Functions
- CAPTURE_MICROSECONDS()
- This function returns the number of microseconds since the value of the CAPTURE_SECONDS() function until the current packet was captured, according to the system clock on the machine that captured it.
- CAPTURE_MICROSECONDS()
- This function returns the number of microseconds since the value of the CAPTURE_SECONDS() function until the current packet was captured, according to the system clock on the machine that captured it.
- CAPTURE_SECONDS()
- This function returns the number of seconds since the beginning of the Unix epoch (midnight on January 1st, 1970 in Greenwich, England) until the current packet was captured, according to the system clock on the machine that captured it.
- CAPTURE_SECONDS()
- This function returns the number of seconds since the beginning of the Unix epoch (midnight on January 1st, 1970 in Greenwich, England) until the current packet was captured, according to the system clock on the machine that captured it.
- CAPTURE_TSC_MICROSECONDS()
- This function returns the value of the machine's timestamp counter when the packet was captured, that is, the number of microseconds since the machine was booted.
- CAPTURE_TSC_MICROSECONDS()
- This function returns the value of the machine's timestamp counter when the packet was captured, that is, the number of microseconds since the machine was booted.
- DHCP_ADDRESS_LEASE_TIME()
- This parser result function returns the duration of the address lease, in seconds, if DHCP option 51 is included in the message, or zero if not.
- DHCP_ALL_SUBNETS_LOCAL()
- This parser result function returns true if all subnets use the same MTU size, if DHCP option 27 is included in the message, or false if not.
- DHCP_ARP_CACHE_TIMEOUT()
- This parser result function returns the timeout for ARP cache entries, in seconds, if DHCP option 35 is included in the message, or zero if not.
- DHCP_BOOTFILE_NAME()
- This parser result function returns the pathname of a boot file the client can use, if there is one, or an empty string otherwise.
- DHCP_BOOT_FILE_SIZE()
- This parser result function returns the size of boot file in 512 byte blocks, if DHCP option 13 is included in the message, or zero if not.
- DHCP_BROADCAST_ADDRESS()
- This parser result function returns the IP version 4 address to use when broadcasting on subnet, if DHCP option 28 is included in the message, or zero if not.
- DHCP_CLIENT_ADDRESS()
- This parser result function returns the DHCP client's IP version 4 address when it requests renewal of its lease.
- DHCP_CLIENT_HARDWARE_ADDRESS()
- This parser result function returns the DHCP client's network hardware address, for example, the MAC address of its ethernet adapter.
- DHCP_CLIENT_HARDWARE_TYPE()
- This parser result function returns the client's hardware address type, for example, '1' for ethernet.
- DHCP_CLIENT_IDENTIFIER()
- This parser result function returns client-specific information, if DHCP option 61 is included in the message, or an empty list if not.
- DHCP_COOKIE_SERVERS()
- This parser result function returns a list of cookie servers, represented as IP version 4 addresses, if DHCP option 8 is included in the message, or an empty list if not.
- DHCP_DNS_SERVERS()
- This parser result function returns a list of DNS servers, represented as IP version 4 addresses, if DHCP option 6 is included in the message, or an empty list if not.
- DHCP_DOMAIN_NAME()
- This parser result function returns the domain name the client should use with DNS, if DHCP option 15 is included in the message, or an empty string if not.
- DHCP_ERROR_MESSAGE()
- This parser result function returns an error message from server, if request failed, if DHCP option 56 is included in the message.
- DHCP_ETHERNET_ENCAPSULATION()
- This parser result function returns true when the client should use ethernet encapsulation, if DHCP option 36 is included in the message, or false if not.
- DHCP_EXTENSIONS_PATH()
- This parser result function returns BOOTP extensions, if DHCP option 18 is included in the message, or an empty string if not.
- DHCP_FINGER_SERVERS()
- This parser result function returns a list of Finger servers, represented as IP version 4 addresses, if DHCP option 73 is included in the message, or an empty list if not.
- DHCP_FLAGS()
- This parser result function returns the DHCP broadcast flag.
- DHCP_HOP_COUNT()
- This parser result function returns the number of relay agents separating the DHCP client and server.
- DHCP_HOST_NAME()
- This parser result function returns the hostname of the client, if DHCP option 12 is included in the message, or an empty string if not.
- DHCP_IMPRESS_SERVERS()
- This parser result function returns a list of Impress servers, represented as IP version 4 addresses, if DHCP option 10 is included in the message, or an empty list if not.
- DHCP_INTERFACE_MTU()
- This parser result function returns the MTU size to use on this interface, if DHCP option 26 is included in the message, or zero if not.
- DHCP_IP_DEFAULT_TTL()
- This parser result function returns the default IP time-to-live for outgoing packets, if DHCP option 23 is included in the message, or zero if not.
- DHCP_IP_FORWARDING()
- This parser result function returns true if the client should forward IP packets, if DHCP option 19 is included in the message, or false if not.
- DHCP_IRC_SERVERS()
- This parser result function returns a list of IRC servers, represented as IP version 4 addresses, if DHCP option 74 is included in the message, or an empty list if not.
- DHCP_LOG_SERVERS()
- This parser result function returns a list of log servers, represented as IP version 4 addresses, if DHCP option 7 is included in the message, or an empty list if not.
- DHCP_LPR_SERVERS()
- This parser result function returns a list of print servers, represented as IP version 4 addresses, if DHCP option 9 is included in the message, or an empty list if not.
- DHCP_MASK_SUPPLIER()
- This parser result function returns true when client should respond to subnet mask discovery, if DHCP option 30 is included in the message, or false if not.
- DHCP_MAXIMUM_MESSAGE_SIZE()
- This parser result function returns the maximum size of DHCP message, if DHCP option 57 is included in the message, or zero if not.
- DHCP_MAXIMUM_REASSEMBLY_SIZE()
- This parser result function returns the maximum size of reassembled packets, if DHCP option 22 is included in the message, or zero if not.
- DHCP_MERIT_DUMP_FILE()
- This parser result function returns the pathname of a file for client's core dump image, if DHCP option 14 is included in the message, or an empty string if not.
- DHCP_MESSAGE_TYPE()
- This parser result function returns the type of this DHCP message, if DHCP option 53 is included in the message, or zero if not, for example:
- DHCP_MOBILE_IP_HOME_AGENTS()
- This parser result function returns a list of mobile IP home agents, represented as IP version 4 addresses, if DHCP option 68 is included in the message, or an empty list if not.
- DHCP_MTU_AGING_TIMEOUT()
- This parser result function returns the time to use when aging path MTU values, in seconds, if DHCP option 24 is included in the message, or zero if not.
- DHCP_MTU_PLATEAU_TABLE()
- This parser result function returns a list of MTU sizes for path discovery, if DHCP option 25 is included in the message, or an empty list if not.
- DHCP_NAME_SERVERS()
- This parser result function returns a list of name servers (not DNS servers, see next option), represented as IP version 4 addresses, if DHCP option 5 is included in the message, or an empty list if not.
- DHCP_NETBIOS_NAME_SERVERS()
- This parser result function returns a list of NetBIOS-over-TCP name servers, represented as IP version 4 addresses, if DHCP option 44 is included in the message, or an empty list if not.
- DHCP_NETBIOS_NBDD_SERVERS()
- This parser result function returns a list of NetBIOS-over-TCP NBDD servers, represented as IP version 4 addresses, if DHCP option 45 is included in the message, or an empty list if not.
- DHCP_NETBIOS_NODE_TYPE()
- This parser result function returns the type of NetBIOS-over-TCP node, if DHCP option 46 is included in the message, or zero if not.
- DHCP_NETBIOS_SCOPE()
- This parser result function returns the client's NetBIOS-over-TCP scope parameter, if DHCP option 47 is included in the message, or an empty string if not.
- DHCP_NISPLUS_DOMAIN()
- This parser result function returns the name of the client's NIS+ domain, if DHCP option 64 is included in the message.
- DHCP_NISPLUS_SERVERS()
- This parser result function returns a list of NIS+ servers, represented as IP version 4 addresses, if DHCP option 65 is included in the message, or an empty list if not.
- DHCP_NIS_DOMAIN()
- This parser result function returns the name of the client's NIS domain, if DHCP option 40 is included in the message, or an empty string if not.
- DHCP_NIS_SERVERS()
- This parser result function returns a list of NIS servers, represented as IP version 4 addresses, if DHCP option 41 is included in the message, or an empty list if not.
- DHCP_NNTP_SERVERS()
- This parser result function returns a list of NNTP servers, represented as IP version 4 addresses, if DHCP option 71 is included in the message, or an empty list if not.
- DHCP_NONLOCAL_SOURCE_FILTERS()
- This parser result function returns a list of IP version 4 address/mask pairs for filtering source packets, if DHCP option 21 is included in the message, or an empty list if not.
- DHCP_NONLOCAL_SOURCE_ROUTING()
- This parser result function returns true if the client should forward IP packets with non-local source routing, if DHCP option 20 is included in the message, or false if not.
- DHCP_NTP_SERVERS()
- This parser result function returns a list of NTP servers, represented as IP version 4 addresses, if DHCP option 42 is included in the message, or an empty list if not.
- DHCP_OPCODE()
- This parser result function returns the DHCP message type ('1' for request, '2' for reply).
- DHCP_OPTION_OVERLOAD_FLAGS()
- This parser result function returns flags indicating whether the sname and file fields in the DHCP message header contain the server's host name and client's boot file name, or additional DHCP options, if DHCP option 52 is included in the message, or zero if not.
- DHCP_PARAMETER_REQUESTS()
- This parser result function returns a list of requested DHCP parameters, expressed as option codes, if DHCP option 55 is included in the message, or an empty list if not.
- DHCP_PERFORM_MASK_DISCOVERY()
- This parser result function returns true when client should perform subnet mask discovery, if DHCP option 29 is included in the message, or false if not.
- DHCP_PERFORM_ROUTER_DISCOVERY()
- This parser result function returns true when the client should solicit routers, if DHCP option 31 is included in the message, or false if not.
- DHCP_POP3_SERVERS()
- This parser result function returns a list of POP3 servers, represented as IP version 4 addresses, if DHCP option 70 is included in the message, or an empty list if not.
- DHCP_REBINDING_TIME()
- This parser result function returns the time from address lease to rebinding, in seconds, if DHCP option 59 is included in the message, or zero if not.
- DHCP_RELAY_AGENT()
- This parser result function returns the IP version 4 address of the relay agent between the DHCP client and server, if there is one, or zero otherwise.
- DHCP_RENEWAL_TIME()
- This parser result function returns then time from address lease to renewal, in seconds, if DHCP option 58 is included in the message, or zero if not.
- DHCP_REQUESTED_ADDRESS()
- This parser result function returns the client's requested address, as an IP version 4 address, if DHCP option 50 is included in the message, or zero if not.
- DHCP_RESOURCE_SERVERS()
- This parser result function returns a list of resource location servers, represented as IP version 4 addresses, if DHCP option 11 is included in the message, or an empty list if not.
- DHCP_ROOT_PATH()
- This parser result function returns the pathname of the client's root disk (for diskless workstations), if DHCP option 17 is included in the message, or an empty string if not.
- DHCP_ROUTERS()
- This parser result function returns a list of routers on client's subnet, represented as IP version 4 addresses, if DHCP option 3 is included in the message, or an empty list if not.
- DHCP_ROUTER_SOLICITATION_ADDRESS()
- This parser result function returns the IP version 4 address to which router solicitations should be sent, if DHCP option 32 is included in the message, or zero if not.
- DHCP_SECONDS()
- This parser result function returns the elased time, in seconds, between the request and the response.
- DHCP_SERVER_ADDRESS()
- This parser result function returns the IP version 4 address of DHCP server, if DHCP option 54 is included in the message, or zero if not.
- DHCP_SERVER_HOSTNAME()
- This parser result function returns the name of the DHCP server, if it has one, or an empty string otherwise.
- DHCP_SERVER_NEXT()
- This parser result function returns the IP version 4 address of the next DHCP server to use.
- DHCP_SMTP_SERVERS()
- This parser result function returns a list of SMTP servers, represented as IP version 4 addresses, if DHCP option 69 is included in the message, or an empty list if not.
- DHCP_STATIC_ROUTES()
- This parser result function returns a list of IP version 4 address pairs for the client's static routing table, if DHCP option 33 is included in the message, or an empty list if not.
- DHCP_STDA_SERVERS()
- This parser result function returns a list of StreetTalk Directory Assistance servers, represented as IP version 4 addresses, if DHCP option 76 is included in the message, or an empty list if not.
- DHCP_STREETTALK_SERVERS()
- This parser result function returns a list of StreetTalk servers, represented as IP version 4 addresses, if DHCP option 75 is included in the message, or an empty list if not.
- DHCP_SUBNET_MASK()
- This parser result function returns the mask of the client's subnet, represented as an IP version 4 address, if DHCP option 1 is included in the message, or zero if not.
- DHCP_SWAP_SERVER()
- This parser result function returns the IP version 4 address of the client's swap server, if DHCP option 16 is included in the message.
- DHCP_TCP_DEFUALT_TTL()
- This parser result function returns the default TCP time-to-live for outgoing segments, if DHCP option 37 is included in the message, or zero if not.
- DHCP_TCP_KEEPALIVE_GARBAGE()
- This parser result function returns true when the client should send a byte of garbage with TCP keepalive messages, if DHCP option 39 is included in the message, or false if not.
- DHCP_TCP_KEEPALIVE_INTERVAL()
- This parser result function returns the time the client should wait before sending TCP keepalive messages, in seconds, if DHCP option 38 is included in the message, or zero if not.
- DHCP_TIME_OFFSET()
- This parser result function returns the time offset of the client's subnet, relative to GMT/UTC, in seconds, if DHCP option 2 is included in the message, or zero if not.
- DHCP_TIME_SERVERS()
- This parser result function returns a list of time servers, represented as IP version 4 addresses, if DHCP option 4 is included in the message, or an empty list if not.
- DHCP_TRAILER_ENCAPSULATION()
- This parser result function returns true when the client should negotiate trailers, if DHCP option 34 is included in the message, or false if not.
- DHCP_TRANSACTION_IDENTIFIER()
- This parser result function returns the request correlator chosen by the DHCP client in its request and returned to it by server in its response.
- DHCP_VENDOR_IDENTIFIER()
- This parser result function returns vendor-specific information, if DHCP option 60 is included in the message, or an empty list if not.
- DHCP_VENDOR_INFORMATION()
- This parser result function returns vendor-specific information, if DHCP option 43 is included in the message, or an empty list if not.
- DHCP_WWW_SERVERS()
- This parser result function returns a list of WWW servers, represented as IP version 4 addresses, if DHCP option 72 is included in the message, or an empty list if not.
- DHCP_XWINDOW_DISPLAY_MANAGERS()
- This parser result function returns a list of X-Windows display managers, represented as IP version 4 addresses, if DHCP option 49 is included in the message, or an empty list if not.
- DHCP_XWINDOW_FONT_SERVERS()
- This parser result function returns a list of X-Windows font servers, represented as IP version 4 addresses, if DHCP option 48 is included in the message, or an empty list if not.
- DHCP_YOUR_ADDRESS()
- This parser result function returns the IP version 4 address leased to the client by the DHCP server, if the message is an acknowledgement granting a lease, or zero if not.
- DNS_ADDITIONAL_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_COUNT()
- This parser result function returns the number of 'additional' resource records in the current message.
- DNS_ADDITIONAL_COUNT()
- This parser result function returns the number of 'additional' resource records in the current message.
- DNS_ADDITIONAL_DATA()
- This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_DATA()
- This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_DATA(rstring)
- This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_DATA(rstring)
- This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_NAMES()
- This parser result function returns a list of the 'name' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_NAMES()
- This parser result function returns a list of the 'name' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_TTLS()
- This parser result function returns a list of the 'time to live' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_TTLS()
- This parser result function returns a list of the 'time to live' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_TYPES()
- This parser result function returns a list of the 'type' fields in the 'additional' resource records in the current message.
- DNS_ADDITIONAL_TYPES()
- This parser result function returns a list of the 'type' fields in the 'additional' resource records in the current message.
- DNS_ALL_FIELDS(rstring, rstring, rstring)
- This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from all DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter.
- DNS_ALL_FLAGS()
- This parser result function returns a 16-bit value containing all of the DNS header flags from the current message.
- DNS_ALL_FLAGS()
- This parser result function returns a 16-bit value containing all of the DNS header flags from the current message.
- DNS_ANSWER_ADDRESS()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as a string value, or an empty string if not.
- DNS_ANSWER_ADDRESS()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as a string value, or an empty string if not.
- DNS_ANSWER_ADDRESSES()
- This parser result function returns a list of the 'data' fields in the 'answer' resource records that have a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as string values.
- DNS_ANSWER_ADDRESSES()
- This parser result function returns a list of the 'data' fields in the 'answer' resource records that have a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as string values.
- DNS_ANSWER_CANONICAL()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '5' (meaning, the answer is a canonical domain name from a type 'CNAME' record), or an empty string if not.
- DNS_ANSWER_CANONICAL()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '5' (meaning, the answer is a canonical domain name from a type 'CNAME' record), or an empty string if not.
- DNS_ANSWER_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_COUNT()
- This parser result function returns the number of 'answer' resource records in the current message.
- DNS_ANSWER_COUNT()
- This parser result function returns the number of 'answer' resource records in the current message.
- DNS_ANSWER_DATA()
- This parser result function returns a list of the 'data' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_DATA()
- This parser result function returns a list of the 'data' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_IPV4_ADDRESS()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' (meaning, the answer is an IP version 4 address from a type 'A' record), as a binary value, or zero if not.
- DNS_ANSWER_IPV4_ADDRESS()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' (meaning, the answer is an IP version 4 address from a type 'A' record), as a binary value, or zero if not.
- DNS_ANSWER_IPV4_ADDRESSES()
- This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '1' (meaning, the answers are IP version 4 addresses from type 'A' records), as a list of binary values.
- DNS_ANSWER_IPV4_ADDRESSES()
- This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '1' (meaning, the answers are IP version 4 addresses from type 'A' records), as a list of binary values.
- DNS_ANSWER_IPV6_ADDRESS()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '28' (meaning, the answer is an IP version 6 address from a type 'AAAA' record), as a binary value, or zero if not.
- DNS_ANSWER_IPV6_ADDRESS()
- This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '28' (meaning, the answer is an IP version 6 address from a type 'AAAA' record), as a binary value, or zero if not.
- DNS_ANSWER_IPV6_ADDRESSES()
- This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '28' (meaning, the answers IP version 6 addresses from type 'AAAA' records), as a binary values.
- DNS_ANSWER_IPV6_ADDRESSES()
- This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '28' (meaning, the answers IP version 6 addresses from type 'AAAA' records), as a binary values.
- DNS_ANSWER_NAMES()
- This parser result function returns a list of the 'name' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_NAMES()
- This parser result function returns a list of the 'name' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_TTLS()
- This parser result function returns a list of the 'time to live' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_TTLS()
- This parser result function returns a list of the 'time to live' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_TYPES()
- This parser result function returns a list of the 'type' fields in the 'answer' resource records in the current message.
- DNS_ANSWER_TYPES()
- This parser result function returns a list of the 'type' fields in the 'answer' resource records in the current message.
- DNS_AUTHORITATIVE_FLAG()
- This parser result function returns true if the 'authoritative' flag is set in the current message, or false if not.
- DNS_AUTHORITATIVE_FLAG()
- This parser result function returns true if the 'authoritative' flag is set in the current message, or false if not.
- DNS_IDENTIFIER()
- This parser result function returns the DNS client's request correlator in the current message, and returned by the server in its response.
- DNS_IDENTIFIER()
- This parser result function returns the DNS client's request correlator in the current message, and returned by the server in its response.
- DNS_INCOMPATIBLE_FLAGS()
- This DNS parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found.
- DNS_INCOMPATIBLE_FLAGS()
- This parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found.
- DNS_NAMESERVER_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_COUNT()
- This parser result function returns the number of 'name server' resource records in the current message.
- DNS_NAMESERVER_COUNT()
- This parser result function returns the number of 'name server' resource records in the current message.
- DNS_NAMESERVER_DATA()
- This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_DATA()
- This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_DATA(rstring)
- This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_DATA(rstring)
- This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_NAMES()
- This parser result function returns a list of the 'name' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_NAMES()
- This parser result function returns a list of the 'name' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_TTLS()
- This parser result function returns a list of the 'time to live' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_TTLS()
- This parser result function returns a list of the 'time to live' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_TYPES()
- This parser result function returns a list of the 'type' fields in the 'name server' resource records in the current message.
- DNS_NAMESERVER_TYPES()
- This parser result function returns a list of the 'type' fields in the 'name server' resource records in the current message.
- DNS_OPCODE()
- This parser result function returns the operation code requested by the DNS client in the current message, for example,
- DNS_OPCODE()
- This parser result function returns the operation code requested by the DNS client in the current message, for example,
- DNS_QUESTION_CLASS()
- This parser result function returns the 'class' field of the first 'question' resource record in the current message, for example, '1' for Internet adddresses ('IN' records),
- DNS_QUESTION_CLASS()
- This parser result function returns the 'class' field of the first 'question' resource record in the current message, for example, '1' for Internet adddresses ('IN' records),
- DNS_QUESTION_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'question' resource records in the current message.
- DNS_QUESTION_CLASSES()
- This parser result function returns a list of the 'class' fields in the 'question' resource records in the current message.
- DNS_QUESTION_COUNT()
- This parser result function returns the number of 'question' resource records in the current message.
- DNS_QUESTION_COUNT()
- This parser result function returns the number of 'question' resource records in the current message.
- DNS_QUESTION_NAME()
- This parser result function returns the 'name' field of the first 'question' resource record in the current message, if there is one, or an empty string if not.
- DNS_QUESTION_NAME()
- This parser result function returns the 'name' field of the first 'question' resource record in the current message, if there is one, or an empty string if not.
- DNS_QUESTION_NAMES()
- This parser result function returns a list of the 'name' fields in the 'question' resource records in the current message.
- DNS_QUESTION_NAMES()
- This parser result function returns a list of the 'name' fields in the 'question' resource records in the current message.
- DNS_QUESTION_TYPE()
- This parser result function returns the 'type' field of the first 'question' resource record in the current message, for example:
- DNS_QUESTION_TYPE()
- This parser result function returns the 'type' field of the first 'question' resource record in the current message, for example:
- DNS_QUESTION_TYPES()
- This parser result function returns a list of the 'type' fields in the 'question' resource records in the current message.
- DNS_QUESTION_TYPES()
- This parser result function returns a list of the 'type' fields in the 'question' resource records in the current message.
- DNS_RESPONSE_CODE()
- This parser result function returns the response code from the DNS server in the current message, for example,
- DNS_RESPONSE_CODE()
- This parser result function returns the response code from the DNS server in the current message, for example,
- DNS_RESPONSE_FLAG()
- This parser result function returns true if the current message is a response sent by a DNS server, or false if it is a request sent by a DNS client.
- DNS_RESPONSE_FLAG()
- This parser result function returns true if the current message is a response sent by a DNS server, or false if it is a request sent by a DNS client.
- DNS_TRUNCATION_FLAG()
- This parser result function returns true if the 'truncation' flag is set in the current message, or false if not.
- DNS_TRUNCATION_FLAG()
- This parser result function returns true if the 'truncation' flag is set in the current message, or false if not.
- ERSPAN_DST_ADDRESS()
- This function returns the value of the GRE ERSPAN destination address in the current packet, if it has one, or zero if otherwise.
- ERSPAN_SRC_ADDRESS()
- This function returns the value of the GRE ERSPAN source address in the current packet, if it has one, or zero if otherwise.
- ETHER_DST_ADDRESS()
- This function returns the ethernet destination address of the current packet.
- ETHER_DST_ADDRESS()
- This function returns the ethernet destination address of the current packet.
- ETHER_PROTOCOL()
- This function returns the ethernet protocol (that is, the EtherType) of the current packet, for example, '2048' for IP version 4, or '34,525' for IP version 6.
- ETHER_PROTOCOL()
- This function returns the ethernet protocol (that is, the EtherType) of the current packet, for example, '2048' for IP version 4, or '34,525' for IP version 6.
- ETHER_SRC_ADDRESS()
- This function returns the ethernet source address of the current packet.
- ETHER_SRC_ADDRESS()
- This function returns the ethernet source address of the current packet.
- EVENT()
- This result function returns a string containing the name of the event that caused the output tuple to be produced.
- EVENT_FILE_CHUNK()
- This result function returns true if a chunk of a file within the current flow has been received, or false otherwise.
- EVENT_FLOW_DATA()
- This result function returns true if data for the current flow has been received, or false otherwise.
- EVENT_FLOW_END()
- This result function returns true if this is the last tuple of a flow, or false otherwise.
- EVENT_FLOW_START()
- This result function returns true if this is the first tuple of a new flow, or false otherwise.
- EVENT_FLOW_TLS()
- This result function returns true if this flow is encrypted using the TLS protocol, or false otherwise.
- EVENT_REQUEST()
- This result function returns true if request headers for a transaction within the current flow have been received, or false otherwise.
- EVENT_RESPONSE()
- This result function returns true if response headers for a transaction within the current flow flow have been received, or false otherwise.
- FILE_CHUNK_BINARY()
- This result function returns the current chunk of the current file as a binary object, for 'FileChunk' events only.
- FILE_CHUNK_COUNTER()
- This result function returns a sequence number for this chunk of the current file, starting at zero, for 'FileChunk' events only.
- FILE_CHUNK_FINAL()
- This result function returns true for the last chunk of the current file, for FileChunk events only, or false otherwise,
- FILE_CHUNK_INITIAL()
- This result function returns true for the first chunk of the curent file, for FileChunk events only, or false otherwise,
- FILE_CHUNK_LENGTH()
- This result function returns the length of the current chunk of the current file, for 'FileChunk' events only.
- FILE_CHUNK_LENGTH_SUM()
- This result function returns the sum of the lengths of this and all preceding chunks of the current file, for 'FileChunk' events only.
- FILE_CHUNK_STRING()
- This result function returns the current chunk of the current file as a string, for 'FileChunk' events only.
- FILE_CONTENT_CHARSET()
- This result function returns the character set portion of the 'ContentType' header for the current file, if there is one, or an empty string if not.
- FILE_CONTENT_LENGTH()
- This result function returns the value of the 'ContentLength' header for the current file, if there is one, or an empty string if not.
- FILE_CONTENT_TYPE()
- This result function returns the value of the 'ContentType' header for the current file, if there is one, or an empty string if not.
- FILE_FORMAT()
- This result function returns the format of the current file, if there is one and the operator can determine it, or an empty string if not.
- FILE_ID()
- This result function returns a unique numeric identifier for the current file.
- FILE_ID_PARENT()
- This result function returns the identifier of the file containing the current file, when the transaction contains a file containing other files, and the operator can decompose them, or zero if not.
- FLOW_DATA_BINARY()
- This result function returns the flow data received as a binary object, for the 'FlowData' event only.
- FLOW_DATA_COUNTER()
- This result function returns a sequence number for the FlowData events within a particular flow, starting at zero for each new flow, as identified by the FLOW_ID() function.
- FLOW_DATA_LENGTH()
- This result function returns the length of the flow data received, for the 'FlowData' event only.
- FLOW_DATA_STRING()
- This result function returns the flow data received as a string, for the 'FlowData' event only.
- FLOW_DIRECTION()
- This result function returns "SrcToDst" or "DstToSrc", where source and destination refer to the FLOW_xxxx_ADDRESS() functions, or "" if the operator cannot determine a direction.
- FLOW_DISCONNECT_REASON()
- This result function returns the reason a flow ended.
- FLOW_DST_BYTES()
- This result function returns the total number of bytes sent by the destination endpoint of the flow to the source endpoint, for the FlowEnd event only.
- FLOW_DST_PACKETS()
- This result function returns the total number of packets sent by the destination endpoint of the flow to the source endpoint, for the FlowEnd event only.
- FLOW_DST_PORT()
- This result function returns the UDP or TCP port number of the destination endpoint of this flow, if the flow's IP protocol is UDP or TCP, or zero otherwise.
- FLOW_ELAPSED_TIME()
- This result function returns the elapsed time of the flow in seconds, with a precision of microseconds, for the 'FlowEnd' event only.
- FLOW_END_TIME()
- This result function returns the time when the flow ended, in seconds, relative to the beginning of the Unix epoch (midnight on January 1st, 1970 in Greenwich, England), with a precision of microseconds, for the 'FlowEnd' event only.
- FLOW_ETHER_DST_ADDRESS()
- This result function returns the ethernet MAC address of the destination endpoint of this flow.
- FLOW_ETHER_SRC_ADDRESS()
- This result function returns the ethernet MAC address of the source endpoint of this flow.
- FLOW_EVENT_TIME()
- This result function returns the time of the current event, in seconds, relative to the beginning of the Unix epoch (midnight on January 1st, 1970 in Greenwich, England), with a precision of microseconds.
- FLOW_ID()
- This result function returns a unique numeric identifier for the current flow.
- FLOW_IPV4_DST_ADDRESS()
- This result function returns the IP version 4 address of the destination endpoint of this flow.
- FLOW_IPV4_SRC_ADDRESS()
- This result function returns the IP version 4 address of the source endpoint of this flow.
- FLOW_IP_PROTOCOL()
- This result function returns the value of the IP protocol field from the flow's IP headers, if it is an IP flow, or zero otherwise.
- FLOW_PROTOCOL()
- This result function returns the application protocol, if the operator can determine it, or an empty string if not.
- FLOW_PROTOCOL_CONFIDENCE()
- This result function returns an integer from 1 to 3 indicating the operator's confidence in its identification of the application protocol (see the FLOW_PROTOCOL() result function), from 'low' to 'high', respectively.
- FLOW_PROTOCOL_DEPTH()
- This result function returns a small value, usually between 0 and 7, indicating the nesting depth at which the application protocol (see the FLOW_PROTOCOL() result function) was identified.
- FLOW_REQUEST_HEADERS()
- This result function returns the request headers of the current transaction of the current flow, if it has any, or an empty string if not.
- FLOW_REQUEST_URI_AUTHORITY()
- This result function returns the 'authority' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_FRAGMENT()
- This result function returns the 'fragment' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_METHOD()
- This result function returns the 'method' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_NORMALIZED()
- This result function returns URI, the 'normalized' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_PATH()
- This result function returns the 'path' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_QUERY()
- This result function returns the 'query' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_RAW()
- This result function returns the 'raw' URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_SCHEME()
- This result function returns the 'scheme' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_REQUEST_URI_USERNAME()
- This result function returns the 'username' portion of a URI, when the current transaction of the current flow has one, or an empty string if not.
- FLOW_RESPONSE_HEADERS()
- This result function returns the response headers of the current transaction of the current flow, if it has any, or an empty string if not.
- FLOW_RESPONSE_STATUS_CODE()
- This result function returns the response status code of the current transaction of the current flow, if it has any, or an empty string if not.
- FLOW_SRC_BYTES()
- This result function returns the total number of bytes sent by the source endpoint of the flow to the destination endpoint, for the FlowEnd event only.
- FLOW_SRC_PACKETS()
- This result function returns the total number of packets sent by the source endpoint of the flow to the destination endpoint, for the FlowEnd event only.
- FLOW_SRC_PORT()
- This result function returns the UDP or TCP port number of the source endpoint of this flow, if the flow's IP protocol is UDP or TCP, or zero otherwise.
- FLOW_START_TIME()
- This result function returns the time when the flow started, in seconds, relative to the beginning of the Unix epoch (midnight on January 1st, 1970 in Greenwich, England), with a precision of microseconds.
- FLOW_TRANSACTION_ID()
- This result function returns a unique numeric identifier for the current request/response pair within the current flow, when there is one, or zero if not.
- IPFIX_bgpDestinationAsNumber()
- IPFIX field 17: The autonomous system (AS) number of the destination IP address.
- IPFIX_bgpNextAdjacentAsNumber()
- IPFIX field 128: The autonomous system (AS) number of the first AS in the AS path to the destination IP address.
- IPFIX_bgpNextHopIPv4Address()
- IPFIX field 18: The IPv4 address of the next (adjacent) BGP hop.
- IPFIX_bgpNextHopIPv6Address()
- IPFIX field 63: The IPv6 address of the next (adjacent) BGP hop.
- IPFIX_bgpPrevAdjacentAsNumber()
- IPFIX field 129: The autonomous system (AS) number of the last AS in the AS path from the source IP address.
- IPFIX_bgpSourceAsNumber()
- IPFIX field 16: The autonomous system (AS) number of the source IP address.
- IPFIX_collectorIPv4Address()
- IPFIX field 211: An IPv4 address to which the Exporting Process sends Flow information.
- IPFIX_collectorIPv6Address()
- IPFIX field 212: An IPv6 address to which the Exporting Process sends Flow information.
- IPFIX_collectorTransportPort()
- IPFIX field 216: The destination port identifier to which the Exporting Process sends Flow information.
- IPFIX_commonPropertiesId()
- IPFIX field 137: An identifier of a set of common properties that is unique per Observation Domain and Transport Session.
- IPFIX_destinationIPv4Address()
- IPFIX field 12: The IPv4 destination address in the IP packet header.
- IPFIX_destinationIPv4Prefix()
- IPFIX field 45: IPv4 destination address prefix.
- IPFIX_destinationIPv4PrefixLength()
- IPFIX field 13: The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element.
- IPFIX_destinationIPv6Address()
- IPFIX field 28: The IPv6 destination address in the IP packet header.
- IPFIX_destinationIPv6Prefix()
- IPFIX field 169: IPv6 destination address prefix.
- IPFIX_destinationIPv6PrefixLength()
- IPFIX field 30: The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element.
- IPFIX_destinationMacAddress()
- IPFIX field 80: The IEEE 802 destination MAC address field.
- IPFIX_destinationTransportPort()
- IPFIX field 11: The destination port identifier in the transport header.
- IPFIX_droppedOctetDeltaCount()
- IPFIX field 132: The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment.
- IPFIX_droppedOctetTotalCount()
- IPFIX field 134: The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.
- IPFIX_droppedPacketDeltaCount()
- IPFIX field 133: The number of packets since the previous report (if any) of this Flow dropped by packet treatment.
- IPFIX_droppedPacketTotalCount()
- IPFIX field 135: The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.
- IPFIX_egressInterface()
- IPFIX field 14: The index of the IP interface where packets of this Flow are being sent.
- IPFIX_enterpriseBasicListFieldAsByteLists(int32)
- This function returns the value of the specified IPFIX 'enterprise' field as a list of byte lists, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.
- IPFIX_enterpriseBasicListFieldAsIntegers(int32)
- This function returns the value of the specified IPFIX 'enterprise' field as a list of integers, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.
- IPFIX_enterpriseBasicListFieldAsStrings(int32)
- This function returns the value of the specified IPFIX 'enterprise' field as a list of strings, if it is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or an empty list if absent.
- IPFIX_enterpriseBasicListFieldElementIdentifier(int32)
- This function returns the value of the 'element identifier' corresponding to the specified IPFIX 'enterprise' 'field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.
- IPFIX_enterpriseBasicListFieldEnterpriseIdentifier(int32)
- This function returns the value of the 'enterprise identifier' corresponding to the specified IPFIX 'enterprise' field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.
- IPFIX_enterpriseBasicListFieldSemantic(int32)
- This function returns the value of the 'semantic code' corresponding to the specified IPFIX 'enterprise' field, if one is present in the 'data flow' record and it was encoded as an IPFIX 'basic list', or zero if absent.
- IPFIX_enterpriseFieldAsByteList(int32)
- This function returns the value of the specified IPFIX 'enterprise' field as a list of bytes, if it is present in the 'data flow' record, or zero if absent.
- IPFIX_enterpriseFieldAsInteger(int32)
- This function returns the value of the specified IPFIX 'enterprise' field as an integer, if it is present in the 'data flow' record, or zero if absent.
- IPFIX_enterpriseFieldAsString(int32)
- This function returns the value of the specified IPFIX 'enterprise' field as a string, if it is present in the 'data flow' record, or zero if absent.
- IPFIX_enterpriseIdentifier(int32)
- This function returns the value of the 'enterprise identifier' corresponding to the specified IPFIX 'field identifier', if one is present in the 'data flow' record, or zero if absent.
- IPFIX_exportInterface()
- IPFIX field 213: The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device.
- IPFIX_exportProtocolVersion()
- IPFIX field 214: The protocol version used by the Exporting Process for sending Flow information.
- IPFIX_exportTransportProtocol()
- IPFIX field 215: The value of the protocol number used by the Exporting Process for sending Flow information.
- IPFIX_exportedFlowRecordTotalCount()
- IPFIX field 42: The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process.
- IPFIX_exportedMessageTotalCount()
- IPFIX field 41: The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process.
- IPFIX_exportedOctetTotalCount()
- IPFIX field 40: The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process.
- IPFIX_exporterIPv4Address()
- IPFIX field 130: The IPv4 address used by the Exporting Process.
- IPFIX_exporterIPv6Address()
- IPFIX field 131: The IPv6 address used by the Exporting Process.
- IPFIX_exporterTransportPort()
- IPFIX field 217: The source port identifier from which the Exporting Process sends Flow information.
- IPFIX_exportingProcessId()
- IPFIX field 144: An identifier of an Exporting Process that is unique per IPFIX Device.
- IPFIX_flowActiveTimeout()
- IPFIX field 36: The number of seconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets.
- IPFIX_flowDirection()
- IPFIX field 61: The direction of the Flow observed at the Observation Point.
- IPFIX_flowDurationMicroseconds()
- IPFIX field 162: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.
- IPFIX_flowDurationMilliseconds()
- IPFIX field 161: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.
- IPFIX_flowEndDeltaMicroseconds()
- IPFIX field 159: This is a relative timestamp only valid within the scope of a single IPFIX Message.
- IPFIX_flowEndMicroseconds()
- IPFIX field 155: The absolute timestamp of the last packet of this Flow.
- IPFIX_flowEndMilliseconds()
- IPFIX field 153: The absolute timestamp of the last packet of this Flow.
- IPFIX_flowEndNanoseconds()
- IPFIX field 157: The absolute timestamp of the last packet of this Flow.
- IPFIX_flowEndReason()
- IPFIX field 136: The reason for Flow termination.
- IPFIX_flowEndSeconds()
- IPFIX field 151: The absolute timestamp of the last packet of this Flow.
- IPFIX_flowEndSysUpTime()
- IPFIX field 21: The relative timestamp of the last packet of this Flow.
- IPFIX_flowId()
- IPFIX field 148: An identifier of a Flow that is unique within an Observation Domain.
- IPFIX_flowIdleTimeout()
- IPFIX field 37: A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field.
- IPFIX_flowKeyIndicator()
- IPFIX field 173: This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key.
- IPFIX_flowLabelIPv6()
- IPFIX field 31: The value of the IPv6 Flow Label field in the IP packet header.
- IPFIX_flowStartDeltaMicroseconds()
- IPFIX field 158: This is a relative timestamp only valid within the scope of a single IPFIX Message.
- IPFIX_flowStartMicroseconds()
- IPFIX field 154: The absolute timestamp of the first packet of this Flow.
- IPFIX_flowStartMilliseconds()
- IPFIX field 152: The absolute timestamp of the first packet of this Flow.
- IPFIX_flowStartNanoseconds()
- IPFIX field 156: The absolute timestamp of the first packet of this Flow.
- IPFIX_flowStartSeconds()
- IPFIX field 150: The absolute timestamp of the first packet of this Flow.
- IPFIX_flowStartSysUpTime()
- IPFIX field 22: The relative timestamp of the first packet of this Flow.
- IPFIX_fragmentFlags()
- IPFIX field 197: Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively.
- IPFIX_fragmentIdentification()
- IPFIX field 54: The value of the Identification field in the IPv4 packet header or in the IPv6 Fragment header, respectively.
- IPFIX_fragmentOffset()
- IPFIX field 88: The value of the IP fragment offset field in the IPv4 packet header or the IPv6 Fragment header, respectively.
- IPFIX_icmpCodeIPv4()
- IPFIX field 177: Code of the IPv4 ICMP message.
- IPFIX_icmpCodeIPv6()
- IPFIX field 179: Code of the IPv6 ICMP message.
- IPFIX_icmpTypeCodeIPv4()
- IPFIX field 32: Type and Code of the IPv4 ICMP message.
- IPFIX_icmpTypeCodeIPv6()
- IPFIX field 139: Type and Code of the IPv6 ICMP message.
- IPFIX_icmpTypeIPv4()
- IPFIX field 176: Type of the IPv4 ICMP message.
- IPFIX_icmpTypeIPv6()
- IPFIX field 178: Type of the IPv6 ICMP message.
- IPFIX_igmpType()
- IPFIX field 33: The type field of the IGMP message.
- IPFIX_ignoredOctetTotalCount()
- IPFIX field 165: The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process.
- IPFIX_ignoredPacketTotalCount()
- IPFIX field 164: The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process.
- IPFIX_ingressInterface()
- IPFIX field 10: The index of the IP interface where packets of this Flow are being received.
- IPFIX_ipClassOfService()
- IPFIX field 5: For IPv4 packets, this is the value of the TOS field in the IPv4 packet header.
- IPFIX_ipDiffServCodePoint()
- IPFIX field 195: The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field.
- IPFIX_ipHeaderLength()
- IPFIX field 189: The length of the IP header.
- IPFIX_ipNextHopIPv4Address()
- IPFIX field 15: The IPv4 address of the next IPv4 hop.
- IPFIX_ipNextHopIPv6Address()
- IPFIX field 62: The IPv6 address of the next IPv6 hop.
- IPFIX_ipPayloadLength()
- IPFIX field 204: The effective length of the IP payload.
- IPFIX_ipPrecedence()
- IPFIX field 196: The value of the IP Precedence.
- IPFIX_ipTTL()
- IPFIX field 192: For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header.
- IPFIX_ipTotalLength()
- IPFIX field 224: The total length of the IP packet.
- IPFIX_ipVersion()
- IPFIX field 60: The IP version field in the IP packet header.
- IPFIX_ipv4IHL()
- IPFIX field 207: The value of the Internet Header Length (IHL) field in the IPv4 header.
- IPFIX_ipv4Options()
- IPFIX field 208: IPv4 options in packets of this Flow.
- IPFIX_ipv6ExtensionHeaders()
- IPFIX field 64: IPv6 extension headers observed in packets of this Flow.
- IPFIX_isMulticast()
- IPFIX field 206: If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero.
- IPFIX_lineCardId()
- IPFIX field 141: An identifier of a line card that is unique per IPFIX Device hosting an Observation Point.
- IPFIX_maximumIpTotalLength()
- IPFIX field 26: Length of the largest packet observed for this Flow.
- IPFIX_maximumTTL()
- IPFIX field 53: Maximum TTL value observed for any packet in this Flow.
- IPFIX_meteringProcessId()
- IPFIX field 143: An identifier of a Metering Process that is unique per IPFIX Device.
- IPFIX_minimumIpTotalLength()
- IPFIX field 25: Length of the smallest packet observed for this Flow.
- IPFIX_minimumTTL()
- IPFIX field 52: Minimum TTL value observed for any packet in this Flow.
- IPFIX_mplsLabelStackDepth()
- IPFIX field 202: The number of labels in the MPLS label stack.
- IPFIX_mplsLabelStackLength()
- IPFIX field 201: The length of the MPLS label stack in units of octets.
- IPFIX_mplsLabelStackSection10()
- IPFIX field 79: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9.
- IPFIX_mplsLabelStackSection2()
- IPFIX field 71: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection.
- IPFIX_mplsLabelStackSection3()
- IPFIX field 72: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2.
- IPFIX_mplsLabelStackSection4()
- IPFIX field 73: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3.
- IPFIX_mplsLabelStackSection5()
- IPFIX field 74: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4.
- IPFIX_mplsLabelStackSection6()
- IPFIX field 75: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5.
- IPFIX_mplsLabelStackSection7()
- IPFIX field 76: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6.
- IPFIX_mplsLabelStackSection8()
- IPFIX field 77: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7.
- IPFIX_mplsLabelStackSection9()
- IPFIX field 78: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8.
- IPFIX_mplsPayloadLength()
- IPFIX field 194: The size of the MPLS packet without the label stack.
- IPFIX_mplsTopLabelExp()
- IPFIX field 203: The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed.
- IPFIX_mplsTopLabelIPv4Address()
- IPFIX field 47: The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to.
- IPFIX_mplsTopLabelIPv6Address()
- IPFIX field 140: The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to.
- IPFIX_mplsTopLabelStackSection()
- IPFIX field 70: The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed.
- IPFIX_mplsTopLabelTTL()
- IPFIX field 200: The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed.
- IPFIX_mplsTopLabelType()
- IPFIX field 46: This field identifies the control protocol that allocated the top-of-stack label.
- IPFIX_mplsVpnRouteDistinguisher()
- IPFIX field 90: The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table.
- IPFIX_nextHeaderIPv6()
- IPFIX field 193: The value of the Next Header field of the IPv6 header.
- IPFIX_notSentFlowTotalCount()
- IPFIX field 166: The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.
- IPFIX_notSentOctetTotalCount()
- IPFIX field 168: The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.
- IPFIX_notSentPacketTotalCount()
- IPFIX field 167: The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process.
- IPFIX_observationDomainId()
- IPFIX field 149: An identifier of an Observation Domain that is locally unique to an Exporting Process.
- IPFIX_observationPointId()
- IPFIX field 138: An identifier of an Observation Point that is unique per Observation Domain.
- IPFIX_observedFlowTotalCount()
- IPFIX field 163: The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point.
- IPFIX_octetDeltaCount()
- IPFIX field 1: The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point.
- IPFIX_octetDeltaSumOfSquares()
- IPFIX field 198: The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point.
- IPFIX_octetTotalCount()
- IPFIX field 85: The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
- IPFIX_octetTotalSumOfSquares()
- IPFIX field 199: The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
- IPFIX_packetDeltaCount()
- IPFIX field 2: The number of incoming packets since the previous report (if any) for this Flow at the Observation Point.
- IPFIX_packetTotalCount()
- IPFIX field 86: The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
- IPFIX_paddingOctets()
- IPFIX field 210: The value of this Information Element is always a sequence of 0x00 values.
- IPFIX_payloadLengthIPv6()
- IPFIX field 191: This Information Element reports the value of the Payload Length field in the IPv6 header.
- IPFIX_portId()
- IPFIX field 142: An identifier of a line port that is unique per IPFIX Device hosting an Observation Point.
- IPFIX_postDestinationMacAddress()
- IPFIX field 57: The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postIpClassOfService()
- IPFIX field 55: The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postMCastOctetDeltaCount()
- IPFIX field 20: The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain.
- IPFIX_postMCastOctetTotalCount()
- IPFIX field 175: The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization.
- IPFIX_postMCastPacketDeltaCount()
- IPFIX field 19: The number of outgoing multicast packets since the previous report (if any) sent for packets of this Flow by a multicast daemon within the Observation Domain.
- IPFIX_postMCastPacketTotalCount()
- IPFIX field 174: The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the Metering Process (re-)initialization.
- IPFIX_postMplsTopLabelExp()
- IPFIX field 237: The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postOctetDeltaCount()
- IPFIX field 23: The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postOctetTotalCount()
- IPFIX field 171: The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postPacketDeltaCount()
- IPFIX field 24: The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postPacketTotalCount()
- IPFIX field 172: The definition of this Information Element is identical to the definition of Information Element 'packetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postSourceMacAddress()
- IPFIX field 81: The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_postVlanId()
- IPFIX field 59: The definition of this Information Element is identical to the definition of Information Element 'vlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
- IPFIX_protocolIdentifier()
- IPFIX field 4: The value of the protocol number in the IP packet header.
- IPFIX_sourceIPv4Address()
- IPFIX field 8: The IPv4 source address in the IP packet header.
- IPFIX_sourceIPv4Prefix()
- IPFIX field 44: IPv4 source address prefix.
- IPFIX_sourceIPv4PrefixLength()
- IPFIX field 9: The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element.
- IPFIX_sourceIPv6Address()
- IPFIX field 27: The IPv6 source address in the IP packet header.
- IPFIX_sourceIPv6Prefix()
- IPFIX field 170: IPv6 source address prefix.
- IPFIX_sourceIPv6PrefixLength()
- IPFIX field 29: The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element.
- IPFIX_sourceMacAddress()
- IPFIX field 56: The IEEE 802 source MAC address field.
- IPFIX_sourceTransportPort()
- IPFIX field 7: The source port identifier in the transport header.
- IPFIX_standardFieldAsByteList(int32)
- This function returns the value of the specified IPFIX 'standard' field as a list of bytes, if it is present in the 'data flow' record, or zero if absent.
- IPFIX_standardFieldAsInteger(int32)
- This function returns the value of the specified IPFIX 'standard' field as an integer, if it is present in the 'data flow' record, or zero if absent.
- IPFIX_standardFieldAsString(int32)
- This function returns the value of the specified IPFIX 'standard' field as a string, if it is present in the 'data flow' record, or zero if absent.
- IPFIX_systemInitTimeMilliseconds()
- IPFIX field 160: The absolute timestamp of the last (re-)initialization of the IPFIX Device.
- IPFIX_tcpAckTotalCount()
- IPFIX field 222: The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set.
- IPFIX_tcpAcknowledgementNumber()
- IPFIX field 185: The acknowledgement number in the TCP header.
- IPFIX_tcpControlBits()
- IPFIX field 6: TCP control bits observed for packets of this Flow.
- IPFIX_tcpDestinationPort()
- IPFIX field 183: The destination port identifier in the TCP header.
- IPFIX_tcpFinTotalCount()
- IPFIX field 219: The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set.
- IPFIX_tcpHeaderLength()
- IPFIX field 188: The length of the TCP header.
- IPFIX_tcpOptions()
- IPFIX field 209: TCP options in packets of this Flow.
- IPFIX_tcpPshTotalCount()
- IPFIX field 221: The total number of packets of this Flow with TCP "Push Function" (PSH) flag set.
- IPFIX_tcpRstTotalCount()
- IPFIX field 220: The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set.
- IPFIX_tcpSequenceNumber()
- IPFIX field 184: The sequence number in the TCP header.
- IPFIX_tcpSourcePort()
- IPFIX field 182: The source port identifier in the TCP header.
- IPFIX_tcpSynTotalCount()
- IPFIX field 218: The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set.
- IPFIX_tcpUrgTotalCount()
- IPFIX field 223: The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set.
- IPFIX_tcpUrgentPointer()
- IPFIX field 187: The urgent pointer in the TCP header.
- IPFIX_tcpWindowScale()
- IPFIX field 238: The scale of the window field in the TCP header.
- IPFIX_tcpWindowSize()
- IPFIX field 186: The window field in the TCP header.
- IPFIX_templateId()
- IPFIX field 145: An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain.
- IPFIX_totalLengthIPv4()
- IPFIX field 190: The total length of the IPv4 packet.
- IPFIX_udpDestinationPort()
- IPFIX field 181: The destination port identifier in the UDP header.
- IPFIX_udpMessageLength()
- IPFIX field 205: The value of the Length field in the UDP header.
- IPFIX_udpSourcePort()
- IPFIX field 180: The source port identifier in the UDP header.
- IPFIX_vlanId()
- IPFIX field 58: The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control Information field that was attached to the IP packet.
- IPFIX_wlanChannelId()
- IPFIX field 146: The identifier of the 802.11 (Wi-Fi) channel used.
- IPFIX_wlanSSID()
- IPFIX field 147: The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used.
- IPV4_DST_ADDRESS()
- This function returns the IP version 4 destination address of the current packet, if it has one, or zero otherwise.
- IPV4_DST_ADDRESS()
- This function returns the IP version 4 destination address of the current packet, if it has one, or zero otherwise.
- IPV4_SRC_ADDRESS()
- This function returns the IP version 4 source address of the current packet, if it has one, or zero otherwise.
- IPV4_SRC_ADDRESS()
- This function returns the IP version 4 source address of the current packet, if it has one, or zero otherwise.
- IPV6_DST_ADDRESS()
- This function returns the IP version 6 destination address of the current packet, if it has one, or an empty list otherwise.
- IPV6_DST_ADDRESS()
- This function returns the IP version 6 destination address of the current packet, if it has one, or an empty list otherwise.
- IPV6_SRC_ADDRESS()
- This function returns the IP version 6 source address of the current packet, if it has one, or an empty list otherwise.
- IPV6_SRC_ADDRESS()
- This function returns the IP version 6 source address of the current packet, if it has one, or an empty list otherwise.
- IP_DST_PORT()
- This function returns the TCP or UDP destination port number of the current packet, if it has one, or zero otherwise.
- IP_PROTOCOL()
- This function returns the IP protocol of the current packet, for example, '6' for TCP, or '17' for UDP, or zero if the ethernet packet does not contain an IP packet.
- IP_PROTOCOL()
- This function returns the IP protocol of the current packet, for example, '6' for TCP, or '17' for UDP, or zero if the ethernet packet does not contain an IP packet.
- IP_SRC_PORT()
- This function returns the TCP or UDP source port number of the current packet, if it has one, or zero otherwise.
- IP_VERSION()
- This function returns the IP version of the current packet ('4' for IP version 4, or '6' for IP version 6), if the ethernet packet contains an IP packet, or zero otherwise.
- IP_VERSION()
- This function returns the IP version of the current packet ('4' for IP version 4, or '6' for IP version 6), if the ethernet packet contains an IP packet, or zero otherwise.
- JMIRROR_DST_ADDRESS()
- This function returns the value of the 'jmirror' destination address in the current packet, if it has one, or zero if otherwise.
- JMIRROR_DST_PORT()
- This function returns the value of the 'jmirror' dstination port in the current packet, if it has one, or zero if otherwise.
- JMIRROR_INTERCEPT_ID()
- This function returns the value of the 'jmirror' intercept identifier in the current packet, if it has one, or zero if otherwise.
- JMIRROR_SESSION_ID()
- This function returns the value of the 'jmirror' session identifier in the current packet, if it has one, or zero if otherwise.
- JMIRROR_SRC_ADDRESS()
- This function returns the value of the 'jmirror' source address in the current packet, if it has one, or zero if otherwise.
- JMIRROR_SRC_PORT()
- This function returns the value of the 'jmirror' source port in the current packet, if it has one, or zero if otherwise.
- NETFLOW_APPLICATION_DESCRIPTION()
- This parser result function returns the application description.
- NETFLOW_APPLICATION_NAME()
- This parser result function returns the name associated with a classification.
- NETFLOW_APPLICATION_TAG()
- This parser result function returns 8 bits of engine ID, followed by n bits of classification.
- NETFLOW_BGP_IPV4_NEXT_HOP()
- This parser result function returns the IP version 4 address of the next router in the BGP domain.
- NETFLOW_BPG_IPV6_NEXT_HOP()
- This parser result function returns the next router in the BGP domain.
- NETFLOW_COUNT()
- This parser result function returns the number of Netflow records in the current message, including templates, options, and flows.
- NETFLOW_DIRECTION()
- This parser result function returns the direction of the flow, '0' for ingress, '1' for egress.
- NETFLOW_DST_AS()
- This parser result function returns the BGP autonomous system number of the destination endpoint of the current flow.
- NETFLOW_DST_MASK()
- This parser result function returns the number of significant bits in the IP version 4 address of the destination endpoint of the current flow record, if available, or zero if not.
- NETFLOW_DST_PORT()
- This parser result function returns the TCP or UDP port number of the destination endpoint of the current flow record, if available, or zero if not.
- NETFLOW_DST_TOS()
- This parser result function returns the 'type of service' byte setting for the flow when exiting the outgoing interface.
- NETFLOW_DST_TRAFFIC_INDEX()
- This parser result function returns BGP policy accounting destination traffic index.
- NETFLOW_DST_VLAN()
- This parser result function returns the virtual LAN identifier associated with the egress interface.
- NETFLOW_ENGINE_ID()
- This parser result function returns the identifier of the switching engine in the router.
- NETFLOW_ENGINE_TYPE()
- This parser result function returns the type code of the switching engine in the router.
- NETFLOW_FIELD_AS_BYTE_LIST(int32)
- This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as list of unsigned bytes, or an empty list if not.
- NETFLOW_FIELD_AS_INTEGER(int32)
- This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as an unsigned integer, or zero if not.
- NETFLOW_FIELD_AS_STRING(int32)
- This parser result function returns the value of the specified Netflow version 9 field in the current flow record, if present, represented as a string, or an empty string if not.
- NETFLOW_FIRST_SWITCHED()
- This parser result function returns the value of NETFLOW_SYSTEM_UPTIME() for the first packet of the current flow, that is, the time that the first packet in this flow passed through the router, relative to when the router was booted, in milliseconds.
- NETFLOW_FLOWS()
- This parser result function returns the number of flows that were aggregated for the current flow record, if available, or zero if not.
- NETFLOW_FLOW_ACTIVE_TIMEOUT()
- This parser result function returns the timeout value, in seconds, for active flow entries in the Netflow cache.
- NETFLOW_FLOW_INACTIVE_TIMEOUT()
- This parser result function returns the timeout value, in seconds, for inactive flow entries in the Netflow cache.
- NETFLOW_FLOW_SAMPLER_ID()
- This parser result function returns the identifier shown in "show flow-sampler".
- NETFLOW_FLOW_SAMPLER_MODE()
- This parser result function returns the sampling mode, when Netflow is sampled, For Netflow version 9, this is field 49.
- NETFLOW_FLOW_SAMPLER_RANDOM_INTERVAL()
- This parser result function returns the packet sampling interval, when Netflow is sampled.
- NETFLOW_FORWARDING_STATUS()
- This parser result function returns the forwarding status, with the 2 left bits giving the status and the 6 remaining bits giving the reason code.
- NETFLOW_FRAGMENT_OFFSET()
- This parser result function returns the fragment offset value from fragmented IP packets.
- NETFLOW_ICMP_TYPE()
- This parser result function returns the ICMP packet type.
- NETFLOW_IF_DESC()
- This parser result function returns the router's interface description.
- NETFLOW_IF_NAME()
- This parser result function returns the router's interface name.
- NETFLOW_INPUT_INTERFACE()
- This parser result function returns the interface index where the current flow entered the router, if available, or zero if not.
- NETFLOW_IN_BYTES()
- This parser result function returns the number of bytes that entered the router for the current flow record, if available, or zero if not.
- NETFLOW_IN_PERMANENT_BYTES()
- This parser result function returns the running byte counter for a permanent flow.
- NETFLOW_IN_PERMANENT_PKTS()
- This parser result function returns the running packet counter for a permanent flow.
- NETFLOW_IN_PKTS()
- This parser result function returns the number of packets that entered the router for the current flow record, if available, or zero if not.
- NETFLOW_IPV4_DST_ADDR()
- This parser result function returns the IP version 4 address of the destination endpoint of the current flow record, if available, or zero if not.
- NETFLOW_IPV4_DST_PREFIX()
- This parser result function returns the IP version 4 destination address prefix (specific for Cisco Catalyst architecture).
- NETFLOW_IPV4_IDENT()
- This parser result function returns The IP version 4 identification field of the flow.
- NETFLOW_IPV4_NEXT_HOP()
- This parser result function returns the IP version 4 address of the next router towards the destination endpoint of the current flow.
- NETFLOW_IPV4_SRC_ADDR()
- This parser result function returns the IP version 4 address of the source endpoint of the current flow record, if available, or zero if not.
- NETFLOW_IPV4_SRC_PREFIX()
- This parser result function returns the IP version 4 source address prefix (specific for Cisco Catalyst architecture).
- NETFLOW_IPV6_DST_ADDR()
- This parser result function returns the IP version 6 address of the destination endpoint of the current flow record, if available, or an empty list if not.
- NETFLOW_IPV6_DST_MASK()
- This parser result function returns the number of significant bits in the IP version 6 address of the source endpoint of the current flow record, if available, or zero if not.
- NETFLOW_IPV6_FLOW_LABEL()
- This parser result function returns the IP version 6 flow label.
- NETFLOW_IPV6_NEXT_HOP()
- This parser result function returns the IP version 6 address of the next-hop router.
- NETFLOW_IPV6_OPTION_HEADERS()
- This parser result function returns the IP version 6 option headers found in the flow.
- NETFLOW_IPV6_SRC_ADDR()
- This parser result function returns the IP version 6 address of the source endpoint of the current flow record, if available, or an empty list if not.
- NETFLOW_IPV6_SRC_MASK()
- This parser result function returns the number of significant bits in the IP version 6 address of the source endpoint of the current flow record, if available, or zero if not.
- NETFLOW_IP_PROTOCOL_VERSION()
- This parser result function returns the IP version for the flow, either '4' or '6'.
- NETFLOW_LAST_SWITCHED()
- This parser result function returns the value of NETFLOW_SYSTEM_UPTIME() for the last packet of the current flow, that is, the time that the last packet in this flow passed through the router, relative to when the router was booted, in milliseconds.
- NETFLOW_MAC_DST_ADDR_IN()
- This parser result function returns the incoming destination MAC address.
- NETFLOW_MAC_DST_ADDR_OUT()
- This parser result function returns the incoming destination MAC address for the flow.
- NETFLOW_MAC_SRC_ADDR_IN()
- This parser result function returns the incoming source MAC address for the flow.
- NETFLOW_MAC_SRC_ADDR_OUT()
- This parser result function returns the outgoing source MAC address.
- NETFLOW_MAX_PKT_LNGTH()
- This parser result function returns the maximum packet length for the current flow.
- NETFLOW_MAX_TTL()
- This parser result function returns the maximum 'time to live' for incoming packets of the flow.
- NETFLOW_MIN_PKT_LNGTH()
- This parser result function returns the minimum packet length for the current flow.
- NETFLOW_MIN_TTL()
- This parser result function returns the minimum 'time to live' for incoming packets of the flow.
- NETFLOW_MPLS_LABEL(int32)
- This parser result function returns the MPLS label at the specified position in the stack, where the position is specified with an argument between 1 and 10.
- NETFLOW_MPLS_PAL_RD()
- This parser result function returns the MPLS PAL Route Distinguisher.
- NETFLOW_MPLS_PREFIX_LEN()
- This parser result function returns the number of consecutive bits in the MPLS prefix length.
- NETFLOW_MPLS_TOP_LABEL_IPV4_ADDR()
- This parser result function returns the Forwarding Equivalent Class corresponding to the MPLS Top Label.
- NETFLOW_MPLS_TOP_LABEL_TYPE()
- This parser result function returns the MPLS top label type, '0' for UNKNOWN, '1' for TE-MIDPT, '2' for ATOM, '3' for VPN '4' for BGP, '5' for LDP.
- NETFLOW_MUL_DST_BYTES()
- This parser result function returns the number of outgoing multicast bytes in the current flow.
- NETFLOW_MUL_DST_PKTS()
- This parser result function returns the number of outgoing multicast packets in the current flow.
- NETFLOW_MUL_IGMP_TYPE()
- This parser result function returns the IGMP packet type.
- NETFLOW_OUTPUT_INTERFACE()
- This parser result function returns the interface index where the current flow left the router, if available, or zero if not.
- NETFLOW_OUT_BYTES()
- This parser result function returns the number of bytes that left the router for the current flow.
- NETFLOW_OUT_PKTS()
- This parser result function returns the number of packets that left the router for the current flow.
- NETFLOW_POST_IP_DSCP()
- This parser result function returns the value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services Field, after modification.
- NETFLOW_PROTOCOL()
- This parser result function returns the IP protocol number for the current flow record, if available, for example, '17' for UDP, or '6' for TCP, or zero if not.
- NETFLOW_REPLICATION_FACTOR()
- This parser result function returns the multicast replication factor.
- NETFLOW_SAMPLER_NAME()
- This parser result function returns the name of the flow sampler, when Netflow is sampled.
- NETFLOW_SAMPLING_ALGORITHM()
- This parser result function returns the sampling algorithm, when Netflow is sampled, with '1' for deterministic sampling, and '2' for random sampling.
- NETFLOW_SAMPLING_INTERVAL()
- This parser result function returns the sampling rate, when Netflow is sampled, for example, a value of 100 indicates that one of every 100 packets is sampled.
- NETFLOW_SEQUENCE_NUMBER()
- This parser result function returns the sequence number assigned to the current message by the router.
- NETFLOW_SOURCE_ID()
- This parser result function returns the port identifier of the router.
- NETFLOW_SRC_AS()
- This parser result function returns the BGP autonomous system number of the source endpoint of the current flow.
- NETFLOW_SRC_MASK()
- This parser result function returns the number of significant bits in the IP version 4 address of the source endpoint of the current flow record, if available, or zero if not.
- NETFLOW_SRC_PORT()
- This parser result function returns the TCP or UDP port number of the source endpoint of the current flow record, if available, or zero if not.
- NETFLOW_SRC_TOS()
- This parser result function returns the IP 'type of service' byte for the current flow record on entering the router, if available, or zero if not.
- NETFLOW_SRC_TRAFFIC_INDEX()
- This parser result function returns BGP policy accounting source traffic index.
- NETFLOW_SRC_VLAN()
- This parser result function returns the virtual LAN identifier associated with the ingress interface.
- NETFLOW_SYSTEM_UPTIME()
- This parser result function returns the elapsed time from when the router started until the current message was sent, in milliseconds.
- NETFLOW_TCP_FLAGS()
- This parser result function returns the cumulative value of all TCP flags in the current flow record, that is, the logical 'or' of the TCP flags in all packets in the flow, if available, or zero if not.
- NETFLOW_TOTAL_BYTES_EXP()
- This parser result function returns the number of bytes exported by the Observation Domain.
- NETFLOW_TOTAL_FLOWS_EXP()
- This parser result function returns the number of flows exported by the Observation Domain.
- NETFLOW_TOTAL_PKTS_EXP()
- This parser result function returns the number of packets exported by the Observation Domain.
- NETFLOW_UNIX_NANOSECONDS()
- This parser result function returns the fractional part of NETFLOW_UNIX_SECONDS(), in nanoseconds, for Netflow version 5 messages only.
- NETFLOW_UNIX_SECONDS()
- This parser result function returns the time that the current message was sent, in seconds, according to the router's clock, relative to the beginning of the Unix epoch (at midnight on the first of January in Greenwich, England).
- NETFLOW_VERSION()
- This parser result function returns the Netflow version of the current message, either '5' or '9'.
- OPEN_FILES()
- This result function returns the number of files that are open at the time the tuple is produced.
- OPEN_FILES_HIGH_WATER_MARK()
- This result function returns the maximum number of files that were ever open simultaneously, since the operator started.
- OPEN_FLOWS()
- This result function returns the number of flows that are open at the time the tuple is produced.
- OPEN_FLOWS_HIGH_WATER_MARK()
- This result function returns the maximum number of flows that were ever open simultaneously, since the operator started.
- PACKET_DATA()
- This function returns the network data in the current packet, including all network headers.
- PACKET_DATA()
- This function returns the network data in the current packet, including all network headers.
- PACKET_LENGTH()
- This function returns the number of bytes of network data in the current packet, including all network headers.
- PACKET_LENGTH()
- This function returns the number of bytes of network data in the current packet, including all network headers.
- PAYLOAD_DATA()
- This function returns the payload data in the current packet, excluding all network headers.
- PAYLOAD_DATA()
- This function returns the payload data in the current packet, excluding all network headers.
- PAYLOAD_LENGTH()
- This function returns the number of bytes of payload data in the current packet, excluding all network headers.
- PAYLOAD_LENGTH()
- This function returns the number of bytes of payload data in the current packet, excluding all network headers.
- TCP_ACKNOWLEDGEMENT()
- This function returns the value of the TCP acknowledgement number in the current packet, if it has one, or zero if otherwise.
- TCP_DST_PORT()
- This function returns the TCP destination port number of the current packet, if it has one, or zero otherwise.
- TCP_FLAGS_ACK()
- This function returns true if the current packet has a TCP 'ack' flag and its set, or false otherwise.
- TCP_FLAGS_FIN()
- This function returns true if the current packet has a TCP 'fin' flag and its set, or false otherwise.
- TCP_FLAGS_PUSH()
- This function returns true if the current packet has a TCP 'push' flag and its set, or false otherwise.
- TCP_FLAGS_RESET()
- This function returns true if the current packet has a TCP 'reset' flag and its set, or false otherwise.
- TCP_FLAGS_SYN()
- This function returns true if the current packet has a TCP 'syn' flag and its set, or false otherwise.
- TCP_FLAGS_URGENT()
- This function returns true if the current packet has a TCP 'urgent' flag and its set, or false otherwise.
- TCP_PORT(uint16)
- This function returns true if the current packet has a TCP source or destination port, or false if not.
- TCP_SEQUENCE()
- This function returns the value of the TCP sequence number in the current packet, if it has one, or zero if otherwise.
- TCP_SRC_PORT()
- This function returns the TCP source port number of the current packet, if it has one, or zero otherwise.
- TCP_WINDOW()
- This function returns the value of the TCP window size in the current packet, if it has one, or zero if otherwise.
- TLS_RECORD_DIRECTION()
- This result function returns the direction this TLS message is going, if the flow is encrypted with the 'transport-layer security' protocol, or an empty string if not.
- TLS_RECORD_LENGTH()
- This result function returns the length of this TLS message, if the flow is encrypted with the 'transport-layer security' protocol, or '0' if not.
- TLS_RECORD_MORE()
- This result function indicates whether or not more TLS messages are coming, if the flow is encrypted with the 'transport-layer security' protocol, or false if not.
- TLS_RECORD_OFFSET()
- This result function returns the offset of this TLS message, if the flow is encrypted with the 'transport-layer security' protocol, or '0' if not.
- TLS_RECORD_TYPE()
- This result function returns the type of TLS message found, if the flow is encrypted with the 'transport-layer security' protocol, or an empty string if not.
- TLS_VERSION()
- This result function returns the version of the TLS protocol being used, if the flow is encrypted with the 'transport-layer security' protocol, or an empty string if not.
- TUNNEL_IPV4_DST_ADDRESS()
- This result function returns the IP version 4 address of the innermost destination endpoint within the tunnel.
- TUNNEL_IPV4_SRC_ADDRESS()
- This result function returns the IP version 4 address of the innermost source endpoint within the tunnel.
- TUNNEL_IPV6_DST_ADDRESS()
- This result function returns the IP version 6 address of the innermost destination endpoint within the tunnel.
- TUNNEL_IPV6_SRC_ADDRESS()
- This result function returns the IP version 6 address of the innermost source endpoint within the tunnel.
- TUNNEL_TYPE()
- This result function returns characteristics of protocols found within another protocol.
- UDP_DST_PORT()
- This function returns the UDP destination port number of the current packet, if it has one, or zero otherwise.
- UDP_DST_PORT()
- This function returns the UDP destination port number of the current packet, if it has one, or zero otherwise.
- UDP_PORT(uint16)
- This function returns true if the current packet is a UDP packet and the argument matches its source or destination port, or false otherwise.
- UDP_PORT(uint16)
- This function returns true if the current packet is a UDP packet and the argument matches its source or destination port, or false otherwise.
- UDP_SRC_PORT()
- This function returns the UDP source port number of the current packet, if it has one, or zero otherwise.
- UDP_SRC_PORT()
- This function returns the UDP source port number of the current packet, if it has one, or zero otherwise.
- VLAN_TAGS()
- This function returns a list of 0 to N VLAN tags found in the current packet.
- VLAN_TAGS()
- This function returns a list of 0 to N VLAN tags found in the current packet.
- bytesProcessed()
- This function returns the number of bytes of network data processed by the operator since it started, including the current packet, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- bytesProcessed()
- This function returns the number of bytes of network data processed by the operator since it started, including the current packet, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- bytesReceived()
- This function returns the number of bytes received from the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not.
- compactIPV6(rstring)
- Compacts a valid IPv6 address (RFC3513).
- compare(rstring, rstring)
- Returns -1 if ip1 is less than ip2.
- convertHostnameToIPV4AddressNumeric(rstring)
- This function converts a hostname into a binary IPv4 address.
- convertHostnameToIPV4AddressString(rstring)
- This function converts a hostname into a string representation of an IPv4 address.
- convertIPV4AddressNumericToHostname(uint32)
- This function converts a four-byte binary representation of an IPv4 address into a hostname.
- convertIPV4AddressNumericToString(uint32)
- This function converts a four-byte binary representation of an IPv4 address into a string representation.
- convertIPV4AddressNumericToSubnet(uint32, int32)
- This function converts a four-byte binary representation of an IPv4 address into a four-byte binary subnet address, using the specified number of mask bits.
- convertIPV4AddressStringToHostname(rstring)
- This function converts a string containing an IPv4 address into a domain name, if the address has one.
- convertIPV4AddressStringToNumeric(rstring)
- This function converts a string representation of an IPv4 address to a four-byte binary representation.
- convertIPV4AddressStringToSubnet(rstring, int32)
- This function converts a string representing an IPv4 address into a string representation of the subnet address, using the specified number of mask bits.
- convertIPV6AddressNumericToString(list<uint8>[16])
- This function converts a sixteen-byte binary representation of an IPv6 address into a string representation.
- convertIPV6AddressStringToNumeric(rstring)
- This function converts a string representation of an IPv6 address into a sixteen-byte binary representation.
- convertMACAddressNumericToString(list<uint8>[6])
- This function converts an ethernet MAC address from a six-byte binary value to a string representation.
- convertMACAddressStringToNumeric(rstring)
- This function converts an ethernet MAC address from a string representation to a six-byte binary value.
- expandIPV6(rstring)
- Expands a valid IPv6 address (RFC3513).
- formatElapsedTime(float64)
- This function formats a value representing elapsed time, in seconds including a fractional part, as a string representation of that time in the form 'DDDDd HHh MMm SS.FFFFFFs', with leading zeros omitted.
- formatElapsedTime(float64, uint32)
- This function formats a value representing elapsed time, in seconds including a fractional part, as a string representation of that time in the form 'DDDDd HHh MMm SS.FFFFFFs', with leading zeros omitted.
- formatElapsedTime(uint32)
- This function formats an integer representing elapsed time, in seconds, as a string representation of that time in the form 'DDDDd HHh MMm SSs', with leading zeros omitted.
- formatEpoch(uint32, rstring)
- This function formats an integer representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string, according to an 'strftime' format pattern.
- formatEpochDateTime(float64)
- This function formats the integer and fractional parts of a value representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'YYYY-MM-DD HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochDateTime(float64, uint32)
- This function formats the integer and fractional parts of a value representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'YYYY-MM-DD HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochDateTime(timestamp)
- This function formats the integer and fractional parts of a timestamp representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'YYYY-MM-DD HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochDateTime(timestamp, uint32)
- This function formats the integer and fractional parts of a timestamp representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'YYYY-MM-DD HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochDateTime(uint32)
- This function formats an integer representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'YYYY-MM-DD HH:MM:SS' in the local time zone.
- formatEpochTime(float64)
- This function formats the integer and fractional parts of a value representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochTime(float64, uint32)
- This function formats the integer and fractional parts of a value representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochTime(timestamp)
- This function formats the integer and fractional parts of a timestamp representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochTime(timestamp, uint32)
- This function formats the integer and fractional parts of a timestamp representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'HH:MM:SS.FFFFFF' in the local time zone.
- formatEpochTime(uint32)
- This function formats an integer representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string in the form 'HH:MM:SS' in the local time zone.
- formatSubseconds(float64, uint32)
- This function formats the integer and fractional parts of a value representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string, with the specified precision for the fractional part.
- formatSubseconds(timestamp, uint32)
- This function formats the integer and fractional parts of a timestamp representing 'Unix epoch' time (that is, seconds since January 1st, 1970 at midnight in Greenwich, England) as a string, with the specified precision for the fractional part.
- getAllAddressesInNetwork(rstring)
- Returns a list of all IP addresses in the network.
- isEqualTo(rstring, rstring)
- Returns true if ip1 and ip2 are valid IPv4 addresses and ip1 address is equal to ip2 address.
- isEqualTo(rstring, rstring)
- Returns true if ip1 and ip2 are valid IPv6 addresses and ip1 address is equal to ip2 address.
- isGlobal(rstring)
- Returns true if a valid IPv4 address was provided and the IP address is not a reserved address.
- isGreaterThan(rstring, rstring)
- Returns true if ip1 and ip2 are valid IPv4 addresses and ip1 address is greater than ip2 address.
- isGreaterThan(rstring, rstring)
- Returns true if ip1 and ip2 are valid IPv6 addresses and ip1 address is greater than ip2 address.
- isIPV4Address(rstring)
- Returns true if the value parameter contains a valid IPv4 address in dotted-decimal notation (i.e <IP_ADDRESS>), otherwise returns false.
- isIPV4CIDRNotation(rstring)
- Returns true if a the networkCIDR argument contains a valid network address in CIDR format (i.e. <IP_ADDRESS>/24). Otherwise returns false.
- isIPV6Address(rstring)
- Returns true if the value parameter contains a valid IPv6 address.
- isIPV6CIDRNotation(rstring)
- Returns true if the networkCIDR argument contains a valid IPv6 network address in CIDR format (i.e. 2001:db8::/32). Otherwise returns false.
- isInIPRange(rstring, rstring, rstring)
- Returns true if startIP, endIP and ip are valid IPv4 addresses and ip falls within the range from startIP (inclusive) to endIP (exclusive).
- isInIPRange(rstring, rstring, rstring)
- Returns true if startIP, endIP and ip are valid IPv6 addresses and ip falls within the range from startIP (inclusive) to endIP (exclusive).
- isInNetwork(rstring, rstring)
- Return true if ip address is in the network provided by the networkCIDR argument.
- isInNetwork(rstring, rstring)
- Return true if ip address is in the network provided by the networkCIDR argument.
- isInNetwork(rstring, uint32)
- Return true if ip address is in the network provided by the networkCIDR argument.
- isInNetworkList(list<rstring>, rstring)
- Return true if ip address is in at least one of the networks provided by the networkList argument.
- isInNetworkList(list<rstring>, rstring)
- Return true if ip address is in at least one of the networks provided by the networkList argument.
- isLessThan(rstring, rstring)
- Returns true if ip1 and ip2 are valid IPv4 addresses and ip1 address is less than ip2 address.
- isLessThan(rstring, rstring)
- Returns true if ip1 and ip2 are valid IPv6 addresses and ip1 address is less than ip2 address.
- isLinkLocal(rstring)
- Returns true if a valid IPv4 address was provided and the IP address is a link local address (RFC3927).
- isLinkLocal(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is a link-local address (RFC3513).
- isLoopback(rstring)
- Returns true if a valid IPv4 address was provided and the IP address is a loopback address (RFC6890).
- isLoopback(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is a loopback address (RFC3513).
- isMulticast(rstring)
- Returns true if a valid IPv4 address was provided and the IP address is a multicast address (RFC5771).
- isMulticast(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is a multicast address (RFC3513).
- isNetworkOverlap(rstring, rstring)
- Returns true if networkCIDR1 and networkCIDR2 are valid networks in CIDR format and the networks overlap.
- isPrivate(rstring)
- Returns true if a valid IPv4 address was provided and the IP address is a private address (RFC1918).
- isReserved(rstring)
- Returns true if a valid IPv4 address was provided and the IP address is a reserved address (RFC1918).
- isSiteLocal(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is a site-local address (RFC3513).
- isUnspecified(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is a unspecified (RFC3513).
- isV4Compatible(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is an "IPv4-compatible IPv6 address" (RFC3513).
- isV4Mapped(rstring)
- Returns true if a valid IPv6 address was provided and the IP address is an "IPv4-mapped IPv6 address" (RFC3513).
- locationCityName(list<uint8>[16])
- This result function returns the city name for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationCityName(uint32)
- This result function returns the city name for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationCityNames(list<uint32>)
- This result function returns a list of city names corresponding to the specified list of IP version 4 addresses.
- locationContinentCode(list<uint8>[16])
- This result function returns the continent code for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationContinentCode(uint32)
- This result function returns the continent code for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationContinentCodes(list<uint32>)
- This result function returns a list of continent codes corresponding to the specified list of IP version 4 addresses.
- locationContinentName(list<uint8>[16])
- This result function returns the continent name for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationContinentName(uint32)
- This result function returns the continent name for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationContinentNames(list<uint32>)
- This result function returns a list of continent names corresponding to the specified list of IP version 4 addresses.
- locationCountryCode(list<uint8>[16])
- This result function returns the country code for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationCountryCode(uint32)
- This result function returns the country code for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationCountryCodes(list<uint32>)
- This result function returns a list of country codes corresponding to the specified list of IP version 4 addresses.
- locationCountryName(list<uint8>[16])
- This result function returns the country name for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationCountryName(uint32)
- This result function returns the country name for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationCountryNames(list<uint32>)
- This result function returns a list of country names corresponding to the specified list of IP version 4 addresses.
- locationFound(list<uint8>[16])
- This parser result function returns true if the location of the specified IP version 6 address was found, or false if not.
- locationFound(uint32)
- This parser result function returns true if the location of the specified IP version 4 address was found, or false if not.
- locationID(list<uint8>[16])
- This result function returns the location identifier for the specified IP version 6 address, if one was found, or an empty string if not.
- locationID(uint32)
- This result function returns the location identifier for the specified IP version 4 address, if one was found, or an empty string if not.
- locationIDs(list<uint32>)
- This result function returns a list of IDs corresponding to the specified list of IP version 4 addresses.
- locationLatitude(list<uint8>[16])
- This result function returns the latitude for the specified IP version 6 address, if its location was found, or zero if not.
- locationLatitude(uint32)
- This result function returns the latitude for the specified IP version 4 address, if its location was found, or zero if not.
- locationLatitudes(list<uint32>)
- This result function returns a list of latitudes corresponding to the specified list of IP version 4 addresses.
- locationLongitude(list<uint8>[16])
- This result function returns the longitude for the specified IP version 6 address, if its location was found, or zero if not.
- locationLongitude(uint32)
- This result function returns the longitude for the specified IP version 4 address, if its location was found, or zero if not.
- locationLongitudes(list<uint32>)
- This result function returns a list of longitudes corresponding to the specified list of IP version 4 addresses.
- locationMetroCode(list<uint8>[16])
- This result function returns the metro code for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationMetroCode(uint32)
- This result function returns the metro code for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationPostalCode(list<uint8>[16])
- This result function returns the postal code for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationPostalCode(uint32)
- This result function returns the postal code for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationPostalCodes(list<uint32>)
- This result function returns a list of postal codes corresponding to the specified list of IP version 4 addresses.
- locationRadii(list<uint32>)
- This result function returns a list of accuracy radii corresponding to the specified list of IP version 4 addresses.
- locationRadius(list<uint8>[16])
- This result function returns the accuracy of the latitude and longitude, expressed as a radius, for the specified IP version 6 address, if its location was found, or zero if not.
- locationRadius(uint32)
- This result function returns the accuracy of the latitude and longitude for the specified IP version 4 address, expressed as a radius, if its location was found, or zero if not.
- locationSubdivision1Code(list<uint8>[16])
- This result function returns the first division code (typically a state or province) for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision1Code(uint32)
- This result function returns the first division code (typically a state or province) for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision1Codes(list<uint32>)
- This result function returns a list of first subdivision codes corresponding to the specified list of IP version 4 addresses.
- locationSubdivision1Name(list<uint8>[16])
- This result function returns the first division name (typically a state or province) for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision1Name(uint32)
- This result function returns the first division name (typically a state or province) for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision1Names(list<uint32>)
- This result function returns a list of the first subdivision names corresponding to the specified list of IP version 4 addresses.
- locationSubdivision2Code(list<uint8>[16])
- This result function returns the second division code for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision2Code(uint32)
- This result function returns the second division code for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision2Codes(list<uint32>)
- This result function returns a list of second subdivision codes corresponding to the specified list of IP version 4 addresses.
- locationSubdivision2Name(list<uint8>[16])
- This result function returns the second division name for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision2Name(uint32)
- This result function returns the second division name for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationSubdivision2Names(list<uint32>)
- This result function returns a list of the second subdivision names corresponding to the specified list of IP version 4 addresses.
- locationSubnet(list<uint8>[16])
- This result function returns the IP subnet address and mask, in CIDR notation, for the specified IP version 6 address, if one was found, or an empty string if not.
- locationSubnet(uint32)
- This result function returns the IP subnet address and mask, in CIDR notation, for the specified IP version 4 address, if one was found, or an empty string if not.
- locationSubnetAddress(list<uint8>[16])
- This result function returns the IP version 6 subnet address for the specified IP version 6 address, if one was found, or zero if not.
- locationSubnetAddress(uint32)
- This result function returns the IP version 4 subnet address for the specified IP version 4 address, if one was found, or zero if not.
- locationSubnetAddresses(list<uint32>)
- This result function returns a list of subnet addresses corresponding to the specified list of IP version 4 addresses.
- locationSubnetMask(list<uint8>[16])
- This result function returns the IP version 6 subnet mask for the specified IP version 6 address, if one was found, or zero if not.
- locationSubnetMask(uint32)
- This result function returns the IP version 4 subnet mask for the specified IP version 4 address, if one was found, or zero if not.
- locationSubnetMasks(list<uint32>)
- This result function returns a list of subnet masks corresponding to the specified list of IP version 4 addresses.
- locationSubnets(list<uint32>)
- This result function returns a list of IP subnets and masks, in CIDR notation, corresponding to the specified list of IP version 4 addresses.
- locationTimezone(list<uint8>[16])
- This result function returns the continent time zone for the specified IP version 6 address, if its location was found and it has one, or an empty string if not.
- locationTimezone(uint32)
- This result function returns the continent time zone for the specified IP version 4 address, if its location was found and it has one, or an empty string if not.
- locationTimezones(list<uint32>)
- This result function returns a list of time zones corresponding to the specified list of IP version 4 addresses.
- locationsFound(list<uint32>)
- This result function returns a list of booleans indicating whether or not the specified list of IP version 4 addresses were found.
- messagesProcessed()
- This parser result function returns the number of messages processed by the operator since it started, including the current message.
- metricsIntervalBytesProcessed()
- This function returns the number of bytes of network data processed by the operator during the most recent metrics interval, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- metricsIntervalBytesProcessed()
- This function returns the number of bytes of network data processed by the operator during the most recent metrics interval, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- metricsIntervalBytesReceived()
- This function returns the number of bytes received from the network interface during the most recent metrics interval, if there is one, or zero if not.
- metricsIntervalElapsed()
- This function returns the duration of the most recent metrics interval, in seconds with a resolution of at least microseconds, if there is one, or zero if not.
- metricsIntervalElapsed()
- This function returns the duration of the most recent metrics interval, in seconds with a resolution of at least microseconds, if there is one, or zero if not.
- metricsIntervalPacketsDropped()
- This function returns the number of packets dropped by the network interface during the most recent metrics interval, if there is one, or zero if not.
- metricsIntervalPacketsDropped()
- This function returns the number of packets dropped by the network interface during the most recent metrics interval, if there is one, or zero if not.
- metricsIntervalPacketsProcessed()
- This function returns the number of network packets processed by the operator during the most recent metrics interval, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- metricsIntervalPacketsProcessed()
- This function returns the number of network packets processed by the operator during the most recent metrics interval, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- metricsIntervalPacketsReceived()
- This function returns the number of packets received from the network interface during the most recent metrics interval, if there is one, or zero if not.
- metricsIntervalPacketsReceived()
- This function returns the number of packets received from the network interface during the most recent metrics interval, if there is one, or zero if not.
- metricsUpdated()
- This function returns true for the first tuple produced after a new metrics interval begins, and returns false for all subsequent tuples produced in the same metrics interval.
- metricsUpdated()
- This function returns true for the first tuple produced after a new metrics interval begins, and returns false for all subsequent tuples produced in the same metrics interval.
- numAddressesInIPRange(rstring, rstring)
- Returns the number of IP addresses between ipStart (inclusive) and ipEnd (exclusive).
- numAddressesInNetwork(rstring)
- Returns the number of IP addresses contained within the network range.
- packetsDropped()
- This function returns the number of packets dropped by the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not.
- packetsDropped()
- This function returns the number of packets dropped by the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not.
- packetsProcessed()
- This function returns the number of network packets processed by the operator since it started, including the current packet, but excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- packetsProcessed()
- This function returns the number of network packets processed by the operator since it started, including the current packet, but excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.
- packetsReceived()
- This function returns the number of packets received from the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not.
- packetsReceived()
- This function returns the number of packets received from the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not.
- parseError()
- This DNS parser result function returns true if an encoding error was detected while decoding the current packet, or false otherwise.
- parseError()
- This parser result function returns true if an encoding error was detected while decoding the current packet, or false otherwise.
- parseErrorCode()
- This DNS parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found.
- parseErrorCode()
- This parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found.
- parseErrorDescription()
- This DNS parser result function returns a description of an encoding error found while decoding the current packet, or an empty string if no enoding errors were found.
- parseErrorDescription()
- This parser result function returns a description of an encoding error found while decoding the current packet, or an empty string if no enoding errors were found.
- parseErrorOffset()
- This DNS parser result function returns the offset from the beginning of the message to the encoding error found, or zero if no encoding errors were found.
- parseErrorOffset()
- This parser result function returns the offset from the beginning of the message to the encoding error found, or zero if no encoding errors were found.