IPFIX
- Last Updated: May 27, 2026
- 36 minute read
- Flowmon Products
- Flowmon
- Documentation
Note:
When you configure a monitoring port to use IPFIX as its export protocol, fields marked as "Exported by default" are automatically included in the export.
| PEN | ID | Field | Description | Input Length (bytes) | Probe Configuration |
|---|---|---|---|---|---|
| - | 1 | in bytes (IPFIX_octetDeltaCount) | The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload. | 8 | Exported by default |
| 29305 | 1 | in rev bytes | The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. This includes IP headers and payload (IPFIX octetDeltaCount). This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 2 | in packets (IPFIX_packetDeltaCount) | The number of incoming packets since the previous report (if any) for this Flow at the Observation point. | 8 | Exported by default |
| 29305 | 2 | in rev packets | The number of incoming packets since the previous report (if any) for this Flow at the Observation Point (IPFIX packetDeltaCount). This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 3 | flows | The conservative count of Original Flows contributing to this Aggregated Flow; may be distributed using any of the methods expressed by the valueDistributionMethod Information Element. | 8 | Not applicable |
| - | 4 | protocol (IPFIX_protocolIdentifier) | The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. | 1 | Exported by default |
| - | 5 | src type-of-service (IPFIX_ipClassOfService) | For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header. | 1 | Enabled by L3/L4 Extended |
| - | 6 | flags (IPFIX_tcpControlBits) | TCP control bits observed for packets of this Flow. The information is encoded in a set of bit fields. For each TCP control bit, there is a bit in this set. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. A value of 0 for a bit indicates that the corresponding bit was not set in any of the observed packets of this Flow. | 1 | Exported by default |
| 29305 | 6 | rev flags | TCP control bits observed for packets of this Flow, encoded as a set of bit fields (IPFIX tcpControlBits). This is the reverse direction field in a bi-flow record. | 1 | Not supported |
| - | 7 | src port (IPFIX_SourceTransportPort) | The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. | 2 | Enabled by L3/L4 Extended |
| - | 8 | src ip4 (IPFIX_SourceIPv4Address) | The IPv4 source address in the IP packet header. | 4 | Exported by default |
| - | 9 | src prefix4 (IPFIX_SourceIPv4PrefixLength) | The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element. | 1 | Exported by default |
| - | 10 | in interface (IPFIX_ingressInterface) | The index of the IP interface where packets of this Flow are being received. The value matches the value of the managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. | 4 | Exported by default |
| - | 11 | dst port (IPFIX_DestinationTransportPort) | The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers. | 2 | Exported by default |
| - | 12 | dst ip4 (IPFIX_DestinationIPv4Address) | The IPv4 destination address in the IP packet header. Abstract Data Type: ipv4Address. | 4 | Exported by default |
| - | 13 | dst prefix4 (IPFIX_DestinationIPv4PrefixLength) | The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element. | 1 | Exported by default |
| - | 14 | out interface (IPFIX_egressInterface) | The index of the IP interface where packets of this Flow are being sent. The value matches the value of the managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. | 4 | Exported by default, configurable per monitoring port |
| - | 15 | next-hop4 (IPFIX_ipNextHopIPv4Address) | The IPv4 address of the next IPv4 hop. | 4 | Not applicable |
| 29305 | 15 | rev next-hop4 | The IPv4 address of the next IPv4 hop (IPFIX ipNextHopIPv4Address). This is the reverse direction field in a bi-flow record. | 4 | Not applicable |
| - | 16 | src autonomous-systems (IPFIX_bgpSourceAsNumber) | The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Enabled by 'Use autonomous system list' |
| - | 17 | dst autonomous-systems (IPFIX_bgpDestinationAsNumber) | The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Enabled by 'Use autonomous system list' |
| - | 18 | bgp-next4 (IPFIX_bgpNextHopIPv4Address) | The IPv4 address of the next (adjacent) BGP hop. | 4 | Not applicable |
| 29305 | 18 | rev bgp-next4 | The IPv4 address of the next (adjacent) BGP hop (IPFIX bgpNextHopIPv4Address). This is the reverse direction field in a bi-flow record. | 4 | Not applicable |
| - | 21 | end-uptime (IPFIX_flowEndSysUpTime) | The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). | 8 | Not supported |
| 29305 | 21 | rev end-uptime | The relative timestamp of the last packet of this Flow. Indicates milliseconds since the last (re-)initialization of the IPFIX Device (IPFIX flowEndSysUpTime). This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 22 | start-uptime (IPFIX_flowStartSysUpTime) | The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). | 8 | Not supported |
| 29305 | 22 | rev start-uptime | The relative timestamp of the first packet of this Flow. Indicates milliseconds since the last (re-)initialization of the IPFIX Device (IPFIX flowStartSysUpTime). This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 23 | out bytes (IPFIX_postOctetDeltaCount) | The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not applicable |
| 29305 | 23 | out rev bytes | Modified octet count caused by a middlebox function after the packet passed the Observation Point (IPFIX postOctetDeltaCount). This is the reverse direction field in a bi-flow record. | 8 | Not applicable |
| - | 24 | out packets (IPFIX_postPacketDeltaCount) | The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not applicable |
| 29305 | 24 | out rev packets | Modified packet count caused by a middlebox function after the packet passed the Observation Point (IPFIX postPacketDeltaCount). This is the reverse direction field in a bi-flow record. | 8 | Not applicable |
| - | 27 | src ip6 (IPFIX_SourceIPv6Address) | The IPv6 source address in the IP packet header. | 16 | Exported by default |
| - | 28 | dst ip6 (IPFIX_DestinationIPv6Address) | The IPv6 destination address in the IP packet header. | 16 | Exported by default |
| - | 29 | src prefix6 (IPFIX_SourceIPv6PrefixLength) | The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element. | 1 | Exported by default |
| - | 30 | dst prefix6 (IPFIX_DestinationIPv6PrefixLength) | The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element. | 1 | Exported by default |
| - | 32 | icmp-type-code4 (IPFIX_icmpTypeCodeIPv4) | Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. | 2 | Exported by default |
| - | 34 | sampler1-interval (IPFIX_samplingInterval) | When using sampled NetFlow, the rate at which packets are sampled, for example: a value of 100 indicates that one of every 100 packets is sampled. | 4 | Exported by default |
| - | 35 | sampler1-algo (IPFIX_samplingAlgorithm) | The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling ,0x02 Random Sampling. | 1 | Exported by default |
| - | 36 | flow-active-timeout | The timeout interval for active flows, in seconds (IPFIX flowActiveTimeout). | 2 | Not supported |
| - | 38 | engine-type (NF9_ENGINE_TYPE) | Type of flow switching engine: RP = 0, VIP/Linecard = 1. | 1 | Not applicable |
| - | 39 | engine-id (NF9_ENGINE_ID) | ID number of the flow switching engine. | 1 | Not applicable |
| - | 48 | sampler2-id (IPFIX_samplerId) | Identifier shown in "show flow-sampler". | 4 | Not supported |
| - | 49 | sampler2-mode (IPFIX_samplerMode) | The type of algorithm used for sampling data: 0x02 random sampling. Use in connection with NF9_FLOW_SAMPLER_ID. | 1 | Not supported |
| - | 50 | sampler2-random (IPFIX_samplerRandomInterval) | Packet interval at which to sample. Use in connection with NF9_FLOW_SAMPLER_MODE. | 4 | Not supported |
| - | 55 | dst type-of-service (IPFIX_postIpClassOfService) | The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 1 | Not applicable |
| - | 56 | src in mac (IPFIX_SourceMacAddress) | The IEEE 802 source MAC address field. | 6 | Enabled by MAC |
| - | 57 | dst out mac (IPFIX_postDestinationMacAddress) | The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 6 | Not applicable |
| - | 58 | src c-vlan (IPFIX_vlanId) | Virtual LAN identifier associated with the ingress interface. | 2 | Enabled by VLAN |
| 29305 | 58 | src rev c-vlan | Reverse direction - Virtual LAN identifier associated with the ingress interface. | 2 | Not supported |
| - | 59 | dst c-vlan (IPFIX_postVlanId) | Virtual LAN identifier associated with the ingress interface. This element reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| 29305 | 59 | dst rev c-vlan | Reverse direction - Virtual LAN identifier associated with the ingress interface. This element reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| - | 61 | direction (IPFIX_flowDirection) | The direction of the Flow observed at the Observation Point. There are only two values defined. | 1 | Not applicable |
| - | 62 | next-hop6 (IPFIX_ipNextHopIPv6Address) | The IPv6 address of the next IPv6 hop. | 16 | Not applicable |
| 29305 | 62 | rev next-hop6 | The IPv6 address of the next IPv6 hop. This is the reverse direction field in a bi-flow record. | 16 | Not applicable |
| - | 63 | bgp-next6 (IPFIX_bgpNextHopIPv6Address) | The IPv6 address of the next (adjacent) BGP hop. | 16 | Not applicable |
| 29305 | 63 | rev bgp-next6 | The IPv6 address of the next (adjacent) BGP hop. This is the reverse direction field in a bi-flow record. | 16 | Not applicable |
| - | 70 | mpls1-stack (IPFIX_mplsTopLabelStackSection) | The Label, Exp, and S fields from the top MPLS label stack entry, that is, from the last label that was pushed. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| - | 71 | mpls2-stack (IPFIX_mplsLabelStackSection2) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| - | 72 | mpls3-stack (IPFIX_mplsLabelStackSection3) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| - | 73 | mpls4-stack (IPFIX_mplsLabelStackSection4) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| - | 74 | mpls5-stack (IPFIX_mplsLabelStackSection5) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| - | 75 | mpls6-stack (IPFIX_mplsLabelStackSection6) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| - | 76 | mpls7-stack (IPFIX_mplsLabelStackSection7) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| - | 77 | mpls8-stack (IPFIX_mplsLabelStackSection8) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| - | 78 | mpls9-stack (IPFIX_mplsLabelStackSection9) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| - | 79 | mpls10-stack (IPFIX_mplsLabelStackSection10) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| - | 80 | dst in mac (IPFIX_DestinationMacAddress) | The IEEE 802 destination MAC address field. | 6 | Enabled by MAC |
| - | 81 | src out mac (IPFIX_postSourceMacAddress) | The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 6 | Not applicable |
| - | 85 | in total-bytes (IPFIX_octetTotalCount) | The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. | 8 | Not supported |
| 29305 | 85 | in rev total-bytes | The total number of octets in incoming packets for this Flow since the Metering Process initialization (IPFIX octetTotalCount). This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 86 | in total-packets (IPFIX_packetTotalCount) | The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. | 8 | Not supported |
| 29305 | 86 | in rev total-packets | The total number of incoming packets for this Flow since the Metering Process initialization (IPFIX packetTotalCount). This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 89 | fwd-status (IPFIX_forwardingStatus) | Forwarding status is encoded on 1 byte with the 2 left bits giving the status and the 6 remaining bits giving the reason code. | 1 | Not applicable |
| - | 90 | route-distinguisher-data (IPFIX_mplsVpnRouteDistinguisher) | The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. The route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made to be open to future size changes. This idea was adopted when choosing octetArray as an abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. | 8 | Not applicable |
| - | 95 | application-id (IPFIX_applicationId) | Specifies an Application ID. | 4 | Enabled by NBAR2 |
| - | 128 | next-as (IPFIX_bgpAdjNextAs) | The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If the AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Not applicable |
| - | 129 | prev-as (IPFIX_bgpAdjPrevAs) | The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If the AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value. | 4 | Not applicable |
| - | 130 | exporter4 (IPFIX_exporterIPv4Address) | The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. | 4 | Not supported |
| - | 131 | exporter6 (IPFIX_exporterIPv6Address) | The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. | 16 | Not supported |
| - | 136 | flow-end-reason | The reason for Flow termination. Values are listed in the flowEndReason registry. | 1 | Exported by default |
| - | 139 | icmp-type-code6 | Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. | 2 | Not supported |
| - | 148 | nsel-connection-id (IPFIX_CONN_ID) | An identifier of a unique flow for the device. | 8 | Not applicable |
| - | 149 | source-id | Observation domain ID or source ID for s-flow. | 4 | Not supported |
| - | 150 | start-time (IPFIX_flowStartSeconds) | The absolute timestamp of the first packet of this Flow. | 8 | Not supported |
| 29305 | 150 | rev start-time | The absolute timestamp of the first packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 151 | end-time (IPFIX_flowEndSeconds) | The absolute timestamp of the last packet of this Flow. | 8 | Not supported |
| 29305 | 151 | rev end-time | The absolute timestamp of the last packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 152 | start-time (IPFIX_flowStartMilliseconds) | The absolute timestamp of the first packet of this Flow. | 8 | Exported by default |
| 29305 | 152 | rev start-time | The absolute timestamp of the first packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 153 | end-time (IPFIX_flowEndMilliseconds) | The absolute timestamp of the last packet of this Flow. | 8 | Exported by default |
| 29305 | 153 | rev end-time | The absolute timestamp of the last packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 154 | start-time (flowStartMicroseconds) | The absolute timestamp of the first packet of this Flow. | 8 | Not supported |
| 29305 | 154 | rev start-time | The absolute timestamp of the last packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 155 | end-time (flowEndMicroseconds) | The absolute timestamp of the last packet of this Flow. | 8 | Not supported |
| 29305 | 155 | rev end-time | The absolute timestamp of the last packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 156 | start-time (flowStartNanoseconds) | The absolute timestamp of the first packet of this Flow. | 8 | Not supported |
| 29305 | 156 | rev start-time | The absolute timestamp of the first packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 157 | end-time (flowEndNanoseconds) | The absolute timestamp of the last packet of this Flow. | 8 | Not supported |
| 29305 | 157 | rev end-time | The absolute timestamp of the last packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 160 | sys-init-time (systemInitTimeMilliseconds) | The absolute timestamp of the last (re-)initialization of the IPFIX Device. | 8 | Not supported |
| - | 161 | flow-duration (NF_F_FLOW_DURATION_MSEC) | The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. | 8 | Not supported |
| 29305 | 161 | rev flow-duration (NF_F_FLOW_DURATION_MSEC) | The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 171 | out total-bytes | The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not supported |
| 29305 | 171 | out rev total-bytes | The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 172 | out total-packets | The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not supported |
| 29305 | 172 | out rev total-packets | The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 176 | icmp-type4 (IPFIX_ICMP_TYPE) | ICMP type value. | 1 | Not applicable |
| - | 177 | icmp-code4 (IPFIX_ICMP_CODE) | ICMP code value. | 1 | Not applicable |
| - | 178 | icmp-type6 (IPFIX_ICMP_TYPE_IPV6) | ICMP IPv6 type value. | 1 | Not applicable |
| - | 179 | icmp-code6 (IPFIX_ICMP_CODE_IPV6) | ICMP IPv6 code value. | 1 | Not applicable |
| - | 180 | src udp-port (x) | The source port identifier in the UDP header. | 2 | Not supported |
| - | 181 | dst udp-port (IPFIX_DestinationTransportPort) | The destination port identifier in the UDP header. | 2 | Not supported |
| - | 182 | src tcp-port | The source port identifier in the TCP header. | 2 | Not supported |
| - | 183 | dst tcp-port | The destination port identifier in the TCP header. | 2 | Not supported |
| - | 186 | tcp-window-size (IPFIX_tcpWindowSize) | The window field in the TCP header. If the TCP window scale is supported, then the TCP window scale must be known to fully interpret the value of this information. | 2 | Enabled by L3/L4 Extended |
| - | 225 | src nat-ip (IPFIX_POST_NAT_SRC_IPV4) | The IPv4 source address in the IP packet header. It reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point. | 4 | Not applicable |
| - | 226 | dst nat-ip (IPFIX_POST_NAT_DST_IPV4) | The IPv4 destination address in the IP packet header. It reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point. | 4 | Not applicable |
| - | 227 | src nat-port (IPFIX_POST_NAPT_SRC_PORT) | The source port identifier in the transport protocol header. For transport protocols such as UDP, TCP, SCTP, and DCCP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. It reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| - | 228 | dst nat-port (IPFIX_POST_NAPT_DST_PORT) | The destination port identifier in the transport protocol header. For transport protocols such as UDP, TCP, SCTP, and DCCP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers. It reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| - | 230 | nat-event (IPFIX_NAT_EVENT) | This Information Element identifies a NAT event. This IE identifies the type of a NAT event. Examples of NAT events include (but are not limited to) NAT translation create, NAT translation delete, Threshold Reached, Threshold Exceeded, and so on. Values for this Information Element are listed in the "NAT Event Type" registry. | 1 | Not applicable |
| - | 231 | in bytes (NF_F_FWD_FLOW_DELTA_BYTES) | The total number of layer 4 payload bytes in a flow from the initiator since the previous report. The initiator is the device that triggered the session creation, and remains the same for the life of the session. | 8 | Not supported |
| - | 232 | in rev bytes (NF_F_REV_FLOW_DELTA_BYTES) | The total number of layer 4 payload bytes in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session. | 8 | Not supported |
| - | 233 | nsel-event (IPFIX_FW_EVENT) | Indicates a firewall event. | 1 | Not applicable |
| - | 234 | nat-vrf (IPFIX_INGRESS_VRFID) | An unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per Metering Process. | 4 | Not applicable |
| - | 243 | src dot1q-vlan (IPFIX_dot1qVlanId) | The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. | 2 | Exported by default |
| 29305 | 243 | src rev dot1q-vlan | Reverse direction - The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. | 2 | Not supported |
| - | 254 | dst dot1q-vlan (IPFIX_postDot1qVlanId) | The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. This element reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| 29305 | 254 | dst rev dot1q-vlan | Reverse direction - The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. This element reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not supported |
| - | 298 | in packets (NF_F_INITIATORPACKETS) | The total number of layer 4 packets in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session. | 8 | Not supported |
| - | 299 | in rev packets (NF_F_RESPONDERPACKETS) | The total number of layer 4 packets in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session. | 8 | Not supported |
| - | 302 | sampler3-id (IPFIX_selectorId) | A unique identifier of the application for a specific Classification Engine ID. Note that the Selector ID length varies depending on the Classification Engine ID. | 8 | Not supported |
| - | 304 | sampler3-algo (IPFIX_selectorAlgorithm) | This Information Element identifies the Intermediate Flow Selection Process technique (for example, Filtering, Sampling) that is applied by the Intermediate Flow Selection Process. Most of these techniques have parameters. Its configuration parameter(s) MUST be clearly specified. | 2 | Not supported |
| - | 305 | sampler3-interval (IPFIX_samplingPacketInterval) | Interval of packet sampling. | 4 | Not supported |
| - | 306 | sampler3-space (IPFIX_samplingPacketSpace) | Packet space sampling. | 4 | Not supported |
| - | 323 | end-time (NF_F_EVENT_TIME_MSEC) | This Information Element specifies the absolute time in milliseconds of an observation. | 8 | Not supported |
| 29305 | 323 | rev end-time (NF_F_EVENT_TIME_MSEC) | This Information Element specifies the absolute time in milliseconds of an observation. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 324 | end-time (NF_F_EVENT_TIME_MICROSEC) | This Information Element specifies the absolute time in milliseconds of an observation. | 8 | Not supported |
| 29305 | 324 | rev end-time (NF_F_EVENT_TIME_MICROSEC) | This Information Element specifies the absolute time in milliseconds of an observation. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 325 | end-time (NF_F_EVENT_TIME_NANOSEC) | This Information Element specifies the absolute time in milliseconds of an observation. | 8 | Not supported |
| 29305 | 325 | rev end-time (NF_F_EVENT_TIME_NANOSEC) | This Information Element specifies the absolute time in milliseconds of an observation. This is the reverse direction field in a bi-flow record. | 8 | Not supported |
| - | 352 | in bytes | The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1) | 8 | Not supported |
| - | 417 | in rev bytes | The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1). It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not supported |
| - | 430 | in packets | The number of incoming layer 2 frames since the previous report (if any) for this Flow at the Observation Point. | 8 | Not supported |
| - | 460 | http-host (NF9_ONE_ACCESS_HTTP_HOST_NAME) | The HTTP request host, as defined in section 5.4 of [RFC7230] or, in the case of HTTP/2, the content of the :authority pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8. | any | Not supported |
| - | 461 | http-url | The HTTP request target, as defined in section 2 of [RFC7231] and in section 5.3 of [RFC7230], associated with a flow. Or the HTTP/2 :path pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8. | any | Not supported |
| - | 6670 | http-host (NF9_ONE_ACCESS_HTTP_HOST_NAME) | The hostname from the HTTP Host header or HTTP/2 :authority pseudo-header, as observed in the flow. | any | Not supported |
| 39499 | 1 | http-host (IPFIX_INVEA_HOST) | HTTP Hostname string (last 32 bytes). | any | Enabled by HTTP |
| 39499 | 2 | http-url (IPFIX_INVEA_URL) | HTTP URL string (first 64 bytes). | any | Enabled by HTTP |
| 39499 | 4 | http-method (IPFIX_INVEA_METHOD_ID) | HTTP Method | 2 | Enabled by HTTP |
| 39499 | 12 | http-response-code (IPFIX_INVEA_STATUS_CODE) | HTTP Status Code | 2 | Enabled by HTTP |
| 39499 | 13 | http-xforward4 | Captures the IPv4 address from the X-Forwarded-For HTTP header, typically used to identify the original client IP address when traffic passes through proxies. | 4 | Enabled by HTTP |
| 39499 | 14 | http-xforward6 | Captures the IPv6 address from the X-Forwarded-For HTTP header, typically used to identify the original client IP address when traffic passes through proxies. | 16 | Enabled by HTTP |
| 39499 | 22 | http-os (IPFIX_INVEA_USER_AGENT_OS) | Identifies version of host operating system. | 2 | Enabled by HTTP |
| 39499 | 23 | http-os-major (IPFIX_INVEA_USER_AGENT_OS_MAJ) | Identifies the major version of the used host operating system. | 2 | Enabled by HTTP |
| 39499 | 24 | http-os-minor (IPFIX_INVEA_USER_AGENT_OS_MIN) | Identifies the minor version of the used host operating system. | 2 | Enabled by HTTP |
| 39499 | 25 | http-os-build (IPFIX_INVEA_USER_AGENT_OS_BLD) | Identifies build version of used host operating system. | 2 | Enabled by HTTP |
| 39499 | 26 | http-app (IPFIX_INVEA_USER_AGENT_APP) | Identifies versions of used applications. | 2 | Enabled by HTTP |
| 39499 | 27 | http-app-major (IPFIX_INVEA_USER_AGENT_APP_MAJ) | Identifies the major version of used applications. | 2 | Enabled by HTTP |
| 39499 | 28 | http-app-minor (IPFIX_INVEA_USER_AGENT_APP_MIN) | Identifies the minimal version of used applications. | 2 | Enabled by HTTP |
| 39499 | 29 | http-app-build (IPFIX_INVEA_USER_AGENT_APP_BLD) | Identifies build version of application build. | 2 | Enabled by HTTP |
| 39499 | 32 | voip-packet-type (IPFIX_INVEA_VOIP_PACKET_TYPE) | Type of VoIP packets. | 1 | Enabled by VoIP or Extended VoIP |
| 39499 | 33 | sip-call-id (IPFIX_INVEA_SIP_CALL_ID) | The value of the SIP Call-ID. | any | Enabled by VoIP or Extended VoIP |
| 39499 | 34 | sip-calling-party (IPFIX_INVEA_SIP_CALLING_PARTY) | Parameter that distinguishes the station used to originate a call. | any | Enabled by VoIP or Extended VoIP |
| 39499 | 35 | sip-called-party (IPFIX_INVEA_SIP_CALLED_PARTY) | The addr-spec URI, including any URI parameters, of the SIP P-Called-Party-ID header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. | any | Enabled by VoIP or Extended VoIP |
| 39499 | 36 | sip-via (IPFIX_INVEA_SIP_VIA) | The value of the first/top-most Via header as a UTF-8 string, escaped according to SIP rules as received by the metering process. | any | Enabled by VoIP or Extended VoIP |
| 39499 | 37 | sip-ring-time (IPFIX_INVEA_SIP_INVITE_RINGING_TIME) | SIP Ringing Time (microsec timestamp). | 8 | Enabled by VoIP or Extended VoIP |
| 39499 | 38 | sip-ok-time (IPFIX_INVEA_SIP_OK_TIME) | SIP OK Time (microsec timestamp). | 8 | Enabled by VoIP or Extended VoIP |
| 39499 | 39 | sip-bye-time (IPFIX_INVEA_SIP_BYE_TIME) | SIP Bye Time (microsec timestamp). | 8 | Enabled by VoIP or Extended VoIP |
| 39499 | 40 | sip-ip4 (IPFIX_INVEA_SIP_RTP_IP4) | IPv4 Real time protocol. | 4 | Enabled by VoIP or Extended VoIP |
| 39499 | 41 | sip-ip6 (IPFIX_INVEA_SIP_RTP_IP6) | IPv6 Real time protocol. | 16 | Enabled by VoIP or Extended VoIP |
| 39499 | 42 | sip-audio (IPFIX_INVEA_SIP_RTP_AUDIO) | Real time protocol audio quality. | 2 | Enabled by VoIP or Extended VoIP |
| 39499 | 43 | sip-video (IPFIX_INVEA_SIP_RTP_VIDEO) | Real time protocol video quality. | 2 | Enabled by VoIP or Extended VoIP |
| 39499 | 44 | sip-stats (IPFIX_INVEA_SIP_STATS) | SIP statistic. | 8 | Enabled by VoIP or Extended VoIP |
| 39499 | 45 | rtp-codec (IPFIX_INVEA_RTP_CODEC) | Type of codec. | 1 | Enabled by Extended VoIP |
| 39499 | 46 | rtp-jitter (IPFIX_INVEA_RTP_JITTER) | Jitter. | 4 | Enabled by Extended VoIP |
| 39499 | 47 | rtcp-lost (IPFIX_INVEA_RTCP_LOST) | Packet loss. | 4 | Enabled by Extended VoIP |
| 39499 | 48 | rtcp-packets (IPFIX_INVEA_RTCP_PACKETS) | Quantity of packets. | 8 | Enabled by Extended VoIP |
| 39499 | 49 | rtcp-octets (IPFIX_INVEA_RTCP_OCTETS) | Quantity of octets. | 8 | Enabled by Extended VoIP |
| 39499 | 50 | rtcp-sources (IPFIX_INVEA_RTCP_SOURCE_COUNT) | Real time control protocol source count. | 1 | Enabled by Extended VoIP |
| 39499 | 61 | npm-jitter-deviation (IPFIX_INVEA_NPM_JITTER_DEV) | Deviation jitter. | 4 | Enabled by Extended NPM |
| 39499 | 62 | npm-jitter-average (IPFIX_INVEA_NPM_JITTER_AVG) | Average jitter. | 4 | Enabled by Extended NPM |
| 39499 | 63 | npm-jitter-min (IPFIX_INVEA_NPM_JITTER_MIN) | Minimal jitter. | 4 | Enabled by Extended NPM |
| 39499 | 64 | npm-jitter-max (IPFIX_INVEA_NPM_JITTER_MAX) | Maximal jitter. | 4 | Enabled by Extended NPM |
| 39499 | 65 | npm-delay-deviation (IPFIX_INVEA_NPM_DELAY_DEV) | Deviation time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 66 | npm-delay-average (IPFIX_INVEA_NPM_DELAY_AVG) | Average time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 67 | npm-delay-min (IPFIX_INVEA_NPM_DELAY_MIN) | Minimal time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 68 | npm-delay-max (IPFIX_INVEA_NPM_DELAY_MAX) | Maximal time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 69 | npm-round-trip-time (IPFIX_INVEA_NPM_RTT) | Round trip time. | 4 | Enabled by NPM |
| 39499 | 70 | npm-server-response-time (IPFIX_INVEA_NPM_SRT) | Server response time. | 4 | Enabled by NPM |
| 39499 | 71 | npm-tcp-retransmission (IPFIX_INVEA_NPM_RETRANSMISSION) | Retransmissions. | 4 | Enabled by NPM |
| 39499 | 72 | npm-tcp-out-of-order (IPFIX_INVEA_NPM_OUT_OF_ORDER) | Out of order packets. | 4 | Enabled by NPM |
| 39499 | 80 | tcp-syn-size (IPFIX_FLOWMON_TCP_SYN_SIZE) | TCP SYN Size | 1 | Enabled by L3/L4 Extended |
| 39499 | 81 | tcp-ttl (IPFIX_FLOWMON_TCP_SYN_TTL) | TCP SYN TTL | 1 | Enabled by L3/L4 Extended |
| 39499 | 110 | dns-id (IPFIX_INVEA_DNS_ID) | DNS Identifier. | 2 | Enabled by DNS |
| 39499 | 111 | dns-flags-codes (IPFIX_INVEA_DNS_FLAGS_CODES) | DNS Flags (includes Operation Code, Response Code, Query/Response flag). | 2 | Enabled by DNS |
| 39499 | 112 | dns-query-count (IPFIX_INVEA_DNS_QUESTION_COUNT) | DNS Questions Count. | 2 | Enabled by DNS |
| 39499 | 113 | dns-answer-count (IPFIX_INVEA_DNS_ANSWREC_COUNT) | DNS Answers Count. | 2 | Enabled by DNS |
| 39499 | 114 | dns-authority-count (IPFIX_INVEA_DNS_AUTHREC_COUNT) | DNS Authority Count. | 2 | Enabled by DNS |
| 39499 | 115 | dns-additional-count (IPFIX_INVEA_DNS_ADDTREC_COUNT) | DNS Additional Count. | 2 | Enabled by DNS |
| 39499 | 116 | dns-response-name (IPFIX_INVEA_DNS_CRR_NAME) | DNS Response Name. | any | Enabled by DNS |
| 39499 | 117 | dns-response-type (IPFIX_INVEA_DNS_CRR_TYPE) | DNS Response Type. | 2 | Enabled by DNS |
| 39499 | 118 | dns-response-class (IPFIX_INVEA_DNS_CRR_CLASS) | DNS Response Class. | 2 | Enabled by DNS |
| 39499 | 119 | dns-response-ttl (IPFIX_INVEA_DNS_CRR_TTL) | DNS Response TTL. | 4 | Enabled by DNS |
| 39499 | 120 | dns-response-data (IPFIX_INVEA_DNS_CRR_RDATA) | DNS Response Data. | any | Enabled by DNS |
| 39499 | 121 | dns-query-name (IPFIX_INVEA_DNS_QNAME) | DNS Question Name. | any | Enabled by DNS |
| 39499 | 122 | dns-query-type (IPFIX_INVEA_DNS_QTYPE) | DNS Question Type. | 2 | Enabled by DNS |
| 39499 | 123 | dns-query-class (IPFIX_INVEA_DNS_QCLASS) | DNS Question Class. | 2 | Enabled by DNS |
| 39499 | 124 | dns-response-data-length (IPFIX_INVEA_DNS_CRR_RDATA_LEN) | DNS Response Data Length. | 2 | Enabled by DNS |
| 39499 | 150 | smb-cmd (IPFIX_INVEA_SMB_CMD) | Samba file name | 4 | Enabled by Samba |
| 39499 | 151 | smb-tree (IPFIX_INVEA_SMB_TREE) | Samba operation code version 2 | any | Enabled by Samba |
| 39499 | 152 | smb-file (IPFIX_INVEA_SMB_FILE) | Samba tree structure | any | Enabled by Samba |
| 39499 | 153 | smb-file-type (IPFIX_INVEA_SMB_FILE_TYPE) | Samba file type | 1 | Enabled by Samba |
| 39499 | 154 | smb-op-int (IPFIX_INVEA_SMB_OP) | Samba file operation type | 1 | Enabled by Samba |
| 39499 | 190 | arp-hardware-type (IPFIX_ARP_HRD) | The hardware type field from the ARP packet in the forward direction, indicating the type of hardware address (for example Ethernet, IEEE 802, and so on). | 2 | Exported by default |
| 39499 | 191 | arp-operation-code (IPFIX_ARP_OP) | The operation code field from the ARP packet in the forward direction, specifying the ARP message type (for example request, reply, RARP, and so on). | 2 | Exported by default |
| 39499 | 200 | dhcp-offered-ip (IPFIX_INVEA_DHCP_OFFERED_IP) | DHCP offered IP address | 4 | Enabled by DHCP |
| 39499 | 201 | dhcp-host-mac (IPFIX_INVEA_DHCP_HOST_MAC_ADDR) | DHCP MAC address of host | 6 | Enabled by DHCP |
| 39499 | 202 | dhcp-type-message (IPFIX_INVEA_DHCP_TYPE) | DHCP message type | 1 | Enabled by DHCP |
| 39499 | 203 | dhcp-lease-time (IPFIX_INVEA_DHCP_IP_LEASE_TIME) | DHCP IP address lease time | 4 | Enabled by DHCP |
| 39499 | 204 | dhcp-server-ip (IPFIX_INVEA_DHCP_SERVER_IP) | DCP server IP address | 4 | Enabled by DHCP |
| 39499 | 205 | dhcp-domain-name (IPFIX_INVEA_DHCP_DOMAIN_NAME) | DHCP server domain name | any | Enabled by DHCP |
| 39499 | 206 | dhcp-host-name (IPFIX_INVEA_DHCP_HOST_NAME) | DHCP hostname | any | Enabled by DHCP |
| 39499 | 207 | dhcp-request-ip (IPFIX_INVEA_DHCP_IP_REQUEST) | DHCP requested IP address | 4 | Enabled by DHCP |
| 39499 | 210 | tds-request-type (IPFIX_INVEA_TDS_REQUEST_TYPE) | MSSQL (TDS) request type | 1 | Enabled by MSSQL |
| 39499 | 211 | tds-protocol-version (IPFIX_INVEA_TDS_VERSION) | MSSQL (TDS) version (protocol type) | 4 | Enabled by MSSQL |
| 39499 | 212 | tds-client-version (IPFIX_INVEA_TDS_CLIENT_VERSION) | MSSQL (TDS) client version | 4 | Enabled by MSSQL |
| 39499 | 213 | tds-server-version (IPFIX_INVEA_TDS_SERVER_VERSION) | MSSQL (TDS) server version | 4 | Enabled by MSSQL |
| 39499 | 214 | tds-database-context (IPFIX_INVEA_TDS_DATABASE) | MSSQL (TDS) database context | any | Enabled by MSSQL |
| 39499 | 215 | tds-user (IPFIX_INVEA_TDS_USERNAME) | MSSQL (TDS) username | any | Enabled by MSSQL |
| 39499 | 216 | tds-host (IPFIX_INVEA_TDS_HOSTNAME) | MSSQL (TDS) hostname | any | Enabled by MSSQL |
| 39499 | 217 | tds-reponse-type (IPFIX_INVEA_TDS_RESPONSE_TYPE) | MSSQL (TDS) response type | 1 | Enabled by MSSQL |
| 39499 | 218 | tds-token (IPFIX_INVEA_TDS_TOKEN) | MSSQL (TDS) token of response | 1 | Enabled by MSSQL |
| 39499 | 219 | tds-transaction-manager-request-type (IPFIX_INVEA_TDS_TMR_TYPE) | MSSQL (TDS) transaction manager request type | 2 | Enabled by MSSQL |
| 39499 | 220 | tds-error-code (IPFIX_INVEA_TDS_ERROR_CODE) | MSSQL (TDS) error code | 4 | Enabled by MSSQL |
| 39499 | 221 | tds-enviroment-change-type (IPFIX_INVEA_TDS_ENVCHANGE_TYPE) | MSSQL (TDS) environment change type | 1 | Enabled by MSSQL |
| 39499 | 222 | tds-sql (IPFIX_INVEA_TDS_SQL_QUERY) | MSSQL (TDS) SQL query | any | Enabled by MSSQL |
| 39499 | 223 | tds-rpc (IPFIX_INVEA_TDS_RPC_NAME) | MSSQL (TDS) remote procedure name | any | Enabled by MSSQL |
| 39499 | 224 | tds-server-name (IPFIX_INVEA_TDS_SERVER_NAME) | MSSQL (TDS) server name | any | Enabled by MSSQL |
| 39499 | 232 | in nsel-acl (IPFIX_INGRESS_ACL_ID) | The Access Control List (ACL) identifier for ingress filtering that permitted or denied the flow. | 12 | Not applicable |
| 39499 | 233 | out nsel-acl (IPFIX_EGRESS_ACL_ID) | The Access Control List (ACL) identifier for egress filtering that permitted or denied the flow. | 12 | Not applicable |
| 39499 | 234 | nsel-extended-event (IPFIX_FW_EXT_EVENT) | Extended event code for NSEL (NetFlow Secure Event Logging), providing additional context or reason for the event. | 2 | Not applicable |
| 39499 | 250 | smtp-hello (IPFIX_INVEA_SMTP_HELO) | SMTP HELO content | any | Enabled by Email |
| 39499 | 251 | smtp-from (IPFIX_INVEA_SMTP_MAIL_FROM) | SMTP FROM content | any | Enabled by Email |
| 39499 | 252 | mail-user (IPFIX_INVEA_MAIL_USERNAME) | SMTP username | any | Enabled by Email |
| 39499 | 253 | mail-failed-authentication (IPFIX_INVEA_MAIL_FAILED_AUTHENTICATION_COUNT) | SMTP failed authentication counter | 1 | Enabled by Email |
| 39499 | 254 | mail-tls (IPFIX_INVEA_MAIL_STARTTLS) | SMTP TLS flag | 1 | Enabled by Email |
| 39499 | 290 | mysql-ver (IPFIX_FLOWMON_MYSQL_PROTOCOL_VERSION) | MySQL protocol version | 1 | Enabled by MySQL |
| 39499 | 291 | mysql-server-version (IPFIX_FLOWMON_MYSQL_SERVER_VERSION) | MySQL server version | any | Enabled by MySQL |
| 39499 | 292 | mysql-auth-status (IPFIX_FLOWMON_MYSQL_USER_AUTH_STATUS) | MySQL user authentication status | 1 | Enabled by MySQL |
| 39499 | 293 | mysql-user (IPFIX_FLOWMON_MYSQL_USERNAME) | MySQL username | any | Enabled by MySQL |
| 39499 | 294 | mysql-auth-method (IPFIX_FLOWMON_MYSQL_AUTH_METHOD) | MySQL authentication method | any | Enabled by MySQL |
| 39499 | 295 | mysql-db (IPFIX_FLOWMON_MYSQL_DATABASE) | MySQL database | any | Enabled by MySQL |
| 39499 | 296 | mysql-server-capabilities (IPFIX_FLOWMON_MYSQL_CPBLT_SERVER) | MySQL server capabilities | 4 | Enabled by MySQL |
| 39499 | 297 | mysql-client-capabilities (IPFIX_FLOWMON_MYSQL_CPBLT_CLIENT) | MySQL client capabilities | 4 | Enabled by MySQL |
| 39499 | 298 | mysql-error-code (IPFIX_FLOWMON_MYSQL_ERROR) | MySQL error code | 2 | Enabled by MySQL |
| 39499 | 299 | mysql-cmd (IPFIX_FLOWMON_MYSQL_COMMAND) | MySQL command | 1 | Enabled by MySQL |
| 39499 | 300 | mysql-sql-query (IPFIX_FLOWMON_MYSQL_SQL_QUERY) | MySQL SQL query | any | Enabled by MySQL |
| 39499 | 310 | pgsql-ver (IPFIX_FLOWMON_PGSQL_PROTOCOL_VERSION) | PostgreSQL protocol version | 4 | Enabled by PostgreSQL |
| 39499 | 311 | pgsql-server-version (IPFIX_FLOWMON_PGSQL_SERVER_VERSION) | PostgreSQL server version | 4 | Enabled by PostgreSQL |
| 39499 | 312 | pgsql-auth-method (IPFIX_FLOWMON_PGSQL_AUTH_METHOD) | PostgreSQL authentication method | 1 | Enabled by PostgreSQL |
| 39499 | 313 | pgsql-user (IPFIX_FLOWMON_PGSQL_USERNAME) | PostgreSQL username | any | Enabled by PostgreSQL |
| 39499 | 314 | pgsql-db (IPFIX_FLOWMON_PGSQL_DATABASE) | PostgreSQL database | any | Enabled by PostgreSQL |
| 39499 | 315 | pgsql-error-code (IPFIX_FLOWMON_PGSQL_ERROR_SQLSTATE) | PostgreSQL error code | 5 | Enabled by PostgreSQL |
| 39499 | 316 | pgsql-error-severity (IPFIX_FLOWMON_PGSQL_ERROR_SEVERITY) | PostgreSQL error severity | 1 | Enabled by PostgreSQL |
| 39499 | 317 | pgsql-sql-query (IPFIX_FLOWMON_PGSQL_SQL_QUERY) | PostgreSQL SQL query | any | Enabled by PostgreSQL |
| 39499 | 318 | pgsql-client-message-type (IPFIX_FLOWMON_PGSQL_MSG_TYPE_CLIENT) | PostgreSQL client message type | 4 | Enabled by PostgreSQL |
| 39499 | 319 | pgsql-server-message-type (IPFIX_FLOWMON_PGSQL_MSG_TYPE_SERVER) | PostgreSQL server message type | 4 | Enabled by PostgreSQL |
| 39499 | 330 | tls-content-type (IPFIX_FLOWMON_TLS_CONTENT_TYPE) | TLS content type | 1 | Enabled by TLS main |
| 39499 | 331 | tls-handshake-type-flags (IPFIX_FLOWMON_TLS_HANDSHAKE_TYPE) | TLS handshake type | 4 | Enabled by TLS main |
| 39499 | 332 | tls-setup (IPFIX_FLOWMON_TLS_SETUP_TIME) | TLS setup time | 8 | Enabled by TLS main |
| 39499 | 333 | tls-server-version (IPFIX_FLOWMON_TLS_SERVER_VERSION) | TLS server version | 2 | Enabled by TLS main |
| 39499 | 334 | tls-server-random-id (IPFIX_FLOWMON_TLS_SERVER_RANDOM) | TLS server random ID | 32 | Enabled by TLS main |
| 39499 | 335 | tls-server-session-id (IPFIX_FLOWMON_TLS_SERVER_SESSION) | TLS server session ID | 32 | Enabled by TLS main |
| 39499 | 336 | tls-cipher-suite (IPFIX_FLOWMON_TLS_CIPHER_SUITE) | TLS cipher suite | 2 | Enabled by TLS main |
| 39499 | 337 | tls-alpn (IPFIX_FLOWMON_TLS_ALPN) | TLS application layer protocol negotiation | any | Enabled by TLS main |
| 39499 | 338 | tls-server-name-indication (IPFIX_FLOWMON_TLS_SNI) | TLS server name indication | any | Enabled by TLS main |
| 39499 | 339 | tls-server-name-indication-len (IPFIX_FLOWMON_TLS_SNI_LENGTH) | TLS server name indication length | 2 | Enabled by TLS main |
| 39499 | 340 | tls-client-version (IPFIX_FLOWMON_TLS_CLIENT_VERSION) | TLS client version | 2 | Enabled by TLS client |
| 39499 | 341 | tls-cipher-suites (IPFIX_FLOWMON_TLS_CIPHER_SUITES) | TLS cipher suites | 16 | Enabled by TLS client |
| 39499 | 342 | tls-client-random-id (IPFIX_FLOWMON_TLS_CLIENT_RANDOM) | TLS client random ID | 32 | Enabled by TLS client |
| 39499 | 343 | tls-client-session-id (IPFIX_FLOWMON_TLS_CLIENT_SESSION) | TLS client session ID | 32 | Enabled by TLS client |
| 39499 | 344 | tls-ext (IPFIX_FLOWMON_TLS_EXTENSION_TYPES) | TLS extension types | 56 | Enabled by TLS client |
| 39499 | 345 | tls-exl (IPFIX_FLOWMON_TLS_EXTENSION_LENGTHS) | TLS extension lengths | 56 | Enabled by TLS client |
| 39499 | 346 | tls-elliptic-curves (IPFIX_FLOWMON_TLS_ELLIPTIC_CURVES) | TLS elliptic curves | 16 | Enabled by TLS client |
| 39499 | 347 | tls-ec-point-formats (IPFIX_FLOWMON_TLS_EC_POINT_FORMATS) | TLS elliptic curves point formats | 4 | Enabled by TLS client |
| 39499 | 348 | tls-client-key-length (IPFIX_FLOWMON_TLS_CLIENT_KEY_LENGTH) | TLS client key length | 4 | Enabled by TLS client |
| 39499 | 349 | tls-certificate-issuer-common-name (IPFIX_FLOWMON_TLS_ISSUER_CN) | TLS certificate issuer common name | any | Enabled by TLS certificate |
| 39499 | 350 | tls-subject-common-name (IPFIX_FLOWMON_TLS_SUBJECT_CN) | TLS subject common name | any | Enabled by TLS certificate |
| 39499 | 351 | tls-subject-organizaion-name (IPFIX_FLOWMON_TLS_SUBJECT_ON) | TLS subject organization name | any | Enabled by TLS certificate |
| 39499 | 352 | tls-valid-from (IPFIX_FLOWMON_TLS_VALIDITY_NOT_BEFORE) | TLS certificate validity since | 8 | Enabled by TLS certificate |
| 39499 | 353 | tls-valid-to (IPFIX_FLOWMON_TLS_VALIDITY_NOT_AFTER) | TLS certificate validity until | 8 | Enabled by TLS certificate |
| 39499 | 354 | tls-signature-algorithm (IPFIX_FLOWMON_TLS_SIGNATURE_ALG) | TLS signature algorithm | 2 | Enabled by TLS certificate |
| 39499 | 355 | tls-public-key-algorithm (IPFIX_FLOWMON_TLS_PUBLIC_KEY_ALG) | TLS public key algorithm | 2 | Enabled by TLS certificate |
| 39499 | 356 | tls-public-key-length (IPFIX_FLOWMON_TLS_PUBLIC_KEY_LENGTH) | TLS public key length | 4 | Enabled by TLS certificate |
| 39499 | 357 | tls-ja3 (IPFIX_FLOWMON_TLS_JA3_FINGERPRINT) | TLS JA3 fingerprint | 16 | Enabled by TLS JA3 |
| 39499 | 370 | iec104-packet-length (IPFIX_FLOWMON_IEC104_PKT_LENGTH) | The length in bytes of the IEC 60870-5-104 protocol packet. | 1 | Enabled by IEC 104 |
| 39499 | 371 | iec104-frame-format (IPFIX_FLOWMON_IEC104_FRAME_FMT) | IEC104 frame format | 1 | Enabled by IEC 104 |
| 39499 | 372 | iec104-asdu-type (IPFIX_FLOWMON_IEC104_ASDU_TYPE) | IEC104 ASDU type | 1 | Enabled by IEC 104 |
| 39499 | 373 | iec104-asdu-object-count (IPFIX_FLOWMON_IEC104_ASDU_OBJ_COUNT) | IEC104 ASDU object count | 1 | Enabled by IEC 104 |
| 39499 | 374 | iec104-asdu-cause-of-transmission (IPFIX_FLOWMON_IEC104_ASDU_COT) | IEC104 ASDU cause of transmission | 1 | Enabled by IEC 104 |
| 39499 | 375 | iec104-asdu-originator (IPFIX_FLOWMON_IEC104_ASDU_ORG) | IEC104 ASDU originator address | 1 | Enabled by IEC 104 |
| 39499 | 376 | iec104-asdu-address (IPFIX_FLOWMON_IEC104_ASDU_ADDRESS) | IEC104 common ASDU address | 2 | Enabled by IEC 104 |
| 39499 | 390 | coap-version (IPFIX_FLOWMON_COAP_VERSION) | CoAP version | 1 | Enabled by COAP |
| 39499 | 391 | coap-message-id (IPFIX_FLOWMON_COAP_MID) | CoAP message ID | 2 | Enabled by COAP |
| 39499 | 392 | coap-code (IPFIX_FLOWMON_COAP_CODE) | CoAP code | 1 | Enabled by COAP |
| 39499 | 393 | coap-option-count (IPFIX_FLOWMON_COAP_OPTIONS_COUNT) | CoAP options count | 2 | Enabled by COAP |
| 39499 | 394 | coap-type (IPFIX_FLOWMON_COAP_TYPE) | CoAP type | 1 | Enabled by COAP |
| 39499 | 395 | coap-accept (IPFIX_FLOWMON_COAP_ACCEPT) | CoAP accept | 2 | Enabled by COAP |
| 39499 | 396 | coap-content-format (IPFIX_FLOWMON_COAP_CONTENT_FORMAT) | CoAP content format | 2 | Enabled by COAP |
| 39499 | 397 | coap-token-len (IPFIX_FLOWMON_COAP_TOKEN_LENGTH) | CoAP token length | 1 | Enabled by COAP |
| 39499 | 398 | coap-token-data (IPFIX_FLOWMON_COAP_TOKEN) | CoAP token | 8 | Enabled by COAP |
| 39499 | 399 | coap-uri-host (IPFIX_FLOWMON_COAP_URI_HOST) | CoAP URI host | any | Enabled by COAP |
| 39499 | 400 | coap-uri-path (IPFIX_FLOWMON_COAP_URI_PATH) | CoAP URI path | any | Enabled by COAP |
| 39499 | 401 | coap-uri-query (IPFIX_FLOWMON_COAP_URI_QUERY) | CoAP URI query | any | Enabled by COAP |
| 39499 | 410 | goose-application-id (IPFIX_FLOWMON_GOOSE_APPID) | GOOSE status number | 2 | Enabled by GOOSE |
| 39499 | 411 | goose-control-block (IPFIX_FLOWMON_GOOSE_CB_REF) | GOOSE application ID | any | Enabled by GOOSE |
| 39499 | 412 | goose-data-set (IPFIX_FLOWMON_GOOSE_DATA_SET) | GOOSE control block reference | any | Enabled by GOOSE |
| 39499 | 413 | goose-id (IPFIX_FLOWMON_GOOSE_ID) | GOOSE data set | any | Enabled by GOOSE |
| 39499 | 414 | goose-status-number (IPFIX_FLOWMON_GOOSE_ST_NUM) | GOOSE id | 4 | Enabled by GOOSE |
| 39499 | 420 | mms-type (IPFIX_FLOWMON_MMS_TYPE) | MMS message type | 1 | Enabled by MMS |
| 39499 | 421 | mms-confirmed-service-request (IPFIX_FLOWMON_MMS_CONF_SERVICE_REQ) | MMS confirmed service request type | 1 | Enabled by MMS |
| 39499 | 422 | mms-confirmed-service-response (IPFIX_FLOWMON_MMS_CONF_SERVICE_RESP) | MMS confirmed service response type | 1 | Enabled by MMS |
| 39499 | 423 | mms-unconfirmed-service (IPFIX_FLOWMON_MMS_UNCONF_SERVICE) | MMS unconfirmed service type | 1 | Enabled by MMS |
| 39499 | 430 | dlms-type (IPFIX_FLOWMON_DLMS_TYPE) | DLMS message type | 1 | Enabled by DLMS |
| 39499 | 431 | dlms-sub-type (IPFIX_FLOWMON_DLMS_SUBTYPE) | DLMS data type | 2 | Enabled by DLMS |
| 39499 | 432 | dlms-class-id (IPFIX_FLOWMON_DLMS_CLASS_ID) | DLMS class id | 2 | Enabled by DLMS |
| 39499 | 433 | dlms-obis (IPFIX_FLOWMON_DLMS_OBIS) | DLMS OBIS code | 6 | Enabled by DLMS |
| 39499 | 434 | dlms-attribute-method-id (IPFIX_FLOWMON_DLMS_ATTR_METHOD_ID) | DLMS attribute/method id | 1 | Enabled by DLMS |
| 39499 | 435 | dlms-data-type (IPFIX_FLOWMON_DLMS_DATA_TYPE) | DLMS data type | 1 | Enabled by DLMS |
| 39499 | 436 | dlms-data-length (IPFIX_FLOWMON_DLMS_DATA_LENGTH) | DLMS data length | 2 | Enabled by DLMS |
| 39499 | 437 | dlms-data-access-result (IPFIX_FLOWMON_DLMS_DATA_ACCESS_RESULT) | DLMS data access result | 1 | Enabled by DLMS |
| 39499 | 438 | dlms-action-result (IPFIX_FLOWMON_DLMS_ACTION_RESULT) | DLMS action result | 1 | Enabled by DLMS |
| 39499 | 450 | vxlan-vni (IPFIX_FLOWMON_VXLAN_VNI) | The VXLAN Network Identifier (VNI) used to identify the VXLAN segment for the flow in the forward direction. | 4 | Enabled by VxLAN |
| 39499 | 480 | quic-version | The version number of the QUIC protocol used in the flow. | 4 | Enabled by QUIC |
| 39499 | 490 | modbus-unit-id (IPFIX_FLOWMON_MODBUS_UNIT_ID) | Identifier of the Modbus server device targeted by the request. Valid range: 1–247. | 1 | Enabled by Modbus |
| 39499 | 491 | modbus-read-requests (IPFIX_FLOWMON_MODBUS_READ_REQUESTS) | Count of Modbus requests sent to read data from server devices (for example coils, registers). | 2 | Enabled by Modbus |
| 39499 | 492 | modbus-write-requests (IPFIX_FLOWMON_MODBUS_WRITE_REQUESTS) | Count of Modbus requests sent to write data to server devices. | 2 | Enabled by Modbus |
| 39499 | 493 | modbus-diagnostic-requests (IPFIX_FLOWMON_MODBUS_DIAGNOSTIC_REQUESTS) | Count of diagnostic function requests (for example loopback test, device busy check) sent to servers. | 2 | Enabled by Modbus |
| 39499 | 494 | modbus-other-requests (IPFIX_FLOWMON_MODBUS_OTHER_REQUESTS) | Count of requests using uncommon or vendor-specific function codes. | 2 | Enabled by Modbus |
| 39499 | 495 | modbus-undefined-requests (IPFIX_FLOWMON_MODBUS_UNDEFINED_REQUESTS) | Count of requests with unrecognized or malformed function codes. | 2 | Enabled by Modbus |
| 39499 | 496 | modbus-success-responses (IPFIX_FLOWMON_MODBUS_SUCCESS_RESPONSES) | Count of responses from Modbus servers indicating successful execution of the request. | 2 | Enabled by Modbus |
| 39499 | 497 | modbus-error-responses (IPFIX_FLOWMON_MODBUS_ERROR_RESPONSES) | Count of responses from Modbus servers containing exception codes or error flags. | 2 | Enabled by Modbus |
| 39499 | 500 | mqtt-client-id (IPFIX_FLOWMON_MQTT_CLIENT_ID) | Unique identifier assigned to the MQTT client during connection setup. Used to track client activity and session state. | any | Enabled by MQTT |
| 39499 | 501 | mqtt-protocol-version (IPFIX_FLOWMON_MQTT_VERSION) | Version of the MQTT protocol used by the client (for example 3.1, 3.1.1, 5.0). Helps determine feature support and compatibility. | 1 | Enabled by MQTT |
| 39499 | 502 | mqtt-protocol-name (IPFIX_FLOWMON_MQTT_PROTOCOL_NAME) | Name of the protocol as declared in the CONNECT packet (typically “MQTT”). Used for protocol validation. | any | Enabled by MQTT |
| 39499 | 503 | mqtt-pub-count-server (IPFIX_FLOWMON_MQTT_PUB_COUNT_SERVER) | Number of MQTT publish messages sent by the broker/server to clients. Indicates server-side data distribution activity. | 4 | Enabled by MQTT |
| 39499 | 504 | mqtt-pub-count-client (IPFIX_FLOWMON_MQTT_PUB_COUNT_CLIENT) | Number of MQTT publish messages sent by the client to the broker. Reflects client-side data transmission | 4 | Enabled by MQTT |
| 39499 | 505 | mqtt-sub-count (IPFIX_FLOWMON_MQTT_SUB_COUNT) | Number of MQTT SUBSCRIBE messages sent by the client. Represents the client's interest in specific topics. | 4 | Enabled by MQTT |
| 39499 | 506 | mqtt-connect-ack (IPFIX_FLOWMON_MQTT_CONNECT_ACK) | Boolean flag indicating whether the broker acknowledged the client's CONNECT request. Absence may signal connectivity or broker issues. | 1 | Enabled by MQTT |
| 39499 | 507 | mqtt-auth-username (IPFIX_FLOWMON_MQTT_AUTH_USER) | Username used by the client for authentication during connection setup. May be empty if anonymous access is allowed. | any | Enabled by MQTT |
| 39499 | 508 | mqtt-auth-password-present (IPFIX_FLOWMON_MQTT_AUTH_PASS) | Boolean flag indicating whether a password was included in the authentication payload. Does not reveal actual password content. | 1 | Enabled by MQTT |
| 39499 | 509 | mqtt-auth-method (IPFIX_FLOWMON_MQTT_AUTH_METHOD) | Authentication method used (for example username/password, TLS). Helps assess security posture of the MQTT session. | any | Enabled by MQTT |
| 39499 | 510 | dnp3-confirmation-requests (IPFIX_FLOWMON_DNP3_CONFIRMATION_REQUESTS) | Count of DNP3 requests using function code 0, indicating confirmation messages. | 2 | Enabled by DNP3 |
| 39499 | 511 | dnp3-read-requests (IPFIX_FLOWMON_DNP3_READ_REQUESTS) | Count of requests to read data objects from DNP3 outstations. | 2 | Enabled by DNP3 |
| 39499 | 512 | dnp3-write-requests (IPFIX_FLOWMON_DNP3_WRITE_REQUESTS) | Count of requests to write data objects to DNP3 outstations. | 2 | Enabled by DNP3 |
| 39499 | 513 | dnp3-control-requests (IPFIX_FLOWMON_DNP3_CONTROL_REQUESTS) | Count of control operation requests (for example select-before-operate sequences). | 2 | Enabled by DNP3 |
| 39499 | 514 | dnp3-freeze-requests (IPFIX_FLOWMON_DNP3_FREEZE_REQUESTS) | Count of freeze requests (function codes 7–12), used to snapshot data states. | 2 | Enabled by DNP3 |
| 39499 | 515 | dnp3-app-control-requests (IPFIX_FLOWMON_DNP3_APP_CONTROL_REQUESTS) | Count of application control messages (function codes 13–18), used for advanced control operations. | 2 | Enabled by DNP3 |
| 39499 | 516 | dnp3-configuration-requests (IPFIX_FLOWMON_DNP3_CONFIGURATION_REQUESTS) | Count of configuration messages (function codes 19–22), used to modify outstation settings. | 2 | Enabled by DNP3 |
| 39499 | 517 | dnp3-time-sync-requests (IPFIX_FLOWMON_DNP3_TIME_SYNC_REQUESTS) | Count of time synchronization requests (function code 23), used to align clocks. | 2 | Enabled by DNP3 |
| 39499 | 518 | dnp3-reserved-requests (IPFIX_FLOWMON_DNP3_RESERVED_REQUESTS) | Count of requests using reserved function codes (24–128), typically undefined or vendor-specific. | 2 | Enabled by DNP3 |
| 39499 | 519 | dnp3-malformed-requests (IPFIX_FLOWMON_DNP3_MALFORMED_REQUESTS) | Count of requests with invalid structure or function codes above 128. | 2 | Enabled by DNP3 |
| 39499 | 520 | dnp3-confirmation-responses (IPFIX_FLOWMON_DNP3_CONFIRMATION_RESPONSES) | Count of confirmation response messages (function code 0). | 2 | Enabled by DNP3 |
| 39499 | 521 | dnp3-solicited-responses (IPFIX_FLOWMON_DNP3_SOLICITED_RESPONSES) | Count of regular responses to requests (function code 129). | 2 | Enabled by DNP3 |
| 39499 | 522 | dnp3-unsolicited-responses (IPFIX_FLOWMON_DNP3_UNSOLICITED_RESPONSES) | Count of unsolicited responses initiated by outstations (function code 130). | 2 | Enabled by DNP3 |
| 39499 | 523 | dnp3-malformed-responses (IPFIX_FLOWMON_DNP3_MALFORMED_RESPONSES) | Count of responses with invalid structure or function codes. | 2 | Enabled by DNP3 |
| 39499 | 524 | dnp3-internal-indicators (IPFIX_FLOWMON_DNP3_INTERNAL_INDICATORS) | Flags indicating internal system status or error conditions. | 2 | Enabled by DNP3 |
| 39499 | 530 | s7comm-param-length-sum (IPFIX_FLOWMON_S7COMM_PARAM_LENGTH_SUM) | Sum of all parameter lengths in S7COMM messages within the observed flow. | 4 | Enabled by S7COMM |
| 39499 | 531 | s7comm-data-length-sum (IPFIX_FLOWMON_S7COMM_DATA_LENGTH_SUM) | Sum of all data payload lengths in S7COMM messages within the observed flow. | 4 | Enabled by S7COMM |
| 39499 | 532 | s7comm-job-readvar-count (IPFIX_FLOWMON_S7COMM_JOB_READVAR_COUNT) | Count of job requests to read variables from the PLC. | 2 | Enabled by S7COMM |
| 39499 | 533 | s7comm-job-readvar-item-count (IPFIX_FLOWMON_S7COMM_JOB_READVAR_ITEM_COUNT) | Total number of variable items requested across all read jobs. | 2 | Enabled by S7COMM |
| 39499 | 534 | s7comm-ack-readvar-count (IPFIX_FLOWMON_S7COMM_ACK_READVAR_COUNT) | Count of acknowledgment responses for read variable jobs. | 2 | Enabled by S7COMM |
| 39499 | 535 | s7comm-ack-readvar-success-count (IPFIX_FLOWMON_S7COMM_ACK_READVAR_SUCCESS_COUNT) | Count of successful read variable acknowledgments (no error codes). | 2 | Enabled by S7COMM |
| 39499 | 536 | s7comm-job-writevar-count (IPFIX_FLOWMON_S7COMM_JOB_WRITEVAR_COUNT) | Count of job requests to write variables to the PLC. | 2 | Enabled by S7COMM |
| 39499 | 537 | s7comm-job-writevar-item-count (IPFIX_FLOWMON_S7COMM_JOB_WRITEVAR_ITEM_COUNT) | Total number of variable items included in write jobs. | 2 | Enabled by S7COMM |
| 39499 | 538 | s7comm-ack-writevar-count (IPFIX_FLOWMON_S7COMM_ACK_WRITEVAR_COUNT) | Count of acknowledgment responses for write variable jobs. | 2 | Enabled by S7COMM |
| 39499 | 539 | s7comm-ack-writevar-success-count (IPFIX_FLOWMON_S7COMM_ACK_WRITEVAR_SUCCESS_COUNT) | Count of successful write variable acknowledgments. | 2 | Enabled by S7COMM |
| 39499 | 540 | s7comm-job-upload-count (IPFIX_FLOWMON_S7COMM_JOB_UPLOAD_COUNT) | Count of job requests to upload blocks or data from the PLC. | 2 | Enabled by S7COMM |
| 39499 | 541 | s7comm-ack-upload-count (IPFIX_FLOWMON_S7COMM_ACK_UPLOAD_COUNT) | Count of acknowledgment responses for upload jobs. | 2 | Enabled by S7COMM |
| 39499 | 542 | s7comm-job-download-count (IPFIX_FLOWMON_S7COMM_JOB_DOWNLOAD_COUNT) | Count of job requests to download blocks or data to the PLC. | 2 | Enabled by S7COMM |
| 39499 | 543 | s7comm-ack-download-count (IPFIX_FLOWMON_S7COMM_ACK_DOWNLOAD_COUNT) | Count of acknowledgment responses for download jobs. | 2 | Enabled by S7COMM |
| 39499 | 544 | s7comm-job-control-count (IPFIX_FLOWMON_S7COMM_JOB_CONTROL_COUNT) | Count of job requests for control operations (for example start/stop PLC). | 2 | Enabled by S7COMM |
| 39499 | 545 | s7comm-ack-control-count (IPFIX_FLOWMON_S7COMM_ACK_CONTROL_COUNT) | Count of acknowledgment responses for control operations. | 2 | Enabled by S7COMM |
| 39499 | 546 | s7comm-error-response-count (IPFIX_FLOWMON_S7COMM_ERROR_RESPONSE_COUNT) | Count of responses indicating errors (non-success status codes). | 2 | Enabled by S7COMM |
| 39499 | 547 | s7comm-userdata-request-programmer-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_PROGRAMMER_COUNT) | Count of user data requests related to programmer functions. | 2 | Enabled by S7COMM |
| 39499 | 548 | s7comm-userdata-response-programmer-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_PROGRAMMER_COUNT) | Count of user data responses for programmer-related requests. | 2 | Enabled by S7COMM |
| 39499 | 549 | s7comm-userdata-request-cyclic-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_CYCLIC_COUNT) | Count of cyclic user data requests (for example periodic data exchange). | 2 | Enabled by S7COMM |
| 39499 | 550 | s7comm-userdata-response-cyclic-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_CYCLIC_COUNT) | Count of responses to cyclic user data requests. | 2 | Enabled by S7COMM |
| 39499 | 551 | s7comm-userdata-request-block-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_BLOCK_COUNT) | Count of user data requests for block operations (for example block info). | 2 | Enabled by S7COMM |
| 39499 | 552 | s7comm-userdata-response-block-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_BLOCK_COUNT) | Count of responses to block-related user data requests. | 2 | Enabled by S7COMM |
| 39499 | 553 | s7comm-userdata-request-cpu-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_CPU_COUNT) | Count of user data requests for CPU-related information. | 2 | Enabled by S7COMM |
| 39499 | 554 | s7comm-userdata-response-cpu-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_CPU_COUNT) | Count of responses to CPU-related user data requests. | 2 | Enabled by S7COMM |
| 39499 | 555 | s7comm-userdata-request-security-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_SECURITY_COUNT) | Count of user data requests for security-related operations. | 2 | Enabled by S7COMM |
| 39499 | 556 | s7comm-userdata-response-security-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_SECURITY_COUNT) | Count of responses to security-related user data requests. | 2 | Enabled by S7COMM |
| 39499 | 557 | s7comm-userdata-request-time-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_TIME_COUNT) | Count of user data requests for time synchronization or time info. | 2 | Enabled by S7COMM |
| 39499 | 558 | s7comm-userdata-response-time-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_TIME_COUNT) | Count of responses to time-related user data requests. | 2 | Enabled by S7COMM |
| 39499 | 559 | s7comm-userdata-request-other-count (IPFIX_FLOWMON_S7COMM_USERDATA_REQUEST_OTHER_COUNT) | Count of user data requests for other miscellaneous operations. | 2 | Enabled by S7COMM |
| 39499 | 560 | s7comm-userdata-response-other-count (IPFIX_FLOWMON_S7COMM_USERDATA_RESPONSE_OTHER_COUNT) | Count of responses to miscellaneous user data requests. | 2 | Enabled by S7COMM |
| 39499 | 561 | s7comm-unknown-request-count (IPFIX_FLOWMON_S7COMM_UNKNOWN_REQUEST_COUNT) | Count of requests with unknown or unsupported function codes. | 2 | Enabled by S7COMM |
| 39499 | 562 | s7comm-unknown-response-count (IPFIX_FLOWMON_S7COMM_UNKNOWN_RESPONSE_COUNT) | Count of responses with unknown or unsupported function codes. | 2 | Enabled by S7COMM |
| 39499 | 563 | received-time | The timestamp when the flow record was received by the collector. | 8 | Not applicable |
| 39499 | 564 | sampling | The sampling interval or rate used for flow data collection (for example 1 out of N packets). | 8 | Not applicable |
| 39499 | 7232 | nsel-user-name (IPFIX_USERNAME) | The username associated with the flow, as reported by AAA (Authentication, Authorization, and Accounting) systems. | any | Not applicable |
| 39499 | 7233 | src xlate-ip (IPFIX_XLATE_SRC_ADDR_IPV4) | The translated (NAT) source IPv4 address after network address translation. | 4 | Not applicable |
| 39499 | 7234 | dst xlate-ip (IPFIX_XLATE_DST_ADDR_IPV4) | The translated (NAT) destination IPv4 address after network address translation. | 4 | Not applicable |
| 39499 | 7235 | src xlate-port (IPFIX_XLATE_SRC_PORT) | The translated (NAT) source transport layer port number after network address translation. | 2 | Not applicable |
| 39499 | 7236 | dst xlate-port (IPFIX_XLATE_DST_PORT) | The translated (NAT) destination transport layer port number after network address translation. | 2 | Not applicable |
| 39499 | 16424 | rev sip-ip4 (IPFIX_INVEA_SIP_RTP_IP4) | IPv4 Real time protocol. | 4 | Enabled by VoIP or Extended VoIP |
| 39499 | 16425 | rev sip-ip6 (IPFIX_INVEA_SIP_RTP_IP6) | IPv6 Real time protocol. | 16 | Enabled by VoIP or Extended VoIP |
| 39499 | 16426 | rev sip-audio (IPFIX_INVEA_SIP_RTP_AUDIO) | Real time protocol audio quality. | 2 | Enabled by VoIP or Extended VoIP |
| 39499 | 16427 | rev sip-video (IPFIX_INVEA_SIP_RTP_VIDEO) | Real time protocol video quality. | 2 | Enabled by VoIP or Extended VoIP |
| 39499 | 16428 | rev sip-stats (IPFIX_INVEA_SIP_STATS) | SIP statistic. | 8 | Enabled by VoIP or Extended VoIP |
| 39499 | 16429 | rev rtp-codec (IPFIX_INVEA_RTP_CODEC) | Type of codec. | 1 | Enabled by Extended VoIP |
| 39499 | 16430 | rev rtp-jitter (IPFIX_INVEA_RTP_JITTER) | Jitter. | 4 | Enabled by Extended VoIP |
| 39499 | 16431 | rev rtcp-lost (IPFIX_INVEA_RTCP_LOST) | Packet loss. | 4 | Enabled by Extended VoIP |
| 39499 | 16432 | rev rtcp-packets (IPFIX_INVEA_RTCP_PACKETS) | Quantity of packets. | 8 | Enabled by Extended VoIP |
| 39499 | 16433 | rev rtcp-octets (IPFIX_INVEA_RTCP_OCTETS) | Quantity of octets. | 8 | Enabled by Extended VoIP |
| 39499 | 16434 | rev rtcp-sources (IPFIX_INVEA_RTCP_SOURCE_COUNT) | Real time control protocol source count. | 1 | Enabled by Extended VoIP |
| 39499 | 16455 | rev npm-tcp-retransmission (IPFIX_INVEA_NPM_RETRANSMISSION) | Retransmissions. | 4 | Enabled by NPM |
| 39499 | 16456 | rev npm-tcp-out-of-order (IPFIX_INVEA_NPM_OUT_OF_ORDER) | Out of order packets. | 4 | Enabled by NPM |
| 39499 | 16516 | rev npm-jitter-deviation (IPFIX_INVEA_NPM_JITTER_DEV) | Deviation jitter. | 4 | Enabled by Extended NPM |
| 39499 | 16517 | rev npm-jitter-average (IPFIX_INVEA_NPM_JITTER_AVG) | Average jitter. | 4 | Enabled by Extended NPM |
| 39499 | 16518 | rev npm-jitter-min (IPFIX_INVEA_NPM_JITTER_MIN) | Minimal jitter. | 4 | Enabled by Extended NPM |
| 39499 | 16519 | rev npm-jitter-max (IPFIX_INVEA_NPM_JITTER_MAX) | Maximal jitter. | 4 | Enabled by Extended NPM |
| 39499 | 16520 | rev npm-delay-deviation (IPFIX_INVEA_NPM_DELAY_DEV) | Deviation time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 16521 | rev npm-delay-average (IPFIX_INVEA_NPM_DELAY_AVG) | Average time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 16522 | rev npm-delay-min (IPFIX_INVEA_NPM_DELAY_MIN) | Minimal time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 16523 | rev npm-delay-max (IPFIX_INVEA_NPM_DELAY_MAX) | Maximal time between packets. | 4 | Enabled by Extended NPM |
| 39499 | 16574 | rev arp-hardware-type (IPFIX_ARP_HRD) | The hardware type field from the ARP packet in the reverse direction, indicating the type of hardware address. | 2 | Not supported |
| 39499 | 16575 | rev arp-operation-code (IPFIX_ARP_OP) | The operation code field from the ARP packet in the reverse direction, specifying the ARP message type. | 2 | Exported by default |
| 39499 | 16834 | rev vxlan-vni | The VXLAN Network Identifier (VNI) used to identify the VXLAN segment for the flow in the reverse direction. | 4 | Not supported |