8.2. Terms available for use in filters

Table 8.1, “JavaScript terms available for filters” describes the terms that can be used in filters. These terms must be formed into filter expressions, as described in Section 8.1, “Advanced use of filters”. The table also specifies the type of each term. You should be careful to only combine terms of the correct type together, using the normal rules for JavaScript.

Three additional JavaScript functions are required to be able to access the destination interface of a packet. These are required because a packet may have multiple destination interfaces, in the case of a broadcast or multicast, and so a simple term is inadequate. The two functions available are described in Table 8.2, “JavaScript functions for filtering on destination interfaces”. To use these functions, add them to a filter, with the parameter to the function being the destination interface you want to test for. For example, to filter on destination interface 49, use destIfIndexInclude(49) for the filter.

Table 8.1. JavaScript terms available for filters

Term Description Type
agent sFlow agent IP address string
srcIfIndex source interface integer
MAC address
srcMACAddr source MAC address string
destMACAddr destination MAC address string
clientMACAddr client MAC address string
serverMACAddr server MAC address string
l2SAP layer 2 SAP integer
IP address
srcIPAddr source IP address string
destIPAddr destination IP address string
clientIPAddr client IP address string
serverIPAddr server IP address string
Highest layer address available
srcAddr source address (IP if available, otherwise MAC) string
destAddr destination address (IP if available, otherwise MAC) string
serverAddr server address (IP if available, otherwise MAC) string
clientAddr client address (IP if available, otherwise MAC) string
TCP/UDP port
srcL4Port layer 4 (TCP/UDP) source port integer
destL4Port layer 4 (TCP/UDP) destination port integer
clientL4Port layer 4 (TCP/UDP) client port integer
serverL4Port layer 4 (TCP/UDP) server port integer
UDP port
srcUDPPort UDP source port integer
destUDPPort UDP destination port integer
clientUDPPort UDP client port integer
serverUDPPort UDP server port integer
TCP port
srcTCPPort TCP source port integer
destTCPPort TCP destination port integer
clientTCPPort TCP client port integer
serverTCPPort TCP server port integer
Highest layer 'port' available
srcPort source port (L4 port, L3 protocol or L2 ethertype) integer
destPort destination port (L4 port, L3 protocol or L2 ethertype integer
clientPort client port (L4 port, L3 protocol or L2 ethertype) integer
serverPort server port (L4 port, L3 protocol or L2 ethertype) integer
VLAN
srcVLAN source VLAN integer
destVLAN destination VLAN integer
clientVLAN client VLAN integer
serverVLAN server VLAN integer
Priority
srcPriority source (802.1p) priority integer
destPriority destination (802.1p) priority integer
clientPriority client (802.1p) priority integer
serverPriority server (802.1p) priority integer
Other IP attributes
tos IP type of service (TOS) integer
ttl IP time to live (TTL) integer
ipProtocol layer 4 protocol (eg 6 for TCP, 17 for UDP) integer
icmpType ICMP type integer
Frame type
isUnicast true if a unicast destination boolean
isMulticast true if a multicast destination boolean
isBroadcast true if a broadcast destination boolean
Routing information (not supported by all sFlow implementations)
isRouter true if this packet was routed boolean
nextHop next hop address if this packet was routed string
srcMaskLength number of bits in the source mask if this packet was routed integer
destMaskLength number of bits in the destination mask if this packet was routed integer

Table 8.2. JavaScript functions for filtering on destination interfaces

Function Description Type
destIfIndexIncludes(ifIndex) returns true if the destination interfaces includes ifIndex boolean
clientIfIndexIncludes(ifIndex) returns true if the client interfaces includes ifIndex boolean
serverIfIndexIncludes(ifIndex) returns true if the server interfaces includes ifIndex boolean