network performance insight references · network performance insight services are running on...
TRANSCRIPT
IBM Network Performance Insight 1.3.1Document Revision R2E1
Network Performance Insight References
IBM
Note
Before using this information and the product it supports, read the information in “Notices” on page379.
This edition applies to version 1.3.1.0 of IBM® Network Performance Insight® and to all subsequent releases andmodifications until otherwise indicated in new editions.© Copyright International Business Machines Corporation 2015, 2019.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract withIBM Corp.
Contents
Reference..............................................................................................................vIntended audience....................................................................................................................................... vOrganization..................................................................................................................................................vNetwork Performance Insight architecture................................................................................................. vIBM Community......................................................................................................................................... viiiNetwork Performance Insight technical training........................................................................................ixSupport information.................................................................................................................................... ixConventions used in this publication ......................................................................................................... ix
Typeface conventions ........................................................................................................................... ix
Chapter 1. Reference............................................................................................. 1REST API definitions.................................................................................................................................... 1
Flow APIs................................................................................................................................................1Metric APIs........................................................................................................................................... 32Threshold API.......................................................................................................................................65
Command line interface............................................................................................................................ 68basecamp-manager-cmd command reference................................................................................ 68backup command reference............................................................................................................... 70restore command reference................................................................................................................ 71pack-tool command usage...................................................................................................................71
NetFlow versions....................................................................................................................................... 73NetFlow V1 formats............................................................................................................................. 74NetFlow V5 formats............................................................................................................................. 75V9 field type definitions....................................................................................................................... 76IPFIX Information Elements................................................................................................................83
SNMP formulas........................................................................................................................................ 334SNMP formula language.......................................................................................................................... 334
Language basics................................................................................................................................. 334Writing custom discovery formulas................................................................................................... 335Writing custom collection formulas...................................................................................................341Writing custom metrics...................................................................................................................... 349
Dashboard reference............................................................................................................................... 350Properties of the summary-level dashboards...................................................................................351Properties of the NetFlow dashboards..............................................................................................356Properties of the On Demand Filtering dashboards..........................................................................358
Configuring Flow devices.........................................................................................................................361Supported devices and flow formats.................................................................................................362Configuring NetFlow on Cisco routers............................................................................................... 362Configuring flow on Juniper devices..................................................................................................370Configuring NetStream traffic on Huawei devices............................................................................ 378
Notices..............................................................................................................379Trademarks.............................................................................................................................................. 380Terms and conditions for product documentation................................................................................. 381
iii
iv
Reference
Use the following reference information to enhance your understanding of IBM Network PerformanceInsight and to help you work with IBM Network Performance Insight effectively.
Intended audienceThe audience who are network administrators or network users who are responsible for installing andusing the Network Performance Insight product on an enterprise network.
To install Network Performance Insight successfully, you must have a thorough understanding of thefollowing subjects:
• Network Performance Insight 1.3.1 system• Basic principles of network protocols and network management• NetFlow and Cisco IP SLA concepts• Linux administration• Jazz® for Service Management• IBM Tivoli® Network Manager IP Edition• IBM Tivoli Netcool®/OMNIbus
OrganizationRead this summary to help you find the information that you need.
This information is organized as follows:
• “REST API definitions” on page 1• “Command line interface” on page 68• “Configuring Flow devices” on page 361
Network Performance Insight architectureIBM Network Performance Insight is a network performance monitoring system. It offers both real-timeand historical trends in network performance and interactive view on the network data that helps inreduced network downtime and optimized network performance.
Network Performance Insight provides IBM Netcool Operations Insight with comprehensive IP networkdevice performance monitoring and session traffic analysis.
The following diagram shows how data is flowing through the various components in NetworkPerformance Insight:
© Copyright IBM Corp. 2015, 2019 v
Network Performance Insight servicesNetwork Performance Insight services are running on microservice architecture that has the softwareapplication as a suite of independently deployable, small, modular services in which each service runs aunique process and communicates through a well-defined, lightweight mechanism. Currently, NetworkPerformance Insight 1.3.1 consists of the following microservices:
Foundation services
• Dashboard• DNS• Event• Manager• Storage• UI
Entity Metric services
• Cacti Collector• Exporter• Formula Service• Entity Analytics• SNMP Collector• Threshold
vi Reference
• Tivoli Network Manager Collector
Flow Metric services
• Flow Analytics• Flow Collector
For more information about these services, see their respective sections in IBM Network PerformanceInsight: Product Overview.
Network Performance Insight additional components
Some of the additional components that are introduced in Network Performance Insight, V1.3.1 forenhanced functions are described here:Technology Packs
A set of ready-to-use Technology Packs is provided to perform second-level discovery and polling ofresources to collect entity metric data . These Technology Packs can help to collect standard SNMPmetrics, IP SLA metrics, and Performance Metric OOTB Device Support metrics.
For more information, see Installing the Technology Packs section in Installing and Configuring IBMNetwork Performance Insight.
Network Performance Insight Dashboards
These interactive dashboards are the built-in, JSON-based dashboards suite that can displayaggregated network data from Network Performance Insight database with the help of REST API calls.It supports a combination of data from multiple data sources.
This feature provides a wide variety of dashboards for Network Operators, Network Engineers, andNetwork Capacity Planners. These dashboards help in pinpointing the troubled resources and generalresource performance. A number of web-based configuration options are available to control the datathat is displayed on the dashboards.
For more information, see Network Performance Insight Dashboards section in IBM NetworkPerformance Insight: Product Overview.
Note: Networks for Operations Insight is a solution extension of Netcool Operations Insight thatincludes the following components and products:
• Tivoli Network Manager• Tivoli Netcool Configuration Manager• Network Performance Insight• Network Health Dashboard• Device Dashboard• Topology Search
Hortonworks Data Platform components
Hortonworks Data Platform (HDP®) can be used to help process and analyze the volume, variety, andvelocity of data that continually enters your organization every day. Network Performance Insight isinstalled as a service extension to the installed HDP® stack.
The features of HDP® that are used in Network Performance Insight:
• HDP®
• Default support for rolling upgrades for Hadoop services• Support for long-running applications within YARN for enhanced reliability
Reference vii
• Spark in-memory distributed compute engine for dramatic performance increase• Apache Ambari operational framework. Apache Ambari is an open framework for provisioning,
managing, and monitoring Apache Hadoop clusters. Ambari provides an intuitive and easy-to-useHadoop management web UI backed by its collection of tools and APIs that simplify the operation ofHadoop clusters.
• Essentially includes the following open source technologies for working with Network PerformanceInsight:
– Apache Hadoop– Apache Kafka– Apache Ambari– Apache Spark– Apache ZooKeeper
Note: Because Zookeeper requires a majority, it is best to use an odd number of machines. Forexample, with four machines ZooKeeper can handle the failure of a single machine; if two machinesfail, the remaining two machines do not constitute a majority. However, with five machinesZooKeeper can handle the failure of two machines.
Integrated products
Products that are integrated with Network Performance Insight 1.3.1:Cassandra
It is available as a microservice that can be installed along with other microservices in NetworkPerformance Insight. All the inventory metadata is stored in Cassandra.
Jazz for Service ManagementDashboard Application Services Hub provides visualization and dashboard services in Jazz for ServiceManagement. It has a single console for administering IBM products and related applications.Visualization for Network Performance Insight is federated into Dashboard Application Services Hub.
IBM Tivoli Network Manager IP EditionTivoli Network Manager provides first-level device discovery and polling of some standard SNMPmetrics.
Tivoli Netcool/OMNIbus component of IBM Netcool Operations InsightNetcool Operations Insight is powered by the fault management capabilities of IBM Tivoli Netcool/OMNIbus. In Network Performance Insight, V1.3.1, Tivoli Netcool/OMNIbus is an important part ofthe solution for monitoring the network threshold violations.
Related informationIBM Network Performance Insight on IBM Knowledge CenterHortonworks Data PlatformHDFS ArchitectureApache Hadoop YARNApache KafkaApache ZookeeperIBM Networks for Operations Insight
IBM CommunityConnect, learn, and share with professionals and product support technical experts who provide theirperspectives and expertise.
Access the IBM Network Performance Insight community. Use IBM Community in the following ways:
viii Reference
• Become involved with transparent development, an ongoing, open engagement between other usersand IBM developers of Tivoli products. You can access early designs, sprint demonstrations, productroadmaps, and prerelease code.
• Connect one-on-one with the experts to collaborate and network about Tivoli and the Network andService Assurance community.
• Read blogs to benefit from the expertise and experience of others.• Use wikis and forums to collaborate with the broader user community.
Network Performance Insight technical trainingFor Tivoli technical training information, see the following Network Performance Insight Training websiteat https://tnpmsupport.persistentsys.com/updated_trainings.
Support informationIf you have a problem with your IBM Software, you want to resolve it quickly. IBM provides the followingways for you to obtain the support you need:Online
Access the IBM Software Support site at https://www-947.ibm.com/support/servicerequest/newServiceRequest.action
IBM Support AssistantThe IBM Support Assistant is a free local software serviceability workbench that helps you resolvequestions and problems with IBM Software products. The Support Assistant provides quick access tosupport-related information and serviceability tools for problem determination. To install the SupportAssistant software, go to https://www.ibm.com/software/support/isa.
Troubleshooting GuideFor more information about resolving problems, see the problem determination information for thisproduct.
Conventions used in this publicationSeveral conventions are used in this publication for special terms, actions, commands, and paths that aredependent on your operating system.
Typeface conventionsThis publication uses the following typeface conventions:
Bold
• Lowercase commands and mixed case commands that are otherwise difficult to distinguish fromsurrounding text
• Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, listboxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs,property sheets), labels (such as Tip:, and Operating system considerations:)
• Keywords and parameters in text
Italic
• Citations (examples: titles of publications, diskettes, and CDs)• Words defined in text (example: a nonswitched line is called a point-to-point line)• Emphasis of words and letters (words as words example: "Use the word that to introduce a
restrictive clause."; letters as letters example: "The LUN address must start with the letter L.")
Reference ix
• New terms in text (except in a definition list): a view is a frame in a workspace that contains data.• Variables and values you must provide: ... where myname represents....
Monospace
• Examples and code examples• File names, programming keywords, and other elements that are difficult to distinguish from
surrounding text• Message text and prompts addressed to the user• Text that the user must type• Values for arguments or command options
Bold monospace
• Command names, and names of macros and utilities that you can type as commands• Environment variable names in text• Keywords• Parameter names in text: API structure parameters, command parameters and arguments, andconfiguration parameters
• Process names• Registry variable names in text• Script names
x IBM Network Performance Insight 1.3.1: Network Performance Insight References
Chapter 1. ReferenceUse the following reference information to enhance your understanding of IBM Network PerformanceInsight and to help you work with IBM Network Performance Insight effectively.
REST API definitionsThe APIs in Network Performance Insight that give access to the database data for constructing thedashboards.
Using Network Performance Insight REST API commands requires the same permissions as using the webinterface. These REST APIs are available so that you can retrieve the data outside of the web interface.
Each REST resource contains information such as URLs, functions, parameters, descriptions, sampleinput, and output data.
Common REST API status codesREST API status codes
HTTP status code Generic description
200 Success
400 Failure
Flow APIsREST APIs that are related Flow data that is collected by Flow Collector Service and analyzed by FlowAnalytics Service.
aggregationProvides a list of Flow aggregations that are visible to the user.
This API queries and retrieves information from CFG.AGGREGATION_DISABLE table.
URL
https://[host]:[port]/service/dataset/flow/aggregation
https://<myserver.ibm.com>:9443/service/dataset/flow/aggregation
Method
The supported request type.
https GET
URL parameters
Name Required Default value Description
visible No true Fields that must bereturned.
© Copyright IBM Corp. 2015, 2019 1
Sample URLs
/service/dataset/flow/aggregation/service/dataset/flow/aggregation/?visible=true
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
aggregation string The key for the aggregation onthe flow metric.
agg_fields string The columns that are used togroup by for the calculation ofaggregation.
aggregation_name string The name of the aggregation onthe flow metric.
visible boolean A flag to indicate whether theaggregation is visible to the useror not.
enabled boolean A flag to indicate whether theaggregation is enabled by theadministrator or not.
order_id number It indicates the sorting order ofthis list.
JSON code with visible flag set to true:
[{"aggregation": "app","aggregation_name": "Top Applications","agg_fields": "APP_NAME","visible": true,"enabled": true,"order_id": 1},{"aggregation": "app_srctos","aggregation_name": "Top Applications with Source ToS","agg_fields": "APP_NAME, SRC_TOS","visible": true,"enabled": true,"order_id": 2},{"aggregation": "srcip","aggregation_name": "Top Sources","agg_fields": "SRC_IP","visible": true,"enabled": true,"order_id": 3},{"aggregation": "srcip_app","aggregation_name": "Top Sources with Application","agg_fields": "SRC_IP, APP_NAME","visible": true,"enabled": true,"order_id": 4},{"aggregation": "dstip","aggregation_name": "Top Destinations",
2 IBM Network Performance Insight 1.3.1: Network Performance Insight References
"agg_fields": "DST_IP","visible": true,"enabled": true,"order_id": 5},{"aggregation": "dstip_app","aggregation_name": "Top Destinations with Application","agg_fields": "DST_IP, APP_NAME","visible": true,"enabled": true,"order_id": 6},{"aggregation": "conv","aggregation_name": "Top Conversations","agg_fields": "SRC_IP, DST_IP","visible": true,"enabled": true,"order_id": 7},{"aggregation": "conv_app","aggregation_name": "Top Conversations with Application","agg_fields": "SRC_IP, DST_IP, APP_NAME","visible": true,"enabled": true,"order_id": 8},{"aggregation": "conv_tos","aggregation_name": "Top Conversations with ToS","agg_fields": "SRC_IP, DST_IP, SRC_TOS","visible": true,"enabled": true,"order_id": 9},{"aggregation": "prot","aggregation_name": "Top Protocols","agg_fields": "PROTOCOL_ID","visible": true,"enabled": true,"order_id": 10},{"aggregation": "prot_app","aggregation_name": "Top Protocols with Application","agg_fields": "PROTOCOL_ID, APP_NAME","visible": true,"enabled": true,"order_id": 11},{"aggregation": "prot_srcip","aggregation_name": "Top Protocols with Source Ip","agg_fields": "PROTOCOL_ID, SRC_IP","visible": true,"enabled": true,"order_id": 12},{"aggregation": "prot_dstip","aggregation_name": "Top Protocols with Destination Ip","agg_fields": "PROTOCOL_ID, DST_IP","visible": true,"enabled": true,"order_id": 13},{"aggregation": "prot_conv","aggregation_name": "Top Protocols with Conversation","agg_fields": "PROTOCOL_ID, SRC_IP, DST_IP","visible": true,"enabled": true,"order_id": 14},{"aggregation": "srcas","aggregation_name": "Top Source Autonomous System","agg_fields": "BGP_SRC_AS_NUM","visible": true,
Reference 3
"enabled": true,"order_id": 15},{"aggregation": "dstas","aggregation_name": "Top Destination Autonomous System","agg_fields": "BGP_DST_AS_NUM","visible": true,"enabled": true,"order_id": 16},{"aggregation": "conv_as","aggregation_name": "Top Autonomous System Conversations","agg_fields": "BGP_SRC_AS_NUM, BGP_DST_AS_NUM","visible": true,"enabled": true,"order_id": 17},{"aggregation": "srctos","aggregation_name": "Top Source ToS","agg_fields": "SRC_TOS","visible": true,"enabled": true,"order_id": 18},{"aggregation": "hierarchy_queueid","aggregation_name": "Top QoS Hierarchies with Queue Id","agg_fields": "POLICY_QOS_CLASSIFICATION_HIERARCHY, POLICY_QOS_QUEUE_ID","visible": true,"enabled": true,"order_id": 19},{"aggregation": "dstipgroup","aggregation_name": "Top Destination Ip Groups","agg_fields": "DST_IP_GROUP","visible": true,"enabled": true,"order_id": 20},{"aggregation": "dstipgroup_app","aggregation_name": "Top Destination Ip Groups with Application","agg_fields": "DST_IP_GROUP, APP_NAME","visible": true,"enabled": true,"order_id": 21},{"aggregation": "dstipgroup_prot","aggregation_name": "Top Destination Ip Groups with Protocol","agg_fields": "DST_IP_GROUP, PROTOCOL_ID","visible": true,"enabled": true,"order_id": 22},{"aggregation": "dstipgroup_tos","aggregation_name": "Top Destination Ip Groups with Source ToS","agg_fields": "DST_IP_GROUP, SRC_TOS","visible": true,"enabled": true,"order_id": 23},{"aggregation": "srcipgroup","aggregation_name": "Top Source Ip Groups","agg_fields": "SRC_IP_GROUP","visible": true,"enabled": true,"order_id": 24},{"aggregation": "srcipgroup_app","aggregation_name": "Top Source Ip Groups with Application","agg_fields": "SRC_IP_GROUP, APP_NAME","visible": true,"enabled": true,"order_id": 25
4 IBM Network Performance Insight 1.3.1: Network Performance Insight References
},{"aggregation": "srcipgroup_prot","aggregation_name": "Top Source Ip Groups with Protocol","agg_fields": "SRC_IP_GROUP, PROTOCOL_ID","visible": true,"enabled": true,"order_id": 26},{"aggregation": "srcipgroup_tos","aggregation_name": "Top Source Ip Groups with Source ToS","agg_fields": "SRC_IP_GROUP, SRC_TOS","visible": true,"enabled": true,"order_id": 27},{"aggregation": "convgroup","aggregation_name": "Top Ip Group Conversations","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP","visible": true,"enabled": true,"order_id": 28}{"aggregation": "convgroup_app","aggregation_name": "Top Ip Group Conversations with Application","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP, APP_NAME","visible": true,"enabled": true,"order_id": 29}]
JSON code with visible flag set to false:
[{"aggregation": "convgroup_prot","aggregation_name": "Top Ip Group Conversations with Protocol","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP, PROTOCOL_ID","visible": false,"enabled": false,"order_id": 1},{"aggregation": "convgroup_tos","aggregation_name": "Top Ip Group Conversations with Source ToS","agg_fields": "SRC_IP_GROUP, DST_IP_GROUP, SRC_TOS","visible": false,"enabled": false,"order_id": 2}]
interfaceProvides a list of all the flow interfaces that the system receives from an exporter. This API is specific forFlow data alone.
This API queries and retrieves information from FLOW_METRIC.INTERFACE table.
URL
https://[host]:[port]/service/dataset/cfg/interface
https://<myserver.ibm.com>:9443/service/dataset/cfg/interface/?fields=*
Reference 5
Method
The supported request type.
https GEThttps POST/PUT
URL parameters
Name Required Description
fields No Fields that must be returned.
count No Number of flow interface records that must bereturned.
sort No How the records must be sorted. Prefix + or - toindicate the sort direction.
For example, +metric,-upper_limit sorts bymetric in ascending order, and then sorts byupper_limit in descending order. You can give acomma-separated list of parameters for sorting.
condition No Expression that must be used to filter specificrecords. For example, condition=name=test.
Sample URLs
List interfaces:
/service/dataset/cfg/interface/?fields=*
/service/dataset/cfg/interface/?fields=*&count=10
/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1&sort=+start_ms
/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1
Update interfaces
/service/dataset/cfg/interface/[entity_id]/service/dataset/cfg/interface/
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
entity_id number Internal system ID for thereturned flow interface.
start_ms number Time at which the flow interfaceis first known by the system.
exporter_ip string IP address of the exporter onwhich the flow interfaces reside.
if_index number Index of the flow interface on theexporter.
direction number Direction of the flow interface (0=ingress, 1= egress).
6 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Data type Description
enabled boolean Flag that indicates for interfaceenablement in the system for theflow interface.
speed number Speed of the flow interface in bitsper second (bps).
if_name string Name of the flow interface asknown by the exporter.
interface_name string The name of the flow interface.
interface_description string The description of the flowinterface.
success_count number Number of interfaces that areenabled or disabled successfullywith toggle parameter in therequest URL.
failure_count number Number of failures for interfaceenablement with toggleparameter in the request URL.
status string Status of the interfaceenablement that is retrieved withtoggle parameter in the requestURL. Default values are enabledor disabled.
JSON code to list interfaces:
[ { "entity_id":8589934636, "start_ms":1516002407478, "exporter_ip":"10.55.239.217", "if_index":3, "direction":1, "enabled":true, "interface_name":"T1 1/2", "interface_description":"T1 1/2", "speed":154400, "if_name":"10.55.239.217-T1 1/2" }, { "entity_id":8589934641, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":5, "direction":0, "enabled":true, "interface_name":"Fa0/0", "interface_description":"FastEthernet0/0", "speed":100000, "if_name":"10.55.239.217-Fa0/0" }, { "entity_id":8589934611, "start_ms":1516002399475, "exporter_ip":"10.55.239.218", "if_index":7, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-7" }, {
Reference 7
"entity_id":8589934596, "start_ms":1516002361468, "exporter_ip":"10.55.239.203", "if_index":1, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-1" }, { "entity_id":8589934606, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":7, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-7" }, { "entity_id":8589934638, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":4, "direction":1, "enabled":true, "interface_name":"T1 1/3", "interface_description":"T1 1/3", "speed":154400, "if_name":"10.55.239.217-T1 1/3" }, { "entity_id":8589934600, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":2, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-2" }, { "entity_id":8589934623, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":2, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-2" }, { "entity_id":8589934612, "start_ms":1516002399475, "exporter_ip":"10.55.239.218", "if_index":2, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-2" }, { "entity_id":8589934644, "start_ms":1516002429480, "exporter_ip":"10.55.239.218", "if_index":5, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-5"
8 IBM Network Performance Insight 1.3.1: Network Performance Insight References
}, { "entity_id":8589934619, "start_ms":1516002399477, "exporter_ip":"10.55.239.218", "if_index":8, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-8" }, { "entity_id":8589934628, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":5, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-5" }, { "entity_id":8589934608, "start_ms":1516002399474, "exporter_ip":"10.55.239.218", "if_index":3, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-3" }, { "entity_id":8589934633, "start_ms":1516002407477, "exporter_ip":"10.55.239.217", "if_index":1, "direction":0, "enabled":true, "interface_name":"T1 1/0_AY123", "interface_description":"T1 1/0 test AY_change", "speed":1000, "if_name":"10.55.239.217-T1 1/0_AY123" }, { "entity_id":8589934603, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":6, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-6" }, { "entity_id":8589934592, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":4, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-4" }, { "entity_id":8589934605, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":3, "direction":1, "enabled":true, "interface_name":"", "interface_description":"",
Reference 9
"speed":0, "if_name":"10.55.239.203-3" }, { "entity_id":8589934615, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":4, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-4" }, { "entity_id":8589934647, "start_ms":1516004669704, "exporter_ip":"10.55.239.218", "if_index":1, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-1" }, { "entity_id":8589934617, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":6, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-6" }, { "entity_id":8589934607, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":7, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-7" }, { "entity_id":8589934620, "start_ms":1516002404479, "exporter_ip":"10.55.239.236", "if_index":1, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-1" }, { "entity_id":8589934624, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":3, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-3" }, { "entity_id":8589934637, "start_ms":1516002407478, "exporter_ip":"10.55.239.217", "if_index":3, "direction":0, "enabled":true,
10 IBM Network Performance Insight 1.3.1: Network Performance Insight References
"interface_name":"T1 1/2", "interface_description":"T1 1/2", "speed":154400, "if_name":"10.55.239.217-T1 1/2" }, { "entity_id":8589934645, "start_ms":1516002429480, "exporter_ip":"10.55.239.218", "if_index":5, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-5" }, { "entity_id":8589934642, "start_ms":1516002407480, "exporter_ip":"10.55.239.217", "if_index":6, "direction":1, "enabled":true, "interface_name":"Fa0/1", "interface_description":"FastEthernet0/1", "speed":100000, "if_name":"10.55.239.217-Fa0/1" }, { "entity_id":8589934622, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":2, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-2" }, { "entity_id":8589934604, "start_ms":1516002371470, "exporter_ip":"10.55.239.203", "if_index":3, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-3" }, { "entity_id":8589934618, "start_ms":1516002399477, "exporter_ip":"10.55.239.218", "if_index":8, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-8" }, { "entity_id":8589934639, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":4, "direction":0, "enabled":true, "interface_name":"T1 1/3", "interface_description":"T1 1/3", "speed":154400, "if_name":"10.55.239.217-T1 1/3" }, { "entity_id":8589934616, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":6,
Reference 11
"direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-6" }, { "entity_id":8589934597, "start_ms":1516002361468, "exporter_ip":"10.55.239.203", "if_index":1, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-1" }, { "entity_id":8589934630, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":6, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-6" }, { "entity_id":8589934598, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":5, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-5" }, { "entity_id":8589934626, "start_ms":1516002404482, "exporter_ip":"10.55.239.236", "if_index":4, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-4" }, { "entity_id":8589934602, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":6, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-6" }, { "entity_id":8589934627, "start_ms":1516002404482, "exporter_ip":"10.55.239.236", "if_index":4, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-4" }, { "entity_id":8589934610, "start_ms":1516002399475,
12 IBM Network Performance Insight 1.3.1: Network Performance Insight References
"exporter_ip":"10.55.239.218", "if_index":7, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-7" }, { "entity_id":8589934629, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":5, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-5" }, { "entity_id":8589934614, "start_ms":1516002399476, "exporter_ip":"10.55.239.218", "if_index":4, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-4" }, { "entity_id":8589934599, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":5, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-5" }, { "entity_id":8589934593, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":4, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-4" }, { "entity_id":8589934613, "start_ms":1516002399475, "exporter_ip":"10.55.239.218", "if_index":2, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-2" }, { "entity_id":8589934632, "start_ms":1516002407477, "exporter_ip":"10.55.239.217", "if_index":1, "direction":1, "enabled":true, "interface_name":"T1 1/0_AY123", "interface_description":"T1 1/0 test AY_change", "speed":1000, "if_name":"10.55.239.217-T1 1/0_AY123" }, {
Reference 13
"entity_id":8589934595, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":8, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-8" }, { "entity_id":8589934643, "start_ms":1516002407480, "exporter_ip":"10.55.239.217", "if_index":6, "direction":0, "enabled":true, "interface_name":"Fa0/1", "interface_description":"FastEthernet0/1", "speed":100000, "if_name":"10.55.239.217-Fa0/1" }, { "entity_id":8589934631, "start_ms":1516002404483, "exporter_ip":"10.55.239.236", "if_index":6, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-6" }, { "entity_id":8589934634, "start_ms":1516002407477, "exporter_ip":"10.55.239.217", "if_index":2, "direction":1, "enabled":true, "interface_name":"T1 1/1_YY", "interface_description":"T1 1/1 YY", "speed":254401, "if_name":"10.55.239.217-T1 1/1_YY" }, { "entity_id":8589934601, "start_ms":1516002361469, "exporter_ip":"10.55.239.203", "if_index":2, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-2" }, { "entity_id":8589934625, "start_ms":1516002404480, "exporter_ip":"10.55.239.236", "if_index":3, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-3" }, { "entity_id":8589934594, "start_ms":1516002351472, "exporter_ip":"10.55.239.203", "if_index":8, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.203-8"
14 IBM Network Performance Insight 1.3.1: Network Performance Insight References
}, { "entity_id":8589934609, "start_ms":1516002399474, "exporter_ip":"10.55.239.218", "if_index":3, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-3" }, { "entity_id":8589934635, "start_ms":1516002407478, "exporter_ip":"10.55.239.217", "if_index":2, "direction":0, "enabled":true, "interface_name":"T1 1/1_YY", "interface_description":"T1 1/1 YY", "speed":254401, "if_name":"10.55.239.217-T1 1/1_YY" }, { "entity_id":8589934640, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":5, "direction":1, "enabled":true, "interface_name":"Fa0/0", "interface_description":"FastEthernet0/0", "speed":100000, "if_name":"10.55.239.217-Fa0/0" }, { "entity_id":8589934646, "start_ms":1516004669704, "exporter_ip":"10.55.239.218", "if_index":1, "direction":1, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.218-1" }, { "entity_id":8589934621, "start_ms":1516002404479, "exporter_ip":"10.55.239.236", "if_index":1, "direction":0, "enabled":true, "interface_name":"", "interface_description":"", "speed":0, "if_name":"10.55.239.236-1" }]
JSON response to update interfaces
{ "entity_id":8589934640, "start_ms":1516002407479, "exporter_ip":"10.55.239.217", "if_index":5, "direction":1, "enabled":true, "interface_name":"Fa0/0", "interface_description":"FastEthernet0/0", "speed":100000, "if_name":"10.55.239.217-Fa0/0" }
Reference 15
qossummaryProvides the summary of policyQosQueueDrop flow metric that measures the QoS queue drops. ThisAPI is applicable for Flow data only.
This API queries and retrieves information from FLOW_METRIC.RAW, and other FLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.
URL
https://[host]:[port]/service/dataset/aggregation/qossummary
https://<myserver.ibm.com>:9443/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&end=1505888940000&count=10
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entity Yes N/A The entity ID representing the interface.
The three type of entities are:
• <FLOW_METRIC.INTERFACE.exporter_ip> -<FLOW_METRIC.INTERFACE.if_index>
• ncim-<NCIM.NETWORK_INTERFACES.entityID>
• flow-<FLOW_METRIC.INTERFACE. entityID>
start Yes N/A The start of the period for which flow data that mustbe returned.
end Yes N/A The end of the period for which flow data that mustbe returned.
time Yes N/A The name of time short cut:
• last-hour• last-day• last-week• last-month• last-year
count No -1 Number of queues to return. For example, top 10talkers of the resource.
remaining No false A flag to indicate whether a row with the total of theremaining records must be provided.
Sample URL
/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&
16 IBM Network Performance Insight 1.3.1: Network Performance Insight References
end=1505888940000&count=10
/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour
/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour&remaining=true
Error responseFor example:
{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
rank number Rank (1-10) of the record that is relative to allother records. Rank 11 indicates remainingrecords in total.
QueueId number Policy QoS Queue ID
hierarchyName string The hierarchy name for the queue combinedwith policy name and class name in format<policyName>-<comma-separated-listof classNames>.
policyName string QoS policy name
classNames string QoS Class Name
droppedPackets number Sum of policyQosQueueDrop metric
droppedPacketPercent number Percent of policyQosQueueDrop for thisqueue over total policyQosQueueDrop for thisinterface
droppedPacketOverTotalPacket
number Percent of policyQosQueueDrop over totalnumber of packets that pass through thisinterface.
JSON code:
[ { "rank":1, "policyName":"Policy1", "hierarchyName":"Policy1-Class1", "droppedPacketPercent":1.169494703290522, "droppedPacketOverTotalPacket":21.169494703290522, "droppedPackets":499, "QueueId":13, "classNames":"Class1" }, { "rank":2, "policyName":"Policy2", "hierarchyName":"Policy2-Class1,Class11", "droppedPacketPercent":1.3077716321364956, "droppedPacketOverTotalPacket":21.169494703290522, "droppedPackets":558, "QueueId":8, "classNames":"Class1,Class11" }]
Reference 17
summaryProvides the top 10 values for an aggregation on a flow interface over a period. This API is specific forFlow data only.
This API queries and retrieves information from FLOW_METRIC.RAW, and other FLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.
URL
https://[host]:[port]/service/dataset/aggregation/summary
https://<myserver.ibm.com>:9443/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes
Method
The supported request type.
https GET
URL parameters
Name Required Default value Description
entity Yes N/A The entity ID that represents theinterface.
The three type of entities are:
• <FLOW_METRIC.INTERFACE.exporter_ip> -<FLOW_METRIC.INTERFACE.if_index>
• ncim-<NCIM.NETWORK_INTERFACES.entityID>
• flow-<FLOW_METRIC.INTERFACE.entityID>
aggregation Yes N/A The aggregation ID that represents howthe data must be aggregated.
direction No Both The direction of the flow data that mustbe returned.
start Yes N/A The start time of the period for whichflow data must be returned.
end Yes N/A The end time of the period for whichflow data must be returned.
time Yes N/A The name of time short cut:
• last-hour• last-day• last-week• last-month
18 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Required Default value Description
granularity No See Notes. The granularity for which the data mustbe aggregated. For example, 5 minutes,14000 minutes.
remaining No false A flag to indicate whether a row withthe total of the remaining records mustbe provided.
extendedAppInfo No false A flag to indicate whether app baseaggregation result contains additionalNBAR, and NBAR2 applicationinformation as follows:
• description• businessRelevance• applicationGroup• applicationCategory• applicationSubcategory• p2p_technology• tunnelTechnology• encryptedTechnology
Sample URL
/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes
/service/dataset/aggregation/summary?aggregation=app&entity=ncim-102&time=lasthour&granularity=1-minutes&extendedAppInfo=true
Error responseFor example:
{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}{"errorMesg":"Missing mandatory parameter :aggregation"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
rank number Rank (1-10) of the record that isrelative to all other records. Rank11 indicates remaining records intotal.
Reference 19
Name Data type Description
application string Application name as specified inthe NBAR2 Protocol Pack.
Note: Applicable only if theextendedAppInfo parameter isenabled.
description string Description of the application asspecified in the NBAR2 ProtocolPack.
Note: Applicable only if theextendedAppInfo parameter isenabled.
srctos string Note: Applicable only if theextendedAppInfo parameter isenabled.
octets number The aggregated octets value for atime period
packets number The aggregated packets value fora time period
percentage number The relative percentage of totaloctets for a time period.
maxThroughput number The granularity wise maxthroughput(octets) for a timeperiod
avgThroughput number The granularity wise avgthroughput(octets) for a timeperiod
maxUtilization number The granularity wise maxutilization(octets) for a timeperiod
avgUtilization number The granularity wise maxutilization(octets) for a timeperiod
label string Aggregation key values that areseparated by /.
businessRelevance string Specifies whether the applicationis considered relevant to thebusiness activity of theorganization.
Note: Applicable only if theextendedAppInfo parameter isenabled.
20 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Data type Description
applicationGroup string Allows the configuration ofapplications that are groupedbased on the same networkingapplication as the match criteria.
Note: Applicable only if theextendedAppInfo parameter isenabled.
applicationCategory string Allows you to configureapplications that are groupedbased on the first level ofcategorization for each protocolas the match criteria.
Note: Applicable only if theextendedAppInfo parameter isenabled.
applicationSubCategory string Provides the option to configureapplications that are groupedbased on the second level ofcategorization for each protocolas the match criteria.
Note: Applicable only if theextendedAppInfo parameter isenabled.
p2p_technology string Provides the option to indicatewhether a protocol uses p2ptechnology.
Note: Applicable only if theextendedAppInfo parameter isenabled.
tunnelTechnology string Provides the option to configureprotocols based on whether aprotocol tunnels the traffic ofother protocols.
Note: Applicable only if theextendedAppInfo parameter isenabled.
encryptedTechnology string Provides the option to configureapplications that are groupedbased on whether the protocol isan encrypted protocol or not asthe match criteria.
Note: Applicable only if theextendedAppInfo parameter isenabled.
Note:
• The actual fields returned depend on the type of aggregation in the URL. The rank, octets, andpercentage values are constant for all aggregations.
Reference 21
• If granularity is not provided, it is computed as follows:
– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.
The supported aggregations are as follows:
• app – (Application)• app_srctos – (Applications, Source TOS)• conv – (Source, Destination)• conv_app – (Source, Destination, Application)• conv_as – (Source Autonomous System Conversation, Destination Autonomous System Conversation)• conv_tos – (Conversations, TOS)• convgroup – (Source IP Group, Destination IP Group)• convgroup_app – (Source IP Group, Destination IP Group, Application)• convgroup_prot – (Source IP Group, Destination IP Groups, Protocol)• convgroup_tos – (Source IP group, Destination IP Groups, Source TOS)• dstas – (Destination Autonomous System)• dstip – (Destination)• dstip_app – (Destination, Application)• dstipgroup – (Destination IP Group)• dstipgroup_app – (Destination IP Group, Application)• dstipgroup_prot – (Destination IP Group, Protocol)• dstipgroup_tos – (Destination IP Group, Source TOS)• hierarchy_queueid – (QoS Hierarchies with Classification, QoS Hierarchies with Queue ID)• prot – (Protocol)• prot_app – (Protocol, Application)• prot_conv – (Protocol, Source, Destination)• prot_dstip – (Protocol, Destination)• prot_srcip – (Protocol, Source)• srcas – (Source Autonomous System)• srcip – (Source)• srcip_app – (Source, Application)• srcipgroup – (Source IP group)• srcipgroup_app – (Source IP group, Application)• srcipgroup_prot – (Source IP group, Protocol)• srcipgroup_tos – (Source IP group, Source TOS)• srctos – (Source TOS)
JSON code:
[ { "rank":1, "application":"ftp", "srctos":"AF13",
22 IBM Network Performance Insight 1.3.1: Network Performance Insight References
"label":"ftp/AF13", "octets":22866690, "packets":44379, "percentage":19.43, "maxThroughput":532756.93, "avgThroughput":190555.75, "maxUtilization":0.05, "avgUtilization":0.02 }, { "rank":2, "application":"ssh", "srctos":"AF13", "label":"ssh/AF13", "octets":16502348, "packets":35801, "percentage":14.02, "maxThroughput":318072.67, "avgThroughput":137519.57, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":3, "application":"https", "srctos":"AF13", "label":"https/AF13", "octets":16055850, "packets":38910, "percentage":13.64, "maxThroughput":370810.53, "avgThroughput":152912.86, "maxUtilization":0.04, "avgUtilization":0.02 }, { "rank":4, "application":"https", "srctos":"AF13", "label":"https/AF13", "octets":10447134, "packets":18166, "percentage":8.88, "maxThroughput":260432.53, "avgThroughput":107150.09, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":5, "application":"bootps", "srctos":"AF13", "label":"bootps/AF13", "octets":9739971, "packets":17876, "percentage":8.28, "maxThroughput":230403.47, "avgThroughput":118060.25, "maxUtilization":0.02, "avgUtilization":0.01 }, { "rank":6, "application":"nicname", "srctos":"AF13", "label":"nicname/AF13", "octets":9577779, "packets":19000, "percentage":8.14, "maxThroughput":178783.87, "avgThroughput":91216.94, "maxUtilization":0.02, "avgUtilization":0.01 }, { "rank":7, "application":"sqlserv", "srctos":"AF13", "label":"sqlserv/AF13", "octets":9437316, "packets":26845, "percentage":8.02,
Reference 23
"maxThroughput":340232.93, "avgThroughput":125830.88, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":8, "application":"domain", "srctos":"AF13", "label":"domain/AF13", "octets":9058840, "packets":14997, "percentage":7.70, "maxThroughput":287669.60, "avgThroughput":109804.12, "maxUtilization":0.03, "avgUtilization":0.01 }, { "rank":9, "application":"irc", "srctos":"AF13", "label":"irc/AF13", "octets":7185223, "packets":9944, "percentage":6.10, "maxThroughput":197913.07, "avgThroughput":106447.75, "maxUtilization":0.02, "avgUtilization":0.01 }, { "rank":10, "application":"bootpc", "srctos":"AF13", "label":"bootpc/AF13", "octets":6827520, "packets":9747, "percentage":5.80, "maxThroughput":159044.53, "avgThroughput":82757.82, "maxUtilization":0.02, "avgUtilization":0.01 }]
Response for the URL with extendedAppInfo flag set:
[ { "rank":1, "application":"ftp", "description":"", "businessRelevance":"", "applicationGroup":"", "applicationCategory":"", "applicationSubCategory":"", "p2p_technology":"", "tunnelTechnology":"", "encryptedTechnology":"", "label":"ftp", "octets":1627476, "packets":5392, "percentage":17.00, "maxThroughput":216996.80, "avgThroughput":216996.80, "maxUtilization":0.02, "avgUtilization":0.02 }, { "rank":2, "application":"bootps", "description":"", "businessRelevance":"", "applicationGroup":"", "applicationCategory":"", "applicationSubCategory":"", "p2p_technology":"", "tunnelTechnology":"", "encryptedTechnology":"",
24 IBM Network Performance Insight 1.3.1: Network Performance Insight References
"label":"bootps", "octets":1600439, "packets":3975, "percentage":16.71, "maxThroughput":213391.87, "avgThroughput":213391.87, "maxUtilization":0.02, "avgUtilization":0.02 }]
Related informationNBAR Categorization and AttributesNBAR2 Protocol Pack 33.0.0
thresholdProvides a list of all the thresholds on Flow data in the system. This API is specific for Flow data only.
This API queries and retrieves information from CFG.THRESHOLD table.
URL
http://[host]:[port]/service/dataset/cfg/threshold
http://<myserver.ibm.com>:9443/service/dataset/cfg/threshold/?fields=*
Method
The supported request type.
HTTP GET
URL parameters
Name Required Description
fields No Fields that must be returned.
count No Number of Flow interface records thatmust be returned.
sort No How the records must be sorted.Prefix + or - to indicate sort direction.For example, +metric,-upper_limit indicates to sort bymetric ascending, and then sort byupper_limit descending. You cangive comma-separated parametersfor sorting.
condition No Expression that must be used to filterspecific records. For example,condition=name=test.
Sample URLs
/service/dataset/flow/threshold/?fields=*
/service/dataset/flow/threshold/?fields=*&count=5
/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1&sort=+start_ms
Reference 25
/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
entity_id number The internal system ID for thereturned Flow interface
metric_id number The internal system ID for themetric
start_ms number The system time when thresholdis configured.
period_sec number The accumulated time in secondswhen the threshold is monitored.
enabled boolean Flag to indicate whetherthreshold monitoring is enabledin the system for the Flowinterface.
kind number The type of threshold monitored.0 is Static Threshold and 1 isLearned Threshold.
Note: Currently, it is notsupported and it always returns0.
limit_type number The limit type for thresholdmonitored.
• 0 is Over• 1 is Under• 2 is Band
upper_limit number The upper bound limit for thethreshold monitored
lower_limit number The lower bound limit for thethreshold monitored
num_events number The number of events that aregenerated on the Flow interface.
learning_days number The number of days for thesystem to learn the pattern.
Note: Currently, it is notsupported.
interface_id number The internal system ID for thereturned Flow interface
direction number The direction of the Flowinterface (0=ingress, 1=egress)
speed number The speed of the Flow interfacein bits per second
26 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Data type Description
exporter_ip string The IP address of the exporter onwhich the Flow interfaces reside.
if_index number The index of the Flow interfaceon the exporter
if_name string The name of the Flow interfaceas known by the exporter
JSON code:
[ { "entity_id":8589934601, "metric_id":1, "start_ms":1472466812124, "period_sec":60, "enabled":false, "kind":0, "limit_type":0, "upper_limit":80923502, "lower_limit":60692626, "num_events":2, "learning_days":0, "interface_id":8589934601, "direction":0, "speed":0, "exporter_ip":"::1", "if_index":1, "if_name":"::1-1" }, { "entity_id":8589934600, "metric_id":1, "start_ms":1472466812125, "period_sec":60, "enabled":false, "kind":0, "limit_type":0, "upper_limit":62739672, "lower_limit":47054754, "num_events":2, "learning_days":0, "interface_id":8589934600, "direction":1, "speed":0, "exporter_ip":"::1", "if_index":1, "if_name":"::1-1" }]
timeseriesProvides a timeseries of data for an aggregation on a flow interface over a period. For timeseries returnwith top10 query, the utilization is only calculated if the speed information is available in NCIM database.If the information is not available, value null is returned.
This API queries and retrieves information from FLOW_METRIC.RAW, and other FLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.
URL
https://[host]:[port]/service/dataset/aggregation/timeserieshttps://[host]:[port]/service/dataset/aggregation/timeseries/top10
https://<myserver.ibm.com>:8081service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-
Reference 27
minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entity Yes N/A The entity ID that represents the interface.
The three type of entities are:
•<FLOW_METRIC.INTERFACE.exporter_ip> -<FLOW_METRIC.INTERFACE.if_index>
• ncim-<NCIM.NETWORK_INTERFACES.entityID>
• flow-<FLOW_METRIC.INTERFACE.entityID>
aggregation Yes N/A The aggregation ID that represents how the datamust be aggregated.
direction No Both The direction of the flow data that must bereturned.
start Yes N/A The start time of the period for which flow datamust be returned.
end Yes N/A The end time of the period for which flow datamust be returned.
granularity No N/A The granularity for which the data must beaggregated. The default granularity can be asfollows:
• 1-minute• 15-minute• 30-minute• 1-day• 7-day
key Yes
No (For top10query)
N/A Combination of grouping keys that are separatedby /. This key must be in the same aggregationorder and support only the top 10 grouping fromaggregation summary.
The grouping key value must be same as thegrouping result of aggregation summary API. Thekey parameter is ignored for top10 where all top 10timeseries data is returned.
28 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name RequiredDefaultvalue Description
time Yes N/A The name of time short cut:
• last-hour• last-day• last-week• last-month• last-year
suppressSummary No false Output result without result summary portion.
Sample URL
/service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data
/service/dataset/aggregation/timeseries/top10?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute
Note:
• The query supports the top 10 grouping from the aggregation summary for the provided time period.• This query runs on aggregation summary result cache and the parameter key value must be as
appeared in aggregation summary API result.• If granularity is not provided, it is computed as follows:
– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.
Error responseFor example:
{"errorMesg":"Missing mandatory parameter :aggregation"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs : 1568373360000 endMs : 1468375200000"}{"errorMesg":"Key parameter must be provided"}
Response
The timeseries API query results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
timestamp number The time that is associated withthe aggregated value.
Reference 29
Name Data type Description
value number The aggregated octets value forthe associated time
JSON code:
[ { "timestamp":1466008980000, "value":999771 }, { "timestamp":1466008990000, "value":999771 }, { "timestamp":1466009000000, "value":999771 }, { "timestamp":1466009100000, "value":999771 }]
The timeseries/top10 API query results are returned as JSON data that contains an array of theheader and result fields as follows:
Table 1. Header fields
Name Data type Description
interface number The interface for which top 10timeseries is calculated.
direction number The direction of the interface
exporter string The exporter IP of the interface
keysSeparator string The separator that is used forcombining the grouping keys.
keys string The grouping keys that are usedfor the aggregation.
speed long The speed of the interface.
Table 2. Result Fields
Name Data type Description
key string The grouping key value for this record,
timestamp long The time that is associated with theaggregated value.
sumOctet long The sumoctets that is calculated forthis grouping key value.
sumPacket long The sumpackets that is calculated forthis grouping key value.
throughput double The number of packets aggregated pergranularity specified.
30 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Table 2. Result Fields (continued)
Name Data type Description
utilization string It is the throughput based on speed ofthe interface.
JSON code without timeseries/top10 query
[ { "timestamp":1466008980000, "value":999771 }, { "timestamp":1466008990000, "value":999771 }, { "timestamp":1466009000000, "value":999771 }, { "timestamp":1466009100000, "value":999771 }]
JSON code for timeseries/top10 query:
{ "interface":1, "direction":"ingress", "exporter":"127.0.0.1", "keysSeparator":"/", "speed":10000000, "keys":[ "srcIp", "dstIp", "appName" ], "timeseries":[ { "key":"56.199.177.191/40.47.23.8/https", "timestamp":1503540000000, "sumOctet":998005, "sumPacket":8457, "throughput":887.1155555555556, "utilization":0.008871155555555557 }, { "key":"192.178.122.236/61.186.117.57/https", "timestamp":1503540000000, "sumOctet":996126, "sumPacket":1617, "throughput":885.4453333333333, "utilization":0.008854453333333333 }, { "key":"132.118.233.143/212.104.175.192/nntp", "timestamp":1503540000000, "sumOctet":999710, "sumPacket":1308, "throughput":888.6311111111111, "utilization":0.00888631111111111 }, { "key":"176.3.79.144/98.139.180.149/ipv6:21", "timestamp":1503540000000, "sumOctet":996046, "sumPacket":4955, "throughput":885.3742222222222, "utilization":0.008853742222222223 }, { "key":"212.219.83.229/91.32.174.183/ftp", "timestamp":1503540000000,
Reference 31
"sumOctet":999397, "sumPacket":4714, "throughput":888.3528888888889, "utilization":0.008883528888888888 }, { "key":"143.94.84.129/89.245.62.143/ftp-data", "timestamp":1503540000000, "sumOctet":997156, "sumPacket":1959, "throughput":886.3608888888889, "utilization":0.00886360888888889 }, { "key":"149.86.219.239/5.191.66.50/ipv6:445", "timestamp":1503540000000, "sumOctet":999563, "sumPacket":962, "throughput":888.5004444444445, "utilization":0.008885004444444445 }, { "key":"232.149.79.235/18.156.162.132/sctp:68", "timestamp":1503540000000, "sumOctet":999358, "sumPacket":4781, "throughput":888.3182222222222, "utilization":0.008883182222222223 }, { "key":"remaining", "timestamp":1503540000000, "sumOctet":1096729557, "sumPacket":7823086, "throughput":9001125.84088889, "utilization":90.01125840888889 }, { "key":"127.105.91.253/251.24.126.55/ftp", "timestamp":1503540000000, "sumOctet":999579, "sumPacket":1516, "throughput":888.5146666666667, "utilization":0.008885146666666668 }, { "key":"165.147.4.136/132.106.235.232/ipv6:53", "timestamp":1503540000000, "sumOctet":999932, "sumPacket":1022, "throughput":888.8284444444445, "utilization":0.008888284444444445 } ]}
Metric APIsREST APIs that retrieve entity metric data that is collected by Network Manager Collector Service andanalyzed by Entity Analytics Service.
anomaliesProvides anomalies in timeseries entity metric data. This information is used in the Device Dashboard todisplay the network anomalies.
This API queries and retrieves information from THRESHOLD.STATE table.
URL
https://[host]:[port]/service/dataset/metric/anomalies
https://<myserver.ibm.com>:9443/service/dataset/metric/anomalies
32 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of ncim entity IDs.
entityNames No N/A Comma-separated list of entity names
metrics Yes N/A Comma-separated names of the metricsand their aggregation expression.
parents No N/A Comma-separated list of main node ID.
parentNames No N/A Comma-separated list of ncim device names
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value are case-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
start No N/A The start of the period for which flow datathat must be returned.
end No N/A The end of the period for which flow datathat must be returned.
time No N/A The name of time short cut used. Forexample:
• last-hour• last-day• last-week• last-month• last-year
excludeParent No false A flag to exclude the parent ID fromresponse.
childTypes No * Comma-separated list of entity types ofnode that must be filtered in the result.Supported childTypes filter values areinterface, device, probe, and * (All).
Reference 33
Name RequiredDefaultvalue Description
entityResourceTypes No N/A Entity Type of node that must be filtered inresult. For example:
• interface• device• probe• physicalcard• artTarget• qosQueue
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.
Sample URLs
/service/dataset/metric/anomalies?entities=ncim-59,ncim-81,ncim-86&time=lastweek&metrics=ifInDiscards
/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards
/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards
/service/dataset/metric/anomalies?entityNames=T1 1/1,T1 1/2&start=1466008260000&end=1466011860000&metrics=ifInDiscards
/service/dataset/metric/anomalies?parents=1,2&entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards
/service/dataset/metric/anomalies?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&start=1466008260000&end=1466011860000&metrics=ifInDiscards
/service/dataset/metric/anomalies?start=1466008260000&end=1466011860000&metrics=ifInDiscards&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'
/service/dataset/metric/anomalies?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
Note:
• At least one or more of the following parameters must be provided:
– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes
• time or a combination of start AND or OR end must be provided.• time parameter is superseded by combination of start AND or OR end if both combinations are
present and it must support last-hour and last_day only.• Supported operators for properties filter are as follows:
– ,– =
34 IBM Network Performance Insight 1.3.1: Network Performance Insight References
– <>– IN– LIKE– AND– OR
For example:
searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'
Note: "%" is reserved keyword. It must be encoded with %25.
Error Response
{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should beprovided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
entity number The entity that is associated with the time andmetric value.
parent number The parent entity ID that is associated with theentity. The value is defaulted to -1 ifenrichment fails.
entityName string The entity name. The value is defaulted tounknown if enrichment fails.
parentName string The entity’s parent name. The value isdefaulted to unknown if enrichment fails.
metric string The metric name for the associated time andmetric value.
type string The type of anomaly that is detected.
severity string The severity of the anomaly.
start number The time that is associated with the start of theanomaly.
end number The time that is associated with the end of theanomaly.
This field is available when the anomaly isended, but not when anomaly is stilloutstanding.
value number The last violation metric value for theassociated time
Reference 35
Name Data type Description
details string JSON blob that contains the details of theanomaly.
JSON code:
[ { "parent":6, "entityName":"", "parentName":"10.55.239.2", "metric":"ifInDiscards", "entity":59, "details":"{'effectiveTimeStamp':1472098732320,'limitType':0,'upperLimit':10,'lowerLimit':5,'numEvents':2}", "severity":"critical", "type":"StaticThreshold", "start":1472099473383, "value":20 }, { "parent":6, "entityName":"0", "parentName":"10.55.239.2", "metric":"ifInDiscards", "entity":81, "details":"{'effectiveTimeStamp':1472098732320,'limitType':0,'upperLimit':10,'lowerLimit':5,'numEvents':2}", "severity":"critical", "type":"StaticThreshold", "start":1472099473384, "value":10 }]
deviationComputes deviation for the current data that is compared against average value on the same day of weekover N number of weeks.
The deviation REST API is used to compare against an aggregated metric data from a specific startand end time stamp and lookBackWeek to produce a TopN resource list.
Consider the following scenario:
• You provide a start and end time from 1 AM - 2 AM Monday, 28 August 2017.• You select the lookBackWeek of 1.• You select the average value for a specific metric.
In this scenario, the deviation REST API queries all the related device types; interface, physical card,and probe, and the average value of the metric for the period of 7 days earlier, that is, Monday , 21 August2017. The API also compares the results and retrieves the top ranking list.
This API queries and retrieves information from ENTITY_METRIC.AGG_030MIN, ENTITY_METRIC.RAW,NCIM.NETWORK_INTERFACES tables.
URL
https://[host]:[port]/service/dataset/metric/deviation
https://<myserver.ibm.com>:9443/service/dataset/metric/deviation
36 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Method
The supported request type.
https GET
URL parameters
Name Required Default value Description
entities No N/A Comma-separated list of entity IDs
entityNames No N/A Comma-separated list of entity names
metrics Yes N/A Comma-separated names of the metrics.Also supports metric IDs.
parents No N/A Comma-separated list of main node IDs.
Note: Must be associated withchildTypes for ART, QoS relatedmetrics.
parentNames No N/A Comma-separated list of ncim devicenames.
Note: Must be associated withchildTypes for ART and QoS relatedmetrics.
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value are case-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
start No N/A The start time for which flow data mustbe returned.
Note: The start and end time periods fordeviation must be minimum 30 minutesand not longer than 1 day.
end No N/A The end time for which flow data must bereturned.
Note: The start and end time periods fordeviation must be minimum 30 minutesand not longer than 1 day.
time No N/A Specific time values:
• last-hour• last-day
Note: You need either start/end ortime parameters in the URL.
Reference 37
Name Required Default value Description
lookBackWeek Yes N/A The number of weeks to look back.lookBackWeek for deviation is always<=4.
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
cacti
Scope of the resource. Scope is requiredfor ART, QoS related metrics.
Note: For all the performance data that iscollected and analyzed from your Cactideployment scenario, scope is set tocacti.
childTypes No * Comma-separated list of entity types ofnodes that must be filtered in the result.By default, it is device and interface.Supported childTypes filter values areas follows:
• interface• device• probe• physicalcard• artTarget• qosQueue• * (All)
suppressSummary No false Output the result without the summaryportion.
count No -1 Number of entities summary that mustbe returned. Combined with sortprovides topN or bottomN functions. Thedefault value -1 returns all availablerecords.
page No 1 The index of the page with data to return.It must be supplied with countparameter to indicate the page size.
properties No N/A Comma-separated list of properties tooutput.
flowEnabled No false If set to true, the result must containthe flow enabled entities.
entityResourceTypes No N/A Entity Type of node that must be filteredin result. For example:
• interface• device• probe• physicalcard• artTarget• qosQueue
38 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Required Default value Description
excludeParent No false A flag to exclude the parent IDs fromresponse.
parentChildRelation No union Set operation between result from parentID search and entity ID search. Forexample, intersection, union.
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.
Sample URLs
/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/deviation?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/deviation?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'
/service/dataset/metric/deviation?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
/service/dataset/metric/deviation?parents=760&metrics=PingResult&time=last-day&lookBackWeek=4
Note:
• At least one or more of the following parameters must be provided:
– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes
• Supported operators for properties filter are as follows:
– ,– =– <>– IN– LIKE– AND
Reference 39
– OR
For example:
searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'
Note: "%" is reserved keyword. It must be encoded with %25.• time or a combination of start AND or OR end must be provided.• start and end range must be minimum of 30 minutes and maximum 1 day.• time parameter is superseded by combination of start AND or OR end. It must support last-hour
or last_day only.• lookBackWeek parameter must contain the value greater than 0.• count parameter must be used to get top N resources.• Data must always be sorted by deviation value.
Error responseFor example:
{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should be provided"}{"errorMesg":"lookBackWeek is a mandatory parameter and should contain value greater than zero"}{"errorMesg":"Time range between start and end should be minimum 30-mins to maximum 1 day"}{"errorMesg":"Metric Deviation Servlet support only 1 metric"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
total number Total number of records available
page number Current page number
count number Number of records in the page
items list The list of entity metric summary
entity number The entity ID that is associated with the timeand metric value.
parent number The parent Entity ID that is associated withthe entity.
entityName string The entity name. This value is defaulted tounknown, if enrichment fails.
parentName string Parent entity name. This value is defaulted tounknown, if enrichment fails.
startTimestamp number The start time that is associated with themetric value.
endTimestamp number The end time that is associated with themetric value.
40 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Data type Description
metric string The metric name for the associated time andmetric value. If metricId is used for search,this attribute returns the metric name.
rank number The rank (1-N) of the record relative to allother entities based on sort. Default is 0 ifsort parameter is not provided.
devValues number The metric deviation value for the associatedtime, entity, and metric expression.
properties map Map of properties that are given in inputparameters and their values.
inIfId number In interface IDs for given entities if enriched.
outIfId number Out interface IDs for given entities ifenriched.
JSON code without suppressSummary flag set:
{ "total":27, "page":1, "count":27, "items":[ { "entity":59, "parent":59, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "devValues":100, "metricId":"MetricName", "metric":10, "inIfId":11, "outIfId":12 }, { "entity":58, "parent":58, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "devValues":99, "metricId":"MetricName", "metric":10, "inIfId":11, "outIfId":12 } ]}
JSON code with suppressSummary flag set:
[ { "entity":59, "parent":59, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "devValues":100, "metricId":"MetricName", "metric":10, "inIfId":11,
Reference 41
"outIfId":12 }, { "entity":60, "parent":60, "entityName":"entityName", "parentName":"parentName", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "devValues":100, "metricId":"MetricName", "metric":10, "inIfId":11, "outIfId":12 }]
entityProvides a list of entities and their properties for a resource type and search conditions.
This API queries and retrieves information from NCIM.NETWORK_INTERFACES,INVENTORY.ENTITY_NAME, INVENTORY.ENTITY_PROPERTIES and ENTITY_METRIC.RAW andENTITY_METRIC aggregated tables.
URL
https://[host]:[port]/service/dataset/metric/entity
https://<myserver.ibm.com>:9443/service/dataset/metric/entity
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entityResourceTypes No N/A Comma-separated list of entity IDs
all No false Comma-separated list of entity names
properties No N/A Comma-separated list of properties tooutput.
Note: properties is not applicable inthe scenario where NetFlow only data iscollected.
See Scenario 3 - NetFlow only data fromthe Installing and Configuring IBMNetwork Performance Insight guide.
42 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name RequiredDefaultvalue Description
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value arecase-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
Note: searchByProperties is notapplicable in the scenario whereNetFlow only data is collected.
See Scenario 3 - NetFlow only data fromthe Installing and Configuring IBMNetwork Performance Insight guide.
scope true ibm-itnm
flow
cacti
Scope must be set to true for ART andQoS resource types.
Note: For all the performance data thatis collected and analyzed from yourCacti deployment scenario, scope is setto cacti.
flowEnabled No false If set to true, the result must contain theflow enabled entities.
Note: flowEnabled is not applicable inthe scenario where NetFlow only data iscollected since the network topologymight have devices that are enabled forNetFlow data only.
See Scenario 3 - NetFlow only data fromthe Installing and Configuring IBMNetwork Performance Insight guide.
interfaceEnabled No false This parameter is applicable forresource type interface only. If set totrue, it returns a list of interfaces forwhich data collection is enabled.
parentChildRelation No union Set operation between result fromparent ID search and entity ID search.For example, intersection, union.
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.
Sample URLs
/service/dataset/metric/entity?entityResourceTypes=device
/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true
Reference 43
/service/dataset/metric/entity?entityResourceTypes=device&all=true
/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true
/service/dataset/metric/entity?parentNames=10.53.17.207,10.53.12.200&entityResourceTypes=interface&scope=flow&interfaceEnabled=true
Note:
• At least one or more of the following parameters must be provided:
– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes
• Supported operators for properties filter are as follows:
– ,– =– <>– IN– LIKE– AND– OR
For example:
searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'
Note: "%" is reserved keyword. It must be encoded with %25.
Error responseFor example:
{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceTypes, or serachByProperties should be provided"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
entityId number An entity ID
entityName string Name of the entity
parentId number Parent entity ID
parentName string Parent entity name
properties map Map of properties that are given in inputparameters their values.
inIfId number Inbound interface IDs for the entities if theyare enriched.
44 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Data type Description
outIfId number Outbound interface IDs for the entities if theyare enriched.
JSON code without flowEnabled flag set is as follows:
[ { "entityId":-1, "entityName":"ALL", "parentId":-1, "parentName":"ALL" }, { "entityId":5, "entityName":"10.55.239.202", "parentId":5, "parentName":"10.55.239.202" }, { "entityId":1, "entityName":"10.55.239.201", "parentId":1, "parentName":"10.55.239.201" }, { "entityId":6, "entityName":"10.55.239.4", "parentId":6, "parentName":"10.55.239.4" }, { "entityId":9, "entityName":"10.55.239.221", "parentId":9, "parentName":"10.55.239.221" }, { "entityId":7, "entityName":"10.55.239.249", "parentId":7, "parentName":"10.55.239.249" }, { "entityId":3, "entityName":"10.55.239.3", "parentId":3, "parentName":"10.55.239.3" }, { "entityId":8, "entityName":"10.55.239.250", "parentId":8, "parentName":"10.55.239.250" }, { "entityId":4, "entityName":"10.55.239.203", "parentId":4, "parentName":"10.55.239.203" }]
JSON code with flowEnabled flag set is as follows:
[ { "entityId":995, "inIfId":8589936607, "entityName":"Se1/0:0", "parentName":"10.55.239.250", "outIfId":8589936606, "parentId":960 }]
Reference 45
lastValueRetrieves the last value of metric data.
This API queries and retrieves information from ENTITY_METRIC.RAW table.
URL
https://[host]:[port]/service/dataset/metric/lastValue
https://<myserver.ibm.com>:9443/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of entity IDs
entityNames No N/A Comma-separated list of entity names
metrics Yes N/A Comma-separated names of the metrics. Alsosupports metricIDs.
parents No N/A Comma-separated list of main node IDs.
Note: Must be associated with childTypesfor ART, QoS related metrics.
parentNames No N/A Comma-separated list of ncim device names.
Note: Must be associated with childTypesfor ART, QoS related metrics.
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value are case-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
46 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name RequiredDefaultvalue Description
time No N/A Specific time values are as follows:
• last-hour• last-day• last-week• last-month• last-year
Note: You need either start/end or timeparameters in the URL.
start No N/A The start time for which flow data must bereturned.
end No N/A The end time for which flow data must bereturned.
excludeParent No false A flag to exclude the parent ID from response.
scope No
Yes for ART/QoSmetrics
ibm-itnm
flow
cacti
Scope of the resource. Scope is required forART, QoS related metrics.
Note: For all the performance data that iscollected and analyzed from your Cactideployment scenario, scope is set to cacti.
childTypes No * Comma-separated list of entity types of nodesthat must be filtered in the result. By default, itis device and interface. SupportedchildTypes filter values are as follows:
• interface• device• probe• physicalcard• artTarget• qosQueue• * (All)
entityResourceTypes
No N/A Entity type of node that must be filtered inresult. For example:
• interface• device• probe• physicalcard• artTarget• qosQueue
parentChildRelation
No union Set operation between result from parent IDsearch and entity ID search. For example,intersection, union.
site No ALL Configured site name.
Reference 47
Name RequiredDefaultvalue Description
bizHour No ALL Configured business hours for a site. Expectedvalues are OFF, ON and ALL.
Sample URLs
/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/lastValue?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/lastValue?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'
/service/dataset/metric/lastValue?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
Note:
• At least one or more of the following parameters must be provided as follows:
– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes
• time or a combination of start AND or OR end must be provided.• time parameter is superseded by combination of start AND or OR end if both combinations are
present.• Supported operators for searchByProperties filter are as follows:
– ,– =– <>– IN– LIKE– AND– OR
For example:
searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'
48 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Note: "%" is reserved keyword. It must be encoded with %25.
Error responseFor example:
{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should be provided"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
entity number The entity that is associated with the timeand metric value
parent number The parent entity ID associated with theentity.
entityName string The entity name. This value is defaulted asunknown if enrichment fails.
parentName string The parent entity name. This value isdefaulted as unknown if enrichment fails.
MetricValue map Map of metric given in input parameters theirvalues.
JSON code:
[ { "parent":2, "entityName":"entity1", "parentName":"parent2", "health":10.0, "entity":1, "cpuUsage":10.0 }, { "parent":4, "entityName":"entity2", "parentName":"parent4", "health":10.0, "entity":2, "cpuUsage":10.0 }]
metricsProvides a list of metrics that are available for the specified entities and time frame.
This API queries and retrieves information from the ENTITY_METRIC.RAW table.
URL
https://[host]:[port]/service/dataset/metrics
https://<myserver.ibm.com>:9443/service/dataset/metrics
Reference 49
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of entity IDs
entityNames No N/A Comma-separated list of entity names
parents No N/A Comma-separated list of main node IDs
parentNames No N/A Comma-separated list of ncim device names.
Note: Must be associated with childTypesfor ART, QoS related metrics.
searchByProperties
No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value are case-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
time No N/A Specific time values are as follows:
• last-hour• last-day• last-week• last-month• last-year
Note: You need either start/end or timeparameters in the URL.
start No N/A The start time for which flow data must bereturned.
end No N/A The end time for which flow data must bereturned.
excludeParent No false A flag to exclude the parent ID from response.
scope No
Yes for ART/QoSmetrics
ibm-itnm
flow
cacti
Scope of the resource. Scope is required forART, QoS related metrics.
Note: For all the performance data that iscollected and analyzed from your Cactideployment scenario, scope is set to cacti.
50 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name RequiredDefaultvalue Description
childTypes No * Comma-separated list of entity types of nodesthat must be filtered in the result. By default,it is device and interface. SupportedchildTypes filter values are as follows:
• interface• device• probe• physicalcard• artTarget• qosQueue• * (All)
entityResourceTypes
No N/A Entity Type of node that must be filtered inresult. For example:
• interface• device• probe• physicalcard• artTarget• qosQueue
parentChildRelation
No union Set operation between result from parent IDsearch and entity ID search. For example,intersection, union.
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site. Expectedvalues are OFF, ON and ALL.
Sample URLs
/service/dataset/metrics?entities=ncim-217&start=1466008260000&end=1466011860000
/service/dataset/metrics?entities=ncim-217&time=last-hour
/service/dataset/metrics?entityNames=T1 1/1,T1 1/2&time=last-hour
/service/dataset/metrics?parents=3&time=last-month
/service/dataset/metrics?parents=3,1&entities=ncim-86,ncim-217&time=last-month
/service/dataset/metrics?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&time=last-month
/service/dataset/metrics?time=last-month&="PHYSICALADDRESS"='30' AND "LOCATION"='KL'
/service/dataset/metrics?parents=3&time=last-day&childTypes=interface
Note:
• At least one or more of the following parameters must be provided as follows:
– entities– parents– entityNames
Reference 51
– parentNames– entityResourceTypes
• time or a combination of start AND or OR end must be provided.• time parameter is superseded by combination of start AND or OR end if both combinations are
present.• Supported operators for searchByProperties filter are as follows:
– ,– =– <>– IN– LIKE– AND– OR
For example:
searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'
Note: "%" is reserved keyword. It must be encoded with %25.
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
metric string The metric name
metricID long The metric ID for the associated time andmetric value.
units string Unit of measurement for the metric. Forexample, #, %, undef
https://<myserver.ibm.com>:9443/service/dataset/metrics?entities=12,188&time=last-day&scope=ibm-itnm
JSON code:
[ { "metric":"ifInDiscards", "units":"#", "metricId":2118 }, { "metric":"health", "units":"undef", "metricId":2119 }, { "metric":"snmpInBandwidth", "units":"%", "metricId":2120 }]
52 IBM Network Performance Insight 1.3.1: Network Performance Insight References
summaryProvides a summary of the metric data.
This API queries and retrieves information from ENTITY_METRIC.RAW, ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.
URL
https://[host]:[port]/service/dataset/metric/summary
https://<myserver.ibm.com>:9443/service/dataset/metric/summary
Method
The supported request type.
https GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of entity IDs.
entityNames No N/A Comma-separated list of entity names.
metrics Yes N/A Comma-separated name of the metricexpression that includes the type ofaggregation.
For example, snmpInBandwidth,health, max(health), min(health)
parents No N/A Comma-separated list of main node IDs.
parentNames No N/A Comma-separated list of ncim devicenames
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value arecase-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
start No N/A The start time for which flow data mustbe returned.
end No N/A The end time for which flow data mustbe returned.
Note: start and end parameters mustbe used together.
Reference 53
Name RequiredDefaultvalue Description
time No N/A Specific time values:
• last-hour• last-day• last-week• last-month• last-year
Note: You need either start/end ortime parameters in the URL.
sort No N/A Metric expression that defines the sortorder of the records. Only one metric isallowed with the sort expression.Prefix + or - to indicate sort direction.
count No -1 Number of entities summary that mustbe returned. Combined with sortprovides topN or bottomN functions.
page No 1 The index of the page for data display.This parameter is supplied with countparameter to indicate page size. Bydefault, it is 1.
excludeParent No false Flag to exclude the parent ID from theresult. By default, this parameter is setto False.
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
cacti
Scope of the resource. Scope is requiredfor ART, QoS related metrics.
Note: For all the performance data thatis collected and analyzed from yourCacti deployment scenario, scope is setto cacti.
childTypes No * Comma-separated list of entity types ofnodes that must be filtered in the result.By default, it is device and interface.Supported childTypes filter values areas follows:
• interface• device• probe• physicalcard• artTarget• qosQueue• * (All)
flatten No false Output of the result without nested theobjects.
suppressSummary No N/A Output of the result without thesummary portion.
54 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name RequiredDefaultvalue Description
entityResourceTypes No N/A Entity Type of node that must be filteredin result. For example:
• interface• device• probe• physicalcard• artTarget• qosQueue
parentChildRelation No union Set operation between the result fromparent identifier search and entityidentifier search.
flowEnabled No false If set to true, the result must containthe flow enabled entities.
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.
Sample URLs
/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/summary?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/summary?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)
/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10
/service/dataset/metric/summary?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10
/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=lasthour&page=2&count=10
/service/dataset/metric/summary?metrics=snmpInBandwidth&time=last-hour&page=2&count=10&searchByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'
/service/dataset/metric/summary?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,
Reference 55
device/service/dataset/metric/summary?metrics=ifInDiscards&time=last-hour&entityResourceType=interface
/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(health),count(health)&time=last-hour&flatten=true
/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&suppressSummary=true
/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(snmpInBandwidth),count(ifOutErrors)&time=lasthour&suppressSummary=false
/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&parentChildRelation=[union/intersection]
Note:
• At least one or more of the following parameters must be provided:
– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes
• time or a combination of start AND or OR end must be provided.• The start and end parameters must be used together. The time parameter supersedes start and end if
they are all present in the URL.• Supported operators for properties filter are as follows:
– ,– =– <>– IN– LIKE– AND– OR
For example:
properties="IFADMINSTATUS"='"up" AND "If"="897"properties="sysName"='"10.55.239.40" AND "If" IN ("897","898")'properties="sysName" like '"10.55.239.%25" AND "If"="897"
Note: "%" is reserved keyword. It must be encoded with %25.• count must be provided with sort.• metric used in the sort parameter must be in one of the expressions that is used in metrics
parameter.• When sort is not provided, output is sorted by entities and rank is shown as zero.
Error responseFor example:
{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceType or searchByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :
56 IBM Network Performance Insight 1.3.1: Network Performance Insight References
1568373360000 endMs : 1468375200000"}
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
total number Total number of records available
page number Current page number
count number Number of records in the page
items list List of metric values. The entity that isassociated with the time and metric value.
entity number The entity that is associated with the timeand metric value.
parent number The entity that is associated with the timeand metric value.
entityName string The parent entity ID that is associated withthe entity.
parentName string Parent entity name. This value is defaulted tounknown, if enrichment fails.
scope string Scope of the resource. For example, ibm-itnm or flow.
startTimestamp number The start time that is associated with themetric value.
endTimestamp number The end time that is associated with themetric value.
rank number The rank (1-N) of the record relative to allother entities based on sort. Defaults to 0 ifsort parameter is not provided.
metricValues list The list metric names and their values.
metric string The metric expression for the associated timeand metric value.
metricId long The metric ID for the associated time andmetric value.
value number The metric value for the associated time,entity, and metric expression.
inIfId number In interface IDs for given entities if enriched.
outIfId number Out interface IDs for given entities ifenriched.
JSON code without suppressSummary flag set:
{ "total":27, "page":1, "count":27, "items":[ { "entity":59,
Reference 57
"scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "metricValues":[ { "metric":"min(health)", "metricId":2118, "value":0 }, { "metric":"max(health)", "metricId":2118, "value":54 }, { "metric":"avg(health)", "metricId":2118, "value":50 }, { "metric":"avg(snmpInBandwidth)", "metricId":2119, "value":150 } ] }, { "entity":61, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "metricValues":[ { "metric":"min(health)", "metricId":2118, "value":0 }, { "metric":"max(health)", "metricId":2118, "value":54 }, { "metric":"avg(health)", "metricId":2118, "value":50 }, { "metric":"avg(snmpInBandwidth)", "metricId":2119, "value":150 } ] } ]}
JSON code with suppressSummary flag set:
[ { "entity":59, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "metricValues":[ { "metric":"min(health)", "metricId":2118, "value":0 }, { "metric":"max(health)", "metricId":2118, "value":54 } ]
58 IBM Network Performance Insight 1.3.1: Network Performance Insight References
}]
JSON code with flatten and suppressSummary flags set:
{ "total":27, "page":1, "count":27, "items":[ { "entity":59, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "min(health)":0, "max(health)":54, "avg(health)":50, "avg(snmpInBandwidth)":150 }, { "entity":61, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "min(health)":54, "avg(health)":50, "avg(snmpInBandwidth)":150 } ]}
JSON code with flatten and flag set:
[ { "entity":59, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":1, "min(health)":0, "max(health)":54 }, { "entity":61, "scope":"ibm-itnm", "startTimestamp":1469515500000, "endTimestamp":1469615500000, "rank":2, "min(health)":54, "avg(health)":50, "avg(snmpInBandwidth)":150 }]
timeseriesProvides timeseries entity metric data.
This API queries and retrieves information from ENTITY_METRIC.RAW, ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.
URL
https://[host]:[port]/service/dataset/metric/timeseries
https://<myserver.ibm.com>:9443/service/dataset/metric/timeseries?entities=ncim-348&metrics=ifInDiscards&time=last-hour
Reference 59
Method
The supported request type.
https GET
URL parameters
Name Required Default value Description
entities No N/A Comma-separated list of entity IDs.
entityNames No N/A Comma-separated list of entity names.
metrics Yes N/A Comma-separated list of metrics andtheir aggregation.
For example, snmpInBandwidth,health, max(health), min(health)
parents No N/A Comma-separated list of main node ID.
parentNames No N/A Comma-separated list of ncim devicenames
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>'<propertyValue>'
Note: Property name and value arecase-sensitive.
For example:
"IFTYPESTRING"='ethernet-csmacd'
start No N/A The start time for which flow data mustbe returned.
end No N/A The end time for which flow data mustbe returned.
time No N/A The name of the time short cut. Forexample:
• last-hour• last-day• last-week• last-month• last-year
granularity No N/A The granularity for which the data mustbe aggregated. The default granularitycan be as follows:
• 1-minute• 15-minute• 30-minute• 1-day• 7-day
60 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Required Default value Description
scope No
Yes for ART/QoSmetrics
ibm-itnm
flow
cacti
Scope of the resource. Scope is requiredfor ART, QoS related metrics.
Note: For all the performance data thatis collected and analyzed from yourCacti deployment scenario, scope is setto cacti.
sort No N/A An expression that defines the sortorder of the records. Prefix + or - toindicate sort direction. For example,+metric -upper_limit indicates thatthe sorting must be by metric inascending order, and then byupper_limit in descending order.
childTypes No * Comma-separated list of entity types ofnodes that must be filtered in the result.By default, it is device and interface.Supported childTypes filter values areas follows:
• interface• device• probe• physicalcard• artTarget• qosQueue• * (All)
excludeParent No N/A Flag to exclude the parent ID from theresult. By default, this parameter is setto False.
flatten No false Output of the result without nested theobjects.
entityResourceTypes No N/A Entity Type of node that must be filteredin result. For example:
• interface• device• probe• physicalcard• artTarget• qosQueue
parentChildRelation No union Set operation between result fromparent ID search and entity ID search.For example, intersection, union.
site No ALL Configured site name.
bizHour No ALL Configured business hours for a site.Expected values are OFF, ON and ALL.
Reference 61
Name Required Default value Description
properties No N/A Comma-separated list of properties thatare returned for the entities that arespecified.
Sample URLs
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=lasthour&granularity=5-min
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min
/service/dataset/metric/timeseries?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min
/service/dataset/metric/timeseries?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&granularity=30-min
/service/dataset/metric/timeseries?parents=3&entities=ncim-86&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/timeseries?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/timeseries?metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&serachByProperties="PHYSICALADDRESS"='30' AND "LOCATION"='KL'
/service/dataset/metric/timeseries?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
/service/dataset/metric/timeseries?entityResourceTypes=probe&metrics=Probe.Echo.Probe.Loss.Percent&parentNames=10.55.239.235&start=1561381980000&end=1561468379000&count=10&properties=sourceAddress,targetAddress,vendor
Note:
• At least one or more of the following parameters must be provided as follows:
– entities– parents– entityNames– parentNames– searchByProperties– entityResourceTypes
• time or a combination of start and end or start or end must be provided.• Sort by metric, entitities, and timestamp are only supported.• The start and end parameters must be used together. The time parameter supersedes start and end if
they are all present in the URL.• time parameter is superseded by combination of start AND or OR end.• Supported operators for properties filter are as follows:
– ,
62 IBM Network Performance Insight 1.3.1: Network Performance Insight References
– =– <>– IN– LIKE– AND– OR
For example:
searchByProperties="sysName"='"10.55.239.40"' AND "If"='897'searchByProperties="sysName"='"10.55.239.40"' AND "If" IN ('897','898')searchByProperties="sysName" like '"10.55.239.%25"' AND "If"='897'
Note: "%" is reserved keyword. It must be encoded with %25.• If granularity is not provided, it is computed as follows:
– If time range is <= 3 hours, granularity = 1 minute– If time range is >3 hour and <=12 hour, granularity = 15 minutes– If time range is >12 hour and <=7 days, granularity = 30 minutes– If time range is between 7 and <90 days, granularity = 1 day– If time range is >=90 days, granularity = 7days
• When the parents or parentNames and entities or entityNames are used in the same URL andthe parentChildRelation is equal to intersection, the result is related to the specific parent andentity. By default, the relation is union, and displays all the parents and entities.
Special behavior
When you specify a granularity period with a start and end time in your query, the API engine alwaysreturns the data from the next available round up time. For example, if you give a query as follows:
https://<myserver.ibm.com>:9443/service/dataset/metric/timeseries?entities=43064,188&metrics=ifInDiscards&start=1497052800000&end=1497117600000&granularity=18-hours
The start time is calculated based on the aggregation round up time. For 18-hrs granularity, the round upaggregation times for the start time of June 10, 2017 12:00:00 AM are:
• June 9, 2017 12:00:00 PM• June 10, 2017 6:00:00 AM• June 11, 2017 12:00:00 AM
The query returns the aggregated data from next available round up time that is June 10, 2017 6:00:00AM and not from June 10, 2017 12:00:00 AM.
Note: This behavior is noticed with timeseries API only.
Error responseFor example:
{"errorMesg":"Either entities, parents, entityNames, parentNames or serachByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs : 1568373360000endMs : 1468375200000"}}
Reference 63
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description
entity number The entity that is associated withthe time and metric value.
parent number The parent entity ID that isassociated with the entity.
entityName string The entity name. The value isdefaulted to unknown ifenrichment fails.
parentName string The entity’s parent name. Thevalue is defaulted to unknown ifenrichment fails.
scope string Scope of the resource that isibm-itnm.
metric string The metric name for theassociated time and metric value
metricId long The metric ID for the associatedtime and metric value.
timestamp number The time that is associated withthe metric value.
value number The metric value for theassociated time
<property> string Values of the requestedproperties that are specified inthe request URL.
JSON code without flatten parameter set:
[ { "parent":6, "timestamp":1471503616000, "entityName":"0", "parentName":"10.55.239.2", "scope":"ibm-itnm", "metric":"ifOutErrors", "metricId":2118, "entity":86, "value":5398 }, { "parent":-1, "timestamp":1471501946000, "entityName":"unknown", "parentName":"unknown", "scope":"ibm-itnm", "metric":"ifOutErrors", "metricId":2118, "entity":134, "value":40 }, { "parent":8, "timestamp":1471501956000, "entityName":"T1 1/2", "parentName":"10.55.239.4", "scope":"ibm-itnm", "metric":"ifOutErrors", "metricId":2118,
64 IBM Network Performance Insight 1.3.1: Network Performance Insight References
"entity":114, "value":0 }]
JSON code with flatten parameter set:
[ { "parent":587, "timestamp":1506250800000, "scope":"ibm-itnm", "entityName":"0", "parentName":"10.55.239.31", "AVG(ifInDiscards)":6, "entity":607, "SUM(ifInDiscards)":6 }, { "parent":587, "timestamp":1506258000000, "scope":"ibm-itnm", "entityName":"0", "parentName":"10.55.239.31", "AVG(ifInDiscards)":6, "entity":607, "SUM(ifInDiscards)":6 }]
JSON code with properties
[{ "targetAddress":"4.20.45.112", "parent":3202, "timestamp":1561423380000, "scope":"ibm-itnm", "entityName":"10.55.239.235_udpEcho:<201>", "parentName":"10.55.239.235", "metric":"Probe.Echo.Probe.Loss.Percent", "sourceAddress":"20.10.11.119", "entity":3878, "vendor":"Cisco", "value":50 }, { "targetAddress":"4.10.110.47", "parent":3202, "timestamp":1561387380000, "scope":"ibm-itnm", "entityName":"10.55.239.235_echo:<106>", "parentName":"10.55.239.235", "metric":"Probe.Echo.Probe.Loss.Percent", "sourceAddress":"10.25.238.209", "entity":3852, "vendor":"Cisco", "value":100 }]
Threshold APIREST APIs that define entity metric Thresholds and stores Threshold definitions.
definitionRetrieves and stores the threshold definitions.
It performs the following functions:
• Get all the stored threshold definitions• Get a single definition based on an identifier• Stores a definition
Reference 65
With this API, information is queried and retrieved from THRESHOLD.STATIC_DEFINITION table. It canalso store a new threshold definition in the table.
URL
https://[host]:[port]/service/dataset/threshold/definition
https://<myserver.ibm.com>:9443/service/dataset/threshold/definition
Method
The supported request type.
https GEThttps POST/PUT
URL parameters
Name Required Description
query No Provides a query predicate, which is a filter that is applied toa where clause.
fields No Specifies the wanted fields in the response
count No Specifies the wanted maximum number of rows in theresponse
sort No How the records must be sorted. Prefix + or - to indicate sortdirection. For example, +metric, -upper_limit indicatesto sort by metric in ascending order, and then sort byupper_limit in descending order.
Sample URL
Get All
https://<myserver.ibm.com>:9443/service/dataset/threshold/definition
Get one (Query by an identifier)
https://<myserver.ibm.com>:9443/service/dataset/threshold/definition?query=threshold_id=2
Post or Put
https://<myserver.ibm.com>:9443/service/dataset/threshold/definition
Response
The results are returned as JSON data that contains an array of the following fields:
Name Data type Description Example
metric string The metric name snmpInBandwidth
effective_time_stamp
long Most recent time whenthe static definition isstored or updated.
UNIX epoch time withmillisecond precision
66 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Name Data type Description Example
threshold_id long Unique identifier for thethreshold definition
2
Important: When youpost a thersholddefinition for IP SLAdata, always usethreshold_id =0.
enabled boolean Indicates whether thethreshold definition isactive or not.
true or false
limit_type int How the static thresholdranges are to be applied.
• 0 is Over• 1 is Under• 2 is Band
upper_limit long Upper range limit 1000
lower_limit long Lower range limit 100
num_events int Number of consecutiveoccurrences that arerequired to violate athreshold.
4
Get response
[ { "metric":"snmpInBandwidth", "effective_time_stamp":1469199999999, "threshold_id":1, "enabled":true, "limit_type":2, "upper_limit":400000, "lower_limit":330000, "num_events":5 }, { "metric":"snmpOutBandwidth", "effective_time_stamp":1469199999999, "threshold_id":2, "enabled":true, "limit_type":2, "upper_limit":400000, "lower_limit":330000, "num_events":5 }, { "metric":"ifInErrors", "effective_time_stamp":1469199999999, "threshold_id":3, "enabled":true, "limit_type":0, "upper_limit":1000, "lower_limit":250, "num_events":2 }, { "metric":"ifOutErrors", "effective_time_stamp":1469199999999, "threshold_id":4, "enabled":true, "limit_type":0, "upper_limit":200, "lower_limit":50, "num_events":2 }]
Reference 67
Payload for Post
{ "metric":"snmpInBandwidth", "effective_time_stamp":1469199999999, "threshold_id":2, "enabled":true, "limit_type":2, "upper_limit":400000, "lower_limit":330000, "num_events":6}
Payload for Post for IP SLA data
{"metric":"httpRtt, "effective_time_stamp":1470275112000, "threshold_id":0, "enabled":true, "limit_type":2, "upper_limit":50, "lower_limit":10, "num_events":2}
Attention: The threshold_id must be a unique number for that metric. Check theTHRESHOLD.STATIC_DEFINITION table for the existing threshold IDs. If you do not specify aunique ID the existing metric with the same ID is updated and the new threshold definition is notcreated for the metric.
Command line interfaceProvide command-line interfaces that are available in IBM Network Performance Insight to supportinstallation, configuration, administration, and other tasks.
A list of commands available for Network Performance Insight users and administrators.
basecamp-manager-cmd command referenceUsage for the basecamp-manager-cmd command. Run the basecamp-manager-cmd command tostart, stop, and check the status of Network Performance Insight services.
Location
Note: basecamp-manager-cmd command can be run as root, netcool or a non-root user with sudopermissions to control Network Performance Insight services.
<basecamp_Home>/basecamp-manager/bin
<basecamp_Home> is the location where the generic basecamp packages are installed. Forexample, /opt/IBM/basecamp.
68 IBM Network Performance Insight 1.3.1: Network Performance Insight References
basecamp-manager-cmd command syntaxbasecamp-manager-cmd action stop
start
status
service npi-cacti-collector
npi-dns
npi-event
npi-formula
npi-flow-collector
npi-flow-analytics
npi-itnm-collector
npi-snmp-collector
npi-snmp-discovery
npi-threshold
basecamp-exporter
basecamp-manager
basecamp-storage
basecamp-timeseries
basecamp-ui
host
basecamp-manager-cmd {action [stop|start|status] | -service <service_name> | -host<hostname>}
Parametersservice
Specify the name of the service.
• npi-cacti-collector• npi-dns• npi-event• npi-formula• npi-flow-collector• npi-flow-analytics• npi-itnm-collector• npi-snmp-collector• npi-snmp-discovery• npi-threshold• basecamp-exporter• basecamp-manager• basecamp-storage• basecamp-timeseries• basecamp-ui
hostFully qualified host name (FQDN) where the service is located.
actionstop
Stops the specified service.
Reference 69
start
Start the specified service.
status
Checks the status of the specified service.
Note: You can check the status only when the Manager Service is up and running.
For example:
To start the Flow Collector Service:
/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -service npi-flow-collector -host <myserver.ibm.com> start
To display the status of all services on all hosts:
/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd status
To display the status of all services on a particular host as non-root user:
sudo /opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -host <myserver.ibm.com> status
backup command referenceUsage for the backup command. Run the backup command to back up Network Performance Insightstorage database. Starting from Fix Pack 1, the backup command location is changed.
Location
Note: backup command can be run as root or netcool user with sudo permissions to control NetworkPerformance Insight services.
<basecamp_Home>/basecamp-storage/bin
<basecamp_Home> is the location where the basecamp packages are installed. For example, /opt/IBM/basecamp.
backup command syntaxbackup ?
path
?
help
?
?
tool
backup {-path <local directory>|-tool <backup tool script location> |-help}
Parameterspath
The directory path of where the backup tar files are stored.tool
The full path of where the Customized_script is located. For example: <basecamp_Home>/basecamp-storage/bin/directory/Customized_scriptBy default, this option uses the <basecamp_Home>/basecamp-storage/bin/backup-tool scriptto create tar files to the path specified in -path.
helpDisplays the usage for backup command.
70 IBM Network Performance Insight 1.3.1: Network Performance Insight References
restore command referenceUsage for the restore command. Run the restore command to restore Network Performance Insightstorage database. Starting from Fix Pack 1, the restore command location is changed.
Location
Note: restore command can be run as root or netcool user with sudo permissions to controlNetwork Performance Insight services.
<basecamp_Home>/basecamp-storage/bin
<basecamp_Home> is the location where Network Performance Insight is installed. Forexample, /opt/IBM/basecamp.
restore command syntaxrestore ?
localBackup
help
restore {-localBackup <backup tarball location> | -help}
Parameters-localBackup
The directory path of where the backup tar files to be restored from.-help
Displays the usage for restore command.
pack-tool command usageUse this information to understand the usage of some command line options that are available inTechnology Pack Development Tool.
pack_tool
pack-tool command can be run as root user. The script is available in /<pack_dev_tool>/bindirectory. Where, <pack_dev_tool> is the directory where Technology Pack Development Tool is extracted.
UsageRun the following command as root user:
$ bin/pack-tool
-------------------------- Pack Development Tool v1.0 --------------------------
Usage: pack-tool [command] [options]
commands: new <pack> - creates a new pack project build [<pack>] - builds the specified pack project otherwise all projects clean [<pack>] - cleans the specified pack project otherwise all projects validate [<pack>] - validates the specified pack project otherwise all projects help - displays help
Parameters
newCreates a project workspace to contain the Technology Packs that are developed.
Reference 71
buildBuilds and packages the Technology Pack after the development is completed.
cleancleans the specified Technology Pack project. If a project name is not specified, it cleans allprojects.
validateValidates that content with in the Technology Packs after the development is complete.
helpProvides the usage of the pack-tool command.
device-discovery-tool
The device-discovery-tool command is used to run the discovery formulas that are created for yourcustom Technology Pack. The script is available in /<pack_dev_tool>/bin directory. Where,<pack_dev_tool> is the directory where Technology Pack Development Tool is extracted.Usage
Run the following command as root user:
$ bin/device-discovery-tool --------------------------------Discovery Device Tool v0.4.0.2--------------------------------
discovery-device-tool [pack] snmp://[credential]@[host]:[port]?[options]
credential: version 1/2c - [read community string]:[write community string] version 3 - [user name]:[authentication]:[encryption]:[context]authentication: md5(password) - MD5 password sha1(password) - SHA1 password none - No authenticationencryption: des(password) - DES key aes(password) - AES key aes128(password) - AES 128-bit key aes192(password) - AES 192-bit key aes256(password) - AES 256-bit key none - No encryptionoptions: version - SNMP Version (2,3). Default is auto-detect timeout - SNMP timeout in milisecond. Default is 5 seconds retries - Number of retries before giving up. Default is 3 times
Parameterspack
Name of the Technology Pack.credential
Credentials for two the SNMP versions:
• version 1/2c - [read community string]:[write community string]
– read community string: name of the SNMP read community.– write community string: name of the SNMP write community.
• version 3 - [user name]:[authentication]:[encryption]:[context]
– user name: the user name to be used for this SNMP V3 community name.– authentication: the password to be used for authentication (MD5 or SHA1) for this SNMP
V3 element.– encryption: the type of encryption for the privacy password. The following types of
encryption are available:
72 IBM Network Performance Insight 1.3.1: Network Performance Insight References
- 3-DES- AES 128- AES 192- AES 256
– context: the context name to be used for this SNMP V3 community name.
HostHost name of the device associated with this SNMP configuration.
portThe port associated with this SNMP configuration. By default, it is 161.
optionsProvide the additional information as follows:
• version - the SNMP Version (2 or 3) associated with this SNMP configuration.• timeout - the length of time (in seconds) to wait for a response from a request. Default is 5
seconds.• retries - the number of times that a request is tried again if a request failure. Default is 3
times
NetFlow versionsNetFlow technology can collect IP network traffic as it enters or exits an interface.
NetFlow enabled devices can export IP traffic statistics from all interfaces as NetFlow records to becollected by one or more associated NetFlow collectors.
The device emits a flow record when it determines that the Flow is finished by using Flow aging, that is,when the device sees new traffic for an existing Flow, it resets the aging counter. The aging counter isdetermined by Flow active and inactive timeout. Typically, NetFlow records are exported by using UDP.Some modern implementations of NetFlow use the Stream Control Transmission Protocol (SCTP) toexport packets to provide some protection against packet loss, and to make sure that NetFlow v9templates are received before any related record is exported.
The different Flow versions that are supported in Netcool Operations Insight such as:
• NetFlow V1
First implementation of Cisco, which is now obsolete, and restricted to IPv4 only.• NetFlow V5
Most common version, available on many routers from different brands.• NetFlow V9
Template-based Flow. Mostly used to report Flows like IPv6, MPLS, or even plain IPv4 with BGPnexthop.
• IPFIX
Based on the NetFlow Version 9 implementation, IPFIX is on the IETF standards and can beimplemented by multiple vendors.
Reference 73
NetFlow V1 formatsV1 format is the original format that is supported in the initial NetFlow releases.
V1 header format
Bytes Contents Description
0-1 version NetFlow export format versionnumber
2-3 count Number of flows that areexported in this packet (1-24)
4-7 SysUptime Current time in millisecondssince the export device is started
8-11 unix_secs Current count of seconds since0000 Coordinated Universal Time1970
12-16 unix_nsecs Residual nanoseconds since0000 Coordinated Universal Time1970
V1 Flow record format
Bytes Contents Description
0-3 srcaddr Source IP address
4-7 dstaddr Destination IP address
8-11 nexthop IP address of next hop router
12-13 input SNMP index of input interface
14-15 output SNMP index of output interface
16-19 dPkts Packets in the flow
20-23 dOctets Total number of Layer 3 bytes inthe packets of the flow
24-27 First SysUptime at start of flow
28-31 Last SysUptime at the time the lastpacket of the flow was received
32-33 srcport TCP/UDP source port number orequivalent
34-35 dstport TCP/UDP destination portnumber or equivalent
36-37 pad1 Unused (zero) byte
38 prot IP protocol type (for example,TCP = 6; UDP = 17)
39 tos IP type of service (ToS)
40 flags Cumulative OR of TCP flags
74 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Bytes Contents Description
41-43 pad1pad2pad3
Unused (zero) bytes
44-48 Reserved Unused (zero) bytes
Related informationNetFlow Export Datagram Format
NetFlow V5 formatsV5 format is an enhancement that adds Border Gateway Protocol (BGP) autonomous system informationand flow sequence numbers.
V5 header format
Bytes Fields Description
0-1 version NetFlow export format versionnumber
2-3 count Number of flows that areexported in this packet (1-30)
4-7 SysUptime Current time in millisecondssince the export device started
8-11 unix_secs Current count of seconds since0000 Coordinated Universal Time1970
12-15 unix_nsecs Residual nanoseconds since0000 Coordinated Universal Time1970
16-19 flow_sequence Sequence counter of total flowsseen
20 engine_type Type of flow-switching engine
21 engine_id Slot number of the flow-switching engine
22-23 sampling_interval First two bits hold the samplingmode; remaining 14 bits holdvalue of sampling interval
V5 Flow record format
Bytes Fields Description
0-3 srcaddr Source IP address
4-7 dstaddr Destination IP address
8-11 nexthop IP address of next hop router
12-13 input SNMP index of input interface
14-15 output SNMP index of output interface
Reference 75
Bytes Fields Description
16-19 dPkts Packets in the flow
20-23 dOctets Total number of Layer 3 bytes inthe packets of the flow
24-27 First SysUptime at start of flow
28-31 Last SysUptime at the time the lastpacket of the flow was received
32-33 srcport TCP/UDP source port number orequivalent
34-35 dstport TCP/UDP destination portnumber or equivalent
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
38 prot IP protocol type (for example,TCP = 6; UDP = 17)
39 tos IP type of service (ToS)
40-41 src_as Autonomous system number ofthe source, either origin or peer
42-43 dst_as Autonomous system number ofthe destination, either origin orpeer
44 src_mask Source address prefix mask bits
45 dst_mask Destination address prefix maskbits
46-47 pad2 Unused (zero) bytes
Related informationNetFlow Export Datagram Format
V9 field type definitionsWhen extensibility is required, the new field types can be added to the list. The new field types must beupdated on the Exporter and Collector but the NetFlow export format remains unchanged.
Field Type Value Length (bytes) Description
IN_BYTES 1 N (default is 4)Incoming counter with length N x 8 bitsfor number of bytes associated with anIP Flow.
IN_PKTS 2 N (default is 4)Incoming counter with length N x 8 bitsfor the number of packets that areassociated with an IP Flow
FLOWS 3 N Number of flows that are aggregated;default for N is 4
PROTOCOL 4 1 IP protocol byte
SRC_TOS 5 1 Type of Service byte setting when thereis an incoming interface
76 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Field Type Value Length (bytes) Description
TCP_FLAGS 6 1 Cumulative of all the TCP flags seen forthis flow
L4_SRC_PORT 7 2 TCP/UDP source port number. That is,FTP, Telnet, or equivalent
IPV4_SRC_ADDR 8 4 IPv4 source address
SRC_MASK 9 1The number of contiguous bits in thesource address subnet mask. That is,the submask in slash notation
INPUT_SNMP 10 N Input interface index; default for N is 2but higher values might be used
L4_DST_PORT 11 2 TCP/UDP destination port number. Thatis, FTP, Telnet, or equivalent
IPV4_DST_ADDR 12 4 IPv4 destination address
DST_MASK 13 1The number of contiguous bits in thedestination address subnet mask. Thatis, the submask in slash notation.
OUTPUT_SNMP 14 N Output interface index; default for N is 2but higher values might be used
IPV4_NEXT_HOP 15 4 IPv4 address of next-hop router
SRC_AS 16 N (default is 2) Source BGP autonomous systemnumber where N might be 2 or 4
DST_AS 17 N (default is 2) Destination BGP autonomous systemnumber where N might be 2 or 4
BGP_IPV4_NEXT_HOP 18 4 Next-hop router's IP in the BGP domain
MUL_DST_PKTS 19 N (default is 4)IP multicast outgoing packet counterwith length N x 8 bits for packets thatare associated with the IP Flow
MUL_DST_BYTES 20 N (default is 4)IP multicast outgoing byte counter withlength N x 8 bits for bytes associatedwith the IP Flow
LAST_SWITCHED 21 4 System uptime at which the last packetof this flow was switched
FIRST_SWITCHED 22 4 System uptime at which the first packetof this flow was switched
OUT_BYTES 23 N (default is 4)Outgoing counter with length N x 8 bitsfor the number of bytes associated withan IP Flow
OUT_PKTS 24 N (default is 4)Outgoing counter with length N x 8 bitsfor the number of packets that areassociated with an IP Flow.
MIN_PKT_LNGTH 25 2 Minimum IP packet length on incomingpackets of the flow
MAX_PKT_LNGTH 26 2 Maximum IP packet length on incomingpackets of the flow
Reference 77
Field Type Value Length (bytes) Description
IPV6_SRC_ADDR 27 16 IPv6 Source Address
IPV6_DST_ADDR 28 16 IPv6 Destination Address
IPV6_SRC_MASK 29 1 Length of the IPv6 source mask incontiguous bits
IPV6_DST_MASK 30 1 Length of the IPv6 destination mask incontiguous bits
IPV6_FLOW_LABEL 31 3 IPv6 flow label as in RFC 2460 definition
ICMP_TYPE 32 2Internet Control Message Protocol(ICMP) packet type; reported as ((ICMPType*256) + ICMP code)
MUL_IGMP_TYPE 33 1 Internet Group Management Protocol(IGMP) packet type
SAMPLING_INTERVAL 34 4
During the use of sampled NetFlow, therate at which packets are sampled. Thatis, a value of 100 indicates that one ofevery 100 packets is sampled
SAMPLING_ALGORITHM 35 1The type of algorithm that is used forsampled NetFlow: 0x01 DeterministicSampling, 0x02 Random Sampling
FLOW_ACTIVE_TIMEOUT 36 2 Timeout value (in seconds) for activeflow entries in the NetFlow cache
FLOW_INACTIVE_TIMEOUT 37 2 Timeout value (in seconds) for inactiveflow entries in the NetFlow cache
ENGINE_TYPE 38 1 Type of flow switching engine: RP = 0,VIP/Linecard = 1
ENGINE_ID 39 1 ID number of the flow switching engine
TOTAL_BYTES_EXP 40 N (default is 4)Counter with length N x 8 bits for bytesfor the number of bytes exported by theObservation Domain
TOTAL_PKTS_EXP 41 N (default is 4)Counter with length N x 8 bits for bytesfor the number of packets that areexported by the Observation Domain
TOTAL_FLOWS_EXP 42 N (default is 4)Counter with length N x 8 bits for bytesfor the number of flows that areexported by the Observation Domain
*Vendor Proprietary* 43
IPV4_SRC_PREFIX 44 4 IPv4 source address prefix (specific forCatalyst architecture)
IPV4_DST_PREFIX 45 4 IPv4 destination address prefix (specificfor Catalyst architecture)
MPLS_TOP_LABEL_TYPE 46 1MPLS Top Label Type: 0x00 UNKNOWN0x01 TE-MIDPT 0x02 ATOM 0x03 VPN0x04 BGP 0x05 LDP
78 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Field Type Value Length (bytes) Description
MPLS_TOP_LABEL_IP_ADDR 47 4 Forwarding Equivalent Classcorresponding to the MPLS Top Label
FLOW_SAMPLER_ID 48 1 Identifier that is shown in "show flow-sampler"
FLOW_SAMPLER_MODE 49 1The type of algorithm that is used forsampling data: 0x02 random sampling.Use with FLOW_SAMPLER_MODE
FLOW_SAMPLER_RANDOM_INTERVAL 50 4 Packet interval at which to sample. Use
with FLOW_SAMPLER_MODE
*Vendor Proprietary* 51
MIN_TTL 52 1 Minimum TTL on incoming packets ofthe flow
MAX_TTL 53 1 Maximum TTL on incoming packets ofthe flow
IPV4_IDENT 54 2 The IP v4 that identifies field
DST_TOS 55 1 Type of Service byte setting whenexiting outgoing interface
IN_SRC_MAC 56 6 Incoming source MAC address
OUT_DST_MAC 57 6 Outgoing destination MAC address
SRC_VLAN 58 2 Virtual LAN identifier that is associatedwith ingress interface
DST_VLAN 59 2 Virtual LAN identifier that is associatedwith egress interface
IP_PROTOCOL_VERSION 60 1
Internet Protocol version is set to 4 forIPv4, and set to 6 for IPv6. If notpresent in the template, then version 4is assumed.
DIRECTION 61 1 Flow direction: 0 - ingress flow, 1 -egress flow
IPV6_NEXT_HOP 62 16 IPv6 address of the next-hop router
BPG_IPV6_NEXT_HOP 63 16 Next-hop router in the BGP domain
IPV6_OPTION_HEADERS 64 4 Bit-encoded field that identifies IPv6option headers found in the flow
Vendor Proprietary 65
Vendor Proprietary 66
Vendor Proprietary 67
Vendor Proprietary 68
Vendor Proprietary 69
MPLS_LABEL_1 70 3
MPLS label at position 1 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
Reference 79
Field Type Value Length (bytes) Description
MPLS_LABEL_2 71 3
MPLS label at position 2 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_3 72 3
MPLS label at position 3 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_4 73 3
MPLS label at position 4 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_5 74 3
MPLS label at position 5 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_6 75 3
MPLS label at position 6 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_7 76 3
MPLS label at position 7 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_8 77 3
MPLS label at position 8 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_9 78 3
MPLS label at position 9 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
MPLS_LABEL_10 79 3
MPLS label at position 10 in the stack. Itcomprises 20 bits of MPLS label, 3 EXP(experimental) bits and 1 S (end-of-stack) bit.
IN_DST_MAC 80 6 Incoming destination MAC address
OUT_SRC_MAC 81 6 Outgoing source MAC address
IF_NAME 82
N
Shortened interface name, FE1/0(default that isspecified intemplate)
IF_DESC 83N (default that isspecified intemplate)
Full interface name, FastEthernet 1/0
80 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Field Type Value Length (bytes) Description
SAMPLER_NAME 84N (default that isspecified intemplate)
Name of the flow sampler
IN_ PERMANENT _BYTES 85 N (default is 4) Running byte counter for a permanentflow
IN_ PERMANENT _PKTS 86 N (default is 4) Running packet counter for a permanentflow
* Vendor Proprietary* 87
FRAGMENT_OFFSET 88 2 The fragment-offset value fromfragmented IP packets
Reference 81
Field Type Value Length (bytes) Description
FORWARDING STATUS 89 1
Forwarding status is encoded on 1 bytewith the 2 left bits giving the status andthe 6 remaining bits giving the reasoncode.
Status is either unknown (00),Forwarded (10), Dropped (10) orConsumed (11). List of forwardingstatus values with their meanings:
• Unknown
– 0• Forwarded
– Unknown 64– Forwarded Fragmented 65– Forwarded not Fragmented 66
• Dropped
– Unknown 128– Drop ACL Deny 129– Drop ACL drop 130– Drop Unroutable 131– Drop Adjacency 132– Drop Fragmentation and DF set 133– Drop Bad header checksum 134– Drop Bad total Length 135– Drop Bad Header Length 136– Drop bad TTL 137– Drop Policer 138– Drop WRED 139– Drop RPF 140– Drop For us 141– Drop Bad output interface 142– Drop Hardware 143
• Consumed
– Unknown 192– Terminate Punt Adjacency 193– Terminate Incomplete Adjacency
194– Terminate For us 195
82 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Field Type Value Length (bytes) Description
MPLS PAL RD 90 8 (array) MPLS PAL Route Distinguisher.
MPLS PREFIX LEN 91 1 Number of consecutive bits in the MPLSprefix length.
SRC TRAFFIC INDEX 92 4 BGP Policy Accounting Source TrafficIndex
DST TRAFFIC INDEX 93 4 BGP Policy Accounting DestinationTraffic Index
APPLICATION DESCRIPTION 94 N Application description.
APPLICATION TAG 95 1+n 8 bits of engine ID, followed by n bits ofclassification.
APPLICATION NAME 96 N Name that is associated with aclassification.
postipDiffServCodePoint 98 1
The value of a Differentiated ServicesCode Point (DSCP) encoded in theDifferentiated Services field aftermodification.
replication factor 99 4 Multicast replication factor.
DEPRECATED 100 N DEPRECATED
layer2packetSectionOffset 102 Layer 2 packet section offset. Potentially
a generic offset.
layer2packetSectionSize 103 Layer 2 packet section size. Potentially ageneric size.
layer2packetSectionData 104 Layer 2 packet section data.
105 - 127 Reserved for future use by cisco
Related informationNetFlow Version 9 Flow-Record Format
IPFIX Information ElementsIPFIX is an IETF standard based on NetFlow v9.
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
0Re
serv
ed
1oc
tetD
elta
Coun
tTh
e nu
mbe
r of
octe
ts s
ince
the
prev
ious
repo
rt (i
fan
y) in
inco
min
gpa
cket
s fo
r thi
sFl
ow a
t the
Obs
erva
tion
Poin
t.Th
e nu
mbe
r of
octe
ts in
clud
es IP
head
er(s
) and
IPpa
yloa
d.
oct
ets
2pa
cket
Del
taCo
unt
The
num
ber o
fin
com
ing
pack
ets
sinc
e th
e pr
evio
usre
port
(if a
ny) f
orth
is F
low
at t
heO
bser
vatio
n Po
int.
pac
ket
s
3de
ltaFl
ow
Coun
tTh
e co
nser
vativ
eco
unt o
f Orig
inal
Flow
s co
ntrib
utin
gto
this
Agg
rega
ted
Flow
; may
be
dist
ribut
ed v
ia a
nyof
the
met
hods
expr
esse
d by
the
valu
eDis
trib
utio
nMet
hod
Info
rmat
ion
Elem
ent.
flo ws
Reference 83
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
4pr
otoc
olId
entifi
er
The
valu
e of
the
prot
ocol
num
ber i
nth
e IP
pac
ket
head
er. T
hepr
otoc
ol n
umbe
riden
tifies
the
IPpa
cket
pay
load
type
. Pro
toco
lnu
mbe
rs a
rede
fined
in th
e IA
NA
Prot
ocol
Num
bers
regi
stry
.
In In
tern
etPr
otoc
ol v
ersi
on 4
(IPv
4), t
his
isca
rrie
d in
the
Prot
ocol
field.
InIn
tern
et P
roto
col
vers
ion
6 (I
Pv6)
,th
is is
car
ried
in th
eN
ext H
eade
r field
in th
e la
stex
tens
ion
head
erof
the
pack
et.
84 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
5ip
Clas
sOfS
ervi
ceFo
r IPv
4 pa
cket
s,th
is is
the
valu
e of
the
TOS fie
ld in
the
IPv4
pac
ket
head
er. F
or IP
v6pa
cket
s, th
is is
the
valu
e of
the Traffic
Clas
s fie
ld in
the
IPv6
pac
ket
head
er.
Reference 85
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
6tc
pCon
trol
Bits
TCP
cont
rol b
itsob
serv
ed fo
r the
pack
ets
of th
isFl
ow. T
his
info
rmat
ion
isen
code
d as
a b
itfie
ld; f
or e
ach
TCP
cont
rol b
it, th
ere
isa
bit i
n th
is s
et. T
hebi
t is
set t
o 1
if an
yob
serv
ed p
acke
t of
this
Flo
w h
as th
eco
rres
pond
ing
TCP
cont
rol b
it se
t to
1.Th
e bi
t is
clea
red
to0
othe
rwis
e.
The
valu
es o
f eac
hbi
t are
sho
wn
belo
w, p
er th
ede
finition
of t
hebi
ts in
the
TCP
head
er [R
FC79
3][R
FC31
68]
[RFC
3540
]:
MSb
LSb
0 1 2 3 4 5
6 7 8 9 10 11 12
13 14 15
+---+---+---+---+---+---+---
+---+---+---+---+---+---+---
+---+---+
| |
| N | C | E | U | A | P | R
| S | F |
| Zero | Future
| S | W | C | R | C | S | S
| Y | I |
| (Data Offset) | Use
| | R | E | G | K | H | T
| N | N |
+---+---+---+---+---+---+---
+---+---+---+---+---+---+---
+---+---+
bit flag
value name description
------+-----
+----------------------------
---------
0x8000 Zero (see
tcpHeaderLength)
0x4000 Zero (see
tcpHeaderLength)
0x2000 Zero (see
tcpHeaderLength)
0x1000 Zero (see
tcpHeaderLength)
0x0800 Future Use
0x0400 Future Use
0x0200 Future Use
0x0100 NS ECN Nonce Sum
0x0080 CWR Congestion
Window Reduced
0x0040 ECE ECN Echo
0x0020 URG Urgent Pointer
field significant
0x0010 ACK Acknowledgment
field significant
0x0008 PSH Push Function
0x0004 RST Reset the
connection
0x0002 SYN Synchronize
sequence numbers
0x0001 FIN No more data
from sender
As th
e m
ost
sign
ifica
nt 4
bits
of
octe
ts 1
2 an
d 13
(cou
ntin
g fr
omze
ro) o
f the
TCP
head
er [R
FC79
3]ar
e us
ed to
enc
ode
the
TCP
data
offs
et(h
eade
r len
gth)
,th
e co
rres
pond
ing
bits
in th
isIn
form
atio
nEl
emen
t mus
t be
expo
rted
as
zero
and
mus
t be
igno
red
by th
eco
llect
or. U
se th
etc
pHea
derL
engt
hIn
form
atio
nEl
emen
t to
enco
deth
is v
alue
.
Each
of t
he 3
bits
(0x8
00, 0
x400
,an
d 0x
200)
, whi
char
e re
serv
ed fo
rfu
ture
use
in[R
FC79
3], m
ust b
eex
port
ed a
sob
serv
ed in
the
TCP
head
ers
of th
epa
cket
s of
this
Flow
.
If e
xpor
ted
as a
sing
le o
ctet
with
redu
ced-
size
enco
ding
, thi
sIn
form
atio
nEl
emen
t cov
ers
the
low
-ord
er o
ctet
of
this
field
(i.e,
bits
0x80
to 0
x01)
,om
ittin
g th
e EC
NN
once
Sum
and
the
thre
e Fu
ture
Use
bits
. A c
olle
ctor
rece
ivin
g th
isIn
form
atio
nEl
emen
t with
redu
ced-
size
enco
ding
mus
t not
assu
me
anyt
hing
abou
t the
con
tent
of th
ese
four
bits
.
Expo
rtin
gPr
oces
ses
expo
rtin
g th
isIn
form
atio
nEl
emen
t on
beha
lfof
a M
eter
ing
Proc
ess
that
is n
otca
pabl
e of
obse
rvin
g an
y of
the
ECN
Non
ceSu
m o
r Fut
ure
Use
bits
mus
t use
redu
ced-
size
enco
ding
, and
onl
yex
port
the
leas
tsign
ifica
nt 8
bits
of
this
Info
rmat
ion
Elem
ent.
Not
e th
at p
revi
ous
revi
sion
s of
this
Info
rmat
ion
Elem
ent's
defin
ition
spe
cifie
dth
at th
e CW
R an
dEC
E bi
ts m
ust b
eex
port
ed a
s ze
ro,
even
if o
bser
ved.
Colle
ctor
s m
ust
ther
efor
e no
tas
sum
e th
at a
valu
e of
zer
o fo
rth
ese
bits
in th
isIn
form
atio
nEl
emen
t ind
icat
esth
e bi
ts w
ere
neve
rse
t in
the
obse
rved
traffic
, esp
ecia
lly if
thes
e bi
ts a
re z
ero
in e
very
Flo
wRe
cord
sen
t by
agi
ven
expo
rter
.
86 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
7so
urce
Tran
spor
tPor
t
The
sour
ce p
ort
iden
tifier
in th
etr
ansp
ort h
eade
r.Fo
r the
tran
spor
tpr
otoc
ols
UDP,
TCP
,an
d SC
TP, t
his
isth
e so
urce
por
tnu
mbe
r giv
en in
the
resp
ectiv
ehe
ader
. Thi
s fie
ldM
AY a
lso
be u
sed
for f
utur
e tr
ansp
ort
prot
ocol
s th
at h
ave
16-b
it so
urce
por
tiden
tifiers.
8so
urce
IPv4
Addr
ess
The
IPv4
sou
rce
addr
ess
in th
e IP
pack
et h
eade
r.
9so
urce
IPv4
Prefi
xLe
ngth
The
num
ber o
fco
ntig
uous
bits
that
are
rele
vant
inth
eso
urce
IPv4
Prefi
xIn
form
atio
nEl
emen
t.
bits
Reference 87
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
10in
gres
sInt
erfa
ceTh
e in
dex
of th
e IP
inte
rfac
e w
here
pack
ets
of th
isFl
ow a
re b
eing
rece
ived
. The
val
uem
atch
es th
e va
lue
of m
anag
ed o
bjec
t'if
Inde
x' a
s de
fined
in [R
FC28
63].
Not
eth
at if
Inde
x va
lues
are
not a
ssig
ned
stat
ical
ly to
an
inte
rfac
e an
d th
atth
e in
terf
aces
may
be re
num
bere
dev
ery
time
the
devi
ce's
man
agem
ent
syst
em is
re-
initi
aliz
ed, a
ssp
ecified
in[R
FC28
63].
88 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
11de
stin
ati
onTr
ans
port
Port
The
dest
inat
ion
port
iden
tifier
inth
e tr
ansp
ort
head
er. F
or th
etr
ansp
ort p
roto
cols
UDP,
TCP
, and
SCTP
, thi
s is
the
dest
inat
ion
port
num
ber g
iven
inth
e re
spec
tive
head
er. T
his fie
ldM
AY a
lso
be u
sed
for f
utur
e tr
ansp
ort
prot
ocol
s th
at h
ave
16-b
it de
stin
atio
npo
rt id
entifi
ers.
12de
stin
ati
onIP
v4A
ddre
ss
The
IPv4
dest
inat
ion
addr
ess
in th
e IP
pack
et h
eade
r.
13de
stinati
onIP
v4P
refix
Len
gth
The
num
ber o
fco
ntig
uous
bits
that
are
rele
vant
inth
ede
stin
atio
nIPv
4Pre
fix
Info
rmat
ion
Elem
ent.
bits
Reference 89
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
14eg
ress
Inte
rfac
eTh
e in
dex
of th
e IP
inte
rfac
e w
here
pack
ets
of th
isFl
ow a
re b
eing
sent
. The
val
uem
atch
es th
e va
lue
of m
anag
ed o
bjec
t'if
Inde
x' a
s de
fined
in [R
FC28
63].
Not
eth
at if
Inde
x va
lues
are
not a
ssig
ned
stat
ical
ly to
an
inte
rfac
e an
d th
atth
e in
terf
aces
may
be re
num
bere
dev
ery
time
the
devi
ce's
man
agem
ent
syst
em is
re-
initi
aliz
ed, a
ssp
ecified
in[R
FC28
63].
15ip
Nex
tHop
IPv4
Add
ress
The
IPv4
add
ress
of th
e ne
xt IP
v4ho
p.
90 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
16bg
pSou
rce
AsN
um
ber
The
auto
nom
ous
syst
em (A
S)nu
mbe
r of t
heso
urce
IP a
ddre
ss.
If A
S pa
thin
form
atio
n fo
r thi
sFl
ow is
onl
yav
aila
ble
as a
nun
orde
red
AS s
et(a
nd n
ot a
s an
orde
red
ASse
quen
ce),
then
the
valu
e of
this
Info
rmat
ion
Elem
ent i
s 0.
17bg
pDes
tina
tionA
sN
umbe
r
The
auto
nom
ous
syst
em (A
S)nu
mbe
r of t
hede
stin
atio
n IP
addr
ess.
If A
S pa
thin
form
atio
n fo
r thi
sFl
ow is
onl
yav
aila
ble
as a
nun
orde
red
AS s
et(a
nd n
ot a
s an
orde
red
ASse
quen
ce),
then
the
valu
e of
this
Info
rmat
ion
Elem
ent i
s 0.
Reference 91
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
18bg
pNex
tH
opIP
v4Ad
dres
s
The
IPv4
add
ress
of th
e ne
xt(a
djac
ent)
BG
Pho
p.
19po
stM
Cast
Pack
etDe
ltaCo
unt
The
num
ber o
fou
tgoi
ng m
ultic
ast
pack
ets
sinc
e th
epr
evio
us re
port
(if
any)
sen
t for
pack
ets
of th
isFl
ow b
y a
mul
ticas
tda
emon
with
in th
eO
bser
vatio
nDo
mai
n. T
his
prop
erty
can
not
nece
ssar
ily b
eob
serv
ed a
t the
Obs
erva
tion
Poin
t,bu
t may
be
retr
ieve
d by
oth
erm
eans
.
pac
ket
s
92 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20po
stM
Cast
Oct
etD
elta
Coun
t
The
num
ber o
foc
tets
sin
ce th
epr
evio
us re
port
(if
any)
in o
utgo
ing
mul
ticas
t pac
kets
sent
for p
acke
ts o
fth
is F
low
by
am
ultic
ast d
aem
onw
ithin
the
Obs
erva
tion
Dom
ain.
Thi
spr
oper
ty c
anno
tne
cess
arily
be
obse
rved
at t
heO
bser
vatio
n Po
int,
but m
ay b
ere
trie
ved
by o
ther
mea
ns. T
henu
mbe
r of o
ctet
sin
clud
es IP
head
er(s
) and
IPpa
yloa
d.
oct
ets
Reference 93
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21flo
wEn
dSy
sUpT
im
e
The
rela
tive
times
tam
p of
the
last
pac
ket o
f thi
sFl
ow. I
t ind
icat
esth
e nu
mbe
r of
mill
isec
onds
sin
ceth
e la
st(r
e-)in
itial
izat
ion
ofth
e IP
FIX
Devi
ce(s
ysUp
Tim
e).
sysU
pTim
e ca
n be
calc
ulat
ed fr
omsy
stem
InitT
imeM
illis
econ
ds.
mill
ise
con
ds
22flo
wSt
artS
ysUp
Tim
e
The
rela
tive
times
tam
p of
the
first
pac
ket o
f thi
sFl
ow. I
t ind
icat
esth
e nu
mbe
r of
mill
isec
onds
sin
ceth
e la
st(r
e-)in
itial
izat
ion
ofth
e IP
FIX
Devi
ce(s
ysUp
Tim
e).
sysU
pTim
e ca
n be
calc
ulat
ed fr
omsy
stem
InitT
imeM
illis
econ
ds.
mill
ise
con
ds
94 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
23po
stO
ctet
Delta
Cou
nt
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'oct
etDe
ltaCo
unt',
exce
pt th
at it
repo
rts
apo
tent
ially
mod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
oct
ets
Reference 95
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24po
stPa
cke
tDel
taCo
unt
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'pac
ketD
elta
Coun
t',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
pac
ket
s
25m
inim
um
IpTo
tal
Leng
th
Leng
th o
f the
smal
lest
pac
ket
obse
rved
for t
his
Flow
. The
pac
ket
leng
th in
clud
es th
eIP
hea
der(
s) le
ngth
and
the
IP p
aylo
adle
ngth
.
oct
ets
96 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26m
axim
um
IpTo
tal
Leng
th
Leng
th o
f the
larg
est p
acke
tob
serv
ed fo
r thi
sFl
ow. T
he p
acke
tle
ngth
incl
udes
the
IP h
eade
r(s)
leng
than
d th
e IP
pay
load
leng
th.
oct
ets
27so
urce
IPv6
Addr
ess
The
IPv6
sou
rce
addr
ess
in th
e IP
pack
et h
eade
r.
28de
stin
ati
onIP
v6A
ddre
ss
The
IPv6
dest
inat
ion
addr
ess
in th
e IP
pack
et h
eade
r.
29so
urce
IPv6
Prefi
xLe
ngth
The
num
ber o
fco
ntig
uous
bits
that
are
rele
vant
inth
eso
urce
IPv6
Prefi
xIn
form
atio
nEl
emen
t.
bits
30de
stinati
onIP
v6P
refix
Len
gth
The
num
ber o
fco
ntig
uous
bits
that
are
rele
vant
inth
ede
stin
atio
nIPv
6Pre
fix
Info
rmat
ion
Elem
ent.
bits
Reference 97
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31flo
wLa
bel
IPv6
The
valu
e of
the
IPv6
Flo
w L
abel
field
in th
e IP
pack
et h
eade
r.
32ic
mpT
ypeC
odeI
Pv4
Type
and
Cod
e of
the
IPv4
ICM
Pm
essa
ge. T
heco
mbi
natio
n of
both
val
ues
isre
port
ed a
s (I
CMP
type
* 2
56) +
ICM
Pco
de.
33ig
mpT
ype
The
type
field
ofth
e IG
MP
mes
sage
.
34sa
mpl
ingI
nter
val
Depr
ecat
ed in
favo
rof
305
sam
plin
gPac
ketI
nter
val.
Whe
n us
ing
sam
pled
Net
Flow
,th
e ra
te a
t whi
chpa
cket
s ar
esa
mpl
ed --
e.g
., a
valu
e of
100
indi
cate
s th
at o
neof
eve
ry 1
00pa
cket
s is
sam
pled
.
pac
ket
s
98 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
35sa
mpl
ingA
lgor
ithm
Depr
ecat
ed in
favo
rof
304
sele
ctor
Algo
rithm
.Th
e ty
pe o
fal
gorit
hm u
sed
for
sam
pled
Net
Flow
:
1 - D
eter
min
istic
Sam
plin
g,
2 - R
ando
mSa
mpl
ing.
The
valu
es a
re n
otco
mpa
tible
with
the
sele
ctor
Algo
rithm
IE, w
here
"Det
erm
inis
tic" h
asbe
en re
plac
ed b
y"S
yste
mat
ic c
ount
-ba
sed"
(1) o
r"S
yste
mat
ic ti
me-
base
d" (2
), an
d"R
ando
m" i
s (3
).Co
nver
sion
isre
quire
d; s
ee[P
acke
t Sam
plin
g(P
SAM
P)Pa
ram
eter
s.]
Reference 99
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
36flo
wAc
tive
Tim
eout
The
num
ber o
fse
cond
s af
ter
whi
ch a
n ac
tive
Flow
is ti
med
out
anyw
ay, e
ven
ifth
ere
is s
till a
cont
inuo
us fl
ow o
fpa
cket
s.
sec
on ds
37flo
wId
leTi
meo
utA
Flow
isco
nsid
ered
to b
etim
ed o
ut if
no
pack
ets
belo
ngin
gto
the
Flow
hav
ebe
en o
bser
ved
for
the
num
ber o
fse
cond
s sp
ecified
by th
is field.
sec
on ds
38en
gine
Type
Type
of f
low
switc
hing
eng
ine
ina
rout
er/s
witc
h:
RP =
0,
VIP/
Line
car
d =
1,
PFC/
DFC
= 2.
Rese
rved
for
inte
rnal
use
on
the
Colle
ctor
.
100 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39en
gine
IdVe
rsat
ile In
terf
ace
Proc
esso
r (VI
P) o
rlin
e ca
rd s
lot
num
ber o
f the
flow
switc
hing
eng
ine
ina
rout
er/s
witc
h.Re
serv
ed fo
rin
tern
al u
se o
n th
eCo
llect
or.
Reference 101
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40ex
port
edO
ctet
Tot
alCo
unt
The
tota
l num
ber
of o
ctet
s th
at th
eEx
port
ing
Proc
ess
has
sent
sin
ce th
eEx
port
ing
Proc
ess
(re-
)initi
aliz
atio
n to
a pa
rtic
ular
Colle
ctin
g Pr
oces
s.Th
e va
lue
of th
isIn
form
atio
nEl
emen
t is
calc
ulat
ed b
ysu
mm
ing
up th
eIP
FIX
Mes
sage
Hea
der l
engt
hva
lues
of a
ll IP
FIX
Mes
sage
s th
atw
ere
succ
essf
ully
sent
to th
eCo
llect
ing
Proc
ess.
The
repo
rted
num
ber e
xclu
des
octe
ts in
the
IPFI
XM
essa
ge th
atca
rrie
s th
e co
unte
rva
lue.
If th
isIn
form
atio
nEl
emen
t is
sent
to a
part
icul
arCo
llect
ing
Proc
ess,
then
by
defa
ult i
tsp
ecifies
the
num
ber o
f oct
ets
sent
to th
isCo
llect
ing
Proc
ess.
oct
ets
102 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41ex
port
edM
essa
geTo
talC
ount
The
tota
l num
ber
of IP
FIX
Mes
sage
sth
at th
e Ex
port
ing
Proc
ess
has
sent
sinc
e th
e Ex
port
ing
Proc
ess
(re-
)initi
aliz
atio
n to
a pa
rtic
ular
Colle
ctin
g Pr
oces
s.Th
e re
port
ednu
mbe
r exc
lude
sth
e IP
FIX
Mes
sage
that
car
ries
the
coun
ter v
alue
. If
this
Info
rmat
ion
Elem
ent i
s se
nt to
apa
rtic
ular
Colle
ctin
g Pr
oces
s,th
en b
y de
faul
t it
spec
ifies
the
num
ber o
f IPF
IXM
essa
ges
sent
toth
is C
olle
ctin
gPr
oces
s.
me
ssa
ges
Reference 103
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42ex
port
edFl
owRe
cor
dTot
alCo
unt
The
tota
l num
ber
of F
low
Rec
ords
that
the
Expo
rtin
gPr
oces
s ha
s se
nt a
sDa
ta R
ecor
ds s
ince
the
Expo
rtin
gPr
oces
s(r
e-)in
itial
izat
ion
toa
part
icul
arCo
llect
ing
Proc
ess.
The
repo
rted
num
ber e
xclu
des
Flow
Rec
ords
in th
eIP
FIX
Mes
sage
that
carr
ies
the
coun
ter
valu
e. If
this
Info
rmat
ion
Elem
ent i
s se
nt to
apa
rtic
ular
Colle
ctin
g Pr
oces
s,th
en b
y de
faul
t it
spec
ifies
the
num
ber o
f Flo
wRe
cord
s se
nt to
this
pro
cess
.
flo ws
104 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43ip
v4Ro
uter
ScTh
is is
a platfo
rm-
spec
ific fie
ld fo
r the
Cata
lyst
500
0/Ca
taly
st 6
000
fam
ily. I
t is
used
tost
ore
the
addr
ess
of a
rout
er th
at is
bein
g sh
ortc
utw
hen
perf
orm
ing
Mul
tiLay
erSw
itchi
ng.
44so
urce
IPv4
Prefi
xIP
v4 s
ourc
ead
dres
s pr
efix.
45de
stinati
onIP
v4P
refix
IPv4
des
tinat
ion
addr
ess pr
efix.
46m
plsT
opLa
belT
ype
This
field iden
tifies
the
cont
rol
prot
ocol
that
allo
cate
d th
e to
p-of
-sta
ck la
bel.
Valu
es fo
r thi
s fie
ldar
e lis
ted
in th
eM
PLS
labe
l typ
ere
gist
ry.
Reference 105
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
47m
plsT
opLa
belIP
v4A
ddre
ss
The
IPv4
add
ress
of th
e sy
stem
that
the
MPL
S to
p la
bel
will
cau
se th
is F
low
to b
e fo
rwar
ded
to.
48sa
mpl
erI
dDe
prec
ated
in fa
vor
of 3
02 s
elec
torI
d.Th
e un
ique
iden
tifier
asso
ciat
ed w
ithsa
mpl
erN
ame.
49sa
mpl
erM
ode
Depr
ecat
ed in
favo
rof
304
sele
ctor
Algo
rithm
.Th
e va
lues
are
not
com
patib
le:
sele
ctor
Algo
rithm
=3
is ra
ndom
sam
plin
g. T
he ty
peof
alg
orith
m u
sed
for s
ampl
ing
data
:1
- Det
erm
inis
tic, 2
- Ran
dom
Sam
plin
g. U
se w
ithsa
mpl
erRa
ndom
Int
erva
l.
106 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
50sa
mpl
erRa
ndom
Inte
rval
Depr
ecat
ed in
favo
rof
305
sam
plin
gPac
ketI
nter
val.
Pack
etin
terv
al a
t whi
ch to
sam
ple
-- in
cas
e of
rand
om s
ampl
ing.
Used
in c
onne
ctio
nw
ith th
esa
mpl
erM
ode
0x02
(ran
dom
sam
plin
g)va
lue.
51cl
assI
dDe
prec
ated
in fa
vor
of 3
02 s
elec
torI
d.Ch
arac
teriz
es th
etraffic
cla
ss, t
hat i
s,Q
oS tr
eatm
ent.
52m
inim
um
TTL
Min
imum
TTL
val
ueob
serv
ed fo
r any
pack
et in
this
Flo
w.
ho ps
53m
axim
um
TTL
Max
imum
TTL
valu
e ob
serv
ed fo
ran
y pa
cket
in th
isFl
ow.
ho ps
Reference 107
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
54frag
men
tIde
ntifi
catio
n
The
valu
e of
the
Iden
tifica
tion fie
ldin
the
IPv4
pac
ket
head
er o
r in
the
IPv6
Fra
gmen
the
ader
,re
spec
tivel
y. T
heva
lue
is 0
for I
Pv6
if th
ere
is n
ofr
agm
ent h
eade
r.
55po
stIp
Clas
sOfS
ervi
ce
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'ipCl
assO
fSer
vice
',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
56so
urce
Mac
Addr
ess
The
IEEE
802
sour
ce M
ACad
dres
s fie
ld.
108 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
57po
stDe
stin
atio
nMac
Addr
ess
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'des
tinat
ionM
acAd
dres
s', e
xcep
t tha
tit
repo
rts
apo
tent
ially
mod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
58vl
anId
Virt
ual L
ANiden
tifier
asso
ciat
ed w
ithin
gres
s in
terf
ace.
For d
ot1q
vla
ns,
see
243
dot1
qVla
nId.
59po
stVl
anId
Virt
ual L
ANiden
tifier
asso
ciat
ed w
itheg
ress
inte
rfac
e.Fo
r pos
tdot
1qvl
ans,
see
254
,po
stDo
t1qV
lanI
d.
Reference 109
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
60ip
Vers
ion
The
IP v
ersi
on field
in th
e IP
pac
ket
head
er.
61flo
wDi
rect
ion
The
dire
ctio
n of
the
Flow
obs
erve
d at
the
Obs
erva
tion
Poin
t. Th
ere
are
only
two
valu
esde
fined
.
0x00
: ing
ress
flow
0x01
: egr
ess
flow
62ip
Nex
tHop
IPv6
Add
ress
The
IPv6
add
ress
of th
e ne
xt IP
v6ho
p.
63bg
pNex
tH
opIP
v6Ad
dres
s
The
IPv6
add
ress
of th
e ne
xt(a
djac
ent)
BG
Pho
p.
110 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
64ip
v6Ex
tens
ionH
ead
ers
IPv6
ext
ensi
onhe
ader
s ob
serv
edin
pac
kets
of t
his
Flow
. The
info
rmat
ion
isen
code
d in
a s
et o
fbi
t fields
. For
eac
hIP
v6 o
ptio
n he
ader
,th
ere
is a
bit
in th
isse
t. Th
e bi
t is
set t
o1
if an
y ob
serv
edpa
cket
of t
his
Flow
cont
ains
the
corr
espo
ndin
g IP
v6ex
tens
ion
head
er.
Oth
erw
ise,
if n
oob
serv
ed p
acke
t of
this
Flo
w c
onta
ined
the
resp
ectiv
e IP
v6ex
tens
ion
head
er,
the
valu
e of
the
corr
espo
ndin
g bi
tis
0.
0 1 2 3
4 5 6 7
+-----+-----+-----+-----
+-----+-----+-----+-----+
| DST | HOP | Res | UNK |
FRA0 | RH |FRA1 | Res | ...
+-----+-----+-----+-----
+-----+-----+-----+-----+
8 9 10 11 12
13 14 15
+-----+-----+-----+-----
+-----+-----+-----+-----+
... | Reserved
| MOB | ESP | AH | PAY |
+-----+-----+-----+-----
+-----+-----+-----+-----+
16 17 18 19
20 21 22 23
+-----+-----+-----+-----
+-----+-----+-----+-----+
... |
Reserved
| ...
+-----+-----+-----+-----
+-----+-----+-----+-----+
24 25 26 27
28 29 30 31
+-----+-----+-----+-----
+-----+-----+-----+-----+
... |
Reserved
| +-----+-----+-----+-----
+-----+-----+-----+-----+
Bit IPv6 Option
Description
0, DST 60
Destination option header
1, HOP 0 Hop-by-
hop option header
2, Res Reserved
3, UNK Unknown
Layer 4 header
(compressed, encrypted, not
supported)
4, FRA0 44
Fragment header - first
fragment
5, RH 43 Routing
header
6, FRA1 44
Fragmentation header - not
first fragment
7, Res Reserved
8 to 11
Reserved
12, MOB 135 IPv6
mobility [RFC3775]
13, ESP 50
Encrypted security payload
14, AH 51
Authentication Header
15, PAY 108
Payload compression header
16 to 31
Reserved
Reference 111
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
65-
69As
sign
ed
for
Net
Flow
v9 com
pati
bilit
y
70m
plsT
opLa
belS
tack
Sect
ion
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
top
MPL
S la
bel
stac
k en
try,
that
is,
from
the
last
labe
lth
at is
pus
hed.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
0
1 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3
4 5 6 7 8 9 0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-
+-+-+-+-+-+-+-+-+-+-+
|
Label | Exp
|S|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-
+-+-+-+-+-+-+-+-+-+-+
Label: Label Value, 20 bits
Exp: Experimental Use, 3
bits
S: Bottom of Stack, 1
bit
112 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
71m
plsL
abel
Stac
kSec
tion2
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sTop
Labe
lSta
ckSe
ctio
n. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
Reference 113
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
72m
plsL
abel
Stac
kSec
tion3
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n2. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
114 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
73m
plsL
abel
Stac
kSec
tion4
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n3. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
Reference 115
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
74m
plsL
abel
Stac
kSec
tion5
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n4. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
116 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
75m
plsL
abel
Stac
kSec
tion6
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n5. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
Reference 117
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
76m
plsL
abel
Stac
kSec
tion7
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n6. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
118 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
77m
plsL
abel
Stac
kSec
tion8
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n7. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
Reference 119
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
78m
plsL
abel
Stac
kSec
tion9
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n8. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
120 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
79m
plsL
abel
Stac
kSec
tion1
0
The
Labe
l, Ex
p, a
ndS fie
lds
from
the
labe
l sta
ck e
ntry
that
is p
ushe
dim
med
iate
ly b
efor
eth
e la
bel s
tack
entr
y th
at w
ould
be
repo
rted
by
mpl
sLab
elSt
ackS
ectio
n9. S
ee th
ede
finition
of
mpl
sTop
Labe
lSta
ckSe
ctio
n fo
r fur
ther
deta
ils.
The
size
of t
his
Info
rmat
ion
Elem
ent i
s 3
octe
ts.
80de
stin
ati
onM
acA
ddre
ss
The
IEEE
802
dest
inat
ion
MAC
addr
ess fie
ld.
Reference 121
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
81po
stSo
urce
Mac
Add
ress
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'sou
rceM
acAd
dres
s', e
xcep
t tha
t it
repo
rts
apo
tent
ially
mod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
82in
terf
ace
Nam
eA
shor
t nam
eun
ique
ly d
escr
ibin
gan
inte
rfac
e, e
g"E
th1/
0".
83in
terf
ace
Desc
ripti
on
The
desc
riptio
n of
an in
terf
ace,
eg
"Fas
tEth
erne
t 1/0
"or
"ISP
conn
ectio
n".
84sa
mpl
erN
ame
Depr
ecat
ed in
favo
rof
335
sele
ctor
Nam
e.N
ame
of th
e flo
wsa
mpl
er.
122 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
85oc
tetT
otal
Coun
tTh
e to
tal n
umbe
rof
oct
ets
inin
com
ing
pack
ets
for t
his
Flow
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
The
num
ber
of o
ctet
s in
clud
esIP
hea
der(
s) a
nd IP
payl
oad.
oct
ets
86pa
cket
Tot
alCo
unt
The
tota
l num
ber
of in
com
ing
pack
ets
for t
his
Flow
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
Reference 123
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
87fla
gsAn
dSa
mpl
erId
Flow
flag
s an
d th
eva
lue
of th
esa
mpl
er ID
(sam
pler
Id)
com
bine
d in
one
bitm
appe
d fie
ld.
Rese
rved
for
inte
rnal
use
on
the
Colle
ctor
.
88fr
agm
entO
ffset
The
valu
e of
the
IPfr
agm
ent o
ffset
field
in th
e IP
v4pa
cket
hea
der o
rth
e IP
v6 F
ragm
ent
head
er,
resp
ectiv
ely.
The
valu
e is
0 fo
r IPv
6if
ther
e is
no
frag
men
t hea
der.
124 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
89fo
rwar
ding
Stat
usTh
is In
form
atio
nEl
emen
t des
crib
esth
e fo
rwar
ding
stat
us o
f the
flow
and
any
atta
ched
reas
ons.
The
redu
ced-
size
enco
ding
rule
s as
per [
RFC7
011]
appl
y.
The
basi
c en
codi
ngis
8 b
its. T
he fu
ture
exte
nsio
ns c
ould
add
one
or th
ree
byte
s. T
he la
yout
of
the
basi
c en
codi
ngis
as
follo
ws:
MSB - 0 1 2 3 4
5 6 7 - LSB
+---+---+---+---+---
+---+---+---+
| Status| Reason
code or flags |
+---+---+---+---+---
+---+---+---+
Status:
00b = Unknown
01b = Forwarded
10b = Dropped
11b = Consumed
Reason Code (status = 01b,
Forwarded)
01 000000b = 64 = Unknown
01 000001b = 65 = Fragmented
01 000010b = 66 = Not
Fragmented
Reason Code (status = 10b,
Dropped)
10 000000b = 128 = Unknown
10 000001b = 129 = ACL deny
10 000010b = 130 = ACL drop
10 000011b = 131 = Unroutable
10 000100b = 132 = Adjacency
10 000101b = 133 =
Fragmentation and DF set
10 000110b = 134 = Bad
header checksum
10 000111b = 135 = Bad total
Length
10 001000b = 136 = Bad
header length
10 001001b = 137 = bad TTL
10 001010b = 138 = Policer
10 001011b = 139 = WRED
10 001100b = 140 = RPF
10 001101b = 141 = For us
10 001110b = 142 = Bad
output interface
10 001111b = 143 = Hardware
Reason Code (status = 11b,
Consumed)
11 000000b = 192 = Unknown
11 000001b = 193 = Punt
Adjacency
11 000010b = 194 =
Incomplete Adjacency
11 000011b = 195 = For us
Examples:
value : 0x40 = 64
binary: 01000000
decode: 01 ->
Forward
000000 -> No
further information
value : 0x89 = 137
binary: 10001001
decode: 10 -> Drop
001001 ->
Fragmentation and DF set
Reference 125
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
90m
plsV
pnRo
uteD
istin
guis
her
The
valu
e of
the
VPN
rout
edi
stin
guis
her o
f aco
rres
pond
ing
entr
y in
a V
PNro
utin
g an
dfo
rwar
ding
tabl
e.Ro
ute
dist
ingu
ishe
ren
sure
s th
at th
esa
me
addr
ess
can
be u
sed
in s
ever
aldi
ffere
nt M
PLS
VPN
s an
d th
at it
ispo
ssib
le fo
r BG
P to
carr
y se
vera
lco
mpl
etel
ydi
ffere
nt ro
utes
toth
at a
ddre
ss, o
nefo
r eac
h VP
N.
Acco
rdin
g to
[RFC
4364
], th
e si
zeof m
plsV
pnRo
uteD
isti
ngui
sher
is 8
octe
ts. H
owev
er, i
n[R
FC43
82] a
n oc
tet
strin
g w
ith fl
exib
lele
ngth
is c
hose
n fo
rre
pres
entin
g a
VPN
rout
e di
stin
guis
her
by o
bjec
tM
plsL
3Vpn
Rout
eDi
stin
guis
her.
This
choi
ce is
mad
e in
orde
r to
be o
pen
tofu
ture
cha
nges
of
the
size
. Thi
s id
eais
ado
pted
whe
nch
oosi
ngoc
tetA
rray
as
abst
ract
dat
a ty
pefo
r thi
s In
form
atio
nEl
emen
t. Th
em
axim
um le
ngth
of
this
Info
rmat
ion
Elem
ent i
s 25
6oc
tets
.
126 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
91mplsT
opLa
belP
ref
ixLe
ngth
The pr
efix
leng
th o
fth
e su
bnet
of t
hem
plsT
opLa
belIP
v4Ad
dres
s th
at th
eM
PLS
top
labe
l will
caus
e th
e Fl
ow to
be fo
rwar
ded
to.
bits
92srcT
raffi
cInd
exBG
P Po
licy
Acco
untin
g So
urce
Traffic
Inde
x.
93ds
tTraffi
cInd
exBG
P Po
licy
Acco
untin
gDe
stin
atio
n Traffic
Inde
x.
94ap
plic
ati
onDe
scri
ptio
n
Spec
ifies
the
desc
riptio
n of
an
appl
icat
ion.
95ap
plic
ati
onId
Spec
ifies
an
Appl
icat
ion
ID p
er[R
FC67
59].
96ap
plic
ati
onN
ame
Spec
ifies
the
nam
eof
an
appl
icat
ion.
Reference 127
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
98po
stIp
DiffS
ervC
ode
Poin
t
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'ipDi
ffSer
vCod
ePoi
nt', e
xcep
t tha
t it
repo
rts
apo
tent
ially
mod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
99m
ultic
astR
eplic
atio
nFac
tor
The
amou
nt o
fm
ultic
ast
repl
icat
ion
that
'sap
plie
d to
a tr
affic
stre
am.
10 0cl
assN
am
eDe
prec
ated
in fa
vor
of 3
35se
lect
orN
ame.
Traffic
Cla
ss N
ame,
asso
ciat
ed w
ith th
ecl
assI
dIn
form
atio
nEl
emen
t.
128 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
10 1clas
sific
ationE
ngineI
d
A un
ique
iden
tifier
for t
he e
ngin
e th
atde
term
ined
the
Sele
ctor
ID. T
hus,
the Clas
sific
ation
Engi
ne ID
defi
nes
the
cont
ext f
or th
eSe
lect
or ID
. The
Clas
sific
ation
Engi
ne c
an b
eco
nsid
ered
asp
ecific
regi
stry
for
appl
icat
ion
assi
gnm
ents
.
Valu
es fo
r thi
s fie
ldar
e lis
ted
in th
eClas
sific
ation
Engi
ne ID
s re
gist
ry.
10 2la
yer2
pack
etSe
ctio
nOffs
et
Depr
ecat
ed in
favo
rof
409
sect
ionO
ffset
.La
yer 2
pac
ket
sect
ion
offs
et.
Pote
ntia
lly a
gene
ric p
acke
tse
ctio
n of
fset
.
Reference 129
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
10 3la
yer2
pack
etSe
ctio
nSiz
e
Depr
ecat
ed in
favo
rof
312
data
Link
Fram
eSiz
e.La
yer 2
pac
ket
sect
ion
size
.Po
tent
ially
age
neric
pac
ket
sect
ion
size
.
10 4la
yer2
pack
etSe
ctio
nDat
a
Depr
ecat
ed in
favo
rof
315
data
Link
Fram
eSec
tio
n. L
ayer
2 p
acke
tse
ctio
n da
ta.
130 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
12 8bg
pNex
tAd
jace
ntAs
Num
ber
The
auto
nom
ous
syst
em (A
S)nu
mbe
r of t
he first
AS in
the
AS p
ath
to th
e de
stin
atio
nIP
add
ress
. The
path
is d
educ
ed b
ylo
okin
g up
the
dest
inat
ion
IPad
dres
s of
the
Flow
in th
e BG
P ro
utin
gin
form
atio
n ba
se. I
fAS
pat
hin
form
atio
n fo
r thi
sFl
ow is
onl
yav
aila
ble
as a
nun
orde
red
AS s
et(a
nd n
ot a
s an
orde
red
ASse
quen
ce),
then
the
valu
e of
this
Info
rmat
ion
Elem
ent i
s 0.
Reference 131
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
12 9bg
pPre
vAd
jace
ntAs
Num
ber
The
auto
nom
ous
syst
em (A
S)nu
mbe
r of t
he la
stAS
in th
e AS
pat
hfr
om th
e so
urce
IPad
dres
s. T
he p
ath
is d
educ
ed b
ylo
okin
g up
the
sour
ce IP
add
ress
of th
e Fl
ow in
the
BGP
rout
ing
info
rmat
ion
base
. If
AS p
ath
info
rmat
ion
for t
his
Flow
is o
nly
avai
labl
e as
an
unor
dere
d AS
set
(and
not
as
anor
dere
d AS
sequ
ence
), th
enth
e va
lue
of th
isIn
form
atio
nEl
emen
t is
0. In
case
of B
GP
asym
met
ry, t
hebg
pPre
vAdj
acen
tAs
Num
ber m
ight
not
be a
ble
to re
port
the
corr
ect v
alue
.
132 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
13 0ex
port
erIP
v4Ad
dre
ss
The
IPv4
add
ress
used
by
the
Expo
rtin
g Pr
oces
s.Th
is is
use
d by
the
Colle
ctor
to id
entif
yth
e Ex
port
er in
case
s w
here
the
iden
tity
of th
eEx
port
er m
ay h
ave
been
obs
cure
d by
the
use
of a
pro
xy.
13 1ex
port
erIP
v6Ad
dre
ss
The
IPv6
add
ress
used
by
the
Expo
rtin
g Pr
oces
s.Th
is is
use
d by
the
Colle
ctor
to id
entif
yth
e Ex
port
er in
case
s w
here
the
iden
tity
of th
eEx
port
er m
ay h
ave
been
obs
cure
d by
the
use
of a
pro
xy.
Reference 133
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
13 2dr
oppe
dO
ctet
Del
taCo
unt
The
num
ber o
foc
tets
sin
ce th
epr
evio
us re
port
(if
any)
in p
acke
ts o
fth
is F
low
dro
pped
by p
acke
ttr
eatm
ent.
The
num
ber o
f oct
ets
incl
udes
IPhe
ader
(s) a
nd IP
payl
oad.
oct
ets
13 3dr
oppe
dPa
cket
Del
taCo
unt
The
num
ber o
fpa
cket
s si
nce
the
prev
ious
repo
rt (i
fan
y) o
f thi
s Fl
owdr
oppe
d by
pac
ket
trea
tmen
t.
pac
ket
s
13 4dr
oppe
dO
ctet
Tot
alCo
unt
The
tota
l num
ber
of o
ctet
s in
pac
kets
of th
is F
low
drop
ped
by p
acke
ttr
eatm
ent s
ince
the
Met
erin
g Pr
oces
s(r
e-)in
itial
izat
ion
for t
his
Obs
erva
tion
Poin
t. Th
e nu
mbe
rof
oct
ets
incl
udes
IP h
eade
r(s)
and
IPpa
yloa
d.
oct
ets
134 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
13 5dr
oppe
dPa
cket
Tot
alCo
unt
The
num
ber o
fpa
cket
s of
this
Flow
dro
pped
by
pack
et tr
eatm
ent
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
Reference 135
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
13 6flo
wEn
dRe
ason
The
reas
on fo
rFl
ow te
rmin
atio
n.Th
e ra
nge
of v
alue
sin
clud
es th
efo
llow
ing:
0x01: idle timeout
The Flow is terminated
because it is considered to
be idle.
0x02: active timeout
The Flow is terminated for
reporting purposes while it
is still active, for example,
after the maximum lifetime of
unreported Flows is reached.
0x03: end of Flow detected
The Flow is terminated
because the Metering Process
detected signals indicating
the end of the Flow,
for example, the TCP FIN
flag.
0x04: forced end
The Flow is terminated
because of some external
event,
for example, a shutdown of
the Metering Process
initiated
by a network management
application.
0x05: lack of resources
The Flow is terminated
because of lack of resources
available to the Metering
Process and/or the Exporting
Process.
136 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
13 7co
mm
onPr
oper
ties
Id
An id
entifi
er o
f ase
t of c
omm
onpr
oper
ties
that
isun
ique
per
Obs
erva
tion
Dom
ain
and
Tran
spor
t Ses
sion
.Ty
pica
lly, t
his
Info
rmat
ion
Elem
ent i
s us
ed to
link
to in
form
atio
nre
port
ed in
sepa
rate
Dat
aRe
cord
s.
13 8ob
serv
atio
nPoi
ntId
An id
entifi
er o
f an
Obs
erva
tion
Poin
tth
at is
uni
que
per
Obs
erva
tion
Dom
ain.
It is
RECO
MM
ENDE
Dth
at th
is id
entifi
eris
als
o un
ique
per
IPFI
X De
vice
.Ty
pica
lly, t
his
Info
rmat
ion
Elem
ent i
s us
ed fo
rlim
iting
the
scop
eof
oth
erIn
form
atio
nEl
emen
ts.
Reference 137
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
13 9ic
mpT
ypeC
odeI
Pv6
Type
and
Cod
e of
the
IPv6
ICM
Pm
essa
ge. T
heco
mbi
natio
n of
both
val
ues
isre
port
ed a
s (I
CMP
type
* 2
56) +
ICM
Pco
de.
14 0m
plsT
opLa
belIP
v6A
ddre
ss
The
IPv6
add
ress
of th
e sy
stem
that
the
MPL
S to
p la
bel
will
cau
se th
is F
low
to b
e fo
rwar
ded
to.
14 1lin
eCar
dId
An id
entifi
er o
f alin
e ca
rd th
at is
uniq
ue p
er IP
FIX
Devi
ce h
ostin
g an
Obs
erva
tion
Poin
t.Ty
pica
lly, t
his
Info
rmat
ion
Elem
ent i
s us
ed fo
rlim
iting
the
scop
eof
oth
erIn
form
atio
nEl
emen
ts.
138 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
14 2po
rtId
An id
entifi
er o
f alin
e po
rt th
at is
uniq
ue p
er IP
FIX
Devi
ce h
ostin
g an
Obs
erva
tion
Poin
t.Ty
pica
lly, t
his
Info
rmat
ion
Elem
ent i
s us
ed fo
rlim
iting
the
scop
eof
oth
erIn
form
atio
nEl
emen
ts.
14 3m
eter
ing
Proc
essI
d
An id
entifi
er o
f aM
eter
ing
Proc
ess
that
is u
niqu
e pe
rIP
FIX
Devi
ce.
Typi
cally
, thi
sIn
form
atio
nEl
emen
t is
used
for
limiti
ng th
e sc
ope
of o
ther
Info
rmat
ion
Elem
ents
. Not
eth
at p
roce
ssiden
tifiers
are
typi
cally
ass
igne
ddy
nam
ical
ly. T
heM
eter
ing
Proc
ess
may
be
re-s
tart
edw
ith a
diff
eren
t ID.
Reference 139
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
14 4ex
port
ingP
roce
ssId
An id
entifi
er o
f an
Expo
rtin
g Pr
oces
sth
at is
uni
que
per
IPFI
X De
vice
.Ty
pica
lly, t
his
Info
rmat
ion
Elem
ent i
s us
ed fo
rlim
iting
the
scop
eof
oth
erIn
form
atio
nEl
emen
ts. N
ote
that
pro
cess
iden
tifiers
are
typi
cally
ass
igne
ddy
nam
ical
ly. T
heEx
port
ing
Proc
ess
may
be
re-s
tart
edw
ith a
diff
eren
t ID.
140 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
14 5te
mpl
ate
IdAn
iden
tifier
of a
Tem
plat
e th
at is
loca
lly u
niqu
ew
ithin
aco
mbi
natio
n of
aTr
ansp
ort s
essi
onan
d an
Obs
erva
tion
Dom
ain.
Tem
plat
e ID
s0-
255
are
rese
rved
for T
empl
ate
Sets
,O
ptio
ns T
empl
ate
Sets
, and
oth
erre
serv
ed S
ets
yet
to b
e cr
eate
d.Te
mpl
ate
IDs
ofDa
ta S
ets
are
num
bere
d fr
om25
6 to
655
35.
Typi
cally
, thi
sIn
form
atio
nEl
emen
t is
used
for
limiti
ng th
e sc
ope
of o
ther
Info
rmat
ion
Elem
ents
. Not
eth
at a
fter a
re-s
tart
of th
e Ex
port
ing
Proc
ess
Tem
plat
eiden
tifiers
may
be
re-a
ssig
ned.
Reference 141
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
14 6w
lanC
hann
elId
The iden
tifier
of t
he80
2.11
(Wi-F
i)ch
anne
l use
d.
14 7w
lanS
SID
The
Serv
ice
Set
IDen
tifier
(SSI
D)id
entif
ying
an
802.
11 (W
i-Fi)
netw
ork
used
.Ac
cord
ing
toIE
EE.8
02-1
1.19
99,
the
SSID
isen
code
d in
to a
strin
g of
up
to 3
2ch
arac
ters
.
14 8flo
wId
An id
entifi
er o
f aFl
ow th
at is
uni
que
with
in a
nO
bser
vatio
nDo
mai
n. T
his
Info
rmat
ion
Elem
ent c
an b
eus
ed to
dis
tingu
ish
betw
een
diffe
rent
Flow
s if
Flow
Key
ssu
ch a
s IP
addr
esse
s an
d po
rtnu
mbe
rs a
re n
otre
port
ed o
r are
repo
rted
inse
para
te re
cord
s.
142 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
14 9ob
serv
atio
nDom
ain
Id
An id
entifi
er o
f an
Obs
erva
tion
Dom
ain
that
islo
cally
uni
que
to a
nEx
port
ing
Proc
ess.
The
Expo
rtin
gPr
oces
s us
es th
eO
bser
vatio
nDo
mai
n ID
toun
ique
ly id
entif
y to
the
Colle
ctin
gPr
oces
s th
eO
bser
vatio
nDo
mai
n w
here
Flow
s w
ere
met
ered
. It i
sRE
COM
MEN
DED
that
this
iden
tifier
is a
lso
uniq
ue p
erIP
FIX
Devi
ce.
A va
lue
of 0
indi
cate
s th
at n
osp
ecific
Obs
erva
tion
Dom
ain
isiden
tified
by
this
Info
rmat
ion
Elem
ent.
Typi
cally
, thi
sIn
form
atio
nEl
emen
t is
used
for
limiti
ng th
e sc
ope
of o
ther
Info
rmat
ion
Elem
ents
.
Reference 143
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
15 0flo
wSt
artS
econ
ds
The
abso
lute
times
tam
p of
the
first
pac
ket o
f thi
sFl
ow.
sec
on ds
15 1flo
wEn
dSe
cond
sTh
e ab
solu
tetim
esta
mp
of th
ela
st p
acke
t of t
his
Flow
.
sec
on ds
15 2flo
wSt
artM
illis
econ
ds
The
abso
lute
times
tam
p of
the
first
pac
ket o
f thi
sFl
ow.
mill
ise
con
ds
15 3flo
wEn
dM
illis
eco
nds
The
abso
lute
times
tam
p of
the
last
pac
ket o
f thi
sFl
ow.
mill
ise
con
ds
15 4flo
wSt
artM
icro
seco
nds
The
abso
lute
times
tam
p of
the
first
pac
ket o
f thi
sFl
ow.
mic
ros
eco
nds
15 5flo
wEn
dM
icro
sec
onds
The
abso
lute
times
tam
p of
the
last
pac
ket o
f thi
sFl
ow.
mic
ros
eco
nds
15 6flo
wSt
artN
anos
eco
nds
The
abso
lute
times
tam
p of
the
first
pac
ket o
f thi
sFl
ow.
nan
ose
con
ds
144 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
15 7flo
wEn
dN
anos
econ
ds
The
abso
lute
times
tam
p of
the
last
pac
ket o
f thi
sFl
ow.
nan
ose
con
ds
15 8flo
wSt
artD
elta
Mi
cros
eco
nds
This
is a
rela
tive
times
tam
p on
lyva
lid w
ithin
the
scop
e of
a s
ingl
eIP
FIX
Mes
sage
. It
cont
ains
the
nega
tive
time
offs
et o
f the
first
obse
rved
pac
ket o
fth
is F
low
rela
tive
toth
e ex
port
tim
esp
ecified
in th
eIP
FIX
Mes
sage
Hea
der.
mic
ros
eco
nds
Reference 145
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
15 9flo
wEn
dDe
ltaM
icro
seco
nds
This
is a
rela
tive
times
tam
p on
lyva
lid w
ithin
the
scop
e of
a s
ingl
eIP
FIX
Mes
sage
. It
cont
ains
the
nega
tive
time
offs
et o
f the
last
obse
rved
pac
ket o
fth
is F
low
rela
tive
toth
e ex
port
tim
esp
ecified
in th
eIP
FIX
Mes
sage
Hea
der.
mic
ros
eco
nds
16 0sy
stem
Ini
tTim
eM
illis
eco
nds
The
abso
lute
times
tam
p of
the
last
(re-
)initi
aliz
atio
n of
the
IPFI
X De
vice
.
mill
ise
con
ds
16 1flo
wDu
ratio
nMill
ise
cond
s
The
diffe
renc
e in
time
betw
een
the
first
obs
erve
dpa
cket
of t
his
Flow
and
the
last
obse
rved
pac
ket o
fth
is F
low
.
mill
ise
con
ds
146 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
16 2flo
wDu
ratio
nMic
ros
econ
ds
The
diffe
renc
e in
time
betw
een
the
first
obs
erve
dpa
cket
of t
his
Flow
and
the
last
obse
rved
pac
ket o
fth
is F
low
.
mic
ros
eco
nds
16 3ob
serv
edF
low
Tota
lCou
nt
The
tota
l num
ber
of F
low
s ob
serv
edin
the
Obs
erva
tion
Dom
ain
sinc
e th
eM
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
flo ws
16 4ig
nore
dPac
ketT
otal
Coun
t
The
tota
l num
ber
of o
bser
ved
IPpa
cket
s th
at th
eM
eter
ing
Proc
ess
did
not p
roce
sssi
nce
the
(re-
)initi
aliz
atio
n of
the
Met
erin
gPr
oces
s.
pac
ket
s
Reference 147
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
16 5ig
nore
dO
ctet
Tot
alCo
unt
The
tota
l num
ber
of o
ctet
s in
obse
rved
IPpa
cket
s (in
clud
ing
the
IP h
eade
r) th
atth
e M
eter
ing
Proc
ess
did
not
proc
ess
sinc
e th
e(r
e-)in
itial
izat
ion
ofth
e M
eter
ing
Proc
ess.
oct
ets
16 6no
tSen
tFl
owTo
tal
Coun
t
The
tota
l num
ber
of F
low
Rec
ords
that
wer
ege
nera
ted
by th
eM
eter
ing
Proc
ess
and
drop
ped
by th
eM
eter
ing
Proc
ess
or b
y th
e Ex
port
ing
Proc
ess
inst
ead
ofbe
ing
sent
to th
eCo
llect
ing
Proc
ess.
Ther
e ar
e se
vera
lpo
tent
ial r
easo
nsfo
r thi
s in
clud
ing
reso
urce
sho
rtag
ean
d sp
ecia
l Flo
wex
port
pol
icie
s.
flo ws
148 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
16 7no
tSen
tPa
cket
Tot
alCo
unt
The
tota
l num
ber
of p
acke
ts in
Flo
wRe
cord
s th
at w
ere
gene
rate
d by
the
Met
erin
g Pr
oces
san
d dr
oppe
d by
the
Met
erin
g Pr
oces
sor
by
the
Expo
rtin
gPr
oces
s in
stea
d of
bein
g se
nt to
the
Colle
ctin
g Pr
oces
s.Th
ere
are
seve
ral
pote
ntia
l rea
sons
for t
his
incl
udin
gre
sour
ce s
hort
age
and
spec
ial F
low
expo
rt p
olic
ies.
pac
ket
s
Reference 149
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
16 8no
tSen
tO
ctet
Tot
alCo
unt
The
tota
l num
ber
of o
ctet
s in
pac
kets
in F
low
Rec
ords
that
wer
ege
nera
ted
by th
eM
eter
ing
Proc
ess
and
drop
ped
by th
eM
eter
ing
Proc
ess
or b
y th
e Ex
port
ing
Proc
ess
inst
ead
ofbe
ing
sent
to th
eCo
llect
ing
Proc
ess.
Ther
e ar
e se
vera
lpo
tent
ial r
easo
nsfo
r thi
s in
clud
ing
reso
urce
sho
rtag
ean
d sp
ecia
l Flo
wex
port
pol
icie
s.
oct
ets
16 9de
stinati
onIP
v6P
refix
IPv6
des
tinat
ion
addr
ess pr
efix.
17 0so
urce
IPv6
Prefi
xIP
v6 s
ourc
ead
dres
s pr
efix.
150 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
17 1po
stO
ctet
Tota
lCou
nt
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'oct
etTo
talC
ount
',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
oct
ets
Reference 151
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
17 2po
stPa
cke
tTot
alCo
unt
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'pac
ketT
otal
Coun
t',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
pac
ket
s
152 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
17 3flo
wKe
yInd
icat
orTh
is s
et o
f bit fie
lds
is u
sed
for m
arki
ngth
e In
form
atio
nEl
emen
ts o
f a D
ata
Reco
rd th
at s
erve
as F
low
Key
. Eac
hbi
t rep
rese
nts
anIn
form
atio
nEl
emen
t in
the
Data
Reco
rd, w
ith th
e n-
th le
ast s
ignific
ant
bit r
epre
sent
ing
the
n-th
Info
rmat
ion
Elem
ent.
A bi
t set
to v
alue
1 in
dica
tes
that
the
corr
espo
ndin
gIn
form
atio
nEl
emen
t is
a Fl
owKe
y of
the
repo
rted
Flow
. A b
it se
t to
valu
e 0
indi
cate
sth
at th
is is
not
the
case
.
If th
e Da
ta R
ecor
dco
ntai
ns m
ore
than
64 In
form
atio
nEl
emen
ts, t
heco
rres
pond
ing
Tem
plat
e m
ust b
ede
sign
ed s
uch
that
all F
low
Key
s ar
eam
ong
the fir
st 6
4In
form
atio
nEl
emen
ts, b
ecau
seth
eflo
wKe
yInd
icat
oron
ly c
onta
ins
64bi
ts. I
f the
Dat
aRe
cord
con
tain
sle
ss th
an 6
4In
form
atio
nEl
emen
ts, t
hen
the
bits
in th
eflo
wKe
yInd
icat
orfo
r whi
ch n
oco
rres
pond
ing
Info
rmat
ion
Elem
ent e
xist
sm
ust h
ave
the
valu
e 0.
Reference 153
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
17 4po
stM
Cast
Pack
etTo
talC
ount
The
tota
l num
ber
of o
utgo
ing
mul
ticas
t pac
kets
sent
for p
acke
ts o
fth
is F
low
by
am
ultic
ast d
aem
onw
ithin
the
Obs
erva
tion
Dom
ain
sinc
e th
eM
eter
ing
Proc
ess
(re-
)initi
aliz
atio
n.Th
is p
rope
rty
cann
ot n
eces
saril
ybe
obs
erve
d at
the
Obs
erva
tion
Poin
t,bu
t may
be
retr
ieve
d by
oth
erm
eans
.
pac
ket
s
154 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
17 5po
stM
Cast
Oct
etT
otal
Coun
t
The
tota
l num
ber
of o
ctet
s in
outg
oing
mul
ticas
tpa
cket
s se
nt fo
rpa
cket
s of
this
Flow
by
a m
ultic
ast
daem
on in
the
Obs
erva
tion
Dom
ain
sinc
e th
eM
eter
ing
Proc
ess
(re-
)initi
aliz
atio
n.Th
is p
rope
rty
cann
ot n
eces
saril
ybe
obs
erve
d at
the
Obs
erva
tion
Poin
t,bu
t may
be
retr
ieve
d by
oth
erm
eans
. The
num
ber o
f oct
ets
incl
udes
IPhe
ader
(s) a
nd IP
payl
oad.
oct
ets
17 6ic
mpT
ypeI
Pv4
Type
of t
he IP
v4IC
MP
mes
sage
.
17 7ic
mpC
odeI
Pv4
Code
of t
he IP
v4IC
MP
mes
sage
.
17 8ic
mpT
ypeI
Pv6
Type
of t
he IP
v6IC
MP
mes
sage
.
Reference 155
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
17 9ic
mpC
odeI
Pv6
Code
of t
he IP
v6IC
MP
mes
sage
.
18 0ud
pSou
rce
Port
The
sour
ce p
ort
iden
tifier
in th
eUD
P he
ader
.
18 1ud
pDes
tina
tionP
ort
The
dest
inat
ion
port
iden
tifier
inth
e UD
P he
ader
.
18 2tc
pSou
rceP
ort
The
sour
ce p
ort
iden
tifier
in th
e TC
Phe
ader
.
18 3tc
pDes
tina
tionP
ort
The
dest
inat
ion
port
iden
tifier
inth
e TC
P he
ader
.
18 4tc
pSeq
uen
ceN
um
ber
The
sequ
ence
num
ber i
n th
e TC
Phe
ader
.
18 5tc
pAck
now
ledg
em
entN
um
ber
The
ackn
owle
dgem
ent
num
ber i
n th
e TC
Phe
ader
.
156 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
18 6tc
pWin
dow
Size
The
win
dow
field
inth
e TC
P he
ader
. If
the
TCP
win
dow
scal
e is
sup
port
ed,
then
TCP
win
dow
scal
e m
ust b
ekn
own
to fu
llyin
terp
ret t
he v
alue
of th
is in
form
atio
n.
18 7tc
pUrg
ent
Poin
ter
The
urge
nt p
oint
erin
the
TCP
head
er.
Reference 157
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
18 8tc
pHea
der
Leng
thTh
e le
ngth
of t
heTC
P he
ader
. Not
eth
at th
e va
lue
ofth
is In
form
atio
nEl
emen
t is
diffe
rent
from
the
valu
e of
the
Data
Offs
etfie
ld in
the
TCP
head
er. T
he D
ata
Offs
et field
indi
cate
s th
ele
ngth
of t
he T
CPhe
ader
in u
nits
of 4
octe
ts. T
his
Info
rmat
ion
Elem
ents
spe
cifie
sth
e le
ngth
of t
heTC
P he
ader
in u
nits
of o
ctet
s.
oct
ets
18 9ip
Hea
derL
engt
hTh
e le
ngth
of t
he IP
head
er. F
or IP
v6,
the
valu
e of
this
Info
rmat
ion
Elem
ent i
s 40
.
oct
ets
19 0to
talL
engt
hIPv
4Th
e to
tal l
engt
h of
the
IPv4
pac
ket.
oct
ets
158 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
19 1pa
yloa
dLen
gthI
Pv6
This
Info
rmat
ion
Elem
ent r
epor
tsth
e va
lue
of th
ePa
yloa
d Le
ngth
field
in th
e IP
v6he
ader
. Not
e th
atIP
v6 e
xten
sion
head
ers
belo
ng to
the
payl
oad.
Als
ono
te th
at in
cas
e of
a ju
mbo
pay
load
optio
n th
e va
lue
ofth
e Pa
yloa
d Le
ngth
field
in th
e IP
v6he
ader
is z
ero
and
so w
ill b
e th
e va
lue
repo
rted
by
this
Info
rmat
ion
Elem
ent.
oct
ets
Reference 159
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
19 2ip
TTL
For I
Pv4,
the
valu
eof
the
Info
rmat
ion
Elem
ent m
atch
esth
e va
lue
of th
eTi
me
to L
ive
(TTL
)fie
ld in
the
IPv4
pack
et h
eade
r. Fo
rIP
v6, t
he v
alue
of
the
Info
rmat
ion
Elem
ent m
atch
esth
e va
lue
of th
eH
op L
imit fie
ld in
the
IPv6
pac
ket
head
er.
ho ps
19 3ne
xtH
eade
rIPv
6Th
e va
lue
of th
eN
ext H
eade
r field
of th
e IP
v6 h
eade
r.Th
e va
lue iden
tifies
the
type
of t
hefo
llow
ing
IPv6
exte
nsio
n he
ader
or o
f the
follo
win
gIP
pay
load
. Val
idva
lues
are
defi
ned
in th
e IA
NA
Prot
ocol
Num
bers
regi
stry
.
160 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
19 4m
plsP
aylo
adLe
ngt
h
The
size
of t
heM
PLS
pack
etw
ithou
t the
labe
lst
ack.
oct
ets
19 5ip
DiffS
ervC
odeP
oin
t
The
valu
e of
aDi
ffere
ntia
ted
Serv
ices
Cod
ePo
int (
DSCP
)en
code
d in
the
Diffe
rent
iate
dSe
rvic
es field.
The
Diffe
rent
iate
dSe
rvic
es field
span
s th
e m
ost
sign
ifica
nt 6
bits
of
the
IPv4
TO
S fie
ldor
the
IPv6
Traffic
Clas
s fie
ld,
resp
ectiv
ely.
This
Info
rmat
ion
Elem
ent e
ncod
eson
ly th
e 6
bits
of
the
Diffe
rent
iate
dSe
rvic
es field.
Ther
efor
e, it
s va
lue
may
rang
e fr
om 0
to 6
3.
Reference 161
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
19 6ip
Prec
eden
ceTh
e va
lue
of th
e IP
Prec
eden
ce. T
he IP
Prec
eden
ce v
alue
is e
ncod
ed in
the
first
3 b
its o
f the
IPv4
TO
S fie
ld o
rth
e IP
v6 Traffic
Clas
s fie
ld,
resp
ectiv
ely.
This
Info
rmat
ion
Elem
ent e
ncod
eson
ly th
ese
3 bi
ts.
Ther
efor
e, it
s va
lue
may
rang
e fr
om 0
to 7
.
162 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
19 7fr
agm
entF
lags
Frag
men
tatio
npr
oper
ties
indi
cate
d by
flag
sin
the
IPv4
pac
ket
head
er o
r the
IPv6
Frag
men
t hea
der,
resp
ectiv
ely.
Bit 0: (RS) Reserved.
The value of this bit must
be 0 until specified
otherwise.
Bit 1: (DF) 0 = May
Fragment, 1 = Don't
Fragment.
Corresponds to the value of
the DF flag in the
IPv4 header. Will always be
0 for IPv6 unless
a "don't fragment" feature
is introduced to IPv6.
Bit 2: (MF) 0 = Last
Fragment, 1 = More Fragments.
Corresponds to the MF flag
in the IPv4 header
or to the M flag in the IPv6
Fragment header,
respectively. The value is
0 for IPv6 if there
is no fragment header.
Bits 3-7: (DC) Don't Care.
The values of these bits are
irrelevant.
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---
+---+
| R | D | M | D | D | D | D
| D |
| S | F | F | C | C | C | C
| C |
+---+---+---+---+---+---+---
+---+
Reference 163
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
19 8oc
tetD
elta
Sum
Of
Squa
res
The
sum
of t
hesq
uare
d nu
mbe
rsof
oct
ets
per
inco
min
g pa
cket
sinc
e th
e pr
evio
usre
port
(if a
ny) f
orth
is F
low
at t
heO
bser
vatio
n Po
int.
The
num
ber o
foc
tets
incl
udes
IPhe
ader
(s) a
nd IP
payl
oad.
19 9oc
tetT
otal
Sum
Of
Squa
res
The
tota
l sum
of
the
squa
red
num
bers
of o
ctet
sin
inco
min
gpa
cket
s fo
r thi
sFl
ow a
t the
Obs
erva
tion
Poin
tsi
nce
the
Met
erin
gPr
oces
s(r
e-)in
itial
izat
ion
for t
his
Obs
erva
tion
Poin
t. Th
e nu
mbe
rof
oct
ets
incl
udes
IP h
eade
r(s)
and
IPpa
yloa
d.
oct
ets
164 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 0m
plsT
opLa
belT
TL
The
TTL fie
ld fr
omth
e to
p M
PLS
labe
lst
ack
entr
y, th
at is
,th
e la
st la
bel t
hat i
spu
shed
.
ho ps
20 1m
plsL
abel
Stac
kLen
gth
The
leng
th o
f the
MPL
S la
bel s
tack
inun
its o
f oct
ets.
oct
ets
20 2m
plsL
abel
Stac
kDep
th
The
num
ber o
fla
bels
in th
e M
PLS
labe
l sta
ck.
lab
el sta
ck ent
ries
20 3m
plsT
opLa
belE
xp
The
Exp fie
ld fr
omth
e to
p M
PLS
labe
lst
ack
entr
y, th
at is
,th
e la
st la
bel t
hat i
spu
shed
.
Bits 0-4: Don't Care, value
is irrelevant.
Bits 5-7: MPLS Exp field.
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---
+---+
| don't care |
Exp |
+---+---+---+---+---+---+---
+---+
Reference 165
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 4ip
Payl
oadL
engt
hTh
e ef
fect
ive
leng
th o
f the
IPpa
yloa
d.
oct
ets
For I
Pv4
pack
ets,
the
valu
e of
this
Info
rmat
ion
Elem
ent i
s th
edi
ffere
nce
betw
een
the
tota
l len
gth
ofth
e IP
v4 p
acke
t (as
repo
rted
by
Info
rmat
ion
Elem
ent
tota
lLen
gthI
Pv4)
and
the
leng
th o
fth
e IP
v4 h
eade
r (as
repo
rted
by
Info
rmat
ion
Elem
ent
head
erLe
ngth
IPv4
). Fo
r IPv
6, th
e va
lue
of th
e Pa
yloa
dLe
ngth
field
in th
eIP
v6 h
eade
r is
repo
rted
exc
ept i
nth
e ca
se th
at th
eva
lue
of th
is field
isze
ro a
nd th
at th
ere
is a
val
id ju
mbo
payl
oad
optio
n. In
this
cas
e, th
e va
lue
of th
e Ju
mbo
Payl
oad
Leng
thfie
ld in
the
jum
bopa
yloa
d op
tion
isre
port
ed.
166 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 5ud
pMes
sag
eLen
gth
The
valu
e of
the
Leng
th field
in th
eUD
P he
ader
.
oct
ets
Reference 167
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 6is
Mul
tica
stIf
the
IPde
stin
atio
nad
dres
s is
not
are
serv
ed m
ultic
ast
addr
ess,
then
the
valu
e of
all
bits
of
the
octe
t (in
clud
ing
the
rese
rved
one
s)is
zer
o.
The fir
st b
it of
this
octe
t is
set t
o 1
ifth
e Ve
rsio
n fie
ld o
fth
e IP
hea
der h
asth
e va
lue
4 an
d if
the
Dest
inat
ion
Addr
ess fie
ldco
ntai
ns a
rese
rved
mul
ticas
t add
ress
in th
e ra
nge
from
224.
0.0.
0 to
239.
255.
255.
255.
Oth
erw
ise,
this
bit
is s
et to
0.
The
seco
nd a
ndth
ird b
its o
f thi
soc
tet a
re re
serv
edfo
r fut
ure
use.
The
rem
aini
ng b
itsof
the
octe
t are
only
set
to v
alue
sot
her t
han
zero
ifth
e IP
Des
tinat
ion
Addr
ess
is a
rese
rved
IPv6
mul
ticas
t add
ress
.Th
en th
e fo
urth
bit
of th
e oc
tet i
s se
tto
the
valu
e of
the
T fla
g in
the
IPv6
mul
ticas
t add
ress
and
the
rem
aini
ngfo
ur b
its a
re s
et to
the
valu
e of
the
scop
e fie
ld in
the
IPv6
mul
ticas
tad
dres
s.
0 1 2 3
4 5 6 7
+------+------+------+------
+------+------+------+------+
| IPv6 multicast scope
| T | RES. | RES. | MCv4 |
+------+------+------+------
+------+------+------+------+
Bits 0-3: set to value of
multicast scope if IPv6
multicast
Bit 4: set to value of T
flag, if IPv6 multicast
Bits 5-6: reserved for
future use
Bit 7: set to 1 if IPv4
multicast
168 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 7ip
v4IH
LTh
e va
lue
of th
eIn
tern
et H
eade
rLe
ngth
(IH
L) field
inth
e IP
v4 h
eade
r. It
spec
ifies
the
leng
thof
the
head
er in
units
of 4
oct
ets.
Plea
se n
ote
that
its
unit
is d
iffer
ent
from
mos
t of t
heot
her I
nfor
mat
ion
Elem
ents
repo
rtin
gle
ngth
val
ues.
4 oct
ets
Reference 169
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 8ip
v4O
pti
ons
IPv4
opt
ions
inpa
cket
s of
this
Flow
. The
info
rmat
ion
isen
code
d in
a s
et o
fbi
t fields
. For
eac
hva
lid IP
v4 o
ptio
nty
pe, t
here
is a
bit
in th
is s
et. T
he b
itis
set
to 1
if a
nyob
serv
ed p
acke
t of
this
Flo
w c
onta
ins
the
corr
espo
ndin
gIP
v4 o
ptio
n ty
pe.
Oth
erw
ise,
if n
oob
serv
ed p
acke
t of
this
Flo
w c
onta
ined
the
resp
ectiv
e IP
v4op
tion
type
, the
valu
e of
the
corr
espo
ndin
g bi
tis
0.
The
list o
f val
idIP
v4 o
ptio
ns is
mai
ntai
ned
byIA
NA.
Not
e th
at fo
rid
entif
ying
an
optio
n no
t jus
t the
5-bi
t Opt
ion
Num
ber,
but a
ll 8
bits
of t
he O
ptio
nTy
pe n
eed
tom
atch
one
of t
heIP
v4 o
ptio
nssp
ecified
at h
ttp:
//w
ww
.iana
.org
/as
sign
men
ts/ip
-pa
ram
eter
s.
Opt
ions
are
map
ped
to b
itsac
cord
ing
to th
eir
optio
n nu
mbe
rs.
Opt
ion
num
ber X
ism
appe
d to
bit
X.Th
e m
appi
ng is
illus
trat
ed b
y th
efig
ure
belo
w.
0 1 2 3
4 5 6 7
+------+------+------+------
+------+------+------+------+
... | RR |CIPSO |E-SEC |
TS | LSR | SEC | NOP |
EOOL |
+------+------+------+------
+------+------+------+------+
8 9 10 11
12 13 14 15
+------+------+------+------
+------+------+------+------+
... |ENCODE| VISA | FINN |
MTUR | MTUP | ZSU | SSR |
SID | ...
+------+------+------+------
+------+------+------+------+
16 17 18 19
20 21 22 23
+------+------+------+------
+------+------+------+------+
... | DPS |NSAPA | SDB |
RTRALT|ADDEXT| TR | EIP |
IMITD | ...
+------+------+------+------
+------+------+------+------+
24 25 26 27
28 29 30 31
+------+------+------+------
+------+------+------+------+
| | EXP | to be
assigned by IANA | QS |
UMP | ...
+------+------+------+------
+------+------+------+------+
Type Option
Bit Value Name Reference
---+-----+-------
+----------------------------
--------
0 7 RR Record
Route, RFC 791
1 134 CIPSO Commercial
Security
2 133 E-SEC Extended
Security, RFC 1108
3 68 TS Time
Stamp, RFC 791
4 131 LSR Loose
Source Route, RFC791
5 130 SEC Security,
RFC 1108
6 1 NOP No
Operation, RFC 791
7 0 EOOL End of
Options List, RFC 791
8 15 ENCODE
9 142 VISA
Experimental Access Control
10 205 FINN
Experimental Flow Control
11 12 MTUR
(obsoleted) MTU Reply, RFC
1191
12 11 MTUP
(obsoleted) MTU Probe, RFC
1191
13 10 ZSU
Experimental Measurement
14 137 SSR Strict
Source Route, RFC 791
15 136 SID Stream
ID, RFC 791
16 151 DPS Dynamic
Packet State
17 150 NSAPA NSAP
Address
18 149 SDB Selective
Directed Broadcast
19 147 ADDEXT Address
Extension
20 148 RTRALT Router
Alert, RFC 2113
21 82 TR
Traceroute, RFC 3193
22 145 EIP Extended
Internet Protocol, RFC 1385
23 144 IMITD IMI
Traffic Descriptor
25 30 EXP RFC3692-
style Experiment
25 94 EXP RFC3692-
style Experiment
25 158 EXP RFC3692-
style Experiment
25 222 EXP RFC3692-
style Experiment
30 25 QS Quick-
Start
31 152 UMP Upstream
Multicast Pkt.
... ... ... Further
options numbers
may be assigned by IANA
170 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
20 9tc
pOpt
ions
TCP
optio
ns in
pack
ets
of th
isFl
ow. T
hein
form
atio
n is
enco
ded
in a
set
of
bit fi
elds
. For
eac
hTC
P op
tion,
ther
e is
a bi
t in
this
set
. The
bit i
s se
t to
1 if
any
obse
rved
pac
ket o
fth
is F
low
con
tain
sth
e co
rres
pond
ing
TCP
optio
n.O
ther
wis
e, if
no
obse
rved
pac
ket o
fth
is F
low
con
tain
edth
e re
spec
tive
TCP
optio
n, th
e va
lue
ofth
e co
rres
pond
ing
bit i
s 0.
Opt
ions
are
map
ped
to b
itsac
cord
ing
to th
eir
optio
n nu
mbe
rs.
Opt
ion
num
ber X
ism
appe
d to
bit
X.TC
P op
tion
num
bers
are
mai
ntai
ned
byIA
NA.
0 1 2 3
4 5 6 7
+-----+-----+-----+-----
+-----+-----+-----+-----+
| 7 | 6 | 5 | 4 |
3 | 2 | 1 | 0 | ...
+-----+-----+-----+-----
+-----+-----+-----+-----+
8 9 10 11 12
13 14 15
+-----+-----+-----+-----
+-----+-----+-----+-----+
... | 15 | 14 | 13 | 12
| 11 | 10 | 9 | 8 |...
+-----+-----+-----+-----
+-----+-----+-----+-----+
16 17 18 19
20 21 22 23
+-----+-----+-----+-----
+-----+-----+-----+-----+
... | 23 | 22 | 21 | 20
| 19 | 18 | 17 | 16 |...
+-----+-----+-----+-----
+-----+-----+-----+-----+
. . .
56 57 58 59
60 61 62 63
+-----+-----+-----+-----
+-----+-----+-----+-----+
... | 63 | 62 | 61 | 60
| 59 | 58 | 57 | 56 |
+-----+-----+-----+-----
+-----+-----+-----+-----+
Reference 171
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 0pa
ddin
gO
ctet
sTh
e va
lue
of th
isIn
form
atio
nEl
emen
t is
alw
ays
ase
quen
ce o
f 0x0
0va
lues
.
21 1co
llect
orIP
v4Ad
dre
ss
An IP
v4 a
ddre
ss to
whi
ch th
eEx
port
ing
Proc
ess
send
s Fl
owin
form
atio
n.
21 2co
llect
orIP
v6Ad
dre
ss
An IP
v6 a
ddre
ss to
whi
ch th
eEx
port
ing
Proc
ess
send
s Fl
owin
form
atio
n.
172 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 3ex
port
Inte
rfac
eTh
e in
dex
of th
ein
terf
ace
from
whi
ch IP
FIX
Mes
sage
s se
nt b
yth
e Ex
port
ing
Proc
ess
to a
Colle
ctor
leav
e th
eIP
FIX
Devi
ce. T
heva
lue
mat
ches
the
valu
e of
man
aged
obje
ct 'i
fInd
ex' a
sde
fined
in[R
FC28
63].
Not
eth
at if
Inde
x va
lues
are
not a
ssig
ned
stat
ical
ly to
an
inte
rfac
e an
d th
atth
e in
terf
aces
may
be re
num
bere
dev
ery
time
the
devi
ce's
man
agem
ent
syst
em is
re-
initi
aliz
ed, a
ssp
ecified
in[R
FC28
63].
Reference 173
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 4ex
port
Prot
ocol
Vers
ion
The
prot
ocol
vers
ion
used
by
the
Expo
rtin
g Pr
oces
sfo
r sen
ding
Flo
win
form
atio
n. T
hepr
otoc
ol v
ersi
on is
give
n by
the
valu
eof
the
Vers
ion
Num
ber fi
eld
in th
eM
essa
ge H
eade
r.
The
prot
ocol
vers
ion
is 1
0 fo
rIP
FIX
and
9 fo
rN
etFl
ow v
ersi
on 9
.A
valu
e of
0in
dica
tes
that
no
expo
rt p
roto
col i
sin
use
.
174 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 5ex
port
Tran
spor
tPro
toco
l
The
valu
e of
the
prot
ocol
num
ber
used
by
the
Expo
rtin
g Pr
oces
sfo
r sen
ding
Flo
win
form
atio
n. T
hepr
otoc
ol n
umbe
riden
tifies
the
IPpa
cket
pay
load
type
. Pro
toco
lnu
mbe
rs a
rede
fined
in th
e IA
NA
Prot
ocol
Num
bers
regi
stry
.
In In
tern
etPr
otoc
ol v
ersi
on 4
(IPv
4), t
his
isca
rrie
d in
the
Prot
ocol
field.
InIn
tern
et P
roto
col
vers
ion
6 (I
Pv6)
,th
is is
car
ried
in th
eN
ext H
eade
r field
in th
e la
stex
tens
ion
head
erof
the
pack
et.
Reference 175
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 6co
llect
orTr
ansp
ortP
ort
The
dest
inat
ion
port
iden
tifier
tow
hich
the
Expo
rtin
g Pr
oces
sse
nds
Flow
info
rmat
ion.
For
the
tran
spor
tpr
otoc
ols
UDP,
TCP
,an
d SC
TP, t
his
isth
e de
stin
atio
npo
rt n
umbe
r. Th
isfie
ld M
AY a
lso
beus
ed fo
r fut
ure
tran
spor
t pro
toco
lsth
at h
ave
16-b
itso
urce
por
tiden
tifiers.
176 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 7ex
port
erTr
ansp
ortP
ort
The
sour
ce p
ort
iden
tifier
from
whi
ch th
eEx
port
ing
Proc
ess
send
s Fl
owin
form
atio
n. F
orth
e tr
ansp
ort
prot
ocol
s UD
P, T
CP,
and
SCTP
, thi
s is
the
sour
ce p
ort
num
ber.
This
field
MAY
als
o be
use
dfo
r fut
ure
tran
spor
tpr
otoc
ols
that
hav
e16
-bit
sour
ce p
ort
iden
tifiers.
Thi
sfie
ld m
ay b
e us
eful
for d
istin
guis
hing
mul
tiple
Exp
ortin
gPr
oces
ses
that
use
the
sam
e IP
addr
ess.
21 8tc
pSyn
Tot
alCo
unt
The
tota
l num
ber
of p
acke
ts o
f thi
sFl
ow w
ith T
CP"S
ynch
roni
zese
quen
cenu
mbe
rs" (
SYN
)fla
g se
t.
pac
ket
s
Reference 177
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
21 9tc
pFin
Tota
lCou
ntTh
e to
tal n
umbe
rof
pac
kets
of t
his
Flow
with
TCP
"No
mor
e da
ta fr
omse
nder
" (FI
N) f
lag
set.
pac
ket
s
22 0tc
pRst
Tota
lCou
ntTh
e to
tal n
umbe
rof
pac
kets
of t
his
Flow
with
TCP
"Res
et th
eco
nnec
tion"
(RST
)fla
g se
t.
pac
ket
s
22 1tc
pPsh
Tot
alCo
unt
The
tota
l num
ber
of p
acke
ts o
f thi
sFl
ow w
ith T
CP"P
ush
Func
tion"
(PSH
) fla
g se
t.
pac
ket
s
22 2tc
pAck
Tot
alCo
unt
The
tota
l num
ber
of p
acke
ts o
f thi
sFl
ow w
ith T
CP"A
ckno
wle
dgm
ent
field
signific
ant"
(ACK
) fla
g se
t.
pac
ket
s
22 3tc
pUrg
Tota
lCou
ntTh
e to
tal n
umbe
rof
pac
kets
of t
his
Flow
with
TCP
"Urg
ent P
oint
erfie
ld signific
ant"
(URG
) fla
g se
t.
pac
ket
s
178 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
22 4ip
Tota
lLe
ngth
The
tota
l len
gth
ofth
e IP
pac
ket.
oct
ets
22 5po
stN
ATSo
urce
IPv
4Add
res
s
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'sou
rceI
Pv4A
ddre
ss',
exc
ept t
hat i
tre
port
s a mod
ified
valu
e ca
used
by
aN
AT m
iddl
ebox
func
tion
afte
r the
pack
et p
asse
d th
eO
bser
vatio
n Po
int.
Reference 179
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
22 6po
stN
ATDe
stin
ati
onIP
v4A
ddre
ss
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'des
tinat
ionI
Pv4A
ddr
ess',
exc
ept t
hat
it re
port
s a
mod
ified
val
ueca
used
by
a N
ATm
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
22 7po
stN
APTS
ourc
eTr
ansp
ortP
ort
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'sou
rceT
rans
port
Port
', exc
ept t
hat i
tre
port
s a mod
ified
valu
e ca
used
by
aN
etw
ork
Addr
ess
Port
Tra
nsla
tion
(NAP
T) m
iddl
ebox
func
tion
afte
r the
pack
et p
asse
d th
eO
bser
vatio
n Po
int.
180 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
22 8po
stN
APTD
estin
atio
nTra
nsp
ortP
ort
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'des
tinat
ionT
rans
port
Port
', exc
ept t
hat
it re
port
s a
mod
ified
val
ueca
used
by
aN
etw
ork
Addr
ess
Port
Tra
nsla
tion
(NAP
T) m
iddl
ebox
func
tion
afte
r the
pack
et p
asse
d th
eO
bser
vatio
n Po
int.
Reference 181
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
22 9na
tOrig
ina
tingA
ddr
essR
eal
m
Indi
cate
s w
heth
erth
e se
ssio
n is
crea
ted
beca
use
traffic
orig
inat
ed in
the
priv
ate
orpu
blic
add
ress
real
m.
post
NAT
Sour
ceIP
v4A
ddre
ss,
post
NAT
Dest
inat
ionI
Pv4A
ddre
ss,
post
NAP
TSou
rceT
ran
spor
tPor
t, an
dpo
stN
APTD
estin
ati
onTr
ansp
ortP
ort
are qu
alified
with
the
addr
ess
real
min
per
spec
tive.
The
allo
wed
val
ues
are:
Priv
ate:
1
Publ
ic: 2
182 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
23 0na
tEve
ntTh
is In
form
atio
nEl
emen
t ide
ntifies
a N
AT e
vent
. Thi
sIE
iden
tifies
the
type
of a
NAT
even
t. Ex
ampl
es o
fN
AT e
vent
sin
clud
e, b
ut a
re n
otlim
ited
to, N
ATtr
ansl
atio
n cr
eate
,N
AT tr
ansl
atio
nde
lete
, Thr
esho
ldRe
ache
d, o
rTh
resh
old
Exce
eded
, etc
.Va
lues
for t
his
Info
rmat
ion
Elem
ent a
re li
sted
in th
e N
AT E
vent
Type
regi
stry
, see
[http://
www.ia
na.org/
assign
men
ts/ip
fix/
ipfix
.xml#
ipfix
-nat-
even
t-type
]. N
ewas
sign
men
ts o
fva
lues
will
be
adm
inis
tere
d by
IAN
A an
d ar
esu
bjec
t to
Expe
rtRe
view
[RFC
8126
].Ex
pert
s ne
ed to
chec
k de
finition
s of
new
val
ues
for
com
plet
enes
s,ac
cura
cy, a
ndre
dund
ancy
.
Reference 183
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
23 1in
itiat
orO
ctet
sTh
e to
tal n
umbe
rof
laye
r 4 p
aylo
adby
tes
in a
flow
from
the
initi
ator
. The
initi
ator
is th
ede
vice
whi
chtr
igge
red
the
sess
ion
crea
tion,
and
rem
ains
the
sam
e fo
r the
life
of
the
sess
ion.
oct
ets
23 2re
spon
der
Oct
ets
The
tota
l num
ber
of la
yer 4
pay
load
byte
s in
a fl
ow fr
omth
e re
spon
der.
The
resp
onde
r is
the
devi
ce w
hich
repl
ies
to th
ein
itiat
or, a
ndre
mai
ns th
e sa
me
for t
he li
fe o
f the
sess
ion.
oct
ets
184 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
23 3fir
ewallE
vent
Indi
cate
s a fir
ewall
even
t. Th
e al
low
edva
lues
are
:
0 - I
gnor
e (in
valid
)
1 - F
low
Cre
ated
2 - F
low
Del
eted
3 - F
low
Den
ied
4 - F
low
Ale
rt
5 - F
low
Upd
ate
23 4in
gres
sVRF
IDAn
uni
que iden
tifier
of th
e VR
Fnam
ew
here
the
pack
ets
of th
is fl
ow a
rebe
ing
rece
ived
.Th
is id
entifi
er is
uniq
ue p
erM
eter
ing
Proc
ess
23 5eg
ress
VRF
IDAn
uni
que iden
tifier
of th
e VR
Fnam
ew
here
the
pack
ets
of th
is fl
ow a
rebe
ing
sent
. Thi
siden
tifier
is u
niqu
epe
r Met
erin
gPr
oces
s
Reference 185
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
23 6VR
Fnam
eTh
e na
me
of a
VPN
Rout
ing
and
Forw
ardi
ng ta
ble
(VRF
).
23 7po
stM
plsT
opLa
bel
Exp
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'mpl
sTop
Labe
lExp
',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
23 8tc
pWin
dow
Scal
eTh
e sc
ale
of th
ew
indo
w field
in th
eTC
P he
ader
.
186 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
23 9bi
flow
Dir
ectio
nA
desc
riptio
n of
the
dire
ctio
nas
sign
men
tm
etho
d us
ed to
assi
gn th
e Bi
flow
Sour
ce a
ndDe
stin
atio
n. T
his
Info
rmat
ion
Elem
ent M
AY b
epr
esen
t in
a Fl
owDa
ta R
ecor
d, o
rap
plie
d to
all
flow
sex
port
ed fr
om a
nEx
port
ing
Proc
ess
or O
bser
vatio
nDo
mai
n us
ing
IPFI
X O
ptio
ns. I
fth
is In
form
atio
nEl
emen
t is
not
pres
ent i
n a
Flow
Reco
rd o
ras
soci
ated
with
aBi
flow
via
sco
pe, i
tis
ass
umed
that
the
confi
guratio
n of
the
dire
ctio
nas
sign
men
tm
etho
d is
don
eou
t-of
-ban
d. N
ote
that
whe
n us
ing
IPFI
X O
ptio
ns to
appl
y th
isIn
form
atio
nEl
emen
t to
all
flow
s w
ithin
an
Obs
erva
tion
Dom
ain
or fr
om a
nEx
port
ing
Proc
ess,
the
Opt
ion
mus
t be
sent
relia
bly.
Ifre
liabl
e tr
ansp
ort i
sno
t ava
ilabl
e (t
hat
is, w
hen
usin
gUD
P), t
his
Info
rmat
ion
Elem
ent m
ust
appe
ar in
eac
hFl
ow R
ecor
d. T
his
field
may
take
the
follo
win
g va
lues
:
+-------+------------------
+----------------------------
------------+
| Value | Name |
Description
|
+-------+------------------
+----------------------------
------------+
| 0x00 | arbitrary |
Direction is assigned
arbitrarily. |
| 0x01 | initiator |
The Biflow Source is the
flow |
| | |
initiator, as determined by
the |
| | |
Metering Process' best
effort to |
| | |
detect the
initiator. |
| 0x02 | reverseInitiator |
The Biflow Destination is
the flow |
| | |
initiator, as determined by
the |
| | |
Metering Process' best
effort to |
| | |
detect the initiator. This
value is |
| | |
provided for the convenience
of |
| | |
Exporting Processes to
revise an |
| | |
initiator estimate without
re-encoding |
| | |
the Biflow
Record. |
| 0x03 | perimeter |
The Biflow Source is the
endpoint |
| | |
outside of a defined
perimeter. The |
| | |
perimeter's definition is
implicit in |
| | |
the set of Biflow Source and
Biflow |
| | |
Destination addresses
exported in the |
| | |
Biflow
Records.
|
+-------+------------------
+----------------------------
------------+
Reference 187
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24 0et
hern
etH
eade
rLen
gth
The
diffe
renc
ebe
twee
n th
e le
ngth
of a
n Et
hern
etfr
ame
(min
us th
eFC
S) a
nd th
e le
ngth
of it
s M
AC C
lient
Data
sec
tion
(incl
udin
g an
ypa
ddin
g) a
sde
fined
in s
ectio
n3.
1 of
[IEE
E.80
2-3.
2005
].It
doe
s no
t inc
lude
the
Prea
mbl
e, S
FDan
d Ex
tens
ion fie
ldle
ngth
s.
oct
ets
24 1et
hern
etPa
yloa
dLe
ngth
The
leng
th o
f the
MAC
Clie
nt D
ata
sect
ion
(incl
udin
gan
y pa
ddin
g) o
f afr
ame
as defi
ned
inse
ctio
n 3.
1 of
[IEE
E.80
2-3.
2005
].
oct
ets
188 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24 2et
hern
etTo
talL
engt
h
The
tota
l len
gth
ofth
e Et
hern
et fr
ame
(exc
ludi
ng th
ePr
eam
ble,
SFD
,Ex
tens
ion
and
FCS
fields)
as
desc
ribed
in s
ectio
n 3.
1 of
[IEE
E.80
2-3.
2005
].
oct
ets
Reference 189
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24 3do
t1qV
lanI
dTh
e va
lue
of th
e12
-bit
VLAN
Iden
tifier
por
tion
ofth
e Ta
g Co
ntro
lIn
form
atio
n fie
ld o
fan
Eth
erne
t fra
me.
The
stru
ctur
e an
dse
man
tics
with
inth
e Ta
g Co
ntro
lIn
form
atio
n fie
ldar
e de
fined
in[I
EEE8
02.1
Q].
InPr
ovid
er B
ridge
dN
etw
orks
, it
repr
esen
ts th
eSe
rvic
e VL
ANiden
tifier
in th
eSe
rvic
e VL
AN T
ag(S
-TAG
) Tag
Con
trol
Info
rmat
ion
(TCI
)fie
ld o
r the
Cust
omer
VLA
Niden
tifier
in th
eCu
stom
er V
LAN
Tag
(C-T
AG) T
agCo
ntro
lIn
form
atio
n (T
CI)
field
as
desc
ribed
in [I
EEE8
02.1
Q].
InPr
ovid
er B
ackb
one
Brid
ged
Net
wor
ks,
it re
pres
ents
the
Back
bone
VLA
Niden
tifier
in th
eBa
ckbo
ne V
LAN
Tag
(B-T
AG) T
agCo
ntro
lIn
form
atio
n (T
CI)
field
as
desc
ribed
in [I
EEE8
02.1
Q].
Ina
virt
ual l
ink
betw
een
a ho
stsy
stem
and
EVB
brid
ge, i
tre
pres
ents
the
Serv
ice
VLAN
iden
tifier
indi
catin
gS-
chan
nel.
In th
e ca
se o
f am
ulti-
tagg
edfr
ame,
it re
pres
ents
the
oute
r tag
'sVL
AN id
entifi
er,
exce
pt fo
r I-T
AG.
190 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24 4do
t1qP
rior
ityTh
e va
lue
of th
e 3-
bit U
ser P
riorit
ypo
rtio
n of
the
Tag
Cont
rol
Info
rmat
ion fie
ld o
fan
Eth
erne
t fra
me.
The
stru
ctur
e an
dse
man
tics
with
inth
e Ta
g Co
ntro
lIn
form
atio
n fie
ldar
e de
fined
in[I
EEE8
02.1
Q].
Inth
e ca
se o
f mul
ti-ta
gged
fram
e, it
repr
esen
ts th
e 3-
bit P
riorit
y Co
dePo
int (
PCP)
por
tion
of th
e ou
ter t
ag's
Tag
Cont
rol
Info
rmat
ion
(TCI
)fie
ld.
24 5do
t1qC
ust
omer
Vlan
Id
The
valu
ere
pres
ents
the
Cust
omer
VLA
Niden
tifier
in th
eCu
stom
er V
LAN
Tag
(C-T
AG) T
agCo
ntro
lIn
form
atio
n (T
CI)
field.
Reference 191
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24 6do
t1qC
ust
omer
Prio
rity
The
valu
ere
pres
ents
the
3-bi
t Prio
rity
Code
Poin
t (PC
P) p
ortio
nof
the
Cust
omer
VLAN
Tag
(C-T
AG)
Tag
Cont
rol
Info
rmat
ion
(TCI
)fie
ld.
24 7m
etro
EvcI
dTh
e EV
C Se
rvic
eAt
trib
ute
whi
chun
ique
ly id
entifi
esth
e Et
hern
et V
irtua
lCo
nnec
tion
(EVC
)w
ithin
a M
etro
Ethe
rnet
Net
wor
k,as
defi
ned
inse
ctio
n 6.
2 of
MEF
10.1
. The
Met
roEV
CID
isen
code
d in
a s
trin
gof
up
to 1
00ch
arac
ters
.
24 8m
etro
EvcT
ype
The
3-bi
t EVC
Serv
ice
Attr
ibut
ew
hich
iden
tifies
the
type
of s
ervi
cepr
ovid
ed b
y an
EVC.
192 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
24 9ps
eudo
Wire
IdA
32-b
it no
n-ze
roco
nnec
tion
iden
tifier, w
hich
toge
ther
with
the
pseu
doW
ireTy
pe,
iden
tifies
the
Pseu
do W
ire (P
W)
as defi
ned
in[R
FC80
77].
25 0ps
eudo
Wire
Typ
e
The
valu
e of
this
info
rmat
ion
elem
ent ide
ntifies
the
type
of M
PLS
Pseu
do W
ire (P
W).
25 1ps
eudo
Wire
Con
trol
Wor
d
The
32-b
itPr
efer
red
Pseu
doW
ire (P
W) M
PLS
Cont
rol W
ord
25 2in
gres
sPhy
sica
lInt
erfa
ce
The
inde
x of
ane
twor
king
devi
ce's
phy
sica
lin
terf
ace
(exa
mpl
e,a
switc
h po
rt)
whe
re p
acke
ts o
fth
is fl
ow a
re b
eing
rece
ived
.
Reference 193
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
25 3eg
ress
Phy
sica
lInt
erfa
ce
The
inde
x of
ane
twor
king
devi
ce's
phy
sica
lin
terf
ace
(exa
mpl
e,a
switc
h po
rt)
whe
re p
acke
ts o
fth
is fl
ow a
re b
eing
sent
.
25 4po
stDo
t1q
Vlan
Id
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'dot
1qVl
anId
',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
194 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
25 5po
stDo
t1q
Cust
om
erVl
anId
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'dot
1qCu
stom
erVl
anI
d', e
xcep
t tha
t it
repo
rts
apo
tent
ially
mod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
25 6et
hern
etTy
peTh
e Et
hern
et ty
pefie
ld o
f an
Ethe
rnet
fram
e th
atiden
tifies
the
MAC
clie
nt p
roto
col
carr
ied
in th
epa
yloa
d.
Reference 195
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
25 7po
stIp
Prec
eden
ce
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'ipPr
eced
ence
',ex
cept
that
itre
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
196 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
25 8co
llect
ionT
imeM
illi
seco
nds
The
abso
lute
times
tam
p at
whi
ch th
e da
taw
ithin
the
scop
eco
ntai
ning
this
Info
rmat
ion
Elem
ent i
s re
ceiv
edby
a C
olle
ctin
gPr
oces
s. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XM
essa
ge v
ia IP
FIX
Opt
ions
and
the
mes
sage
Scop
eIn
form
atio
nEl
emen
t, as
defin
ed b
elow
.
mill
ise
con
ds
Reference 197
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
25 9ex
port
Sctp
Stre
am
Id
The
valu
e of
the
SCTP
Str
eam
Iden
tifier
use
d by
the
Expo
rtin
gPr
oces
s fo
rex
port
ing
IPFI
XM
essa
ge d
ata.
Thi
sis
car
ried
in th
eSt
ream
Iden
tifier
field
of t
he h
eade
rof
the
SCTP
DAT
Ach
unk
cont
aini
ngth
e IP
FIX
Mes
sage
(s).
26 0m
axEx
por
tSec
onds
The
abso
lute
Expo
rt T
ime
of th
ela
test
IPFI
XM
essa
ge w
ithin
the
scop
e co
ntai
ning
this
Info
rmat
ion
Elem
ent.
This
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a IP
FIX
Opt
ions
and
the
sess
ionS
cope
Info
rmat
ion
Elem
ent.
sec
on ds
198 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 1m
axFl
ow
EndS
eco
nds
The
late
st a
bsol
ute
times
tam
p of
the
last
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t, ro
unde
dup
to th
e se
cond
ifne
cess
ary.
Thi
sIn
form
atio
nEl
emen
t mus
t be
boun
d to
its
cont
aini
ng IP
FIX
Tran
spor
t Ses
sion
via
IPFI
X O
ptio
nsan
d th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t.
sec
on ds
Reference 199
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 2m
essa
geM
D5Ch
eck
sum
The
MD5
che
cksu
mof
the
IPFI
XM
essa
geco
ntai
ning
this
reco
rd. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XM
essa
ge v
ia a
nop
tions
reco
rd a
ndth
e m
essa
geSc
ope
Info
rmat
ion
Elem
ent,
asde
fined
bel
ow, a
ndm
ust a
ppea
r onl
yon
ce in
a g
iven
IPFI
X M
essa
ge. T
oca
lcul
ate
the
valu
eof
this
Info
rmat
ion
Elem
ent, fir
stbu
ffer t
heco
ntai
ning
IPFI
XM
essa
ge, s
ettin
gth
e va
lue
of th
isIn
form
atio
nEl
emen
t to
all
zero
es. T
hen
calc
ulat
e th
e M
D5ch
ecks
um o
f the
resu
lting
buf
fer a
sde
fined
in[R
FC13
21],
plac
eth
e re
sulti
ng v
alue
in th
is In
form
atio
nEl
emen
t, an
dex
port
the
buffe
red
mes
sage
. Thi
sIn
form
atio
nEl
emen
t is
inte
nded
as
asi
mpl
e ch
ecks
umon
ly; t
here
fore
colli
sion
resi
stan
cean
d al
gorit
hmag
ility
are
not
requ
ired,
and
MD5
is a
n ap
prop
riate
mes
sage
dig
est.
This
Info
rmat
ion
Elem
ent h
as a
fixe
dle
ngth
of 1
6 oc
tets
.
200 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 3m
essa
geSc
ope
The
pres
ence
of
this
Info
rmat
ion
Elem
ent a
s sc
ope
in a
n O
ptio
nsTe
mpl
ate sign
ifies
that
the
optio
nsde
scrib
ed b
y th
eTe
mpl
ate
appl
y to
the
IPFI
X M
essa
geth
at c
onta
ins
them
.It
is defi
ned
for
gene
ral p
urpo
sem
essa
ge s
copi
ng o
fop
tions
, and
prop
osed
spec
ifica
lly to
allo
wth
e at
tach
men
t ach
ecks
um to
am
essa
ge v
ia IP
FIX
Opt
ions
. The
val
ueof
this
Info
rmat
ion
Elem
ent m
ust b
ew
ritte
n as
0 b
y th
eFi
le W
riter
or
Expo
rtin
g Pr
oces
s.Th
e va
lue
of th
isIn
form
atio
nEl
emen
t mus
t be
igno
red
by th
e Fi
leRe
ader
or t
heCo
llect
ing
Proc
ess.
Reference 201
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 4m
inEx
port
Seco
nds
The
abso
lute
Expo
rt T
ime
of th
eea
rlies
t IPF
IXM
essa
ge w
ithin
the
scop
e co
ntai
ning
this
Info
rmat
ion
Elem
ent.
This
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a an
opt
ions
reco
rd a
nd th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t.
sec
on ds
202 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 5m
inFl
owSt
artS
econ
ds
The
earli
est
abso
lute
times
tam
p of
the
first
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t, ro
unde
ddo
wn
to th
e se
cond
if ne
cess
ary.
Thi
sIn
form
atio
nEl
emen
t mus
t be
boun
d to
its
cont
aini
ng IP
FIX
Tran
spor
t Ses
sion
via
an o
ptio
nsre
cord
and
the
sess
ionS
cope
Info
rmat
ion
Elem
ent.
sec
on ds
Reference 203
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 6op
aque
Oct
ets
This
Info
rmat
ion
Elem
ent i
s us
ed to
enca
psul
ate
non-
IPFI
X da
ta in
to a
nIP
FIX
Mes
sage
stre
am, f
or th
epu
rpos
e of
allo
win
ga
non-
IPFI
X da
tapr
oces
sor t
o st
ore
a da
ta s
trea
min
line
with
in a
nIP
FIX
File
. ACo
llect
ing
Proc
ess
or F
ile W
riter
mus
tN
OT
try
to in
terp
ret
this
bin
ary
data
.Th
is In
form
atio
nEl
emen
t diff
ers
from
padd
ingO
ctet
s as
its c
onte
nts
are
mea
ning
ful i
n so
me
non-
IPFI
X co
ntex
t,w
hile
the
cont
ents
of p
addi
ngO
ctet
sm
ust b
e 0x
00 a
ndar
e in
tend
ed o
nly
for I
nfor
mat
ion
Elem
ent a
lignm
ent.
204 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 7se
ssio
nSco
peTh
e pr
esen
ce o
fth
is In
form
atio
nEl
emen
t as
scop
ein
an
Opt
ions
Tem
plat
e sign
ifies
that
the
optio
nsde
scrib
ed b
y th
eTe
mpl
ate
appl
y to
the
IPFI
XTr
ansp
ort S
essi
onth
at c
onta
ins
them
.N
ote
that
as
all
optio
ns a
reim
plic
itly
scop
ed to
Tran
spor
t Ses
sion
and
Obs
erva
tion
Dom
ain,
this
Info
rmat
ion
Elem
ent i
seq
uiva
lent
to a
"nul
l" s
cope
. It i
sde
fined
for g
ener
alpu
rpos
e se
ssio
nsc
opin
g of
opt
ions
,an
d pr
opos
edsp
ecifica
lly to
allo
wth
e at
tach
men
t of
time
win
dow
to a
nIP
FIX
File
via
IPFI
XO
ptio
ns. T
he v
alue
of th
is In
form
atio
nEl
emen
t mus
t be
writ
ten
as 0
by
the
File
Writ
er o
rEx
port
ing
Proc
ess.
The
valu
e of
this
Info
rmat
ion
Elem
ent m
ust b
eig
nore
d by
the
File
Read
er o
r the
Colle
ctin
g Pr
oces
s.
Reference 205
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 8m
axFl
ow
EndM
icro
seco
nds
The
late
st a
bsol
ute
times
tam
p of
the
last
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t, ro
unde
dup
to th
em
icro
seco
nd if
nece
ssar
y. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a IP
FIX
Opt
ions
and
the
sess
ionS
cope
Info
rmat
ion
Elem
ent.
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed o
nly
inTr
ansp
ort S
essi
ons
cont
aini
ng F
low
Reco
rds
with
mic
rose
cond
-pr
ecis
ion
(or
bett
er) t
imes
tam
pIn
form
atio
nEl
emen
ts.
mic
ros
eco
nds
206 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
26 9m
axFl
ow
EndM
illis
econ
ds
The
late
st a
bsol
ute
times
tam
p of
the
last
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t, ro
unde
dup
to th
em
illis
econ
d if
nece
ssar
y. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a IP
FIX
Opt
ions
and
the
sess
ionS
cope
Info
rmat
ion
Elem
ent.
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed o
nly
inTr
ansp
ort S
essi
ons
cont
aini
ng F
low
Reco
rds
with
mill
isec
ond-
prec
isio
n (o
rbe
tter
) tim
esta
mp
Info
rmat
ion
Elem
ents
.
mill
ise
con
ds
Reference 207
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 0m
axFl
ow
EndN
ano
seco
nds
The
late
st a
bsol
ute
times
tam
p of
the
last
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t. Th
isIn
form
atio
nEl
emen
t mus
t be
boun
d to
its
cont
aini
ng IP
FIX
Tran
spor
t Ses
sion
via
IPFI
X O
ptio
nsan
d th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t. Th
isIn
form
atio
nEl
emen
t mus
t be
used
onl
y in
Tran
spor
t Ses
sion
sco
ntai
ning
Flo
wRe
cord
s w
ithna
nose
cond
-pr
ecis
ion
times
tam
pIn
form
atio
nEl
emen
ts.
nan
ose
con
ds
208 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 1m
inFl
owSt
artM
icro
seco
nds
The
earli
est
abso
lute
times
tam
p of
the
first
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t, ro
unde
ddo
wn
to th
em
icro
seco
nd if
nece
ssar
y. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a an
opt
ions
reco
rd a
nd th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t. Th
isIn
form
atio
nEl
emen
t mus
t be
used
onl
y in
Tran
spor
t Ses
sion
sco
ntai
ning
Flo
wRe
cord
s w
ithm
icro
seco
nd-
prec
isio
n (o
rbe
tter
) tim
esta
mp
Info
rmat
ion
Elem
ents
.
mic
ros
eco
nds
Reference 209
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 2m
inFl
owSt
artM
illi
seco
nds
The
earli
est
abso
lute
times
tam
p of
the
first
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t, ro
unde
ddo
wn
to th
em
illis
econ
d if
nece
ssar
y. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a an
opt
ions
reco
rd a
nd th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t. Th
isIn
form
atio
nEl
emen
t mus
t be
used
onl
y in
Tran
spor
t Ses
sion
sco
ntai
ning
Flo
wRe
cord
s w
ithm
illis
econ
d-pr
ecis
ion
(or
bett
er) t
imes
tam
pIn
form
atio
nEl
emen
ts.
mill
ise
con
ds
210 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 3m
inFl
owSt
artN
anos
econ
ds
The
earli
est
abso
lute
times
tam
p of
the
first
pac
ket w
ithin
any
Flow
with
in th
esc
ope
cont
aini
ngth
is In
form
atio
nEl
emen
t. Th
isIn
form
atio
nEl
emen
t mus
t be
boun
d to
its
cont
aini
ng IP
FIX
Tran
spor
t Ses
sion
via
an o
ptio
nsre
cord
and
the
sess
ionS
cope
Info
rmat
ion
Elem
ent.
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed o
nly
inTr
ansp
ort S
essi
ons
cont
aini
ng F
low
Reco
rds
with
nano
seco
nd-
prec
isio
ntim
esta
mp
Info
rmat
ion
Elem
ents
.
nan
ose
con
ds
Reference 211
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 4co
llector
Certifica
te
The
full
X.50
9ce
rtifica
te,
enco
ded
in A
SN.1
DER
form
at, u
sed
by th
e Co
llect
orw
hen
IPFI
XM
essa
ges
wer
etr
ansm
itted
usi
ngTL
S or
DTL
S. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a an
opt
ions
reco
rd a
nd th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t, or
to it
sco
ntai
ning
IPFI
XM
essa
ge v
ia a
nop
tions
reco
rd a
ndth
e m
essa
geSc
ope
Info
rmat
ion
Elem
ent.
212 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 5ex
porter
Certifica
te
The
full
X.50
9ce
rtifica
te,
enco
ded
in A
SN.1
DER
form
at, u
sed
by th
e Co
llect
orw
hen
IPFI
XM
essa
ges
wer
etr
ansm
itted
usi
ngTL
S or
DTL
S. T
his
Info
rmat
ion
Elem
ent m
ust b
ebo
und
to it
sco
ntai
ning
IPFI
XTr
ansp
ort S
essi
onvi
a an
opt
ions
reco
rd a
nd th
ese
ssio
nSco
peIn
form
atio
nEl
emen
t, or
to it
sco
ntai
ning
IPFI
XM
essa
ge v
ia a
nop
tions
reco
rd a
ndth
e m
essa
geSc
ope
Info
rmat
ion
Elem
ent.
Reference 213
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 6da
taRe
cor
dsRe
liab
ility
The
expo
rtre
liabi
lity
of D
ata
Reco
rds,
with
in th
isSC
TP s
trea
m, f
orth
e el
emen
t(s)
inth
e O
ptio
nsTe
mpl
ate
scop
e. A
typi
cal e
xam
ple
ofan
ele
men
t for
whi
ch th
e ex
port
relia
bilit
y w
ill b
ere
port
ed is
the
tem
plat
eID,
as
spec
ified
in th
eDa
ta R
ecor
dsRe
liabi
lity
Opt
ions
Tem
plat
e. A
val
ueof
'Tru
e' m
eans
that
the
Expo
rtin
gPr
oces
s m
ust s
end
any
Data
Rec
ords
asso
ciat
ed w
ith th
eel
emen
t(s)
relia
bly
with
in th
is S
CTP
stre
am. A
val
ue o
f'F
alse
' mea
ns th
atth
e Ex
port
ing
Proc
ess
MAY
sen
dan
y Da
ta R
ecor
dsas
soci
ated
with
the
elem
ent(
s)un
relia
bly
with
inth
is S
CTP
stre
am.
214 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 7ob
serv
atio
nPoi
ntTy
pe
Type
of o
bser
vatio
npo
int.
Valu
esas
sign
ed to
dat
ear
e:
1. P
hysi
cal p
ort
2. P
ort c
hann
el
3. V
lan.
27 8ne
wCo
nne
ctio
nDel
taCo
unt
This
info
rmat
ion
elem
ent c
ount
s th
enu
mbe
r of T
CP o
rUD
P co
nnec
tions
whi
ch w
ere
open
eddu
ring
the
obse
rvat
ion
perio
d.Th
e ob
serv
atio
npe
riod
may
be
spec
ified
by
the
flow
sta
rt a
nd e
ndtim
esta
mps
.
Reference 215
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
27 9co
nnec
tion
Sum
Dur
atio
nSec
onds
This
info
rmat
ion
elem
ent
aggr
egat
es th
eto
tal t
ime
inse
cond
s fo
r all
ofth
e TC
P or
UDP
conn
ectio
ns w
hich
wer
e in
use
dur
ing
the
obse
rvat
ion
perio
d. F
orex
ampl
e if
ther
ear
e 5
conc
urre
ntco
nnec
tions
eac
hfo
r 10
seco
nds,
the
valu
e w
ould
be
50s.
sec
on ds
216 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 0co
nnec
tion
Tran
sac
tionI
d
This
info
rmat
ion
elem
ent ide
ntifies
a tr
ansa
ctio
n w
ithin
a co
nnec
tion.
Atr
ansa
ctio
n is
am
eani
ngfu
lex
chan
ge o
fap
plic
atio
n da
tabe
twee
n tw
one
twor
k de
vice
s or
a cl
ient
and
ser
ver.
A tr
ansa
ctio
nId
isas
sign
ed th
e fir
sttim
e a
flow
isre
port
ed, s
o th
atla
ter r
epor
ts fo
r the
sam
e flo
w w
ill h
ave
the
sam
etr
ansa
ctio
nId.
Adi
ffere
nttr
ansa
ctio
nId
isus
ed fo
r eac
htr
ansa
ctio
n w
ithin
aTC
P or
UDP
conn
ectio
n. T
heiden
tifiers
need
not
be s
eque
ntia
l.
Reference 217
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 1po
stN
ATSo
urce
IPv
6Add
res
s
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'sou
rceI
Pv6A
ddre
ss',
exc
ept t
hat i
tre
port
s a mod
ified
valu
e ca
used
by
aN
AT64
mid
dleb
oxfu
nctio
n af
ter t
hepa
cket
pas
sed
the
Obs
erva
tion
Poin
t.
28 2po
stN
ATDe
stin
ati
onIP
v6A
ddre
ss
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
Info
rmat
ion
Elem
ent
'des
tinat
ionI
Pv6A
ddr
ess',
exc
ept t
hat
it re
port
s a
mod
ified
val
ueca
used
by
a N
AT64
mid
dleb
ox fu
nctio
naf
ter t
he p
acke
tpa
ssed
the
Obs
erva
tion
Poin
t.
218 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 3na
tPoo
lId
Loca
lly u
niqu
eiden
tifier
of a
NAT
pool
.
28 4na
tPoo
lN
ame
The
nam
e of
a N
ATpo
ol id
entifi
ed b
y a
natP
oolID
.
Reference 219
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 5an
onym
iza
tionF
lag
s
A fla
g w
ord
desc
ribin
gsp
ecia
lized
mod
ifica
tions
toth
e an
onym
izat
ion
polic
y in
effe
ct fo
rth
e an
onym
izat
ion
tech
niqu
e ap
plie
dto
a re
fere
nced
Info
rmat
ion
Elem
ent w
ithin
are
fere
nced
Tem
plat
e. W
hen
flags
are
cle
ar (0
),th
e no
rmal
pol
icy
(as
desc
ribed
by
anon
ymiz
atio
nTec
hni
que)
app
lies
with
out
mod
ifica
tion.
MSB 14 13 12 11 10
9 8 7 6 5 4 3
2 1 LSB
+---+---+---+---+---+---+---
+---+---+---+---+---+---+---
+---+---+
|
Reserved
|LOR|PmA| SC |
+---+---+---+---+---+---+---
+---+---+---+---+---+---+---
+---+---+
anonymizationFlags IE
+--------+----------
+----------------------------
-------------------+
| bit(s) | name |
description
|
| (LSB = |
|
|
| 0) |
|
|
+--------+----------
+----------------------------
-------------------+
| 0-1 | SC |
Stability Class: see the
Stability Class |
| | | table
below, and section Section
5.1. |
| 2 | PmA |
Perimeter Anonymization:
when set (1), |
| | |
source- Information Elements
as described in |
| | |
[RFC5103] are interpreted as
external |
| | |
addresses, and destination-
Information |
| | |
Elements as described in
[RFC5103] are |
| | |
interpreted as internal
addresses, for the |
| | |
purposes of
associating
|
| | |
anonymizationTechnique to
Information |
| | |
Elements only; see Section
7.2.2 for details. |
| | | This
bit must NOT be set when
associated with |
| | | a non-
endpoint (that is, source-
or |
| | |
destination-) Information
Element. must be |
| | |
consistent within a record
(that is, if a |
| | |
source- Information Element
has this flag |
| | | set,
the corresponding
destination- element |
| | | must
have this flag set, and vice-
versa.) |
| 3 | LOR | Low-
Order Unchanged: when set
(1), the |
| | | low-
order bits of the anonymized
Information |
| | |
Element contain real data.
This modification |
| | | is
intended for the
anonymization of |
| | |
network-level addresses
while leaving |
| | | host-
level addresses intact in
order to |
| | |
preserve host level-
structure, which could |
| | |
otherwise be used to reverse
anonymization. |
| | | must
NOT be set when associated
with a |
| | |
truncation-based
anonymizationTechnique.
| | 4-15 | Reserved |
Reserved for future use:
must be cleared |
| | | (0) by
the Exporting Process and
must be |
| | |
ignored by the Collecting
Process. |
+--------+----------
+----------------------------
-------------------+
The
Stab
ility
Cla
sspo
rtio
n of
this
flag
sw
ord
desc
ribes
the
stab
ility
cla
ss o
fth
e an
onym
izat
ion
tech
niqu
e ap
plie
dto
a re
fere
nced
Info
rmat
ion
Elem
ent w
ithin
are
fere
nced
Tem
plat
e. S
tabi
lity
clas
ses
refe
r to
the
stab
ility
of t
hepa
ram
eter
s of
the
anon
ymiz
atio
nte
chni
que,
and
ther
efor
e th
eco
mpa
rabi
lity
ofth
e m
appi
ngbe
twee
n th
e re
alan
d an
onym
ized
valu
es o
ver t
ime.
This
det
erm
ines
whi
ch a
nony
miz
edda
tase
ts m
ay b
eco
mpa
red
with
each
oth
er. V
alue
sar
e as
follo
ws:
+-----+-----
+----------------------------
---------------------------+
| Bit | Bit |
Description
|
| 1 | 0
|
|
+-----+-----
+----------------------------
---------------------------+
| 0 | 0 | Undefined: the
Exporting Process makes
no |
| | | representation
as to how stable the mapping
is, or |
| | | over what time
period values of this field
will |
| | | remain
comparable; while the
Collecting Process MAY |
| | | assume Session
level stability, Session
level |
| | | stability is
not guaranteed. Processes
must assume |
| | | this is the
case in the absence of
stability class |
| | | information;
this is the default
stability class. |
| 0 | 1 | Session: the
Exporting Process will
ensure that the |
| | | parameters of
the anonymization technique
are stable |
| | | during the
Transport Session. All the
values of the |
| | | described
Information Element for each
Record |
| | | described by
the referenced Template
within the |
| | | Transport
Session are comparable. The
Exporting |
| | | Process must
endeavour to ensure at least
this |
| | | stability
class.
|
| 1 | 0 | Exporter-
Collector Pair: the
Exporting Process will |
| | | ensure that
the parameters of the
anonymization |
| | | technique are
stable across Transport
Sessions over |
| | | time with the
given Collecting Process,
but may use |
| | | different
parameters for different
Collecting |
| | | Processes.
Data exported to different
Collecting |
| | | Processes are
not
comparable.
|
| 1 | 1 | Stable: the
Exporting Process will
ensure that the |
| | | parameters of
the anonymization technique
are stable |
| | | across
Transport Sessions over
time, regardless of |
| | | the Collecting
Process to which it is
sent. |
+-----+-----
+----------------------------
---------------------------+
220 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 6an
onym
iza
tionT
ech
niqu
e
A de
scrip
tion
of th
ean
onym
izat
ion
tech
niqu
e ap
plie
dto
a re
fere
nced
Info
rmat
ion
Elem
ent w
ithin
are
fere
nced
Tem
plat
e. E
ach
tech
niqu
e m
ay b
eap
plic
able
onl
y to
cert
ain
Info
rmat
ion
Elem
ents
and
reco
mm
ende
d on
lyfo
r cer
tain
Info
mat
ion
Elem
ents
; the
sere
stric
tions
are
note
d in
the
tabl
ebe
low
.
+-------
+---------------------------
+-----------------
+-------------+
| Value |
Description |
Applicable to |
Recommended |
|
|
| |
for |
+-------
+---------------------------
+-----------------
+-------------+
| 0 | Undefined: the
Exporting | all
| all |
| | Process makes
no
|
| |
| | representation as
to |
| |
| | whether the
defined field
|
| |
| | is anonymized or
not. |
| |
| | While the
Collecting
|
| |
| | Process MAY assume
that |
| |
| | the field is
not
|
| |
| | anonymized, it is
not |
| |
| | guaranteed not to
be. |
| |
| | This is the
default
|
| |
| | anonymization
technique.
|
| |
| 1 | None: the values
exported | all |
all |
| | are
real.
|
| |
| 2 |
Precision |
all |
all |
| | Degradation/
Truncation:
|
| |
| | the values
exported are
|
| |
| | anonymized using
simple |
| |
| | precision
degradation or
|
| |
| | truncation. The
new |
| |
| | precision or
number of
|
| |
| | truncated bits
is |
| |
| | implicit in the
exported |
| |
| | data, and can be
deduced |
| |
| | by the
Collecting
|
| |
| |
Process.
|
| |
| 3 | Binning: the
values |
all |
all |
| | exported are
anonymized
|
| |
| | into
bins.
|
| |
| 4 | Enumeration: the
values | all |
timestamps |
| | exported are
anonymized
|
| |
| | by
enumeration.
|
| |
| 5 | Permutation: the
values | all |
identifiers |
| | exported are
anonymized
|
| |
| | by
permutation.
|
| |
| 6 | Structured
Permutation: |
addresses
| |
| | the values
exported are
|
| |
| | anonymized
by
|
| |
| | permutation,
preserving
|
| |
| | bit-level
structure as
|
| |
| | appropriate;
this
|
| |
| |
represents
|
| |
| | prefix-preserving
IP |
| |
| | address
anonymization or
|
| |
| | structured MAC
address |
| |
| |
anonymization.
|
| |
| 7 | Reverse
Truncation: the |
addresses
| |
| | values exported
are |
| |
| | anonymized using
reverse |
| |
| | truncation. The
number |
| |
| | of truncated bits
is |
| |
| | implicit in the
exported |
| |
| | data, and can be
deduced |
| |
| | by the
Collecting
|
| |
| |
Process.
|
| |
| 8 | Noise: the
values | non-
identifiers | counters |
| | exported are
anonymized
|
| |
| | by adding random
noise to |
| |
| | each
value.
|
| |
| 9 | Offset: the
values |
all |
timestamps |
| | exported are
anonymized
|
| |
| | by adding a single
offset |
| |
| | to all
values.
|
| |
+-------
+---------------------------
+-----------------
+-------------+
Reference 221
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 7in
form
atio
nEle
men
tInd
ex
A ze
ro-b
ased
inde
xof
an
Info
rmat
ion
Elem
ent
refe
renc
ed b
yin
form
atio
nEle
men
tId
with
in a
Tem
plat
ere
fere
nced
by
tem
plat
eId;
use
dto
dis
ambi
guat
esc
ope
for
tem
plat
esco
ntai
ning
mul
tiple
iden
tical
Info
rmat
ion
Elem
ents
.
28 8p2
pTec
hno
logy
Spec
ifies
if th
eAp
plic
atio
n ID
isba
sed
on p
eer-
to-
peer
tech
nolo
gy.
Poss
ible
val
ues
are:
{ "y
es",
"y",
1 },
{ "no
", "n
", 2
} and
{ "un
assi
gned
", "u
",0
}.
222 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
28 9tu
nnel
Tech
nolo
gySp
ecifies
if th
eAp
plic
atio
n ID
isus
ed a
s a
tunn
elte
chno
logy
.
Poss
ible
val
ues
are:
{ "y
es",
"y",
1 },
{ "no
", "n
", 2
} and
{ "un
assi
gned
", "u
",0
}.
29 0en
cryp
tedT
echn
olo
gy
Spec
ifies
if th
eAp
plic
atio
n ID
is a
nen
cryp
ted
netw
orki
ngpr
otoc
ol.
Poss
ible
val
ues
are:
{ "y
es",
"y",
1 },
{ "no
", "n
", 2
} and
{ "un
assi
gned
", "u
",0
}.
29 1ba
sicL
ist
Spec
ifies
a g
ener
icIn
form
atio
nEl
emen
t with
aba
sicL
ist a
bstr
act
data
type
. For
exam
ple,
a li
st o
fpo
rt n
umbe
rs, a
list
of in
terf
ace
inde
xes,
etc
.
Reference 223
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
29 2su
bTem
plat
eLis
tSp
ecifies
a g
ener
icIn
form
atio
nEl
emen
t with
asu
bTem
plat
eLis
tab
stra
ct d
ata
type
.
29 3su
bTem
plat
eMul
tiLis
t
Spec
ifies
a g
ener
icIn
form
atio
nEl
emen
t with
asu
bTem
plat
eMul
tiLi
st a
bstr
act d
ata
type
.
29 4bg
pVal
idity
Stat
eTh
is e
lem
ent
desc
ribes
the
"val
idity
sta
te" o
fth
e BG
P ro
ute
corr
espo
nden
tso
urce
or
dest
inat
ion
IPad
dres
s. If
the
"val
idity
sta
te" f
orth
is F
low
is o
nly
avai
labl
e, th
en th
eva
lue
of th
isIn
form
atio
nEl
emen
t is
255.
29 5IP
SecS
PI
IPSe
c Se
curit
yPa
ram
eter
s In
dex
(SPI
).
224 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
29 6na
tTyp
eTh
e ty
pe o
f NAT
trea
tmen
t:
0 un
know
n
1 N
AT44
tran
slat
ed
2 N
AT64
tran
slat
ed
3 N
AT46
tran
slat
ed
4 IP
v4--
>IPv
4 (n
oN
AT)
5 N
AT66
tran
slat
ed
6 IP
v6--
>IPv
6 (n
oN
AT)
GR
E key
, whi
ch is use
d for
ide
ntif
yin
g an indi
vid
ual
traf
fic flo w w
ithi
na tu
nne
l.
29 7Th
e ty
pe o
f NAT
trea
tmen
t:
Reference 225
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
29 8in
itiat
orPa
cket
sTh
e to
tal n
umbe
rof
laye
r 4 p
acke
tsin
a fl
ow fr
om th
ein
itiat
or. T
hein
itiat
or is
the
devi
ce w
hich
trig
gere
d th
ese
ssio
n cr
eatio
n,an
d re
mai
ns th
esa
me
for t
he li
fe o
fth
e se
ssio
n.
pac
ket
s
29 9re
spon
der
Pack
ets
The
tota
l num
ber
of la
yer 4
pac
kets
in a
flow
from
the
resp
onde
r. Th
ere
spon
der i
s th
ede
vice
whi
chre
plie
s to
the
initi
ator
, and
rem
ains
the
sam
efo
r the
life
of t
hese
ssio
n.
pac
ket
s
30 0ob
serv
atio
nDom
ain
Nam
e
The
nam
e of
an
obse
rvat
ion
dom
ain iden
tified
by a
nob
serv
atio
nDom
ain
Id.
226 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 1se
lect
ionS
eque
nce
Id
From
all
the
pack
ets
obse
rved
at a
n O
bser
vatio
nPo
int,
a su
bset
of
the
pack
ets
isse
lect
ed b
y a
sequ
ence
of o
ne o
rm
ore
Sele
ctor
s.Th
ese
lect
ionS
eque
nce
Id is
a u
niqu
e va
lue
per O
bser
vatio
nDo
mai
n, s
peci
fyin
gth
e O
bser
vatio
nPo
int a
nd th
ese
quen
ce o
fSe
lect
ors
thro
ugh
whi
ch th
e pa
cket
sar
e se
lect
ed.
30 2se
lect
orI
dTh
e Se
lect
or ID
isth
e un
ique
IDid
entif
ying
aPr
imiti
ve S
elec
tor.
Each
Prim
itive
Sele
ctor
mus
t hav
ea
uniq
ue ID
in th
eO
bser
vatio
nDo
mai
n.
Reference 227
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 3in
form
atio
nEle
men
tId
This
Info
rmat
ion
Elem
ent c
onta
ins
the
ID o
f ano
ther
Info
rmat
ion
Elem
ent.
228 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 4se
lect
orAl
gorit
hm
This
Info
rmat
ion
Elem
ent ide
ntifies
the
pack
etse
lect
ion
met
hods
(e.g
., Fi
lterin
g,Sa
mpl
ing)
that
are
appl
ied
by th
eSe
lect
ion
Proc
ess.
Mos
t of t
hese
met
hods
hav
epa
ram
eter
s.Fu
rthe
rIn
form
atio
nEl
emen
ts a
rene
eded
to fu
llysp
ecify
pac
ket
sele
ctio
n w
ithth
ese
met
hods
and
all t
heir
para
met
ers.
The
met
hods
list
edbe
low
are
defi
ned
in [R
FC54
75].
For
thei
r par
amet
ers,
Info
rmat
ion
Elem
ents
are
defin
ed in
the
info
rmat
ion
mod
eldo
cum
ent.
The
nam
es o
f the
seIn
form
atio
nEl
emen
ts a
re li
sted
for e
ach
met
hod
iden
tifier.
Furt
her m
etho
diden
tifiers
may
be
adde
d to
the
list
belo
w. I
t mig
ht b
ene
cess
ary
to defi
nene
w In
form
atio
nEl
emen
ts to
spe
cify
thei
r par
amet
ers.
The
sele
ctor
Algo
rithm
regi
stry
ism
aint
aine
d by
IAN
A. N
ewas
sign
men
ts fo
rth
e re
gist
ry w
ill b
ead
min
iste
red
byIA
NA,
and
are
subj
ect t
o Ex
pert
Revi
ew [R
FC81
26].
The
regi
stry
can
be
upda
ted
whe
nsp
ecifica
tions
of
the
new
met
hod(
s)an
d an
y ne
wIn
form
atio
nEl
emen
ts a
repr
ovid
ed.
The
grou
p of
expe
rts
mus
tdo
uble
che
ck th
ese
lect
orAl
gorit
hmde
finition
s an
dIn
form
atio
nEl
emen
ts w
ithal
read
y de
fined
sele
ctor
Algo
rithm
san
d In
form
atio
nEl
emen
ts fo
rco
mpl
eten
ess,
accu
racy
, and
redu
ndan
cy. T
hose
expe
rts
will
initi
ally
be d
raw
n fr
om th
eW
orki
ng G
roup
Chai
rs a
nddo
cum
ent e
dito
rsof
the
IPFI
X an
dPS
AMP
Wor
king
Gro
ups.
The
follo
win
gpa
cket
sel
ectio
nm
etho
ds id
entifi
ers
are de
fined
her
e:
Ther
e is
a b
road
varie
ty o
f pos
sibl
epa
ram
eter
s th
atco
uld
be u
sed
for
Prop
erty
mat
chFi
lterin
g (5
) but
curr
ently
ther
e ar
eno
agr
eed
para
met
ers
spec
ified
.
Reference 229
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 5sa
mpl
ingP
acke
tInt
erva
l
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
pack
ets
that
are
cons
ecut
ivel
ysa
mpl
ed. A
val
ue o
f10
0 m
eans
that
100
cons
ecut
ive
pack
ets
are
sam
pled
.
pac
ket
s
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a sy
stem
atic
cou
nt-
base
d Sa
mpl
ing
Sele
ctor
.
230 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 6sa
mpl
ingP
acke
tSp
ace
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
pack
ets
betw
een
two
"sam
plin
gPac
ketI
nte
rval
"s. A
val
ue o
f10
0 m
eans
that
the
next
inte
rval
sta
rts
100
pack
ets
(whi
char
e no
t sam
pled
)af
ter t
he c
urre
nt"s
ampl
ingP
acke
tIn
terv
al" i
s ov
er.
pac
ket
s
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a sy
stem
atic
cou
nt-
base
d Sa
mpl
ing
Sele
ctor
.
Reference 231
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 7sa
mpl
ingT
imeI
nte
rval
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e tim
e in
terv
al in
mic
rose
cond
sdu
ring
whi
ch a
llar
rivin
g pa
cket
s ar
esa
mpl
ed.
mic
ros
eco
nds
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a sy
stem
atic
tim
e-ba
sed
Sam
plin
gSe
lect
or.
232 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 8sa
mpl
ingT
imeS
pac
e
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e tim
e in
terv
al in
mic
rose
cond
sbe
twee
n tw
o"s
ampl
ingT
imeI
nte
rval
"s. A
val
ue o
f10
0 m
eans
that
the
next
inte
rval
sta
rts
100
mic
rose
cond
s(d
urin
g w
hich
no
pack
ets
are
sam
pled
) afte
r the
curr
ent
"sam
plin
gTim
eInt
erv
al" i
s ov
er.
mic
ros
eco
nds
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay u
sed
to d
escr
ibe
the
confi
guratio
n of
asy
stem
atic
tim
e-ba
sed
Sam
plin
gSe
lect
or.
Reference 233
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
30 9sa
mpl
ingS
ize
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
elem
ents
take
nfr
om th
e pa
rent
Popu
latio
n fo
rra
ndom
Sam
plin
gm
etho
ds.
pac
ket
s
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a ra
ndom
n-o
ut-o
f-N
Sam
plin
gSe
lect
or.
234 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 0sa
mpl
ingP
opul
atio
n
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
elem
ents
in th
epa
rent
Pop
ulat
ion
for r
ando
mSa
mpl
ing
met
hods
.
pac
ket
s
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a ra
ndom
n-o
ut-o
f-N
Sam
plin
gSe
lect
or.
Reference 235
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 1sa
mpl
ingP
roba
bilit
y
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e pr
obab
ility
that
a pa
cket
issa
mpl
ed,
expr
esse
d as
ava
lue
betw
een
0an
d 1.
The
prob
abili
ty is
equ
alfo
r eve
ry p
acke
t. A
valu
e of
0 m
eans
no p
acke
t is
sam
pled
sin
ce th
epr
obab
ility
is 0
.
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a un
iform
prob
abili
stic
Sam
plin
g Se
lect
or.
31 2da
taLi
nkFr
ameS
ize
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e le
ngth
of t
hese
lect
ed d
ata
link
fram
e.
The
data
link
laye
ris
defi
ned
in [I
SO/
IEC.
7498
-1:1
994]
.
236 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 3ip
Hea
derP
acke
tSec
tion
This
Info
rmat
ion
Elem
ent c
arrie
s a
serie
s of
n o
ctet
sfr
om th
e IP
hea
der
of a
sam
pled
pack
et, s
tart
ing
sect
ionO
ffset
octe
ts in
to th
e IP
head
er.
How
ever
, if n
ose
ctio
nOffs
et field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent i
s pr
esen
t,th
en a
sect
ionO
ffset
of
zero
app
lies,
and
the
octe
ts m
ust b
efr
om th
e st
art o
fth
e IP
hea
der.
With
suffic
ient
leng
th, t
his
elem
ent a
lso
repo
rts
octe
ts fr
omth
e IP
pay
load
.H
owev
er, f
ull
pack
et c
aptu
re o
far
bitr
ary
pack
etst
ream
s is
expl
icitl
y ou
t of
scop
e pe
r the
Secu
rity
Cons
ider
atio
nsse
ctio
ns o
f[R
FC54
77] a
nd[R
FC28
04].
The
sect
ionE
xpor
tedO
cte
ts e
xpre
sses
how
muc
h da
ta is
expo
rted
, whi
le th
ere
mai
nder
ispa
ddin
g.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent e
xist
s, th
isIn
form
atio
nEl
emen
t MAY
hav
ea fix
ed le
ngth
and
MAY
be
padd
ed, o
rit
MAY
hav
e a
varia
ble
leng
th.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent d
oes
not
exis
t, th
isIn
form
atio
nEl
emen
t mus
t hav
ea
varia
ble
leng
than
d m
ust N
OT
bepa
dded
. In
this
case
, the
siz
e of
the
expo
rted
sec
tion
may
be
cons
trai
ned
due
to li
mita
tions
in th
e IP
FIX
prot
ocol
.
Reference 237
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 4ip
Payl
oadP
acke
tSe
ctio
n
This
Info
rmat
ion
Elem
ent c
arrie
s a
serie
s of
n o
ctet
sfr
om th
e IP
payl
oad
of a
sam
pled
pac
ket,
star
ting
sect
ionO
ffset
octe
ts in
to th
e IP
payl
oad.
How
ever
, if n
ose
ctio
nOffs
et field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent i
s pr
esen
t,th
en a
sect
ionO
ffset
of
zero
app
lies,
and
the
octe
ts m
ust b
efr
om th
e st
art o
fth
e IP
pay
load
.
The
IPv4
pay
load
isth
at p
art o
f the
pack
et th
at fo
llow
sth
e IP
v4 h
eade
ran
d an
y op
tions
,w
hich
[RFC
791]
refe
rs to
as
"dat
a"or
"dat
a oc
tets
".Fo
r exa
mpl
e, s
eeth
e ex
ampl
es in
[RFC
791]
,Ap
pend
ix A
.
The
IPv6
pay
load
isth
e re
st o
f the
pack
et fo
llow
ing
the
40-o
ctet
IPv6
head
er. N
ote
that
any
exte
nsio
nhe
ader
s pr
esen
tar
e co
nsid
ered
par
tof
the
payl
oad.
The
sect
ionE
xpor
tedO
cte
ts e
xpre
sses
how
muc
h da
ta is
obse
rved
, whi
le th
ere
mai
nder
ispa
ddin
g.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent e
xist
s, th
isIn
form
atio
nEl
emen
t MAY
hav
ea fix
ed le
ngth
and
MAY
be
padd
ed, o
rM
AY h
ave
ava
riabl
e le
ngth
.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent d
oes
not
exis
t, th
isIn
form
atio
nEl
emen
t mus
t hav
ea
varia
ble
leng
than
d m
ust N
OT
bepa
dded
. In
this
case
, the
siz
e of
the
expo
rted
sec
tion
may
be
cons
trai
ned
due
to li
mita
tions
in th
e IP
FIX
prot
ocol
.
238 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 5da
taLi
nkFr
ameS
ect
ion
This
Info
rmat
ion
Elem
ent c
arrie
s n
octe
ts fr
om th
eda
ta li
nk fr
ame
of a
sele
cted
fram
e,st
artin
gse
ctio
nOffs
etoc
tets
into
the
fram
e.
How
ever
, if n
ose
ctio
nOffs
et field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent i
s pr
esen
t,th
en a
sect
ionO
ffset
of
zero
app
lies,
and
the
octe
ts m
ust b
efr
om th
e st
art o
fth
e da
ta li
nk fr
ame.
The
sect
ionE
xpor
tedO
cte
ts e
xpre
sses
how
muc
h da
ta is
obse
rved
, whi
le th
ere
mai
nder
ispa
ddin
g.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent e
xist
s, th
isIn
form
atio
nEl
emen
t MAY
hav
ea fix
ed le
ngth
and
MAY
be
padd
ed, o
rM
AY h
ave
ava
riabl
e le
ngth
.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent d
oes
not
exis
t, th
isIn
form
atio
nEl
emen
t mus
t hav
ea
varia
ble
leng
than
d m
ust N
OT
bepa
dded
. In
this
case
, the
siz
e of
the
expo
rted
sec
tion
may
be
cons
trai
ned
due
to li
mita
tions
in th
e IP
FIX
prot
ocol
.
Furt
her
Info
rmat
ion
Elem
ents
, tha
t is,
data
Link
Fram
eTyp
ean
dda
taLi
nkFr
ameS
ize,
are
need
ed to
spec
ify th
e da
talin
k ty
pe a
nd th
esi
ze o
f the
dat
a lin
kfr
ame
of th
isIn
form
atio
nEl
emen
t. A
set o
fth
ese
Info
rmat
ion
Elem
ents
MAY
be
cont
aine
d in
ast
ruct
ured
dat
aty
pe, a
s ex
pres
sed
in [R
FC63
13].
Or a
set o
f the
seIn
form
atio
nEl
emen
ts M
AY b
eco
ntai
ned
in o
neFl
ow R
ecor
d as
show
n in
App
endi
xB
of [R
FC71
33].
The
data
link
laye
ris
defi
ned
in [I
SO/
IEC.
7498
-1:1
994]
.
Reference 239
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 6m
plsL
abel
Stac
kSec
tion
This
Info
rmat
ion
Elem
ent c
arrie
s a
serie
s of
n o
ctet
sfr
om th
e M
PLS
labe
l sta
ck o
f asa
mpl
ed p
acke
t,st
artin
gse
ctio
nOffs
etoc
tets
into
the
MPL
S la
bel s
tack
.
How
ever
, if n
ose
ctio
nOffs
et field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent i
s pr
esen
t,th
en a
sect
ionO
ffset
of
zero
app
lies,
and
the
octe
ts m
ust b
efr
om th
e he
ad o
fth
e M
PLS
labe
lst
ack.
With
suffic
ient
leng
th, t
his
elem
ent a
lso
repo
rts
octe
ts fr
omth
e M
PLS
payl
oad.
How
ever
, ful
lpa
cket
cap
ture
of
arbi
trar
y pa
cket
stre
ams
isex
plic
itly
out o
fsc
ope.
See
[RFC
3031
] for
the sp
ecifica
tion
ofM
PLS
pack
ets.
See
[RFC
3032
] for
the sp
ecifica
tion
ofth
e M
PLS
labe
lst
ack.
The
sect
ionE
xpor
tedO
cte
ts e
xpre
sses
how
muc
h da
ta is
obse
rved
, whi
le th
ere
mai
nder
ispa
ddin
g.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent e
xist
s, th
isIn
form
atio
nEl
emen
t MAY
hav
ea fix
ed le
ngth
and
MAY
be
padd
ed, o
rM
AY h
ave
ava
riabl
e le
ngth
.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent d
oes
not
exis
t, th
isIn
form
atio
nEl
emen
t mus
t hav
ea
varia
ble
leng
than
d m
ust N
OT
bepa
dded
. In
this
case
, the
siz
e of
the
expo
rted
sec
tion
may
be
cons
trai
ned
due
to li
mita
tions
in th
e IP
FIX
prot
ocol
.
240 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 7m
plsP
aylo
adPa
cke
tSec
tion
The
mpl
sPay
load
Pack
etSe
ctio
n ca
rrie
s a
serie
s of
n o
ctet
sfr
om th
e M
PLS
payl
oad
of a
sam
pled
pac
ket,
star
ting
sect
ionO
ffset
octe
ts in
to th
eM
PLS
payl
oad,
as
itis
dat
a th
at fo
llow
sim
med
iate
ly a
fter
the
MPL
S la
bel
stac
k.
How
ever
, if n
ose
ctio
nOffs
et field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent i
s pr
esen
t,th
en a
sect
ionO
ffset
of
zero
app
lies,
and
the
octe
ts m
ust b
efr
om th
e st
art o
fth
e M
PLS
payl
oad.
See
[RFC
3031
] for
the sp
ecifica
tion
ofM
PLS
pack
ets.
See
[RFC
3032
] for
the sp
ecifica
tion
ofth
e M
PLS
labe
lst
ack.
The
sect
ionE
xpor
tedO
cte
ts e
xpre
sses
how
muc
h da
ta is
obse
rved
, whi
le th
ere
mai
nder
ispa
ddin
g.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent e
xist
s, th
isIn
form
atio
nEl
emen
t MAY
hav
ea fix
ed le
ngth
and
MAY
be
padd
ed, o
rit
MAY
hav
e a
varia
ble
leng
th.
Whe
n th
ese
ctio
nExp
orte
dOc
tets
field
corr
espo
ndin
g to
this
Info
rmat
ion
Elem
ent d
oes
not
exis
t, th
isIn
form
atio
nEl
emen
t mus
t hav
ea
varia
ble
leng
than
d m
ust N
OT
bepa
dded
. In
this
case
, the
siz
e of
the
expo
rted
sec
tion
may
be
cons
trai
ned
due
to li
mita
tions
in th
e IP
FIX
prot
ocol
.
Reference 241
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
31 8se
lect
orI
dTot
alPk
tsO
bser
ved
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e to
tal n
umbe
r of
pack
ets
obse
rved
by a
Sel
ecto
r, fo
r asp
ecific
valu
e of
Sele
ctor
Id.
pac
ket
s
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed in
an
Opt
ions
Tem
plat
e sc
oped
to th
e ob
serv
atio
nto
whi
ch it
refe
rs
31 9se
lect
orI
dTot
alPk
tsSe
lect
ed
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e to
tal n
umbe
r of
pack
ets
sele
cted
by a
Sel
ecto
r, fo
r asp
ecific
valu
e of
Sele
ctor
Id.
pac
ket
s
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed in
an
Opt
ions
Tem
plat
e sc
oped
to th
e ob
serv
atio
nto
whi
ch it
refe
rs.
242 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
32 0ab
solu
teEr
ror
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e m
axim
umpo
ssib
lem
easu
rem
ent e
rror
of th
e re
port
edva
lue
for a
giv
enIn
form
atio
nEl
emen
t. Th
eab
solu
teEr
ror h
asth
e sa
me
unit
asth
e In
form
atio
nEl
emen
t with
whi
chit
is a
ssoc
iate
d.Th
e re
al v
alue
of
the
met
ric c
andi
ffer b
yab
solu
teEr
ror
(pos
itive
or
nega
tive)
from
the
mea
sure
d va
lue.
This
Info
rmat
ion
Elem
ent p
rovi
des
only
the
erro
r for
mea
sure
d va
lues
.If
an
Info
rmat
ion
Elem
ent c
onta
ins
an e
stim
ated
val
ue(fr
om S
ampl
ing)
,th
e co
nfide
nce
boun
darie
s an
dco
nfide
nce
leve
lha
ve to
be
prov
ided
inst
ead,
usi
ng th
eup
perC
ILim
it,lo
wer
CILi
mit,
and
confi
denc
eLev
elIn
form
atio
nEl
emen
ts.
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed in
an
Opt
ions
Tem
plat
e sc
oped
to th
e ob
serv
atio
nto
whi
ch it
refe
rs.
Th e uni
ts of the
Inf
or ma
tio n Ele
me
nt for
whi
ch the
err
or is spe
cifi
ed.
Reference 243
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
32 1re
lativ
eErr
orTh
is In
form
atio
nEl
emen
t spe
cifie
sth
e m
axim
umpo
ssib
le p
ositi
ve o
rne
gativ
e er
ror r
atio
for t
he re
port
edva
lue
for a
giv
enIn
form
atio
nEl
emen
t as
perc
enta
ge o
f the
mea
sure
d va
lue.
The
real
val
ue o
fth
e m
etric
can
diffe
r by
rela
tiveE
rror
perc
ent (
posi
tive
orne
gativ
e) fr
om th
em
easu
red
valu
e.
This
Info
rmat
ion
Elem
ent p
rovi
des
only
the
erro
r for
mea
sure
d va
lues
.If
an
Info
rmat
ion
Elem
ent c
onta
ins
an e
stim
ated
val
ue(fr
om S
ampl
ing)
,th
e co
nfide
nce
boun
darie
s an
dco
nfide
nce
leve
lha
ve to
be
prov
ided
inst
ead,
usi
ng th
eup
perC
ILim
it,lo
wer
CILi
mit,
and
confi
denc
eLev
elIn
form
atio
nEl
emen
ts.
This
Info
rmat
ion
Elem
ent m
ust b
eus
ed in
an
Opt
ions
Tem
plat
e sc
oped
to th
e ob
serv
atio
nto
whi
ch it
refe
rs.
244 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
32 2ob
serv
atio
nTim
eSe
cond
s
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e ab
solu
te ti
me
in s
econ
ds o
f an
obse
rvat
ion.
sec
on ds
32 3ob
serv
atio
nTim
eM
illis
eco
nds
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e ab
solu
te ti
me
in m
illis
econ
ds o
fan
obs
erva
tion.
mill
ise
con
ds
32 4ob
serv
atio
nTim
eM
icro
sec
onds
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e ab
solu
te ti
me
in m
icro
seco
nds
ofan
obs
erva
tion.
mic
ros
eco
nds
32 5ob
serv
atio
nTim
eN
anos
econ
ds
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e ab
solu
te ti
me
in n
anos
econ
ds o
fan
obs
erva
tion.
nan
ose
con
ds
32 6di
gest
Ha
shVa
lue
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e va
lue
from
the
dige
st h
ash
func
tion.
Reference 245
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
32 7ha
shIP
Pay
load
Of
fset
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e IP
pay
load
offs
et u
sed
by a
Has
h-ba
sed
Sele
ctio
n Se
lect
or.
32 8ha
shIP
Pay
load
Size
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e IP
pay
load
siz
eus
ed b
y a
Has
h-ba
sed
Sele
ctio
nSe
lect
or.
32 9ha
shO
utpu
tRan
geM
in
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e va
lue
for t
hebe
ginn
ing
of a
has
hfu
nctio
n's
pote
ntia
lou
tput
rang
e.
See
also
Sec
tions
6.2,
3.8
and
7.1
of
[RFC
5475
].
246 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
33 0ha
shO
utpu
tRan
geM
ax
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e va
lue
for t
heen
d of
a h
ash
func
tion'
s po
tent
ial
outp
ut ra
nge.
See
also
Sec
tions
6.2,
3.8
and
7.1
of
[RFC
5475
].
33 1ha
shSe
lec
tedR
ang
eMin
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e va
lue
for t
hebe
ginn
ing
of a
has
hfu
nctio
n's
sele
cted
rang
e.
See
also
Sec
tions
6.2,
3.8
and
7.1
of
[RFC
5475
].
33 2ha
shSe
lec
tedR
ang
eMax
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e va
lue
for t
heen
d of
a h
ash
func
tion'
s se
lect
edra
nge.
See
also
Sec
tions
6.2,
3.8
and
7.1
of
[RFC
5475
].
Reference 247
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
33 3ha
shDi
ges
tOut
put
This
Info
rmat
ion
Elem
ent c
onta
ins
abo
olea
n va
lue
that
is T
RUE
if th
eou
tput
from
this
hash
Sel
ecto
r has
been
con
figur
ed to
be in
clud
ed in
the
pack
et re
port
as
apa
cket
dig
est,
else
FALS
E.
See
also
Sec
tions
6.2,
3.8
and
7.1
of
[RFC
5475
].
33 4ha
shIn
itial
iser
Val
ue
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e in
itial
iser
val
ueto
the
hash
func
tion.
See
also
Sec
tions
6.2,
3.8
and
7.1
of
[RFC
5475
].
33 5se
lect
orN
ame
The
nam
e of
ase
lect
or id
entifi
edby
a s
elec
torI
D.G
loba
lly u
niqu
e pe
rM
eter
ing
Proc
ess.
248 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
33 6up
perC
ILi
mit
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e up
per l
imit
of a
confi
denc
ein
terv
al. I
t is
used
to p
rovi
de a
nac
cura
cyst
atem
ent f
or a
nes
timat
ed v
alue
.Th
e co
nfide
nce
limits
defi
ne th
era
nge
in w
hich
the
real
val
ue is
assu
med
to b
e w
itha
cert
ain
prob
abili
ty p
.Co
nfide
nce
limits
alw
ays
need
to b
eas
soci
ated
with
aco
nfide
nce
leve
lth
at defi
nes
this
prob
abili
ty p
.Pl
ease
not
e th
at a
confi
denc
e in
terv
alon
ly p
rovi
des
apr
obab
ility
that
the
real
val
ue li
esw
ithin
the
limits
.Th
at m
eans
the
real
val
ue c
an li
eou
tsid
e th
eco
nfide
nce
limits
.
The
uppe
rCIL
imit,
low
erCI
Lim
it, a
ndco
nfide
nceL
evel
Info
rmat
ion
Elem
ents
mus
t all
be u
sed
in a
nO
ptio
ns T
empl
ate
scop
ed to
the
obse
rvat
ion
tow
hich
they
refe
r.
Not
e th
at th
eup
perC
ILim
it,lo
wer
CILi
mit,
and
confi
denc
eLev
elar
e al
l req
uire
d to
spec
ify con
fiden
ce,
and
mus
t be
disr
egar
ded
unle
ssal
l thr
ee a
resp
ecified
toge
ther
.
Reference 249
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
33 7lo
wer
CIL
imit
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e lo
wer
lim
it of
aco
nfide
nce
inte
rval
. For
furt
her
info
rmat
ion,
see
the
desc
riptio
n of
uppe
rCIL
imit.
The
uppe
rCIL
imit,
low
erCI
Lim
it, a
ndco
nfide
nceL
evel
Info
rmat
ion
Elem
ents
mus
t all
be u
sed
in a
nO
ptio
ns T
empl
ate
scop
ed to
the
obse
rvat
ion
tow
hich
they
refe
r.
Not
e th
at th
eup
perC
ILim
it,lo
wer
CILi
mit,
and
confi
denc
eLev
elar
e al
l req
uire
d to
spec
ify con
fiden
ce,
and
mus
t be
disr
egar
ded
unle
ssal
l thr
ee a
resp
ecified
toge
ther
.
250 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
33 8co
nfide
nce
Leve
lTh
is In
form
atio
nEl
emen
t spe
cifie
sth
e co
nfide
nce
leve
l. It
is u
sed
topr
ovid
e an
accu
racy
stat
emen
t for
estim
ated
val
ues.
The co
nfide
nce
leve
l pro
vide
s th
epr
obab
ility
p w
ithw
hich
the
real
valu
e lie
s w
ithin
agi
ven
rang
e. A
confi
denc
e le
vel
alw
ays
need
s to
be
asso
ciat
ed w
ithco
nfide
nce
limits
that
defi
ne th
era
nge
in w
hich
the
real
val
ue is
assu
med
to b
e.
The
uppe
rCIL
imit,
low
erCI
Lim
it, a
ndco
nfide
nceL
evel
Info
rmat
ion
Elem
ents
mus
t all
be u
sed
in a
nO
ptio
ns T
empl
ate
scop
ed to
the
obse
rvat
ion
tow
hich
they
refe
r.
Not
e th
at th
eup
perC
ILim
it,lo
wer
CILi
mit,
and
confi
denc
eLev
elar
e al
l req
uire
d to
spec
ify con
fiden
ce,
and
mus
t be
disr
egar
ded
unle
ssal
l thr
ee a
resp
ecified
toge
ther
.
Reference 251
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
33 9in
form
atio
nEle
men
tDat
aTyp
e
A de
scrip
tion
of th
eab
stra
ct d
ata
type
of a
n IP
FIX
info
rmat
ion
elem
ent.
Thes
e ty
pes
are
regi
ster
ed in
the
IAN
A IP
FIX
Info
rmat
ion
Elem
ent D
ata
Type
subr
egis
try.
Thi
ssu
breg
istr
y is
inte
nded
to a
ssig
nnu
mbe
rs fo
r typ
ena
mes
, not
topr
ovid
e a
mec
hani
sm fo
rad
ding
dat
a ty
pes
to th
e IP
FIX
Prot
ocol
, and
as
such
requ
ires
aSt
anda
rds
Actio
n to
mod
ify.
252 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
34 0in
form
atio
nEle
men
tDes
crip
tion
A UT
F-8
[RFC
3629
]en
code
d Un
icod
est
ring
cont
aini
ng a
hum
an-r
eada
ble
desc
riptio
n of
an
Info
rmat
ion
Elem
ent.
The
cont
ent o
f the
info
rmat
ionE
lem
entD
escr
iptio
n M
AYbe
ann
otat
ed w
ithon
e or
mor
ela
ngua
ge ta
gs[R
FC46
46],
enco
ded
in-li
ne[R
FC24
82] w
ithin
the
UTF-
8 st
ring,
inor
der t
o sp
ecify
the
lang
uage
in w
hich
the
desc
riptio
n is
writ
ten.
Des
crip
tion
text
in m
ultip
lela
ngua
ges
MAY
tag
each
sec
tion
with
its o
wn
lang
uage
tag;
in th
is c
ase,
the
desc
riptio
nin
form
atio
n in
eac
hla
ngua
ge m
ust
have
equ
ival
ent
mea
ning
. In
the
abse
nce
of a
nyla
ngua
ge ta
g, th
e"i-
defa
ult"
[RFC
2277
]la
ngua
ge m
ust b
eas
sum
ed. S
ee th
eSe
curit
yCo
nsid
erat
ions
sect
ion
for n
otes
on s
trin
g ha
ndlin
gfo
r Inf
orm
atio
nEl
emen
t typ
ere
cord
s.
Reference 253
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
34 1in
form
atio
nEle
men
tNam
e
A UT
F-8
[RFC
3629
]en
code
d Un
icod
est
ring
cont
aini
ngth
e na
me
of a
nIn
form
atio
nEl
emen
t, in
tend
edas
a s
impl
eiden
tifier. S
ee th
eSe
curit
yCo
nsid
erat
ions
sect
ion
for n
otes
on s
trin
g ha
ndlin
gfo
r Inf
orm
atio
nEl
emen
t typ
ere
cord
s
34 2in
form
atio
nEle
men
tRan
geB
egin
Cont
ains
the
incl
usiv
e lo
w e
nd o
fth
e ra
nge
ofac
cept
able
val
ues
for a
n In
form
atio
nEl
emen
t.
34 3in
form
atio
nEle
men
tRan
geE
nd
Cont
ains
the
incl
usiv
e hi
gh e
ndof
the
rang
e of
acce
ptab
le v
alue
sfo
r an
Info
rmat
ion
Elem
ent.
254 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
34 4in
form
atio
nEle
men
tSem
ant
ics
A de
scrip
tion
of th
ese
man
tics
of a
nIP
FIX
Info
rmat
ion
Elem
ent.
Thes
e ar
eta
ken
from
the
data
type
sem
antic
sde
fined
in s
ectio
n3.
2 of
the
IPFI
XIn
form
atio
n M
odel
[RFC
5102
]; se
eth
at s
ectio
n fo
rm
ore
info
rmat
ion
on th
e ty
pes
defin
ed in
the
info
rmat
ionE
lem
entS
eman
tics
sub-
regi
stry
. Thi
s fie
ldm
ay ta
ke th
eva
lues
in T
able
;th
e sp
ecia
l val
ue0x
00 (d
efau
lt) is
used
to n
ote
that
no s
eman
tics
appl
yto
the fie
ld; i
tca
nnot
be
man
ipul
ated
by
aCo
llect
ing
Proc
ess
or F
ile R
eade
r tha
tdo
es n
otun
ders
tand
it a
prio
rity
Thes
e se
man
tics
are
regi
ster
ed in
the
IAN
A IP
FIX
Info
rmat
ion
Elem
ent S
eman
tics
subr
egis
try.
Thi
ssu
breg
istr
y is
inte
nded
to a
ssig
nnu
mbe
rs fo
rse
man
tics
nam
es,
not t
o pr
ovid
e a
mec
hani
sm fo
rad
ding
sem
antic
sto
the
IPFI
XPr
otoc
ol, a
nd a
ssu
ch re
quire
s a
Stan
dard
s Ac
tion
[RFC
8126
] to
mod
ify.
Reference 255
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
34 5in
form
atio
nEle
men
tUni
ts
A de
scrip
tion
of th
eun
its o
f an
IPFI
XIn
form
atio
nEl
emen
t. Th
ese
corr
espo
nd to
the
units
impl
icitl
yde
fined
in th
eIn
form
atio
nEl
emen
t defi
nitio
nsin
sec
tion
5 of
the
IPFI
X In
form
atio
nM
odel
[RFC
5102
];se
e th
at s
ectio
n fo
rm
ore
info
rmat
ion
on th
e ty
pes
desc
ribed
in th
ein
form
atio
nEle
men
tsUn
its s
ub-
regi
stry
. Thi
s fie
ldm
ay ta
ke th
eva
lues
in T
able
3be
low
; the
spe
cial
valu
e 0x
00 (n
one)
is u
sed
to n
ote
that
the fie
ld is
uni
tless
.
Thes
e ty
pes
are
regi
ster
ed in
the
IAN
A IP
FIX
Info
rmat
ion
Elem
ent U
nits
subr
egis
try;
new
type
s m
ay b
ead
ded
on a
Firs
tCo
me
Firs
t Ser
ved
[RFC
8126
] bas
is.
256 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
34 6pr
ivat
eEnt
erpr
ise
Num
ber
A pr
ivat
een
terp
rise
num
ber,
as a
ssig
ned
byIA
NA.
With
in th
eco
ntex
t of a
nIn
form
atio
nEl
emen
t Typ
ere
cord
, thi
sel
emen
t can
be
used
alo
ng w
ith th
ein
form
atio
nEle
men
tId
elem
ent t
osc
ope
prop
ertie
s to
a sp
ecific
Info
rmat
ion
Elem
ent.
To e
xpor
tty
pe in
form
atio
nab
out a
n IA
NA-
assi
gned
Info
rmat
ion
Elem
ent,
set t
hepr
ivat
eEnt
erpr
iseN
umbe
r to
0, o
r do
not e
xpor
t the
priv
ateE
nter
pris
eNum
ber i
n th
e ty
pere
cord
. To
expo
rtty
pe in
form
atio
nab
out a
nen
terp
rise-
spec
ific
Info
rmat
ion
Elem
ent,
expo
rtth
e en
terp
rise
num
ber i
npr
ivat
eEnt
erpr
iseN
umbe
r, an
d ex
port
the
Info
rmat
ion
Elem
ent n
umbe
rw
ith th
e En
terp
rise
bit c
lear
ed in
info
rmat
ionE
lem
entI
d. T
he E
nter
pris
ebi
t in
the
asso
ciat
edin
form
atio
nEle
men
tId
Info
rmat
ion
Elem
ent m
ust b
eig
nore
d by
the
Colle
ctin
g Pr
oces
s.Reference 257
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
34 7vi
rtua
lSt
atio
nInt
erfa
ceId
Inst
ance
Iden
tifier
of th
e in
terf
ace
to a
Virt
ual S
tatio
n. A
Virt
ual S
tatio
n is
an
end
stat
ion
inst
ance
: it c
an b
ea
virt
ual m
achi
neor
a p
hysi
cal h
ost.
34 8vi
rtua
lSt
atio
nInt
erfa
ceN
am
e
Nam
e of
the
inte
rfac
e to
aVi
rtua
l Sta
tion.
AVi
rtua
l Sta
tion
is a
nen
d st
atio
nin
stan
ce: i
t can
be
a vi
rtua
l mac
hine
or a
phy
sica
l hos
t.
34 9vi
rtua
lSt
atio
nUUI
D
Uniq
ue Id
entifi
er o
fa
Virt
ual S
tatio
n. A
Virt
ual S
tatio
n is
an
end
stat
ion
inst
ance
: it c
an b
ea
virt
ual m
achi
neor
a p
hysi
cal h
ost.
35 0vi
rtua
lSt
atio
nNa
me
Nam
e of
a V
irtua
lSt
atio
n. A
Virt
ual
Stat
ion
is a
n en
dst
atio
n in
stan
ce: i
tca
n be
a v
irtua
lm
achi
ne o
r aph
ysic
al h
ost.
258 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
35 1la
yer2
Segm
entI
dId
entifi
er o
f a la
yer
2 ne
twor
k se
gmen
tin
an
over
lay
netw
ork.
The
mos
tsign
ifica
nt b
yte
iden
tifies
the
laye
r2
netw
ork
over
lay
netw
ork
enca
psul
atio
nty
pe:
0x00
rese
rved
0x01
VxL
AN
0x02
NVG
RE
The
thre
e lo
wes
tsign
ifica
nt b
ytes
hold
the
valu
e of
the
laye
r 2 o
verla
yne
twor
k se
gmen
tiden
tifier.
For e
xam
ple:
- a 2
4 bi
t seg
men
tID
VXL
AN N
etw
ork
Iden
tifier
(VN
I)
- a 2
4 bi
t Ten
ant
Net
wor
k Id
entifi
er(T
NI)
for N
VGRE
Reference 259
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
35 2la
yer2
Oc
tetD
elta
Coun
t
The
num
ber o
fla
yer 2
oct
ets
sinc
eth
e pr
evio
us re
port
(if a
ny) i
n in
com
ing
pack
ets
for t
his
Flow
at t
heO
bser
vatio
n Po
int.
The
num
ber o
foc
tets
incl
udes
laye
r 2 h
eade
r(s)
and
laye
r 2pa
yloa
d. #
mem
o:la
yer 2
ver
sion
of
octe
tDel
taCo
unt
(field
#1)
oct
ets
260 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
35 3la
yer2
Oc
tetT
otal
Coun
t
The
tota
l num
ber
of la
yer 2
oct
ets
inin
com
ing
pack
ets
for t
his
Flow
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
The
num
ber
of o
ctet
s in
clud
esla
yer 2
hea
der(
s)an
d la
yer 2
payl
oad.
# m
emo:
laye
r 2 v
ersi
on o
foc
tetT
otal
Coun
t(field
#85
)
oct
ets
35 4in
gres
sUni
cast
Pack
etTo
talC
ount
The
tota
l num
ber
of in
com
ing
unic
ast
pack
ets
met
ered
at
the
Obs
erva
tion
Poin
t sin
ce th
eM
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
Reference 261
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
35 5in
gres
sMul
ticas
tPac
ketT
otal
Coun
t
The
tota
l num
ber
of in
com
ing
mul
ticas
t pac
kets
met
ered
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
35 6in
gres
sBro
adca
stPa
cket
Tot
alCo
unt
The
tota
l num
ber
of in
com
ing
broa
dcas
t pac
kets
met
ered
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
35 7eg
ress
Uni
cast
Pack
etTo
talC
ount
The
tota
l num
ber
of in
com
ing
unic
ast
pack
ets
met
ered
at
the
Obs
erva
tion
Poin
t sin
ce th
eM
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
262 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
35 8eg
ress
Broa
dcas
tPa
cket
Tot
alCo
unt
The
tota
l num
ber
of in
com
ing
broa
dcas
t pac
kets
met
ered
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
pac
ket
s
35 9m
onito
ring
Inte
rval
Star
tMi
lli Seco
nds
The
abso
lute
times
tam
p at
whi
ch th
em
onito
ring
inte
rval
star
ted.
AM
onito
ring
inte
rval
is th
e pe
riod
oftim
e du
ring
whi
chth
e M
eter
ing
Proc
ess
is ru
nnin
g.
mill
ise
con
ds
36 0m
onito
ring
Inte
rval
EndM
illi Se
cond
s
The
abso
lute
times
tam
p at
whi
ch th
em
onito
ring
inte
rval
ende
d. A
Mon
itorin
g in
terv
alis
the
perio
d of
time
durin
g w
hich
the
Met
erin
gPr
oces
s is
runn
ing.
mill
ise
con
ds
Reference 263
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
36 1po
rtRa
nge
Star
tTh
e po
rt n
umbe
rid
entif
ying
the
star
tof
a ra
nge
of p
orts
.A
valu
e of
zer
oin
dica
tes
that
the
rang
e st
art i
s no
tsp
ecified
, ie
the
rang
e is
defi
ned
inso
me
othe
r way
.
Addi
tiona
lin
form
atio
n on
defin
ed T
CP p
ort
num
bers
can
be
foun
d at
[IAN
Are
gist
ry s
ervi
ce-
nam
es-p
ort-
num
bers
].
264 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
36 2po
rtRa
nge
End
The
port
num
ber
iden
tifyi
ng th
e en
dof
a ra
nge
of p
orts
.A
valu
e of
zer
oin
dica
tes
that
the
rang
e en
d is
not
spec
ified
, ie
the
rang
e is
defi
ned
inso
me
othe
r way
.
Addi
tiona
lin
form
atio
n on
defin
ed T
CP p
ort
num
bers
can
be
foun
d at
[IAN
Are
gist
ry s
ervi
ce-
nam
es-p
ort-
num
bers
].
36 3po
rtRa
nge
Step
Size
The
step
siz
e in
apo
rt ra
nge.
The
defa
ult s
tep
size
is1,
whi
ch in
dica
tes
cont
iguo
us p
orts
. Ava
lue
of z
ero
indi
cate
s th
at th
est
ep s
ize
is n
otsp
ecified
, ie
the
rang
e is
defi
ned
inso
me
othe
r way
.
Reference 265
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
36 4po
rtRa
nge
Num
Por
ts
The
num
ber o
fpo
rts
in a
por
tra
nge.
A v
alue
of
zero
indi
cate
s th
atth
e nu
mbe
r of
port
s is
not
spec
ified
, ie
the
rang
e is
defi
ned
inso
me
othe
r way
.
36 5st
aMac
Add
ress
The
IEEE
802
MAC
addr
ess
of a
wire
less
sta
tion
(STA
).
36 6st
aIPv
4Ad
dres
sTh
e IP
v4 a
ddre
ssof
a w
irele
ssst
atio
n (S
TA).
36 7w
tpM
acAd
dres
sTh
e IE
EE 8
02 M
ACad
dres
s of
aw
irele
ss a
cces
spo
int (
WTP
).
266 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
36 8in
gres
sInt
erfa
ceTy
pe
The
type
of
inte
rfac
e w
here
pack
ets
of th
isFl
ow a
re b
eing
rece
ived
. The
val
uem
atch
es th
e va
lue
of m
anag
ed o
bjec
t'if
Type
' as de
fined
in [I
ANA
regi
stry
iana
iftyp
e-m
ib].
36 9eg
ress
Inte
rfac
eTyp
e
The
type
of
inte
rfac
e w
here
pack
ets
of th
isFl
ow a
re b
eing
sent
. The
val
uem
atch
es th
e va
lue
of m
anag
ed o
bjec
t'if
Type
' as de
fined
in [I
ANA
regi
stry
iana
iftyp
e-m
ib].
37 0rt
pSeq
uen
ceN
um
ber
RTP
sequ
ence
num
ber p
er[R
FC35
50].
37 1us
erN
am
eUs
er n
ame
asso
ciat
ed w
ith th
eflo
w.
Reference 267
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
37 2ap
plic
ati
onCa
teg
oryN
ame
An a
ttrib
ute
that
prov
ides
a first
leve
l cat
egor
izat
ion
for e
ach
Appl
icat
ion
ID.
37 3ap
plic
ati
onSu
bCa
tego
ryN
ame
An a
ttrib
ute
that
prov
ides
a s
econ
dle
vel c
ateg
oriz
atio
nfo
r eac
hAp
plic
atio
n ID
.
37 4ap
plic
ati
onG
roup
Nam
e
An a
ttrib
ute
that
grou
ps m
ultip
leAp
plic
atio
n ID
sth
at b
elon
g to
the
sam
e ne
twor
king
appl
icat
ion.
37 5or
igin
alF
low
sPre
sent
The
non-
cons
erva
tive
coun
tof
Orig
inal
Flo
ws
cont
ribut
ing
to th
isAg
greg
ated
Flo
w.
Non
-con
serv
ativ
eco
unts
nee
d no
tsu
m to
the
orig
inal
coun
t on
re-
aggr
egat
ion.
flo ws
268 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
37 6or
igin
alF
low
sIni
tiat
ed
The
cons
erva
tive
coun
t of O
rigin
alFl
ows
who
se first
pack
et is
repr
esen
ted
with
inth
is A
ggre
gate
dFl
ow. C
onse
rvat
ive
coun
ts m
ust s
umto
the
orig
inal
coun
t on
re-
aggr
egat
ion.
flo ws
37 7or
igin
alF
low
sCo
mpl
eted
The
cons
erva
tive
coun
t of O
rigin
alFl
ows
who
se la
stpa
cket
isre
pres
ente
d w
ithin
this
Agg
rega
ted
Flow
. Con
serv
ativ
eco
unts
mus
t sum
to th
e or
igin
alco
unt o
n re
-ag
greg
atio
n.
flo ws
Reference 269
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
37 8di
stin
ctC
ount
OfS
ourc
eIP
Addr
ess
The
coun
t of
dist
inct
sou
rce
IPad
dres
s va
lues
for
Orig
inal
Flo
ws
cont
ribut
ing
to th
isAg
greg
ated
Flo
w,
with
out r
egar
d to
IP v
ersi
on. T
his
Info
rmat
ion
Elem
ent i
spr
efer
red
to th
e IP
-ve
rsion-
spec
ific
coun
ters
, unl
ess
itis
impo
rtan
t to
sepa
rate
the
coun
ts b
y ve
rsio
n.
270 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
37 9di
stin
ctC
ount
OfD
estin
atio
nIP
Addr
ess
The
coun
t of
dist
inct
des
tinat
ion
IP a
ddre
ss v
alue
sfo
r Orig
inal
Flo
ws
cont
ribut
ing
to th
isAg
greg
ated
Flo
w,
with
out r
egar
d to
IP v
ersi
on. T
his
Info
rmat
ion
Elem
ent i
spr
efer
red
to th
eve
rsion-
spec
ific
coun
ters
bel
ow,
unle
ss it
isim
port
ant t
ose
para
te th
eco
unts
by
vers
ion.
38 0di
stin
ctC
ount
OfS
ourc
eIPv
4 Addr
ess
The
coun
t of
dist
inct
sou
rce
IPv4
add
ress
valu
es fo
r Orig
inal
Flow
s co
ntrib
utin
gto
this
Agg
rega
ted
Flow
.
Reference 271
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
38 1di
stin
ctC
ount
OfD
estin
atio
nIPv
4Ad
dres
s
The
coun
t of
dist
inct
des
tinat
ion
IPv4
add
ress
valu
es fo
r Orig
inal
Flow
s co
ntrib
utin
gto
this
Agg
rega
ted
Flow
.
38 2di
stin
ctC
ount
OfS
ourc
eIPv
6 Addr
ess
The
coun
t of
dist
inct
sou
rce
IPv6
add
ress
valu
es fo
r Orig
inal
Flow
s co
ntrib
utin
gto
this
Agg
rega
ted
Flow
.
38 3di
stin
ctC
ount
OfD
estin
atio
nIPv
6Ad
dres
s
The
coun
t of
dist
inct
des
tinat
ion
IPv6
add
ress
valu
es fo
r Orig
inal
Flow
s co
ntrib
utin
gto
this
Agg
rega
ted
Flow
.
272 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
38 4va
lueD
istr
ibut
ion
Met
hod
A de
scrip
tion
of th
em
etho
d us
ed to
dist
ribut
e th
eco
unte
rs fr
omCo
ntrib
utin
g Fl
ows
into
the
Aggr
egat
edFl
ow re
cord
sde
scrib
ed b
y an
asso
ciat
ed s
cope
,ge
nera
lly a
Tem
plat
e. T
hem
etho
d is
dee
med
to a
pply
to a
ll th
eno
n-ke
yIn
form
atio
nEl
emen
ts in
the
refe
renc
ed s
cope
for w
hich
val
uedi
strib
utio
n is
ava
lid o
pera
tion;
ifth
eor
igin
alFl
owsI
nitia
ted
and
/or
orig
inal
Flow
sCom
ple
ted
Info
rmat
ion
Elem
ents
app
ear i
nth
e Te
mpl
ate,
they
are
not s
ubje
ct to
this
dis
trib
utio
nm
etho
d, a
s th
eyea
ch in
fer t
heir
own
dist
ribut
ion
met
hod.
Thi
s is
inte
nded
to b
e a
com
plet
e se
t of
poss
ible
val
uedi
strib
utio
nm
etho
ds; i
t is
enco
ded
asfo
llow
s:
+-------
+----------------------------
-----------------------------
--+
| Value |
Description
| +-------
+----------------------------
-----------------------------
--+
| 0 | Unspecified: The
counters for an Original
Flow are |
| | explicitly not
distributed according to any
other method |
| | defined for this
Information Element; use for
arbitrary |
| | distribution, or
distribution algorithms not
described by |
| | any other
codepoint.
|
| |
-----------------------------
----------------------------
| |
|
|
| 1 | Start Interval:
The counters for an Original
Flow are |
| | added to the
counters of the appropriate
Aggregated Flow |
| | containing the
start time of the Original
Flow. This |
| | must be assumed
the default if value
distribution |
| | information is not
available at a Collecting
Process for |
| | an Aggregated
Flow.
|
| |
-----------------------------
----------------------------
| |
|
|
| 2 | End Interval: The
counters for an Original
Flow are added |
| | to the counters of
the appropriate Aggregated
Flow |
| | containing the end
time of the Original
Flow. |
| |
-----------------------------
----------------------------
| |
|
|
| 3 | Mid Interval: The
counters for an Original
Flow are added |
| | to the counters of
a single appropriate
Aggregated Flow |
| | containing some
timestamp between start and
end time of |
| | the Original
Flow.
|
| |
-----------------------------
----------------------------
| |
|
|
| 4 | Simple Uniform
Distribution: Each counter
for an Original |
| | Flow is divided by
the number of time intervals
the |
| | Original Flow
covers (that is, of
appropriate Aggregated |
| | Flows sharing the
same Flow Key), and this
number is |
| | added to each
corresponding counter in
each Aggregated |
| |
Flow.
| | |
-----------------------------
----------------------------
| |
|
|
| 5 | Proportional
Uniform Distribution: Each
counter for an |
| | Original Flow is
divided by the number of
time units the |
| | Original Flow
covers, to derive a mean
count rate. This |
| | mean count rate is
then multiplied by the
number of time |
| | units in the
intersection of the duration
of the Original |
| | Flow and the time
interval of each Aggregated
Flow. This |
| | is like simple
uniform distribution, but
accounts for the |
| | fractional
portions of a time interval
covered by an |
| | Original Flow in
the first and last time
interval. |
| |
-----------------------------
----------------------------
| |
|
|
| 6 | Simulated Process:
Each counter of the Original
Flow is |
| | distributed among
the intervals of the
Aggregated Flows |
| | according to some
function the Intermediate
Aggregation |
| | Process uses based
upon properties of Flows
presumed to |
| | be like the
Original Flow. This is
essentially an |
| | assertion that the
Intermediate Aggregation
Process has |
| | no direct packet
timing information but is
nevertheless |
| | not using one of
the other simpler
distribution methods. |
| | The Intermediate
Aggregation Process
specifically makes |
| | no assertion as to
the correctness of the
simulation. |
| |
-----------------------------
----------------------------
| |
|
|
| 7 | Direct: The
Intermediate Aggregation
Process has access |
| | to the original
packet timings from the
packets making up |
| | the Original Flow,
and uses these to distribute
or |
| | recalculate the
counters.
|
+-------
+----------------------------
-----------------------------
--+
Reference 273
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
38 5rf
c355
0Ji
tter
Mill
isec
onds
Inte
rarr
ival
jitt
er a
sde
fined
in s
ectio
n6.
4.1
of [R
FC35
50],
mea
sure
d in
mill
isec
onds
.
mill
ise
con
ds
38 6rf
c355
0Ji
tter
Mic
rose
con
ds
Inte
rarr
ival
jitt
er a
sde
fined
in s
ectio
n6.
4.1
of [R
FC35
50],
mea
sure
d in
mic
rose
cond
s.
mic
ros
eco
nds
38 7rf
c355
0Ji
tter
Na
nose
con
ds
Inte
rarr
ival
jitt
er a
sde
fined
in s
ectio
n6.
4.1
of [R
FC35
50],
mea
sure
d in
nano
seco
nds.
nan
ose
con
ds
274 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
38 8do
t1qD
EI
The
valu
e of
the
1-bi
t Dro
p El
igib
leIn
dica
tor (
DEI)
field
of t
he V
LAN
tag
as d
escr
ibed
in80
2.1Q
-201
1su
bcla
use
9.6.
Inca
se o
f a Q
inQ
fram
e, it
repr
esen
tsth
e ou
ter t
ag's
DEI
field
and
in c
ase
ofan
IEEE
802
.1ad
fram
e it
repr
esen
tsth
e DE
I field
of th
eS-
TAG
. Not
e: in
earli
er v
ersi
ons
of80
2.1Q
the
sam
ebi
t field
in th
ein
com
ing
pack
et is
occu
pied
by
the
Cano
nica
l For
mat
Indi
cato
r (CF
I)fie
ld, e
xcep
t for
S-
TAG
s.
Reference 275
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
38 9do
t1qC
ust
omer
DEI
In c
ase
of a
Qin
Qfr
ame,
it re
pres
ents
the
inne
r tag
's D
rop
Elig
ible
Indi
cato
r(D
EI) fi
eld
and
inca
se o
f an
IEEE
802.
1ad
fram
e it
repr
esen
ts th
e DE
Ifie
ld o
f the
C-T
AG.
276 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 0flo
wSe
lect
orAl
gorit
hm
This
Info
rmat
ion
Elem
ent ide
ntifies
the
Inte
rmed
iate
Flow
Sel
ectio
nPr
oces
s te
chni
que
(e.g
., Fi
lterin
g,Sa
mpl
ing)
that
isap
plie
d by
the
Inte
rmed
iate
Flo
wSe
lect
ion
Proc
ess.
Mos
t of t
hese
tech
niqu
es h
ave
para
met
ers.
Its
confi
guratio
npa
ram
eter
(s) m
ust
be c
lear
lysp
ecified
. Fur
ther
Info
rmat
ion
Elem
ents
are
need
ed to
fully
spec
ify p
acke
tse
lect
ion
with
thes
e m
etho
ds a
ndal
l the
irpa
ram
eter
s.Fu
rthe
r met
hod
iden
tifiers
may
be
adde
d to
the
flow
Sele
ctor
Algo
rithm
regi
stry
. It
mig
ht b
e ne
cess
ary
to defi
ne n
ewIn
form
atio
nEl
emen
ts to
spe
cify
thei
r par
amet
ers.
The
flow
Sele
ctor
Algo
rithm
regi
stry
ism
aint
aine
d by
IAN
A. N
ewas
sign
men
ts fo
rth
e re
gist
ry w
ill b
ead
min
iste
red
byIA
NA,
on
a Fi
rst
Com
e Fi
rst S
erve
dba
sis
[RFC
8126
],su
bjec
t to
Expe
rtRe
view
[RFC
8126
].Pl
ease
not
e th
atth
e pu
rpos
e of
the
flow
sel
ectio
nte
chni
ques
desc
ribed
in th
isdo
cum
ent i
s th
eim
prov
emen
t of
mea
sure
men
tfu
nctio
ns a
sde
fined
in th
eSc
ope
(Sec
tion
1).
Befo
re a
ddin
g ne
wflo
w s
elec
tor
algo
rithm
s it
mus
tbe
che
cked
wha
t is
thei
r int
ende
dpu
rpos
e an
des
peci
ally
if th
ose
cont
radi
ct w
ithpo
licie
s de
fined
in[R
FC28
04].
The
desi
gnat
edex
pert
(s) m
ust
cons
ult w
ith th
eco
mm
unity
if a
requ
est i
s re
ceiv
edth
at ru
ns c
ount
erto
[RFC
2804
]. Th
ere
gist
ry c
an b
eup
date
d w
hen
spec
ifica
tions
of
the
new
met
hod(
s)an
d an
y ne
wIn
form
atio
nEl
emen
ts a
repr
ovid
ed. T
hegr
oup
of e
xper
tsm
ust d
oubl
e ch
eck
the
flow
Sele
ctor
Algo
rithm
defi
nitio
ns a
ndIn
form
atio
nEl
emen
ts w
ithal
read
y de
fined
flow
Sele
ctor
Algo
rithm
and
Info
rmat
ion
Elem
ents
for
com
plet
enes
s,ac
cura
cy, a
ndre
dund
ancy
. Tho
seex
pert
s w
ill in
itial
lybe
dra
wn
from
the
Wor
king
Gro
upCh
airs
and
docu
men
t edi
tors
of th
e IP
FIX
and
PSAM
P W
orki
ngG
roup
s. T
heIn
term
edia
te F
low
Sele
ctio
n Pr
oces
sTe
chni
ques
iden
tifiers
are
defin
ed a
t [http
://www.ia
na.org/
assign
men
ts/ip
fix/
ipfix
.xml#
ipfix
-flo
wse
lectoralgo
rithm
].
Reference 277
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 1flo
wSe
lect
edO
ctet
Delta
Cou
nt
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e vo
lum
e in
octe
ts o
f all
Flow
sth
at a
re s
elec
ted
inth
e In
term
edia
teFl
ow S
elec
tion
Proc
ess
sinc
e th
epr
evio
us re
port
.
oct
ets
39 2flo
wSe
lect
edPa
cke
tDel
taCo
unt
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e vo
lum
e in
pack
ets
of a
ll Fl
ows
that
wer
e se
lect
edin
the
Inte
rmed
iate
Flow
Sel
ectio
nPr
oces
s si
nce
the
prev
ious
repo
rt.
pac
ket
s
39 3flo
wSe
lect
edFl
ow
Delta
Cou
nt
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
Flow
s th
at w
ere
sele
cted
in th
eIn
term
edia
te F
low
Sele
ctio
n Pr
oces
ssi
nce
the
last
repo
rt.
flo ws
278 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 4se
lect
orI
DTot
alFl
owsO
bser
ved
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e to
tal n
umbe
r of
Flow
s ob
serv
ed b
ya
Sele
ctor
, for
asp
ecific
valu
e of
Sele
ctor
Id. T
his
Info
rmat
ion
Elem
ent m
ust b
eus
ed in
an
Opt
ions
Tem
plat
e sc
oped
to th
e ob
serv
atio
nto
whi
ch it
refe
rs.
See
Sect
ion
3.4.
2.1
of th
e IP
FIX
prot
ocol
doc
umen
t[R
FC70
11].
flo ws
Reference 279
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 5se
lect
orI
DTot
alFl
owsS
ele
cted
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e to
tal n
umbe
r of
Flow
s se
lect
ed b
y a
Sele
ctor
, for
asp
ecific
valu
e of
Sele
ctor
Id. T
his
Info
rmat
ion
Elem
ent m
ust b
eus
ed in
an
Opt
ions
Tem
plat
e sc
oped
to th
e ob
serv
atio
nto
whi
ch it
refe
rs.
See
Sect
ion
3.4.
2.1
of th
e IP
FIX
prot
ocol
doc
umen
t[R
FC70
11].
flo ws
280 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 6sa
mpl
ingF
low
Int
erva
l
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
Flow
s th
at a
reco
nsec
utiv
ely
sam
pled
. A v
alue
of
100
mea
ns th
at10
0 co
nsec
utiv
eFl
ows
are
sam
pled
.Fo
r exa
mpl
e, th
isIn
form
atio
nEl
emen
t may
be
used
to d
escr
ibe
the co
nfigu
ratio
n of
a sy
stem
atic
cou
nt-
base
d Sa
mpl
ing
Sele
ctor
.
flo ws
Reference 281
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 7sa
mpl
ingF
low
Spac
ing
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e nu
mbe
r of
Flow
s be
twee
n tw
o"s
ampl
ingF
low
Inte
rval
"s. A
val
ue o
f10
0 m
eans
that
the
next
inte
rval
sta
rts
100
Flow
s (w
hich
are
not s
ampl
ed)
afte
r the
cur
rent
"sam
plin
gFlo
wIn
terv
al" i
s ov
er. F
orex
ampl
e, th
isIn
form
atio
nEl
emen
t may
be
used
to d
escr
ibe
the co
nfigu
ratio
n of
a sy
stem
atic
cou
nt-
base
d Sa
mpl
ing
Sele
ctor
.
flo ws
282 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 8flo
wSa
mpl
ingT
imeI
nter
val
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e tim
e in
terv
al in
mic
rose
cond
sdu
ring
whi
ch a
llar
rivin
g Fl
ows
are
sam
pled
. For
exam
ple,
this
Info
rmat
ion
Elem
ent m
ay b
eus
ed to
des
crib
eth
e co
nfigu
ratio
n of
a sy
stem
atic
tim
e-ba
sed
Sam
plin
gSe
lect
or.
mic
ros
eco
nds
Reference 283
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
39 9flo
wSa
mpl
ingT
imeS
paci
ng
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e tim
e in
terv
al in
mic
rose
cond
sbe
twee
n tw
o"f
low
Sam
plin
gTim
eIn
terv
al"s
. A v
alue
of 1
00 m
eans
that
the
next
inte
rval
star
ts 1
00m
icro
seco
nds
(dur
ing
whi
ch n
oFl
ows
are
sam
pled
)af
ter t
he c
urre
nt"f
low
sam
plin
gTim
eIn
terv
al" i
s ov
er.
For e
xam
ple,
this
Info
rmat
ion
Elem
ent m
ay u
sed
to d
escr
ibe
the
confi
guratio
n of
asy
stem
atic
tim
e-ba
sed
Sam
plin
gSe
lect
or.
mic
ros
eco
nds
284 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 0ha
shFl
ow
Dom
ain
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e In
form
atio
nEl
emen
ts th
at a
reus
ed b
y th
e H
ash-
base
d Fl
owSe
lect
or a
s th
eH
ash
Dom
ain.
40 1tr
ansp
ortO
ctet
Delta
Coun
t
The
num
ber o
foc
tets
, exc
ludi
ngIP
hea
der(
s) a
ndLa
yer 4
tran
spor
tpr
otoc
ol h
eade
r(s)
,ob
serv
ed fo
r thi
sFl
ow a
t the
Obs
erva
tion
Poin
tsi
nce
the
prev
ious
repo
rt (i
f any
).
oct
ets
40 2tr
ansp
ortP
acke
tDel
taCo
unt
The
num
ber o
fpa
cket
s co
ntai
ning
at le
ast o
ne o
ctet
beyo
nd th
e IP
head
er(s
) and
Laye
r 4 tr
ansp
ort
prot
ocol
hea
der(
s),
obse
rved
for t
his
Flow
at t
heO
bser
vatio
n Po
int
sinc
e th
e pr
evio
usre
port
(if a
ny).
pac
ket
s
Reference 285
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 3or
igin
alE
xpor
terI
Pv4A
ddr
ess
The
IPv4
add
ress
used
by
the
Expo
rtin
g Pr
oces
son
an
Orig
inal
Expo
rter
, as
seen
by th
e Co
llect
ing
Proc
ess
on a
nIP
FIX
Med
iato
r.Us
ed to
pro
vide
info
rmat
ion
abou
tth
e O
rigin
alO
bser
vatio
n Po
ints
to a
dow
nstr
eam
Colle
ctor
.
40 4or
igin
alE
xpor
terI
Pv6A
ddr
ess
The
IPv6
add
ress
used
by
the
Expo
rtin
g Pr
oces
son
an
Orig
inal
Expo
rter
, as
seen
by th
e Co
llect
ing
Proc
ess
on a
nIP
FIX
Med
iato
r.Us
ed to
pro
vide
info
rmat
ion
abou
tth
e O
rigin
alO
bser
vatio
n Po
ints
to a
dow
nstr
eam
Colle
ctor
.
286 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 5or
igin
alO
bser
vati
onDo
mai
nId
The
Obs
erva
tion
Dom
ain
IDre
port
ed b
y th
eEx
port
ing
Proc
ess
on a
n O
rigin
alEx
port
er, a
s se
enby
the
Colle
ctin
gPr
oces
s on
an
IPFI
X M
edia
tor.
Used
to p
rovi
dein
form
atio
n ab
out
the
Orig
inal
Obs
erva
tion
Dom
ain
to a
dow
nstr
eam
Colle
ctor
. Whe
nca
scad
ing
thro
ugh
mul
tiple
Med
iato
rs,
this
iden
tifies
the
initi
al O
bser
vatio
nDo
mai
n in
the
casc
ade.
Reference 287
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 6in
term
edi
ateP
roce
ssId
Desc
riptio
n: A
niden
tifier
of a
nIn
term
edia
tePr
oces
s th
at is
uniq
ue p
er IP
FIX
Devi
ce. T
ypic
ally
,th
is In
form
atio
nEl
emen
t is
used
for
limiti
ng th
e sc
ope
of o
ther
Info
rmat
ion
Elem
ents
. Not
eth
at p
roce
ssiden
tifiers
may
be
assi
gned
dyna
mic
ally
; tha
tis
, an
Inte
rmed
iate
Proc
ess
may
be
rest
arte
d w
ith a
diffe
rent
ID.
288 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 7ig
nore
dDa
taRe
cor
dTot
alCo
unt
Desc
riptio
n: T
heto
tal n
umbe
r of
rece
ived
Dat
aRe
cord
s th
at th
eIn
term
edia
tePr
oces
s di
d no
tpr
oces
s si
nce
the
(re-
)initi
aliz
atio
n of
the
Inte
rmed
iate
Proc
ess;
incl
udes
only
Dat
a Re
cord
sno
t exa
min
ed o
rot
herw
ise
hand
led
by th
eIn
term
edia
tePr
oces
s du
e to
reso
urce
cons
trai
nts,
not
Data
Rec
ords
that
wer
e ex
amin
ed o
rot
herw
ise
hand
led
by th
eIn
term
edia
tePr
oces
s bu
t tho
seth
at m
erel
y do
not
cont
ribut
e to
any
expo
rted
Dat
aRe
cord
due
to th
eop
erat
ions
perf
orm
ed b
y th
eIn
term
edia
tePr
oces
s.
Reference 289
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 8da
taLi
nkFr
ameT
ype
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e ty
pe o
f the
sele
cted
dat
a lin
kfr
ame.
The
follo
win
g da
talin
k ty
pes
are
defin
ed h
ere:
•0x
01 IE
EE80
2.3
ETH
ERN
ET[I
EEE8
02.3
]•
0x02
IEEE
802.
11M
AC F
ram
efo
rmat
[IEE
E802
.11]
Furt
her v
alue
s m
aybe
ass
igne
d by
IAN
A. N
ote
that
the
assi
gned
val
ues
are
bits
so
that
mul
tiple
obse
rvat
ions
can
be O
R'd
toge
ther
.
The
data
link
laye
ris
defi
ned
in [I
SO/
IEC.
7498
-1:1
994]
.
290 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
40 9se
ctio
nOffs
etTh
is In
form
atio
nEl
emen
t spe
cifie
sth
e of
fset
of t
hepa
cket
sec
tion
(e.g
.,da
taLi
nkFr
ameS
ect
ion,
ipH
eade
rPac
ketS
ectio
n,ip
Payl
oadP
acke
tSe
ctio
n,m
plsL
abel
Stac
kSec
tion,
and
mpl
sPay
load
Pack
etSe
ctio
n). I
f thi
sIn
form
atio
nEl
emen
t is
omitt
ed,
it de
faul
ts to
zer
o(t
hat i
s, n
o of
fset
).
If m
ultip
lese
ctio
nOffs
etIn
form
atio
nEl
emen
ts a
resp
ecified
with
in a
sing
le T
empl
ate,
then
they
app
ly to
the
pack
et s
ectio
nIn
form
atio
nEl
emen
ts in
ord
er:
the fir
stse
ctio
nOffs
etap
plie
s to
the fir
stpa
cket
sec
tion,
the
seco
nd to
the
seco
nd, a
nd s
o on
.N
ote
that
the
"clo
sest
"se
ctio
nOffs
et a
ndpa
cket
sec
tion
Info
rmat
ion
Elem
ents
with
in a
give
n Te
mpl
ate
are
not n
eces
saril
yre
late
d. If
ther
e ar
efe
wer
sec
tionO
ffset
Info
rmat
ion
Elem
ents
than
pack
et s
ectio
nIn
form
atio
nEl
emen
ts, t
hen
subs
eque
nt p
acke
tse
ctio
nIn
form
atio
nEl
emen
ts h
ave
noof
fset
, tha
t is,
ase
ctio
nOffs
et o
fze
ro a
pplie
s to
thos
e pa
cket
sect
ion
Info
rmat
ion
Elem
ents
. If t
here
are
mor
ese
ctio
nOffs
etIn
form
atio
nEl
emen
ts th
an th
enu
mbe
r of p
acke
tse
ctio
nIn
form
atio
nEl
emen
ts, t
hen
the
addi
tiona
lse
ctio
nOffs
etIn
form
atio
nEl
emen
ts a
rem
eani
ngle
ss.
Reference 291
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 0se
ctio
nExp
orte
dO
ctet
s
This
Info
rmat
ion
Elem
ent s
pecifie
sth
e ob
serv
edle
ngth
of t
hepa
cket
sec
tion
(e.g
.,da
taLi
nkFr
ameS
ect
ion,
ipH
eade
rPac
ketS
ectio
n,ip
Payl
oadP
acke
tSe
ctio
n,m
plsL
abel
Stac
kSec
tion,
and
mpl
sPay
load
Pack
etSe
ctio
n) w
hen
padd
ing
is u
sed.
The
pack
et s
ectio
nm
ay b
e of
a fixe
dsi
ze la
rger
than
the
sect
ionE
xpor
tedO
cte
ts. I
n th
is c
ase,
octe
ts in
the
pack
etse
ctio
n be
yond
the
sect
ionE
xpor
tedO
cte
ts m
ust f
ollo
wth
e [R
FC70
11]
rule
s fo
r pad
ding
(tha
t is,
be
com
pose
d of
zer
o(0
) val
ued
octe
ts).
292 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 1do
t1qS
erv
iceI
nst
ance
Tag
This
Info
rmat
ion
Elem
ent,
whi
ch is
16 o
ctet
s lo
ng,
repr
esen
ts th
eBa
ckbo
ne S
ervi
ceIn
stan
ce T
ag (I
-TA
G) T
ag C
ontr
olIn
form
atio
n (T
CI)
field
of a
n Et
hern
etfr
ame
as d
escr
ibed
in [I
EEE8
02.1
Q].
Iten
code
s th
eBa
ckbo
ne S
ervi
ceIn
stan
ce P
riorit
yCo
de P
oint
(I-P
CP),
Back
bone
Ser
vice
Inst
ance
Dro
pEl
igib
le In
dica
tor
(I-D
EI),
Use
Cust
omer
Addr
esse
s (U
CAs)
,Ba
ckbo
ne S
ervi
ceIn
stan
ce Id
entifi
er(I
-SID
),En
caps
ulat
edCu
stom
erDe
stin
atio
nAd
dres
s (C
-DA)
,En
caps
ulat
edCu
stom
er S
ourc
eAd
dres
s (C
-SA)
,an
d re
serv
ed fields
.Th
e st
ruct
ure
and
sem
antic
s w
ithin
the
Tag
Cont
rol
Info
rmat
ion fie
ldar
e de
fined
in[I
EEE8
02.1
Q].
Reference 293
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 2do
t1qS
erv
iceI
nst
ance
Id
The
valu
e of
the
24-b
it Ba
ckbo
neSe
rvic
e In
stan
ceId
entifi
er (I
-SID
)po
rtio
n of
the
Back
bone
Ser
vice
Inst
ance
Tag
(I-
TAG
) Tag
Con
trol
Info
rmat
ion
(TCI
)fie
ld o
f an
Ethe
rnet
fram
e as
des
crib
edin
[IEE
E802
.1Q
].
41 3do
t1qS
erv
iceI
nst
ance
Prio
rity
The
valu
e of
the
3-bi
t Bac
kbon
eSe
rvic
e In
stan
cePr
iorit
y Co
de P
oint
(I-P
CP) p
ortio
n of
the
Back
bone
Serv
ice
Inst
ance
Tag
(I-T
AG) T
agCo
ntro
lIn
form
atio
n (T
CI)
field
of a
n Et
hern
etfr
ame
as d
escr
ibed
in [I
EEE8
02.1
Q].
294 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 4do
t1qC
ust
omer
Sou
rceM
acA
ddre
ss
The
valu
e of
the
Enca
psul
ated
Cust
omer
Sou
rce
Addr
ess
(C-S
A)po
rtio
n of
the
Back
bone
Ser
vice
Inst
ance
Tag
(I-
TAG
) Tag
Con
trol
Info
rmat
ion
(TCI
)fie
ld o
f an
Ethe
rnet
fram
e as
des
crib
edin
[IEE
E802
.1Q
].
41 5do
t1qC
ust
omer
Des
tinat
ionM
acAd
dres
s
The
valu
e of
the
Enca
psul
ated
Cust
omer
Dest
inat
ion
Addr
ess
(C-D
A)po
rtio
n of
the
Back
bone
Ser
vice
Inst
ance
Tag
(I-
TAG
) Tag
Con
trol
Info
rmat
ion
(TCI
)fie
ld o
f an
Ethe
rnet
fram
e as
des
crib
edin
[IEE
E802
.1Q
].
41 6Du
plic
ate
ofIn
form
atio
nEl
emen
t ID
352,
laye
r2O
ctet
Delta
Coun
t.
Reference 295
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 7po
stLa
yer2
Oct
etDe
ltaCo
unt
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
the
laye
r2O
ctet
Delta
Coun
t Inf
orm
atio
nEl
emen
t, ex
cept
that
it re
port
s a
pote
ntia
llymod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
post
Oct
etDe
ltaCo
unt
(Ele
men
tId
#23
).
oct
ets
296 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 8po
stM
Cast
Laye
r2O
ctet
Del
taCo
unt
The
num
ber o
fla
yer 2
oct
ets
sinc
eth
e pr
evio
us re
port
(if a
ny) i
n ou
tgoi
ngm
ultic
ast p
acke
tsse
nt fo
r pac
kets
of
this
Flo
w b
y a
mul
ticas
t dae
mon
with
in th
eO
bser
vatio
nDo
mai
n. T
his
prop
erty
can
not
nece
ssar
ily b
eob
serv
ed a
t the
Obs
erva
tion
Poin
tbu
t may
be
retr
ieve
d by
oth
erm
eans
. The
num
ber o
f oct
ets
incl
udes
laye
r 2he
ader
(s) a
nd la
yer
2 pa
yloa
d.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
post
MCa
stO
ctet
Del
taCo
unt
(Ele
men
tId
#20
).
oct
ets
Reference 297
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
41 9Du
plic
ate
ofIn
form
atio
nEl
emen
t ID
353,
laye
r2O
ctet
Tota
lCo
unt.
42 0po
stLa
yer2
Oct
etT
otal
Coun
t
The de
finition
of
this
Info
rmat
ion
Elem
ent i
s id
entic
alto
the de
finition
of
the
laye
r2O
ctet
Tota
lCo
unt I
nfor
mat
ion
Elem
ent,
exce
ptth
at it
repo
rts
apo
tent
ially
mod
ified
val
ueca
used
by
am
iddl
ebox
func
tion
afte
r the
pac
ket
pass
ed th
eO
bser
vatio
n Po
int.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
post
Oct
etTo
talC
ount
(Ele
men
tId
#17
1).
oct
ets
298 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 1po
stM
Cast
Laye
r2O
ctet
Tot
alCo
unt
The
tota
l num
ber
of la
yer 2
oct
ets
inou
tgoi
ng m
ultic
ast
pack
ets
sent
for
pack
ets
of th
isFl
ow b
y a
mul
ticas
tda
emon
in th
eO
bser
vatio
nDo
mai
n si
nce
the
Met
erin
g Pr
oces
s(r
e-)in
itial
izat
ion.
This
pro
pert
yca
nnot
nec
essa
rily
be o
bser
ved
at th
eO
bser
vatio
n Po
int
but m
ay b
ere
trie
ved
by o
ther
mea
ns. T
henu
mbe
r of o
ctet
sin
clud
es la
yer 2
head
er(s
) and
laye
r2
payl
oad.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
post
MCa
stO
ctet
Tot
alCo
unt (
Elem
entI
d#
175)
.
oct
ets
Reference 299
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 2m
inim
um
Laye
r2To
talL
engt
h
Laye
r 2 le
ngth
of
the
smal
lest
pac
ket
obse
rved
for t
his
Flow
. The
pac
ket
leng
th in
clud
es th
ele
ngth
of t
he la
yer
2 he
ader
(s) a
nd th
ele
ngth
of t
he la
yer
2 pa
yloa
d.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
min
imum
IpTo
talL
eng
th (E
lem
entI
d#
25).
oct
ets
300 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 3m
axim
um
Laye
r2To
talL
engt
h
Laye
r 2 le
ngth
of
the
larg
est p
acke
tob
serv
ed fo
r thi
sFl
ow. T
he p
acke
tle
ngth
incl
udes
the
leng
th o
f the
laye
r2
head
er(s
) and
the
leng
th o
f the
laye
r2
payl
oad.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
max
imum
IpTo
talL
eng
th (E
lem
entI
d#
26).
oct
ets
Reference 301
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 4dr
oppe
dLa
yer2
Oct
etDe
ltaC
ount
The
num
ber o
fla
yer 2
oct
ets
sinc
eth
e pr
evio
us re
port
(if a
ny) i
n pa
cket
sof
this
Flo
wdr
oppe
d by
pac
ket
trea
tmen
t. Th
enu
mbe
r of o
ctet
sin
clud
es la
yer 2
head
er(s
) and
laye
r2
payl
oad.
oct
ets
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
drop
pedO
ctet
Delta
Coun
t (El
emen
tId
#13
2).
302 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 5dr
oppe
dLa
yer2
Oct
etTo
tal
Coun
t
The
tota
l num
ber
of o
ctet
s in
obse
rved
laye
r 2pa
cket
s (in
clud
ing
the
laye
r 2 h
eade
r)th
at w
ere
drop
ped
by p
acke
ttr
eatm
ent s
ince
the
(re-
)initi
aliz
atio
n of
the
Met
erin
gPr
oces
s.
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
drop
pedO
ctet
Tota
lCo
unt (
Elem
entI
d#
134)
.
oct
ets
Reference 303
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 6ig
nore
dLay
er2O
cte
tTot
alCo
unt
The
tota
l num
ber
of o
ctet
s in
obse
rved
laye
r 2pa
cket
s (in
clud
ing
the
laye
r 2 h
eade
r)th
at th
e M
eter
ing
Proc
ess
did
not
proc
ess
sinc
e th
e(r
e-)in
itial
izat
ion
ofth
e M
eter
ing
Proc
ess.
oct
ets
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
igno
redO
ctet
Tota
lCou
nt (E
lem
entI
d#
165)
.
304 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 7no
tSen
tLay
er2O
cte
tTot
alCo
unt
The
tota
l num
ber
of o
ctet
s in
obse
rved
laye
r 2pa
cket
s (in
clud
ing
the
laye
r 2 h
eade
r)th
at th
e M
eter
ing
Proc
ess
did
not
proc
ess
sinc
e th
e(r
e-)in
itial
izat
ion
ofth
e M
eter
ing
Proc
ess.
oct
ets
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
notS
entO
ctet
Tota
lCou
nt (E
lem
entI
d#
168)
.
Reference 305
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 8la
yer2
Oc
tetD
elta
Sum
OfS
quar
es
The
sum
of t
hesq
uare
d nu
mbe
rsof
laye
r 2 o
ctet
spe
r inc
omin
gpa
cket
sin
ce th
epr
evio
us re
port
(if
any)
for t
his
Flow
at
the
Obs
erva
tion
Poin
t. Th
e nu
mbe
rof
oct
ets
incl
udes
laye
r 2 h
eade
r(s)
and
laye
r 2pa
yloa
d.
oct
ets
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
octe
tDel
taSu
mO
fSqu
ares
(Ele
men
tId
#19
8).
306 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
42 9la
yer2
Oc
tetT
otal
Sum
OfS
qua
res
The
tota
l sum
of
the
squa
red
num
bers
of l
ayer
2oc
tets
in in
com
ing
pack
ets
for t
his
Flow
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
The
num
ber
of o
ctet
s in
clud
esla
yer 2
hea
der(
s)an
d la
yer 2
payl
oad.
oct
ets
This
Info
rmat
ion
Elem
ent i
s th
ela
yer 2
ver
sion
of
octe
tTot
alSu
mO
fSq
uare
s (E
lem
entI
d#
199)
.
43 0la
yer2
Fram
eDel
taC
ount
The
num
ber o
fin
com
ing
laye
r 2fr
ames
sin
ce th
epr
evio
us re
port
(if
any)
for t
his
Flow
at
the
Obs
erva
tion
Poin
t.
fra
me
s
Reference 307
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 1la
yer2
Fram
eTot
alC
ount
The
tota
l num
ber
of in
com
ing
laye
r 2fr
ames
for t
his
Flow
at t
heO
bser
vatio
n Po
int
sinc
e th
e M
eter
ing
Proc
ess
(re-
)initi
aliz
atio
nfo
r thi
s O
bser
vatio
nPo
int.
fra
me
s
43 2ps
eudo
Wire
Des
tinat
ionI
Pv4A
ddr
ess
The
dest
inat
ion
IPv4
add
ress
of t
hePS
N tu
nnel
carr
ying
the
pseu
dow
ire.
43 3ig
nore
dLay
er2F
ram
eTot
alCo
unt
The
tota
l num
ber
of o
bser
ved
laye
r 2fr
ames
that
the
Met
erin
g Pr
oces
sdi
d no
t pro
cess
sinc
e th
e(r
e-)in
itial
izat
ion
ofth
e M
eter
ing
Proc
ess.
Thi
sIn
form
atio
nEl
emen
t is
the
laye
r 2 v
ersi
on o
fig
nore
dPac
ketT
otal
Coun
t (El
emen
tId
#16
4).
fra
me
s
308 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 4m
ibO
bje
ctVa
lueI
nteg
er
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
the
inte
ger v
alue
of a
MIB
obj
ect w
ill b
eex
port
ed. T
he M
IBO
bjec
t Ide
ntifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
Inte
ger3
2 an
dIN
TEG
ER w
ithIP
FIX
redu
ced-
size
enco
ding
use
d as
requ
ired.
The
val
ueis
enc
oded
as
per
the
stan
dard
IPFI
XAb
stra
ct D
ata
Type
of s
igne
d32.
Reference 309
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 5m
ibO
bje
ctVa
lueO
ctet
Strin
g
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
an
Oct
et S
trin
g or
Opa
que
valu
e of
aM
IB o
bjec
t will
be
expo
rted
. The
MIB
Obj
ect I
dentifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
OCT
ET S
TRIN
G a
ndO
paqu
e. T
he v
alue
is e
ncod
ed a
s pe
rth
e st
anda
rd IP
FIX
Abst
ract
Dat
a Ty
peof
oct
etAr
ray.
310 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 6m
ibO
bje
ctVa
lueO
ID
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
an
Obj
ect I
dentifier
or
OID
val
ue o
f a M
IBob
ject
will
be
expo
rted
. The
MIB
Obj
ect I
dentifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
OBJ
ECT
IDEN
TIFI
ER. N
ote:
In th
is c
ase,
the
"mibObjec
tIde
ntifi
er" d
efine
s w
hich
MIB
obj
ect i
s be
ing
expo
rted
, and
the
"mib
Obj
ectV
alue
OI
D" field
will
con
tain
the
OID
val
ue o
fth
at M
IB o
bjec
t.Th
em
ibO
bjec
tVal
ueO
ID
Info
rmat
ion
Elem
ent i
sen
code
d as
ASN
.1/B
ER [X
.690
]in
an
octe
tArr
ay.
Reference 311
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 7m
ibO
bje
ctVa
lueB
its
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
a s
etof
Enu
mer
ated
flags
or b
its fr
om a
MIB
obj
ect w
ill b
eex
port
ed. T
he M
IBO
bjec
t Ide
ntifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
BITS
. The
flag
s or
bits
are
enc
oded
as
per t
he s
tand
ard
IPFI
X Ab
stra
ctDa
ta T
ype
ofoc
tetA
rray
, with
sufficien
t len
gth
toac
com
mod
ate
the
requ
ired
num
ber o
fbi
ts. I
f the
num
ber
of b
its is
not
an
inte
ger m
ultip
le o
foc
tets
, the
n th
em
ost s
ignific
ant
bits
at t
he e
nd o
fth
e oc
tetA
rray
mus
t be
set t
o 0.
312 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 8m
ibO
bje
ctVa
lueI
PAdd
res
s
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
the
IPv4
add
ress
val
ueof
a M
IB o
bjec
t will
be e
xpor
ted.
The
MIB
Obj
ect
Iden
tifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
IpAd
dres
s. T
heva
lue
is e
ncod
ed a
spe
r the
sta
ndar
dIP
FIX
Abst
ract
Data
Typ
e of
ipv4
Addr
ess.
Reference 313
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
43 9m
ibO
bje
ctVa
lueC
ount
er
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
the
coun
ter v
alue
of a
MIB
obj
ect w
ill b
eex
port
ed. T
he M
IBO
bjec
t Ide
ntifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
Coun
ter3
2 or
Coun
ter6
4 w
ithIP
FIX
redu
ced-
size
enco
ding
use
d as
requ
ired.
The
val
ueis
enc
oded
as
per
the
stan
dard
IPFI
XAb
stra
ct D
ata
Type
of u
nsig
ned6
4.
314 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 0m
ibO
bje
ctVa
lueG
auge
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
the
Gau
ge v
alue
of a
MIB
obj
ect w
ill b
eex
port
ed. T
he M
IBO
bjec
t Ide
ntifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
Gau
ge32
. The
valu
e is
enc
oded
as
per t
he s
tand
ard
IPFI
X Ab
stra
ctDa
ta T
ype
ofun
sign
ed32
. Thi
sva
lue
repr
esen
ts a
non-
nega
tive
inte
ger t
hat m
ayin
crea
se o
rde
crea
se b
ut th
atsh
all n
ever
exc
eed
a m
axim
um v
alue
or fa
ll be
low
am
inim
um v
alue
.
Reference 315
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 1m
ibO
bje
ctVa
lueT
imeT
icks
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
the
Tim
eTic
ks v
alue
of
a M
IB o
bjec
t will
be
expo
rted
. The
MIB
Obj
ect I
dentifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
Tim
eTic
ks. T
heva
lue
is e
ncod
ed a
spe
r the
sta
ndar
dIP
FIX
Abst
ract
Data
Typ
e of
unsi
gned
32.
316 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 2m
ibO
bje
ctVa
lueU
nsig
ned
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
an
unsi
gned
inte
ger
valu
e of
a M
IBob
ject
will
be
expo
rted
. The
MIB
Obj
ect I
dentifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ithth
e Ba
se s
ynta
x of
unsi
gned
32 w
ithIP
FIX
redu
ced-
size
enco
ding
use
d as
requ
ired.
The
val
ueis
enc
oded
as
per
the
stan
dard
IPFI
XAb
stra
ct D
ata
Type
of u
nsig
ned3
2.
Reference 317
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 3m
ibO
bje
ctVa
lueT
able
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
aco
mpl
ete
or p
artia
lco
ncep
tual
tabl
ew
ill b
e ex
port
ed.
The
MIB
Obj
ect
Iden
tifier
("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ith a
synt
ax o
fSE
QUE
NCE
OF.
This
is e
ncod
ed a
sa
subT
empl
ateL
ist
of m
ibO
bjec
tVal
ueIn
form
atio
nEl
emen
ts. T
heTe
mpl
ate sp
ecified
in th
esu
bTem
plat
eLis
tm
ust b
e an
Opt
ions
Tem
plat
e an
d m
ust
incl
ude
all t
heob
ject
s lis
ted
in th
eIN
DEX
clau
se a
sSc
ope
Fiel
ds.
318 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 4m
ibO
bje
ctVa
lueR
ow
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
asi
ngle
row
of a
conc
eptu
al ta
ble
will
be
expo
rted
.Th
e M
IB O
bjec
tId
entifi
er("mibObjec
tIde
ntifi
er")
for t
his fie
ldm
ust b
e ex
port
edin
a M
IB F
ield
Opt
ion
or v
iaan
othe
r mea
ns.
This
Info
rmat
ion
Elem
ent i
s us
ed fo
rM
IB o
bjec
ts w
ith a
synt
ax o
fSE
QUE
NCE
. Thi
s is
enco
ded
as a
subT
empl
ateL
ist o
fm
ibO
bjec
tVal
ueIn
form
atio
nEl
emen
ts. T
hesu
bTem
plat
eLis
tex
port
ed m
ust
cont
ain
exac
tly o
nero
w (t
hat i
s, o
nein
stan
ce o
f the
subT
empl
ate)
. The
Tem
plat
e sp
ecified
in th
esu
bTem
plat
eLis
tm
ust b
e an
Opt
ions
Tem
plat
e an
d m
ust
incl
ude
all t
heob
ject
s lis
ted
in th
eIN
DEX
clau
se a
sSc
ope
Fiel
ds.
Reference 319
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 5mibObje
ctId
entif
ier
An IP
FIX
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
a M
IBO
bjec
t Ide
ntifier
(MIB
OID
) is
expo
rted
in th
e(O
ptio
ns) T
empl
ate
Reco
rd. T
hemibObjec
tIde
ntifier
Info
rmat
ion
Elem
ent c
onta
ins
the
OID
ass
igne
dto
the
MIB
obj
ect
type
defi
nitio
nen
code
d as
ASN
.1/B
ER[X
.690
].
44 6mibSu
bIde
ntifier
A no
n-ne
gativ
esu
b-iden
tifier
of a
nO
bjec
t Ide
ntifier
(OID
).
320 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 7m
ibIn
dexI
ndic
ator
A se
t of b
it fie
lds
that
is u
sed
for
mar
king
the
Info
rmat
ion
Elem
ents
of a
Dat
aRe
cord
that
ser
veas
INDE
X M
IBob
ject
s fo
r an
inde
xed
colu
mna
rM
IB o
bjec
t. Ea
chbi
t rep
rese
nts
anIn
form
atio
nEl
emen
t in
the
Data
Reco
rd, w
ith th
e n-
th le
ast s
ignific
ant
bit r
epre
sent
ing
the
n-th
Info
rmat
ion
Elem
ent.
A bi
t set
to 1
indi
cate
s th
atth
e co
rres
pond
ing
Info
rmat
ion
Elem
ent i
s an
inde
xof
the
colu
mna
rob
ject
repr
esen
ted
by th
em
ibO
bjec
tVal
ue. A
bit s
et to
0in
dica
tes
that
this
is n
ot th
e ca
se.
If th
e Da
ta R
ecor
dco
ntai
ns m
ore
than
64 In
form
atio
nEl
emen
ts, t
heco
rres
pond
ing
Tem
plat
e m
ust b
ede
sign
ed s
uch
that
all i
ndex
fields
are
amon
g th
e fir
st 6
4In
form
atio
nEl
emen
ts, b
ecau
seth
em
ibIn
dexI
ndic
ator
only
con
tain
s 64
bits
. If t
he D
ata
Reco
rd c
onta
ins
less
than
64
Info
rmat
ion
Elem
ents
, the
n th
eex
tra
bits
in th
em
ibIn
dexI
ndic
ator
for w
hich
no
corr
espo
ndin
gIn
form
atio
nEl
emen
t exi
sts
mus
t hav
e th
eva
lue
0 an
d m
ust
be d
isre
gard
ed b
yth
e Co
llect
or. T
his
Info
rmat
ion
Elem
ent m
ay b
eex
port
ed w
ithIP
FIX
redu
ced-
size
enco
ding
.
Reference 321
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 8m
ibCa
ptur
eTim
eSe
man
tics
Indi
cate
s w
hen
inth
e lif
etim
e of
the
Flow
the
MIB
val
ueis
retr
ieve
d fr
omth
e M
IB fo
r amibObjec
tIde
ntifier
. Thi
s is
use
d to
indi
cate
if th
e va
lue
expo
rted
isco
llect
ed fr
om th
eM
IB c
lose
r to
Flow
crea
tion
or F
low
expo
rt ti
me
and
refe
rs to
the
Tim
esta
mp fie
lds
incl
uded
in th
esa
me
Data
Rec
ord.
This
field
mus
t be
used
whe
nex
port
ing
am
ibO
bjec
tVal
ueth
at spe
cifie
sco
unte
rs o
rst
atis
tics.
If th
e M
IB v
alue
issa
mpl
ed b
y SN
MP
prio
r to
the
IPFI
XM
eter
ing
Proc
ess
or E
xpor
ting
Proc
ess
retr
ievi
ngth
e va
lue
(tha
t is,
the
data
is a
lread
yst
ale)
and
it is
impo
rtan
t to
know
the
exac
t sam
plin
gtim
e, th
en a
nad
ditio
nal
obse
rvat
ionT
ime*
elem
ent m
ust b
epa
ired
with
the
OID
usin
g IP
FIX
Stru
ctur
ed D
ata
[RFC
6313
].Si
mila
rly, i
fdi
ffere
nt M
IBca
ptur
e tim
esap
ply
to d
iffer
ent
mib
Obj
ectV
alue
elem
ents
with
inth
e Da
ta R
ecor
d,th
en in
divi
dual
mib
Capt
ureT
imeS
em
antic
sIn
form
atio
nEl
emen
ts m
ust b
epa
ired
with
eac
hO
ID u
sing
IPFI
XSt
ruct
ured
Dat
a.
Valu
es:
•0 un
defin
ed•
1 be
gin
- The
valu
e fo
r the
MIB
obje
ct is
capt
ured
from
the
MIB
whe
n th
eFl
ow is
first
obse
rved
•2
end
- The
val
uefo
r the
MIB
obje
ct is
capt
ured
from
the
MIB
whe
n th
eFl
ow e
nds
•3
expo
rt -
The
valu
e fo
r the
MIB
obje
ct is
capt
ured
from
the
MIB
at e
xpor
ttim
e•
4 av
erag
e - T
heva
lue
for t
he M
IBob
ject
is a
nav
erag
e of
mul
tiple
cap
ture
sfr
om th
e M
IBov
er th
eob
serv
ed li
fe o
fth
e Fl
ow
322 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
44 9m
ibCo
ntex
tEng
ineI
D
A mib
Cont
extE
ngin
eID
that
spe
cifie
s th
eSN
MP
engi
ne ID
for
a M
IB field
bein
gex
port
ed o
ver
IPFI
X. Defi
nitio
n.
45 0m
ibCo
ntex
tNam
eAn
Info
rmat
ion
Elem
ent t
hat
deno
tes
that
a M
IBco
ntex
t nam
e is
spec
ified
for a
MIB
field
bei
ngex
port
ed o
ver
IPFI
X.
45 1m
ibO
bje
ctN
ame
The
nam
e (c
alle
d a
desc
ripto
r in
[RFC
2578
] of a
nob
ject
type
defin
ition
.
45 2m
ibO
bje
ctDe
scri
ptio
n
The
valu
e of
the
DESC
RIPT
ION
clau
se o
f a M
IBob
ject
type
defin
ition
.
Reference 323
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
45 3m
ibO
bje
ctSy
ntax
The
valu
e of
the
SYN
TAX
clau
se o
f aM
IB o
bjec
t typ
ede
finition
, whi
chm
ay in
clud
e a
text
ual c
onve
ntio
nor
sub
-typ
ing.
45 4m
ibM
odul
eNam
eTh
e te
xtua
l nam
eof
the
MIB
mod
ule
that
defi
nes
a M
IBob
ject
.
45 5m
obile
IM
SITh
e In
tern
atio
nal
Mob
ileSu
bscr
iptio
nId
entit
y (I
MSI
).Th
e IM
SI is
ade
cim
al d
igit
strin
gw
ith u
p to
am
axim
um o
f 15
ASCI
I/UT
F-8
enco
ded
digi
ts(0
x30
- 0x3
9).
324 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
45 6m
obile
MSI
SDN
The
Mob
ile S
tatio
nIn
tern
atio
nal
Subs
crib
erDi
rect
ory
Num
ber
(MSI
SDN
). Th
eM
SISD
N is
ade
cim
al d
igit
strin
gw
ith u
p to
am
axim
um o
f 15
ASCI
I/UT
F-8
enco
ded
digi
ts(0
x30
- 0x3
9).
45 7ht
tpSt
atus
Code
The
HTT
PRe
spon
se S
tatu
sCo
de, a
s de
fined
inse
ctio
n 6
of[R
FC72
31],
asso
ciat
ed w
ith a
flow
. Im
plie
s th
atth
e flo
w re
cord
repr
esen
ts a
flow
cont
aini
ng a
n H
TTP
Resp
onse
.
Reference 325
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
45 8so
urce
Tran
spor
tPor
tsLi
mit
This
Info
rmat
ion
Elem
ent c
onta
ins
the
max
imum
num
ber o
f IP
sour
ce tr
ansp
ort
port
s th
at c
an b
eus
ed b
y an
end
user
whe
n se
ndin
gIP
pac
kets
; eac
hus
er is
ass
ocia
ted
with
one
or m
ore
(sou
rce)
IPv4
or
IPv6
add
ress
es.
This
Info
rmat
ion
Elem
ent i
spa
rtic
ular
ly u
sefu
lin
add
ress
-sha
ring
depl
oym
ents
that
adhe
re to
REQ
-4 o
f[R
FC68
88].
Lim
iting
the
num
ber o
f por
tsas
sign
ed to
eac
hus
er e
nsur
esfa
irnes
s am
ong
user
s an
d m
itiga
tes
the
deni
al-o
f-se
rvic
e at
tack
that
a us
er c
ould
laun
chag
ains
t oth
er u
sers
thro
ugh
the
addr
ess-
shar
ing
devi
ce in
ord
er to
grab
mor
e po
rts.
por
ts
326 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
45 9ht
tpRe
que
stM
etho
d
The
HTT
P re
ques
tm
etho
d, a
s de
fined
in s
ectio
n 4
of[R
FC72
31],
asso
ciat
ed w
ith a
flow
. Str
ing
with
up
to 8
UTF
-8ch
arac
ters
.
46 0ht
tpRe
que
stH
ost
The
HTT
P re
ques
tho
st, a
s de
fined
inse
ctio
n 5.
4 of
[RFC
7230
] or,
inth
e ca
se o
f HTT
P/2,
the
cont
ent o
fth
e :a
utho
rity
pseu
do-h
eade
rfie
ld a
s de
fined
inse
ctio
n 8.
1.2.
3 of
[RFC
7240
].En
code
d in
UTF
-8.
Reference 327
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 1ht
tpRe
que
stTa
rget
The
HTT
P re
ques
tta
rget
, as de
fined
in s
ectio
n 2
of[R
FC72
31] a
nd in
sect
ion
5.3
of[R
FC72
30],
asso
ciat
ed w
ith a
flow
. Or t
he H
TTP/
2":
path
" pse
udo-
head
er field
asde
fined
in s
ectio
n8.
1.2.
3 of
[RFC
7240
].En
code
d in
UTF
-8.
46 2ht
tpM
essa
geVe
rsio
n
The
vers
ion
of a
nH
TTP/
1.1
mes
sage
as in
dica
ted
by th
eH
TTP-
vers
ion fie
ld,
defin
ed in
sec
tion
2.6
of [R
FC72
30],
or th
e ve
rsio
niden
tifica
tion
of a
nH
TTP/
2 fr
ame
asde
fined
in[R
FC72
40] s
ectio
n3.
1. T
he le
ngth
of
this
field
is li
mite
dto
10
char
acte
rs,
UTF-
8 en
code
d.
328 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 3na
tIns
tanc
eID
This
Info
rmat
ion
Elem
ent u
niqu
ely
iden
tifies
an
Inst
ance
of t
heN
AT th
at ru
ns o
n a
NAT
mid
dleb
oxfu
nctio
n af
ter t
hepa
cket
pas
ses
the
Obs
erva
tion
Poin
t.na
tIns
tanc
eID
isde
fined
in[R
FC76
59]
Reference 329
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 4in
tern
alAd
dres
sRe
alm
This
Info
rmat
ion
Elem
ent r
epre
sent
sth
e in
tern
alad
dres
s re
alm
whe
re th
e pa
cket
isor
igin
ated
from
or
dest
ined
to. B
yde
finition
, a N
ATm
appi
ng c
an b
ecr
eate
d fr
om tw
oad
dres
s re
alm
s,on
e fr
om in
tern
alan
d on
e fr
omex
tern
al. R
ealm
sar
e im
plem
enta
tion
depe
nden
t and
can
repr
esen
t a V
irtua
lRo
utin
g an
dFo
rwar
ding
(VRF
)ID
, a V
LAN
ID, o
rso
me
uniq
ueiden
tifier. R
ealm
sar
e op
tiona
l, an
dw
hen
left
unsp
ecified
, wou
ldm
ean
that
the
exte
rnal
and
inte
rnal
real
ms
are
the
sam
e.
330 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 5ex
tern
alAd
dres
sRe
alm
This
Info
rmat
ion
Elem
ent r
epre
sent
sth
e ex
tern
alad
dres
s re
alm
whe
re th
e pa
cket
isor
igin
ated
from
or
dest
ined
to. T
hede
taile
d de
finition
is in
the
inte
rnal
addr
ess
real
m a
ssp
ecified
abo
ve.
Reference 331
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 6na
tQuo
taE
xcee
ded
Even
t
This
Info
rmat
ion
Elem
ent ide
ntifies
the
type
of a
NAT
Quo
ta E
xcee
ded
even
t. Va
lues
for
this
Info
rmat
ion
Elem
ent a
re li
sted
in th
e N
AT Q
uota
Exce
eded
Eve
ntTy
pe re
gist
ry, s
ee[http://
www.ia
na.org/
assign
men
ts/ip
fix/
ipfix
.xhtml#
ipfix
-na
t-qu
ota-
exce
eded
-eve
nt].
New
ass
ignm
ents
of v
alue
s w
ill b
ead
min
iste
red
byIA
NA
and
are
subj
ect t
o Ex
pert
Revi
ew [R
FC81
26].
Expe
rts
need
toch
eck de
finition
s of
new
val
ues
for
com
plet
enes
s,ac
cura
cy, a
ndre
dund
ancy
.
332 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 7na
tThr
esho
ldEv
ent
This
Info
rmat
ion
Elem
ent ide
ntifies
a ty
pe o
f a N
ATTh
resh
old
even
t.Va
lues
for t
his
Info
rmat
ion
Elem
ent a
re li
sted
in th
e N
ATTh
resh
old
Even
tTy
pe re
gist
ry, s
ee[http://
www.ia
na.org/
assign
men
ts/ip
fix/
ipfix
.xhtml#
ipfix
-na
t-thresh
old-
even
t]. N
ewas
sign
men
ts o
fva
lues
will
be
adm
inis
tere
d by
IAN
A an
d ar
esu
bjec
t to
Expe
rtRe
view
[RFC
8126
].Ex
pert
s ne
ed to
chec
k de
finition
s of
new
val
ues
for
com
plet
enes
s,ac
cura
cy, a
ndre
dund
ancy
.
Reference 333
Tabl
e 3.
IPFI
X In
form
atio
n El
emen
ts(c
ontin
ued)
Ele
me
ntI
D
Nam
eDe
scrip
tion
Uni
ts
46 8ht
tpUs
erAg
ent
The
HTT
P Us
er-
Agen
t hea
der fi
eld
as defi
ned
inse
ctio
n 5.
5.3
of[R
FC72
31].
Enco
ded
in U
TF-8
.
46 9ht
tpCo
nten
tTyp
eTh
e H
TTP
Cont
ent-
Type
hea
der fi
eld
as defi
ned
inse
ctio
n 3.
1.1.
5 of
[RFC
7231
].En
code
d in
UTF
-8.
47 0ht
tpRe
ason
Phra
se
The
HTT
P re
ason
phra
se a
s de
fined
in s
ectio
n 6.
1 of
of
[RFC
7231
].
Related informationIP Flow Information Export (IPFIX) EntitiesSpecification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information
SNMP formulasDetailed information about the SNMP formulas and their structure in Network Performance Insight.
This information is intended for Network Administrators who must understand the metrics and formulasand their structure that are available in the technology packs. You can see the discovery formulas,collection formulas, metrics, and the required MIB files in the installation directories for the technologypacks that are installed in your environment.
For more information about them, see Installing the Technology Packs section in Installing and ConfiguringIBM Network Performance Insight.
The administrators can modify the formulas or use this information for data validation and interpretation.
SNMP formula languageDetailed information about the SNMP formula language that can be used to create custom collectionformulas, discovery formulas, and metrics.
Technology Pack Development Tool can be used to craft these formulas and metrics.
All the custom content can be validated, bundled, and installed in Network Performance Insight systemaccording to your requirements.
Language basicsSpecific formula language that is supported in Network Performance Insight. This formula language canbe used by application engineers who need to create the custom content for new devices in network.
Formulas
A formula is a calculation that is performed against an SNMP data. It is written in a proprietary language.You can use a formula to customize the information collected by Network Performance Insight.
Two types of formulas:
334 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Discovery formulas
Discovery formulas are used against managed nodes or hosts and their resources. These formulas aredesigned to return a list of resources from a device. You can write a new discovery formula to includea device that does not have an in-built support in Network Performance Insight.
Collection formulas
It is a collection of OID functions, and standard mathematical operations that are applied to aresource type to perform a computation.
Collection formulas are used to collect metrics about the status of the devices in your network duringpolling. These formulas are applied against a resource or managed item in the host to produce a result(numeric). The result is saved in the timeseries database. A resource type can be a physical or logicalobject such as port, interface, virtual circuit, or DLCI.
Network Performance Insight has many predefined collection formulas in Technology Packs that areavailable in the media. However, you can write additional formulas for a customized collectionprocess.
Metrics
Collected data values. From the database perspective, a metric is a single data value that can beidentified by a resource. From the reporting perspective, a metric is a data value shown in a report. It is aset of database metrics, pre-aggregated over time by using a statistical function like average or maximum.A report metric can be aggregated across a set of resources and their types.
MIB files
Management Information Base (MIB) is a collection of information that is organized hierarchically. MIBsprovide definitions for the properties of a managed object within a device.
Writing custom discovery formulasDiscovery formulas are used against devices and their resources during discovery and are designed toreturn a list of resources from a device.
Discovery process
The discovery process consists of several steps.
• Tivoli Network Manager performs the first-level discovery and returns the following information:
– Devices– SNMP credentials for the devices
• During the second-level discovery, Network Performance Insight runs discovery to get a list of resourcesfrom the discovered devices based on the applicable discovery formulas.
• If a new device is added to Tivoli Network Manager system, the ad hoc discovery is run. Resources arediscovered on the device and updated in the database.
Note: Network Performance Insight comes with predefined vendor-specific discovery formulas and theirrequired MIB files. All the discovery files and their MIB files are available in /opt/IBM/npi/npi-itnm-collector/discovery/content directory.
You can use the Technology Pack Development Tool to create, validate, package your own discoveryformulas.
Reference 335
Discovery formula structureAll the discovery formula files must have the file extension as .discovery.
when clause
Specifies the resource types that are appropriate for executing a specific discovery formula. Thecomponents of when clause are as follows:
• resource.type
resource.type = 'device'
Resource type device is discovered by Tivoli Network Manager in first-level discovery. Currently, onlythe device resource type is supported by Tivoli Network Manager and resources from the discovereddevices are discovered by Network Performance Insight in second-level discovery.
Note: The value for resource.type must be in single quotation marks.• resource.sysobjectid
You can narrow the discovery to a specific vendor type by specifying the sysobjectid. Thesysobjectid represents the type of device and can also indicate the model number in a dotteddecimal format. For example:
Table 4. Vendor and model identification numbers
Vendor OID
Cisco 1.3.6.1.4.1.9
Huawei 1.3.6.1.4.1.2011
Juniper 1.3.6.1.4.1.2636
Juniper Networks/Unisphere 1.3.6.1.4.1.4874
For more information about the vendor and model identification numbers, see IANA-registered PrivateEnterprise Numbers.
All the discovery files that have the same sysobjectid as that is returned from system-objectid.discovery are run to obtain the resources from those devices.
• name.<IP_address>
It is the IP address of an interface or device.
Example
when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.9'
Note: The value for sysobjectid must be in single quotation marks.
select statement
In Network Performance Insight discovery, MIB tables are represented as relational database tables.Hence you can write the discovery definitions in SQL.
Selects data from a table or multiple tables. An SQL statement that retrieves resource properties from thetables that are available in the associated vendor-specific MIB file. The select statement has thefollowing components:
property namesA list of property names and their aliases.
336 IBM Network Performance Insight 1.3.1: Network Performance Insight References
from table expressionSelects data from a table or multiple tables. In this case, it is <MIB _file_name.MIB_table_name>. Forexample:
when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.9'select index, ciscomemorypooltype as memoryPoolType, ciscomemorypoolname as memoryPoolName, ciscomemorypoolvalid as memoryPoolValid from CiscoMemoryPoolMib.ciscoMemoryPoolTable where ciscomemorypoolvalid = 1set type = 'memory'set vendor = 'Cisco'set name = context.host + '_MemoryPool<' + resource.index + '>'
• CiscoMemoryPoolMib is the code representation of the MIB file CISCO-MEMORY-POOL-MIB.
You can get these details by running the bin/snmp-mib-tool pack-demo list command fromthe Technology Pack Development Tool installation directory.
• ciscoMemoryPoolTable is MIB table from CISCO-MEMORY-POOL-MIB file.
You can get these details by running the bin/snmp-mib-tool pack-demo show CISCO-MEMORY-POOL-MIB command from the Technology Pack Development Tool installation directory.
join table expressionJoins tables to combine rows from two or more tables, based on a related column between them. Thedifferent types of joins in SQL are as follows:
• inner join
Returns records that have matching values in both tables.• left join
Returns all records from the left table, and the matched records from the right table. It is alsoknown as outer join.
• right join
Returns all records from the right table, and the matched records from the left table. It is alsoknown as outer join.
• full join
Returns all records when there is a match in either left or right table.
Note:
• The index column is a special column that discovery adds automatically to the MIB tables. Itcontains the MIB index details.
• If the select statement contains joins with multiple tables and the column name is not unique for atable, then you must add the MIB table name to qualify the column name. For example,ciscoMemoryPoolTable.index.
• In V1.3.1, there is no support for scalar MIBs.
where conditionThe where condition is used to extract only those records that fulfill a specified condition.
Operators
You can use all the SQL supported operators in the select statements. Typically, the followingoperators are used in the predefined discovery formulas.like
The like operator is used in a where clause to search for a specified pattern in a column.IN
The IN operator allows you to specify multiple values in a where clause.ON
ON represents one or more JOIN conditions by which to match the records from one table toanother.
Reference 337
Example
select hwEntityStateTable.index, hwEntityAdminStatus, hwEntityOperStatus, hwEntityStandbyStatus, hwEntityTemperature, entPhysicalTable.index, entPhysicalIndex, entPhysicalDescr, entPhysicalVendorType, entPhysicalName, entPhysicalClass from HuaweiEntityExtentMib.hwEntityStateTable left join EntityMib.entPhysicalTable on hwEntityStateTable.index = entPhysicalTable.index where entPhysicalClass = 6
Note: You can use complex nested select statements to create your discovery formulas by using theTechnology Pack Development Tool.
set definitions
Discovery formulas provide an additional way to add resource properties. The set definition can contain aliteral string, or combination of discovered properties, or special placeholder called context. For example:
set type = '<resource_type>'set vendor = '<vendor>'set id = context.host + '_<resource_name>:<' + resource.index + '>'
The expressions in the set definitions are as follows:
• context
context is the special place holder that is used in the discovery formulas. It contains the following twocomponents:
– host
The context.host string returns the host name of the device. In this case, it is the IP address of thedevice that is returned from Tivoli Network Manager.
– port
The context.port string returns the SNMP port number of the device.
The expression, set name = context.host + '_Huawei_PowerSupply:<' + resource.index+ '>' results in the name as:
10.55.239.56_Huawei_PowerSupply:<1835017>
Example
set type = 'card'set vendor = 'Huawei'set id = context.host + '_Huawei_PowerSupply:<' + resource.index + '>'
unset definitions
Unset removes or deletes the specified set values.
Example
unset jnxfilleddescrunset jnxoperatingcontentsindexunset jnxoperatingl1indexunset jnxoperatingl2indexunset jnxoperatingl3index
Note: The set and unset definitions support JavaScript expressions.
Required properties
• type
338 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Resource type to which the resource that is discovered belongs to. The resource types can beconfigured from Resource Types page in System Configuration on Dashboard Application Services Hubportal.
In Cisco devices, it can be memory, environment, temperature, fan, cpu, and others.
For more information, see Configuring resource types in Installing and Configuring IBM NetworkPerformance Insight.
• vendor
Vendor device to which the discovery formula is applicable.• id
The resource on the device for which the discovery is to be done.• index
Index number of the resource.
Stitch definitions
Create a discovery file with stitch definitions. The format of the syntax is as follows:
RELATE <source_resource_type> TO <target_resource_type> AS <relation_type> WHEN <filtering and joining conditions>
Note:
• You can specify multiple releate conditions.• The when clause meant for two purposes; condition for joining source and target resources and filtering
unrelated relate rules for a device's resources.• The definition file must not be shared with the discovery definitions above.
For example:
Relate interface To channel AS contain when source.AP_Name == target.AP_Name && source.ap_slot_Id == target.ap_slot_Id && source.vendor == 'Cisco'
SNMP bulk get
Packs such as Huawei NQA requires to get stats values from tables that have dynamic or running indexes.It is not possible to obtain these indexes during discovery.
During discovery, the index property must have static indexes only and for dynamic indexes, it must bereplaced with *. For example:
when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.2011'select * from NqaMib.nqaAdminCtrlTableset vendor='Huawei'set type='probe'set id='HuaweiNQA<'+resource.index+'>'set index=resource.index+'.*'
Note: set index = resource.index + '.*' appends '*' to the end of index property.
ExamplesSome vendor-specific discovery formula examples:
Reference 339
Ciscocisco-powersupply.discovery
when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.9'select index, ciscoenvmonsupplystatusdescr as envPowerSupplyStatusDescription, ciscoenvmonsupplystate as envPowerSupplyState, ciscoenvmonsupplysource as envPowerSupplySource from CiscoEnvmonMib.ciscoEnvMonSupplyStatusTable where ciscoenvmonsupplystate!=5set type = 'environment'set vendor = 'Cisco'set id = context.host + '_PowerSupply:<' + resource.index + '>'
Juniperjuniper-chassis.discovery
when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.2636'SELECT jnxContentsTable.index, jnxOperatingContentsIndex, jnxOperatingL1Index, jnxOperatingL2Index, jnxOperatingL3Index, jnxOperatingDescr as jnxOperatingDescription, jnxContainersIndex, jnxContainersView, jnxContainersLevel, jnxContainersDescr as jnxContainersDescription, jnxFilledState, jnxFilledDescr as jnxFilledDescription, jnxFilledContainerIndex, jnxContentsContainerIndex, jnxContentsSerialNo, jnxContentsRevision, jnxContentsPartNo FROM JuniperMib.jnxContentsTable INNER JOIN JuniperMib.jnxContainersTable ON jnxContentsTable.jnxContentsContainerIndex = jnxContainersTable.jnxContainersIndex INNER JOIN JuniperMib.jnxFilledTable ON jnxContentsTable.index = jnxFilledTable.index INNER JOIN JuniperMib.jnxOperatingTable ON jnxContentsTable.index = jnxOperatingTable.indexWHERE jnxOperatingDescr NOT LIKE '%temp sensor%' AND (jnxOperatingDescr LIKE '%SSB%' OR jnxOperatingDescr LIKE '%SCB%' OR jnxOperatingDescr LIKE '%SFM%' OR jnxOperatingDescr LIKE '%FEB%' OR jnxOperatingDescr LIKE '%FPC%' OR jnxOperatingDescr LIKE '%PIC%' OR jnxOperatingDescr LIKE '%midplane%')AND jnxContainersLevel = 0set type = 'chassis'set vendor = 'Juniper'set id = context.host + '_Chassis:<' + resource.jnxoperatingcontentsindex + '><' + resource.jnxoperatingl1index + '><' + resource.jnxoperatingl2index + '><' + resource.jnxoperatingl3index + '>'
Juniper ERXjunipererx-module.discovery
when resource.type = "device" and resource.sysobjectid like "1.3.6.1.4.1.4874"select 'module' as type,juniSystemSlotTable.index,junisystemslotstatus,junisystemslottype, juniSystemModuleTable.index,junisystemmoduleoperstatus as ModuleOperStatus, junisystemmodulecurrenttype as ModuleType from JuniperSystemMib.juniSystemSlotTable LEFT JOIN JuniperSystemMib.juniSystemModuleTable ON JuniperSystemMib.juniSystemSlotTable.index = JuniperSystemMib.juniSystemModuleTable.index where junisystemslotstatus =4 and junisystemslottype IN(1,2,16,17,18) and junisystemmodulecurrenttype IS NOT NULLset vendor = "Juniper"set CLASSNAME = "JuniperERX"set id = context.host + "_JuniperERXModule:<" + resource.index + ">"
Huaweihuawei-powersupply.discovery
when resource.type = 'device' and resource.sysobjectid like '1.3.6.1.4.1.2011'select hwEntityStateTable.index, hwEntityAdminStatus, hwEntityOperStatus, hwEntityStandbyStatus, hwEntityTemperature, entPhysicalTable.index, entPhysicalIndex, entPhysicalDescr, entPhysicalVendorType, entPhysicalName, entPhysicalClass from HuaweiEntityExtentMib.hwEntityStateTable LEFT JOIN EntityMib.entPhysicalTable ON hwEntityStateTable.index = entPhysicalTable.index where entPhysicalClass = 6set type = 'card'set vendor = 'Huawei'set id = context.host + '_Huawei_PowerSupply:<' + resource.index + '>'
Related informationH2 SQL Grammar
340 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Writing custom collection formulasA collection formula is applied against a resource to produce a result that is always a number. The result isthen saved to the timeseries database. The collection formulas are executed regularly based on thepolling interval and applied on a larger scale than discovery formulas. These collection formulas must beas simple as possible.
About this taskExplains how to create custom collection formulas.
Collection formula structureUse this information to understand the syntax for writing the collection formulas easily. A collectionformula is a calculation that is performed against raw SNMP data. It is a combination of functions,conditions, and standard mathematical operations.
Collection formula structure
All collection formulas must have the extension .formula. If a formula file has more than one formula,save it with the extension .formulas.
Name of the formulaTypically, formula names follow a dot notation that includes the following structure:
<resource_group>.<metric_name>.<units>.formula
For example:
• Environment.Temperature.Level.Celcius.formula• Network.Outbound.Broadcast.pps.formulas
functionBuilt-in functions that can be used in the collection formula language that can perform a calculationon the metrics and return a value. See “Common functions” on page 343.
when clauseFilter condition to pick from the specified values or to compare the expression to determine the value.It contains a set of key value pairs.
when resource.type == 'card' && resource.vendor =='Huawei'
Note: All string values must be in single quotation marks.
resource typeTypically, the when condition must specify the resource type from which to poll that is followed byother conditions. For example:
when resource.type == 'interface' && number(resource.ifSpeed)>429496729
SNMP bulk get
In collection formulas, for those OIDs that return arrays of values, append 'Array' as suffix. For example:
nqaJitterStatsAvgJitterDS.octets = average(value(NQA_MIB.nqaJitterStatsAvgJitterDSArray)) when resource.vendor == 'Huawei'
Where, NQA_MIB.nqaJitterStatsAvgJitterDS is the OID. When bulk get is used on the OID, thenuse the suffix Array as NQA_MIB.nqaJitterStatsAvgJitterDSArray.
• The expression, value(NQA_MIB.nqaJitterStatsAvgJitterDSArray) returns an array of values.• To access the first element in the list, use value(NQA_MIB.nqaJitterStatsAvgJitterDSArray)[0].
Reference 341
• You can also use more advanced JavaScript array methods such as .reduce() can be used onJava.from(value(NQA_MIB.nqaJitterStatsAvgJitterDSArray)).
• Predefined functions such as max, min, sum, count, and average can also be used with these arrays.
• CPU.Utilization.Percent.formula
CPU.Utilization.Percent = value(CISCO_PROCESS_MIB.cpmCPUTotal5minRev) when resource.type == 'cpu' && resource.vendor =='Cisco'
• Network.Inbound.Broadcast.pps.formulas
Network.Inbound.Broadcast.pps = positive(delta(IF_MIB.ifHCInBroadcastPkts))/duration(IF_MIB.ifHCInBroadcastPkts)*100 when resource.type == 'interface' && number(resource.ifSpeed)>4294967295Network.Inbound.Broadcast.pps = positive(delta(IF_MIB.ifInBroadcastPkts))/duration(IF_MIB.ifInBroadcastPkts)*100 when resource.type == 'interface' && number(resource.ifSpeed)<4294967295
OperatorsThe operators supported by the formula language.
Mathematical conventions
The formula language uses standard priority rules between operators. Expressions are evaluated from leftto right, respecting parentheses and mathematical precedence rules. You can use parentheses to alterpriority or to increase readability.
Binary Operators
A list of the mathematical operators supported by the formula language.
Table 5. Mathematical Operators
Symbol Definition Comments
+ Addition When used between numbers,this is mathematical addition.When used between strings, thisis the concatenation operator.
- Subtraction or negation This symbol is used either as asubtraction operator, or in frontof an expression to negate thevalue of the expression.
* Multiplication
/ Division
% Modulo Returns the remainder. Forexample, 155 % 10 -> 5.
b& Binary AND Converts numbers to binary andperforms an AND operation.
For example:
252 b& 63 = 60
11111100 b& 00111111 = 00111100
342 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Table 5. Mathematical Operators (continued)
Symbol Definition Comments
b| Binary OR Converts numbers to binary andperforms an OR operation.
For example:
127 b| 128 = 255
01111111 b| 10000000 = 11111111
The result of a Boolean operation is an integer value: 0 for False , 1 for True . The value is considered to beFalse if it is 0, or True for any value other than 0.
Boolean Operators
Table 6. Boolean Operators
Symbol Definition Comments
> Greater than
>= Greater than or equal
< Less than
<= Less than or equal
== Equal
!= Not equal
Like Like This is a string comparison tool.The right argument is a string thatcan contain wildcard characters.The wildcard characters are asfollows:
* -- Replaces 0 or morecharacters
? -- Replaces one character.
&& Logical AND
|| Logical OR
Common functionsThe common functions supported in collection formulas.
deltaPurpose
Returns the difference between the current value of binding x and its previous value. If delta()of a MIB object with counter syntax is negative, it is not considered a problem.
Reference 343
Syntax
delta (x)
x The value whose delta value you want to find.
Example
•positive(delta(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))
Which is equal to:
positive(currentValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit) – previousValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))
valuePurpose
Returns the value of a binding x. The value function is same as the currentValue function.
Syntax
value (x)
x The binding whose value you want to find.
Examples
•value(CISCO_ENVMON_MIB.ciscoEnvMonSupplyState)
valuesPurpose
Returns an array of values of a binding x that is stored in current state.Syntax
values(x)
x The binding whose values from its storedcurrent state that you want to find.
Example
positive(values(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)[0])
durationPurpose
Returns the difference of the current value collection time and the previous value collection timeof a binding x.
Syntax
duration (x, ['seconds'])
x The binding whose value you want to find.
344 IBM Network Performance Insight 1.3.1: Network Performance Insight References
seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:
• 's'• 'sec'• 'secs'• 'second'• 'seconds'
Example
•positive(delta(IF_MIB.ifHCOutUcastPkts)/duration(IF_MIB.ifHCOutUcastPkts))
Which is equal to:
positive(currentTime(IF_MIB.ifHCOutUcastPkts) – previousTime(IF_MIB.ifHCOutUcastPkts))
timePurpose
Returns the collection time of the current value of a binding x. The time function is same as thecurrentTime function.
Syntax
time (x, ['seconds'])
x The binding whose value you want to find.
seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:
• 's'• 'sec'• 'secs'• 'second'• 'seconds'
Example
positive(time(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))
Reference 345
timesPurpose
Returns an array of collection times of all the values of a binding x that is stored in the currentstate.
Syntax
times(x, ['seconds'])
x The binding whose value you want to find.
seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:
• 's'• 'sec'• 'secs'• 'second'• 'seconds'
Example
positive(times(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)[0])
currentTimePurpose
Returns the collection time of the current value of a binding x.Syntax
currentTime (x, ['seconds'])
x The binding whose value you want to find.
seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:
• 's'• 'sec'• 'secs'• 'second'• 'seconds'
Example
positive(currentTime(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit))
346 IBM Network Performance Insight 1.3.1: Network Performance Insight References
previousTimePurpose
Returns the collection time of the previous value of a binding.Syntax
previousTime (x, ['seconds'])
x The binding whose value you want to find.
seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:
• 's'• 'sec'• 'secs'• 'second'• 'seconds'
Example
previousTime(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)
ratePurpose
Returns the rate of change between the current value and previous value of a binding.Syntax
rate (x, ['seconds'])
x The binding whose value you want to find.
seconds Optional argument that indicates the unit oftime. By default, it returns the value inmilliseconds. If you want the function to returnseconds, an argument 'second' must beadded to the formula. It can be given as any ofthe following formats in single quotationmarks:
• 's'• 'sec'• 'secs'• 'second'• 'seconds'
Example
positive(rate(IF_MIB.ifHCOutUcastPkts, 'second'))
Which is equal to:
Reference 347
positive(delta(IF_MIB.ifHCOutUcastPkts)/duration(IF_MIB.ifHCOutUcastPkts, 'second'))
currentValuePurpose
Returns the value of a binding x.Syntax
currentValue (x)
x The value whose currentValue value youwant to find.
Example
currentValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)
previousValuePurpose
Returns the previous value of a binding.Syntax
previousValue (x)
x The value whose previousValue value youwant to find.
Example
previousValue(CISCO_ENHANCED_MEMPOOL_MIB.cempMemPoolFreeHit)
positivePurpose
Returns the value of the expression as follows:
• If the value of the binding is positive, it returns the value.• If the value of the binding is negative, it returns null. You can provide a default value to be
returned. For example, positive(-1, 10), it returns 10.• When you write a custom formula that uses positive function, enclose the function within the
expression so it returns a null value instead of zero. For example:
positive(value(RFC1213_MIB.ifOutOctets) * 8000)
returns null as intended Whereas:
positive(value(RFC1213_MIB.ifOutOctets)) * 8000
returns zero, which is incorrect.
Syntax
posistive (x, [default_value])
348 IBM Network Performance Insight 1.3.1: Network Performance Insight References
x The binding whose value is returned. If thebinding is positive, then the value is returned. Ifit is negative, then null is returned. If thebinding is a negative value, provide a defaultvalue. Then, the default value is returned.
[default_value] An optional argument. Value that must bereturned for a negative result from theexpression.
Example
positive(rate(IF_MIB.ifHCOutOctets, 'second')*8 / value(IF_MIB.ifHighSpeed)/10000)
Writing custom metricsA metric is a single collected data value that is identified by its generic name, timestamp, and value. Fromthe reporting perspective, a metric is a data value that is shown in a report. Metric files contain metadatasuch as metric name, description, and alias. For every collection formula, a corresponding metric file mustbe created.
About this taskExplains how to create custom metrics and use them in creating custom collection formulas. Allperformance metrics in Network Performance Insight are stored in timeseries database. These metricscan be displayed in real-time on Timeseries Data dashboard.
Metric structureTypical structure of a metric that is used in a collection formula. A metric has these components. Metricsstructure follows HOCON format, which is derived from JSON.
name
It is the normalized metric name for the same metric across all supported vendors. For example, the built-in metrics that are available in Technology Packs has the following structure:
<resource_group>-<metric_name>-<units>.metric
Note: All metrics must have an extension .metric.
description
Provide a simple description of what SNMP data that the metric returns. The data type for description isstring.
Note: Description must be in double quotation marks.
units
Provide an applicable unit for the metric based on the information that it represents and its result. Forexample:
• Number (count,type)• Percent• Bytes• Volt• Celsius• Milliseconds
Reference 349
aliases
An array of comma-separated vendor-specific formula names by which the metric can be identified. Itmust match the formula name that can be mapped to the metric name.
properties
It contains the resource types that are associated with this metric. This field can be left blank with openand closed braces.
Some examples of metrics are as follows:
• Environment-Voltage-Level-Volts.metric
name=Environment.Voltage.Level.Voltsdescription="The voltage of entity"units=voltaliases=[CiscoDevice Voltage Level,Huawei Voltage Level]properties={ resource-types="powerSupply,card"}
• CPU-Utilization-Percent.metric
name=CPU.Utilization.Percentdescription="The percentage of CPU utilization"units=Percentaliases=[cpuBusy,JuniperERX CPU Utilization,JuniperChassis CPU Utilization avg last 5min,Huawei CPU Utilization,CiscoDevice System CPU Utilization CPM]properties={ resource-types="cpu,card,device"}
• IP-Fragment-Failure-pps.metric
name=IP.Fragment.Failure.ppsdescription="The number of IP datagrams that is discarded because they needed to be fragmented at this entity but might not be."units=ppsaliases=[RFCMIBII Fragmentation Failures]properties={ resource-types="device"}
Related informationUsing HOCON, the JSON Superset
Dashboard referenceUse this reference to understand the Flow or entity metrics that are displayed on each dashboard, andother properties of the dashboard. The aggregations that are used on the NetFlow dashboards are alsospecified as applicable.
The following types of metrics are stored in Network Performance Insight database:
• Flow metrics
The raw metrics from Flow records are aggregated and stored FLOW_METRIC schema tables.• Entity metrics
The raw metrics that are discovered and polled from Tivoli Network Manager are aggregated and storedin ENTITY_METRIC schema tables.
These individual metrics and a combination of the metrics are displayed in various dashboards andwidgets. The data is queried and retrieved from the database with the help of REST APIs.
350 IBM Network Performance Insight 1.3.1: Network Performance Insight References
REST (REpresentational State Transfer) APIs rely on a stateless, client/server, cacheable communicationsprotocol. REST applications use HTTP requests to post data (create and update), read data (such asrunning queries), and delete data. REST is a lightweight alternative to mechanisms like RPC (RemoteProcedure Calls) and Web Services (such as SOAP and WSDL). Much like Web Services, a REST service is:
• Platform-independent• Language-independent• Standards-based (runs on top of HTTP)• Able to be used in the presence of firewalls.
Properties of the summary-level dashboardsSummary-level dashboards are strategic dashboards for organizational decisions that provide thesignificant overview about your network health and performance. These dashboards improve visibility bydisplaying metrics with birds-eye-view visualizations and to consolidate the insights.
Properties of the Network Performance Overview dashboardThis information provides the properties of the Network Performance Overview and its associatedwidgets.
Data flow to Network Performance Overview dashboard and its widgets
Widget name Metrics Type of data Technology Pack
Top 10 OutboundPacket Discard(Packets)
Network.Outbound.Discards.Count
Entity metric network-health-extension
Total Packet Drops PerQueue (Packets)
policyQosQueueDrop Flow metric N/A
Top 10 Inbound PacketDiscard (Packets)
Network.Inbound.Discards.Count
Entity metric network-health-extension
Top 10 Applications byTotal Delay (ms)
max(maxTotalRespTime)
Flow metric N/A
Top 10 Round-Trip Time(ms)
Probe.Echo.RTT.ms Entity metric • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Top 10 Probe Loss (%) Probe.Echo.Probe.Loss.Percent
Entity metric • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Top 10 VoIP InboundJitter (ms)
Probe.Jitter.Inbound.Avg.ms
Entity metric network-probe-cisco
Top 10 VoIP OutboundJitter (ms)
Probe.Jitter.Outbound.Avg.ms
Entity metric network-probe-cisco
Reference 351
Widget name Metrics Type of data Technology Pack
VoIP Voice Quality Probe.VOIP.MOS Entity metric network-probe-cisco
Probe.VOIP.ICPIF Entity metric network-probe-cisco
Top 10 OutboundUtilization (%)
Network.Outbound.Utilization.Percent
Entity metric network-health-extension
Top 10 Applications byTotal Volume (Octets)
APP_NAME Flow metric N/A
Top 10 InboundUtilization (%)
Network.Inbound.Utilization.Percent
Entity metric network-health-extension
Top 10 Applications byAverage Utilization (%)
APP_NAME Flow metric N/A
Top 10 CPU Load (%) CPU.Utilization.Percent
Entity metrics • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Top 10 Memory Load(%)
Memory.Utilization.Percent
Entity metrics • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Related informationCreating simple poll policies
Properties of the Network Performance Overview by Deviation dashboardThis information provides the properties of the Network Performance Overview and its associatedwidgets.
Data flow to Network Performance Overview by Deviation dashboard and its widgets
Widget name Metrics Type of data Technology pack
Top 10 OutboundPacket DiscardDeviation (%)
Network.Outbound.Discards.Count
Entity metric network-health-extension
Total Packet Drops PerQueue (Packets)
policyQosQueueDrop Flow metric N/A
Top 10 Inbound PacketDiscard Deviation (%)
Network.Inbound.Discards.Count
Entity metric network-health-extension
Top 10 Applications byTotal Delay (ms)
max(maxTotalRespTime)
Flow metric N/A
352 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Widget name Metrics Type of data Technology pack
Top 10 Round-Trip TimeDeviation (%)
Probe.Echo.RTT.ms Entity metric • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Top 10 Probe LossDeviation (%)
Probe.Echo.Probe.Loss.Percent
Entity metric • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Top 10 VoIP InboundJitter Deviation (%)
Probe.Jitter.Inbound.Avg.ms
Entity metric network-probe-cisco
Top 10 VoIP OutboundJitter Deviation (%)
Probe.Jitter.Outbound.Avg.ms
Entity metric network-probe-cisco
VoIP Voice Quality Probe.VOIP.MOS Entity metric network-probe-cisco
Probe.VOIP.ICPIF Entity metric network-probe-cisco
Top 10 OutboundUtilization Deviation (%)
Network.Outbound.Utilization.Percent
Entity metric network-health-extension
Top 10 Applications byTotal Volume (Octets)
APP_NAME Flow metric N/A
Top 10 InboundUtilization Deviation (%)
Network.Inbound.Utilization.Percent
Entity metric network-health-extension
Top 10 Applications byAverage Utilization (%)
APP_NAME Flow metric N/A
Top 10 CPU LoadDeviation (%)
CPU.Utilization.Percent
Entity metrics • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Top 10 Memory LoadDeviation (%)
Memory.Utilization.Percent
Entity metrics • network-probe-cisco
• network-probe-huawei
• network-probe-juniper
Related informationCreating simple poll policies
Reference 353
Properties of the WiFi Overview dashboardThis information provides the properties of the WiFi Overview and its associated widgets.
Data flow to WiFi Overview dashboard and its widgets
Widget Name Metrics Type of data Technology Pack
Total APs Controller.APs.Connected.Count
Entity metric wifi-health-cisco
Total SSIDs Controller.Ssid.Count
Entity metric wifi-health-cisco
2.4GHz Clients Controller.2.4G.Total.Client.Count
Entity metric wifi-health-cisco
5GHz Clients Controller.5G.Total.Client.Count
Entity metric wifi-health-cisco
Clients by RSSI Quality Controller.Client.Count.RSSI.Good
Entity metric wifi-health-cisco
Controller.Client.Count.RSSI.Average
Entity metric wifi-health-cisco
Controller.Client.Count.RSSI.Poor
Entity metric wifi-health-cisco
Clients by SNR Quality Controller.Client.Count.SNR.Good
Entity metric wifi-health-cisco
Controller.Client.Count.SNR.Average
Entity metric wifi-health-cisco
Controller.Client.Count.SNR.Poor
Entity metric wifi-health-cisco
WiFi Network Details wlanSsid Entity metric wifi-health-cisco
wlanAdminStatus Entity metric
wlanQos [0:bronze,1:silver, 2:gold,3:platinum]
Entity metric
Ssid.Client.Count Entity metric
Access Point Details apName Entity metric wifi-health-cisco
apLocation Entity metric
apIpAddress Entity metric
apAdminStatus Entity metric
AP.Total.Associated.Client.Count
Entity metric
2.4GHz: Worst 10Performing Radio byChannel Utilization (%)
Radio.Slot.Channel.Utilization.2.4G.Percent
Entity metric wifi-health-cisco
5GHz: Worst 10Performing Radio byChannel Utilization (%)
Radio.Slot.Channel.Utilization.5G.Percent
Entity metric wifi-health-cisco
354 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Widget Name Metrics Type of data Technology Pack
Worst 10 PerformingChannels byInterference
Channel.Interference.Utilization.Percent
Entity metric wifi-health-cisco
Properties of the WiFi Client Count dashboardThis information provides the properties of the WiFi Client Count and its associated widgets.
Data flow to WiFi Client Count dashboard and its widgets
Widget Name Metrics Type of data Technology Pack
2.4GHz:Client CountTrend
Controller.2.4G.Total.Client.Count
Entity metric wifi-health-cisco
5GHz:Client Count Trend Controller.5G.Total.Client.Count
Entity metric wifi-health-cisco
Client Count by RSSIQuality Trend
Controller.Client.Count.RSSI.Good
Entity metric wifi-health-cisco
Controller.Client.Count.RSSI.Average
Entity metric wifi-health-cisco
Controller.Client.Count.RSSI.Poor
Entity metric wifi-health-cisco
Client Count by SNRQuality Trend
Controller.Client.Count.SNR.Good
Entity metric wifi-health-cisco
Controller.Client.Count.SNR.Average
Entity metric wifi-health-cisco
Controller.Client.Count.SNR.Poor
Entity metric wifi-health-cisco
Properties of WiFi Interference and Noise Performance dashboardThis information provides the properties of the WiFi Interference and Noise Performance and itsassociated widgets.
Data flow to WiFi Interference and Noise Performance dashboard and its widgets
Widget Name Metrics Type of data Technology Pack
Interference Score (%)Trend
Channel.Interference.Utilization.Percent
Entity metric wifi-health-cisco
Interference Power(dBm) Trend
Channel.Interference.Power.dBm
Entity metric wifi-health-cisco
Noise (dBm) Trend Channel.Noise.Power.dBm
Entity metric wifi-health-cisco
Reference 355
Properties of the NetFlow dashboardsThis information provides the properties of all the NetFlow dashboards.
Data flow to the NetFlow dashboards and widgets
NetFlow dashboards Flow metrics are stored in Network Performance Insight database. The raw metricsfrom Flow records are aggregated and stored FLOW_METRIC schema tables.
The following table shows the data properties of the Top Talker views in the NetFlow dashboards.
Table 7. NetFlow Dashboards
Aggregation name Grouping keys
Top Applications with ToS IF_ID + APP_NAME+SRC_TOS
Top Applications IF_ID + APP_NAME
Top Destination Autonomous Systems IF_ID+BGP_DST_AS_NUM
Top Source Autonomous Systems IF_ID+BGP_SRC_AS_NUM
Top Autonomous System Conversations IF_ID+BGP_SRC_AS_NUM+BGP_DST_AS_NUM
Top Conversations with Application IF_ID+SRC_IP+DST_IP+APP_NAME
Top Conversations with ToS IF_ID+SRC_IP+DST_IP+SRC_TOS
Top Conversations IF_ID+SRC_IP+DST_IP
Top Destinations with Application IF_ID+DST_IP+APP_NAME
Top Destinations IF_ID+DST_IP
Top IP Group Conversations IF_ID +SRC_IP_GROUP+DST_IP_GROUP
Top IP Group Conversations withApplication
IF_ID +SRC_IP_GROUP+DST_IP_GROUP+APP_NAME
Top Source IP Groups with Protocol IF_ID+SRC_IP_GROUP+PROTOCOL_ID
Top Destination IP Groups with Protocol IF_ID+DST_IP_GROUP+PROTOCOL_ID
Top Source IP Groups with ToS IF_ID+SRC_IP_GROUP+SRC_TOS
Top IP Group Conversations with Protocol IF_ID +SRC_IP_GROUP+DST_IP_GROUP+PROTOCOL_ID
Top Destination IP Groups with ToS IF_ID+DST_IP_GROUP+SRC_TOS
Top Source IP Groups with Application IF_ID+SRC_IP_GROUP+APP_NAME
Top IP Group Conversations with ToS IF_ID +SRC_IP_GROUP+DST_IP_GROUP+SRC_TOS
Top Destination IP Groups IF_ID+SRC_IP_GROUP
356 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Table 7. NetFlow Dashboards (continued)
Aggregation name Grouping keys
Top Source IP Groups IF_ID+SRC_IP_GROUP
Top Destination IP Groups with Application IF_ID+DST_IP_GROUP+APP_NAME
Top Protocols with Conversation IF_ID+PROTOCOL_ID+SRC_IP+DST_IP
Top Protocols with Destination IF_ID+PROTOCOL_ID+DST_IP
Top Protocols with Application IF_ID+PROTOCOL_ID+APP_NAME
Top Protocols with Source IF_ID+PROTOCOL_ID+SRC_IP
Top Protocols IF_ID+PROTOCOL_ID
QoS Queue Drops IF_ID+POLICY_QOS_CLASSIFICATION_HIERARCHY+POLICY_QOS_QUEUE_ID
Top Sources IF_ID+SRC_IP
Top Sources with Application IF_ID+SRC_IP+APP_NAME
Top ToS IF_ID+SRC_TOS
Properties of the Applications Response Overview dashboardThis information provides the properties of the Applications Response Overview and its associatedwidgets.
Data flow to Applications Response Overview dashboard and its widgets
The following table shows the flow data properties in Applications Response Overview dashboardwidgets.
Widget name Metrics
Top 10 Applications by Client Network Delay (ms) max(maxClientNwkTime)
Top 10 Applications by Server Network Delay (ms) max(maxServerNwkTime)
Top 10 Applications by Application Delay (ms) max(maxServerRespTime)
Top 10 Applications by Total Delay (ms) max(maxTotalRespTime)
Properties of the Network Traffic Overview dashboardThis information provides the properties of the Network Traffic Overview and its associated widgets.
Data flow to Network Traffic Overview dashboard and its widgets
The following table shows the flow data properties in Network Traffic Overview dashboard widgets.
Widget name Metrics
Top 10 Inbound Utilization (%) avg(interfaceInUtilization)
Top 10 Outbound Utilization (%) avg(interfaceOutUtilization)
Reference 357
Widget name Metrics
Utilization Deviation avg(interfaceInUtilization)
avg(interfaceOutUtilization)
Utilization interfaceInUtilization
interfaceOutUtilization
Traffic Volume (Octets) sum(interfaceInOctets)
sum(interfaceOutOctets)
Interface Speed (bps) speed
4-Weeks Utilization Trend avg(interfaceOutUtilization)
Utilization Trend interfaceOutUtilization
interfaceInUtilization
The following table shows the flow data properties of the Top Talkers views in the Network TrafficOverview dashboard.
Widget name Aggregation name Grouping keys
Top 10 Applications by TrafficVolume (Octets)
Top Application IF_ID + APP_NAME
Top 10 Protocols by TrafficVolume (Octets)
Top Protocols IF_ID+PROTOCOL_ID
Top 10 ToS by Traffic Volume(Octets)
Top ToS IF_ID+SRC_TOS
Top 10 Conversations by TrafficVolume (Octets)
Top Conversations IF_ID+SRC_IP+DST_IP
Top 10 Sources by Traffic Volume(Octets)
Top Sources IF_ID+SRC_IP
Top 10 Destinations by TrafficVolume (Octets)
Top Destinations IF_ID+DST_IP
Properties of the On Demand Filtering dashboardsThis information provides the properties of all the On Demand Filtering dashboards.
Device Health dashboard
Data flow to On Demand Filtering Device Health dashboard
The following table shows the metrics information that are displayed on the Device Health dashboard.
358 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Table 8. Device Health
Displayed KPI Metrics Type of data Technology pack
Inbound Utilization(%)
Network.Inbound.Utilization.Percent
Entity metric
network-health-generic
Outbound Utilization(%)
Network.Outbound.Utilization.Percent
Inbound Errors(pkts)
Network.Inbound.Errors.Count
Outbound Errors(pkts)
Network.Outbound.Errors.Count
Inbound Discards Network.Inbound.Discards.Count
Outbound Discards Network.Outbound.Discards.Count
Inbound Volumes(octets)
Network.Inbound.Octets.Bytes
Outbound Volumes(octets)
Network.Outbound.Octets.Bytes
Inbound Throughput(bps)
Network.Inbound.Throughput.bps
OutboundThroughput (bps)
Network.Outbound.Throughput.bps
CPU (%) CPU.Interrupt.Utilization.Percent
network-health-juniper
Memory (%) Memory.Utilization.Percent
network-health-cisco
Temperature(celsius)
Environment.Temperature.Level.Celcius
network-health-cisco
network-health-juniper
network-health-huawei
Flow dashboard
Data flow to On Demand Filtering Flow dashboard
To view the data properties of the Top Talker views in the On Demand Filtering Flow dashboard, refer to“Properties of the NetFlow dashboards” on page 356.
HTTP Operations dashboard
Data flow to On Demand Filtering HTTP Operations dashboard
The following table shows the metrics information that are displayed on the HTTP Operations dashboard.
Reference 359
Table 9. HTTP Operations
KPI Displayed KPI Metrics Technology pack
http
RTT (ms) Probe.HTTP.RTT.ms
network-healthDNS RTT (ms) Probe.HTTP.DNS.RTT.ms
TCP Connect RTT (ms) Probe.HTTP.TCP-Connect.RTT.ms
Transaction RTT (ms) Probe.HTTP.Total.Transaction.RTT.ms
IPSLA dashboard
Data flow to On Demand Filtering IPSLA dashboard
The following table shows the metrics information that are displayed on the IPSLA dashboard.
Table 10. IPSLA
SLA Test Displayed KPI Metrics Technology pack
echo
tcpConnect
udpEcho
Probe Count (count) Probe.Echo.Probe.Count
network-health
Probe Loss (%) Probe.Echo.Probe.Loss.Percent
Probe Succeeded (%) Probe.Echo.Probe.Succeeded.Percent
RTT (ms) Probe.Echo.RTT.ms
http
RTT (ms) Probe.Echo.RTT.ms
network-health
DNS RTT (ms) Probe.HTTP.DNS.RTT.ms
TCP Connect RTT(ms)
Probe.HTTP.TCP-Connect.RTT.ms
Transaction RTT (ms) Probe.HTTP.Total.Transaction.RTT.ms
jitter
Inbound Jitter (ms) Probe.Jitter.Inbound.Avg.ms
network-health
Outbound Jitter (ms) Probe.Jitter.Outbound.Avg.ms
Inbound One WayLatency (ms)
Probe.Jitter.Inbound.One-way.Avg.ms
Outbound One WayLatency (ms)
Probe.Jitter.Outbound.One-way.Avg.ms
Inbound Packet Loss(%)
Probe.Jitter.Inbound.Packet.Loss.Percent
Outbound PacketLoss (%)
Probe.Jitter.Outbound.Packet.Loss.Percent
360 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Table 10. IPSLA (continued)
SLA Test Displayed KPI Metrics Technology pack
rtp
Inbound Jitter (ms) Probe.RTP.Inbound.Inter-Arrival.Jitter.ms
network-health
Outbound Jitter (ms) Probe.RTP.Outbound.Inter-Arrival.Jitter.ms
Inbound One WayLatency (ms)
Probe.RTP.Inbound.Jitter.Avg.ms
Outbound One WayLatency (ms)
Probe.RTP.Outbound.Jitter.Avg.ms
Inbound Packet Loss(%)
Probe.RTP.Inbound.Packet.Loss.Percent
Outbound PacketLoss (%)
Probe.RTP.Outbound.Packet.Loss.Percent
RTT (ms) Probe.RTP.RTT.ms
voip
Inbound Jitter (ms) Probe.Jitter.Inbound.Avg.ms
network-health
Outbound Jitter (ms) Probe.Jitter.Outbound.Avg.ms
Inbound One WayLatency (ms)
Probe.Jitter.Inbound.One-way.Avg.ms
Outbound One WayLatency (ms)
Probe.Jitter.Outbound.One-way.Avg.ms
Inbound Packet Loss(%)
Probe.Jitter.Inbound.Packet.Loss.Percent
Outbound PacketLoss (%)
Probe.Jitter.Outbound.Packet.Loss.Percent
MOS (count) Probe.VOIP.MOS
For more information, see Supported IP SLA metrics and formulas section in IBM Network PerformanceInsight: References.
Configuring Flow devicesProvides the command reference with examples for configuring the flow devices to enable them to workwith IBM Network Performance Insight, Version 1.3.1.
Before Network Performance Insight can gather data, routers and other network devices must beconfigured to send NetFlow data. These configurations are needed to ensure that routers send NetFlowdata periodically to the Collector subsystem.
For more detailed information about setting up flow devices for Network Performance Insight, see thespecific vendor documentation.
CAUTION: Only IT administrators with experience in configuring routers and switches must usethis information.
Reference 361
Supported devices and flow formatsIBM Network Performance Insight, Version 1.3.1 supports most of the devices and their flow formats thatare available in the market.
Some of devices and their flow formats that Network Performance Insight v1.3.1 supports:
Device Flow format
Cisco NetFlow (v1, v5, v9, and IPFIX versions) andFlexible NetFlow with AVC
Juniper J-Flow (v5 and v9)
Alcatel Cflow (v5 and v9)
Huawei NetStream (v5 and v9)
Configuring NetFlow on Cisco routersNetflow is a data collection and reporting protocol for monitoring network traffic that is supported bymultiple vendors.
As a part of this configuration, network administrators must configure the devices to transmit NetFlowinformation actively to the network monitoring application and configure the interfaces to gatherinformation about the traffic conversations. The configurations that you perform must be in line with thecapacity of the network application. In this case, Network Performance Insight.
NetFlow also monitors layers 2-4 of Open Systems Interconnection (OSI) model and other flowtechnologies and provides information on network usage and port conversations activity.
Related informationCisco IOS Configuration Fundamentals Command Reference, Release 12.2
Cisco IOS command modesYou use the CLI to access Cisco IOS software.
Enter a question mark (?) at the CLI prompt to obtain a list of commands that are available for eachcommand mode.
When you log in to the CLI, you are in user EXEC mode. User EXEC mode contains only a limited subset ofcommands. To have access to all commands, you must enter privileged EXEC mode, normally by using apassword. From privileged EXEC mode, you can give any EXEC command; user or privileged mode. Or, youcan enter global configuration mode.
These configuration modes are needed for you to change the running configuration. If you later save therunning configuration to the start configuration, these changed commands are stored when the softwareis rebooted. To enter specific configuration modes, you must start at global configuration mode. Fromglobal configuration mode, you can enter interface configuration mode and various other modes, such asprotocol-specific modes.
Command modesDescribes how to use various common command modes of the Cisco IOS software.
Command modesShows examples of the prompts displayed.
Command mode Command
User Exec
When you log in to the CLI, you are in User Execmode. Contains only a limited subset ofcommands.
Router>
362 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Command mode Command
Privileged Exec
You can have access to all commands in this mode.Typically, require a password. Use the enablecommand. Your prompt changes to Router#.
Router> enablePassword <password>Router#
Global configuration
Enter the configure terminal privileged EXECcommand to enter global configuration mode. Yourprompt changes to Router(config)#.
Router# configure terminalRouter(config)#
Note: Enter configuration commands, one per line.End with CTRL+Z or Exit command.
Interface configuration
From global configuration mode, specify aninterface by using an interface command. Yourprompt changes to Router(config_if)#.
Note: Enter "?" to display what you must enter nexton the command line.
Router(config)# interface serial ?<0-6> Serial interface numberRouter(config)# interface serial 4 ?/Router(config)# interface serial 4/ ?<0-3> Serial interface numberRouter(config)# interface serial 4/0Router(config-if)#
ROM monitor mode
ROM monitor mode is a separate mode that is usedwhen the Cisco IOS software cannot load properly.From privileged EXEC mode, use the reload EXECcommand. Your prompt changes to rommon #>.
Router# reload>
Configuring Flexible NetFlow and Application Visibility and Control (AVC)Use these configuration steps to enable your devices for the mandatory Flow fields and the enterpriseFlow fields to support AVC solution.
About this task
AVC is integrated approach that provides application recognition and performance monitoring capabilitiesto your NetFlow enabled devices. The information that is collected by Cisco AVC is exported in an openstandard format such as Netflow Version 9 and IPFIX. These formats allow both Cisco and third-partynetwork management to support Cisco AVC solution.
The following Cisco AVC solution components are supported in Network Performance Insight:
• Network-Based Application Recognition (NBAR)• Next Generation Network-Based Application Recognition (NBAR2)• Application Response Time (ART)• Quality of Service (QoS)
Related informationConfiguration Examples for Flexible Netflow
Configuring standard Flow fieldsThe flow record defines the record fields that must be exported from the device to the collector.
About this task
Standard Flow fields configuration.
Reference 363
Procedure
1. Configure to specify where the Flow data must be exported to:
configure terminalflow exporter <NPI_exporter>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9# Configure this option template to support application id to name and description mappingoption application table# Configure if required to support NBAR2 for application attributesoption application attributesexit
2. Configure the Flow record to collect the Flow fields:
Note: This example is for NetFlow V9 records.
configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit
3. Configure the Flow monitor that creates new NetFlow cache and the required Flow record and FlowExporter:
configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_exporter>exit
4. Configure to apply the Flow Monitor to an interface:
configure terminalinterface GigabitEthernet0/3ip flow monitor <NPI_monitor> inputip flow monitor <NPI_monitor> outputexit
Related informationCisco IOS Flexible NetFlow Command Reference
Configuring Quality of Service (QoS) on Cisco devicesQoS provides prioritization and rate-limiting of traffic. High-priority, latency-sensitive traffic can be putinto the priority queue.
About this task
QoS Flow fields configuration.
364 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Procedure
1. Configure to specify where the Flow data must be exported to:
configure terminalflow exporter <NPI_monitor>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application table # NBAR fields to support application id to name and description mappingoption application attributes [Configure if required to support NBAR2 for application attributesoption c3pl-policy-table # Configure if required to support QoS HIeararchy and Queue Drops reportingoption c3pl-class-table # Configure if required to support QoS HIeararchy and Queue Drops reportingexit
2. Configure the Flow record to collect the QoS fields:
configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect policy qos class hierarchycollect policy qos queue idcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit
a) Configure the QoS Queue Drops field collection:
Note: QoS Queue Drops must be configured in a separate Flow record as mandated by Cisco. SeeAVC Configuration.
configure terminalflow record type performance monitor QoS_Queue_Dropmatch policy qos queue indexcollect policy qos queue dropscollect interface outputcollect timestamp absolute monitoring-interval startcollect timestamp absolute monitoring-interval endexit
3. Configure the Flow monitor that creates new NetFlow cache and the required Flow record and FlowExporter:
configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_monitor>exit
Reference 365
a) Configure the QoS monitor:
configure terminalflow monitor type performance-monitor <qos_Monitor>exporter <NPI_exporter>record QoS_Queue_Dropexit
b) Configure to create Performance Monitor Policy for QoS:
Note: Ensure that the required QoS policies and classes are defined. See AVC Configuration.
configure terminalpolicy-map type performance monitor pm-qosclass class-defaultflow monitor qos-monitorexit
4. Configure to apply the Flow Monitor to an interface:
configure terminalinterface GigabitEthernet0/3ip flow monitor NPI_monitor inputip flow monitor NPI_monitor outputservice-policy type performance monitor output pm-qosexit
Configuring Application Response Time (ART) on Cisco devicesART metrics are extracted or calculated by the ART engine. These metrics are available only for TCP flows.
About this task
ART Flow fields configuration.
Procedure
1. Configure to specify where the Flow data must be exported to:
configure terminalflow exporter <NPI_exporter>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application table option application attributes exit
2. Configure a separate Flow record template for Application Response Time (ART) configuration as ARTrecords contain bi-directional data:
configure terminalflow record type performance-monitor ART_recordmatch ipv4/ipv6 protocolmatch application namematch connection client ipv4 addressmatch connection server ipv4 addressmatch connection server transport portcollect ipv4/ipv6 dscpcollect interface inputcollect interface outputcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastcollect connection delay network to-server maxcollect connection delay network to-client maxcollect connection delay application maxcollect connection delay response client-to-server
366 IBM Network Performance Insight 1.3.1: Network Performance Insight References
3. Configure the Flow monitor that creates new NetFlow cache and the required Flow record and FlowExporter:
configure terminalflow monitor type performance-monitor ART-monitorexporter NPI_exporterrecord ART_recordexit
4. Create the Performance Monitor Policy:
configure terminalpolicy-map type performance monitor ARTclass class-defaultflow monitor ART-monitor
5. Associate the Performance Monitor to an interface:
configure terminalinterface <interface>service-policy type performance monitor output ART
Enabling NetFlow on your devicesTo enable NetFlow, configure IP routing and use these commands in global configuration mode.
About this taskEnabling flow monitoring for an interface.
Command Description
Router(config)# interface typeslot/port-adapter/port
Enters interface configuration mode and configuresthe interface.
For example, interfaceGigabitEthernet1/0/3
Router(config-if)# ip route-cache flow Enables NetFlow for IP routing.
Router(config-if)# ip route-cache ingressRouter(config-if)# ip route-cache egressRouter(config-if)# ip flow egressRouter(config-if)# ip flow ingress
Enables NetFlow on the sub interfaces withdirection.
Configuring the Flow ExportersNetFlow information can also be exported to network management applications.
About this taskTo configure a router to export NetFlow information that is maintained in the NetFlow cache to NetworkPerformance Insight, use these commands in global configuration mode. NetFlow information is exportedto Network Performance Insight when the Flow expires in NetFlow cache.
Reference 367
Command Description
Router(config)# ip flow-export ip-address udp-port
Where<IP_address>
IP address of the system to which you want to send theNetFlow information.
udp-portUDP protocol-specific port number.
Configures a router to export NetFlowcache entries to a Collector.
Note: To disable IP routing, use the noIP routing command as: no ip flow-export.
Router(config)# ip flow-export version 9 [peer-as | origin-as | bgp-nexthop]
Specifies that the export packet uses theVersion 9 format. Optionally, specify theorigin or peer autonomous systems.
• peer-as
Specifies that export statistics includethe originating autonomous system forthe source and destination.
• origin-as
Specifies that export statistics includethe peer autonomous system for thesource and destination.
• bgp-nexthop
Specifies that export statistics includeBGP next hop-related information.
show ip flow export Displays statistics for the NetFlow dataexport, including statistics for the maincache and for all other enabled caches.
Router(config)# ip flow-export source <interface>/<interface_number>
Sets the source IP address of theNetFlow exports that are sent by thedevice to the specified IP address.
Router(config)# ip flow-cache timeout active 1 Active timeout is the frequency of activeflow records that are exported from theflow cache to Network PerformanceInsight. Default value is 30 min. To getreal-time traffic reports, set this value to1.
Router(config)# ip flow-cache timeout inactive 15 Inactive timeout is the frequency ofinactive flow records that are exportedfrom the flow cache to NetworkPerformance Insight. A flow record isinactive when the conversation betweentwo interfaces is stopped. Default valueis 15 sec.
Related informationConfiguring NetFlow and NetFlow Data Export
368 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Customizing the number of entries in flow cacheYou can increase or decrease the number of entries that are maintained in the cache to meet yourNetFlow traffic rates. The number of entries can be 1024 - 524288. The default is 65536.
About this task
Command Description
Router(config)# ip flow-cache entries <number> Changes the number of entries that aremaintained in the NetFlow cache.
CAUTION: Improper use of thisfeature might cause networkproblems. To return to thedefault NetFlow cache entries,use the no ip flow-cacheentries in global configurationmode.
Monitoring NetFlow informationUse these commands to verify whether the NetFlow data export is functioning and displaying the data.
About this task
Command Description
Router# show ip flow export Displays information aboutNetFlow flow exporters andstatistics.
Router# show flow exporter <exporter_name> Displays the statistics of thespecified Flow Exporter.
Router# show ip flow interface Displays NetFlow accountingconfiguration on interfaces.
Router# show ip interface Displays the usability status ofinterfaces that are configured forIP.
Router# show ip cache flow Displays the NetFlow statisticssuch as:
• IP packet size distribution• IP flow cache information• Flow information; protocol, total
flow, flows per second
Router# clear ip flow stats Clears the NetFlow statistics.
An example Cisco device configurationCisco device configuration.
configure terminalinterface serial 3/0/0ip route-cache flowexitip flow-export 127.1.0.0 0 version 5 peer-asexitclear ip flow statsRouter# show ip cache flow
Reference 369
The output is as shown:
IP packet size distribution (230151 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.999 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
Configuring flow on Juniper devicesProvides commands and examples to configure J-Flow on an SRX Series device.
Command modes
Command mode Description
Operational mode
When you log in to the router and type the CLIcommand, you are automatically in operationalmode:
user@host>
This mode displays the status of the device. Inoperational mode, you enter commands to monitorand troubleshoot the Junos OS, devices, andnetwork connectivity.
Configuration mode
user@host>configureuser@host#
To exit the mode, give the following commands:
user@host# commit and-quitcommit completeuser@host
To exit without commit:
user@host# exitExiting configuration modeuser@host>
A configuration for a device that is running onJunos OS is stored as a hierarchy of statements. Inconfiguration mode, you enter these statements todefine all properties of the Junos OS, includinginterfaces, general routing information, routingprotocols, user access, and several system andhardware properties.
Active Flow monitoringFlow monitoring versions 5, 8, and 9 support active flow monitoring. For active flow monitoring, themonitoring station participates in the network as an active router. A router performs the following actionsduring active Flow monitoring:
• Sampling
The router selects and analyzes only a portion of the traffic.• Sampling with templates
The router selects, analyzes, and arranges a portion of the traffic into templates.• Sampling per sampling instance
The router selects, analyzes, and arranges a portion of the traffic according to the configuration andbinding of a sampling instance.
• Port mirroring
The router copies entire packets and sends the copies to another interface.• Multiple port mirroring
The router sends multiple copies of monitored packets to multiple export interfaces with the next-hop-group statement at the (edit forwarding-options) hierarchy level.
370 IBM Network Performance Insight 1.3.1: Network Performance Insight References
• Discard accounting
The router accounts for selected traffic before it discards. Such traffic is not forwarded out of the router.Instead, the traffic is quarantined and deleted.
• Flow-tap processing
The router processes requests for active flow monitoring dynamically by using the Dynamic TaskingControl Protocol (DTCP).
Some of the commands for these actions are described here.Related informationFlow Monitoring Feature Guide for Routing DevicesActive Flow Monitoring Overview
Configuring J-Flow versions 5 and 8Commands to configure J-Flow versions 5 and 8.
About this task
Commands Description
user@host# set interfaces ge-0/0/0 unit 0 family inet sampling inputuser@host# set interfaces ge-0/0/0 unit 0 family inet sampling output
Enables sampling on one or moreinterfaces and specify the direction.
user@host# set forwarding-options sampling input rate 100
Specifies the sampling rate.
CAUTION: Caution: Activation offlow collection can have asignificant impact on theperformance of the SRX Seriesdevice. The smaller the samplerate, the bigger the impact. It isrecommended to not use asampling input rate of 1.
Where:forwarding-options
Starts the inline J-Flowconfiguration, so that the samplingand the J-Flow service thread areimplemented in the forwardingengine.
samplingConfigures the J-Flow packetsampling options.
inputEnables sampling.
rateSpecifies the ratio of packets to besampled.
user@host# set forwarding-options sampling family inet output flow-server 10.10.10.1 port 2056
Specifies the UDP port number of thehost that is collecting cflowd packets.
user@host# set forwarding-options sampling family inet output flow-server 10.10.10.1 version 5
Specify the version format 5.
Reference 371
Related informationSRX Getting Started - Configure J-Flow
Configuring J-Flow version 9Commands to configure J-Flow versions 9.
About this task
Commands Description
user@host# set services flow-monitoring version9 template v4 flow-active-timeout 30
user@host# set services flow-monitoring version9 template v4 flow-inactive-timeout 30
user@host# set services flow-monitoring version9 template v4 <ipv4-template>
Configures the J-Flow v9template.
Note: Currently, the IPv4template is supported.
user@host# set forwarding-options sampling input rate 100
user@host# set forwarding-options sampling input run-length 0
Specifies the sampling rate andrun length.
user@host# set forwarding-options sampling family inet output flow-server <IP_add> port 2222
user@host# set forwarding-options sampling family inet output flow-server <IP_address> version9 template <template_name>
Configures the external flowcollector and its port number.
Note: The J-Flow v9 templateis associated with the externalflow collector. Up to eight flowcollectors can besimultaneously configured.
user@host# set forwarding-options samplinguser@host# set forwarding-options sampling inputuser@host# set forwarding-options sampling output family inet output inline-jflow source-address<IP_address>
Configure the inline-jflow, sothat the sampling and the J-Flow service thread areimplemented in the forwardingengine.
user@host# set interfaces ge-0/0/14 unit 0 family inet sampling inputuser@host# set interfaces ge-1/0/0 unit 0 family inet sampling output user@host# set interfaces ge-0/0/14 unit 0 family inet address <IP_address>/24
Configure the sampling filter onan interface (or interfaces) inthe direction, on which the J-Flow service is required.
user@host# show interfaces descriptions Displays all the configuredinterfaces.
Related informationJuniper Flow Monitoring
Configuring the sampling instanceYou can configure active sampling by using a sampling instance and associate that sampling instance to aparticular Packet Forwarding Engine. In addition, you can define multiple sampling instances that areassociated with multiple destinations (as many as the number of Packet Forwarding Engines in thechassis), with multiple protocol families per each sampling instance destination.
372 IBM Network Performance Insight 1.3.1: Network Performance Insight References
About this task
set chassis fpc 0 sampling-instance s0 set interfaces ge-0/1/0 unit 0 family inet sampling input set interfaces ge-0/1/0 unit 0 family inet address set interfaces ge-1/0/0 unit 0 family inet address set interfaces sp-2/0/0 unit 0 family inet set forwarding-options sampling instance s0 input rate 1 set forwarding-options sampling instance s0 input run-length 0 set forwarding-options sampling instance s0 family inet output flow-server 2.2.2.2 port 2055 set forwarding-options sampling instance s0 family inet output flow-server 2.2.2.2 version9 template v4; set forwarding-options sampling instance s0 family inet output interface sp-2/0/0 source-address 1.1.1.1 set routing-options static route 50.0.0.0/8 next-hop 20.0.0.2 set services flow-monitoring version9 template v4 flow-active-timeout 30 set services flow-monitoring version9 template v4 flow-inactive-timeout 30 set services flow-monitoring version9 template v4 ipv4-template
Related informationExample: Sampling Instance Configuration
Configuring J-Flow version 9 for SRX-DataCenter devicesCommands to configure J-Flow versions 9 for SRX-DataCenter devices.
About this task
Commands Description
user@host# set services flow-monitoring version9 template <template_name>
Configures the J-Flow v9 template
user@host# set samplng family inet output flow server <flow_collector_ip_add> port <flow_collector_port> version9 template <template_name>
Configures external flow collector, in thiscase, Network Performance InsightCollector.
user@host# set forwarding-options sampling instance <instance1> input rate 100
user@host# set forwarding-options sampling instance <instance1> input run-length 0
Specifies the sampling rate.
Note: Currently, IPv4 template issupported.
user@host# set forwarding-options sampling instance instance1 family inet output flow-server <Ip_address> port 2222
user@host# set forwarding-options sampling instance instance1 family inet output flow-server <Ip_address> version9 template <template_name>
Configures the external flow collectorand its port address.
Note: The J-Flow v9 template isassociated with the external flowcollector. Up to eight flow collectors canbe simultaneously configured.
user@host# set forwarding-options sampling instance instance1 family inet output inline-jflow source-address <Ip_address>
Configures the inline-jflow, so that thesampling and the J-Flow service threadare implemented in the forwardingengine.
user@host# set interfaces ge-0/0/14 unit 0 family inet sampling inputuser@host# set interfaces ge-0/0/14 unit 0 family inet address 2.2.2.1/24
Configures the sampling filter on aninterface (or interfaces) in the direction,on which the J-Flow service is required.
Reference 373
Related informationSRX Getting Started - Configure J-Flow
Using the show commandsDescribes the possible show command options in configuration mode and Operational mode.
About this task
configure//To enter a configuration modeshow ?
<[Enter]> Execute this command> access Network access configuration> access-profile Access profile for this instance> accounting-options Accounting data configuration> applications Define applications by protocol characteristics+ apply-groups Groups from which to inherit configuration data> chassis Chassis configuration> class-of-service Class-of-service configuration> ethernet-switching-options Ethernet-switching configuration options> event-options Event processing configuration> firewall Define a firewall configuration> forwarding-options Configure options to control packet forwarding> groups Configuration groups> interfaces Interface configuration> multi-chassis> multicast-snooping-options Multicast snooping option configuration> policy-options Policy option configuration> protocols Routing protocol configuration> routing-instances Routing instance configuration> routing-options Protocol-independent routing option configuration> schedulers Security scheduler> security Security configuration> services Set services parameters> smtp Simple Mail Transfer Protocol service configuration> snmp Simple Network Management Protocol configuration> system System parameters> vlans VLAN configuration | Pipe through a command
Exit//To exit the configuration modeShow// To run the show command options in User Excec mode
accounting Show accounting profiles and records arp Show system Address Resolution Protocol table entries as-path Show table of known autonomous system paths authentication-whitelist Show 802.1X White List MAC addresses bfd Show Bidirectional Forwarding Detection information bgp Show Border Gateway Protocol information chassis Show chassis information class-of-service Show class-of-service (CoS) information cli Show command-line interface settings configuration Show current configuration connections Show circuit cross-connect connections database-replication Show database replication information dhcp Show Dynamic Host Configuration Protocol information dhcpv6 Show Dynamic Host Configuration Protocol v6 information dialer Show dialer information dot1x Show 802.1X information dvmrp Show Distance Vector Multicast Routing Protocol information dynamic-tunnels Show dynamic tunnel information information esis Show end system-to-intermediate system information ethernet-switching Show Ethernet-switching information
374 IBM Network Performance Insight 1.3.1: Network Performance Insight References
event-options Show event-options information firewall Show firewall information forwarding-options Show forwarding-options information gvrp Show Generic VLAN Registration Protocol information helper Show port-forwarding helper information hfrr Show information related to Host (Direct route) Fast reroute host Show hostname information from domain name server iccp Show Inter Chassis Control Protocol information igmp Show Internet Group Management Protocol information igmp-snooping Show IGMP snooping information ingress-replication Show Ingress-Replication tunnel information interfaces Show interface information ipv6 Show IP version 6 information isdn Show Integrated Services Digital Network information isis Show Intermediate System-to-Intermediate System information l2circuit Show Layer 2 circuit information l2vpn Show Layer 2 VPN information lacp Show Link Aggregation Control Protocol information ldp Show Label Distribution Protocol information lldp Show Link Layer Discovery Protocol information log Show contents of log file mld Show multicast listener discovery information mld-snooping Show MLD snooping information mpls Show mpls information msdp Show Multicast Source Discovery Protocol information multicast Show multicast information mvpn Show Multicast Virtual Private Network (MVPN) information network-access Show network-access related information ntp Show Network Time Protocol information oam Show OAM-related information ospf Show Open Shortest Path First information ospf3 Show Open Shortest Path First version 3 information pfe Show Packet Forwarding Engine information pgm Show Pragmatic Generalized Multicast information pim Show Protocol Independent Multicast information policer Show interface policer counters and information policy Show policy information ppp Show PPP process information pppoe Show PPP over Ethernet information r2cp Show Radio-to-Router Protocol information rip Show Routing Information Protocol information ripng Show Routing Information Protocol for IPv6 information route Show routing table information rsvp Show Resource Reservation Protocol information sap Show Session Announcement Protocol information schedulers Show the information on one or more schedulers security Show security information services Show services smtp Show Simple Mail Transfer Protocol information snmp Show Simple Network Management Protocol information spanning-tree Show Spanning Tree Protocol information system Show system information task Show routing protocol per-task information ted Show Traffic Engineering Database information tgm Show telephony gateway module information version Show software process revision levels vlans Show VLAN information vpls Show VPLS information vrrp Show Virtual Router Redundancy Protocol information wan-acceleration Show WAN acceleration module information
Reference 375
Verifying the configuration with show commandsTo verify that your configuration is correct, use these commands on the monitoring station that isconfigured for active flow monitoring.
About this task
show servicesshow services flow-monitoringshow services flow-monitoring version9 template <template_name>show services accounting errorsshow services accounting (flow | flow-detail)show services accounting memoryshow services accounting packet-size-distributionshow services accounting statusshow services accounting usageshow services accounting aggregation template template-name name (detail | extensive | terse)
Most active flow monitoring operational mode commands contain equivalent output information to thefollowing passive flow monitoring commands:
show services accounting errors = show passive-monitoring errorshow services accounting flow = show passive-monitoring flowshow services accounting memory = show passive-monitoring memoryshow services accounting status = show passive-monitoring statusshow services accounting usage = show passive-monitoring usage
The active flow monitoring commands can be used with most active flow monitoring applications,including sampling, discard accounting, port mirroring, and multiple port mirroring. The followingcommand shows the output of the show commands that are used with the configuration example:
user@router> show services accounting errors
Service Accounting interface: sp-2/0/0, Local interface index: 542Service name: (default sampling) Error information Packets dropped (no memory): 0, Packets dropped (not IP): 0 Packets dropped (not IPv4): 0, Packets dropped (header too small): 0 Memory allocation failures: 0, Memory free failures: 0 Memory free list failures: 0 Memory overload: No, PPS overload: No, BPS overload: Yes
user@router> show services accounting flow-detail limit 10
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Protocol Source Source Destination Destination Packet Byte Address Port Address Port count countudp(17) 10.1.1.2 53 10.0.0.1 53 4329 3386035ip(0) 10.1.1.2 0 10.0.0.2 0 4785 3719654ip(0) 10.1.1.2 0 10.0.1.2 0 4530 3518769udp(17) 10.1.1.2 0 10.0.7.1 0 5011 3916767tcp(6) 10.1.1.2 20 10.3.0.1 20 1 1494tcp(6) 10.1.1.2 20 10.168.80.1 20 1 677tcp(6) 10.1.1.2 20 10.69.192.1 20 1 446tcp(6) 10.1.1.2 20 10.239.240.1 20 1 1426tcp(6) 10.1.1.2 20 10.126.160.1 20 1 889tcp(6) 10.1.1.2 20 10.71.224.1 20 1 1046
user@router> show services accounting memory
376 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Memory utilization Allocation count: 437340, Free count: 430681, Maximum allocated: 6782 Allocations per second: 3366, Frees per second: 6412 Total memory used (in bytes): 133416928, Total memory free (in bytes): 133961744
user@router> show services accounting packet-size-distribution
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Range start Range end Number of packets Percentage packets 64 96 1705156 100
user@router> show services accounting status
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling) Interface state: Monitoring Group index: 0 Export interval: 60 secs, Export format: cflowd v5 Protocol: IPv4, Engine type: 55, Engine ID: 5 Route record count: 13, IFL to SNMP index count: 30, AS count: 1 Time set: Yes, Configuration set: Yes Route record set: Yes, IFL SNMP map set: Yes
user@router> show services accounting usage
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling) CPU utilization Uptime: 4790345 milliseconds, Interrupt time: 1668537848 microseconds Load (5 second): 71%, Load (1 minute): 63%
Related informationVerifying Your Work
Viewing device configurationAn example configuration for the J-Flow v9 template ipv4-test, flow collector 172.19.101.85 (port 2222)with sampling rate 1:100 and run length as 0.
For example, to view the configuration for the following set commands:
set services flow-monitoring version9 template ipv4-test ipv4-templateset forwarding-options sampling input rate 1set forwarding-options sampling input run-length 0set forwarding-options sampling family inet output flow-server 172.19.101.85 port2222set forwarding-options sampling family inet output flow-server 172.19.101.85version9 template ipv4-testset forwarding-options sampling family inet output inline-jflow source-address172.19.101.132set interfaces ge-0/0/14 unit 0 family inet sampling inputset interfaces ge-0/0/14 unit 0 family inet address 23.23.23.1/24
Give this command to view the details:
show configuration
Reference 377
Configuring NetStream traffic on Huawei devicesHuawei devices support NetStream flow, which is a supported flow type in Network Performance Insight.Related informationNetStream Configuration
Configuring NetStream exportHuawei NetStream works much like Cisco NetFlow. The NetStream process gathers detailed data aboutflows and stores them to a cache table. NetStream then processes the flow data from the cache table andsends it to Network Performance Insight for monitoring.
About this taskThere are export options for flow sampling, aggregation, and flow record content depending on how andwhat you are monitoring and how you need to export and report.
Commands Description
[RouterA] ip NetStream export host <hostname>|<ip_address> 9996
Enables NetStream onHuawei devices
ip NetStream export source interface <interface_name> Exports the NetStream datato a specified IP address.
[RouterA] ip NetStream sampler inbound 100
[RouterA] ip NetStream sampler outbound 100
Configures global sampling.
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address <IP_address1> <IP_address2>
Sets up an interface.
[RouterA-GigabitEthernet1/0/0] ip NetStream inbound
[RouterA-GigabitEthernet1/0/0] ip NetStream outbound
Enables NetStream statisticson the inbound and outboundinterfaces
378 IBM Network Performance Insight 1.3.1: Network Performance Insight References
Notices
This information was developed for products and services offered in the US. This material might beavailable from IBM in other languages. However, you may be required to own a copy of the product orproduct version in that language in order to access it.
IBM may not offer the products, services, or features discussed in this document in other countries.Consult your local IBM representative for information on the products and services currently available inyour area. Any reference to an IBM product, program, or service is not intended to state or imply that onlythat IBM product, program, or service may be used. Any functionally equivalent product, program, orservice that does not infringe any IBM intellectual property right may be used instead. However, it is theuser's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document.The furnishing of this document does not grant you any license to these patents. You can send licenseinquiries, in writing, to:
IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US
For license inquiries regarding double-byte character set (DBCS) information, contact the IBM IntellectualProperty Department in your country or send inquiries, in writing, to:
Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS"WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR APARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties incertain transactions, therefore, this statement may not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodicallymade to the information herein; these changes will be incorporated in new editions of the publication.IBM may make improvements and/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.
Any references in this information to non-IBM websites are provided for convenience only and do not inany manner serve as an endorsement of those websites. The materials at those websites are not part ofthe materials for this IBM product and use of those websites is at your own risk.
IBM may use or distribute any of the information you provide in any way it believes appropriate withoutincurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose of enabling: (i) theexchange of information between independently created programs and other programs (including thisone) and (ii) the mutual use of the information which has been exchanged, should contact:
IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US
© Copyright IBM Corp. 2015, 2019 379
Such information may be available, subject to appropriate terms and conditions, including in some cases,payment of a fee.
The licensed program described in this document and all licensed material available for it are provided byIBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or anyequivalent agreement between us.
The performance data discussed herein is presented as derived under specific operating conditions.Actual results may vary.
The client examples cited are presented for illustrative purposes only. Actual performance results mayvary depending on specific configurations and operating conditions.
Information concerning non-IBM products was obtained from the suppliers of those products, theirpublished announcements or other publicly available sources. IBM has not tested those products andcannot confirm the accuracy of performance, compatibility or any other claims related to non-IBMproducts. Questions on the capabilities of non-IBM products should be addressed to the suppliers ofthose products.
Statements regarding IBM's future direction or intent are subject to change or withdrawal without notice,and represent goals and objectives only.
All IBM prices shown are IBM's suggested retail prices, are current and are subject to change withoutnotice. Dealer prices may vary.
This information is for planning purposes only. The information herein is subject to change before theproducts described become available.
This information contains examples of data and reports used in daily business operations. To illustratethem as completely as possible, the examples include the names of individuals, companies, brands, andproducts. All of these names are fictitious and any similarity to actual people or business enterprises isentirely coincidental.
COPYRIGHT LICENSE:
This information contains sample application programs in source language, which illustrate programmingtechniques on various operating platforms. You may copy, modify, and distribute these sample programsin any form without payment to IBM, for the purposes of developing, using, marketing or distributingapplication programs conforming to the application programming interface for the operating platform forwhich the sample programs are written. These examples have not been thoroughly tested under allconditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of theseprograms. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not beliable for any damages arising out of your use of the sample programs.
Each copy or any portion of these sample programs or any derivative work must include a copyright noticeas follows:
© (your company name) (year).Portions of this code are derived from IBM Corp. Sample Programs.© Copyright IBM Corp. _enter the year or years_.
TrademarksIBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International BusinessMachines Corp., registered in many jurisdictions worldwide. Other product and service names might betrademarks of IBM or other companies. A current list of IBM trademarks is available on the web at"Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered trademarks ortrademarks of Adobe Systems Incorporated in the United States, other countries, or both.
IT Infrastructure Library is a registered trademark of the Central Computer and TelecommunicationsAgency which is now part of the Office of Government Commerce.
380 Notices
Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon,Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation orits subsidiaries in the United States and other countries.
Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both
Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, orboth.
ITIL is a registered trademark, and a registered community trademark of The Minister for the CabinetOffice, and is registered in the U.S. Patent and Trademark Office.
UNIX is a registered trademark of The Open Group in the United States and other countries.
Java and all Java-based trademarks and logos aretrademarks or registered trademarks of Oracleand/or its affiliates.
Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, othercountries, or both and is used under license therefrom.
Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. andQuantum in the U.S. and other countries.
Terms and conditions for product documentationPermissions for the use of these publications are granted subject to the following terms and conditions.
Applicability
These terms and conditions are in addition to any terms of use for the IBM website.
Personal use
You may reproduce these publications for your personal, noncommercial use provided that all proprietarynotices are preserved. You may not distribute, display or make derivative work of these publications, orany portion thereof, without the express consent of IBM.
Commercial use
You may reproduce, distribute and display these publications solely within your enterprise provided thatall proprietary notices are preserved. You may not make derivative works of these publications, orreproduce, distribute or display these publications or any portion thereof outside your enterprise, withoutthe express consent of IBM.
Rights
Except as expressly granted in this permission, no other permissions, licenses or rights are granted, eitherexpress or implied, to the publications or any information, data, software or other intellectual propertycontained therein.
IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use ofthe publications is detrimental to its interest or, as determined by IBM, the above instructions are notbeing properly followed.
You may not download, export or re-export this information except in full compliance with all applicablelaws and regulations, including all United States export laws and regulations.
IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS AREPROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
Notices 381
INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT,AND FITNESS FOR A PARTICULAR PURPOSE.
382 IBM Network Performance Insight 1.3.1: Network Performance Insight References
IBM®