Skip to main content
Version: 2.10.1

Services Performance Monitor (10017 / 20017)

Description

This Module monitors services performance characteristics. A service is defined as a combination of a host IP address, a destination port number and an IP protocol. The Module calculates average response time over a specified Data Collection Interval and reports it for each of the listed servers. A special port number value (0) indicates that response time should be calculated over all ports serviced by that server (e.g. an FTP server in the passive mode). Along with response time measurements the Module also provides traffic volume in each direction and the number of flows.

Parameters

Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
List of monitored IPv4 address, destination port number and IP protocol tuplesList of the watched services (IPv4 address, destination port number and IP protocol)e.g. 67.202.0.200 / 80/6; 72.44.32.1 / 53/ 17
List of monitored IPv6 address, destination port number and IP protocol tuplesList of the watched services (IPv6 address, destination port number and IP protocol)e.g. 2620:0:2d0:200::7/ 53/ 17

Input

NetFlow v5 and v9, Cisco ASA NSEL, Palo Alto Networks NFv9.

Required NetFlow Fields

Information Element (IE)IE idIE size, BDescription
sourceIPv4Address or sourceIPv6Address8 or 274 or 16The IPv4 or IPv6 source address in the IP packet header
destinationIPv4Address or destinationIPv6Address12 or 284 or 16The IPv4 or IPv6 destination address in the IP packet header
protocolIdentifier41The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.
sourceTransportPort72The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header.
destinationTransportPort112The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header.
octetDeltaCount14 or 8The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.
flowStartSysUpTime224The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.
flowEndSysUpTime214The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier"nfc_id=20017"
exp_ipNetFlow exporter IP address<IPv4_address>
dest_ipService IPv4 address<IPv4_address>
dest_ip6Service IPv6 address<IPv6_address>
dest_portService transport port number<number>
protocolIP protocol (TCP = 6, UDP = 17)<number>
min_timeMin service response time, msec<number>
max_timeMax service response time, msec<number>
avg_timeAverage service response time, msec<number>
flow_countNumber of observed flows<number>
bytes_inTraffic received, bytes<number>
bytes_outTraffic sent, bytes<number>
t_intObservation time interval, msec<number>