Prisma SD-WAN
Flow Information Elements
Table of Contents
Expand All
|
Collapse All
Prisma SD-WAN Docs
-
-
- Prisma SD-WAN Key Elements
- Prisma SD-WAN Releases and Upgrades
- Use Copilot in Prisma SD-WAN
- Prisma SD-WAN Summary
- Prisma SD-WAN Application Insights
- Device Activity Charts
- Site Summary Dashboard
- Prisma SD-WAN Predictive Analytics Dashboard
- Prisma SD-WAN Link Quality Dashboard
- Prisma SD-WAN Subscription Usage
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Secure Group Tags (SGT) Propagation
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure Secure SD-WAN Fabric Tunnels between Data Centers
- Configure a Site Prefix
- Configure Ciphers
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Sub-Interface
- Configure a Loopback Interface
- Add and Configure Port Channel Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure an OSPF in Prisma SD-WAN
- Enable BGP for Private WAN and LAN
- Configure BGP Global Parameters
- Global or Local Scope for BGP Peers
- Configure a Route Map
- Configure a Prefix List
- Configure an AS Path List
- Configure an IP Community List
- View Routing Status and Statistics
- Distribution to Fabric
- Host Tracking
-
- Configure Multicast
- Create, Assign, and Configure a WAN Multicast Configuration Profile
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
-
- Prisma SD-WAN Branch HA Key Concepts
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Configure Branch HA in a Hybrid Topology with Gen-1 (3000) and Gen-2 (3200) Platforms
- Configure HA Groups
- Add ION Devices to HA Groups
- Edit HA Groups and Group Membership
- Prisma SD-WAN Clarity Reports
-
-
CloudBlade Integrations
- CloudBlade Integrations
- CloudBlades Integration with Prisma Access
-
-
-
-
- clear app-engine
- clear app-map dynamic
- clear app-probe prefix
- clear connection
- clear device account-login
- clear dhcplease
- clear dhcprelay stat
- clear flow and clear flows
- clear flow-arp
- clear qos-bwc queue-snapshot
- clear routing
- clear routing multicast statistics
- clear routing ospf
- clear routing peer-ip
- clear switch mac-address-entries
- clear user-id agent statistics
-
- arping interface
- curl
- ping
- ping6
- debug bounce interface
- debug bw-test src-interface
- debug cellular stats
- debug controller reachability
- debug flow
- debug ipfix
- debug log agent eal file log
- debug logging facility
- debug logs dump
- debug logs follow
- debug logs tail
- debug performance-policy
- debug poe interface
- debug process
- debug reboot
- debug routing multicast log
- debug routing multicast pimd
- debug servicelink logging
- debug tcpproxy
- debug time sync
- dig dns
- dig6
- file export
- file remove
- file space available
- file tailf log
- file view log
- ssh6 interface
- ssh interface
- tcpdump
- tcpping
- traceroute
- traceroute6
-
- dump appdef config
- dump appdef version
- dump app-engine
- dump app-l4-prefix table
- dump app-probe config
- dump app-probe flow
- dump app-probe prefix
- dump app-probe status
- dump auth config
- dump auth status
- dump banner config
- dump bfd status
- dump bypass-pair config
- dump cellular config
- dump cellular stats
- dump cellular status
- dump cgnxinfra status
- dump cgnxinfra status live
- dump cgnxinfra status store
- dump config network
- dump config security
- dump controller cipher
- dump controller status
- dump device accessconfig
- dump device conntrack count
- dump device date
- dump device info
- dump device status
- dump dhcp-relay config
- dump dhcprelay stat
- dump dhcp-server config
- dump dhcp-server status
- dump dhcpstat
- dump dnsservice config all
- dump dpdk cpu
- dump dpdk interface
- dump dpdk port status
- dump dpdk stats
- dump flow
- dump flow count-summary
- dump interface config
- dump interface status
- dump interface status interface details
- dump interface status interface module
- dump intra cluster tunnel
- dump ipfix config collector-contexts
- dump ipfix config derived-exporters
- dump ipfix config filter-contexts
- dump ipfix config ipfix-overrides
- dump ipfix config prefix-filters
- dump ipfix config profiles
- dump ipfix config templates
- dump lldp
- dump lldp config
- dump lldp info
- dump lldp stats
- dump lldp status
- dump log-agent eal conn
- dump log-agent eal response-time
- dump log-agent eal stats
- dump log-agent config
- dump log-agent iot snmp config
- dump log-agent iot snmp device discovery stats
- dump log-agent ip mac bindings
- dump log-agent neighbor discovery stats
- dump log-agent status
- dump ml7 mctd counters
- dump ml7 mctd session
- dump ml7 mctd version
- dump nat counters
- dump nat6 counters
- dump nat summary
- dump network-policy config policy-rules
- dump network-policy config policy-sets
- dump network-policy config policy-stacks
- dump network-policy config prefix-filters
- dump overview
- dump performance-policy config policy-rules
- dump performance-policy config policy-sets
- dump performance-policy config policy-set-stacks
- dump performance-policy config threshold-profile
- dump poe system config
- dump poe system status
- dump priority-policy config policy-rules
- dump priority-policy config policy-sets
- dump priority-policy config policy-stacks
- dump priority-policy config prefix-filters
- dump probe config
- dump probe profile
- dump radius config
- dump radius statistics
- dump radius status
- dump reachability-probe config
- dump qos-bwc config
- dump reachability-probe status
- dump routing aspath-list
- dump routing cache
- dump routing communitylist
- dump routing multicast config
- dump routing multicast igmp
- dump routing multicast interface
- dump routing multicast internal vif-entries
- dump routing multicast mroute
- dump routing multicast pim
- dump routing multicast sources
- dump routing multicast statistics
- dump routing multicast status
- dump routing ospf
- dump routing peer advertised routes
- dump routing peer config
- dump routing peer neighbor
- dump routing peer received-routes
- dump routing peer routes
- dump routing peer route-via
- dump routing peer status
- dump routing peer route-json
- dump routing prefixlist
- dump routing prefix-reachability
- dump routing route
- dump routing routemap
- dump routing running-config
- dump routing summary
- dump routing static-route reachability-status
- dump routing static-route config
- dump routing vpn host tracker
- dump security-policy config policy-rules
- dump security-policy config policy-set
- dump security-policy config policy-set-stack
- dump security-policy config prefix-filters
- dump security-policy config zones
- dump sensor type
- dump sensor type summary
- dump serviceendpoints
- dump servicelink summary
- dump servicelink stats
- dump servicelink status
- dump site config
- dump snmpagent config
- dump snmpagent status
- dump software status
- dump spoke-ha config
- dump spoke-ha status
- dump standingalarms
- dump static-arp config
- dump static host config
- dump static routes
- dump support details
- dump-support
- dump switch fdb vlan-id
- dump switch port status
- dump switch vlan-db
- dump syslog config
- dump syslog-rtr stats
- dump syslog status
- dump time config
- dump time log
- dump time status
- dump troubleshoot message
- dump user-id agent config
- dump user-id agent statistics
- dump user-id agent status
- dump user-id agent summary
- dump user-id groupidx
- dump user-id group-mapping
- dump user-id ip-user-mapping
- dump user-id statistics
- dump user-id status
- dump user-id summary
- dump user-id useridx
- dump vlan member
- dump vpn count
- dump vpn ka all
- dump vpn ka summary
- dump vpn ka VpnID
- dump vpn status
- dump vpn summary
- dump vrf
- dump waninterface config
- dump waninterface summary
-
- inspect app-flow-table
- inspect app-l4-prefix lookup
- inspect app-map
- inspect certificate
- inspect certificate device
- inspect cgnxinfra role
- inspect connection
- inspect dhcplease
- inspect dhcp6lease
- inspect dpdk ip-rules
- inspect dpdk vrf
- inspect fib
- inspect fib-leak
- inspect flow-arp
- inspect flow brief
- inspect flow-detail
- inspect flow internal
- inspect interface stats
- inspect ipfix exporter-stats
- inspect ipfix collector-stats
- inspect ipfix app-table
- inspect ipfix wan-path-info
- inspect ipfix interface-info
- inspect ip-rules
- inspect ipv6-rules
- inspect lqm stats
- inspect memory summary
- inspect network-policy conflicts
- inspect network-policy dropped
- inspect network-policy hits policy-rules
- inspect network-policy lookup
- inspect performance-policy fec status
- inspect policy-manager status
- inspect policy-mix lookup-flow
- inspect priority-policy conflicts
- inspect priority-policy dropped
- inspect priority-policy hits default-rule-dscp
- inspect priority-policy hits policy-rules
- inspect priority-policy lookup
- inspect performance-policy incidents
- inspect performance-policy lookup
- inspect performance-policy hits analytics
- inspect process status
- inspect qos-bwc debug-state
- inspect qos-bwc queue-history
- inspect qos-bwc queue-snapshot
- inspect routing multicast fc site-iface
- inspect routing multicast interface
- inspect routing multicast mroute
- inspect security-policy lookup
- inspect security-policy size
- inspect switch mac-address-table
- inspect system arp
- inspect system ipv6-neighbor
- inspect system vrf
- inspect vrf
- inspect wanpaths
-
-
5.6
- 5.6
- 6.1
- 6.2
- 6.3
- 6.4
- 6.5
- New Features Guide
- On-Premises Controller
- Prisma SD-WAN CloudBlades
- Prisma Access CloudBlade Cloud Managed
- Prisma Access CloudBlade Panorama Managed
-
- Features Introduced in Prisma SD-WAN ION Release 5.6
- Changes to Default Behavior in Prisma SD-WAN ION Release 5.6
- Upgrade ION 9000 Firmware for Device Version 5.6.x
- CLI Commands in Prisma SD-WAN ION Release 5.6
- Addressed Issues in Prisma SD-WAN ION Release 5.6
- Known Issues in Prisma SD-WAN ION Release 5.6
Flow Information Elements
View detailed information for flow information elements in Prisma SD-WAN.
Where Can I Use This? | What Do I Need? |
---|---|
|
|
The table below describes the flow information
elements, which are based on the IANA IP Flow Information Export
(IPFIX) entity definitions included at https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-elements.
Flow Field | Information Element | ElementId | Description | Data Type | Data Type Semantics |
---|---|---|---|---|---|
APPLICATION_HOST | httpRequestHost | IANA 460 | Identifies the domain name of the application's request host. Encoded in UTF-8. | string | |
APP_DEF_ID | applicationId | IANA 95 | Identifies the flow application ID. | octetArray | default |
CONNECTION_BIFLOW_BYTES | cgnxBidirectionalOctetDeltaCount | 1006 CGNX | Specifies the number of octets since the previous report (if any) in both directions for this flow at the observation point. | unsigned64 | deltaCounter |
CONNECTION_BIFLOW_PACKETS | cgnxBidirectionalPacketDeltaCount | 1007 CGNX | Specifies the number of packets since the previous report (if any) in both directions for this flow at the observation point. | unsigned64 | deltaCounter |
CONNECTION_INIT | cgnxTcpConnInit | 1021 CGNX | This boolean flag indicates if a SYN-ACK packet
is seen in response to a SYN packet.![]() | unsigned8 | flags |
CONNECTION_NTT | The NTT subTemplate contains the
following Information Elements and is exported as part of the flow
when you configure the CONNECTION_NTT flow
field option:
| ||||
cgnxNttMinMilliseconds | 1012 CGNX | Specifies the minimum network transfer time for an application in milliseconds. | unsigned32 | default | |
cgnxNttMaxMilliseconds | 1013 CGNX | Specifies the maximum network transfer time for an application in milliseconds. | unsigned32 | default | |
cgnxNttObservedDeltaCount | 1014 CGNX | Specifies the total number of network transfer time observations for this Flow at the Observation Point. | unsigned32 | deltaCounter | |
cgnxNttSumMilliseconds | 1015 CGNX | Specifies the sum of network transfer times for an application in milliseconds. | unsigned32 | default | |
CONNECTION_RTT | The RTT subTemplate contains the
following Information Elements and is exported as part of the flow
when you configure the CONNECTION_RTT flow
field:
| ||||
cgnxRttMinMilliseconds | 1008 CGNX | Specifies the minimum round trip time for an application in milliseconds. | unsigned32 | default | |
cgnxRttMaxMilliseconds | 1009 CGNX | Specifies the maximum round trip time for an application in milliseconds. | unsigned32 | default | |
cgnxRttObservedDeltaCount | 1010 CGNX | Specifies the number of round trip time observations for this Flow at the Observation Point. | unsigned32 | deltaCounter | |
cgnxRttSumMilliseconds | 1011 CGNX | Specifies the sum of round trip times for an application in milliseconds. | unsigned32 | default | |
CONNECTION_SRT | The SRT subTemplate contains the
following Information Elements and is exported as part of the flow
when you include the CONNECTION_SRT flow
field:
| ||||
cgnxSrtMinMilliseconds | 1016 CGNX | Specifies the minimum server response time for an application in milliseconds | unsigned32 | default | |
cgnxSrtMaxMilliseconds | 1017 CGNX | Specifies the maximum server response time for an application in milliseconds. | unsigned32 | default | |
cgnxSrtObservedDeltaCount | 1018 CGNX | Specifies the number of server response time observations for this Flow at the Observation Point. | unsigned32 | deltaCounter | |
cgnxSrtSumMilliseconds | 1019 CGNX | Specifies the sum of server response times for an application in milliseconds. | unsigned32 | default | |
CONNECTION_UDPTRT | The TRT subTemplate contains the
following Information Elements and is exported as part of the flow
when you configure the CONNECTION_UDPTRT flow
field:
| ||||
cgnxTrtMinMilliseconds | 1024 CGNX | Specifies the minimum transaction response time for an application in milliseconds. | unsigned32 | default | |
cgnxTrtMaxMilliseconds | 1025 CGNX | Specifies the maximum transaction response time for an application in milliseconds. | unsigned32 | default | |
cgnxTrtObservedDeltaCount | 1026 CGNX | Specifies the number of transaction response time observations for this Flow at the Observation Point. | unsigned32 | deltaCounter | |
cgnxTrtSumMilliseconds | 1027 CGNX | Specifies the sum of transaction response times for an application in milliseconds. | unsigned32 | default | |
CONNECTION_UNIFLOW_BYTES | octetDeltaCount | IANA 1 | Identifies the number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. | unsigned64 | deltaCounter |
CONNECTION_XACT | The XACT subTemplate contains
the following Information Elements and is exported as part of the
flow when you configure the CONNECTION_XACT flow
field:
| ||||
cgnxConnectionTransactionSuccessTotalCount | 1022 CGNX | Specifies the total number of connection transaction success observations for this Flow at the Observation Point. | unsigned32 | TotalCounter | |
cgnxConnectionTransactionFailureTotalCount | 1023 CGNX | Specifies the total number of connection transaction failure observations for this Flow at the Observation Point. | unsigned32 | TotalCounter | |
DSCP_MAP | cgnxDiffServCodePointMap | 1000 CGNX | Identifies the Prisma SD-WAN DSCP bitmap observation for the flow at the interface. | unsigned64 | flags |
DSCP_LAST | ipDiffservCodePoint | IANA 195 | Identifies the last observed DSCP value for the flow. | unsigned8 | Identifier |
INTERFACES |
|
| Identifies a flow's ingress (where packets are received) and/or egress interface (where packets are sent) (physical & logical). The Interface ID exported shall match the SNMP IF ID. | unsigned32 | Identifier |
MEDIA_CODEC | cgnxMediaCodecList | 1034 CGNX | A list of codec identifiers as identified from the flow. Each codec is represented by an single octet in the list. | octetArray | Identifier |
MEDIA_JITTER | Identifies the jitter of a media
flow. The Media Jitter subTemplate contains the following Information
Elements and is exported as part of the flow when you configure
the MEDIA_JITTER flow field:
| ||||
cgnxMediaJitterMaxMilliseconds | 1036 CGNX | Specifies the maximum jitter time for an application in milliseconds. | unsigned32 | default | |
cgnxMediaJitterObservedDeltaCount | 1037 CGNX | Specifies the number of jitter time observations for this Flow at the Observation Point. | unsigned64 | deltaCounter | |
cgnxMediaJitterSumMilliseconds | 1038 CGNX | Specifies the sum of jitter times for an application in milliseconds. | unsigned32 | default | |
MEDIA_LOSS | Identifies the packet loss percentage
of a media flow. The Media Loss subTemplate contains the following
Information Elements and is exported as part of the flow when you
configure the MEDIA_LOSS flow field:
| ||||
cgnxMediaLossMax | 1039 CGNX | Specifies the maximum packet loss percentage for an application. | float32 | quantity | |
cgnxMediaLossObservedDeltaCount | 1040 CGNX | Specifies the number of packet loss percentage observations for this Flow at the Observation Point. | unsigned64 | deltaCounter | |
cgnxMediaLossSum | Specifies the sum of packet loss percentages for an application. | float32 | quantity | ||
MEDIA_MOS | cgnxMediaMosMin | 1042 CGNX | Specifies the minimum MOS sample for an application. | float32 | quantity |
cgnxMediaMosMax | 1043 CGNX | Specifies the maximum MOS sample for an application. | float32 | default | |
cgnxMediaMosObservedDeltaCount | 1044 CGNX | Specifies the number of MOS observations for this Flow at the Observation Point. | unsigned32 | deltaCounter | |
cgnxMediaMosSum | 1045 CGNX | Specifies the sum of MOS observations for an application. | float32 | default | |
QOS_QUEUE | cgnxQosQueue | 1001 CGNX | Identifies the QoS queue that the flow is assigned by
the ION device.![]() | unsigned8 | Identifier |
RTP_TRANSPORT_TYPE | cgnxRtpTransport | 1033 CGNX | The value of the RTP transport identifier is Prisma
SD-WAN specific and is identified from the flow.![]() | unsigned8 | Identifier |
Identifies the minimum and maximum
TCP window size for a flow.The TcpWin subTemplate contains the following
Information Elements and is exported as part of the flow when you
configure the TRANSPORT_TCP_WINDOWSIZETRANSPORT_TCP_WINDOWSIZE
flow field:
| |||||
cgnxMinTcpWindowSize | 1003 CGNX | The minimum value observed for the TCP window for the flow. | unsigned32 | quantity | |
cgnxMaxTcpWindowSize | 1004 CGNX | The maximum value observed for the TCP window for the flow. | unsigned32 | quantity | |
TROUBLESHOOT_DECISION_MAP | Specifies the Prisma SD-WAN decision
bitmap observation for the flow at the interface. The information
is encoded in a set of bit fields allocated in 4 octet word groups.
The decision map flags are mapped to bits according to their flag numbers. Single
Decision map subTemplate : Contains the following Information Elements and
is exported as part of the flow when you configure the TROUBLESHOOT_DECISION_MAP flow
field:
| ||||
cgnxDecisionMap | 1048 CGNX | Specifies the CloudGenix decision bitmap observation for this flow at the Observation Point. | octetArray | flags | |
TROUBLESHOOT_TCP | The troubleshoot TCP flags subTemplate
contains the following Information Elements and is exported as part
of the flow when you configure the TROUBLESHOOT_TCP flow
field:
| ||||
cgnxTcpSynDeltaCount | 1050 CGNX | The number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set observed since the last record for the flow was sent. | unsigned32 | deltaCounter | |
cgnxTcpFinDeltaCount | 1051 CGNX | The number of packets of this Flow with TCP "No more data from sender" (FIN) flag set observed since the last record for the flow was sent. | unsigned32 (Reduced to unsigned8) | deltaCounter | |
cgnxTcpRstDeltaCount | 1052 CGNX | The number of packets of this Flow with TCP "Reset the connection" (RST) flag set observed since the last record for the flow was sent. | unsigned32 (Reduced to unsigned8) | deltaCounter | |
cgnxTcpAckDeltaCount | 1053 CGNX | The number of packets of this Flow with TCP "Acknowledgement field significant" (ACK) flag set observed since the last record for the flow was sent. | unsigned32 | deltaCounter | |
cgnxTcpRexmitDeltaCount | 1046 CGNX | unsigned32 | deltaCounter | ||
cgnxTcpOoopDeltaCount | 1047 CGNX | Specifies the number of new TCP out of order packet observations for this TCP Flow at the Observation Point since the last export record for the flow. | unsigned32 | deltaCounter | |
WAN-PATH | cgnxWanPath | 1002 CGNX | WAN path identifier | unsigned64 | Identifier |