Defining Flows
Flows can be defined using REST API /flow/ or using JavaScript setFlow() function.
See RESTflow for an overview and examples.
Flow Definition Attributes
| Attribute | Default | Example | Comment |
|---|
| name | | pair | Name used to identify flow specification |
| keys | | ipsource,ipdestination | List of Flow Keys or Key Functions |
| value | | bytes | Numeric Flow Key, e.g. bytes, frames, requests, duration |
| values | | frames | List of additional values |
| filter | | ipsource=10.0.0.1 | Boolean expression filtering Flow Keys or Key Functions
using comparison operators: equals(=), not equals(!=), match(~), not match(!~), brackets ( ), and logical operators and(&), or(|).
The left hand side of a comparision operation references a flow key or key functions applied to flow key(s). The right hand side is a comma separated list
of values to test. Match operations are tested against a list of Pattern strings. |
| n | 5 | 10 | Number of largest flows to maintain (i.e. the n in "top n"). Values < 5 or > 20 will be adjusted to fall within the allowed range |
| t | 2 | 10 | Smoothing factor (in seconds). Values < 0.2 or > 600 will be adjusted to fall within the allowed range. |
| dropped | false | true | Analyze dropped packet notifications, otherwise packet samples |
| fs | , | _SEP_ | String used to separate flow record fields |
| log | false | true | Log flows for Script and REST API access |
| flowStart | false | true | Log start of flow, otherwise record end of flow |
| activeTimeout | 60 | 10 | Number seconds before flushing active flow |
| ipfixCollectors | | 10.0.0.1 | Send flows as IPFIX messages to specified list of collectors - only the following subset of keys is allowed, macsource, macdestination, ethernetprotocol, vlan, priority, ipprotocol, ipsource, ipdestination, ip6source, ip6destination, ip6nexthdr, tcpsourceport, tcpdestinationport, udpsourceport, udpdestinationport, inputifindex, outputifindex and the following values, bytes, frames. |
Key Functions
Functions of the form <funcname>:<arg1>:<arg2>... can be applied used to define flow keys or filter.
Functions can be nested using square brackets [] as a delimeter, e.g. prefix:[uri:httpurl:path]:/:2 applied to the URL http://localhost:8008/metrics/json would return /metrics.
| Function | Example | Arguments | Comment |
|---|
| group | group:ipsource:default | group:<flowkey>:<group1>:<group2> | One or more group lookups are applied in order until there is a match |
| country | country:ipsource | country:<flowkey>:<attr> | Returns country code for address where attr is code, name, or both
Note: Set System Property geo.country |
| asn | asn:ipsource | asn:<flowkey>:<attr> | Returns Autonomous System Number (ASN) for address where attr is number, descr, or both
Note: Set System Property geo.asn |
| oui | oui:macsource | oui:<flowkey>:<attr> | Returns Organizationally Unique Identifier (OUI) for MAC address where attr is number, or name
Note: Set System Property oui.names |
| dns | dns:ipsource | dns:<flowkey> | Returns FQDN for address
Note: Set System Property dns.servers |
| host | host:macsource:uuid | host:<flowkey>:<attr> | Where attr is host_name, machine_type, os_name, uuid, os_release, vir_host_name, vir_machine_type, vir_os_name, vir_uuid, or vir_os_release |
| prefix | prefix:ipsource:.:2 | prefix:<flowkey>:<delim>:<n> | |
| suffix | suffix:ipsource:.:2 | suffix:<flowkey>:<delim>:<n> | |
| concat | concat:_:ipsource:tcpsourceport | concat:<delim>:<flowkey1>:<flowkey2>.. | Joins keys using delimiter |
| mask | mask:ipsource:24 | mask:<flowkey>:<bits> | Appy CIDR mask to address and return network/bits |
| null | null:vlan:undefined | null:<flowkey>:<val> | Allow null values as keys |
| or | or:ipsource:ip6source | or:<flowkey1>:<flowkey2> | Return first non-null key |
| eq | eq:ipsource:ipdestination | eq:<flowkey1>:<flowkey2> | Return true if keys are equal |
| range | range:tcpsourceport:0:1023 | range:<flowkey>:<lower>:<upper> | Returns true if value in range |
| map | map:vlan:vlan_names | map:<flowkey>:<map1>:<map2> | One or more map lookups are applied in order until there is a match |
| hash | hash:ipsource:ipdestination | hash:<flowkey>:<flowkey>... | Computes a hash across the set of keys |
| uri | uri:httpurl:path | uri:<flowkey>:<attr> | Where attr is normalized, scheme, user, authority, host, port, path, file, extension, query, fragment, isabsolute, isopaque. See URI |
| attr | attr:appattributes:loc | attr:<flowkey>:<name>:<case> | Where name is a field in an HTTP query string, e.g. "cc=visa&loc=mobile", and setting the case flag to true indicates a case sensitve lookup. |
| lc | lc:appname | lc:<flowkey> | Convert value to lowercase |
| uc | uc:appname | uc:<flowkey> | Convert value to uppercase |
| node | node:inputifindex | node:<inputifindex|outputifindex> | Returns node name. Requires a topology. |
| link | link:inputifindex | link:<inputifindex|outputifindex> | Returns link name. Requires a topology. |
| ifname | ifname:inputifindex | ifname:<inputifindex|outputifindex> | Returns port name. |
| if | if:tcpdirection:received:ipsource:ipdestination | if:<flowkey_cmp>:<value>:<flowkey_true>:<flowkey_false> | Selects key based on condition. |
| first | first:stack:.:ip:ip6 | first:<flowkey>:<delim>:<val1>:<val2>... | Return the value that occurs first in the delimited list |
| bits | bits:ip6flowlabel:1032703 | bits:<flowkey>:<mask>:<shift> | Mask and shift bits in numeric flowkey |
Value Functions
The following prefixes can be used to modify the way that the value field is computed:
| Function | Example | Arguments | Comment |
|---|
| rate | rate:bytes | rate:<flowkey> | Compute per second rate for value, e.g. bytes/second |
| avg | avg:duration | avg:<flowkey> | Compute time average for value |
| min | min:transitdelay | min:<flowkey> | Compute minimum value over interval |
| max | max:queuedepth | max:<flowkey> | Compute maximum value over interval |
| count | count:ipsource | count:<flowkey> | Compute number of discrete values of key |
Note: If no value function is specified then the default rate: function is applied. The smoothing factor, t, controls the interval over which the value function is applied.
Flow Keys
The following flow keys are supported by sFlow-RT. However, the subset of available keys will depend on the sources of sFlow data and can be queried using
REST API /flowkeys/json or JavaScript flowKeys() function.
Additional flow keys can be defined using Custom metrics.
Field names may have a numeric suffix indicating that one or more instances of the same attribute exist within
packets. For example, ipsource.1, indicates that an inner IP source address exists within a tunnel, see
Down the rabbit hole.
Note: A special flow key stack captures the layers decoded from the packet. For example, a stack value of
eth.ip.udp.vxlan.eth.ip.tcp indicates that the packet was sampled from a VxLAN tunnel and has inner and outer
Ethernet and IP layers.
Forwarding Information
Forwarding information associated with sampled packet, see sFlow Version 5
| Name | Example | Comment |
|---|
| inputifindex | 12 | SNMP ifIndex of ingress port, or "local" if packet originated from device |
| outputifindex | 34 | SNMP ifIndex of egress port, or "multiple" if packet copied to more than one egress port, or "internal" if packet delivered to device, or "discard" if packet discarded |
| outputifcount | 3 | Indicates number of egress ports when outputifindex=multiple |
| outputdiscardreason | ttl_exceeded | Indicates reason for packet discard if outputifindex=discard (see sFlow Version 5 page 27) |
| direction | ingress | Packet direction with respect to port that sampled it |
| vlansource | 4 | VLAN on ingress |
| vlandestination | 1000 | VLAN on egress |
| prioritysource | 3 | Layer 2 priority on ingress |
| prioritydestination | 5 | Layer 2 priority on egress |
| ipnexthoprouter | 10.0.0.254 | Next hop router |
| ip6nexthoprouter | FD03::102 | Next hop IPv6 router |
| ipsourcemaskbits | 24 | Mask bits for source subnet |
| ipdestinationmaskbits | 24 | Mask bits for destination subnet |
| bgpnexthop | 10.0.0.254 | BGP next hop |
| bgpnexthop6 | FE03::102 | BGP next hop IPv6 |
| bgpas | 123 | Autonomous System Number (ASN) of reporting router |
| bgpsourceas | 123 | ASN associated with source address |
| bgpsourcepeeras | 123 | ASN associated with peer from which packet was received |
| bgpdestinationas | 123 | ASN associated with destination address |
| bgpdestinationpeeras | 123 | ASN associated with next hop peer |
| bgpdestinationaspath | 123-345-456 | Sequence of AS numbers for selected route |
| bgpcommunities | 234:32-234:666 | Communities associated with selected route |
| bgplocalpref | 3 | Local preference associated with selected route |
| natsrc | 10.0.0.254 | Translated source address |
| natsrc6 | FE03::102 | Translated IPv6 source address |
| natsrcport | 234 | Translated source TCP/UDP port |
| natdst | 10.0.0.254 | Translated destination address |
| natdst6 | FE03::102 | Translated IPv6 destination address |
| natdstport | 234 | Translated destination TCP/UDP port |
| usersrc | peter | User ID associated with packet source |
| userdst | peter | User ID associated with packet destination |
| url | /index.html | HTTP request line |
| urldirection | source | Direction of connection |
| urlhost | sflow.org | The Host field from the HTTP header |
| mplslabelstackin | 1-2-4 | Label stack of received packet |
| mplslabelstackout | 1-2-4 | Label stack for transmitted packet |
| mplsnexthoprouter | 10.0.0.254 | MPLS next hop |
| mplsnexthoprouter6 | FE03::102 | MPLS IPv6 next hop |
| mplstunnellspname | tun1 | Tunnel name |
| mplstunnlid | 123 | Tunnel ID |
| mplstunnelcos | 3 | Tunnel COS value |
| mplsvcinstancename | vc1 | VC instance name |
| mplsvcvllid | 3 | VLL/VC instance ID |
| mplsvclabelcos | 3 | VC label COS value |
| mplsftndescr | ftn1 | See MPLS-FTN-STD-MIB mplsFTNTable |
| mplsftnmask | 10 | See MPLS-FTN-STD-MIB mplsFTNTable |
| mplsfecaddrprefixlen | 10 | See MPLS-LDP-STD-MIB mplsFecTable |
| vlantunnelstack | 2-3-4 | |
Dropped Packets
See sFlow Dropped Packet Notification Structures
| Name | Example | Comment |
|---|
| reason | ttl_exceeded | Reason for dropping packet |
| queueindex | 7 | Eqress queue number selected for sampled packet |
| aclnumber | 3 | Access list number |
| aclname | ddos | Access list name |
| acldirection | ingress | ingress, egress, or unknown |
| function | tcp_v4_rcv | Name of the function in software network stack that discarded the packet |
| function_full | tcp_v4_rcv+0x7c/0xef0 | Name and address of the function in software network stack that discarded the packet |
| linux_drop_reason | NO_SOCKET | Linux dropreason for discarding packet |
| hw_trap_group | l3_drops | Linux Devlink Trap group |
| hw_trap_name | blackhole_route | Linux Devlink Trap name |
Transit Delay
See sFlow Transit Delay Structures
| Name | Example | Comment |
|---|
| transitdelay | 839660224 | Delay for sampled packet to traverse switch (nanoseconds) |
| queuedepth | 11354112 | Depth seen by sampled packet in egress queue identified by queueindex (bytes) |
WiFi Transmit / Receive
See sFlow 802.11 Structures
| Name | Example | Comment |
|---|
| ciphersuite | 1 | |
| ciphersuiteoui | 000fac | |
| ciphersuitetype | 2 | |
| ssid | | SSID string |
| bssid | | BSSID |
| wifiversion | g | version |
| wifichannel | 3 | channel number |
| rsni | | received signal to noise ratio |
| rcpi | | received channel power |
| speed | | |
| duration | | |
| transmissions | 2 | number of transmissions for sampled packet |
| retransduration | | |
| power | | |
| occupancy | | % radio occupancy |
Tunnel Encap/Decap
See sFlow Tunnel Structures
| Name | Example | Comment |
|---|
| outputmacdestination | | destination MAC of encapsulation |
| outputmacsource | | source MAC of encapsulation |
| outputethernetprotocol | | Ethernet protocol of encapsulation |
| inputmacdestination | | destination MAC of encapsulation |
| inputmacsource | | source MAC of encapsulation |
| inputethernetprotocol | | Ethernet protocol of encapsulation |
| inputiptos | | |
| inputipecn | | |
| inputipdscp | | |
| inputipdscpname | | |
| inputipsource | | |
| inputipdestination | | |
| inputip6source | | |
| inputip6destination | | |
| inputtcpsourceport | | |
| inputtcpdestinationport | | |
| inputtcpflags | | |
| inputudpsourceport | | |
| inputudpdestinationport | | |
| outputiptos | | |
| outputipecn | | |
| outputipdscp | | |
| outputipdscpname | | |
| outputipsource | | |
| outputipdestination | | |
| outputip6source | | |
| outputip6destination | | |
| outputtcpsourceport | | |
| outputtcpdestinationport | | |
| outputtcpflags | | |
| outputudpsourceport | | |
| outputudpdestinationport | | |
| outputheaderoffset | | |
| inputheaderoffset | | |
| outputvni | | |
| inputvni | | |
Ethernet
| Name | Example | Comment |
|---|
| eth_offset | 0 | Ethernet header offset from start of packet |
| macsource | 003EE1C6DCCA | source address |
| macdestination | 984BE1034A61 | destination address |
| isbroadcast | false | |
| ismulticast | false | |
| isunicast | true | |
| vlan | 200 | |
| priority | 0 | |
| llcbytes | 50 | |
| llcssap | 170 | |
| llcdsap | 170 | |
| llcctl | 3 | |
| llcsnapoui | 0000C | |
| llcsnapprotocol | 267 | |
| ethernetprotocol | 2048 | |
WiFi
| Name | Example | Comment |
|---|
| wifi_offset | 0 | WiFi header offset from start of packet |
| wifitype | | |
| wifisubtype | | |
| wififlags | | |
| macreceiver | | |
| mactransmitter | | |
| bssid | | |
PBB
| Name | Example | Comment |
|---|
| pbb_offset | | PBB header offset from start of packet |
| pbbflags | | |
| pbbisid | | |
VN-TAG
| Name | Example | Comment |
|---|
| vntag_offset | | VN-TAG header offset from start of packet |
| vntagdir | | |
| vntagvifsrc | | |
| vntagvifdst | | |
| vntaglooped | | |
| vntagreserved | | |
| vntagversion | | |
TRILL
| Name | Example | Comment |
|---|
| trill_offset | 18 | TRILL header offset from start of packet |
| trilloptions | 0 | |
| trillhops | 62 | |
| trillbridgeout | 3 | |
| trillbridgein | 6 | |
MPLS
| Name | Example | Comment |
|---|
| mpls_offset | | MPLS header offset from start of packet |
| mplslabels | | |
LLDP
| Name | Example | Comment |
|---|
| lldp_offset | | LLDP header offset from start of packet |
| lldpchassisphysalias | | |
| lldpchassisifalias | | |
| lldpchassisport | | |
| lldpchassismac | | |
| lldpchassisifname | | |
| lldpchassislocal | | |
| lldpportifalias | | |
| lldpportphysalias | | |
| lldpportmac | | |
| lldpportifname | | |
| lldpportcircuitid | | |
| lldpportlocal | | |
| lldpttl | | |
| lldpportdescr | | |
| lldpsysname | | |
| lldpsysdescr | | |
| lldpcapabilities | | |
| lldpcapabilitiesenabled | | |
ATA over Ethernet
| Name | Example | Comment |
|---|
| aoe_offset | | AoE header offset from start of packet |
| aoeversion | | |
| aoetarget | e1.4 | |
| aoeatacmd | read | |
| aoeoperation | query | |
| requests | 1 | number of requests |
Fiber Channel over Ethernet
| Name | Example | Comment |
|---|
| fc_offset | | FCoE header offset from start of packet |
| fcsource | | |
| fcdestination | | |
| fctype | | |
| scsiop | 8 | |
| scsiopname | READ6 | |
| requests | 1 | number of requests |
Audo Video Bridging - Transport Protocol (AVTP)
| Name | Example | Comment |
|---|
| avtp_offset | | AVTP header offset from start of packet |
| avtpsubtype | | |
| avtpversion | | |
| avtpstreadid | | |
| avtpcontroldatalen | |
|
| avtpseqno | | |
| avtpstreamdatalen | | |
| avtptimestamp | | |
| avtpgateway | | |
IEC 61883 over AVTP
| Name | Example | Comment |
|---|
| iec61883_offset | | IEC61883 header offset from start of packet |
| iec61883tag | | |
| iec61883channel | | |
| iec61883sid | | |
| iec61883dbs | | |
| iec61883fmt | | |
InfiniBand Global Routing
| Name | Example | Comment |
|---|
| ibgr_offset | | IBGR header offset from start of packet |
| ibgripver | 6 | IP Version |
| ibgrtclass | 0 | traffic class |
| ibgrlabel | 0 | flow label |
| ibgrpaylen | 4112 | payload length |
| ibgrnxthdr | 27 | next header |
| ibgrhoplimit | 64 | hop limit |
| ibgrsgid | 0000:0000:0000:0000:0000:ffff:0a0a:0216 | source GID |
| ibgrdgid | 0000:0000:0000:0000:0000:ffff:0a0a:0216 | destination GID |
InfiniBand Base Transport
| Name | Example | Comment |
|---|
| ibbt_offset | | IBBT header offset from start of packet |
| ibbtopcode | 1 | opcode |
| ibbtver | 0 | transport Header Version |
| ibbtdestqp | 345 | destination QP |
| ibbtack | false | acknowledge Request |
| ibbtoptransport | RC | transport Type |
| ibbtopname | RDMA_WRITE | operation Name |
ARP
| Name | Example | Comment |
|---|
| arp_offset | 18 | ARP header offset from start of packet |
| arphardwaretype | 1 | |
| arpprotocoltype | 2048 | |
| arpoperation | 1 | |
| arpmacsender | AC87A30F1323 | |
| arpipsender | 10.0.0.1 | |
| arpmactarget | 0026BB6C1EB0 | |
| arpiptarget | 10.0.0.2 | |
ICMP
See ICMP unreachable and Exporting events using syslog
| Name | Example | Comment |
|---|
| icmp_offset | 34 | ICMP header offset from start of packet |
| icmptype | 3 | message type, e.g. Destination Unreachable (3) |
| icmpcode | 2 | message code, e.g. Protocol Unreachable (2) |
| icmpseqno | 13 | sequence number |
| icmpunreachablenet | 10.0.0.1 | IP address in network unreachable response |
| icmpunreachablehost | 10.0.0.1 | IP address in host unreachable response |
| icmpunreachableprotocol | 41 | protocol in protocol unreachable response |
| icmpunreachableport | udp_30000 | port in port unreachable response |
IP
| Name | Example | Comment |
|---|
| ip_offset | 14 | IP header offset from start of packet |
| iptos | 00000000 | type of service bits |
| ipecn | 11 | explicit congestion notification bits |
| ipdscp | 0 | differentiated services code point |
| ipdscpname | be(0) | differentiated services code point name |
| ipttl | 63 | time to live |
| ipprotocol | 17 | protocol |
| ipbytes | 54 | payload bytes |
| ipid | 5210 | identification |
| ipflags | 010 | flags |
| ipfragoffset | 0 | fragment offset |
| ipsource | 10.0.0.1 | source address |
| ipdestination | 10.0.0.2 | destination address |
ICMP version 6
| Name | Example | Comment |
|---|
| icmp6_offset | 62 | ICMP6 header offset from start of packet |
| icmp6type | 3 | message type, e.g. Destination Unreachable (3) |
| icmp6code | 2 | message code, e.g. Protocol Unreachable (2) |
| icmp6seqno | 13 | sequence number |
| icmp6mldmaxrespdelay | | |
| icmp6mldaddress | | |
| icmp6racurhoplimit | | |
| icmp6ramanagedconfig | | |
| icmp6raotherconfig | |
|
| icmp6ralifetime | | |
| icmp6rareachabletime | | |
| icmp6raetranstimer | | |
| icmp6nstarget | | |
| icmp6narouter | | |
| icmp6nasolicit | | |
| icmp6naoverride | | |
| icmp6natarget | | |
| icmp6redirecttarget | | |
| icmp6redirectdestination | | |
| icmp6unreachablenoroute | | |
| icmp6unreachableprohibited | | |
| icmp6unreachablebeyondscope | | |
| icmp6unreachableaddress | | |
| icmp6unreachablesourcepolicy | | |
| icmp6unreachablerejectroute | | |
| icmp6unreachableport | udp_30000 | port in port unreachable response |
IP version 6
| Name | Example | Comment |
|---|
| ip6_offset | 14 | IPv6 header offset from start of packet |
| ip6tos | 01100000 | type of service bits |
| ip6ecn | 00 | explicit congestion notification bits |
| ip6dscp | 0 | differentiated services code point |
| ip6dscpname | be(0) | differentiated services code point name |
| ip6flowlabel | 501244 | flow label |
| ip6ttl | 63 | time to live |
| ip6source | FE80::104C:51DF:4458:E00A | source address |
| ip6destination | FE80::A00:27FF:FEB8:326D | destination address |
| ip6bytes | 60 | payload bytes |
| ip6extensions | 0 | list of next header values for extension headers |
| ip6fragoffset | 0 | fragment offset |
| ip6fragm | false | fragment m flag |
| ip6nexthdr | 17 | next header |
TCP
| Name | Example | Comment |
|---|
| tcp_offset | 34 | TCP header offset from start of packet |
| tcpsourceport | 80 | source port |
| tcpdestinationport | 26955 | destination port |
| tcpseqno | 1971494866 | sequence number |
| tcpackno | 3138709947 | acknowledgement number |
| tcpflags | 000010000 | flag bits |
| tcpoffset | 5 | offset |
| tcpwindow | 512 | window |
| tcpopts | 1-1-8 | options |
| tcpoptbytes | 12 | option bytes |
| tcppayloadbytes | 161 | payload bytes |
TCP Info
See Network performance monitoring
| Name | Example | Comment |
|---|
| tcpdirection | received | sampled packet direction, sent or received |
| tcpmsssnd | 1448 | cached effective mss, not including SACKS |
| tcpmssrcv | 1336 | max. recv. segment size |
| tcpunacked | 10 | packets which are "in flight" |
| tcplost | 0 | lost packets |
| tcpretrans | 0 | retransmitted packets |
| tcppmtu | 1500 | last pmtu seen by socket |
| tcpcwndsnd | 22 | sending congestion window |
| tcpreordering | 3 | reordering |
| tcprtt | 668 | smoothed RTT (microseconds) |
| tcprttvar | 153 | RTT variance (microseconds) |
| tcprttsdev | 14.387 | RTT standard deviation |
| tcprttserr | 0.012 | RTT standard error |
| tcprttmin | 439 | minimum RTT (microseconds) |
| tcprttwait | 143 | tcprtt - tcprttmin |
UDP
| Name | Example | Comment |
|---|
| udp_offset | 34 | UDP header offset from start of packet |
| udpsourceport | | |
| udpdestinationport | | |
| udpbytes | | |
DHCP
| Name | Example | Comment |
|---|
| dhcp_offset | | DHCP header offset from start of packet |
| dhcpopcode | | |
| dhcphtype | | |
| dhcphlen | | |
| dhcphops | | |
| dhcpxid | | |
| dhcpsecs | | |
| dhcpflags | | |
| dhcpciaddr | | |
| dhcpyiaddr | | |
| dhcpsiaddr | | |
| dhcpgiaddr | | |
| dhcpchaddr | | |
| dhcpsname | | |
QUIC
| Name | Example | Comment |
|---|
| quic_offset | 42 | QUIC header offset from start of packet |
| quicheaderform | long | short/long header |
| quictype | 0-rtt | packet type |
| quicversion | 1 | version |
| quicspinbit | true | spin bit |
ESP
| Name | Example | Comment |
|---|
| esp_offset | 34 | ESP header offset from start of packet |
| espspi | 3395130038 | |
| espseqno | 7633681 | |
GRE
| Name | Example | Comment |
|---|
| gre_offset | 34 | GRE header offset from start of packet |
| greflowid | | |
| grevsid | | |
| greversion | 0 | |
| greprotocoltype | 2048 | |
VxLAN
| Name | Example | Comment |
|---|
| vxlan_offset | 42 | VxLAN header offset from start of packet |
| vxlanvni | 5000 | virtual network identifier |
VxLAN GPE
| Name | Example | Comment |
|---|
| vxlangpe_offset | | VxLAN GPE header offset from start of packet |
| vxlangpeversion | | |
| vxlangpeflags | | |
| vxlangpevni | | virtual network identifier |
| vxlangpenextprotocol | | next protocol |
NSH
| Name | Example | Comment |
|---|
| nsh_offset | | NSH header offset from start of packet |
| nshversion | | |
| nshflags | | |
| nshmdtype | | |
| nshspi | | |
| nshsi | | |
| nshnextprotocol | | next protocol |
GPRS Tunneling Protocol (GTP)
| Name | Example | Comment |
|---|
| gtp_offset | 42 | GTP header offset from start of packet |
| gtpversion | 1 | |
| gtpmsgtype | 255 | |
| gtpmsglength | 1400 | |
| gtptied | 1634 | tunnel endpoint identifier |
Geneve
| Name | Example | Comment |
|---|
| geneve_offset | | Geneve header offset from start of packet |
| geneveprotocoltype | | |
| genevevni | | virtual network identifier |
DNS
See DNS amplification attacks for an example
| Name | Example | Comment |
|---|
| dns_offset | 42 | DNS header offset from start of packet |
| dnsqr | false | request=false, response=true |
| dnsopcode | 0 | op code |
| dnsaa | false | authoritative answer |
| dnstc | false | truncated |
| dnsrd | false | recursion desired |
| dnsra | true | recursion available |
| dnsz | 0 | reserved |
| dnsrcode | 0 | response code |
| dnsqdcount | 1 | number of entries in question |
| dnsancount | 0 | number of entries in answer |
| dnsnscount | 0 | number of entries in name server section |
| dnsarcount | 0 | number of entries in resources section |
| dnsqname | yahoo.com. | domain name in query |
| dnsqtype | 15 | query type code |
| dnsid | 9409 | query ID |
| dnsqtypename | MX(15) | query type name |
| dnsqclass | 1 | query class |
| requests | 1 | number of requests |
SNMP
| Name | Example | Comment |
|---|
| snmp_offset | 42 | SNMP header offset from start of packet |
| snmpversion | 2c | version |
| snmpcommunity | public | community |
| snmppdu | get_req | message type |
| snmpbytes | 446 | size of SNMP payload |
| requests | 1 | number of requests |
NTP
| Name | Example | Comment |
|---|
| ntp_offset | 46 | NTP header offset from start of packet |
| ntpversion | 2 | version |
| ntpmode | 7 | |
| ntpctlresponse | | |
| ntpctloperation | | |
| ntpctloffset | | |
| ntpctlbytes | | |
| ntppvtresponse | | |
| ntppvtimpl | | |
| ntppvtreq | | |
| ntppvtbytes | | |
| ntpstratum | |
| ntpreferenceid | | |
| requests | 1 | number of requests |
RTP
| Name | Example | Comment |
|---|
| rtp_offset | | RTP header offset from start of packet |
| rtppayload | G.722 | |
| rtpssrc | 8f02 | |
RTCP
| Name | Example | Comment |
|---|
| rtcp_offset | 42 | RTCP header offset from start of packet |
| rtcplostfraction | 0.2 | |
| rtcpjitter | 3 | |
Chargen
| Name | Example | Comment |
|---|
| chargen_offset | 42 | Chargen header offset from start of packet |
| chargen | !"#$%&'()*+,-./01234567 | payload |
| requests | 1 | number of requests |
SSDP
| Name | Example | Comment |
|---|
| ssdp_offset | 42 | SSDP header offset from start of packet |
| ssdpstartline | NOTIFY | |
| requests | 1 | number of requests |
HTTP
| Name | Example | Comment |
|---|
| http_offset | 54 | HTTP header offset from start of packet |
| httpmethod | GET | method |
| httpurl | /index.html | URI as it came from client |
| httpstatus | 200 | status code |
| requests | 1 | number of requests |
SIP
| Name | Example | Comment |
|---|
| sip_offset | 42 | SIP header offset from start of packet |
| sipmethod | INVITE | |
| siptarget | 100@10.0.0.1 | |
| requests | 1 | number of requests |
Application Sockets
See sFlow Host Structures
| Name | Example | Comment |
|---|
| protocol | | |
| serveraddress | | |
| serveraddress6 | | |
| serverport | |
|
| clientaddress | | |
| clientaddress6 | | |
| clientport | | |
| proxyprotocol | | |
| proxyserveraddress | | |
| proxyserveraddress6 | | |
| proxyserverport | |
|
| proxyclientaddress | | |
| proxyclientaddress6 | | |
| proxyclientport | | |
HTTP Operation
See sFlow Blog for articles on HTTP sFlow
| Name | Example | Comment |
|---|
| httpmethod | GET | method |
| httpprotocol | 1.1 | protocol version |
| httphost | sflow-rt.com | Host value from request header |
| httpuseragent | Mozilla/5.0 | User-Agent value from request header |
| httpxff | 10.0.0.1 | X-Forwarded-For value from request header |
| httpauthuser | admin | RFC 1413 identify of user |
| httpmimetype | application/json | Mime-Type of response |
| httpurl | /index.html | URI exactly as it came from client |
| httpreferer | https://sflow-rt.com/index.php | Referer value from request header |
| httpstatus | 200 | status code |
| bytes | 4222 | request + response bytes |
| reqbytes | 1210 | request bytes |
| respbytes | 3012 | response bytes |
| duration | 23110 | duration of operation (in microseconds) |
| requests | 1 | number of requests |
Memcache Operation
See sFlow Blog for articles on Memcache sFlow
| Name | Example | Comment |
|---|
| memcachecommand | GET | |
| memcacheprotocol | | |
| memcachestatus | OK | |
| memcachenumkeys | | |
| bytes | | |
| duration | | |
| requests | 1 | number of requests |
Generic Application Operation
See Scripting languages for article describing how to send generic application transactions
| Name | Example | Comment |
|---|
| appname | | |
| appoperation | | |
| appattributes | | |
| appstatus | 2 | |
| appstatusdescr | TIMEOUT | |
| duration | | |
| bytes | | request + response bytes |
| reqbytes | | request bytes |
| respbytes | | response bytes |
| requests | 1 | number of requests |