAN identifier associated with the egress interface.
  • NETFLOW_ENGINE_ID(): This parser result function returns the identifier of the switching engine in the router.
  • NETFLOW_ENGINE_TYPE(): This parser result function returns the type code of the switching engine in the router.
  • NETFLOW_FIELD_AS_BYTE_LIST(int32): This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as list of unsigned bytes, or an empty list if not.
  • NETFLOW_FIELD_AS_INTEGER(int32): This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as an unsigned integer, or zero if not.
  • NETFLOW_FIELD_AS_STRING(int32): This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as a string, or an empty string if not.
  • NETFLOW_FIRST_SWITCHED(): This parser result function returns the value of NETFLOW_SYSTEM_UPTIME() for the first packet of the current flow, that is, the time that the first packet in this flow passed through the router, relative to when the router was booted, in milliseconds.
  • NETFLOW_FLOWS(): This parser result function returns the number of flows that were aggregated for the current flow record, if available, or zero if not.
  • NETFLOW_FLOW_ACTIVE_TIMEOUT(): This parser result function returns the timeout value, in seconds, for active flow entries in the Netflow cache.
  • NETFLOW_FLOW_INACTIVE_TIMEOUT(): This parser result function returns the timeout value, in seconds, for inactive flow entries in the Netflow cache.
  • NETFLOW_FLOW_SAMPLER_ID(): This parser result function returns the identifier shown in "show flow-sampler".
  • NETFLOW_FLOW_SAMPLER_MODE(): This parser result function returns the sampling mode, when Netflow is sampled, For Netflow version 9, this is field 49.
  • NETFLOW_FLOW_SAMPLER_RANDOM_INTERVAL(): This parser result function returns the packet sampling interval, when Netflow is sampled.
  • NETFLOW_FORWARDING_STATUS(): This parser result function returns the forwarding status, with the 2 left bits giving the status and the 6 remaining bits giving the reason code.
  • NETFLOW_FRAGMENT_OFFSET(): This parser result function returns the fragment offset value from fragmented IP packets.
  • NETFLOW_ICMP_TYPE(): This parser result function returns the ICMP packet type.
  • NETFLOW_IF_DESC(): This parser result function returns the router's interface description.
  • NETFLOW_IF_NAME(): This parser result function returns the router's interface name.
  • NETFLOW_INPUT_INTERFACE(): This parser result function returns the interface index where the current flow entered the router, if available, or zero if not.
  • NETFLOW_IN_BYTES(): This parser result function returns the number of bytes that entered the router for the current flow record, if available, or zero if not.
  • NETFLOW_IN_PERMANENT_BYTES(): This parser result function returns the running byte counter for a permanent flow.
  • NETFLOW_IN_PERMANENT_PKTS(): This parser result function returns the running packet counter for a permanent flow.
  • NETFLOW_IN_PKTS(): This parser result function returns the number of packets that entered the router for the current flow record, if available, or zero if not.
  • NETFLOW_IPV4_DST_ADDR(): This parser result function returns the IP version 4 address of the destination endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_IPV4_DST_PREFIX(): This parser result function returns the IP version 4 destination address prefix (specific for Cisco Catalyst architecture).
  • NETFLOW_IPV4_IDENT(): This parser result function returns The IP version 4 identification field of the flow.
  • NETFLOW_IPV4_NEXT_HOP(): This parser result function returns the IP version 4 address of the next router towards the destination endpoint of the current flow.
  • NETFLOW_IPV4_SRC_ADDR(): This parser result function returns the IP version 4 address of the source endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_IPV4_SRC_PREFIX(): This parser result function returns the IP version 4 source address prefix (specific for Cisco Catalyst architecture).
  • NETFLOW_IPV6_DST_ADDR(): This parser result function returns the IP version 6 address of the destination endpoint of the current flow record, if available, or an empty list if not.
  • NETFLOW_IPV6_DST_MASK(): This parser result function returns the number of significant bits in the IP version 6 address of the source endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_IPV6_FLOW_LABEL(): This parser result function returns the IP version 6 flow label.
  • NETFLOW_IPV6_NEXT_HOP(): This parser result function returns the IP version 6 address of the next-hop router.
  • NETFLOW_IPV6_OPTION_HEADERS(): This parser result function returns the IP version 6 option headers found in the flow.
  • NETFLOW_IPV6_SRC_ADDR(): This parser result function returns the IP version 6 address of the source endpoint of the current flow record, if available, or an empty list if not.
  • NETFLOW_IPV6_SRC_MASK(): This parser result function returns the number of significant bits in the IP version 6 address of the source endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_IP_PROTOCOL_VERSION(): This parser result function returns the IP version for the flow, either '4' or '6'.
  • NETFLOW_LAST_SWITCHED(): This parser result function returns the value of NETFLOW_SYSTEM_UPTIME() for the last packet of the current flow, that is, the time that the last packet in this flow passed through the router, relative to when the router was booted, in milliseconds.
  • NETFLOW_MAC_DST_ADDR_IN(): This parser result function returns the incoming destination MAC address.
  • NETFLOW_MAC_DST_ADDR_OUT(): This parser result function returns the incoming destination MAC address for the flow.
  • NETFLOW_MAC_SRC_ADDR_IN(): This parser result function returns the incoming source MAC address for the flow.
  • NETFLOW_MAC_SRC_ADDR_OUT(): This parser result function returns the outgoing source MAC address.
  • NETFLOW_MAX_PKT_LNGTH(): This parser result function returns the maximum packet length for the current flow.
  • NETFLOW_MAX_TTL(): This parser result function returns the maximum 'time to live' for incoming packets of the flow.
  • NETFLOW_MIN_PKT_LNGTH(): This parser result function returns the minimum packet length for the current flow.
  • NETFLOW_MIN_TTL(): This parser result function returns the minimum 'time to live' for incoming packets of the flow.
  • NETFLOW_MPLS_LABEL(int32): This parser result function returns the MPLS label at the specified position in the stack, where the position is specified with an argument between 1 and 10.
  • NETFLOW_MPLS_PAL_RD(): This parser result function returns the MPLS PAL Route Distinguisher.
  • NETFLOW_MPLS_PREFIX_LEN(): This parser result function returns the number of consecutive bits in the MPLS prefix length.
  • NETFLOW_MPLS_TOP_LABEL_IPV4_ADDR(): This parser result function returns the Forwarding Equivalent Class corresponding to the MPLS Top Label.
  • NETFLOW_MPLS_TOP_LABEL_TYPE(): This parser result function returns the MPLS top label type, '0' for UNKNOWN, '1' for TE-MIDPT, '2' for ATOM, '3' for VPN '4' for BGP, '5' for LDP.
  • NETFLOW_MUL_DST_BYTES(): This parser result function returns the number of outgoing multicast bytes in the current flow.
  • NETFLOW_MUL_DST_PKTS(): This parser result function returns the number of outgoing multicast packets in the current flow.
  • NETFLOW_MUL_IGMP_TYPE(): This parser result function returns the IGMP packet type.
  • NETFLOW_OUTPUT_INTERFACE(): This parser result function returns the interface index where the current flow left the router, if available, or zero if not.
  • NETFLOW_OUT_BYTES(): This parser result function returns the number of bytes that left the router for the current flow.
  • NETFLOW_OUT_PKTS(): This parser result function returns the number of packets that left the router for the current flow.
  • NETFLOW_POST_IP_DSCP(): This parser result function returns the value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services Field, after modification.
  • NETFLOW_PROTOCOL(): This parser result function returns the IP protocol number for the current flow record, if available, for example, '17' for UDP, or '6' for TCP, or zero if not.
  • NETFLOW_REPLICATION_FACTOR(): This parser result function returns the multicast replication factor.
  • NETFLOW_SAMPLER_NAME(): This parser result function returns the name of the flow sampler, when Netflow is sampled.
  • NETFLOW_SAMPLING_ALGORITHM(): This parser result function returns the sampling algorithm, when Netflow is sampled, with '1' for deterministic sampling, and '2' for random sampling.
  • NETFLOW_SAMPLING_INTERVAL(): This parser result function returns the sampling rate, when Netflow is sampled, for example, a value of 100 indicates that one of every 100 packets is sampled.
  • NETFLOW_SEQUENCE_NUMBER(): This parser result function returns the sequence number assigned to the current message by the router.
  • NETFLOW_SOURCE_ID(): This parser result function returns the port identifier of the router.
  • NETFLOW_SRC_AS(): This parser result function returns the BGP autonomous system number of the source endpoint of the current flow.
  • NETFLOW_SRC_MASK(): This parser result function returns the number of significant bits in the IP version 4 address of the source endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_SRC_PORT(): This parser result function returns the TCP or UDP port number of the source endpoint of the current flow record, if available, or zero if not.
  • NETFLOW_SRC_TOS(): This parser result function returns the IP 'type of service' byte for the current flow record on entering the router, if available, or zero if not.
  • NETFLOW_SRC_TRAFFIC_INDEX(): This parser result function returns BGP policy accounting source traffic index.
  • NETFLOW_SRC_VLAN(): This parser result function returns the virtual LAN identifier associated with the ingress interface.
  • NETFLOW_SYSTEM_UPTIME(): This parser result function returns the elapsed time from when the router started until the current message was sent, in milliseconds.
  • NETFLOW_TCP_FLAGS(): This parser result function returns the cumulative value of all TCP flags in the current flow record, that is, the logical 'or' of the TCP flags in all packets in the flow, if available, or zero if not.
  • NETFLOW_TOTAL_BYTES_EXP(): This parser result function returns the number of bytes exported by the Observation Domain.
  • NETFLOW_TOTAL_FLOWS_EXP(): This parser result function returns the number of flows exported by the Observation Domain.
  • NETFLOW_TOTAL_PKTS_EXP(): This parser result function returns the number of packets exported by the Observation Domain.
  • NETFLOW_UNIX_NANOSECONDS(): This parser result function returns the fractional part of NETFLOW_UNIX_SECONDS(), in nanoseconds, for Netflow version 5 messages only.
  • NETFLOW_UNIX_SECONDS(): This parser result function returns the time that the current message was sent, in seconds, according to the router's clock, relative to the beginning of the Unix epoch (at midnight on the first of January in Greenwich, England).
  • NETFLOW_VERSION(): This parser result function returns the Netflow version of the current message, either '5' or '9'.
  • messagesProcessed(): This parser result function returns the number of messages processed by the operator since it started, including the current message.
  • parseError(): This parser result function returns true if an encoding error was detected while decoding the current packet, or false otherwise.
  • parseErrorCode(): This parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found.
  • parseErrorDescription(): This parser result function returns a description of an encoding error found while decoding the current packet, or an empty string if no enoding errors were found.
  • parseErrorOffset(): This parser result function returns the offset from the beginning of the message to the encoding error found, or zero if no encoding errors were found.