Contents

Introduction

Prerequisites

Template IDs

Standard NetFlow Elements

Enterprise-Specific Elements

Template Formats

IPv4 First Flow - Template 317

IPv4 First Flow Deep - Template 318

IPv4 Flow - Template 319

IPv4 Event - Template 320

IPv6 First Flow - Template 321

IPv6 First Flow Deep - Template 322

IPv6 Flow - Template 323

IPv6 Event - Template 324

IPv4 Source Email Counts - Template 325

IPv4 First Flow Response Time Monitoring - Template 326

IPv4 First Flow Deep Response Time Monitoring - Template 327

IPv4 Flow Response Time Monitoring - Template 328

IPv6 First Flow Response Time Monitoring - Template 329

IPv6 First Flow Deep Response Time Monitoring - Template 330

IPv6 Flow Response Time Monitoring - Template 331

IPv4 Destination Email Counts - Template 332

IPv6 Source Email Counts - Template 333

IPv6 Destination Email Counts - Template 334

IPv4 First Flow IPFIX Template 335

IPv4 First Flow Deep IPFIX - Template 336

IPv4 Flow IPFIX - Template 337

IPv4 Event IPFIX - Template 338

IPv6 First Flow IPFIX - Template 339

IPv6 First Flow Deep IPFIX - Template 340

IPv6 Flow IPFIX - Template 341

IPv6 Event IPFIX - Template 342

IPv4 Source Email Counts IPFIX - Template 343

IPv4 First Flow Response Time Monitoring - Template 344

IPv4 First Flow Deep Response Time Monitoring - Template 345

IPv4 Flow Response Time Monitoring IPFIX - Template 346

IPv6 First Flow Response Time Monitoring IPFIX - Template 347

IPv6 First Flow Deep RTM IPFIX - Template 348

IPv6 Flow Response Time Monitoring - Template 349

IPv4 Destination Email Counts IPFIX - Template 350

IPv6 Source Email Counts IPFIX - Template 351

IPv6 Destination Email Counts IPFIX - Template 352

Introduction

This document describes the NetFlow templates used by the Flow Sensor, this includes information such as size/format and Enterprise-specific elements

Prerequisites

The NetFlow element IDs used here are standard netflow protocol, however the template information and which elements included in each template are subject to change at any time.

Template IDs

Note: The templates with an asterisk (*) beside them contain the basic NetFlow v9/IPFIX fields found on the IANA list for standard flow creation and analysis.

IPV4_FIRST_FLOW_TEMPLATE_ID 317*

IPV4_FIRST_FLOW_DEEP_TEMPLATE_ID 318*

IPV4_FLOW_TEMPLATE_ID 319*

IPV4_EVENT_TEMPLATE_ID 320

IPV6_FIRST_FLOW_TEMPLATE_ID 321*

IPV6_FIRST_FLOW_DEEP_TEMPLATE_ID 322*

IPV6_FLOW_TEMPLATE_ID 323*

IPV6_EVENT_TEMPLATE_ID 324

IPV4_SRC_EMAIL_COUNTS_TEMPLATE_ID 325

IPV4_FIRST_FLOW_RTM_TEMPLATE_ID 326*

IPV4_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID 327*

IPV4_FLOW_RTM_TEMPLATE_ID 328*

IPV6_FIRST_FLOW_RTM_TEMPLATE_ID 329*

IPV6_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID 330*

IPV6_FLOW_RTM_TEMPLATE_ID 331*

IPV4_DST_EMAIL_COUNTS_TEMPLATE_ID 332

IPV6_SRC_EMAIL_COUNTS_TEMPLATE_ID 333

IPV6_DST_EMAIL_COUNTS_TEMPLATE_ID 334

IPV4_FIRST_FLOW_IPFIX_TEMPLATE_ID 335*

IPV4_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID 336*

IPV4_FLOW_IPFIX_TEMPLATE_ID 337*

IPV4_EVENT_IPFIX_TEMPLATE_ID 338

IPV6_FIRST_FLOW_IPFIX_TEMPLATE_ID 339*

IPV6_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID 340*

IPV6_FLOW_IPFIX_TEMPLATE_ID 341*

IPV6_EVENT_IPFIX_TEMPLATE_ID 342

IPV4_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID 343

IPV4_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID 344*

IPV4_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID 345*

IPV4_FLOW_RTM_IPFIX_TEMPLATE_ID 346*

IPV6_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID 347*

IPV6_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID 348*

IPV6_FLOW_RTM_IPFIX_TEMPLATE_ID 349*

IPV4_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID 350

IPV6_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID 351

IPV6_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID 352

Standard NetFlow Elements

NF_F_IN_BYTES 1

NF_F_IN_PKTS 2

NF_F_PROTOCOL 4

NF_F_SRC_TOS 5

NF_F_TCP_FLAGS 6

NF_F_L4_SRC_PORT 7

NF_F_SRC_ADDR_IPV4 8

NF_F_SRC_INTF_ID 10

NF_F_L4_DST_PORT 11

NF_F_DST_ADDR_IPV4 12

NF_F_DST_INTF_ID 14

NF_F_LAST_SWITCHED 21

NF_F_FIRST_SWITCHED 22

NF_F_SRC_ADDR_IPV6 27

NF_F_DST_ADDR_IPV6 28

NF_F_MIN_TTL 52

NF_F_IN_SRC_MAC 56

NF_F_OUT_DST_MAC 57

NF_F_SRC_VLAN 58

NF_F_MPLS_LABEL_1 70

NF_F_SYSTEM_INIT_TIME_MILLISECONDS 160

NF_F_TCP_SYN_TOTAL_COUNT 218

NF_F_TCP_FIN_TOTAL_COUNT 219

NF_F_TCP_RST_TOTAL_COUNT 220

NF_F_TCP_ACK_TOTAL_COUNT 222

NF_F_IP_SECTION_HEADER 313

NF_F_IP_SECTION_PAYLOAD 314

Enterprise-Specific Elements

Note: The Flow Sensor uses Lancope Information Element Identifier Definitions: Private Enterprise Number (PEN) - 8712

More information about these elements is available in the Secure Analytics Information Elements guide

NF_F_FLOWSENSOR_INITIATOR 29794

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT 29795

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT 29796

NF_F_FLOWSENSOR_RTT 29797

NF_F_FLOWSENSOR_SVR_RESP 29798

NF_F_FLOWSENSOR_RETRANSMITS 29799

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT 29800

NF_F_FLOWSENSOR_TCP_FRAG_TOTAL_COUNT 29801

NF_F_FLOWSENSOR_SRC_EMAIL_IN 29802

NF_F_FLOWSENSOR_SRC_EMAIL_OUT 29803

NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS 29804

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS 29805

NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS 29806

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS 29807

NF_F_FLOWSENSOR_DST_EMAIL_IN 29808

NF_F_FLOWSENSOR_DST_EMAIL_OUT 29809

NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS 29810

NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS 29811

NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS 29812

NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS 29813

NF_F_FLOWSENSOR_TRACES 29814

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL 29817

NF_F_FLOWSENSOR_EMB_ICMP_TYPE 29818

NF_F_FLOWSENSOR_EMB_ICMP_CODE 29819

NF_F_FLOWSENSOR_APPLICATION_ID 29820

NF_F_FLOWSENSOR_BAD_FLAG_XMAS 29821

NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN 29822

NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST 29823

NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK 29824

NF_F_FLOWSENSOR_BAD_FLAG_URG 29825

NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG 29826

NF_F_FLOWSENSOR_BAD_TCP_PROBE 29827

NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK 29828

NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT 29829

NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG 29830

NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES 29831

NF_F_FLOWSENSOR_APPLICATION_DETAILS 29832

Template Formats

Note: Each template includes the Template Name and field count, followed by the individual NetFlow/IPFIX fields and the size of each field (in bytes).

Note that Enterprise-specific IPFIX elements are ored with 0x8000 to turn on the high bit, so the collector knows that the Private Enterprise Number (PEN) field is present.

An example with NetFlow v9 and Enterprise-specific IPFIX elements is included.

TEMPLATE_NAME, ## <-- Field Count (Total number of NF_F fields in the template)

FIELD_NAME_V9, # <-- Field size (in bytes)

ENTERPRISE_FIELD_NAME_IPFIX | 0x8000, # <-- Field size (in bytes)

0000, 8712 <-- Private Enterprise Number (PEN)

IPv4 First Flow - Template 317

Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine.

IPV4_FIRST_FLOW_TEMPLATE_ID, 31

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv4 First Flow Deep - Template 318

Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

IPV4_FIRST_FLOW_DEEP_TEMPLATE_ID, 33

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv4 Flow - Template 319

Note: This template is used for follow-on v9 exports of IPv4 flow information from a flow slot in the Flow Sensor engine.

IPV4_FLOW_TEMPLATE_ID, 25

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv4 Event - Template 320

Note: This template is used for v9 exports of IPv4 bad fragment and flag combination counts detected by the Flow Sensor engine.

IPV4_EVENT_TEMPLATE_ID, 18

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_PROTOCOL, 1

NF_F_FLOWSENSOR_BAD_FLAG_XMAS, 2

NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN, 2

NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST, 2

NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK, 2

NF_F_FLOWSENSOR_BAD_FLAG_URG, 2

NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG, 2

NF_F_FLOWSENSOR_BAD_TCP_PROBE, 2

NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK, 2

NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT, 2

NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG, 2

NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES, 2

IPv6 First Flow - Template 321

Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine.

IPV6_FIRST_FLOW_TEMPLATE_ID, 31

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv6 First Flow Deep - Template 322

Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

IPV6_FIRST_FLOW_DEEP_TEMPLATE_ID, 33

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv6 Flow - Template 323

Note: This template is used for follow-on v9 exports of IPv6 flow information from a flow slot in the Flow Sensor engine.

IPV6_FLOW_TEMPLATE_ID, 25

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv6 Event - Template 324

Note: This template is used for v9 exports of IPv6 bad fragment and flag combination counts detected by the Flow Sensor engine.

IPV6_EVENT_TEMPLATE_ID, 18

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_PROTOCOL, 1

NF_F_FLOWSENSOR_BAD_FLAG_XMAS, 2

NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN, 2

NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST, 2

NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK, 2

NF_F_FLOWSENSOR_BAD_FLAG_URG, 2

NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG, 2

NF_F_FLOWSENSOR_BAD_TCP_PROBE, 2

NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK, 2

NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT, 2

NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG, 2

NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES, 2

IPv4 Source Email Counts - Template 325

Note: This template is used for v9 exports of IPv4 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

IPV4_SRC_EMAIL_COUNTS_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_FLOWSENSOR_SRC_EMAIL_IN, 4

NF_F_FLOWSENSOR_SRC_EMAIL_OUT, 4

NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS, 4

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS, 4

NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS, 4

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS, 4

IPv4 First Flow Response Time Monitoring - Template 326

Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV4_FIRST_FLOW_RTM_TEMPLATE_ID, 34

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_RTT, 4

NF_F_FLOWSENSOR_SVR_RESP, 4

NF_F_FLOWSENSOR_RETRANSMITS, 2

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv4 First Flow Deep Response Time Monitoring - Template 327

Note: This template is used for the initial v9 export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected and RTM data has been computed.

IPV4_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID, 36

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_RTT, 4

NF_F_FLOWSENSOR_SVR_RESP, 4

NF_F_FLOWSENSOR_RETRANSMITS, 2

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv4 Flow Response Time Monitoring - Template 328

Note: This template is used for follow-on v9 exports of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV4_FLOW_RTM_TEMPLATE_ID, 28

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_RTT, 4

NF_F_FLOWSENSOR_SVR_RESP, 4

NF_F_FLOWSENSOR_RETRANSMITS, 2

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv6 First Flow Response Time Monitoring - Template 329

Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV6_FIRST_FLOW_RTM_TEMPLATE_ID, 34

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_RTT, 4

NF_F_FLOWSENSOR_SVR_RESP, 4

NF_F_FLOWSENSOR_RETRANSMITS, 2

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv6 First Flow Deep Response Time Monitoring - Template 330

Note: This template is used for the initial v9 export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected and RTM data has been computed.

IPV6_FIRST_FLOW_DEEP_RTM_TEMPLATE_ID, 36

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_RTT, 4

NF_F_FLOWSENSOR_SVR_RESP, 4

NF_F_FLOWSENSOR_RETRANSMITS, 2

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv6 Flow Response Time Monitoring - Template 331

Note: This template is used for follow-on v9 exports of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV6_FLOW_RTM_TEMPLATE_ID, 28

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TRACES, 2

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL, 1

NF_F_FLOWSENSOR_EMB_ICMP_TYPE, 1

NF_F_FLOWSENSOR_EMB_ICMP_CODE, 1

NF_F_FLOWSENSOR_RTT, 4

NF_F_FLOWSENSOR_SVR_RESP, 4

NF_F_FLOWSENSOR_RETRANSMITS, 2

NF_F_FLOWSENSOR_APPLICATION_ID, 4

IPv4 Destination Email Counts - Template 332

Note: This template is used for v9 exports of IPv4 email counts information received by the destination IP address as detected by the Flow Sensor engine.

IPV4_DST_EMAIL_COUNTS_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_FLOWSENSOR_DST_EMAIL_IN, 4

NF_F_FLOWSENSOR_DST_EMAIL_OUT, 4

NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS, 4

NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS, 4

NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS, 4

NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS, 4

IPv6 Source Email Counts - Template 333

Note: This template is used for v9 exports of IPv6 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

IPV6_SRC_EMAIL_COUNTS_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_FLOWSENSOR_SRC_EMAIL_IN, 4

NF_F_FLOWSENSOR_SRC_EMAIL_OUT, 4

NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS, 4

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS, 4

NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS, 4

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS, 4

IPv6 Destination Email Counts - Template 334

Note: This template is used for v9 exports of IPv6 email counts information received by the destination IP address as detected by the Flow Sensor engine.

IPV6_DST_EMAIL_COUNTS_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_FLOWSENSOR_DST_EMAIL_IN, 4

NF_F_FLOWSENSOR_DST_EMAIL_OUT, 4

NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS, 4

NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS, 4

NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS, 4

NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS, 4

IPv4 First Flow IPFIX Template 335

Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine.

IPV4_FIRST_FLOW_IPFIX_TEMPLATE_ID, 33

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv4 First Flow Deep IPFIX - Template 336

Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

IPV4_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID, 35

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv4 Flow IPFIX - Template 337

Note: This template is used for follow-on IPFIX exports of IPv4 flow information from a flow slot in the Flow Sensor engine.

IPV4_FLOW_IPFIX_TEMPLATE_ID, 27

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv4 Event IPFIX - Template 338

Note: This template is used for IPFIX exports of IPv4 bad fragment and flag combination counts detected by the Flow Sensor engine.

IPV4_EVENT_IPFIX_TEMPLATE_ID, 19

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_PROTOCOL, 1

NF_F_FLOWSENSOR_BAD_FLAG_XMAS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_URG | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_TCP_PROBE | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES | 0x8000, 2

0000, 8712

IPv6 First Flow IPFIX - Template 339

Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine.

IPV6_FIRST_FLOW_IPFIX_TEMPLATE_ID, 33

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv6 First Flow Deep IPFIX - Template 340

Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

IPV6_FIRST_FLOW_DEEP_IPFIX_TEMPLATE_ID, 35

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv6 Flow IPFIX - Template 341

Note: This template is used for follow-on IPFIX exports of IPv6 flow information from a flow slot in the Flow Sensor engine.

IPV6_FLOW_IPFIX_TEMPLATE_ID, 27

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv6 Event IPFIX - Template 342

Note: This template is used for IPFIX exports of IPv6 bad fragment and flag combination counts detected by the Flow Sensor engine.

IPV6_EVENT_IPFIX_TEMPLATE_ID, 19

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_PROTOCOL, 1

NF_F_FLOWSENSOR_BAD_FLAG_XMAS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_SYN_FIN | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_BAD_RST | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_NO_ACK | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_URG | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_FLAG_NOFLAG | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_BAD_TCP_PROBE | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_SHORT_FRAG_ATTACK | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_FRAG_PKT_TOO_SHORT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_FRAG_PKT_TOO_LONG | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_FRAG_DIFFERENT_SIZES | 0x8000, 2

0000, 8712

IPv4 Source Email Counts IPFIX - Template 343

Note: This template is used for IPFIX exports of IPv4 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

IPV4_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_FLOWSENSOR_SRC_EMAIL_IN | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_OUT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS | 0x8000, 4

0000, 8712

IPv4 First Flow Response Time Monitoring - Template 344

Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV4_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID, 36

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_RTT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv4 First Flow Deep Response Time Monitoring - Template 345

Note: This template is used for the initial IPFIX export of IPv4 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

IPV4_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID, 38

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_RTT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv4 Flow Response Time Monitoring IPFIX - Template 346

Note: This template is used for follow-on IPFIX exports of IPv4 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV4_FLOW_RTM_IPFIX_TEMPLATE_ID, 30

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_RTT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv6 First Flow Response Time Monitoring IPFIX - Template 347

Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV6_FIRST_FLOW_RTM_IPFIX_TEMPLATE_ID, 36

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_RTT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv6 First Flow Deep RTM IPFIX - Template 348

Note: This template is used for the initial IPFIX export of IPv6 flow information from a flow slot in the Flow Sensor engine when the Export Packet Payload check box is selected.

IPV6_FIRST_FLOW_DEEP_RTM_IPFIX_TEMPLATE_ID, 38

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_SRC_MAC, 6

NF_F_OUT_DST_MAC, 6

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_SRC_VLAN, 2

NF_F_MPLS_LABEL_1, 3

NF_F_MIN_TTL, 1

NF_F_SRC_TOS, 1

NF_F_IP_SECTION_HEADER, 64

NF_F_IP_SECTION_PAYLOAD, 26

NF_F_FLOWSENSOR_INITIATOR | 0x8000, 1

0000, 8712

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_RTT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv6 Flow Response Time Monitoring - Template 349

Note: This template is used for follow-on IPFIX exports of IPv6 flow information from a flow slot in the Flow Sensor engine when RTM data has been computed.

IPV6_FLOW_RTM_IPFIX_TEMPLATE_ID, 30

NF_F_FIRST_SWITCHED, 4

NF_F_LAST_SWITCHED, 4

NF_F_SYSTEM_INIT_TIME_MILLISECONDS, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_L4_SRC_PORT, 2

NF_F_L4_DST_PORT, 2

NF_F_IN_BYTES, 4

NF_F_IN_PKTS, 4

NF_F_SRC_INTF_ID, 2

NF_F_DST_INTF_ID, 2

NF_F_PROTOCOL, 1

NF_F_TCP_FLAGS, 1

NF_F_MIN_TTL, 1

NF_F_TCP_SYN_TOTAL_COUNT, 2

NF_F_TCP_ACK_TOTAL_COUNT, 2

NF_F_TCP_FIN_TOTAL_COUNT, 2

NF_F_TCP_RST_TOTAL_COUNT, 2

NF_F_FLOWSENSOR_TCP_BAD_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SRS_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TCP_SYN_ACK_TOTAL_COUNT | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_TRACES | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_PROTOCOL | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_TYPE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_EMB_ICMP_CODE | 0x8000, 1

0000, 8712

NF_F_FLOWSENSOR_RTT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SVR_RESP | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_RETRANSMITS | 0x8000, 2

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_ID | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_APPLICATION_DETAILS | 0x8000, 65535

0000, 8712

IPv4 Destination Email Counts IPFIX - Template 350

Note: This template is used for IPFIX exports of IPv4 email counts information received by the destination IP address as detected by the Flow Sensor engine.

IPV4_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV4, 4

NF_F_DST_ADDR_IPV4, 4

NF_F_FLOWSENSOR_DST_EMAIL_IN | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_OUT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS | 0x8000, 4

0000, 8712

IPv6 Source Email Counts IPFIX - Template 351

Note: This template is used for IPFIX exports of IPv6 email counts information sourced from the source IP address as detected by the Flow Sensor engine.

IPV6_SRC_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_FLOWSENSOR_SRC_EMAIL_IN | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_OUT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_IN_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_IN_TRYS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_SRC_EMAIL_OUT_TRYS | 0x8000, 4

0000, 8712

IPv6 Destination Email Counts IPFIX - Template 352

Note: This template is used for IPFIX exports of IPv6 email counts information received by the destination IP address as detected by the Flow Sensor engine.

IPV6_DST_EMAIL_COUNTS_IPFIX_TEMPLATE_ID, 8

NF_F_SRC_ADDR_IPV6, 16

NF_F_DST_ADDR_IPV6, 16

NF_F_FLOWSENSOR_DST_EMAIL_IN | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_OUT | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_IN_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_OUT_MESS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_IN_TRYS | 0x8000, 4

0000, 8712

NF_F_FLOWSENSOR_DST_EMAIL_OUT_TRYS | 0x8000, 4

0000, 8712