Flowmon Collector - Extra Fields

The Flowmon Collector adds these fields to flow records either automatically if the incoming flow record contains the required data or by enabling the appropriate Collector processing module. For more information about processing modules, see Built-in Collector - Processing Modules.

PEN	ID	Field	Description	Length (bytes)	Collector Processing Module
-	16	src autonomous-systems (IPFIX_bgpSourceAsNumber)	The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.	4	Autonomous system list
-	17	dst autonomous-systems (IPFIX_bgpDestinationAsNumber)	The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.	4	Autonomous system list
-	-	src hostname	The captured hostname for the source IP address, if available.	any	DNS information
-	-	dst hostname	The captured hostname for the destination IP address, if available.	any	DNS information
-	-	src country	The country code (ISO 3166-1 numeric) for the source IP address, as determined by geolocation.	2	GeoIP information
-	-	dst country	The country code (ISO 3166-1 numeric) for the destination IP address, as determined by geolocation.	2	GeoIP information
-	-	npm-server-response-time-min	The minimum server response time (SRT) observed for the flow.	4	Normalize flow records
-	-	npm-server-response-time-max	The maximum server response time (SRT) observed for the flow.	4	Normalize flow records
-	-	dns-response-info	Arbitrary DNS response data, such as resource record data or additional information, captured as a string or binary blob.	any	Normalize flow records
39499	1	http-host (IPFIX_INVEA_HOST)	HTTP Hostname string (last 32 bytes).	any	Normalize flow records
39499	2	http-url (IPFIX_INVEA_URL)	HTTP URL string (first 64 bytes).	any	Normalize flow records
39499	69	npm-round-trip-time (IPFIX_INVEA_NPM_RTT)	Round trip time.	4	Normalize flow records
39499	70	npm-server-response-time (IPFIX_INVEA_NPM_SRT)	Server response time.	4	Normalize flow records
39499	71	npm-tcp-retransmission (IPFIX_INVEA_NPM_RETRANSMISSION)	Retransmissions.	4	Normalize flow records
39499	111	dns-flags-codes (IPFIX_INVEA_DNS_FLAGS_CODES)	DNS Flags (includes Operation Code, Response Code, Query/Response flag).	2	Normalize flow records
39499	354	tls-signature-algorithm (IPFIX_FLOWMON_TLS_SIGNATURE_ALG)	TLS signature algorithm	2	Normalize flow records
39499	355	tls-public-key-algorithm (IPFIX_FLOWMON_TLS_PUBLIC_KEY_ALG)	TLS public key algorithm	2	Normalize flow records
39499	356	tls-public-key-length (IPFIX_FLOWMON_TLS_PUBLIC_KEY_LENGTH)	TLS public key length	4	Normalize flow records
-	-	src user-id	The user identity (for example login name or UID) associated with the source of the flow.	any	User identity
-	-	dst user-id	The user identity (for example login name or UID) associated with the destination of the flow.	any	User identity
-	-	listening-port-name	The name or label assigned to the listening port (for example service name or custom label).	any	Enabled by default
-	-	source-group-id	An identifier for the group or set of sources associated with the flow, used for grouping or aggregation.	2	Enabled by default
-	-	start-time-orig	The original timestamp when the flow was first observed in the forward direction.	8	Enabled by default
-	-	end-time-orig	The original timestamp when the flow was last observed in the forward direction.	8	Enabled by default
-	-	uuid	A universally unique identifier (UUID) assigned to the flow record for correlation or tracking.	16	Enabled by default
-	32	icmp-type-code4 (IPFIX_icmpTypeCodeIPv4)	Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.	2	Enabled by default
-	38	engine-type (NF9_ENGINE_TYPE)	Type of flow switching engine: RP = 0, VIP/Linecard = 1.	1	Enabled by default
-	39	engine-id (NF9_ENGINE_ID)	ID number of the flow switching engine.	1	Enabled by default
-	130	exporter4 (IPFIX_exporterIPv4Address)	The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.	4	Enabled by default
-	131	exporter6 (IPFIX_exporterIPv6Address)	The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.	16	Enabled by default
-	139	icmp-type-code6	Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.	2	Enabled by default
-	149	source-id	Observation domain ID or source ID for s-flow.	4	Enabled by default
-	156	start-time (flowStartNanoseconds)	The absolute timestamp of the first packet of this Flow.	8	Enabled by default
-	157	end-time (flowEndNanoseconds)	The absolute timestamp of the last packet of this Flow.	8	Enabled by default
-	176	icmp-type4 (IPFIX_ICMP_TYPE)	ICMP type value.	1	Enabled by default
-	177	icmp-code4 (IPFIX_ICMP_CODE)	ICMP code value.	1	Enabled by default
-	178	icmp-type6 (IPFIX_ICMP_TYPE_IPV6)	ICMP IPv6 type value.	1	Enabled by default
-	179	icmp-code6 (IPFIX_ICMP_CODE_IPV6)	ICMP IPv6 code value.	1	Enabled by default
39499	563	received-time	The timestamp when the flow record was received by the collector.	8	Enabled by default
39499	564	sampling	The sampling interval or rate used for flow data collection (for example 1 out of N packets).	8	Enabled by default