NetFlow v9
- Last Updated: May 27, 2026
- 16 minute read
- Flowmon Products
- Flowmon
- Documentation
Note:
In the following table, the value “Exported by default” refers to a monitoring port that has been configured to use NetFlow v9 as its export protocol.
| ID | Field | Description | Input Length (bytes) | Probe Configuration |
|---|---|---|---|---|
| 1 | in bytes (NF9_OCTETDELTACOUNT) | The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload. | 8 | Exported by default |
| 2 | in packets (NF9_PACKETDELTACOUNT) | The number of incoming packets since the previous report (if any) for this Flow at the Observation point. | 8 | Exported by default |
| 3 | flows | The conservative count of Original Flows contributing to this Aggregated Flow; may be distributed using any of the methods expressed by the valueDistributionMethod Information Element. | 8 | Not applicable |
| 4 | protocol (NF9_PROTOCOLIDENTIFIER) | The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. | 1 | Exported by default |
| 5 | src type-of-service (NF9_IPCLASSOFSERVICE) | For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header. | 1 | Enabled by L3/L4 Extended |
| 6 | flags (NF9_TCPCONTROLBITS) | TCP control bits observed for packets of this Flow. The information is encoded in a set of bit fields. For each TCP control bit, there is a bit in this set. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. A value of 0 for a bit indicates that the corresponding bit was not set in any of the observed packets of this Flow. | 1 | Exported by default |
| 7 | src port (NF9_SOURCETRANSPORTPORT) | The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. | 2 | Enabled by L3/L4 Extended |
| 8 | src ip4 (NF9_SOURCEIPV4ADDRESS) | The IPv4 source address in the IP packet header. | 4 | Exported by default |
| 9 | src prefix4 (NF9_SOURCEIPV4PREFIXLENGTH) | The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element. | 1 | Exported by default |
| 10 | in interface (NF9_INGRESSINTERFACE) | The index of the IP interface where packets of this Flow are being received. The value matches the value of the managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. | 4 | Exported by default |
| 11 | dst port (NF9_DESTINATIONTRANSPORTPORT) | The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers. | 2 | Exported by default |
| 12 | dst ip4 (NF9_DESTINATIONIPV4ADDRESS) | The IPv4 destination address in the IP packet header. Abstract Data Type: ipv4Address. | 4 | Exported by default |
| 13 | dst prefix4 (NF9_DESTINATIONIPV4PREFIXLENGTH) | The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element. | 1 | Exported by default |
| 14 | out interface (NF9_EGRESSINTERFACE) | The index of the IP interface where packets of this Flow are being sent. The value matches the value of the managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. | 4 | Exported by default, configurable per monitoring port |
| 15 | next-hop4 (NF9_IPNEXTHOPIPV4ADDRESS) | The IPv4 address of the next IPv4 hop. | 4 | Not applicable |
| 16 | src autonomous-systems (NF9_BGPSOURCEASNUMBER) | The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Enabled by 'Use autonomous system list' |
| 17 | dst autonomous-systems (NF9_BGPDESTINATIONASNUMBER) | The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Enabled by 'Use autonomous system list' |
| 18 | bgp-next4 (NF9_BGPNEXTHOPIPV4ADDRESS) | The IPv4 address of the next (adjacent) BGP hop. | 4 | Not applicable |
| 21 | end-uptime (NF9_FLOWENDSYSUPTIME) | The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). | 8 | Not supported |
| 22 | start-uptime (NF9_FLOWSTARTSYSUPTIME) | The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). | 8 | Not supported |
| 23 | out bytes (NF9_POSTOCTETDELTACOUNT) | The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not applicable |
| 24 | out packets (NF9_POSTPACKETDELTACOUNT) | The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not applicable |
| 27 | src ip6 (NF9_SOURCEIPV6ADDRESS) | The IPv6 source address in the IP packet header. | 16 | Exported by default |
| 28 | dst ip6 (NF9_DESTINATIONIPV6ADDRESS) | The IPv6 destination address in the IP packet header. | 16 | Exported by default |
| 29 | src prefix6 (NF9_SOURCEIPV6PREFIXLENGTH) | The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element. | 1 | Exported by default |
| 30 | dst prefix6 (NF9_DESTINATIONIPV6PREFIXLENGTH) | The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element. | 1 | Exported by default |
| 32 | icmp-type-code4 (NF9_ICMPTYPECODEIPV4) | Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. | 2 | Exported by default |
| 34 | sampler1-interval (NF9_SAMPLINGINTERVAL) | When using sampled NetFlow, the rate at which packets are sampled, for example: a value of 100 indicates that one of every 100 packets is sampled. | 4 | Exported by default |
| 35 | sampler1-algo (NF9_SAMPLINGALGORITHM) | The type of algorithm used for sampled NetFlow: 0x01 Deterministic Sampling ,0x02 Random Sampling. | 1 | Exported by default |
| 36 | flow-active-timeout | The timeout interval for active flows, in seconds (IPFIX flowActiveTimeout). | 2 | Not supported |
| 38 | engine-type (NF9_ENGINE_TYPE) | Type of flow switching engine: RP = 0, VIP/Linecard = 1. | 1 | Not applicable |
| 39 | engine-id (NF9_ENGINE_ID) | ID number of the flow switching engine. | 1 | Not applicable |
| 48 | sampler2-id (NF9_SAMPLERID) | Identifier shown in "show flow-sampler". | 4 | Not supported |
| 49 | sampler2-mode (NF9_SAMPLERMODE) | The type of algorithm used for sampling data: 0x02 random sampling. Use in connection with NF9_FLOW_SAMPLER_ID. | 1 | Not supported |
| 50 | sampler2-random (NF9_SAMPLERRANDOMINTERVAL) | Packet interval at which to sample. Use in connection with NF9_FLOW_SAMPLER_MODE. | 4 | Not supported |
| 55 | dst type-of-service (NF9_POSTIPCLASSOFSERVICE) | The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 1 | Not applicable |
| 56 | src in mac (NF9_SOURCEMACADDRESS) | The IEEE 802 source MAC address field. | 6 | Enabled by MAC |
| 57 | dst out mac (NF9_POSTDESTINATIONMACADDRESS) | The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 6 | Not applicable |
| 58 | src c-vlan (NF9_VLANID) | Virtual LAN identifier associated with the ingress interface. | 2 | Enabled by VLAN |
| 59 | dst c-vlan (NF9_POSTVLANID) | Virtual LAN identifier associated with the ingress interface. This element reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| 61 | direction (NF9_FLOWDIRECTION) | The direction of the Flow observed at the Observation Point. There are only two values defined. | 1 | Not applicable |
| 62 | next-hop6 (NF9_IPNEXTHOPIPV6ADDRESS) | The IPv6 address of the next IPv6 hop. | 16 | Not applicable |
| 63 | bgp-next6 (NF9_BGPNEXTHOPIPV6ADDRESS) | The IPv6 address of the next (adjacent) BGP hop. | 16 | Not applicable |
| 70 | mpls1-stack (NF9_MPLSTOPLABELSTACKSECTION) | The Label, Exp, and S fields from the top MPLS label stack entry, that is, from the last label that was pushed. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| 71 | mpls2-stack (NF9_MPLSLABELSTACKSECTION2) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| 72 | mpls3-stack (NF9_MPLSLABELSTACKSECTION3) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| 73 | mpls4-stack (NF9_MPLSLABELSTACKSECTION4) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Enabled by MPLS |
| 74 | mpls5-stack (NF9_MPLSLABELSTACKSECTION5) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| 75 | mpls6-stack (NF9_MPLSLABELSTACKSECTION6) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| 76 | mpls7-stack (NF9_MPLSLABELSTACKSECTION7) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| 77 | mpls8-stack (NF9_MPLSLABELSTACKSECTION8) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| 78 | mpls9-stack (NF9_MPLSLABELSTACKSECTION9) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| 79 | mpls10-stack (NF9_MPLSLABELSTACKSECTION10) | The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. | 4 | Not supported |
| 80 | dst in mac (NF9_DESTINATIONMACADDRESS) | The IEEE 802 destination MAC address field. | 6 | Enabled by MAC |
| 81 | src out mac (NF9_POSTSOURCEMACADDRESS) | The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 6 | Not applicable |
| 85 | in total-bytes (NF9_OCTETTOTALCOUNT) | The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. | 8 | Not supported |
| 86 | in total-packets (NF9_PACKETTOTALCOUNT) | The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. | 8 | Not supported |
| 89 | fwd-status (NF9_FORWARDINGSTATUS) | Forwarding status is encoded on 1 byte with the 2 left bits giving the status and the 6 remaining bits giving the reason code. | 1 | Not applicable |
| 90 | route-distinguisher-data (NF9_MPLSVPNROUTEDISTINGUISHER) | The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. The route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made to be open to future size changes. This idea was adopted when choosing octetArray as an abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. | 8 | Not applicable |
| 95 | application-id (NF9_APPLICATIONID) | Specifies an Application ID. | 4 | Enabled by NBAR2 |
| 128 | next-as (NF9_BGPADJNEXTAS) | The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If the AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. | 4 | Not applicable |
| 129 | prev-as (NF9_BGPADJPREVAS) | The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If the AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value. | 4 | Not applicable |
| 130 | exporter4 (NF9_EXPORTERIPV4ADDRESS) | The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. | 4 | Not supported |
| 131 | exporter6 (NF9_EXPORTERIPV6ADDRESS) | The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. | 16 | Not supported |
| 136 | flow-end-reason | The reason for Flow termination. Values are listed in the flowEndReason registry. | 1 | Exported by default |
| 139 | icmp-type-code6 | Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. | 2 | Not supported |
| 148 | nsel-connection-id (NF9_CONN_ID) | An identifier of a unique flow for the device. | 8 | Not applicable |
| 149 | source-id | Observation domain ID or source ID for s-flow. | 4 | Not supported |
| 150 | start-time (NF9_FLOWSTARTSECONDS) | The absolute timestamp of the first packet of this Flow. | 8 | Not supported |
| 151 | end-time (NF9_FLOWENDSECONDS) | The absolute timestamp of the last packet of this Flow. | 8 | Not supported |
| 152 | start-time (NF9_FLOWSTARTMILLISECONDS) | The absolute timestamp of the first packet of this Flow. | 8 | Exported by default |
| 153 | end-time (NF9_FLOWENDMILLISECONDS) | The absolute timestamp of the last packet of this Flow. | 8 | Exported by default |
| 154 | start-time (FLOWSTARTMICROSECONDS) | The absolute timestamp of the first packet of this Flow. | 8 | Not supported |
| 155 | end-time (FLOWENDMICROSECONDS) | The absolute timestamp of the last packet of this Flow. | 8 | Not supported |
| 156 | start-time (FLOWSTARTNANOSECONDS) | The absolute timestamp of the first packet of this Flow. | 8 | Not supported |
| 157 | end-time (FLOWENDNANOSECONDS) | The absolute timestamp of the last packet of this Flow. | 8 | Not supported |
| 160 | sys-init-time (SYSTEMINITTIMEMILLISECONDS) | The absolute timestamp of the last (re-)initialization of the IPFIX Device. | 8 | Not supported |
| 161 | flow-duration (NF_F_FLOW_DURATION_MSEC) | The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. | 8 | Not supported |
| 171 | out total-bytes | The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not supported |
| 172 | out total-packets | The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not supported |
| 176 | icmp-type4 (NF9_ICMP_TYPE) | ICMP type value. | 1 | Not applicable |
| 177 | icmp-code4 (NF9_ICMP_CODE) | ICMP code value. | 1 | Not applicable |
| 178 | icmp-type6 (NF9_ICMP_TYPE_IPV6) | ICMP IPv6 type value. | 1 | Not applicable |
| 179 | icmp-code6 (NF9_ICMP_CODE_IPV6) | ICMP IPv6 code value. | 1 | Not applicable |
| 180 | src udp-port (X) | The source port identifier in the UDP header. | 2 | Not supported |
| 181 | dst udp-port (NF9_DESTINATIONTRANSPORTPORT) | The destination port identifier in the UDP header. | 2 | Not supported |
| 182 | src tcp-port | The source port identifier in the TCP header. | 2 | Not supported |
| 183 | dst tcp-port | The destination port identifier in the TCP header. | 2 | Not supported |
| 186 | tcp-window-size (NF9_TCPWINDOWSIZE) | The window field in the TCP header. If the TCP window scale is supported, then the TCP window scale must be known to fully interpret the value of this information. | 2 | Enabled by L3/L4 Extended |
| 225 | src nat-ip (NF9_POST_NAT_SRC_IPV4) | The IPv4 source address in the IP packet header. It reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point. | 4 | Not applicable |
| 226 | dst nat-ip (NF9_POST_NAT_DST_IPV4) | The IPv4 destination address in the IP packet header. It reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point. | 4 | Not applicable |
| 227 | src nat-port (NF9_POST_NAPT_SRC_PORT) | The source port identifier in the transport protocol header. For transport protocols such as UDP, TCP, SCTP, and DCCP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. It reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| 228 | dst nat-port (NF9_POST_NAPT_DST_PORT) | The destination port identifier in the transport protocol header. For transport protocols such as UDP, TCP, SCTP, and DCCP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers. It reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| 230 | nat-event (NF9_NAT_EVENT) | This Information Element identifies a NAT event. This IE identifies the type of a NAT event. Examples of NAT events include (but are not limited to) NAT translation create, NAT translation delete, Threshold Reached, Threshold Exceeded, and so on. Values for this Information Element are listed in the "NAT Event Type" registry. | 1 | Not applicable |
| 231 | in bytes (NF_F_FWD_FLOW_DELTA_BYTES) | The total number of layer 4 payload bytes in a flow from the initiator since the previous report. The initiator is the device that triggered the session creation, and remains the same for the life of the session. | 8 | Not supported |
| 232 | in rev bytes (NF_F_REV_FLOW_DELTA_BYTES) | The total number of layer 4 payload bytes in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session. | 8 | Not supported |
| 233 | nsel-event (NF9_FW_EVENT) | Indicates a firewall event. | 1 | Not applicable |
| 234 | nat-vrf (NF9_INGRESS_VRFID) | An unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per Metering Process. | 4 | Not applicable |
| 243 | src dot1q-vlan (NF9_DOT1QVLANID) | The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. | 2 | Exported by default |
| 254 | dst dot1q-vlan (NF9_POSTDOT1QVLANID) | The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG. This element reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 2 | Not applicable |
| 298 | in packets (NF_F_INITIATORPACKETS) | The total number of layer 4 packets in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session. | 8 | Not supported |
| 299 | in rev packets (NF_F_RESPONDERPACKETS) | The total number of layer 4 packets in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session. | 8 | Not supported |
| 302 | sampler3-id (NF9_SELECTORID) | A unique identifier of the application for a specific Classification Engine ID. Note that the Selector ID length varies depending on the Classification Engine ID. | 8 | Not supported |
| 304 | sampler3-algo (NF9_SELECTORALGORITHM) | This Information Element identifies the Intermediate Flow Selection Process technique (for example, Filtering, Sampling) that is applied by the Intermediate Flow Selection Process. Most of these techniques have parameters. Its configuration parameter(s) MUST be clearly specified. | 2 | Not supported |
| 305 | sampler3-interval (NF9_SAMPLINGPACKETINTERVAL) | Interval of packet sampling. | 4 | Not supported |
| 306 | sampler3-space (NF9_SAMPLINGPACKETSPACE) | Packet space sampling. | 4 | Not supported |
| 323 | end-time (NF_F_EVENT_TIME_MSEC) | This Information Element specifies the absolute time in milliseconds of an observation. | 8 | Not supported |
| 324 | end-time (NF_F_EVENT_TIME_MICROSEC) | This Information Element specifies the absolute time in milliseconds of an observation. | 8 | Not supported |
| 325 | end-time (NF_F_EVENT_TIME_NANOSEC) | This Information Element specifies the absolute time in milliseconds of an observation. | 8 | Not supported |
| 352 | in bytes | The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1) | 8 | Not supported |
| 417 | in rev bytes | The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1). It reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. | 8 | Not supported |
| 430 | in packets | The number of incoming layer 2 frames since the previous report (if any) for this Flow at the Observation Point. | 8 | Not supported |
| 460 | http-host (NF9_ONE_ACCESS_HTTP_HOST_NAME) | The HTTP request host, as defined in section 5.4 of [RFC7230] or, in the case of HTTP/2, the content of the :authority pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8. | any | Not supported |
| 461 | http-url | The HTTP request target, as defined in section 2 of [RFC7231] and in section 5.3 of [RFC7230], associated with a flow. Or the HTTP/2 :path pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8. | any | Not supported |
| 6670 | http-host (NF9_ONE_ACCESS_HTTP_HOST_NAME) | The hostname from the HTTP Host header or HTTP/2 :authority pseudo-header, as observed in the flow. | any | Not supported |
| 33000 | in nsel-acl (NF_F_INGRESS_ACL_ID) | The input ACL that permitted or denied the flow. All ACL IDs are composed of the following three, four-byte values: Hash value or ID of the ACL name Hash value, ID, or line of an ACE within the ACL Hash value or ID of an extended ACE configuration. | 12 | Not applicable |
| 33001 | out nsel-acl (NF_F_EGRESS_ACL_ID) | The output ACL that permitted or denied a flow. | 12 | Not applicable |
| 33002 | nsel-extended-event (NF_F_FW_EXT_EVENT) | Extended event code. These values provide additional information about the event. | 2 | Not applicable |
| 40000 | nsel-user-name (NF_F_USERNAME) | AAA username. | any | Not applicable |
| 40001 | src xlate-ip (NF_F_XLATE_SRC_ADDR_IPV4) | Source IPv4 address. | 4 | Not applicable |
| 40002 | dst xlate-ip (NF_F_XLATE_DST_ADDR_IPV4) | Destination IPv4 address. | 4 | Not applicable |
| 40003 | src xlate-port (NF_F_XLATE_SRC_PORT) | Post NATT Source Transport Port. | 2 | Not applicable |
| 40004 | dst xlate-port (NF_F_XLATE_DST_PORT) | Post NATT Destination Transport Port. | 2 | Not applicable |
| 40005 | nsel-event (NF_F_FW_EVENT) | High-level event code. Values are as follows: 0-Collected by default (ignore), 1-Flow created, 2-Flow deleted, 3-Flow denied, 4-Flow alert, 5-Flow update. | 1 | Not applicable |
| 57595 | client-latency (%CLIENT_NW_LATENCY_MS) | Network RTT/2 client <-> nprobe (msec) | 4 | Not applicable |
| 57596 | server-latency (%SERVER_NW_LATENCY_MS) | Network RTT/2 nprobe <-> server (msec) | 4 | Not applicable |
| 57597 | app-latency (%APPL_LATENCY_MS) | Application latency (msec), also known as server response time | 4 | Not applicable |