FDR Packeteer-2 Flow Data (20010)
FDR Packeteer-2 Flow Data Converter translates Blue Coat’s PacketShaper flows into syslog messages 1-to-1. Each flow record is converted into a syslog message in the “key=value” format. The tables below describe the mapping between Packeteer-2 Flow Data and key values.
This table describes the header present in each Packeteer-2 protocol packet.
Name | Bytes | NetFlow Logic field |
Version | 2 | |
Flow records in this PDU | 1 | |
Shaper Serial Number | 5 | device |
Unix Time in sec | 4 | |
Residual nanoseconds | 4 | |
Total flows seen | 4 | |
PacketeerFlowRecordsID | 4 | flow_id |
SysUpTime in millisec | 4 | |
This table describes the data records present in each Packeteer-2 packet. The number of bytes used and any additional information is given for each data item included in the FDR packet.
Name | Bytes | Description | NetFlow Logic field |
Source IPaddr | 4 | The IP address from which a flow was sent | src_ip |
Destination IPaddr | 4 | The IP address to which a flow was sent | dest_ip |
Packeteer ClassID | 4 | A numeric descriptor for a PacketShaper-identified traffic class | class_id |
Inbound IFindex | 2 | The PacketShaper interface through which the flow entered | ifindex_in |
Outbound IFindex | 2 | The PacketShaper interface through which the flow exited | ifindex_out |
Packet Count | 4 | The total number of packets in the flow | packets |
Byte Count | 4 | The total number of bytes in the flow | bytes |
Time at Start of Flow | 4 | SysUpTime when first packet seen | first_time |
Time at End of Flow | 4 | SysUpTime when last packet seen | last_time |
Source Port | 2 | The port on which the flow was sent | src_port |
Destination Port | 2 | The port to which the flow was sent | dest_port |
Packeteer Policy | 1 | priority=1, rate=2, uncontrolled=8, discard=16 or never-admit=32 | policy |
TCP flags | 1 | The logical sum (AND) of all TCP flags seen during the flow | tcp_flag |
Layer 4 protocol | 1 | The type of layer 4 protocol for the flow. Common IP protocol values are: 1 ICMP 2 IGMP 6 TCP 9 IGRP 17 UDP 41 IPv6 46 RSVP 47 GRE 50 IPSec 51 IPSec 108 IPComp | protocol |
IP ToS/DiffServ Byte (DSCP) | 1 | The value of any Type of Service or DiffServ (DSCP) for the flow, if present | tos |
Packeteer Service Type | 2 | The type of service (TOS) | service_id |
Server at Source or Dest. | 1 | The location of the server for this flow, may not apply to some protocols: s = source of the flow d = destination of the flow 0 = unknown (may not be a client/server based protocol) | srv_loc |
Packeteer Policy Priority | 1 | Priority for this flow (0-7), either the priority assigned by a priority policy, or the priority assigned to excess rate with a rate policy | priority |
Retransmitted Bytes | 4 | The number of bytes requiring retransmission for this flow | r_bytes |
VLanID | 2 | The ID number of any 802.1q VLAN associated with the flow | vlan_id |
TTL | 1 | Time to Live of the flow's last packet | ttl |
Measurements Type | 1 | 'p'=Ping 'v'=RTCP 'a'=RTM 't'=TCP 0=none | m_type |
Measurement 1 | 4 | The first measurement in this FDR packet (see below) | m1 |
Measurement 2 | 4 | The second measurement in this FDR packet (see below) | m2 |
Measurement 3 | 4 | The third measurement in this FDR packet (see below) | m3 |
FDR Packeteer-2
Key | Field Description | Comments |
nfc_id | Message type identifier | “nfc_id=20010” |
device | PacketShaper Serial Number(1) | <string> |
flow_id | PacketShaper flow identifier | <number> |
src_ip | The IP address from which a flow was sent | <IPv4_address> |
dest_ip | The IP address to which a flow was sent | <IPv4_address> |
class_id | PacketShaper traffic class ID | <number> |
application | Application (class ID name) (2) | <string> |
ifindex_in | Inbound Interface | <number> |
ifindex_out | Outbound Interface | <number> |
packets | Packet Count | <number> |
bytes | Byte Count | <number> |
first_time | Time at Start of Flow | <number> |
last_time | Time at End of Flow | <number> |
src_port | Source Port | <number> |
dest_port | Destination Port | <number> |
policy | Packeteer Policy | <number> |
tcp_flag | TCP flags | <string>, e.g. “SYN,ACK,FIN” |
protocol | Transport Protocol (TCP = 6, UDP = 17) | <number> |
tos | IP ToS/DiffServ Byte (DSCP) | <number> |
service_id | Packeteer Service Type | <number> |
srv_loc | Server Location | <number> |
priority | Packeteer Policy Priority | <number> |
r_bytes | Retransmitted Bytes | <number> |
vlan_id | VLanID | <number> |
ttl | TTL | <number> |
m_type | Measurements Type | <number> |
m1 | Measurement 1 | <number> |
m2 | Measurement 2 | <number> |
m3 | Measurement 3 | <number> |
(1) This field is taken from Packeteer-2 Header. (2) This field is populated from a lookup CSV file that maps class ID to Application name.