logstash-codec-netflow 3.10.0 → 3.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 23f25a4dd41e18de926001edf51d595b28f32bba
-  data.tar.gz: a7844a2a74423c4ee1da1e0a3b94120d5cbd323a
+  metadata.gz: 07ad48d13787699e6d90dab262c0567edc948c97
+  data.tar.gz: 30153eba0e146d5f3a368bb3c42b0e276ebe5a36
 SHA512:
-  metadata.gz: c0ff89f1a8f9d9bc771dd80e724ee9f019ea97f3c13bb893226e599e69e82a26911e6a6fe213e0cab87bdc675aa84779bd894bfb678cd8236649d16cc091d297
-  data.tar.gz: 5f6826dcd84eb0fbba51b0ec6fb47ed83dc08b689b778c04b131f2877dd36baca8e16a71b59d89bf907e6d4ae88e64f7b569bcd81b0dc8fea07b89b978770f0e
+  metadata.gz: 069225ea9353e4b785eb7e3bea887372c5a9c958e03ce418d407a2c728b4ff2c69da24af2d48dfb94b34cb9ea0b41e743ad778ca68a3074eecf1beee3d916cda
+  data.tar.gz: 77677faa328a265d3b2e8750cc9bdbc85ff81728f33b7e0ebd374b9f1c30e9383e588d2c9da9f1e9d02254a2dc693e7cb5e4d2c347f9307177165136cc88dbdb

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 3.11.0
+
+  - Updated Netflow v9 IE coverage from 10% to 90%
+  - Added support for Huawei Netstream
+
 ## 3.10.0
 
   - Added support for Nokia BRAS

data/CONTRIBUTORS

@@ -39,6 +39,7 @@ Contributors:
 * jstopinsek
 * sliddjur
 * szhong12
+* zwirk
 
 Maintainer:
 * Jorrit Folmer (jorritfolmer)

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2012–2016 Elasticsearch <http://www.elastic.co>
+Copyright (c) 2012-2018 Elasticsearch <http://www.elastic.co>
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

data/RFC_COMPLIANCE_NETFLOW_v9.md

@@ -7,7 +7,7 @@ The level of RFC compliance reached for collector-relevant requirements:
 | RFC 3954  | 100% of RFC "MUST" requirements implemented  |
 | RFC 3954  | 0% of RFC "SHOULD" requirements implemented  |  
 | RFC 3954  | 83% of IEs 1-127 supported                   |
-| RFC 3954  | 10% of IEs 127-32768 supported               |
+| RFC 3954  | 90% of IEs 127-32768 supported               |
 
 ## RFC 3954 collector compliance summary
 
@@ -97,276 +97,6 @@ From the IEs 128-, these are not yet supported:
 
 |id | name         |data type       
 |---|--------------|-----
-|128|bgpNextAdjacentAsNumber|unsigned32
-|129|bgpPrevAdjacentAsNumber|unsigned32
-|130|exporterIPv4Address|ipv4Address
-|131|exporterIPv6Address|ipv6Address
-|132|droppedOctetDeltaCount|unsigned64
-|133|droppedPacketDeltaCount|unsigned64
-|134|droppedOctetTotalCount|unsigned64
-|135|droppedPacketTotalCount|unsigned64
-|137|commonPropertiesId|unsigned64
-|138|observationPointId|unsigned64
-|139|icmpTypeCodeIPv6|unsigned16
-|140|mplsTopLabelIPv6Address|ipv6Address
-|141|lineCardId|unsigned32
-|142|portId|unsigned32
-|143|meteringProcessId|unsigned32
-|144|exportingProcessId|unsigned32
-|145|templateId|unsigned16
-|146|wlanChannelId|unsigned8
-|149|observationDomainId|unsigned32
-|150|flowStartSeconds|dateTimeSeconds
-|151|flowEndSeconds|dateTimeSeconds
-|153|flowEndMilliseconds|dateTimeMilliseconds
-|154|flowStartMicroseconds|dateTimeMicroseconds
-|155|flowEndMicroseconds|dateTimeMicroseconds
-|156|flowStartNanoseconds|dateTimeNanoseconds
-|157|flowEndNanoseconds|dateTimeNanoseconds
-|158|flowStartDeltaMicroseconds|unsigned32
-|159|flowEndDeltaMicroseconds|unsigned32
-|160|systemInitTimeMilliseconds|dateTimeMilliseconds
-|161|flowDurationMilliseconds|unsigned32
-|162|flowDurationMicroseconds|unsigned32
-|163|observedFlowTotalCount|unsigned64
-|164|ignoredPacketTotalCount|unsigned64
-|165|ignoredOctetTotalCount|unsigned64
-|166|notSentFlowTotalCount|unsigned64
-|167|notSentPacketTotalCount|unsigned64
-|168|notSentOctetTotalCount|unsigned64
-|169|destinationIPv6Prefix|ipv6Address
-|170|sourceIPv6Prefix|ipv6Address
-|171|postOctetTotalCount|unsigned64
-|172|postPacketTotalCount|unsigned64
-|173|flowKeyIndicator|unsigned64
-|174|postMCastPacketTotalCount|unsigned64
-|175|postMCastOctetTotalCount|unsigned64
-|184|tcpSequenceNumber|unsigned32
-|185|tcpAcknowledgementNumber|unsigned32
-|186|tcpWindowSize|unsigned16
-|187|tcpUrgentPointer|unsigned16
-|188|tcpHeaderLength|unsigned8
-|189|ipHeaderLength|unsigned8
-|190|totalLengthIPv4|unsigned16
-|191|payloadLengthIPv6|unsigned16
-|192|ipTTL|unsigned8
-|193|nextHeaderIPv6|unsigned8
-|196|ipPrecedence|unsigned8
-|197|fragmentFlags|unsigned8
-|198|octetDeltaSumOfSquares|unsigned64
-|199|octetTotalSumOfSquares|unsigned64
-|200|mplsTopLabelTTL|unsigned8
-|202|mplsLabelStackDepth|unsigned32
-|203|mplsTopLabelExp|unsigned8
-|204|ipPayloadLength|unsigned32
-|205|udpMessageLength|unsigned16
-|206|isMulticast|unsigned8
-|207|ipv4IHL|unsigned8
-|208|ipv4Options|unsigned32
-|209|tcpOptions|unsigned64
-|210|paddingOctets|octetArray
-|211|collectorIPv4Address|ipv4Address
-|212|collectorIPv6Address|ipv6Address
-|213|exportInterface|unsigned32
-|214|exportProtocolVersion|unsigned8
-|215|exportTransportProtocol|unsigned8
-|216|collectorTransportPort|unsigned16
-|217|exporterTransportPort|unsigned16
-|218|tcpSynTotalCount|unsigned64
-|219|tcpFinTotalCount|unsigned64
-|220|tcpRstTotalCount|unsigned64
-|221|tcpPshTotalCount|unsigned64
-|222|tcpAckTotalCount|unsigned64
-|223|tcpUrgTotalCount|unsigned64
-|224|ipTotalLength|unsigned64
-|229|natOriginatingAddressRealm|unsigned8
-|230|natEvent|unsigned8
-|237|postMplsTopLabelExp|unsigned8
-|238|tcpWindowScale|unsigned16
-|239|biflowDirection|unsigned8
-|240|ethernetHeaderLength|unsigned8
-|241|ethernetPayloadLength|unsigned16
-|242|ethernetTotalLength|unsigned16
-|243|dot1qVlanId|unsigned16
-|244|dot1qPriority|unsigned8
-|245|dot1qCustomerVlanId|unsigned16
-|246|dot1qCustomerPriority|unsigned8
-|247|metroEvcId|string
-|248|metroEvcType|unsigned8
-|249|pseudoWireId|unsigned32
-|250|pseudoWireType|unsigned16
-|251|pseudoWireControlWord|unsigned32
-|252|ingressPhysicalInterface|unsigned32
-|253|egressPhysicalInterface|unsigned32
-|254|postDot1qVlanId|unsigned16
-|255|postDot1qCustomerVlanId|unsigned16
-|256|ethernetType|unsigned16
-|257|postIpPrecedence|unsigned8
-|258|collectionTimeMilliseconds|dateTimeMilliseconds
-|259|exportSctpStreamId|unsigned16
-|260|maxExportSeconds|dateTimeSeconds
-|261|maxFlowEndSeconds|dateTimeSeconds
-|262|messageMD5Checksum|octetArray
-|263|messageScope|unsigned8
-|264|minExportSeconds|dateTimeSeconds
-|265|minFlowStartSeconds|dateTimeSeconds
-|266|opaqueOctets|octetArray
-|267|sessionScope|unsigned8
-|268|maxFlowEndMicroseconds|dateTimeMicroseconds
-|269|maxFlowEndMilliseconds|dateTimeMilliseconds
-|270|maxFlowEndNanoseconds|dateTimeNanoseconds
-|271|minFlowStartMicroseconds|dateTimeMicroseconds
-|272|minFlowStartMilliseconds|dateTimeMilliseconds
-|273|minFlowStartNanoseconds|dateTimeNanoseconds
-|274|collectorCertificate|octetArray
-|275|exporterCertificate|octetArray
-|276|dataRecordsReliability|boolean
-|277|observationPointType|unsigned8
-|278|newConnectionDeltaCount|unsigned32
-|279|connectionSumDurationSeconds|unsigned64
-|280|connectionTransactionId|unsigned64
-|283|natPoolId|unsigned32
-|284|natPoolName|string
-|285|anonymizationFlags|unsigned16
-|286|anonymizationTechnique|unsigned16
-|287|informationElementIndex|unsigned16
-|288|p2pTechnology|string
-|289|tunnelTechnology|string
-|290|encryptedTechnology|string
-|291|basicList|basicList
-|292|subTemplateList|subTemplateList
-|293|subTemplateMultiList|subTemplateMultiList
-|294|bgpValidityState|unsigned8
-|295|IPSecSPI|unsigned32
-|296|greKey|unsigned32
-|297|natType|unsigned8
-|300|observationDomainName|string
-|301|selectionSequenceId|unsigned64
-|302|selectorId|unsigned64
-|303|informationElementId|unsigned16
-|304|selectorAlgorithm|unsigned16
-|305|samplingPacketInterval|unsigned32
-|306|samplingPacketSpace|unsigned32
-|307|samplingTimeInterval|unsigned32
-|308|samplingTimeSpace|unsigned32
-|309|samplingSize|unsigned32
-|310|samplingPopulation|unsigned32
-|311|samplingProbability|float64
-|312|dataLinkFrameSize|unsigned16
-|313|ipHeaderPacketSection|octetArray
-|314|ipPayloadPacketSection|octetArray
-|315|dataLinkFrameSection|octetArray
-|316|mplsLabelStackSection|octetArray
-|317|mplsPayloadPacketSection|octetArray
-|318|selectorIdTotalPktsObserved|unsigned64
-|319|selectorIdTotalPktsSelected|unsigned64
-|320|absoluteError|float64
-|321|relativeError|float64
-|322|observationTimeSeconds|dateTimeSeconds
-|324|observationTimeMicroseconds|dateTimeMicroseconds
-|325|observationTimeNanoseconds|dateTimeNanoseconds
-|326|digestHashValue|unsigned64
-|327|hashIPPayloadOffset|unsigned64
-|328|hashIPPayloadSize|unsigned64
-|329|hashOutputRangeMin|unsigned64
-|330|hashOutputRangeMax|unsigned64
-|331|hashSelectedRangeMin|unsigned64
-|332|hashSelectedRangeMax|unsigned64
-|333|hashDigestOutput|boolean
-|334|hashInitialiserValue|unsigned64
-|335|selectorName|string
-|336|upperCILimit|float64
-|337|lowerCILimit|float64
-|338|confidenceLevel|float64
-|339|informationElementDataType|unsigned8
-|340|informationElementDescription|string
-|341|informationElementName|string
-|342|informationElementRangeBegin|unsigned64
-|343|informationElementRangeEnd|unsigned64
-|344|informationElementSemantics|unsigned8
-|345|informationElementUnits|unsigned16
-|347|virtualStationInterfaceId|octetArray
-|348|virtualStationInterfaceName|string
-|349|virtualStationUUID|octetArray
-|350|virtualStationName|string
-|351|layer2SegmentId|unsigned64
-|352|layer2OctetDeltaCount|unsigned64
-|353|layer2OctetTotalCount|unsigned64
-|354|ingressUnicastPacketTotalCount|unsigned64
-|355|ingressMulticastPacketTotalCount|unsigned64
-|356|ingressBroadcastPacketTotalCount|unsigned64
-|357|egressUnicastPacketTotalCount|unsigned64
-|358|egressBroadcastPacketTotalCount|unsigned64
-|359|monitoringIntervalStartMilliSeconds|dateTimeMilliseconds
-|360|monitoringIntervalEndMilliSeconds|dateTimeMilliseconds
-|363|portRangeStepSize|unsigned16
-|364|portRangeNumPorts|unsigned16
-|368|ingressInterfaceType|unsigned32
-|369|egressInterfaceType|unsigned32
-|370|rtpSequenceNumber|unsigned16
-|371|userName|string
-|372|applicationCategoryName|string
-|373|applicationSubCategoryName|string
-|374|applicationGroupName|string
-|375|originalFlowsPresent|unsigned64
-|376|originalFlowsInitiated|unsigned64
-|377|originalFlowsCompleted|unsigned64
-|378|distinctCountOfSourceIPAddress|unsigned64
-|379|distinctCountOfDestinationIPAddress|unsigned64
-|380|distinctCountOfSourceIPv4Address|unsigned32
-|381|distinctCountOfDestinationIPv4Address|unsigned32
-|382|distinctCountOfSourceIPv6Address|unsigned64
-|383|distinctCountOfDestinationIPv6Address|unsigned64
-|384|valueDistributionMethod|unsigned8
-|385|rfc3550JitterMilliseconds|unsigned32
-|386|rfc3550JitterMicroseconds|unsigned32
-|387|rfc3550JitterNanoseconds|unsigned32
-|388|dot1qDEI|boolean
-|389|dot1qCustomerDEI|boolean
-|390|flowSelectorAlgorithm|unsigned16
-|391|flowSelectedOctetDeltaCount|unsigned64
-|392|flowSelectedPacketDeltaCount|unsigned64
-|393|flowSelectedFlowDeltaCount|unsigned64
-|394|selectorIDTotalFlowsObserved|unsigned64
-|395|selectorIDTotalFlowsSelected|unsigned64
-|396|samplingFlowInterval|unsigned64
-|397|samplingFlowSpacing|unsigned64
-|398|flowSamplingTimeInterval|unsigned64
-|399|flowSamplingTimeSpacing|unsigned64
-|400|hashFlowDomain|unsigned16
-|401|transportOctetDeltaCount|unsigned64
-|402|transportPacketDeltaCount|unsigned64
-|403|originalExporterIPv4Address|ipv4Address
-|404|originalExporterIPv6Address|ipv6Address
-|405|originalObservationDomainId|unsigned32
-|406|intermediateProcessId|unsigned32
-|407|ignoredDataRecordTotalCount|unsigned64
-|408|dataLinkFrameType|unsigned16
-|409|sectionOffset|unsigned16
-|410|sectionExportedOctets|unsigned16
-|411|dot1qServiceInstanceTag|octetArray
-|412|dot1qServiceInstanceId|unsigned32
-|413|dot1qServiceInstancePriority|unsigned8
-|414|dot1qCustomerSourceMacAddress|macAddress
-|415|dot1qCustomerDestinationMacAddress|macAddress
-|416||
-|417|postLayer2OctetDeltaCount|unsigned64
-|418|postMCastLayer2OctetDeltaCount|unsigned64
-|419||
-|420|postLayer2OctetTotalCount|unsigned64
-|421|postMCastLayer2OctetTotalCount|unsigned64
-|422|minimumLayer2TotalLength|unsigned64
-|423|maximumLayer2TotalLength|unsigned64
-|424|droppedLayer2OctetDeltaCount|unsigned64
-|425|droppedLayer2OctetTotalCount|unsigned64
-|426|ignoredLayer2OctetTotalCount|unsigned64
-|427|notSentLayer2OctetTotalCount|unsigned64
-|428|layer2OctetDeltaSumOfSquares|unsigned64
-|429|layer2OctetTotalSumOfSquares|unsigned64
-|430|layer2FrameDeltaCount|unsigned64
-|431|layer2FrameTotalCount|unsigned64
-|432|pseudoWireDestinationIPv4Address|ipv4Address
-|433|ignoredLayer2FrameTotalCount|unsigned64
 |434|mibObjectValueInteger|signed32
 |435|mibObjectValueOctetString|octetArray
 |436|mibObjectValueOID|octetArray

data/docs/index.asciidoc

@@ -45,6 +45,7 @@ The following Netflow/IPFIX exporters are known to work with the most recent ver
 |Citrix Netscaler         |    |    |   y   | Still some unknown fields, labeled netscalerUnknown<id>
 |fprobe                   |  y |    |       |
 |Fortigate FortiOS        |    | y  |       |
+|Huawei Netstream         |    | y  |       |
 |ipt_NETFLOW              |  y | y  |   y   |
 |Juniper MX80             |  y |    |       | SW > 12.3R8
 |Mikrotik                 |  y |    |   y   | http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow
@@ -74,7 +75,9 @@ input {
 }
 --------------------------
 
-For high-performance production environments the configuration below will decode up to 15000 flows/sec on a dedicated 16 CPU instance. If your total flowrate exceeds 15000 flows/sec, you should use multiple Logstash instances.
+For high-performance production environments the configuration below will decode up to 15000 flows/sec from a Cisco ASR 9000 router on a dedicated 16 CPU instance. If your total flowrate exceeds 15000 flows/sec, you should use multiple Logstash instances.
+
+Note that for richer flows from a Cisco ASA firewall this number will be at least 3x lower.
 
 [source, ruby]
 --------------------------

data/lib/logstash/codecs/netflow/netflow.yaml

@@ -235,15 +235,72 @@
 98:
 - :uint8
 - :postIpDiffServCodePoint
+128:
+- :uint32
+- :bgpNextAdjacentAsNumber
+129:
+- :uint32
+- :bgpPrevAdjacentAsNumber
+130:
+- :ip4_addr
+- :exporterIPv4Address
+131:
+- :ip6_addr
+- :exporterIPv6Address
+132:
+- :uint64
+- :droppedOctetDeltaCount
+133:
+- :uint64
+- :droppedPacketDeltaCount
+134:
+- :uint64
+- :droppedOctetTotalCount
+135:
+- :uint64
+- :droppedPacketTotalCount
 136:
 - :uint8
 - :flow_end_reason
+137:
+- :uint64
+- :commonPropertiesId
+138:
+- :uint64
+- :observationPointId
+139:
+- :uint16
+- :icmpTypeCodeIPv6
+140:
+- :ip6_addr
+- :mplsTopLabelIPv6Address
+141:
+- :uint32
+- :lineCardId
+142:
+- :uint32
+- :portId
+143:
+- :uint32
+- :meteringProcessId
+144:
+- :uint32
+- :exportingProcessId
+145:
+- :uint16
+- :templateId
+146:
+- :uint8
+- :wlanChannelId
 147:
 - :string
 - :wlanSSID
 148:
 - :uint32
 - :conn_id
+149:
+- :uint32
+- :observationDomainId
 150:
 - :uint32
 - :flowStartSeconds
@@ -262,6 +319,66 @@
 155:
 - :uint64
 - :flowEndMicroseconds
+156:
+- :uint64
+- :flowStartNanoseconds
+157:
+- :uint64
+- :flowEndNanoseconds
+158:
+- :uint32
+- :flowStartDeltaMicroseconds
+159:
+- :uint32
+- :flowEndDeltaMicroseconds
+160:
+- :uint64
+- :systemInitTimeMilliseconds
+161:
+- :uint32
+- :flowDurationMilliseconds
+162:
+- :uint32
+- :flowDurationMicroseconds
+163:
+- :uint64
+- :observedFlowTotalCount
+164:
+- :uint64
+- :ignoredPacketTotalCount
+165:
+- :uint64
+- :ignoredOctetTotalCount
+166:
+- :uint64
+- :notSentFlowTotalCount
+167:
+- :uint64
+- :notSentPacketTotalCount
+168:
+- :uint64
+- :notSentOctetTotalCount
+169:
+- :ip6_addr
+- :destinationIPv6Prefix
+170:
+- :ip6_addr
+- :sourceIPv6Prefix
+171:
+- :uint64
+- :postOctetTotalCount
+172:
+- :uint64
+- :postPacketTotalCount
+173:
+- :uint64
+- :flowKeyIndicator
+174:
+- :uint64
+- :postMCastPacketTotalCount
+175:
+- :uint64
+- :postMCastOctetTotalCount
 176:
 - :uint8
 - :icmp_type
@@ -286,15 +403,131 @@
 183:
 - :uint16
 - :tcp_dst_port
+183:
+- :uint16
+- :tcpDestinationPort
+184:
+- :uint32
+- :tcpSequenceNumber
+185:
+- :uint32
+- :tcpAcknowledgementNumber
+186:
+- :uint16
+- :tcpWindowSize
+187:
+- :uint16
+- :tcpUrgentPointer
+188:
+- :uint8
+- :tcpHeaderLength
+189:
+- :uint8
+- :ipHeaderLength
+190:
+- :uint16
+- :totalLengthIPv4
+191:
+- :uint16
+- :payloadLengthIPv6
+192:
+- :uint8
+- :ipTTL
+193:
+- :uint8
+- :nextHeaderIPv6
 194:
 - :uint8
 - :ip_tos
 195:
 - :uint8
 - :ip_dscp
+196:
+- :uint8
+- :ipPrecedence
+197:
+- :uint8
+- :fragmentFlags
+198:
+- :uint64
+- :octetDeltaSumOfSquares
+199:
+- :uint64
+- :octetTotalSumOfSquares
+200:
+- :uint8
+- :mplsTopLabelTTL
 201:
 - mpls_label_stack_octets
 - mpls_label_stack_octets
+202:
+- :uint32
+- :mplsLabelStackDepth
+203:
+- :uint8
+- :mplsTopLabelExp
+204:
+- :uint32
+- :ipPayloadLength
+205:
+- :uint16
+- :udpMessageLength
+206:
+- :uint8
+- :isMulticast
+207:
+- :uint8
+- :ipv4IHL
+208:
+- :uint32
+- :ipv4Options
+209:
+- :uint64
+- :tcpOptions
+210:
+- :skip
+211:
+- :ip4_addr
+- :collectorIPv4Address
+212:
+- :ip6_addr
+- :collectorIPv6Address
+213:
+- :uint32
+- :exportInterface
+214:
+- :uint8
+- :exportProtocolVersion
+215:
+- :uint8
+- :exportTransportProtocol
+216:
+- :uint16
+- :collectorTransportPort
+217:
+- :uint16
+- :exporterTransportPort
+218:
+- :uint64
+- :tcpSynTotalCount
+219:
+- :uint64
+- :tcpFinTotalCount
+220:
+- :uint64
+- :tcpRstTotalCount
+221:
+- :uint64
+- :tcpPshTotalCount
+222:
+- :uint64
+- :tcpAckTotalCount
+223:
+- :uint64
+- :tcpUrgTotalCount
+224:
+- :uint64
+- :ipTotalLength
 225:
 - :ip4_addr
 - :xlate_src_addr_ipv4
@@ -307,6 +540,12 @@
 228:
 - :uint16
 - :xlate_dst_port
+229:
+- :uint8
+- :natOriginatingAddressRealm
+230:
+- :uint8
+- :natEvent
 231:
 - :uint32 
 - :fwd_flow_delta_bytes
@@ -325,33 +564,387 @@
 236:
 - :string
 - :VRFname
+237:
+- :uint8
+- :postMplsTopLabelExp
+238:
+- :uint16
+- :tcpWindowScale
+239:
+- :uint8
+- :biflowDirection
+240:
+- :uint8
+- :ethernetHeaderLength
+241:
+- :uint16
+- :ethernetPayloadLength
+242:
+- :uint16
+- :ethernetTotalLength
 243:
 - :uint16
 - :dot1qVlanId
+244:
+- :uint8
+- :dot1qPriority
+245:
+- :uint16
+- :dot1qCustomerVlanId
+246:
+- :uint8
+- :dot1qCustomerPriority
+247:
+- :string
+- :metroEvcId
+248:
+- :uint8
+- :metroEvcType
+249:
+- :uint32
+- :pseudoWireId
+250:
+- :uint16
+- :pseudoWireType
+251:
+- :uint32
+- :pseudoWireControlWord
+252:
+- :uint32
+- :ingressPhysicalInterface
+253:
+- :uint32
+- :egressPhysicalInterface
+254:
+- :uint16
+- :postDot1qVlanId
+255:
+- :uint16
+- :postDot1qCustomerVlanId
+256:
+- :uint16
+- :ethernetType
+257:
+- :uint8
+- :postIpPrecedence
+258:
+- :uint64
+- :collectionTimeMilliseconds
+259:
+- :uint16
+- :exportSctpStreamId
+260:
+- :uint32
+- :maxExportSeconds
+261:
+- :uint32
+- :maxFlowEndSeconds
+262:
+- :string
+- :messageMD5Checksum
+263:
+- :uint8
+- :messageScope
+264:
+- :uint32
+- :minExportSeconds
+265:
+- :uint32
+- :minFlowStartSeconds
+266:
+- :string
+- :opaqueOctets
+267:
+- :uint8
+- :sessionScope
+268:
+- :uint64
+- :maxFlowEndMicroseconds
+269:
+- :uint64
+- :maxFlowEndMilliseconds
+270:
+- :uint64
+- :maxFlowEndNanoseconds
+271:
+- :uint64
+- :minFlowStartMicroseconds
+272:
+- :uint64
+- :minFlowStartMilliseconds
+273:
+- :uint64
+- :minFlowStartNanoseconds
+274:
+- :string
+- :collectorCertificate
+275:
+- :string
+- :exporterCertificate
+276:
+- :uint8
+- :dataRecordsReliability
+277:
+- :uint8
+- :observationPointType
+278:
+- :uint32
+- :newConnectionDeltaCount
+279:
+- :uint64
+- :connectionSumDurationSeconds
+280:
+- :uint64
+- :connectionTransactionId
 281:
 - :ip6_addr
 - :xlate_src_addr_ipv6
 282:
 - :ip6_addr
 - :xlate_dst_addr_ipv6
+283:
+- :uint32
+- :natPoolId
+284:
+- :string
+- :natPoolName
+285:
+- :uint16
+- :anonymizationFlags
+286:
+- :uint16
+- :anonymizationTechnique
+287:
+- :uint16
+- :informationElementIndex
+288:
+- :string
+- :p2pTechnology
+289:
+- :string
+- :tunnelTechnology
+290:
+- :string
+- :encryptedTechnology
+291:
+- :skip
+292:
+- :skip
+293:
+- :skip
+294:
+- :uint8
+- :bgpValidityState
+295:
+- :uint32
+- :IPSecSPI
+296:
+- :uint32
+- :greKey
+297:
+- :uint8
+- :natType
 298:
 - :uint64
 - :initiatorPackets
 299:
 - :uint64
 - :responderPackets
+300:
+- :string
+- :observationDomainName
+301:
+- :uint64
+- :selectionSequenceId
+302:
+- :uint64
+- :selectorId
+303:
+- :uint16
+- :informationElementId
+304:
+- :uint16
+- :selectorAlgorithm
+305:
+- :uint32
+- :samplingPacketInterval
+306:
+- :uint32
+- :samplingPacketSpace
+307:
+- :uint32
+- :samplingTimeInterval
+308:
+- :uint32
+- :samplingTimeSpace
+309:
+- :uint32
+- :samplingSize
+310:
+- :uint32
+- :samplingPopulation
+311:
+- :double
+- :samplingProbability
+312:
+- :uint16
+- :dataLinkFrameSize
+313:
+- :string
+- :ipHeaderPacketSection
+314:
+- :string
+- :ipPayloadPacketSection
+315:
+- :string
+- :dataLinkFrameSection
+316:
+- :string
+- :mplsLabelStackSection
+317:
+- :string
+- :mplsPayloadPacketSection
+318:
+- :uint64
+- :selectorIdTotalPktsObserved
+319:
+- :uint64
+- :selectorIdTotalPktsSelected
+320:
+- :double
+- :absoluteError
+321:
+- :double
+- :relativeError
+322:
+- :uint32
+- :observationTimeSeconds
 323:
 - 8
 - :event_time_msec
+324:
+- :uint64
+- :observationTimeMicroseconds
+325:
+- :uint64
+- :observationTimeNanoseconds
+326:
+- :uint64
+- :digestHashValue
+327:
+- :uint64
+- :hashIPPayloadOffset
+328:
+- :uint64
+- :hashIPPayloadSize
+329:
+- :uint64
+- :hashOutputRangeMin
+330:
+- :uint64
+- :hashOutputRangeMax
+331:
+- :uint64
+- :hashSelectedRangeMin
+332:
+- :uint64
+- :hashSelectedRangeMax
+333:
+- :uint8
+- :hashDigestOutput
+334:
+- :uint64
+- :hashInitialiserValue
+335:
+- :string
+- :selectorName
+336:
+- :double
+- :upperCILimit
+337:
+- :double
+- :lowerCILimit
+338:
+- :double
+- :confidenceLevel
+339:
+- :uint8
+- :informationElementDataType
+340:
+- :string
+- :informationElementDescription
+341:
+- :string
+- :informationElementName
+342:
+- :uint64
+- :informationElementRangeBegin
+343:
+- :uint64
+- :informationElementRangeEnd
+344:
+- :uint8
+- :informationElementSemantics
+345:
+- :uint16
+- :informationElementUnits
 346:
 - :uint32
 - :privateEnterpriseNumber
+347:
+- :string
+- :virtualStationInterfaceId
+348:
+- :string
+- :virtualStationInterfaceName
+349:
+- :string
+- :virtualStationUUID
+350:
+- :string
+- :virtualStationName
+351:
+- :uint64
+- :layer2SegmentId
+352:
+- :uint64
+- :layer2OctetDeltaCount
+353:
+- :uint64
+- :layer2OctetTotalCount
+354:
+- :uint64
+- :ingressUnicastPacketTotalCount
+355:
+- :uint64
+- :ingressMulticastPacketTotalCount
+356:
+- :uint64
+- :ingressBroadcastPacketTotalCount
+357:
+- :uint64
+- :egressUnicastPacketTotalCount
+358:
+- :uint64
+- :egressBroadcastPacketTotalCount
+359:
+- :uint64
+- :monitoringIntervalStartMilliSeconds
+360:
+- :uint64
+- :monitoringIntervalEndMilliSeconds
 361:
 - :uint16
 - :postNATPortBlockStart
 362:
 - :uint16
 - :postNATPortBlockEnd
+363:
+- :uint16
+- :portRangeStepSize
+364:
+- :uint16
+- :portRangeNumPorts
 365:
 - :mac_addr
 - :staMacAddress
@@ -361,12 +954,198 @@
 367:
 - :mac_addr
 - :wtpMacAddress
+368:
+- :uint32
+- :ingressInterfaceType
+369:
+- :uint32
+- :egressInterfaceType
+370:
+- :uint16
+- :rtpSequenceNumber
 371:
 - :string
 - :userName
 372:
 - :string
 - :applicationCategoryName
+373:
+- :string
+- :applicationSubCategoryName
+374:
+- :string
+- :applicationGroupName
+375:
+- :uint64
+- :originalFlowsPresent
+376:
+- :uint64
+- :originalFlowsInitiated
+377:
+- :uint64
+- :originalFlowsCompleted
+378:
+- :uint64
+- :distinctCountOfSourceIPAddress
+379:
+- :uint64
+- :distinctCountOfDestinationIPAddress
+380:
+- :uint32
+- :distinctCountOfSourceIPv4Address
+381:
+- :uint32
+- :distinctCountOfDestinationIPv4Address
+382:
+- :uint64
+- :distinctCountOfSourceIPv6Address
+383:
+- :uint64
+- :distinctCountOfDestinationIPv6Address
+384:
+- :uint8
+- :valueDistributionMethod
+385:
+- :uint32
+- :rfc3550JitterMilliseconds
+386:
+- :uint32
+- :rfc3550JitterMicroseconds
+387:
+- :uint32
+- :rfc3550JitterNanoseconds
+388:
+- :uint8
+- :dot1qDEI
+389:
+- :uint8
+- :dot1qCustomerDEI
+390:
+- :uint16
+- :flowSelectorAlgorithm
+391:
+- :uint64
+- :flowSelectedOctetDeltaCount
+392:
+- :uint64
+- :flowSelectedPacketDeltaCount
+393:
+- :uint64
+- :flowSelectedFlowDeltaCount
+394:
+- :uint64
+- :selectorIDTotalFlowsObserved
+395:
+- :uint64
+- :selectorIDTotalFlowsSelected
+396:
+- :uint64
+- :samplingFlowInterval
+397:
+- :uint64
+- :samplingFlowSpacing
+398:
+- :uint64
+- :flowSamplingTimeInterval
+399:
+- :uint64
+- :flowSamplingTimeSpacing
+400:
+- :uint16
+- :hashFlowDomain
+401:
+- :uint64
+- :transportOctetDeltaCount
+402:
+- :uint64
+- :transportPacketDeltaCount
+403:
+- :ip4_addr
+- :originalExporterIPv4Address
+404:
+- :ip6_addr
+- :originalExporterIPv6Address
+405:
+- :uint32
+- :originalObservationDomainId
+406:
+- :uint32
+- :intermediateProcessId
+407:
+- :uint64
+- :ignoredDataRecordTotalCount
+408:
+- :uint16
+- :dataLinkFrameType
+409:
+- :uint16
+- :sectionOffset
+410:
+- :uint16
+- :sectionExportedOctets
+411:
+- :string
+- :dot1qServiceInstanceTag
+412:
+- :uint32
+- :dot1qServiceInstanceId
+413:
+- :uint8
+- :dot1qServiceInstancePriority
+414:
+- :mac_addr
+- :dot1qCustomerSourceMacAddress
+415:
+- :mac_addr
+- :dot1qCustomerDestinationMacAddress
+417:
+- :uint64
+- :postLayer2OctetDeltaCount
+418:
+- :uint64
+- :postMCastLayer2OctetDeltaCount
+420:
+- :uint64
+- :postLayer2OctetTotalCount
+421:
+- :uint64
+- :postMCastLayer2OctetTotalCount
+422:
+- :uint64
+- :minimumLayer2TotalLength
+423:
+- :uint64
+- :maximumLayer2TotalLength
+424:
+- :uint64
+- :droppedLayer2OctetDeltaCount
+425:
+- :uint64
+- :droppedLayer2OctetTotalCount
+426:
+- :uint64
+- :ignoredLayer2OctetTotalCount
+427:
+- :uint64
+- :notSentLayer2OctetTotalCount
+428:
+- :uint64
+- :layer2OctetDeltaSumOfSquares
+429:
+- :uint64
+- :layer2OctetTotalSumOfSquares
+430:
+- :uint64
+- :layer2FrameDeltaCount
+431:
+- :uint64
+- :layer2FrameTotalCount
+432:
+- :ip4_addr
+- :pseudoWireDestinationIPv4Address
+433:
+- :uint64
+- :ignoredLayer2FrameTotalCount
 8192:
 - :uint32
 - :streamcore_wan_rtt