FDR Packeteer-2 Flow Data Converter translates Blue Coat’s PacketShaper flows into syslog messages 1-to-1. Each flow record is converted into a syslog message in the “key=value” format. The tables below describe the mapping between Packeteer-2 Flow Data and key values.
FDR Packeteer-2 Header
This table describes the header present in each Packeteer-2 protocol packet.
Name
Bytes
NetFlow Logic field
Version
2
Flow records in this PDU
1
Shaper Serial Number
5
device
Unix Time in sec
4
Residual nanoseconds
4
Total flows seen
4
PacketeerFlowRecordsID
4
flow_id
SysUpTime in millisec
4
FDR Packeteer-2 Records
This table describes the data records present in each Packeteer-2 packet. The number of bytes used and any additional information is given for each data item included in the FDR packet.
Name
Bytes
Description
NetFlow Logic field
Source IPaddr
4
The IP address from which a flow was sent
src_ip
Destination IPaddr
4
The IP address to which a flow was sent
dest_ip
Packeteer ClassID
4
A numeric descriptor for a PacketShaper-identified traffic class
class_id
Inbound IFindex
2
The PacketShaper interface through which the flow entered
ifindex_in
Outbound IFindex
2
The PacketShaper interface through which the flow exited
ifindex_out
Packet Count
4
The total number of packets in the flow
packets
Byte Count
4
The total number of bytes in the flow
bytes
Time at Start of Flow
4
SysUpTime when first packet seen
first_time
Time at End of Flow
4
SysUpTime when last packet seen
last_time
Source Port
2
The port on which the flow was sent
src_port
Destination Port
2
The port to which the flow was sent
dest_port
Packeteer Policy
1
priority=1, rate=2, uncontrolled=8, discard=16 or never-admit=32
policy
TCP flags
1
The logical sum (AND) of all TCP flags seen during the flow
tcp_flag
Layer 4 protocol
1
The type of layer 4 protocol for the flow. Common IP protocol values are: