Manual Chapter :
lsn_log_ipfix
Applies To:
Show Versions
BIG-IP APM
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
BIG-IP Analytics
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
BIG-IP LTM
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
BIG-IP PEM
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
BIG-IP AFM
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
BIG-IP DNS
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
BIG-IP ASM
- 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
lsn_log_ipfix
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The "LSN" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
postNATSourceIPv4Address | 225 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
postNAPTSourceTransportPort | 227 | 2 | |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natOriginatingAddressRealm | 229 | 1 | 1 (private/internal realm, subscriber side). |
natEvent | 230 | 1 | 1 (for Create event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The "LSN" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
postNATSourceIPv4Address | 225 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
postNAPTSourceTransportPort | 227 | 2 | |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natOriginatingAddressRealm | 229 | 1 | 1 (private/internal realm, subscriber side). |
natEvent | 230 | 1 | 2 (for Delete event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
flowDurationMilliseconds | 161 | 4 | Duration in ms. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "LSN" routing-domain ID. |
egressVRFID | 235 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | |
postNATDestinationIPv4Address | 226 | 4 | |
destinationTransportPort | 11 | 2 | |
postNAPTDestinationTransportPort | 228 | 2 | |
natOriginatingAddressRealm | 229 | 1 | 2 (public/external realm, Internet side). |
natEvent | 230 | 1 | 1 (for Create event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "LSN" routing-domain ID. |
egressVRFID | 235 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | |
postNATDestinationIPv4Address | 226 | 4 | |
destinationTransportPort | 11 | 2 | |
postNAPTDestinationTransportPort | 228 | 2 | |
natOriginatingAddressRealm | 229 | 1 | 2 (public/external realm, Internet side). |
natEvent | 230 | 1 | 2 (for Delete event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
flowDurationMilliseconds | 161 | 4 | Duration in ms. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The "LSN" routing-domain ID. |
sourceIPv6Address | 27 | 16 | |
postNATSourceIPv4Address | 225 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
postNAPTSourceTransportPort | 227 | 2 | |
postNATDestinationIPv4Address | 226 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natOriginatingAddressRealm | 229 | 1 | 1 (private/internal realm, subscriber side). |
natEvent | 230 | 1 | 1 (for Create event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The "LSN" routing-domain ID. |
sourceIPv6Address | 27 | 16 | |
postNATSourceIPv4Address | 225 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
postNAPTSourceTransportPort | 227 | 2 | |
postNATDestinationIPv4Address | 226 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natOriginatingAddressRealm | 229 | 1 | 1 (private/internal realm, subscriber side). |
natEvent | 230 | 1 | 2 (for Delete event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
flowDurationMilliseconds | 161 | 4 | Duration in ms. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "LSN" routing-domain ID. |
egressVRFID | 235 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | |
postNATDestinationIPv6Address | 282 | 16 | |
destinationTransportPort | 11 | 2 | |
postNAPTDestinationTransportPort | 228 | 2 | |
natOriginatingAddressRealm | 229 | 1 | 2 (public/external realm, Internet side). |
natEvent | 230 | 1 | 1 (for Create event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "LSN" routing-domain ID. |
egressVRFID | 235 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | |
postNATDestinationIPv6Address | 282 | 16 | |
destinationTransportPort | 11 | 2 | |
postNAPTDestinationTransportPort | 228 | 2 | |
natOriginatingAddressRealm | 229 | 1 | 2 (public/external realm, Internet side). |
natEvent | 230 | 1 | 2 (for Delete event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
flowDurationMilliseconds | 161 | 4 | Duration in ms. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The "LSN" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
postNATSourceIPv4Address | 225 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
postNAPTSourceTransportPort | 227 | 2 | |
sourceIPv6Address | 27 | 16 | DS-Lite remote endpoint IPv6 address. |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natOriginatingAddressRealm | 229 | 1 | 1 (private/internal realm, subscriber side). |
natEvent | 230 | 1 | 1 (for Create event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The "LSN" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
postNATSourceIPv4Address | 225 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
postNAPTSourceTransportPort | 227 | 2 | |
sourceIPv6Address | 27 | 16 | DS-Lite remote endpoint IPv6 address. |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natOriginatingAddressRealm | 229 | 1 | 1 (private/internal realm, subscriber side). |
natEvent | 230 | 1 | 2 (for Delete event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
flowDurationMilliseconds | 161 | 4 | Duration in ms. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "LSN" routing-domain ID. |
egressVRFID | 235 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | |
postNATDestinationIPv6Address | 282 | 16 | DS-Lite remote endpoint IPv6 address. |
postNATDestinationIPv4Address | 226 | 4 | |
destinationTransportPort | 11 | 2 | |
postNAPTDestinationTransportPort | 228 | 2 | |
natOriginatingAddressRealm | 229 | 1 | 2 (public/external realm, Internet side). |
natEvent | 230 | 1 | 1 (for Create event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "LSN" routing-domain ID. |
egressVRFID | 235 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | |
postNATDestinationIPv6Address | 282 | 16 | |
postNATDestinationIPv4Address | 226 | 4 | |
destinationTransportPort | 11 | 2 | |
postNAPTDestinationTransportPort | 228 | 2 | |
natOriginatingAddressRealm | 229 | 1 | 2 (public/external realm, Internet side). |
natEvent | 230 | 1 | 2 (for Delete event). |
flowStartMilliseconds | 152 | 8 | Start time, in ms since Epoch (1/1/1970). |
flowDurationMilliseconds | 161 | 4 | Duration in ms. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natEvent | 230 | 1 | 10 for Transmission Failed. |
natPoolName | 284 | Variable | This IE is omitted for NetFlow v9. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
sourceIPv6Address | 27 | 16 | |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natEvent | 230 | 1 | 10 for Transmission Failed. |
natPoolName | 284 | Variable | This IE is omitted for NetFlow v9. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | IPv4 address used by F5 CGNAT in the IPv4-mapped IPv6 format, for the DS-Lite tunnel terminated on the BIG-IP. |
protocolIdentifier | 4 | 1 | |
sourceTransportPort | 7 | 2 | |
sourceIPv6Address | 27 | 16 | IPv6 address for remote endpoint of the DS-Lite tunnel. |
destinationIPv4Address | 12 | 4 | 0 (zero) if obscured. |
destinationTransportPort | 11 | 2 | 0 (zero) if obscured. |
natEvent | 230 | 1 | 10 for Transmission Failed. |
natPoolName | 284 | Variable | This IE is omitted for NetFlow v9. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
natEvent | 230 | 1 | 11 for Session Quota Exceeded, 12 for Port Quota Exceeded, 15 for PBA client block limit Exceeded, 16 for PBA Port Quota Exceeded. |
natPoolName | 284 | Variable | This IE is omitted for NetFlow v9. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
sourceIPv6Address | 27 | 16 | |
natEvent | 230 | 1 | 11 for Session Quota Exceeded, 12 for Port Quota Exceeded, 15 for PBA client block limit Exceeded, 16 for PBA Port Quota Exceeded. |
natPoolName | 284 | Variable | This IE is omitted for NetFlow v9. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
sourceIPv6Address | 27 | 16 | DS-Lite remote endpoint IPv6 address. |
natEvent | 230 | 1 | 11 for Session Quota Exceeded, 12 for Port Quota Exceeded, 15 for PBA client block limit Exceeded, 16 for PBA Port Quota Exceeded. |
natPoolName | 284 | Variable | This IE is omitted for NetFlow v9. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The egress routing-domain ID. |
sourceIPv4Address | 8 | 4 | |
postNATSourceIPv4Address | 225 | 4 | |
portRangeStart | 361 | 2 | |
portRangeEnd | 362 | 2 | |
natEvent | 230 | 1 | 13 for PBA, block Allocated, 14 for PBA, block released. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The egress routing-domain ID. |
sourceIPv6Address | 27 | 16 | |
postNATSourceIPv4Address | 225 | 4 | |
portRangeStart | 361 | 2 | |
portRangeEnd | 362 | 2 | |
natEvent | 230 | 1 | 13 for PBA, block Allocated, 14 for PBA, block released. |
Information Element (IE) | ID | Size (Bytes) | Notes |
|---|---|---|---|
observationTimeMilliseconds | 323 | 8 | |
ingressVRFID | 234 | 4 | The "client" routing-domain ID. |
egressVRFID | 235 | 4 | The egress routing-domain ID. |
sourceIPv6Address | 27 | 16 | |
postNATSourceIPv4Address | 225 | 4 | |
portRangeStart | 361 | 2 | |
portRangeEnd | 362 | 2 | |
natEvent | 230 | 1 | 13 for PBA, block Allocated, 14 for PBA, block released. |
Information Element (IE) | ID | Size (Bytes) |
|---|---|---|
destinationIPv4Address | 12 | 4 |
destinationTransportPort | 11 | 2 |
egressVRFID | 235 | 4 |
flowDurationMilliseconds | 161 | 4 |
flowStartMilliseconds | 152 | 8 |
ingressVRFID | 234 | 4 |
natEvent | 230 | 1 |
natOriginatingAddressRealm | 229 | 1 |
natPoolName | 284 | Variable |
observationTimeMilliseconds | 323 | 8 |
portRangeEnd | 362 | 2 |
portRangeStart | 361 | 2 |
postNAPTDestinationTransportPort | 228 | 2 |
postNAPTSourceTransportPort | 227 | 2 |
postNATDestinationIPv4Address | 226 | 4 |
postNATDestinationIPv6Address | 282 | 16 |
postNATSourceIPv4Address | 225 | 4 |
protocolIdentifier | 4 | 1 |
sourceIPv4Address | 8 | 4 |
sourceIPv6Address | 27 | 16 |
sourceTransportPort | 7 | 2 |
