IPFIX
- Last Updated: April 5, 2026
- 23 minute read
- Flowmon Products
- Flowmon
- Documentation
Note:
When you configure a monitoring port to use IPFIX as its export protocol, fields marked as "Exported by default" are automatically included in the export.
| PEN | ID | Field | Description | Input Length (bytes) | Probe Configuration | Collector Configuration |
|---|---|---|---|---|---|---|
| - | 1 | IPFIX_octetDeltaCount | The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload. | 8/4 | Exported by default | Collected by default |
| - | 2 | IPFIX_packetDeltaCount | The number of incoming packets since the previous report (if any) for this Flow at the Observation point. | 8/4 | Exported by default | Collected by default |
| - | 4 | IPFIX_protocolIdentifier | The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. | 1 | Exported by default | Collected by default |
| - | 5 | IPFIX_ipClassOfService | For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header. | 1 | Enabled by L3/L4 Extended | Collected by default |
| - | 6 | IPFIX_tcpControlBits | TCP control bits observed for packets of this Flow. The information is encoded in a set of bit fields. For each TCP control bit, there is a bit in this set. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. A value of 0 for a bit indicates that the corresponding bit was not set in any of the observed packets of this Flow. | 1 | Exported by default | Collected by default |
| - | 7 | IPFIX_SourceTransportPort | The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. | 2 | Exported by default | Collected by default |
| - | 8 | IPFIX_SourceIPv4Address | The IPv4 source address in the IP packet header. | 4 | Exported by default | Collected by default |
| - | 9 | IPFIX_SourceIPv4PrefixLength | The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element. | 1 | Exported by default | Enabled by SRC/DST mask, (dst) TOS, Direction |
| - | 10 | IPFIX_ingressInterface | The index of the IP interface where packets of this Flow are being received. The value matches the value of the managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. | 4/2 | Exported by default | Collected by default |
| - | 11 | IPFIX_DestinationTransportPort | The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers. | 2 | Exported by default | Collected by default |
| - | 12 | IPFIX_DestinationIPv4Address | The IPv4 destination address in the IP packet header. Abstract Data Type: ipv4Address. | 4 | Exported by default | Collected by default |
| - | 13 | IPFIX_DestinationIPv4PrefixLength | The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element. | 1 | Exported by default | Enabled by SRC/DST mask, (dst) TOS, Direction |
| - | 14 | IPFIX_egressInterface | The index of the IP interface where packets of this Flow are being sent. The value matches the value of the managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. | 4/2 | Exported by default Configurable per monitoring port | Collected by default |
| - | 15 | IPFIX_ipNextHopIPv4Address | The IPv4 address of the next IPv4 hop. | 4 | Not applicable | Enabled by Next HOP IP address |
| - | 16 | IPFIX_bgpSourceAsNumber | The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4/2 | Enabled by Use autonomous system list | Collected by default |
| - | 17 | IPFIX_bgpDestinationAsNumber | The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4/2 | Enabled by Use autonomous system list | Collected by default |
| - | 18 | IPFIX_bgpNextHopIPv4Address | The IPv4 address of the next (adjacent) BGP hop. | 4 | Not applicable | Enabled by BGP next HOP IP address |
| - | 21 | IPFIX_flowEndSysUpTime | The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). | 4 | Not supported | Collected by default |
| - | 22 | IPFIX_flowStartSysUpTime | The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). | 4 | Not supported | Collected by default |
| - | 23 | IPFIX_postOctetDeltaCount | The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8/4 | Not applicable | Enabled by Counter output bytes |
| - | 24 | IPFIX_postPacketDeltaCount | The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8/4 | Not applicable | Enabled by Counter output packets |
| - | 27 | IPFIX_SourceIPv6Address | The IPv6 source address in the IP packet header. | 16 | Exported by default | Collected by default |
| - | 28 | IPFIX_DestinationIPv6Address | The IPv6 destination address in the IP packet header. | 16 | Exported by default | Collected by default |
| - | 29 | IPFIX_SourceIPv6PrefixLength | The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element. | 1 | Exported by default | Enabled by SRC/DST mask, (dst) TOS, Direction |
| - | 30 | IPFIX_DestinationIPv6PrefixLength | The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element. | 1 | Exported by default | Enabled by SRC/DST mask, (dst) TOS, Direction |
| - | 31 | IPFIX_flowLabelIPv6 | The value of the IPv6 Flow Label field in the IP packet header. | 4 | Not supported | Collected by default |
| - | 32 | IPFIX_icmpTypeCodeIPv4 | Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. | 2 | Exported by default | Collected by default |
| - | 34 | NF9_SAMPLING_INTERVAL | When using sampled NetFlow, the rate at which packets are sampled, for example: a value of 100 indicates that one of every 100 packets is sampled. | 4 | Exported by default | Collected by default |
| - | 35 | NF9_SAMPLING_ALGORITHM | The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling, 0x02 Random Sampling. | 1 | Exported by default | Collected by default |
| - | 38 | IPFIX_ENGINE_TYPE | Type of flow switching engine: RP = 0, VIP/Linecard = 1. | 1 | Not applicable | Collected by default |
| - | 38 | IPFIX_ENGINE_ID | ID number of the flow switching engine. | 1 | Not applicable | Collected by default |
| - | 48 | NF9_FLOW_SAMPLER_ID | Identifier shown in "show flow-sampler". | 1/2/4 | Not supported | Collected by default |
| - | 49 | NF9_FLOW_SAMPLER_MODE | The type of algorithm used for sampling data: 0x02 random sampling. Use in connection with NF9_FLOW_SAMPLER_ID. | 4 | Not supported | Collected by default |
| - | 50 | NF9_FLOW_SAMPLER_RANDOM_INTERVAL | Packet interval at which to sample. Use in connection with NF9_FLOW_SAMPLER_MODE. | 2/4 | Not supported | Collected by default |
| - | 55 | IPFIX_postIpClassOfService | The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 1 | Not applicable | Enabled by SRC/DST mask, (dst) TOS, Direction |
| - | 56 | IPFIX_SourceMacAddress | The IEEE 802 source MAC address field. | 6 | Enabled by MAC | Enabled by In SRC/out DST MAC address |
| - | 57 | IPFIX_postDestinationMacAddress | The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 6 | Not applicable | Enabled by In SRC/out DST MAC address |
| - | 58 | IPFIX_vlanId | The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. | 2 | Enabled by VLAN | Enabled by SRC/DST VLAN ID labels |
| - | 59 | IPFIX_postVlanId | The definition of this Information Element is identical to the definition of Information Element 'vlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not applicable | Enabled by SRC/DST VLAN ID labels |
| - | 61 | IPFIX_flowDirection | The direction of the Flow observed at the Observation Point. There are only two values defined. | 1 | Not applicable | Enabled by SRC/DST mask, (dst) TOS, Direction |
| - | 62 | IPFIX_ipNextHopIPv6Address | The IPv6 address of the next IPv6 hop. | 16 | Not applicable | Enabled by Next HOP IP address |
| - | 63 | IPFIX_bgpNextHopIPv6Address | The IPv6 address of the next (adjacent) BGP hop. | 16 | Not applicable | Enabled by BGP next HOP IP address |
| - | 70 | IPFIX_mplsTopLabelStackSection | The Label, Exp, and S fields from the top MPLS label stack entry, that is, from the last label that was pushed. The size of this Information Element is 3 octets. | 3 | Enabled by MPLS | Enabled by MPLS labels 1-10 |
| - | 71 | IPFIX_mplsLabelStackSection2 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Enabled by MPLS | Enabled by MPLS labels 1-10 |
| - | 72 | IPFIX_mplsLabelStackSection3 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Enabled by MPLS | Enabled by MPLS labels 1-10 |
| - | 73 | IPFIX_mplsLabelStackSection4 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Enabled by MPLS | Enabled by MPLS labels 1-10 |
| - | 74 | IPFIX_mplsLabelStackSection5 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Not supported | Enabled by MPLS labels 1-10 |
| - | 75 | IPFIX_mplsLabelStackSection6 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Not supported | Enabled by MPLS labels 1-10 |
| - | 76 | IPFIX_mplsLabelStackSection7 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Not supported | Enabled by MPLS labels 1-10 |
| - | 77 | IPFIX_mplsLabelStackSection8 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Not supported | Enabled by MPLS labels 1-10 |
| - | 78 | IPFIX_mplsLabelStackSection9 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Not supported | Enabled by MPLS labels 1-10 |
| - | 79 | IPFIX_mplsLabelStackSection10 | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 3 | Not supported | Enabled by MPLS labels 1-10 |
| - | 80 | IPFIX_DestinationMacAddress | The IEEE 802 destination MAC address field. | 6 | Enabled by MAC | Enabled by In DST/out SRC MAC address |
| - | 81 | IPFIX_postSourceMacAddress | The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 6 | Not applicable | Enabled by In DST/out SRC MAC address |
| - | 85 | IPFIX_octetTotalCount | The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. | 8/4 | Not supported | Collected by default |
| - | 86 | IPFIX_packetTotalCount | The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. | 8/4 | Not supported | Collected by default |
| - | 90 | IPFIX_mplsVpnRouteDistinguisher | The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. The route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made to be open to future size changes. This idea was adopted when choosing octetArray as an abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. | 8 | Not applicable | Enabled by MPLS VPN Route Distinguisher |
| - | 95 | IPFIX_applicationId | Specifies an Application ID. | 4 | Enabled by NBAR2 | Enabled by NBAR2 application tag |
| - | 128 | IPFIX_bgpAdjNextAs | The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Not applicable | Enabled by BGP adjacent prev/next AS |
| - | 129 | IPFIX_bgpAdjPrevAs | The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. If there is BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value. | 4 | Not applicable | Enabled by BGP adjacent prev/next AS |
| - | 150 | IPFIX_flowStartSeconds | The absolute timestamp of the first packet of this Flow. | 4 | Not supported | Collected by default |
| - | 151 | IPFIX_flowEndSeconds | The absolute timestamp of the last packet of this Flow. | 4 | Not supported | Collected by default |
| - | 152 | IPFIX_flowStartMilliseconds | The absolute timestamp of the first packet of this Flow. | 8 | Exported by default | Collected by default |
| - | 153 | IPFIX_flowEndMilliseconds | The absolute timestamp of the last packet of this Flow. | 8 | Exported by default | Collected by default |
| - | 186 | IPFIX_tcpWindowSize | The window field in the TCP header. If the TCP window scale is supported, then the TCP window scale must be known to fully interpret the value of this information. | 2 | Enabled by L3/L4 Extended | Enabled by L3/L4 extended fields |
| - | 231 | IPFIX_initiatorOctets | The total number of layer 4 payload bytes in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session. | 8/4 | Not supported | Collected by default |
| - | 232 | IPFIX_responderOctets | The total number of layer 4 payload bytes in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session. | 8/4 | Not supported | Enabled by Counter output bytes |
| 243 | IPFIX_dot1qVlanId | The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag. Control Information field that was attached to the IP packet. | 2 | Enabled by VLAN | Enabled by SRC/DST VLAN ID labels | |
| 254 | IPFIX_postDot1qVlanId | The definition of this Information Element is identical to the definition of Information Element 'vlanId', except that it reports a potentially modified value caused by a middlebox function after he packet passed the Observation Point. | 2 | Enabled by VLAN | Enabled by SRC/DST VLAN ID labels | |
| - | 298 | IPFIX_initiatorPackets | The total number of layer 4 packets in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session. | 8/4 | Not supported | Collected by default |
| - | 299 | IPFIX_responderPackets | The total number of layer 4 packets in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session. | 8/4 | Not supported | Enabled by Counter output packets |
| - | 302 | IPFIX_selectorId | A unique identifier of the application for a specific Classification Engine ID. Note that the Selector ID length varies depending on the Classification Engine ID. | 8 | Not supported | Collected by default |
| - | 304 | IPFIX_selectorAlgorithm | This Information Element identifies the Intermediate Flow Selection Process technique (for example, Filtering, Sampling) that is applied by the Intermediate Flow Selection Process. Most of these techniques have parameters. Its configuration parameter(s) MUST be clearly specified. | 2 | Not supported | Collected by default |
| - | 305 | IPFIX_samplingPacketInterval | Interval of packet sampling. | 4 | Not supported | Collected by default |
| - | 306 | IPFIX_samplingPakcetSpace | Packet space sampling. | 4 | Not supported | Collected by default |
| 39499 | 1 | IPFIX_INVEA_HOST | HTTP Hostname string (last 32 bytes). | 32 | Enabled by HTTP | Truncated to 31 bytes; Enabled by HTTP Hostname |
| 39499 | 2 | IPFIX_INVEA_URL | HTTP URL string (first 64 bytes). | 64 | Enabled by HTTP | Enabled by HTTP URL |
| 39499 | 4 | IPFIX_INVEA_HTTP_METHOD_ID | HTTP Method | 2 | Enabled by HTTP | Enabled by HTTP method and result |
| 39499 | 12 | IPFIX_INVEA_HTTP_STATUS_CODE | HTTP Status Code | 2 | Enabled by HTTP | Enabled by HTTP method and result |
| 39499 | 22 | IPFIX_INVEA_USER_AGENT_OS | Identifies version of host operating system. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 23 | IPFIX_INVEA_USER_AGENT_OS_MAJ | Identifies the major version of the used host operating system. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 24 | IPFIX_INVEA_USER_AGENT_OS_MIN | Identifies the minor version of the used host operating system. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 25 | IPFIX_INVEA_USER_AGENT_OS_BLD | Identifies build version of used host operating system. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 26 | IPFIX_INVEA_USER_AGENT_APP | Identifies versions of used applications. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 27 | IPFIX_INVEA_USER_AGENT_APP_MAJ | Identifies the major version of used applications. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 28 | IPFIX_INVEA_USER_AGENT_APP_MIN | Identifies the minimal version of used applications. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 29 | IPFIX_INVEA_USER_AGENT_APP_BLD | Identifies build version of application build. | 2 | Enabled by HTTP | Enabled by HTTP OS & Application info |
| 39499 | 33 | IPFIX_INVEA_SIP_CALL_ID | The value of the SIP Call-ID. | 64 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP basic |
| 39499 | 34 | IPFIX_INVEA_SIP_CALLING_PARTY | Parameter that distinguishes the station used to originate a call. | 48 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP basic |
| 39499 | 35 | IPFIX_INVEA_SIP_CALLED_PARTY | The addr-spec URI, including any URI parameters, of the SIP P-Called-Party-ID header, as a UTF-8 string, escaped according to SIP rules as received by the metering process. | 48 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP basic |
| 39499 | 36 | IPFIX_INVEA_SIP_VIA | The value of the first/top-most Via header as a UTF-8 string, escaped according to SIP rules as received by the metering process. | 48 | Enabled byVoIP or Extended VoIP | Enabled by VoIP SIP basic |
| 39499 | 32 | IPFIX_INVEA_VOIP_PACKET_TYPE | Type of VoIP packets. | 1 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 37 | IPFIX_INVEA_SIP_INVITE_RINGING_TIME | SIP Ringing Time (microsec timestamp). | 8 | Enabled by VoIP or Extended VoIP | Enabled byVoIP SIP advanced |
| 39499 | 38 | IPFIX_INVEA_SIP_OK_TIME | SIP OK Time (microsec timestamp). | 8 | Enabled by VoIP or Extended VoIP | Enabled by **VoIP SIP ** |
| 39499 | 39 | IPFIX_INVEA_SIP_BYE_TIME | SIP Bye Time (microsec timestamp). | 8 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 40 | IPFIX_INVEA_SIP_RTP_IP4 | IPv4 Real time protocol. | 4 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 41 | IPFIX_INVEA_SIP_RTP_IP6 | IPv6 Real time protocol. | 16 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 42 | IPFIX_INVEA_SIP_RTP_AUDIO | Real time protocol audio quality. | 2 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 43 | IPFIX_INVEA_SIP_RTP_VIDEO | Real time protocol video quality. | 2 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 44 | IPFIX_INVEA_SIP_STATS | SIP statistic. | 8 | Enabled by VoIP or Extended VoIP | Enabled by VoIP SIP advanced |
| 39499 | 45 | IPFIX_INVEA_RTP_CODEC | Type of codec. | 1 | Enabled by Extended VoIP | Enabled by VoIP RTP |
| 39499 | 46 | IPFIX_INVEA_RTP_JITTER | Jitter. | 4 | Enabled by Extended VoIP | Enabled by VoIP RTP |
| 39499 | 47 | IPFIX_INVEA_RTCP_LOST | Packet loss. | 4 | Enabled by Extended VoIP | Enabled by VoIP RTP |
| 39499 | 48 | IPFIX_INVEA_RTCP_PACKETS | Quantity of packets. | 8 | Enabled by Extended VoIP | Enabled by VoIP RTP |
| 39499 | 49 | IPFIX_INVEA_RTCP_OCTETS | Quantity of octets. | 8 | Enabled by Extended VoIP | Enabled by VoIP RTP |
| 39499 | 50 | IPFIX_INVEA_RTCP_SOURCE_COUNT | Real time control protocol source count. | 1 | Enabled by Extended VoIP | Enabled by VoIP RTP |
| 39499 | 69 | IPFIX_INVEA_NPM_RTT | Round trip time. | 4 | Enabled by NPM | Enabled by NPM Basic Metrics |
| 39499 | 70 | IPFIX_INVEA_NPM_SRT | Server response time. | 4 | Enabled by NPM | Enabled by NPM Basic Metrics |
| 39499 | 61 | IPFIX_INVEA_NPM_JITTER_DEV | Deviation jitter. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 62 | IPFIX_INVEA_NPM_JITTER_AVG | Average jitter. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 63 | IPFIX_INVEA_NPM_JITTER_MIN | Minimal jitter. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 64 | IPFIX_INVEA_NPM_JITTER_MAX | Maximal jitter. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 65 | IPFIX_INVEA_NPM_DELAY_DEV | Deviation time between packets. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 66 | IPFIX_INVEA_NPM_DELAY_AVG | Average time between packets. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 67 | IPFIX_INVEA_NPM_DELAY_MIN | Minimal time between packets. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 68 | IPFIX_INVEA_NPM_DELAY_MAX | Maximal time between packets. | 4 | Enabled by Extended NPM | Enabled by NPM Basic Metrics |
| 39499 | 71 | IPFIX_INVEA_NPM_RETRANSMISSION | Retransmissions. | 4 | Enabled by NPM | Enabled by NPM Retransmission & Out of Order |
| 39499 | 72 | IPFIX_INVEA_NPM_OUT_OF_ORDER | Out of order packets. | 4 | Enabled by NPM | Enabled by NPM Retransmission & Out of Order |
| 39499 | 80 | IPFIX_INVEA_TCP_SYN_SIZE | TCP SYN Size | 1 | Enabled by L3/L4 Extended | Enabled by L3/L4 extended fields |
| 39499 | 81 | IPFIX_INVEA_TCP_SYN_TTL | TCP SYN TTL | 1 | Enabled by L3/L4 Extended | Enabled by L3/L4 extended fields |
| 39499 | 110 | IPFIX_INVEA_DNS_ID | DNS Identifier. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 111 | IPFIX_INVEA_DNS_FLAGS_CODES | DNS Flags (includes Operation Code, Response Code, Query/Response flag). | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 112 | IPFIX_INVEA_DNS_QUESTION_COUNT | DNS Questions Count. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 113 | IPFIX_INVEA_DNS_ANSWREC_COUNT | DNS Answers Count. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 114 | IPFIX_INVEA_DNS_AUTHREC_COUNT | DNS Authority Count. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 115 | IPFIX_INVEA_DNS_ADDTREC_COUNT | DNS Additional Count. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 116 | IPFIX_INVEA_DNS_CRR_NAME | DNS Response Name. | 64 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 117 | IPFIX_INVEA_DNS_CRR_TYPE | DNS Response Type. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 118 | IPFIX_INVEA_DNS_CRR_CLASS | DNS Response Class. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 119 | IPFIX_INVEA_DNS_CRR_TTL | DNS Response TTL. | 4 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 120 | IPFIX_INVEA_DNS_CRR_RDATA | DNS Response Data. | 64 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 121 | IPFIX_INVEA_DNS_QNAME | DNS Question Name. | 64 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 122 | IPFIX_INVEA_DNS_QTYPE | DNS Question Type. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 123 | IPFIX_INVEA_DNS_QCLASS | DNS Question Class. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 124 | IPFIX_INVEA_DNS_CRR_RDATA_LEN | DNS Response Data Length. | 2 | Enabled by DNS | Enabled by DNS Fields |
| 39499 | 150 | IPFIX_INVEA_SMB_CMD | Samba operation code version 2 | 4 | Enabled by Samba | Enabled by SMB Fields |
| 39499 | 151 | IPFIX_INVEA_SMB_TREE | Samba tree structure | 128 | Enabled by Samba | Enabled by SMB Fields |
| 39499 | 152 | IPFIX_INVEA_SMB_FILE | Samba file name | 128 | Enabled by Samba | Enabled by SMB Fields |
| 39499 | 153 | IPFIX_INVEA_SMB_FILE_TYPE | Samba file type | 1 | Enabled by Samba | Enabled by SMB Fields |
| 39499 | 154 | IPFIX_INVEA_SMB_OP | Samba file operation type | 1 | Enabled by Samba | Enabled by SMB Fields |
| 39499 | 190 | IPFIX_INVEA_ARP_HRD | ARP Hardware Type | 2 | Exported by default | Collected by default |
| 39499 | 191 | IPFIX_INVEA_ARP_OP | ARP Operation Code | 2 | Exported by default | Collected by default |
| 39499 | 200 | IPFIX_INVEA_DHCP_OFFERED_IP | DHCP offered IP address | 4 | Enabled byDHCP | Enabled by DHCP Fields |
| 39499 | 201 | IPFIX_INVEA_DHCP_HOST_MAC_ADDR | DHCP MAC address of host | 6 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 202 | IPFIX_INVEA_DHCP_TYPE | DHCP message type | 1 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 203 | IPFIX_INVEA_DHCP_IP_LEASE_TIME | DHCP IP address lease time | 4 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 204 | IPFIX_INVEA_DHCP_SERVER_IP | DCP server IP address | 4 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 205 | IPFIX_INVEA_DHCP_DOMAIN_NAME | DHCP server domain name | 32 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 206 | IPFIX_INVEA_DHCP_HOST_NAME | DHCP hostname | 32 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 207 | IPFIX_INVEA_DHCP_IP_REQUEST | DHCP requested IP address | 4 | Enabled by DHCP | Enabled by DHCP Fields |
| 39499 | 210 | IPFIX_INVEA_TDS_REQUEST_TYPE | MSSQL (TDS) request type | 1 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 211 | IPFIX_INVEA_TDS_VERSION | MSSQL (TDS) version (protocol type) | 4 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 212 | IPFIX_INVEA_TDS_CLIENT_VERSION | MSSQL (TDS) client version | 4 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 213 | IPFIX_INVEA_TDS_SERVER_VERSION | MSSQL (TDS) server version | 4 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 214 | IPFIX_INVEA_TDS_DATABASE | MSSQL (TDS) database context | 64 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 215 | IPFIX_INVEA_TDS_USERNAME | MSSQL (TDS) username | 64 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 216 | IPFIX_INVEA_TDS_HOSTNAME | MSSQL (TDS) hostname | 64 | Enabled by MSSQL | Enabled by MSSQL Fields |
| 39499 | 217 | IPFIX_INVEA_TDS_RESPONSE_TYPE | MSSQL (TDS) response type | 1 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 218 | IPFIX_INVEA_TDS_TOKEN | MSSQL (TDS) token of response | 1 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 219 | IPFIX_INVEA_TDS_TMR_TYPE | MSSQL (TDS) transaction manager request type | 2 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 220 | IPFIX_INVEA_TDS_ERROR_CODE | MSSQL (TDS) error code | 4 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 221 | IPFIX_INVEA_TDS_ENVCHANGE_TYPE | MSSQL (TDS) environment change type | 1 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 222 | IPFIX_INVEA_TDS_SQL_QUERY | MSSQL (TDS) SQL query | 64 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 223 | IPFIX_INVEA_TDS_RPC_NAME | MSSQL (TDS) remote procedure name | 64 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 224 | IPFIX_INVEA_TDS_SERVER_NAME | MSSQL (TDS) server name | 64 | Enabled by MSSQL | Enabled by MSSQL Extended fields |
| 39499 | 250 | IPFIX_INVEA_SMTP_EHLO_HELO | SMTP HELO content | 64 | Enabled by Email | Enabled by E-mail Fields |
| 39499 | 251 | IPFIX_INVEA_SMTP_MAIL_FROM | SMTP FROM content | 64 | Enabled by Email | Enabled by E-mail Fields |
| 39499 | 252 | IPFIX_INVEA_MAIL_USERNAME | SMTP username | 64 | Enabled by Email | Enabled by E-mail Fields |
| 39499 | 253 | IPFIX_INVEA_MAIL_FAILED_AUTHENTICATION_COUNT | SMTP failed authentication counter | 1 | Enabled by Email | Enabled by E-mail Fields |
| 39499 | 254 | IPFIX_INVEA_MAIL_IS_ENCRYPTED | SMTP TLS flag | 1 | Enabled by Email | Enabled by E-mail Fields |
| 39499 | 290 | IPFIX_FLOWMON_MYSQL_PROTOCOL_VERSION | MySQL protocol version | 1 | Enabled by MySQL | Enabled by MySQL fields |
| 39499 | 291 | IPFIX_FLOWMON_MYSQL_SERVER_VERSION | MySQL server version | 64 | Enabled by MySQL | Enabled by MySQL fields |
| 39499 | 292 | IPFIX_FLOWMON_MYSQL_USER_AUTH_STATUS | MySQL user authentication status | 1 | Enabled by MySQL | Enabled by MySQL fields |
| 39499 | 293 | IPFIX_FLOWMON_MYSQL_USERNAME | MySQL username | 64 | Enabled by MySQL | Enabled by MySQL fields |
| 39499 | 294 | IPFIX_FLOWMON_MYSQL_AUTH_METHOD | MySQL authentication method | 64 | Enabled by MySQL | Enabled by MySQL fields |
| 39499 | 295 | IPFIX_FLOWMON_MYSQL_DATABASE | MySQL database | 64 | Enabled by MySQL | Enabled by MySQL fields |
| 39499 | 296 | IPFIX_FLOWMON_MYSQL_CPBLT_SERVER | MySQL server capabilities | 4 | Enabled by MySQL | Enabled by MySQL extended fields |
| 39499 | 297 | IPFIX_FLOWMON_MYSQL_CPBLT_CLIENT | MySQL client capabilities | 4 | Enabled by MySQL | Enabled by MySQL extended fields |
| 39499 | 298 | IPFIX_FLOWMON_MYSQL_ERROR | MySQL error code | 2 | Enabled by MySQL | Enabled by MySQL extended fields |
| 39499 | 299 | IPFIX_FLOWMON_MYSQL_COMMAND | MySQL command | 1 | Enabled by MySQL | Enabled by MySQL extended fields |
| 39499 | 300 | IPFIX_FLOWMON_MYSQL_SQL_QUERY | MySQL SQL query | 64 | Enabled by MySQL | Enabled by MySQL extended fields |
| 39499 | 310 | IPFIX_FLOWMON_PGSQL_PROTOCOL_VERSION | PostgreSQL protocol version | 4 | Enabled by PostgreSQL | Enabled by PostgreSQL fields |
| 39499 | 311 | IPFIX_FLOWMON_PGSQL_SERVER_VERSION | PostgreSQL server version | 4 | Enabled by PostgreSQL | Enabled by PostgreSQL fields |
| 39499 | 312 | IPFIX_FLOWMON_PGSQL_AUTH_METHOD | PostgreSQL authentication method | 1 | Enabled by PostgreSQL | Enabled by PostgreSQL fields |
| 39499 | 313 | IPFIX_FLOWMON_PGSQL_USERNAME | PostgreSQL username | 64 | Enabled by PostgreSQL | Enabled by PostgreSQL fields |
| 39499 | 314 | IPFIX_FLOWMON_PGSQL_DATABASE | PostgreSQL database | 64 | Enabled by PostgreSQL | Enabled by PostgreSQL fields |
| 39499 | 315 | IPFIX_FLOWMON_PGSQL_ERROR_SQLSTATE | PostgreSQL error code | 5 | Enabled by PostgreSQL | Enabled by PostgreSQL extended fields |
| 39499 | 316 | IPFIX_FLOWMON_PGSQL_ERROR_SEVERITY | PostgreSQL error severity | 1 | Enabled by PostgreSQL | Enabled by PostgreSQL extended fields |
| 39499 | 317 | IPFIX_FLOWMON_PGSQL_SQL_QUERY | PostgreSQL SQL query | 64 | Enabled by PostgreSQL | Enabled by PostgreSQL extended fields |
| 39499 | 318 | IPFIX_FLOWMON_PGSQL_MSG_TYPE_CLIENT | PostgreSQL client message type | 4 | Enabled by PostgreSQL | Enabled by PostgreSQL extended fields |
| 39499 | 319 | IPFIX_FLOWMON_PGSQL_MSG_TYPE_SERVER | PostgreSQL server message type | 4 | Enabled by PostgreSQL | Enabled by PostgreSQL extended fields |
| 39499 | 330 | IPFIX_FLOWMON_TLS_CONTENT_TYPE | TLS content type | 1 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 331 | IPFIX_FLOWMON_TLS_HANDSHAKE_TYPE | TLS handshake type | 4 | Enabled byTLS main | Enabled byTLS main fields |
| 39499 | 332 | IPFIX_FLOWMON_TLS_SETUP_TIME | **TLS setup time | 8 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 333 | IPFIX_FLOWMON_TLS_SERVER_VERSION | TLS server version | 2 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 334 | IPFIX_FLOWMON_TLS_SERVER_RANDOM | TLS server random ID | 32 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 335 | IPFIX_FLOWMON_TLS_SERVER_SESSION | TLS server session ID | 32 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 336 | IPFIX_FLOWMON_TLS_CIPHER_SUITE | TLS cipher suite | 2 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 337 | IPFIX_FLOWMON_TLS_ALPN | TLS application layer protocol negotiation | 19 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 338 | IPFIX_FLOWMON_TLS_SNI | TLS server name indication | 64 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 339 | IPFIX_FLOWMON_TLS_SNI_LENGTH | TLS server name indication length | 2 | Enabled by TLS main | Enabled by TLS main fields |
| 39499 | 340 | IPFIX_FLOWMON_TLS_CLIENT_VERSION | TLS client version | 2 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 341 | IPFIX_FLOWMON_TLS_CIPHER_SUITES | TLS cipher suites | 16 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 342 | IPFIX_FLOWMON_TLS_CLIENT_RANDOM | TLS client random ID | 32 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 343 | IPFIX_FLOWMON_TLS_CLIENT_SESSION | TLS client session ID | 32 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 344 | IPFIX_FLOWMON_TLS_EXTENSION_TYPES | TLS extension types | 56 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 345 | IPFIX_FLOWMON_TLS_EXTENSION_LENGTHS | TLS extension lengths | 56 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 346 | IPFIX_FLOWMON_TLS_ELLIPTIC_CURVES | TLS elliptic curves | 16 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 347 | IPFIX_FLOWMON_TLS_EC_POINT_FORMATS | TLS elliptic curves point formats | 4 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 348 | IPFIX_FLOWMON_TLS_CLIENT_KEY_LENGTH | TLS client key length | 4 | Enabled by TLS client | Enabled by TLS client fields |
| 39499 | 349 | IPFIX_FLOWMON_TLS_ISSUER_CN | TLS certificate issuer common name | 64 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 350 | IPFIX_FLOWMON_TLS_SUBJECT_CN | TLS subject common name | 64 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 351 | IPFIX_FLOWMON_TLS_SUBJECT_ON | TLS subject organization name | 64 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 352 | IPFIX_FLOWMON_TLS_VALIDITY_NOT_BEFORE | TLS certificate validity since | 8 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 353 | IPFIX_FLOWMON_TLS_VALIDITY_NOT_AFTER | TLS certificate validity until | 8 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 354 | IPFIX_FLOWMON_TLS_SIGNATURE_ALG | TLS signature algorithm | 2 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 355 | IPFIX_FLOWMON_TLS_PUBLIC_KEY_ALG | TLS public key algorithm | 2 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 356 | IPFIX_FLOWMON_TLS_PUBLIC_KEY_LENGTH | TLS public key length | 4 | Enabled by TLS certificate | Enabled by TLS certificate fields |
| 39499 | 357 | IPFIX_FLOWMON_TLS_JA3_FINGERPRINT | TLS JA3 fingerprint | 16 | Enabled by TLS JA3 | Enabled by TLS JA3 fields |
| 39499 | 371 | IPFIX_FLOWMON_IEC104_FRAME_FMT | IEC104 frame format | 1 | Enabled by IEC 104 | Enabled by IEC104 |
| 39499 | 372 | IPFIX_FLOWMON_IEC104_ASDU_TYPE | IEC104 ASDU type | 1 | Enabled by IEC 104 | Enabled by IEC104 |
| 39499 | 373 | IPFIX_FLOWMON_IEC104_ASDU_OBJ_COUNT | IEC104 ASDU object count | 1 | Enabled by IEC 104 | Enabled by IEC104 |
| 39499 | 374 | IPFIX_FLOWMON_IEC104_ASDU_COT | IEC104 ASDU cause of transmission | 1 | Enabled by IEC 104 | Enabled by IEC104 |
| 39499 | 375 | IPFIX_FLOWMON_IEC104_ASDU_ORG | IEC104 ASDU originator address | 1 | Enabled by IEC 104 | Enabled by IEC104 |
| 39499 | 376 | IPFIX_FLOWMON_IEC104_ASDU_ADDRESS | IEC104 common ASDU address | 2 | Enabled by IEC 104 | Enabled by IEC104 |
| 39499 | 390 | IPFIX_FLOWMON_COAP_VERSION | CoAP version | 1 | Enabled by COAP | Enabled by COAP |
| 39499 | 391 | IPFIX_FLOWMON_COAP_MID | CoAP message ID | 2 | Enabled by COAP | Enabled by COAP |
| 39499 | 392 | IPFIX_FLOWMON_COAP_CODE | CoAP code | 1 | Enabled by COAP | Enabled by COAP |
| 39499 | 393 | IPFIX_FLOWMON_COAP_OPTIONS_COUNT | CoAP options count | 2 | Enabled by COAP | Enabled by COAP |
| 39499 | 394 | IPFIX_FLOWMON_COAP_TYPE | CoAP type | 1 | Enabled by COAP | Enabled by COAP |
| 39499 | 395 | IPFIX_FLOWMON_COAP_ACCEPT | CoAP accept | 2 | Enabled by COAP | Enabled by COAP |
| 39499 | 396 | IPFIX_FLOWMON_COAP_CONTENT_FORMAT | CoAP content format | 2 | Enabled by COAP | Enabled by COAP |
| 39499 | 397 | IPFIX_FLOWMON_COAP_TOKEN_LENGTH | CoAP token length | 1 | Enabled by COAP | Enabled by COAP |
| 39499 | 398 | IPFIX_FLOWMON_COAP_TOKEN | CoAP token | 8 | Enabled by COAP | Enabled by COAP |
| 39499 | 399 | IPFIX_FLOWMON_COAP_URI_HOST | CoAP URI host | 64 | Enabled by COAP | Enabled by COAP |
| 39499 | 400 | IPFIX_FLOWMON_COAP_URI_PATH | CoAP URI path | 64 | Enabled by COAP | Enabled by COAP |
| 39499 | 401 | IPFIX_FLOWMON_COAP_URI_QUERY | CoAP URI query | 64 | Enabled by COAP | Enabled by COAP |
| 39499 | 410 | IPFIX_FLOWMON_GOOSE_APPID | GOOSE application ID | 2 | Enabled by GOOSE | Enabled by GOOSE |
| 39499 | 411 | IPFIX_FLOWMON_GOOSE_CB_REF | GOOSE control block reference | 64 | Enabled by GOOSE | Enabled by GOOSE |
| 39499 | 412 | IPFIX_FLOWMON_GOOSE_DATA_SET | GOOSE data set | 64 | Enabled by GOOSE | Enabled by GOOSE |
| 39499 | 413 | IPFIX_FLOWMON_GOOSE_ID | GOOSE id | 64 | Enabled by GOOSE | Enabled by GOOSE |
| 39499 | 414 | IPFIX_FLOWMON_GOOSE_ST_NUM | GOOSE status number | 4 | Enabled by GOOSE | Enabled by GOOSE |
| 39499 | 420 | IPFIX_FLOWMON_MMS_TYPE | MMS message type | 1 | Enabled by MMS | Enabled by MMS |
| 39499 | 421 | IPFIX_FLOWMON_MMS_CONF_SERVICE_REQ | MMS confirmed service request type | 1 | Enabled by MMS | Enabled by MMS |
| 39499 | 422 | IPFIX_FLOWMON_MMS_CONF_SERVICE_RESP | MMS confirmed service response type | 1 | Enabled by MMS | Enabled by MMS |
| 39499 | 423 | IPFIX_FLOWMON_MMS_UNCONF_SERVICE | MMS unconfirmed service type | 1 | Enabled by MMS | Enabled by MMS |
| 39499 | 430 | IPFIX_FLOWMON_DLMS_TYPE | DLMS message type | 1 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 431 | IPFIX_FLOWMON_DLMS_SUBTYPE | DLMS message subtype | 2 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 432 | IPFIX_FLOWMON_DLMS_CLASS_ID | DLMS class id | 2 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 433 | IPFIX_FLOWMON_DLMS_OBIS | DLMS OBIS code | 6 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 434 | IPFIX_FLOWMON_DLMS_ATTR_METHOD_ID | DLMS attribute/method id | 1 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 435 | IPFIX_FLOWMON_DLMS_DATA_TYPE | DLMS data type | 1 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 436 | IPFIX_FLOWMON_DLMS_DATA_LENGTH | DLMS data length | 2 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 437 | IPFIX_FLOWMON_DLMS_DATA_ACCESS_RESULT | DLMS data access result | 1 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 438 | IPFIX_FLOWMON_DLMS_ACTION_RESULT | DLMS action result | 1 | Enabled by DLMS | Enabled by DLMS |
| 39499 | 450 | IPFIX_FLOWMON_VXLAN_VNI | VxLAN VNI | 4 | Enabled by VxLAN | Enabled by VxLAN |