Indexing Reference
The system may have multiple levels of nesting, for example there are 3 IPv4 address in a packet then ipv4_0_src, ipv4_1_src, ipv4_2_src are populated.
Time
ts_begin
Start PCAP timestamp of the flow/packet.
ts_end
End PCAP timestamp of the flow/packet
ts_snapshot
the Boundary start time of the snapshot when in Flow mode
hostname
The hostname the file was generated on. this identifies which system it was captured on
Protocol Specific
Protocol
proto
String describing the entire protocol encapsulation format
Hash
Hash functions run a dual CRC64 polynomial that is optimized for parallel calculation.
hash_half
Standard half duplex hash function, used for aggregation of uni-directional flows
hash_full
Full duplex hash function, used for aggregating bi-directional flows
hash_inner
The inner payload hash function, used for identifying the same packet across multiple networks
entropy_inner
Generates the Shannon entropy metric on the payload. This is used to detect encrypted
https://en.wikipedia.org/wiki/Entropy_(information_theory)
0 - (0) no entropy, repeated value
76 - 127 (3.0 - 5.0) uncompressed, unencrypted payload
179+ (7.0+) - compressed, encrypted payload
Ethernet
ether_[0..3]_dst
destination MAC, 6 bytes
ether_[0..3]_src
source MAC, 6 bytes
ether_[0..3]_type
EtherType of this ethernet layer
VLAN
vlan_[0..7]_tpid
VLAN TPID (0x8100 / 0x9100 / 0x88a8)
vlan_[0..7]_vid
12-bit VLAN ID
MPLS
mpls_[0..7]_id
20-bit MPLS label
mpls_[0..7]_tc
3-bit MPLS traffic class
GENEVE
Generic Network Virtualization Encapsulation. RFC 8926,
https://en.wikipedia.org/wiki/Generic_Network_Virtualization_Encapsulation
geneve_[0..3]_vni
24-bit GENEVE network identifier
IPv4
IP Version 4
https://en.wikipedia.org/wiki/IPv4
ipv4_[0..5]_src
IPv4 source address, network order
ipv4_[0..5]_dst
IPv4 destination address, network order
ipv4_[0..5]_proto
IP protocol number of the payload
ipv4_[0..5]_is_frag
packet is a non-first IP fragment
IPv6
IP Version 6
https://en.wikipedia.org/wiki/IPv6
ipv6_[0..3]_proto
IPv6 next-header protocol number
ipv6_[0..3]_src
IPv6 source address, 16 bytes
ipv6_[0..3]_dst
IPv6 destination address, 16 bytes
TCP
Transport Control Protocol
https://en.wikipedia.org/wiki/Transmission_Control_Protocol
tcp_[0..3]_port_src
TCP source port
tcp_[0..3]_port_dst
TCP destination port
UDP
User Datagram Protocol
https://en.wikipedia.org/wiki/User_Datagram_Protocol
udp_[0..3]_port_src
UDP source port
udp_[0..3]_port_dst
UDP destination port
GRE
Generic Routing Encapsulation
https://en.wikipedia.org/wiki/Generic_routing_encapsulation
gre_X_proto
GRE payload protocol (EtherType)
ICMP
Internet Control Message Protocol
https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol
icmp_[0..3]_type
ICMP message type
SCTP
Stream Control Transmission Protocol (4G/5G)
https://en.wikipedia.org/wiki/Stream_Control_Transmission_Protocol
sctp_[0..1]_port_src
SCTP source port
sctp_[0..1]_port_dst
SCTP destination port
GTPC
Generic Tunneling Protocol Control Plane
https://en.wikipedia.org/wiki/GPRS_Tunnelling_Protocol#GTP-C_-_GTP_control
gtpc_0_version
GTP-C protocol version (1 or 2)
gtpc_0_teid
GTP-C tunnel endpoint id
gtpc_0_imsi
IMSI extracted from the GTP-C IEs (0 if absent)
gtpc_0_imei
IMEI extracted from the GTP-C IEs (0 if absent)
gtpc_0_msisdn
MSISDN extracted from the GTP-C IEs (0 if absent)
gtpc_0_teid
GTP-U tunnel endpoint id
Tap Aggregation
Catch all for Tap Aggregation Packet Brokers
Currently support
Arista 7280 ETH64
Arista 7130 Footer
tapagg_[0..3]_ts
tap aggregation device timestamp, nanosecond epoch
tapagg_[0..3]_device_type
type of tapagg metadata found
arista7280_eth64
aritsa7130 (metawatch)
tapagg_[0..3]_device
aggregation device id (0 if the format has none)
tappagg_[0..3]_port
device ingress port (0 if the format has none)
tapagg_[0..3]_flag
device specific flags
PGM
Pragmatic General Multicast
https://en.wikipedia.org/wiki/Pragmatic_General_Multicast
pgm_[0]_port_src
PGM Source Port
pgm_[0]_port_dst
PGM Destination Port
pgm_[0]_type
PGM type flags. these are bits extracted from the header
SPM
ODATA
ODATA_RDATA
ODATA_SPM
And any other combination of the above PGM flags.
pgm_[0]_gsi
Global source Identifier
Neighbor
Using Neighbor protocols like LLDP and CDPv2 extract out the Switch and Port information, this can be very useful for idenifying what cables are patched where
neighbor_[0]_switch_name
Name of the switch
neighbor_[0]_port_name
Name of the Port on the switch
PTPv2
Extraction of PTPv2 specific fields
ptp_[0]_msg_type
PTPv2 Message type
ptp_[0]_version
PTPv2 Version number
ptp_[0]_version_minor
PTPv2 Version minor
ptp_[0]_domain
PTPv2 Domain number
ptp_[0]_clock_identity
Clock Identity, e.g. the grandmaster id
ptp_[0]_port_number
PTP port number
ptp_[0]_seq_no
PTP message seqence number
ptp_[0]_gm_identity
PTPv2 Grandmaster ID
ptp_[0]_gm_clock_class
Class of the GM
ptp_[0]_ts
PTPv2 Timestamp
ptp_[0]_utc_offset
Offset of UTC
ptp_[0]_time_source
Source of the time
Packet Metrics
These are metrics about the specific packet
byte_wire
Total bytes of the packet on the wire
byte_capture
Total bytes of the packet captured by the device
byte_inner
Total bytes of the inner TCP/UDP payload
pkt
Total number of packets
fcs_error_cnt
Number of FCS Errors