16.2. Database fields reference

This section contains a reference for each of the database fields. There are used in JavaScript filters, and in the select and sort statements in advanced reports.

Depending on which database table a query is being run over, different fields are available. The tables available are:

flows
contains flow data from network switches (both physical and virtual). Flow data contains details of traffic, such as source and destination addresses, ports, etc.
counters
contains counters data from network switches (both physical and virtual). Counters data contains volumetric data on traffic through interfaces, such as bytes, frames, errors, etc.
hostCounters
contains counters data from sFlow enabled hosts. This includes information such as CPU utilization, memory usage, etc, for each host.
services
contains detailed data from sFlow enabled services. This is analogous to flow data for network traffic. For example, if the apache web server has the sFlow monitoring module installed and enabled, then detail of HTTP transactions, such as URIs served, will be contained in this table.
serviceCounters
contains counter data for sFlow monitored services, such as http. This data is volumetric, such as the number of requests of each HTTP method.

The fields available are keys, values or time. Keys represent aspects of the traffic being analyzed (eg a source address), while values are associated with that traffic (eg frames transmitted). Value fields can be used in a database sort statement, to sort the column in the resulting table (note that the same field must be in the select statement before it can be used in the sort statement). Additionally, there is one time field, which represents the time when traffic was observed.

The fields below are organized by database table, and by key, value and time.

16.2.1. Flows table fields

This section documents the fields available when a query is run over the flows table.

Table 16.1. Database key fields available for flows

Term Description Type
Agent
A string representing the address of the sFlow agent where the traffic was observed
agent sFlow agent IP address string
IfIndex
An integer representing the ifIndex that the traffic was seen on
inputIfIndex switch input interface integer
Qualified interface
A string representing the agent and ifIndex, separated by '>'
inputInterface qualified switch input interface integer
ouputInterface qualified output interface integer
clientInterface qualified interface associated with the client integer
serverInterface interface associated with the server integer
MAC address
A string representing a MAC address in hex
macSource source MAC address string
macDestination destination MAC address string
macClient client MAC address string
macServer server MAC address string
IP address
A string representing an IP address in numeric notation
ipSource source IP address string
ipDestination destination IP address string
ipClient client IP address string
ipServer server IP address string
Highest layer address available
A string representing the highest layer address available
sourceAddress source address (IP if available, otherwise MAC) string
destinationAddress destination address (IP if available, otherwise MAC) string
serverAddress server address (IP if available, otherwise MAC) string
clientAddress client address (IP if available, otherwise MAC) string
UDP port
An integer representing the UDP port, or 0 if not UDP
udpSourcePort UDP source port integer
udpDestinationPort UDP destination port integer
udpClientPort UDP client port integer
udpServerPort UDP server port integer
TCP port
An integer representing the TCP port, or 0 if not TCP
tcpSourcePort TCP source port integer
tcpDestinationPort TCP destination port integer
tcpClientPort TCP client port integer
tcpServerTCP TCP server port integer
Highest layer 'port' available
A string with the protocol and the highest layer port (including ethertype) available, separated by ':'
sourcePort source port (L4 port, L3 protocol or L2 ethertype) string
destinationPort destination port (L4 port, L3 protocol or L2 ethertype string
clientPort client port (L4 port, L3 protocol or L2 ethertype) string
serverPort server port (L4 port, L3 protocol or L2 ethertype) string
VLAN
An integer representing the VLAN number (or 0, if no VLAN)
vlanSource source VLAN integer
vlanDestination destination VLAN integer
vlanClient client VLAN integer
vlanServer server VLAN integer
cVLAN customer VLAN in IEEE 802.1ad or IEEE 802.1ah frame integer
sVLAN service VLAN in IEEE 802.1ad or IEEE 802.1ah frame integer
vlanStack VLANs in IEEE 802.1ad tagged frame, separated by ':' string
isQinQ true if flow includes IEEE 802.1ad Q-in-Q fields boolean
Priority
An integer representing the 802.1p priority
prioritySource source (802.1p) priority integer
priorityDestination destination (802.1p) priority integer
priorityClient client (802.1p) priority integer
priorityServer server (802.1p) priority integer
cPriority customer priority in IEEE 802.1ad or IEEE 802.1ah frame integer
sPriority service priority in IEEE 802.1ad or IEEE 802.1ah frame integer
Other MAC attributes
Various other attributes of MAC traffic
ieee802SAP IEEE 802 SAP integer
Other IP attributes
Various other attributes of IP (0 if non-IP traffic)
ipTOS IP type of service (TOS) integer
ipTTL IP time to live (TTL) integer
ipProtocol layer 4 protocol (eg 6 for TCP, 17 for UDP) integer
icmpType ICMP type integer
Frame type
Boolean tests for type of traffic
isUnicast true if a unicast destination boolean
isMulticast true if a multicast destination boolean
isL3Multicast true if a layer 3 multicast destination boolean
isBroadcast true if a broadcast destination boolean
Non-directional fields
Special non-directional fields for select statements only (these fields cannot be used in filters)
inputOrOutputIfIndex the input or output ifIndex integer
inputOrOutputInterface the input or output qualified interface string
Routing information (not supported by all sFlow implementations)
If isRouted == true, then the other values will be valid
isRouted true if this packet was routed boolean
ipNextHopRouter next hop address if this packet was routed string
sourceMaskLength number of bits in the source mask if this packet was routed integer
destinationMaskLength number of bits in the destination mask if this packet was routed integer
NAT information (not supported by all sFlow implementations)
NAT devices can provide information on addresses and ports that are rewritten using NAT
destinationNATAddress Destination address before NAT string
sourceNATAddress Source address before NAT string
destinationNATPort Destination port before NAT integer
sourceNATPort Source port before NAT integer
Tunnel information (not supported by all sFlow implementations)
Additional information on tunneled traffic
egressVNI Virtual Network Identifier used to identify the traffic on egress from the switch integer
ingressVNI Virtual Network Identifier used to identify the traffic on ingress to the switch integer
IEEE 802.1ah PBB/MAC-in-MAC
Information decoded from IEEE 802.1ah frames including fields from encapsulated inner packet. The format of MAC addresses is the same as outer MAC addresses.
isPBB true if flow includes IEEE 802.1ah PBB fields boolean
iSID service identifier in IEEE 802.1ah I-TAG integer
iPriority priority flag in IEEE 802.1ah I-TAG integer
cMacSource Customer IEEE 802.1ad source MAC address encapsulated in IEEE 802.1ah frame string
cMacDestination Customer IEEE 802.1ad destination MAC address encapsulated in 802.1ah frame string
Layer 3/4 encapsulations
Information decoded from layer 3 or 4 tunneling protocols (Geneve, GRE, NVGRE, VXLAN) including fields from encapsulated inner packet. The format of MAC and IP addresses is the same as outer MAC and IP addresses.
isGeneve true if tunneling protocol is Geneve boolean
isGRE true if tunneling protocol is GRE boolean
isNVGRE true if tunneling protocol is NVGRE boolean
isVXLAN true if tunneling protocol is VXLAN boolean
greKey GRE key field integer
greVersion GRE version number integer
vni virtual network identifier (VXLAN, Geneve) integer
vsid virtual subnet identifier (NVGRE) integer
macSource.1 source MAC address of inner encapsulated packet string
macDestination.1 destination MAC address of inner encapsulated packet string
macClient.1 client MAC address of inner encapsulated packet string
macServer.1 server MAC address of inner encapsulated packet string
ipSource.1 source IP address of inner encapsulated packet string
ipDestination.1 destination IP address of inner encapsulated packet string
ipClient.1 client IP address of inner encapsulated packet string
ipServer.1 server IP address of inner encapsulated packet string
sourceAddress.1 highest layer source address of inner encapsulated packet (IP if available, otherwise MAC) string
destinationAddress.1 highest layer destination address of inner encapsulated packet (IP if available, otherwise MAC) string
serverAddress.1 highest layer server address of inner encapsulated packet (IP if available, otherwise MAC) string
clientAddress.1 highest layer client address of inner encapsulated packet (IP if available, otherwise MAC) string
udpSourcePort.1 UDP source port of inner encapsulated packet integer
udpDestinationPort.1 UDP destination port of inner encapsulated packet integer
udpClientPort.1 UDP client port of inner encapsulated packet integer
udpServerPort.1 UDP server port of inner encapsulated packet integer
tcpSourcePort.1 TCP source port of inner encapsulated packet integer
tcpDestinationPort.1 TCP destination port of inner encapsulated packet integer
tcpClientPort.1 TCP client port of inner encapsulated packet integer
tcpServerTCP.1 TCP server port of inner encapsulated packet integer
sourcePort.1 highest layer source port (L4 port, L3 protocol or L2 ethertype) of inner encapsulated packet string
destinationPort.1 highest destination port (L4 port, L3 protocol or L2 ethertype of inner encapsulated packet string
clientPort.1 highest client port (L4 port, L3 protocol or L2 ethertype) of inner encapsulated packet string
serverPort.1 highest layer server port (L4 port, L3 protocol or L2 ethertype) of inner encapsulated packet string
vlanSource.1 source VLAN of inner encapsulated packet integer
vlanDestination.1 destination VLAN of inner encapsulated packet integer
vlanClient.1 client VLAN of inner encapsulated packet integer
vlanServer.1 server VLAN of inner encapsulated packet integer
prioritySource.1 source (802.1p) priority of inner encapsulated packet integer
priorityDestination.1 destination (802.1p) priority of inner encapsulated packet integer
priorityClient.1 client (802.1p) priority of inner encapsulated packet integer
priorityServer.1 server (802.1p) priority of inner encapsulated packet integer
ieee802SAP.1 IEEE 802 SAP of inner encapsulated packet integer
ipTOS.1 IP type of service (TOS) of inner encapsulated packet integer
ipTTL.1 IP time to live (TTL) of inner encapsulated packet integer
ipProtocol.1 layer 4 protocol (eg 6 for TCP, 17 for UDP) of inner encapsulated packet integer
icmpType.1 ICMP type of inner encapsulated packet integer
isUnicast.1 true if a unicast destination of inner encapsulated packet boolean
isMulticast.1 true if a multicast destination of inner encapsulated packet boolean
isL3Multicast.1 true if a layer 3 multicast destination of inner encapsulated packet boolean
isBroadcast.1 true if a broadcast destination of inner encapsulated packet boolean
BGP information (not supported by all sFlow implementations)
Additional information on BGP routed traffic
bgpAS The local Autonomous System number integer
bgpNextHop Next-hop router from BGP routed traffic string
bgpSourceAS Source Autonomous System number from BGP routed traffic integer
bgpSourcePeerAS Source peer Autonomous System number from BGP routed traffic integer
bgpDestinationAS Destination Autonomous System number from BGP routed traffic integer
bgpDestinationPeerAS Destination peer Autonomous System number from BGP routed traffic integer
bgpDestinationASPath The destination Autonomous System path from BGP routed traffic string
bgpCommunities Communities from BGP routed traffic string
bgpLocalPref LocalPref from BGP routed traffic integer
MPLS information
Additional information on MPLS traffic
mplsLabelStackIn The received MPLS label stack string
mplsLabelStackOut The transmitted MPLS label stack string
isMPLS true for traffic decoded as MPLS boolean
Wireless information (not supported by all sFlow implementations)
If isWireless == true, then the other values will be valid
isWireless true if this packet was send on a wireless network boolean
wifiFrameControl 802.11 frame control integer
wifiReceiverAddress 802.11 receiver address string
wifiTransmitterAddress 802.11 transmitter address string
wifiCipher 802.11 cipher suite integer
wifiCipherFormatted 802.11 cipher suite, formatted into the convention hex string form (OUI-OUI-OUI-Suite) string
wifiCipherName The name of the 802.11 cipher suite string
wifiTxSSID 802.11 transmit SSID string
wifiTxBSSID 802.11 transmit BSSID string
wifiTxVersion 802.11 protocol transmitted string
wifiTransmissions 802.11 number of transmissions integer
wifiTxDuration 802.11 transmitted packet duration integer
wifiRetransmitDuration 802.11 retransmit duration integer
wifiTxChannel 802.11 transmit channel integer
wifiTxSpeed 802.11 transmit speed integer
wifiTxPower 802.11 transmit RSNI integer
wifiRxSSID 802.11 receive SSID string
wifiRxBSSID 802.11 receive BSSID string
wifiRxVersion 802.11 protocol received string
wifiRxChannel 802.11 receive channel integer
wifiRxSpeed 802.11 receive speed integer
wifiRSNI 802.11 RSNI integer
wifiRCPI 802.11 RCPI integer
wifiRxDuration 802.11 received packet duration integer
Non-directional wireless fields
Special non-directional fields for select statements only (these fields cannot be used in filters)
wifiVersion 802.11 protocol for transmit or receive string
wifiSpeed 802.11 speed for transmit or receive integer
wifiSSID 802.11 SSID for transmit or receive string
wifiBSSID 802.11 BSSID for transmit or receive string
wifiDuration 802.11 duration for transmit or receive integer
wifiChannel 802.11 channel for transmit or receive integer

Table 16.2. Database value fields available for flows

Term Description Type
Bytes
Traffic byte count
bytesFromServer Bytes sent from the server integer
bytesToServer Bytes sent to the server integer
bytesIn Bytes received. integer
bytesOut Bytes sent. integer
bytesTotal Total number of bytes integer
Frames
Traffic byte count
framesFromServer Frames sent from the server integer
framesToServer Frames sent to the server integer
framesIn Frames received. integer
framesOut Frames sent. integer
framesTotal Total number of frames integer
TCP/IP flags
Various statistics from TCP/IP flags
synCount The number of TCP/IP packets with SYN set integer
synAckCount The number of TCP/IP packets with both SYN and ACK set integer
802.11 channel utilization
Usage of the 802.11 channel by percent utilization
wifiAirUtilizationIn Percent utilization of the receive channel integer
wifiAirUtilizationOut Percent utilization of the transmit channel integer
wifiAirUtilizationTotal Total utilization of the channel integer

16.2.2. Counters table fields

This section documents the fields available when a query is run over the counters table.

Table 16.3. Database key fields available for counters

Term Description Type
Agent
A string representing the address of the sFlow agent where the traffic was observed
agent sFlow agent IP address string
IfIndex
An integer representing the ifIndex that the traffic was seen on
ifIndex switch interface associated with the counters integer
Qualified interface
A string representing the agent and ifIndex, separated by '>'
interface qualified switch interface associated with the counters integer

Table 16.4. Database value fields available for counters

Term Description Type
Interface counters
Standard interface counters
framesIn The total of all non-error received frames integer
framesOut The total of all non-error transmitted frames integer
ifInBroadcasts Number of received broadcast frames integer
ifOutBroadcasts Number of transmitted broadcast frames integer
ifInMulticasts Number of received multicast frames integer
ifOutMulticasts Number of transmitted multicast frames integer
ifInUcasts Number of received unicast frames integer
ifOutUcasts Number of transmitted unicast frames integer
ifInOctets Number of received bytes integer
ifOutOctets Number of transmitted bytes integer
ifInErrors Number of received errors integer
ifOutErrors Number of transmitted errors integer
ifInDiscards Number of received discards integer
ifOutDiscards Number of transmitted discards integer
ifInErrorsAndDiscards The total of received errors and discards integer
ifOutErrorsAndDiscards The total of transmitted errors and discards integer
utilizationIn The ingress utilization integer
utilizationOut The egress utilization integer
Interface status
Standard interface status
ifStatus Bit 0: ifAdminStatus, bit 1: ifOperStatus integer
ifType The ifType (see IANAIfType) integer
ifSpeed The interface speed in bits/second integer
ifDirection 0 = unknown, 1 = full-duplex, 2 = half-duplex, 3 = in, 4 = out integer
ifPromiscuousMode Interface promiscuous mode integer
ifUnknownProtos Count of unknown protocols integer
Basic wireless counters
Basic wireless counters (not supported by all sFlow implementations)
wifiAssociated Number of associated stations integer
wifiTxFragments Number of transmitted fragments integer
wifiTxFrames Number of transmitted frames integer
wifiTxMulticasts Number of transmitted multicast frames integer
wifiRxFragments Number of received fragments integer
wifiRxMulticasts Number of received multicast frames integer
wifiRetries Number of retried frames integer
wifiMultiRetries Number of multiple retries integer
wifiFailures Number of failed frames integer
wifiAckFailures Number of acknowledgement failures integer
wifiRTSFailures Number of RTS failures integer
wifiRTSSuccesses Number of RTS successes integer
wifiFCSErrors Number of FCS errors integer
wifiDuplicates Number of duplicate frames integer
wifiWEPUndecryptable Number of undecryptable frames integer
Time-based wireless counters
Channel time wireless counters (not supported by all sFlow implementations)
wifiElapsedTime Total elapsed time in ms integer
wifiOnChannelTime Total time spent on channel in ms integer
wifiOnChannelBusyTime Busy time spent on channel in ms integer
QoS wireless counters
Quality of service wireless counters (not supported by all sFlow implementations)
wifiQoSCFRx Number of CF frames received integer
wifiQoSCFLost Number of CF frames lost integer
wifiQoSCFUnusable Number of CF frames unusable integer
wifiQoSCFUnused Number of CF frames unused integer
wifiQoSDiscards Number of discarded frames integer

16.2.3. Host counters table fields

This section documents the fields available when a query is run over the hostCounters table.

Table 16.5. Database key fields available for host counters

Term Description Type
Agent
A string representing the address of the sFlow agent for the host
agent sFlow agent IP address string
Datasource
A String representing the sFlow datasource for the host
datasource sFlow datasource for the host string
parent The sFlow datasource for the parent of this host string
System identity
Information on the identity of the host
hostname The host's hostname string
UUID A String representing the UUID of the host in standard RFC 4122 format string
System information
Information about the system and OS
machineType The architecture of the system string
osName The name of the OS running on the host string
osRelease The release version string of the OS running on the host string
Virtual information
Boolean test for virtual hosts
isVirtual true if the host is a virtual host boolean

Table 16.6. Database value fields available for host counters

Term Description Type
Host CPU counters
Host CPU performance counters expressed as an absolute value
cpuIdle Idle CPU time in ms integer
cpuIntr Time in ms servicing interrupts integer
cpuNice Nice CPU time in ms integer
cpuSoftIntr Time in ms servicing soft interrupts integer
cpuSystem System CPU time in ms integer
cpuTotal Total CPU time available in ms (the sum of all of the other CPU time fields, including idle) integer
cpuUser User CPU time in ms integer
cpuWIO Time in ms waiting for I/O to complete integer
vCpuTime Virtual CPU time in ms integer
cpuNum Number of CPUs in the system integer
vCpuNum Number of virtual CPUs assigned to system integer
cpuSpeed Speed in MHz of the CPU integer
loadOne One-minute load average integer
loadFive Five-minute load average integer
loadFifteen Fifteen-minute load average integer
procRun Total number of runnable processes integer
procTotal Total number of processes integer
contexts Count of context switches integer
interrupts Count of interrupts integer
uptime Seconds since the last reboot integer
vNodeCpuNum Number of physical CPUs in a virtualized host integer
vNodeCpuSpeed Expected speed of the physical CPUs in a virtualized host integer
Host CPU percentage counters
Host CPU performance counters expressed as a percentage of total CPU time
cpuIdleUtil Percentage of idle CPU time integer
cpuIntrUtil Percentage of CPU time servicing interrupts integer
cpuNiceUtil Percentage of nice CPU time integer
cpuSoftIntrUtil Percentage of CPU time servicing soft interrupts integer
cpuSystemUtil Percentage of system CPU time integer
cpuUserUtil Percentage of user CPU time integer
cpuUtil Percentage of non-idle CPU time integer
cpuWIOUtil Percentage of CPU time waiting for I/O to complete integer
vCpuTimeUtil Percentage utilization of virtual CPU time integer
Host disk counters
Host disk counters expressed as an absolute value
diskFree Free disk space in bytes integer
diskTotal Total disk size in bytes integer
diskUsed Total space used on disk integer
diskReads Number of read operations from disk integer
bytesRead Number of bytes read from disk integer
readTime Time in ms reading from disk integer
diskWrites Number of write operations completed to disk integer
bytesWritten Number of bytes written to disk integer
writeTime Time in ms writing to disk integer
vDiskAlloc Disk space allocated to virtual system integer
vDiskAvail Disk space available to virtual system integer
vDiskCapacity Capacity of disk for virtual system integer
vDiskErrors Number of virtual disk errors integer
vDiskReadBytes Number of bytes read by virtual system integer
vDiskReadReqs Number of read requests by virtual system integer
vDiskWriteBytes Number of bytes written by virtual system integer
vDiskWriteReqs Number of write requests by virtual system integer
Host disk percentage counters
Host disk counters expressed as a percentage
diskFreeUtil Free disk space expressed as a percentage of total space integer
diskUsedUtil Used disk space expressed as a percentage of total space integer
partitionMaxUsed Utilization of the highest utilized partition expressed as a percentage integer
vDiskAllocUtil Disk space allocated to virtual system expressed as a percentage of capacity integer
vDiskAvailUtil Disk space available to virtual system expressed as a percentage of capacity integer
Host memory counters
Host memory performance counters expressed as an absolute value
memoryBuffers Bytes of memory used for buffers integer
memoryCache Bytes of memory used for cache integer
memoryFree Free bytes of memory integer
memoryShared Shared bytes of memory integer
memoryTotal Total bytes of memory integer
memoryUsed Bytes of memory used (= memoryTotal-memoryFree-memoryShared-memoryBuffers-memoryCache) integer
memoryUsedTotal Total bytes of memory used (= memoryTotal-memoryFree) integer
swapFree Free bytes of swap space integer
swapTotal Total bytes of swap space integer
swapUsed Bytes of swap space used integer
pageIn Page in count integer
pageOut Page out count integer
swapIn Swap in count integer
swapOut Swap out count integer
vMemory Memory in bytes used by virtual system integer
vMemoryFree Free memory in bytes available to virtual system integer
vMemoryMax Maximum memory in bytes available to virtual system integer
vNodeMemTotal Total size of physical memory in bytes in a virtualized host integer
vNodeMemUsed Used physical memory in bytes in a virtualized host integer
vNodeMemFree Free physical memory in bytes in a virtualized host integer
Host memory percentage counters
Host memory performance counters expressed as a percentage of total memory
memoryBuffersUtil Percentage of memory used for buffers integer
memoryCacheUtil Percentage of memory used for cache integer
memoryFreeUtil Percentage of memory free integer
memorySharedUtil Percentage of memory shared integer
memoryUsedUtil Percentage of memory used (see memoryUsed) integer
memoryUsedTotalUtil Percentage of used total memory (see memoryUsedTotal) integer
swapFreeUtil Percentage of swap space free integer
swapUsedUtil Percentage of swap space used integer
vMemoryUtil Memory used by virtual system expressed as a percentage of the total available integer
vMemoryFreeUtil Free memory available to virtual system expressed as a percentage of the total available integer
vNodeMemUsedUtil Used physical memory in a virtualized host, expressed as a percentage of the total available integer
vNodeMemFreeUtil Free physical memory in a virtualized host, expressed as a percentage of the total available integer
Host network counters
Host network performance counters
hostBytesIn Bytes received by the host integer
hostBytesOut Bytes sent by the host integer
hostPacketsIn Packets received by the host integer
hostPacketsOut Packets send by the host integer
hostErrorsIn Error packets received by the host integer
hostErrorsOut Error packets send by the host integer
hostDropsIn Dropped packets received by the host integer
hostDropsOut Dropped packets send by the host integer
vNetRxBytes Bytes received by a virtual system integer
vNetTxBytes Bytes transmitted by a virtual system integer
vNetRxPackets Packets received by a virtual system integer
vNetTxPackets Packets transmitted by a virtual system integer
vNetRxErrors Error packets received by a virtual system integer
vNetTxErrors Error packets transmitted by a virtual system integer
vNetRxDrops Dropped packets received by a virtual system integer
vNetTxDrops Dropped packets transmitted by a virtual system integer
Other virtualization counters
Other host counters for virtualized systems
vState The state of a virtualized host (see the libvirt documentation) integer
virtualDomains The number of active domains in a virtualized host integer

16.2.4. Services table fields

This section documents the fields available when a query is run over the services table.

Table 16.7. Database key fields available for services

Term Description Type
Agent
A string representing the address of the sFlow agent for the service
agent sFlow agent IP address string
Datasource
A String representing the sFlow datasource for the service
datasource sFlow datasource for the service string
Service
Information on the type of service
service The name of the service (eg http) string
IfIndex
An integer representing the ifIndex that the request was seen on, if known
inputIfIndex the input interface for the request integer
outputIfIndex the output interface for the request integer
Qualified interface
A string representing the agent and ifIndex that the request was seen on, separated by '>', if known
inputInterface qualified input interface for the request integer
outputInterface qualified output interface for the request integer
IP address
A string representing an IP address in numeric notation
ipLocal the local IP address associated with the request string
ipRemote the remote IP address associated with the request string
ipClient client IP address string
ipServer server IP address string
UDP port
An integer representing the UDP port, or 0 if not UDP
udpLocalPort the local UDP port associated with the request integer
udpRemotePort the remote UDP port associated with the request integer
udpClientPort UDP client port integer
udpServerPort UDP server port integer
TCP port
An integer representing the TCP port, or 0 if not TCP
tcpLocalPort the local TCP port associated with the request integer
tcpRemotePort the remote TCP port associated with the request integer
tcpClientPort TCP client port integer
tcpServerTCP TCP server port integer
Highest layer 'port' available
A string with the protocol and port, separated by ':'
localPort The local port associated with the request string
remotePort The remote port associated with the request string
clientPort The client port associated with the request string
serverPort The server port associated with the request string
Other IP attributes
Other attributes of IP
ipProtocol layer 4 protocol (eg 6 for TCP, 17 for UDP) integer
HTTP fields
HTTP fields, available if the service is HTTP
httpHost The host from the HTTP request string
httpMethod The method from the HTTP request string
httpProtocol The HTTP protocol version, encoded as major_number*1000+minor_number, eg HTTP1.1 is encoded as 1001 string
httpReferrer The referrer from the HTTP request string
httpURI The full URI from the HTTP request string
httpURIPath The path from the URI. The path starts after the protocol, and ends at the start of the query string
httpURIFile The file from the URI. The file is the last component of the path string
httpURIExtn The file extension from the URI string
httpUserAgent The user agent from the HTTP request string
httpXForwardedFor The X-Forwarded-For field from the HTTP request string
httpAuthUser The auth user from the HTTP request, if present string
httpStatus The status of the response to an HTTP request integer
httpMimeType The mime type of the response to an HTTP request string

Table 16.8. Database value fields available for services

Term Description Type
Generic values
Generic information on traffic
framesTotal Number of frames or transactions integer
numSamples Number of samples seen integer
HTTP values
Values associated with HTTP transactions
httpDuration The mean duration of HTTP transactions, from start of request to end of response integer
httpDuration The mean duration of HTTP transactions, from start of request to end of response integer
httpRequestBytes The number of bytes in an HTTP request integer
httpResponseBytes The number of bytes in an HTTP response integer
httpTotalBytes The total number of bytes in a combined HTTP request and response integer

16.2.5. Service counters table fields

This section documents the fields available when a query is run over the serviceCounters table.

Table 16.9. Database key fields available for service counters

Term Description Type
Agent
A string representing the address of the sFlow agent for the service
agent sFlow agent IP address string
Datasource
A String representing the sFlow datasource for the service
datasource sFlow datasource for the service string
parent The sFlow datasource for the parent of this service string
Service
Information on the type of service
service The name of the service (eg http) string

Table 16.10. Database value fields available for service counters

Term Description Type
HTTP counters
Counters for HTTP operations counters
httpMethodConnectCount Count of http CONNECT methods integer
httpMethodDeleteCount Count of http DELETE methods integer
httpMethodGetCount Count of http GET methods integer
httpMethodHeadCount Count of http HEAD methods integer
httpMethodOptionCount Count of http OPTION methods integer
httpMethodPostCount Count of http POST methods integer
httpMethodPutCount Count of http PUT methods integer
httpMethodTraceCount Count of http TRACE methods integer
httpMethodOtherCount Count of other http methods integer
httpStatus1xxCount Count of http status 1xx integer
httpStatus2xxCount Count of http status 3xx integer
httpStatus3xxCount Count of http status 3xx integer
httpStatus4xxCount Count of http status 4xx integer
httpStatus 5xxCount Count of http status 5xx integer
httpStatusOtherCount Count of other http status integer

16.2.6. Time fields

This section documents the time fields available. Time fields are common for all of the tables.

Table 16.11. Database time fields

Term Description Type
time The time when traffic was observed string

16.2.7. Metadata fields

This section documents the metadata fields available. These fields can be used to provide additional information on each row of a result. They cannot be used for filters.

Table 16.12. Database metadata fields

Term Description Type
isOther true if a row represents the "other" value in a top-n, false otherwise boolean
noData true if a row represents a time interval with no data, false otherwise boolean