Defining Flows

Flows can be defined using REST API /flow/ or using JavaScript setFlow() fuction.

See RESTflow for an overview and examples

Flow Definition Attributes
AttributeDefaultExampleComment
namepairname used to identify flow specification
keysipsource,ipdestinationlist of Flow Keys or Key Functions
valuebytesNumeric Flow Key, e.g. bytes, frames, requests, duration
filteripsource=10.0.0.1boolean expression filtering Flow Keys or Key Functions using comparison operators: equals(=), not equals(!=), match(~), not match(!~), brackets ( ), and logical operators and(&), or(|)
n510number of largest flows to maintain (i.e. the n in "top n"). Values < 5 or > 20 will be adjusted to fall within the allowed range
t210smoothing factor (in seconds). Values < 0.2 or > 600 will be adjusted to fall within the allowed range.
fs,_SEP_string used to separate flow record fields
logfalsetruelog flows for Script and REST API access
flowStartfalsetruelog start of flow, otherwise record end of flow
activeTimeout6010number seconds before flushing active flow
ipfixCollectors10.0.0.1send flows as IPFIX messages to specified list of collectors - only the following subset of keys is allowed, macsource, macdestination, ethernetprotocol, vlan, priority, ipprotocol, ipsource, ipdestination, ip6source, ip6destination, ip6nexthdr, tcpsourceport, tcpdestinationport, udpsourceport, udpdestinationport, inputifindex, outputifindex and the following values, bytes, frames.
Key Functions

Functions of the form <funcname>:<arg1>:<arg2>... can be applied used to define flow keys or filter. Functions can be nested using square brackets [] as a delimeter, e.g. prefix:[uri:httpurl:path]:/:2 applied to the URL http://localhost:8008/metrics/json would return /metrics.

FunctionExampleArgumentsComment
groupgroup:ipsource:defaultgroup:<flowkey>:<group1>:<group2>One or more group lookups are applied in order until there is a match
countrycountry:ipsourcecountry:<flowkey>
asnasn:ipsourceasn:<flowkey>:<attr>Where attr is number, descr, or both
ouioui:macsourceoui:<flowkey>:<attr>Where attr is number, or name
dnsdns:ipsourcedns:<flowkey>
hosthost:macsource:uuidhost:<flowkey>:<attr>Where attr is host_name, machine_type, os_name, uuid, os_release, vir_host_name, vir_machine_type, vir_os_name, vir_uuid, or vir_os_release
prefixprefix:ipsource:.:2prefix:<flowkey>:<delim>:<n>
suffixsuffix:ipsource:.:2suffix:<flowkey>:<delim>:<n>
concatconcat:_:ipsource:tcpsourceportconcat:<delim>:<flowkey1>:<flowkey2>..
maskmask:ipsource:24mask:<flowkey>:<bits>
nullnull:vlan:undefinednull:<flowkey>:<val>
oror:ipsource:ip6sourceor:<flowkey1>:<flowkey2>
eqeq:ipsource:ipdestinationeq:<flowkey1>:<flowkey2>
rangerange:tcpsourceport:0:1023range:<flowkey>:<lower>:<upper>
mapmap:vlan:vlan_namesmap:<flowkey>:<map1>:<map2>One or more map lookups are applied in order until there is a match
hashhash:ipsource:ipdestinationhash:<flowkey>:<flowkey>...Computes a hash across the set of keys
uriuri:httpurl:pathuri:<flowkey>:<attr>Where attr is normalized, scheme, user, authority, host, port, path, file, extension, query, fragment, isabsolute, isopaque. See URI
attrattr:appattributes:locattr:<flowkey>:<name>:<case>Where name is a field in an HTTP query string, e.g. "cc=visa&loc=mobile", and setting the case flag to true indicates a case sensitve lookup.
lclc:appnamelc:<flowkey>Convert value to lowercase
ucuc:appnameuc:<flowkey>Convert value to uppercase
nodenode:inputifindexnode:<inputifindex|outputifindex>Returns node name. Requires a topology.
linklink:inputifindexlink:<inputifindex|outputifindex>Returns link name. Requires a topology.
ifnameifname:inputifindexifname:<inputifindex|outputifindex>Returns port name.
Value Functions

The following prefixes can be used to modify the way that the value field is computed:

FunctionExampleArgumentsComment
raterate:bytesrate:<flowkey>
avgavg:durationavg:<flowkey>
countcount:ipsourcecount:<flowkey>

Note: If no value function is specified then the default rate: function is applied.

Flow Keys

The following flow keys are supported by sFlow-RT. However, the subset of available keys will depend on the sources of sFlow data and can be queried using REST API /flowkeys/ or JavaScript flowKeys() function. Additional flow keys can be defined using Custom metrics.

Field names may have a numeric suffix indicating that one or more instances of the same attribute exist within packets. For example, ipsource.1, indicates that an inner IP source address exists within a tunnel, see Down the rabbit hole.

Note: A special flow key stack captures the layers decoded from the packet. For example, a stack value of eth.ip.udp.vxlan.eth.ip.tcp indicates that the packet was sampled from a VxLAN tunnel and has inner and outer Ethernet and IP layers.

Forwarding Information

Forwarding information associated with sampled packet, see sFlow Version 5

NameExampleComment
inputifindex12SNMP ifIndex of ingress port, or "local" if packet originated from device
outputifindex34SNMP ifIndex of egress port, or "multiple" if packet copied to more than one egress port, or "internal" if packet delivered to device, or "discard" if packet discarded
outputifcount3Indicates number of egress ports when outputifindex=multiple
outputdiscardreason257Indicates reason for packet discard if outputifindex=discard (see sFlow Version 5 page 27)
directioningressPacket direction with respect to port that sampled it
vlansource4VLAN on ingress
vlandestination1000VLAN on egress
prioritysource3Layer 2 priority on ingress
prioritydestination5Layer 2 priority on egress
ipnexthoprouter10.0.0.254Next hop router
ip6nexthoprouterFD03::102Next hop IPv6 router
ipsourcemaskbits24Mask bits for source subnet
ipdestinationmaskbits24Mask bits for destination subnet
bgpnexthop10.0.0.254BGP next hop
bgpnexthop6FE03::102BGP next hop IPv6
bgpas123Autonomous System Number (ASN) of reporting router
bgpsourceas123ASN associated with source address
bgpsourcepeeras123ASN associated with peer from which packet was received
bgpdestinationas123ASN associated with destination address
bgpdestinationpeeras123ASN associated with next hop peer
bgpdestinationaspath123-345-456Sequence of AS numbers for selected route
bgpcommunities234:32Communities associated with selected route
bgplocalpref3Local preference associated with selected route
natsrc10.0.0.254Translated source address
natsrc6FE03::102Translated IPv6 source address
natsrcport234Translated source TCP/UDP port
natdst10.0.0.254Translated destination address
natdst6FE03::102Translated IPv6 destination address
natdstport234Translated destination TCP/UDP port
usersrcpeterUser ID associated with packet source
userdstpeterUser ID associated with packet destination
url/index.htmlHTTP request line
urldirectionsourceDirection of connection
urlhostsflow.orgThe Host field from the HTTP header
mplslabelstackin1-2-4Label stack of received packet
mplslabelstackout1-2-4Label stack for transmitted packet
mplsnexthoprouter10.0.0.254MPLS next hop
mplsnexthoprouter6FE03::102MPLS IPv6 next hop
mplstunnellspnametun1Tunnel name
mplstunnlid123Tunnel ID
mplstunnelcos3Tunnel COS value
mplsvcinstancenamevc1VC instance name
mplsvcvllid3VLL/VC instance ID
mplsvclabelcos3VC label COS value
mplsftndescrftn1See MPLS-FTN-STD-MIB mplsFTNTable
mplsftnmask10See MPLS-FTN-STD-MIB mplsFTNTable
mplsfecaddrprefixlen10See MPLS-LDP-STD-MIB mplsFecTable
vlantunnelstack2-3-4
WiFi Transmit / Receive

See sFlow 802.11 Structures

NameExampleComment
ciphersuite1
ciphersuiteoui000fac
ciphersuitetype2
ssidSSID string
bssidBSSID
wifiversiongversion
wifichannel3channel number
rsnireceived signal to noise ratio
rcpireceived channel power
speed
duration
transmissions2number of transmissions for sampled packet
retransduration
power
occupancy% radio occupancy
Tunnel Encap/Decap

See sFlow Tunnel Structures

NameExampleComment
outputmacdestinationDestination MAC of encapsulation
outputmacsourceSource MAC of encapsulation
outputethernetprotocolEthernet protocol of encapsulation
inputmacdestinationDestination MAC of encapsulation
inputmacsourceSource MAC of encapsulation
inputethernetprotocolEthernet protocol of encapsulation
inputiptos
inputipecn
inputipdscp
inputipdscpname
inputipsource
inputipdestination
inputip6source
inputip6destination
inputtcpsourceport
inputtcpdestinationport
inputtcpflags
inputudpsourceport
inputudpdestinationport
outputiptos
outputipecn
outputipdscp
outputipdscpname
outputipsource
outputipdestination
outputip6source
outputip6destination
outputtcpsourceport
outputtcpdestinationport
outputtcpflags
outputudpsourceport
outputudpdestinationport
outputheaderoffset
inputheaderoffset
outputvni
inputvni
Ethernet
NameExampleComment
eth_offset
macsource
macdestination
isbroadcoastfalse
ismulticastfalse
isunicasttrue
vlan
priority
llcbytes
llcssap
llcdsap
llcctl
llcsnapoui
llcsnapprotocol
ethernetprotocol
WiFi
NameExampleComment
wifi_offset
wifitype
wifisubtype
wififlags
macreceiver
mactransmitter
bssid
PBB
NameExampleComment
pbb_offset
pbbflags
pbbisid
TRILL
NameExampleComment
trill_offset
trilloptions
trillhops
trillbridgeout
trillbridgein
MPLS
NameExampleComment
mpls_offset
mpllabels
LLDP
NameExampleComment
lldp_offset
lldpchassisphysalias
lldpchassisifalias
lldpchassisport
lldpchassismac
lldpchassisifname
lldpchassislocal
lldpportifalias
lldpportphysalias
lldpportmac
lldpportifname
lldpportcircuitid
lldpportlocal
lldpttl
lldpportdescr
lldpsysname
lldpsysdescr
lldpcapabilities
lldpcapabilitiesenabled
ATA over Ethernet
NameExampleComment
aoe_offset
aoeversion
aoetargete1.4
aoeatacmdread
aoeoperationquery
requests
Fiber Channel over Ethernet
NameExampleComment
fc_offset
fcsource
fcdestination
fctype
scsiop8
scsiopnameREAD6
requests
Audo Video Bridging - Transport Protocol (AVTP)
NameExampleComment
avtp_offset
avtpsubtype
avtpversion
avtpstreadid
avtpcontroldatalen
avtpseqno
avtpstreamdatalen
avtptimestamp
avtpgateway
IEC 61883 over AVTP
NameExampleComment
iec61883_offset
iec61883tag
iec61883channel
iec61883sid
iec61883dbs
iec61883fmt
ICMP

See ICMP unreachable and Exporting events using syslog

NameExampleComment
icmp_offset
icmp6_offset
icmptype3Message type, e.g. Destination Unreachable (3)
icmp6type3Message type, e.g. Destination Unreachable (3)
icmpcode2Message code, e.g. Protocol Unreachable (2)
icmp6code2Message code, e.g. Protocol Unreachable (2)
icmpunreachablenet10.0.0.1IP address in network unreachable response
icmpunreachablehost10.0.0.1IP address in host unreachable response
icmpunreachableprotocol41Protocol in protocol unreachable response
icmpunreachableportudp_30000Port in port unreachable response
ARP
NameExampleComment
arp_offset
arphardwaretype
arpprotocoltype
arpoperation
arpmacsender
arpipsender
arpmactarget
arpiptarget
IP
NameExampleComment
ip_offset14
iptos
ipecn
ipdscp0
ipdscpnamebe(0)
ipttl63
ipprotocol
ipbytes
ipid
ipflags
ipfragoffset
ipsource10.0.0.1
ipdestination10.0.0.2
IP version 6
NameExampleComment
ip6_offset14
ip6tos
ip6ecn
ip6dscp0
ip6dscpnamebe(0)
ip6ttl63
ip6sourceFE80::104C:51DF:4458:E00A
ip6destinationFE80::A00:27FF:FEB8:326D
ip6bytes
ip6extensions
ip6nexthdr
TCP
NameExampleComment
tcp_offset
tcpsourceport
tcpdestinationport
tcpsourceport
tcpseqno
tcpackno
tcpflags
tcpoffset
tcpwindow
tcppayloadbytes
TCP Info

See Network performance monitoring

NameExampleComment
tcpdirectionreceivedSampled packet direction, sent or received
tcpmsssnd1448Cached effective mss, not including SACKS
tcpmssrcv1336Max. recv. segment size
tcpunacked10Packets which are "in flight"
tcplost0Lost packets
tcpretrans0Retransmitted packets
tcppmtu1500Last pmtu seen by socket
tcpcwndsnd22Sending congestion window
tcpreordering3Reordering
tcprtt668Smoothed RTT (microseconds)
tcprttvar153RTT variance (microseconds)
tcprttsdev14.387RTT standard deviation
tcprttserr0.012RTT standard error
tcprttmin439Minimum RTT (microseconds)
tcprttwait143tcprtt - tcprttmin
UDP
NameExampleComment
udp_offset
udpsourceport
udpdestinationport
udpbytes
DHCP
NameExampleComment
dhcp_offset
dhcpopcode
dhcphtype
dhcphlen
dhcphops
dhcpxid
dhcpsecs
dhcpflags
dhcpciaddr
dhcpyiaddr
dhcpsiaddr
dhcpgiaddr
dhcpchaddr
dhcpsname
QUIC
NameExampleComment
quic_offset
quicflags
quicpackettype
quicconnectionid
quicversion
quicpacketno
ESP
NameExampleComment
esp_offset
espspi
espseqno
GRE
NameExampleComment
gre_offset
greflowid
grevsid
greversion
greprotocoltype
VxLAN
NameExampleComment
vxlan_offset
vni
Geneve
NameExampleComment
geneve_offset
geneveprotocoltype
genevevni
DNS

See DNS amplification attacks for an example

NameExampleComment
dnsqrfalserequest=false, response=true
dnsopcode0op code
dnsaafalseauthoritative answer
dnstcfalsetruncated
dnsrdfalserecursion desired
dnsratruerecursion available
dnsz0reserved
dnsrcode0response code
dnsqdcount1number of entries in question
dnsancount0number of entries in answer
dnsnscount0number of entries in name server section
dnsarcount0number of entries in resources section
dnsqnameyahoo.com.domain name in query
dnsqtype15query type code
dnsqtypenameMX(15)query type name
dnsqclass1query class
requests
SNMP
NameExampleComment
snmp_offset
snmpversion
snmpcommunity
snmppduget_req
snmpbytes
requests
NTP
NameExampleComment
ntp_offset
ntpversion
ntpmode
ntpctlresponse
ntpctloperation
ntpctloffset
ntpctlbytes
ntppvtresponse
ntppvtimpl
ntppvtreq
ntppvtbytes
ntpstratum
ntpreferenceid
RTP
NameExampleComment
rtp_offset
rtppayloadG.722
rtpssrc
RTCP
NameExampleComment
rtcp_offset
rtcplostfraction0.2
rtcpjitter3
Chargen
NameExampleComment
chargen_offset
chargen
SSDP
NameExampleComment
ssdp_offset
ssdp_start_line
HTTP
NameExampleComment
http_offset
httpmethod
httpurl
httpreferer
httpstatus
requests
SIP
NameExampleComment
sip_offset
sipmethod
siptarget
Application Sockets

See sFlow Host Structures

NameExampleComment
protocol
serveraddress
serveraddress6
serverport
clientaddress
clientaddress6
clientport
proxyprotocol
proxyserveraddress
proxyserveraddress6
proxyserverport
proxyclientaddress
proxyclientaddress6
proxyclientport
HTTP Operation

See sFlow Blog for articles on HTTP sFlow

NameExampleComment
httpmethodGET
httpprotocol1.0
httphost
httpuseragent
httpxff
httpauthuser
httpmimetype
httpurl
httpreferer
httpstatus
bytesRequest + response bytes
req_bytesRequest bytes
resp_bytesResponse bytes
duration
requests
Memcache Operation

See sFlow Blog for articles on Memcache sFlow

NameExampleComment
memcachecommandGET
memcacheprotocol
memcachestatusOK
memcachenumkeys
bytes
duration
requests
Generic Application Operation

See Scripting languages for article describing how to send generic application transactions

NameExampleComment
appname
appoperation
appattributes
appstatus2
appstatusdescrTIMEOUT
duration
bytesRequest + response bytes
req_bytesRequest bytes
resp_bytesResponse bytes
requests