| 1 | <!--startmeta |
| 2 | custom_edit_url: "https://github.com/netdata/netdata/edit/master/docs/network-flows/field-reference.md" |
| 3 | sidebar_label: "Field Reference" |
| 4 | learn_status: "Published" |
| 5 | learn_rel_path: "Network Flows" |
| 6 | keywords: ['fields', 'flow record', 'schema', 'reference'] |
| 7 | endmeta--> |
| 8 | |
| 9 | <!-- markdownlint-disable-file --> |
| 10 | |
| 11 | # Field Reference |
| 12 | |
| 13 | Each flow record carries up to 91 fields. Some come straight from the exporter, others are added by enrichment after decode. This page is the canonical list — what each field means, where it comes from, and which protocols populate it. |
| 14 | |
| 15 | In the dashboard, fields appear by their canonical name (uppercase, e.g., `SRC_AS_NAME`). The dashboard is case-insensitive when typing into the filter ribbon. |
| 16 | |
| 17 | ## How to read the protocol columns |
| 18 | |
| 19 | | Symbol | Meaning | |
| 20 | |---|---| |
| 21 | | ✓ | Always populated by this protocol when the data is available | |
| 22 | | ◐ | Populated only when the exporter includes the relevant Information Element in its template (v9 / IPFIX) or the relevant record type (sFlow) | |
| 23 | | — | Never populated by this protocol; expect this field to be empty | |
| 24 | |
| 25 | Enrichment-only fields are marked **enrichment** — the decoder never fills them; they come from configured GeoIP databases, static metadata, classifiers, or routing sources. |
| 26 | |
| 27 | ## Counters and sampling |
| 28 | |
| 29 | The four most-used fields. Read these first. |
| 30 | |
| 31 | | Field | Type | Description | |
| 32 | |---|---|---| |
| 33 | | `BYTES` | uint64 | Bytes in the flow, **already multiplied by `SAMPLING_RATE`** at ingest. The dashboard's volume numbers come from this. | |
| 34 | | `PACKETS` | uint64 | Packets in the flow, already multiplied by `SAMPLING_RATE`. | |
| 35 | | `RAW_BYTES` | uint64 | Bytes the exporter literally reported, before per-flow sampling multiplication. Use when you want the unscaled value the exporter sent. | |
| 36 | | `RAW_PACKETS` | uint64 | Packets the exporter actually reported, before scaling. | |
| 37 | | `FLOWS` | uint64 | Number of flows aggregated into this record. Always 1 for raw records. | |
| 38 | | `SAMPLING_RATE` | uint64 | Packets-per-sample reported by the exporter. `1` means unsampled. Used as the multiplier for BYTES and PACKETS. | |
| 39 | |
| 40 | Every protocol populates these. sFlow always sends a sampling rate (per-sample). NetFlow v5 reads a header rate. NetFlow v7 has no rate field and is treated as unsampled. NetFlow v9 and IPFIX may include the rate per-record or via Sampling Options. |
| 41 | |
| 42 | ## Identity — who and what |
| 43 | |
| 44 | | Field | Type | v5 | v7 | v9 | IPFIX | sFlow | Description | |
| 45 | |---|---|---|---|---|---|---|---| |
| 46 | | `FLOW_VERSION` | string | ✓ | ✓ | ✓ | ✓ | ✓ | One of `v5`, `v7`, `v9`, `ipfix`, `sflow`. | |
| 47 | | `EXPORTER_IP` | IP | ✓ | ✓ | ✓ | ✓ | ✓ | The device that sent this flow. For sFlow, the agent address takes precedence over the UDP source IP. | |
| 48 | | `EXPORTER_PORT` | uint16 | ✓ | ✓ | ✓ | ✓ | ✓ | Source UDP port of the exporter. | |
| 49 | | `SRC_ADDR` | IP | ✓ | ✓ | ◐ | ◐ | ◐ | Source IP. v9/IPFIX from IE 8/27, sFlow from sampled header or `SampledIPv4`/`SampledIPv6`. | |
| 50 | | `DST_ADDR` | IP | ✓ | ✓ | ◐ | ◐ | ◐ | Destination IP. | |
| 51 | | `SRC_PORT` | uint16 | ✓ | ✓ | ◐ | ◐ | ◐ | Source L4 port. | |
| 52 | | `DST_PORT` | uint16 | ✓ | ✓ | ◐ | ◐ | ◐ | Destination L4 port. | |
| 53 | | `PROTOCOL` | uint8 | ✓ | ✓ | ✓ | ✓ | ◐ | IP protocol number. TCP=6, UDP=17, ICMP=1, ICMPv6=58, GRE=47, ESP=50. | |
| 54 | | `ETYPE` | uint16 | ✓ (IPv4) | ✓ (IPv4) | ◐ | ◐ | ◐ | EtherType. 2048 = IPv4, 34525 = IPv6. | |
| 55 | | `DIRECTION` | enum | — | — | ◐ | ◐ | — | `ingress`, `egress`, or `undefined`. | |
| 56 | |
| 57 | NetFlow v5 and v7 are IPv4-only. For v9, IPFIX, and sFlow, IPv6 fields populate when the exporter sends them. |
| 58 | |
| 59 | ## Routing — addresses and AS |
| 60 | |
| 61 | | Field | Type | Source | Description | |
| 62 | |---|---|---|---| |
| 63 | | `SRC_PREFIX` | IP | decoder + enrichment | Source network prefix. | |
| 64 | | `DST_PREFIX` | IP | decoder + enrichment | Destination network prefix. | |
| 65 | | `SRC_MASK` | uint8 | decoder + enrichment | Source prefix length in bits. | |
| 66 | | `DST_MASK` | uint8 | decoder + enrichment | Destination prefix length in bits. | |
| 67 | | `NEXT_HOP` | IP | decoder | BGP next-hop or RIB next-hop, depending on the exporter. | |
| 68 | | `SRC_AS` | uint32 | decoder + enrichment | Source autonomous system. | |
| 69 | | `DST_AS` | uint32 | decoder + enrichment | Destination autonomous system. | |
| 70 | | `SRC_AS_NAME` | string | **enrichment** | Friendly AS name (e.g., `AS15169 Google LLC`). | |
| 71 | | `DST_AS_NAME` | string | **enrichment** | Friendly AS name. | |
| 72 | | `DST_AS_PATH` | string | sFlow `ExtendedGateway` / BGP enrichment | BGP AS path as comma-separated ASNs. | |
| 73 | | `DST_COMMUNITIES` | string | sFlow `ExtendedGateway` / BGP enrichment | BGP communities. | |
| 74 | | `DST_LARGE_COMMUNITIES` | string | BGP enrichment | RFC 8092 large communities. | |
| 75 | |
| 76 | Static-network configuration can override `SRC_MASK` / `DST_MASK` and `SRC_AS` / `DST_AS` with more specific values from your CIDR-to-attribute map. |
| 77 | |
| 78 | ## Interfaces |
| 79 | |
| 80 | | Field | Type | Source | Description | |
| 81 | |---|---|---|---| |
| 82 | | `IN_IF` | uint32 | decoder | Ingress SNMP ifIndex. | |
| 83 | | `OUT_IF` | uint32 | decoder | Egress SNMP ifIndex. | |
| 84 | | `IN_IF_NAME` | string | **enrichment** | Friendly name. | |
| 85 | | `OUT_IF_NAME` | string | **enrichment** | Friendly name. | |
| 86 | | `IN_IF_DESCRIPTION` | string | **enrichment** | SNMP `ifDescr` or your label. | |
| 87 | | `OUT_IF_DESCRIPTION` | string | **enrichment** | SNMP `ifDescr` or your label. | |
| 88 | | `IN_IF_SPEED` | uint64 | **enrichment** | Interface speed in bps. | |
| 89 | | `OUT_IF_SPEED` | uint64 | **enrichment** | Interface speed in bps. | |
| 90 | | `IN_IF_PROVIDER` | string | **enrichment** | Your transit provider tag (e.g., `Cogent`, `Lumen`). | |
| 91 | | `OUT_IF_PROVIDER` | string | **enrichment** | Same. | |
| 92 | | `IN_IF_CONNECTIVITY` | string | **enrichment** | Connectivity type tag (`transit`, `peering`, `customer`, `cdn`, ...). | |
| 93 | | `OUT_IF_CONNECTIVITY` | string | **enrichment** | Same. | |
| 94 | | `IN_IF_BOUNDARY` | uint8 | **enrichment** | `1` = External (Internet-facing), `2` = Internal (LAN/private). | |
| 95 | | `OUT_IF_BOUNDARY` | uint8 | **enrichment** | Same. | |
| 96 | |
| 97 | `*_BOUNDARY` is counter-intuitive: 1 means "external" (the Internet side). It's defined that way so that filtering for `IN_IF_BOUNDARY=1` cleanly gives you "traffic that came in from the Internet". |
| 98 | |
| 99 | ## Layer 2 |
| 100 | |
| 101 | | Field | Type | v5 | v7 | v9 | IPFIX | sFlow | Description | |
| 102 | |---|---|---|---|---|---|---|---| |
| 103 | | `SRC_MAC` | MAC | — | — | ◐ | ◐ | ◐ | Source MAC. v9 IE 56, IPFIX IE 56/81. sFlow from `SampledHeader` or `SampledEthernet`. | |
| 104 | | `DST_MAC` | MAC | — | — | ◐ | ◐ | ◐ | Destination MAC. v9 IE 80, IPFIX IE 80/57. | |
| 105 | | `SRC_VLAN` | uint16 | — | — | ◐ | ◐ | ◐ | Source VLAN. v9 IE 58, IPFIX IE 58/243. **For sFlow, only from `ExtendedSwitch` records — NOT from 802.1Q tags inside a sampled packet header.** | |
| 106 | | `DST_VLAN` | uint16 | — | — | ◐ | ◐ | ◐ | Destination VLAN. | |
| 107 | | `MPLS_LABELS` | string | — | — | ◐ | ◐ | ◐ | MPLS label stack as comma-separated decimal label values (label only, not EXP/S/TTL). | |
| 108 | |
| 109 | ## NAT |
| 110 | |
| 111 | | Field | Type | v5/v7 | v9 | IPFIX | sFlow | Description | |
| 112 | |---|---|---|---|---|---|---| |
| 113 | | `SRC_ADDR_NAT` | IP | — | ◐ | ◐ | — | Post-NAT source address. v9 IE 225, IPFIX IE 225/281. | |
| 114 | | `DST_ADDR_NAT` | IP | — | ◐ | ◐ | — | Post-NAT destination address. | |
| 115 | | `SRC_PORT_NAT` | uint16 | — | ◐ | ◐ | — | Post-NAT source port. | |
| 116 | | `DST_PORT_NAT` | uint16 | — | ◐ | ◐ | — | Post-NAT destination port. | |
| 117 | |
| 118 | ## Protocol metadata |
| 119 | |
| 120 | | Field | Type | Description | |
| 121 | |---|---|---| |
| 122 | | `IPTTL` | uint8 | IP TTL. v9 uses Min/MaxTtl; IPFIX uses IE 192/52. | |
| 123 | | `IPTOS` | uint8 | IP Type of Service / DSCP byte. | |
| 124 | | `IPV6_FLOW_LABEL` | uint32 | IPv6 flow label (20-bit). v9/IPFIX only. | |
| 125 | | `TCP_FLAGS` | uint8 | OR of all TCP control bits seen in the flow (SYN/ACK/FIN/RST/PSH/URG). | |
| 126 | | `IP_FRAGMENT_ID` | uint32 | IPv4 ident or IPv6 fragment ID. | |
| 127 | | `IP_FRAGMENT_OFFSET` | uint16 | Non-zero means fragmented. | |
| 128 | | `ICMPV4_TYPE` | uint8 | ICMPv4 type. | |
| 129 | | `ICMPV4_CODE` | uint8 | ICMPv4 code. | |
| 130 | | `ICMPV6_TYPE` | uint8 | ICMPv6 type. | |
| 131 | | `ICMPV6_CODE` | uint8 | ICMPv6 code. | |
| 132 | | `FORWARDING_STATUS` | uint8 | RFC 7270 outcome code: `64..127` = forwarded, `128..191` = dropped, `192..255` = consumed. | |
| 133 | |
| 134 | ## Timestamps |
| 135 | |
| 136 | | Field | Type | Description | |
| 137 | |---|---|---| |
| 138 | | `FLOW_START_USEC` | uint64 | Microseconds since epoch. From v5/v7 first-switched + sysUptime; from v9 first-switched normalised against system init time; from IPFIX `flowStartMicroseconds` family. Not populated for sFlow. | |
| 139 | | `FLOW_END_USEC` | uint64 | Microseconds since epoch. Same sources. Not populated for sFlow. | |
| 140 | | `OBSERVATION_TIME_MILLIS` | uint64 | NetFlow v9 observation time (`ObservationTimeMilliseconds`, IE 323). IPFIX observation-time fields are not exposed. | |
| 141 | |
| 142 | ## Geolocation (enrichment-only) |
| 143 | |
| 144 | | Field | Type | Description | |
| 145 | |---|---|---| |
| 146 | | `SRC_COUNTRY` | string | ISO 3166 country code. | |
| 147 | | `DST_COUNTRY` | string | ISO 3166 country code. | |
| 148 | | `SRC_GEO_STATE` | string | State / province. | |
| 149 | | `DST_GEO_STATE` | string | State / province. | |
| 150 | | `SRC_GEO_CITY` | string | City. | |
| 151 | | `DST_GEO_CITY` | string | City. | |
| 152 | | `SRC_GEO_LATITUDE` | string | Decimal latitude (string-encoded). Hidden in tables by default. | |
| 153 | | `DST_GEO_LATITUDE` | string | Decimal latitude. | |
| 154 | | `SRC_GEO_LONGITUDE` | string | Decimal longitude. | |
| 155 | | `DST_GEO_LONGITUDE` | string | Decimal longitude. | |
| 156 | |
| 157 | City, latitude, and longitude are **not preserved in the rollup tiers** (1m, 5m, 1h). Aggregating on them forces the query to raw tier. Country and state survive into rollups. |
| 158 | |
| 159 | ## Network labels (enrichment-only) |
| 160 | |
| 161 | These are the labels you assign to your own networks via static-metadata or network-sources configuration. The decoder never fills them. |
| 162 | |
| 163 | | Field | Type | Description | |
| 164 | |---|---|---| |
| 165 | | `SRC_NET_NAME` | string | Friendly name for the source network. | |
| 166 | | `DST_NET_NAME` | string | Friendly name for the destination network. | |
| 167 | | `SRC_NET_ROLE` | string | Role tag (e.g., `dmz`, `office`, `printing`, `iot`). | |
| 168 | | `DST_NET_ROLE` | string | Role tag. | |
| 169 | | `SRC_NET_SITE` | string | Physical site (e.g., `dc-fra1`). | |
| 170 | | `DST_NET_SITE` | string | Physical site. | |
| 171 | | `SRC_NET_REGION` | string | Region (e.g., `eu`, `us-east`). | |
| 172 | | `DST_NET_REGION` | string | Region. | |
| 173 | | `SRC_NET_TENANT` | string | Tenant (multi-tenant deployments). | |
| 174 | | `DST_NET_TENANT` | string | Tenant. | |
| 175 | |
| 176 | ## Exporter labels (enrichment-only) |
| 177 | |
| 178 | Labels you attach to your exporters via static-metadata or classifiers. |
| 179 | |
| 180 | | Field | Type | Description | |
| 181 | |---|---|---| |
| 182 | | `EXPORTER_NAME` | string | Friendly name. Falls back to an IP-derived string if no enrichment match. | |
| 183 | | `EXPORTER_GROUP` | string | Group tag. | |
| 184 | | `EXPORTER_ROLE` | string | Role tag (e.g., `edge`, `core`, `wan`). | |
| 185 | | `EXPORTER_SITE` | string | Site tag. | |
| 186 | | `EXPORTER_REGION` | string | Region tag. | |
| 187 | | `EXPORTER_TENANT` | string | Tenant tag. | |
| 188 | |
| 189 | ## Per-protocol availability summary |
| 190 | |
| 191 | For exporter-derived fields (not enrichment), the protocols differ. The shortest version: |
| 192 | |
| 193 | - **NetFlow v5**: IPv4 5-tuple, AS, interfaces, next-hop, IPTOS, TCP flags, bytes, packets, sampling rate (header), first/last switched timestamps. No IPv6, MAC, VLAN, NAT, ICMP, MPLS. |
| 194 | - **NetFlow v7**: same as v5 minus the sampling rate. |
| 195 | - **NetFlow v9**: depends on the template. Theoretically all the IEs Netdata maps (see [the IPFIX/v9 IE map](#what-ies-are-mapped) below). IPv6 supported. |
| 196 | - **IPFIX**: superset of v9. Adds biflow (initiator/responder counters and `reverseInformationElement` IEs). Wider IE coverage. ICMP type and code as separate IEs. |
| 197 | - **sFlow v5**: depends on which sFlow record types the agent emits. From `SampledHeader` you get most fields after parsing the truncated packet (Ethernet/IPv4/IPv6/TCP/UDP/ICMP/MPLS). VLANs come only from `ExtendedSwitch`. AS path and BGP communities come from `ExtendedGateway`. Counter samples are dropped. |
| 198 | |
| 199 | ## What IEs are mapped |
| 200 | |
| 201 | For NetFlow v9 and IPFIX, only specific Information Elements end up in flow-record fields. The rest of the template is parsed (so the decoder can walk past them) but the values are dropped. |
| 202 | |
| 203 | The mapped IEs cover the standard set: identity (8/12/27/28, 7/11), counters (1/2/23/24/231/232/298/299), interfaces (10/14/252/253), protocol (4/5/6), ToS/DSCP (5/55), TTL (52/192), VLANs (58/59/243/254), MACs (56/80/57/81), NAT (225/226/281/282/227/228), AS (16/17), prefixes (44/45), masks (9/13/29/30), MPLS (70-79), ICMP (32/176-179, 139), fragmentation (54/88), IPv6 flow label (31), forwarding status (89), direction (61/239), sampling (34/50/305/306), timestamps (21/22/152/153/322 and the seconds/microseconds variants), and the data-link section for decapsulation (315). |
| 204 | |
| 205 | Vendor enterprise IEs are recognised only for one Juniper case (PEN 2636 `commonPropertiesId`) used to surface forwarding status. Cisco AVC, Cisco NEL/NSEL NAT events, and similar vendor-private fields are parsed (so the decoder doesn't fail) but their values are not exposed in flow records. |
| 206 | |
| 207 | If you need a specific IE mapped, open an issue with a sanitized sample export. |
| 208 | |
| 209 | ## Filtering and aggregation hints |
| 210 | |
| 211 | Some fields are queryable but not aggregatable: |
| 212 | |
| 213 | - `BYTES`, `PACKETS`, `FLOWS`, `RAW_BYTES`, `RAW_PACKETS`, `SAMPLING_RATE` — these are sums in tables and sankeys; you cannot filter or group-by them. |
| 214 | - `FLOW_START_USEC`, `FLOW_END_USEC`, `OBSERVATION_TIME_MILLIS` — timestamps stored on raw records; not used by the dashboard time picker and not used as facets. |
| 215 | - The four geo-coordinate fields (`SRC_GEO_LATITUDE/LONGITUDE`, `DST_GEO_LATITUDE/LONGITUDE`) are stored but hidden in the table by default and not exposed as facets. |
| 216 | |
| 217 | The dashboard also exposes two **virtual facets** that don't exist in the canonical schema: |
| 218 | |
| 219 | - `ICMPV4` — a synthesised string from `ICMPV4_TYPE` and `ICMPV4_CODE`, useful for filtering ICMPv4 messages by their named type/code combination (e.g., "echo-request"). |
| 220 | - `ICMPV6` — same for ICMPv6. |
| 221 | |
| 222 | Filtering on either of these virtual fields runs against the underlying `*_TYPE` and `*_CODE` fields. |
| 223 | |
| 224 | ## A note on field counts |
| 225 | |
| 226 | This reference lists the **91 fields** exposed by Network Flows, plus the virtual facets described above. |
| 227 | |
| 228 | ## Master index — every field at a glance |
| 229 | |
| 230 | Use this table as the single reference when you know the field name and want every dimension in one place. Sorted alphabetically. |
| 231 | |
| 232 | Column legend: |
| 233 | |
| 234 | - **v5 / v7 / v9 / IPFIX / sFlow** — `✓` always populated, `◐` only when the exporter sends the relevant IE/record, `—` never. |
| 235 | - **Source** — `decoder` (filled by parsing the protocol), `enrichment` (filled by post-decode lookups; the wire never carries it), or `both` (decoder may fill, enrichment may overlay/override). |
| 236 | - **Tiers** — which tiers preserve the field. `all` means raw + 1m + 5m + 1h. `raw` means raw only (dropped at rollup). |
| 237 | - **Selectivity** — which query roles the field plays. `facet` (autocomplete + filter ribbon), `group-by` (Sankey/timeseries/maps aggregation), `filter` (selections), `metric` (BYTES/PACKETS/FLOWS — sums in tables, not faceted), `hidden` (queryable but not in the default columns). |
| 238 | - **Notes** — IE numbers / sFlow record types when relevant, plus the enrichment chain for enrichment-derived fields. |
| 239 | |
| 240 | | Field | Type | v5 | v7 | v9 | IPFIX | sFlow | Source | Tiers | Selectivity | Notes | |
| 241 | |---|---|---|---|---|---|---|---|---|---|---| |
| 242 | | `BYTES` | uint64 | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | all | metric, filter | Counter; scaled by `SAMPLING_RATE` at ingest. sFlow derives from decoded L3 length | |
| 243 | | `DIRECTION` | string | — | — | ◐ | ◐ | — | decoder | all | facet, group-by, filter | v9 IE 61, IPFIX IE 61/239. sFlow has no native direction | |
| 244 | | `DST_ADDR` | IP | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9/IPFIX IE 12/28; sFlow `SampledHeader`/`SampledIPv4`/`SampledIPv6`. Raw-only | |
| 245 | | `DST_ADDR_NAT` | IP | — | — | ◐ | ◐ | — | decoder | raw | facet, group-by, filter | v9 IE 226/282; IPFIX `postNATdestinationIPv4/IPv6Address` | |
| 246 | | `DST_AS` | uint32 | ✓ | ✓ | ◐ | ◐ | ◐ | both | all | facet, group-by, filter | decoder IE 17 / sFlow `ExtendedGateway` last AS in path. Enrichment chain: `asn_providers` (default `[flow, routing, geoip]`); per-CIDR `enrichment.networks.<cidr>.asn` overrides | |
| 247 | | `DST_AS_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `format_as_name(DST_AS, attrs.asn_name)` → `AS{n} {name}`; falls back to `AS0 Unknown ASN` or `AS0 Private IP Address Space` | |
| 248 | | `DST_AS_PATH` | string | — | — | — | — | ◐ | both | raw | filter | sFlow `ExtendedGateway` BGP path. Routing enrichment overlay (BMP / BioRIS) for non-sFlow exporters | |
| 249 | | `DST_COMMUNITIES` | string | — | — | — | — | ◐ | both | raw | filter | sFlow `ExtendedGateway` communities. Routing enrichment overlay (BMP / BioRIS) | |
| 250 | | `DST_COUNTRY` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | GeoIP MMDB on `DST_ADDR` → optional override from `enrichment.networks.<cidr>.country` | |
| 251 | | `DST_GEO_CITY` | string | — | — | — | — | — | enrichment | raw | facet, group-by, filter | GeoIP city MMDB. Raw-only (dropped at rollup) | |
| 252 | | `DST_GEO_LATITUDE` | string | — | — | — | — | — | enrichment | raw | filter, hidden | GeoIP coordinates. Raw-only; hidden in default table view | |
| 253 | | `DST_GEO_LONGITUDE` | string | — | — | — | — | — | enrichment | raw | filter, hidden | GeoIP coordinates. Raw-only; hidden in default table view | |
| 254 | | `DST_GEO_STATE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | GeoIP subdivision. Preserved in rollups | |
| 255 | | `DST_LARGE_COMMUNITIES` | string | — | — | — | — | — | enrichment | raw | filter | RFC 8092 large communities from routing enrichment (BMP / BioRIS) | |
| 256 | | `DST_MAC` | MAC | — | — | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9 IE 80/57; IPFIX same. sFlow from `SampledHeader` datalink or `SampledEthernet` | |
| 257 | | `DST_MASK` | uint8 | ✓ | ✓ | ◐ | ◐ | ◐ | both | raw | facet, group-by, filter | v9 IE 13/29; sFlow `ExtendedRouter`. Enrichment overlay via `net_providers` (default `[flow, routing]`) plus per-CIDR overrides | |
| 258 | | `DST_NET_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.name` (static) merged with network sources by ascending prefix length | |
| 259 | | `DST_NET_REGION` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.region` from static + network sources | |
| 260 | | `DST_NET_ROLE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.role` from static + network sources | |
| 261 | | `DST_NET_SITE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.site` from static + network sources | |
| 262 | | `DST_NET_TENANT` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.tenant` from static + network sources | |
| 263 | | `DST_PORT` | uint16 | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9/IPFIX IE 11. sFlow from `SampledIPv4`/`SampledIPv6` or `SampledHeader` transport parse. Raw-only | |
| 264 | | `DST_PORT_NAT` | uint16 | — | — | ◐ | ◐ | — | decoder | raw | facet, group-by, filter | v9 IE 228; IPFIX `postNAPTdestinationTransportPort` | |
| 265 | | `DST_PREFIX` | IP | ✓ | ✓ | ◐ | — | — | decoder | raw | filter | v5/v7 derived from `DST_ADDR` & `DST_MASK`. v9 IE 45 (`Ipv4DstPrefix`). IPFIX has no canonical mapping; sFlow none | |
| 266 | | `DST_VLAN` | uint16 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v9 IE 59; IPFIX IE 254 (`PostVlanId`/`PostDot1qVlanId`). sFlow only via `ExtendedSwitch` (NOT from 802.1Q tag in `SampledHeader`) | |
| 267 | | `ETYPE` | uint16 | ✓ (IPv4) | ✓ (IPv4) | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v5/v7 hardcoded to 2048. v9/IPFIX IE 60 `IpProtocolVersion` (4→2048, 6→34525). sFlow from sampled L2 etype | |
| 268 | | `EXPORTER_GROUP` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.group`. Classifiers fill it when static metadata didn't | |
| 269 | | `EXPORTER_IP` | IP | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | all | facet, group-by, filter | UDP source IP for NetFlow. sFlow uses datagram `agent_address` (override) | |
| 270 | | `EXPORTER_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.name` → falls back to IP-derived name | |
| 271 | | `EXPORTER_PORT` | uint16 | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | all | facet, group-by, filter | UDP source port from socket | |
| 272 | | `EXPORTER_REGION` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.region`. Classifiers may fill | |
| 273 | | `EXPORTER_ROLE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.role`. Classifiers may fill | |
| 274 | | `EXPORTER_SITE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.site`. Classifiers may fill | |
| 275 | | `EXPORTER_TENANT` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.tenant`. Classifiers may fill | |
| 276 | | `FLOWS` | uint64 | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | all | metric, filter | Always 1 for raw records; sums during rollup aggregation | |
| 277 | | `FLOW_END_USEC` | uint64 | ✓ | ✓ | ◐ | ◐ | — | decoder | raw | hidden | v5/v7 from header `sysUpTime` + `LastSwitched`. v9 from `LastSwitched`/`flowEndMilliseconds` normalised against `system_init`. IPFIX from `flowEndMilliseconds` family. Not populated for sFlow | |
| 278 | | `FLOW_START_USEC` | uint64 | ✓ | ✓ | ◐ | ◐ | — | decoder | raw | hidden | Same sources as `FLOW_END_USEC`. Not populated for sFlow | |
| 279 | | `FLOW_VERSION` | string | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | all | facet, group-by, filter | One of `v5`, `v7`, `v9`, `ipfix`, `sflow` | |
| 280 | | `FORWARDING_STATUS` | uint8 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v9/IPFIX IE 89; IPFIX also from Juniper PEN 2636 `commonPropertiesId`. sFlow synthesises `128` (dropped) when `output_format` is `discarded` | |
| 281 | | `ICMPV4_CODE` | uint8 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | IPFIX IE 177 `IcmpCodeIpv4` + IE 32 low byte. v9 IE 178 `IcmpCodeValue` + IE 32. sFlow from decoded ICMP header | |
| 282 | | `ICMPV4_TYPE` | uint8 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | IPFIX IE 176 `IcmpTypeIpv4` + IE 32 high byte. v9 IE 32 `IcmpType` + IE 177 `IcmpTypeValue`. sFlow from decoded ICMP header | |
| 283 | | `ICMPV6_CODE` | uint8 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | IPFIX IE 179 `IcmpCodeIpv6` + IE 139 low byte. v9 IE 179 `ImpIpv6CodeValue`. sFlow from decoded ICMPv6 header | |
| 284 | | `ICMPV6_TYPE` | uint8 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | IPFIX IE 178 `IcmpTypeIpv6` + IE 139 high byte. v9 IE 178 `IcmpIpv6TypeValue`. sFlow from decoded ICMPv6 header | |
| 285 | | `IN_IF` | uint32 | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v9 IE 10 `InputSnmp`; IPFIX IE 10/252. sFlow flow-sample `input` (single index only; LOCAL→0) | |
| 286 | | `IN_IF_BOUNDARY` | uint8 | — | — | — | — | — | enrichment | all | facet, group-by, filter | Per-interface static metadata or interface classifier output. `1`=external, `2`=internal | |
| 287 | | `IN_IF_CONNECTIVITY` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | Per-interface static metadata or interface classifier (e.g., `transit`, `peering`, `customer`) | |
| 288 | | `IN_IF_DESCRIPTION` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.if_indexes.<idx>.description` or set via classifier `SetDescription()` | |
| 289 | | `IN_IF_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.if_indexes.<idx>.name` or set via classifier `SetName()` | |
| 290 | | `IN_IF_PROVIDER` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | Static metadata or interface classifier provider tag | |
| 291 | | `IN_IF_SPEED` | uint64 | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.if_indexes.<idx>.speed` (bps) | |
| 292 | | `IPTOS` | uint8 | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v9 IE 5 `SrcTos` / IE 55 `DstTos`. IPFIX IE 5/55. sFlow from `SampledIPv4` tos / `SampledIPv6` priority / parsed L3 | |
| 293 | | `IPTTL` | uint8 | — | — | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9 IE 52/192 (`Min/MaxTtl`). IPFIX same. sFlow from parsed L3 header | |
| 294 | | `IPV6_FLOW_LABEL` | uint32 | — | — | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9/IPFIX IE 31 `FlowLabelIpv6`. sFlow from parsed IPv6 header | |
| 295 | | `IP_FRAGMENT_ID` | uint32 | — | — | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9 IE 54 `Ipv4Ident`. IPFIX IE 54 `FragmentIdentification`. sFlow from parsed IPv4 header | |
| 296 | | `IP_FRAGMENT_OFFSET` | uint16 | — | — | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9/IPFIX IE 88 `FragmentOffset`. sFlow from parsed IPv4 header | |
| 297 | | `MPLS_LABELS` | string | — | — | ◐ | ◐ | ◐ | decoder | raw | filter | v9 IE 70-79 `MplsLabel1..10`. IPFIX IE 70 `MplsTopLabelStackSection` + 71-79 `MplsLabelStackSection2..10`. sFlow from MPLS in `SampledHeader`. Comma-separated decimal labels | |
| 298 | | `NEXT_HOP` | IP | ✓ | ✓ | ◐ | ◐ | ◐ | both | all | facet, group-by, filter | v9 IE 15/18/62/63; IPFIX same. sFlow `ExtendedRouter`/`ExtendedGateway`. Enrichment overlay via `net_providers` chain (default `[flow, routing]`) | |
| 299 | | `OBSERVATION_TIME_MILLIS` | uint64 | — | — | ◐ | — | — | decoder | raw | hidden | v9 IE 323 `ObservationTimeMilliseconds`. IPFIX observation-time fields are not exposed | |
| 300 | | `OUT_IF` | uint32 | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v9 IE 14 `OutputSnmp`; IPFIX IE 14/253. sFlow flow-sample `output` (single index only; LOCAL→0) | |
| 301 | | `OUT_IF_BOUNDARY` | uint8 | — | — | — | — | — | enrichment | all | facet, group-by, filter | Same semantics as `IN_IF_BOUNDARY` | |
| 302 | | `OUT_IF_CONNECTIVITY` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | Static metadata or interface classifier connectivity tag | |
| 303 | | `OUT_IF_DESCRIPTION` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.if_indexes.<idx>.description` | |
| 304 | | `OUT_IF_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.if_indexes.<idx>.name` | |
| 305 | | `OUT_IF_PROVIDER` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | Static metadata or interface classifier provider tag | |
| 306 | | `OUT_IF_SPEED` | uint64 | — | — | — | — | — | enrichment | all | facet, group-by, filter | `metadata_static.exporters.<ip>.if_indexes.<idx>.speed` (bps) | |
| 307 | | `PACKETS` | uint64 | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | all | metric, filter | Counter; scaled by `SAMPLING_RATE` at ingest. sFlow always 1 per sample | |
| 308 | | `PROTOCOL` | uint8 | ✓ | ✓ | ✓ | ✓ | ◐ | decoder | all | facet, group-by, filter | v5/v7 protocol_number; v9 IE 4; IPFIX IE 4 `ProtocolIdentifier`. sFlow from `SampledIPv4`/`SampledIPv6` or parsed L3 | |
| 309 | | `RAW_BYTES` | uint64 | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | raw | metric | Pre-sampling byte count from the exporter | |
| 310 | | `RAW_PACKETS` | uint64 | ✓ | ✓ | ✓ | ✓ | ✓ | decoder | raw | metric | Pre-sampling packet count from the exporter | |
| 311 | | `SAMPLING_RATE` | uint64 | ✓ (header) | — | ◐ | ◐ | ✓ | decoder | raw | metric | v5 from header `sampling_interval`. v7 has no rate (treated as unsampled). v9/IPFIX from IE 34/305/306 or Sampling Options template. sFlow per-sample rate | |
| 312 | | `SRC_ADDR` | IP | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9/IPFIX IE 8/27. sFlow `SampledHeader`/`SampledIPv4`/`SampledIPv6`. Raw-only | |
| 313 | | `SRC_ADDR_NAT` | IP | — | — | ◐ | ◐ | — | decoder | raw | facet, group-by, filter | v9 IE 225/281; IPFIX `postNATsourceIPv4/IPv6Address` | |
| 314 | | `SRC_AS` | uint32 | ✓ | ✓ | ◐ | ◐ | ◐ | both | all | facet, group-by, filter | decoder IE 16 / sFlow `ExtendedGateway` `src_as`. Enrichment chain: `asn_providers` (default `[flow, routing, geoip]`); per-CIDR `enrichment.networks.<cidr>.asn` overrides | |
| 315 | | `SRC_AS_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `format_as_name(SRC_AS, attrs.asn_name)` → `AS{n} {name}`; falls back to `AS0 Unknown ASN` or `AS0 Private IP Address Space` | |
| 316 | | `SRC_COUNTRY` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | GeoIP MMDB on `SRC_ADDR` → optional override from `enrichment.networks.<cidr>.country` | |
| 317 | | `SRC_GEO_CITY` | string | — | — | — | — | — | enrichment | raw | facet, group-by, filter | GeoIP city MMDB. Raw-only | |
| 318 | | `SRC_GEO_LATITUDE` | string | — | — | — | — | — | enrichment | raw | filter, hidden | GeoIP coordinates. Raw-only; hidden in default table view | |
| 319 | | `SRC_GEO_LONGITUDE` | string | — | — | — | — | — | enrichment | raw | filter, hidden | GeoIP coordinates. Raw-only; hidden in default table view | |
| 320 | | `SRC_GEO_STATE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | GeoIP subdivision. Preserved in rollups | |
| 321 | | `SRC_MAC` | MAC | — | — | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9 IE 56/81; IPFIX same. sFlow from `SampledHeader` datalink or `SampledEthernet` | |
| 322 | | `SRC_MASK` | uint8 | ✓ | ✓ | ◐ | ◐ | ◐ | both | raw | facet, group-by, filter | v9 IE 9/29; sFlow `ExtendedRouter`. Enrichment overlay via `net_providers` (default `[flow, routing]`) plus per-CIDR overrides | |
| 323 | | `SRC_NET_NAME` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.name` (static) merged with network sources by ascending prefix length | |
| 324 | | `SRC_NET_REGION` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.region` from static + network sources | |
| 325 | | `SRC_NET_ROLE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.role` from static + network sources | |
| 326 | | `SRC_NET_SITE` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.site` from static + network sources | |
| 327 | | `SRC_NET_TENANT` | string | — | — | — | — | — | enrichment | all | facet, group-by, filter | `enrichment.networks.<cidr>.tenant` from static + network sources | |
| 328 | | `SRC_PORT` | uint16 | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | raw | facet, group-by, filter | v9/IPFIX IE 7. sFlow from `SampledIPv4`/`SampledIPv6` or transport parse. Raw-only | |
| 329 | | `SRC_PORT_NAT` | uint16 | — | — | ◐ | ◐ | — | decoder | raw | facet, group-by, filter | v9 IE 227; IPFIX `postNAPTsourceTransportPort` | |
| 330 | | `SRC_PREFIX` | IP | ✓ | ✓ | ◐ | — | — | decoder | raw | filter | v5/v7 derived from `SRC_ADDR` & `SRC_MASK`. v9 IE 44 (`Ipv4SrcPrefix`). IPFIX has no canonical mapping; sFlow none | |
| 331 | | `SRC_VLAN` | uint16 | — | — | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | v9 IE 58; IPFIX IE 58/243 (`VlanId`/`Dot1qVlanId`). sFlow only via `ExtendedSwitch` (NOT from 802.1Q tag in `SampledHeader`) | |
| 332 | | `TCP_FLAGS` | uint8 | ✓ | ✓ | ◐ | ◐ | ◐ | decoder | all | facet, group-by, filter | OR of all TCP control bits seen in the flow. v9/IPFIX IE 6. sFlow from parsed TCP header in `SampledHeader` | |
| 333 | |
| 334 | The two virtual facets (`ICMPV4`, `ICMPV6`) aren't in this table because they don't exist in the canonical schema — they are synthesised string facets that filter on `ICMPV4_TYPE`/`ICMPV4_CODE` (or v6) under the hood. See the previous section. |
| 335 | |
| 336 | ## What's next |
| 337 | |
| 338 | - [Configuration](/docs/network-flows/configuration.md) — `netflow.yaml` reference. |
| 339 | - [Retention and Querying](/docs/network-flows/retention-querying.md) — How the four tiers store data and which fields they preserve. |
| 340 | - [Visualisation](/docs/network-flows/visualization/summary-sankey.md) — Reading the dashboard. |
| 341 | - [Validation and Data Quality](/docs/network-flows/validation.md) — How to know your data is right. |