match ipv4/ipv6 version
|
IPv4/IPv6 version from IPv4/IPv6 header.
[1]
|
match ipv4/ipv6 protocol
|
Layer4 protocol from the IPv4/IPv6 header.
|
match application name
|
Application ID
|
match connection client ipv4/ipv6 address
|
Field name: clientIPv4/IPv6Address
IPv4/IPv6 client address in the IP packet header. The client is the device that triggered the session creation, and remains
the same for the life of the session.
[2]
|
match connection server ipv4/ipv6 address
|
Field name: serverIPv4/IPv6Address
IPv4/IPv6 server address in the IP packer header. The server is the device that replies to the client, and remains the same
for the life of the session.
[2]
|
match connection server transport port
|
Field name: serverTransportPort
Server transport port identifier. This may be the source or destination transport port. The server is the device that replies
to the client, and remains the same for the life of the session.
[2]
|
match flow observation point
|
Field name: observationPointId
Identifier of an observation point unique for each observation domain.
[2]
|
collect connection initiator
|
Field name: biflowDirection
Description of the direction assignment method used to assign the Biflow Source and Destination.
[2]
|
collect flow direction
|
Direction (ingress/egress) of the flow observed at the observation point.
|
collect routing vrf input
|
Field name: ingressVRFID
(Applies only to routers, not wireless controllers)
VRF ID from incoming packets on a router. If a packet arrives on an interface that does not belong to a VRF, a VRF ID of 0
is recorded.
|
collect wireless client mac address
|
(Applies only to wireless controllers)
Field name: staMacAddress
The IEEE 802 MAC address of a wireless station (STA).
|
collect timestamp absolute first
|
Field name: flowStartMilliseconds
The absolute timestamp of the first packet of the flow.
|
collect timestamp absolute last
|
Field name: flowEndMilliseconds
The absolute timestamp of the last packet of the flow.
|
collect connection new-connections
|
Field name: connectionCountNew
This information element counts the number of TCP or UDP connections which were opened during the observation period. The
observation period may be specified by the flow start and end timestamps.
[2]
|
collect connection server counter packets long
|
Field name: serverPackets
Number of layer 4 packets in a flow from the server. The server is the device that replies to the client, and remains the
same for the life of the session.
[2]
|
collect connection server counter bytes network long
|
Field name: serverOctets
Overall IP packet bytes in a flow from the server. The server is the device that replies to the client, and remains the same
for the life of the session.
[2]
|
collect connection client counter packets long
|
Field name: clientPackets
Number of layer 4 packets in a flow from the client. The client is the device that triggered the session creation, and remains
the same for the life of the session.
[2]
|
collect connection client counter bytes network long
|
Overall IP packet bytes from client to server.
[2]
|
collect connection delay network client-to-server sum
|
Field name: sumNwkTime
Network delay is the round-trip time between the client and the server, as measured by the observation point, calculated once
per session. The value of this information element is the sum of all network delays observed for the sessions of this flow.
[2] [3]
|
collect connection delay network to-server sum
|
Field name: sumServerNwkTime
Server network delay is the round-trip time between the observation point and the server, calculated once per session. The
value of this information element is the sum of all server network delays observed for the sessions of this flow.
[2] [3]
|
collect connection client counter packets retransmitted
|
Field name: retransClientPackets
Number of packets retransmitted by the client.
[2] [3]
|
collect connection server counter packets retransmitted
|
Field name: retransServerPackets
Number of packets retransmitted by the server.
[3]
|
collect connection delay application sum
|
Field name: sumServerRespTime
The sum of all application delays observed for all responses of the flow.
[2] [3]
|
collect connection server counter responses
|
Field name: numRespsCountDelta
Total number of responses sent by the server.
[2] [3]
|