Manual Chapter : lsn_log_ipfix

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0

BIG-IP Analytics

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0

BIG-IP LTM

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0

BIG-IP PEM

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0

BIG-IP AFM

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0

BIG-IP DNS

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0

BIG-IP ASM

  • 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0
Manual Chapter

lsn_log_ipfix

Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The "LSN" routing-domain ID.
sourceIPv4Address
8
4
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceTransportPort
7
2
postNAPTSourceTransportPort
227
2
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natOriginatingAddressRealm
229
1
1 (private/internal realm, subscriber side).
natEvent
230
1
1 (for Create event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The "LSN" routing-domain ID.
sourceIPv4Address
8
4
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceTransportPort
7
2
postNAPTSourceTransportPort
227
2
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natOriginatingAddressRealm
229
1
1 (private/internal realm, subscriber side).
natEvent
230
1
2 (for Delete event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
flowDurationMilliseconds
161
4
Duration in ms.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "LSN" routing-domain ID.
egressVRFID
235
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
postNATDestinationIPv4Address
226
4
destinationTransportPort
11
2
postNAPTDestinationTransportPort
228
2
natOriginatingAddressRealm
229
1
2 (public/external realm, Internet side).
natEvent
230
1
1 (for Create event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "LSN" routing-domain ID.
egressVRFID
235
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
postNATDestinationIPv4Address
226
4
destinationTransportPort
11
2
postNAPTDestinationTransportPort
228
2
natOriginatingAddressRealm
229
1
2 (public/external realm, Internet side).
natEvent
230
1
2 (for Delete event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
flowDurationMilliseconds
161
4
Duration in ms.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The "LSN" routing-domain ID.
sourceIPv6Address
27
16
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceTransportPort
7
2
postNAPTSourceTransportPort
227
2
postNATDestinationIPv4Address
226
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natOriginatingAddressRealm
229
1
1 (private/internal realm, subscriber side).
natEvent
230
1
1 (for Create event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The "LSN" routing-domain ID.
sourceIPv6Address
27
16
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceTransportPort
7
2
postNAPTSourceTransportPort
227
2
postNATDestinationIPv4Address
226
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natOriginatingAddressRealm
229
1
1 (private/internal realm, subscriber side).
natEvent
230
1
2 (for Delete event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
flowDurationMilliseconds
161
4
Duration in ms.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "LSN" routing-domain ID.
egressVRFID
235
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
postNATDestinationIPv6Address
282
16
destinationTransportPort
11
2
postNAPTDestinationTransportPort
228
2
natOriginatingAddressRealm
229
1
2 (public/external realm, Internet side).
natEvent
230
1
1 (for Create event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "LSN" routing-domain ID.
egressVRFID
235
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
postNATDestinationIPv6Address
282
16
destinationTransportPort
11
2
postNAPTDestinationTransportPort
228
2
natOriginatingAddressRealm
229
1
2 (public/external realm, Internet side).
natEvent
230
1
2 (for Delete event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
flowDurationMilliseconds
161
4
Duration in ms.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The "LSN" routing-domain ID.
sourceIPv4Address
8
4
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceTransportPort
7
2
postNAPTSourceTransportPort
227
2
sourceIPv6Address
27
16
DS-Lite remote endpoint IPv6 address.
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natOriginatingAddressRealm
229
1
1 (private/internal realm, subscriber side).
natEvent
230
1
1 (for Create event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The "LSN" routing-domain ID.
sourceIPv4Address
8
4
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceTransportPort
7
2
postNAPTSourceTransportPort
227
2
sourceIPv6Address
27
16
DS-Lite remote endpoint IPv6 address.
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natOriginatingAddressRealm
229
1
1 (private/internal realm, subscriber side).
natEvent
230
1
2 (for Delete event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
flowDurationMilliseconds
161
4
Duration in ms.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "LSN" routing-domain ID.
egressVRFID
235
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
postNATDestinationIPv6Address
282
16
DS-Lite remote endpoint IPv6 address.
postNATDestinationIPv4Address
226
4
destinationTransportPort
11
2
postNAPTDestinationTransportPort
228
2
natOriginatingAddressRealm
229
1
2 (public/external realm, Internet side).
natEvent
230
1
1 (for Create event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "LSN" routing-domain ID.
egressVRFID
235
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
postNATDestinationIPv6Address
282
16
postNATDestinationIPv4Address
226
4
destinationTransportPort
11
2
postNAPTDestinationTransportPort
228
2
natOriginatingAddressRealm
229
1
2 (public/external realm, Internet side).
natEvent
230
1
2 (for Delete event).
flowStartMilliseconds
152
8
Start time, in ms since Epoch (1/1/1970).
flowDurationMilliseconds
161
4
Duration in ms.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natEvent
230
1
10 for Transmission Failed.
natPoolName
284
Variable
This IE is omitted for NetFlow v9.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
sourceIPv6Address
27
16
protocolIdentifier
4
1
sourceTransportPort
7
2
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natEvent
230
1
10 for Transmission Failed.
natPoolName
284
Variable
This IE is omitted for NetFlow v9.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
IPv4 address used by F5 CGNAT in the IPv4-mapped IPv6 format, for the DS-Lite tunnel terminated on the BIG-IP.
protocolIdentifier
4
1
sourceTransportPort
7
2
sourceIPv6Address
27
16
IPv6 address for remote endpoint of the DS-Lite tunnel.
destinationIPv4Address
12
4
0 (zero) if obscured.
destinationTransportPort
11
2
0 (zero) if obscured.
natEvent
230
1
10 for Transmission Failed.
natPoolName
284
Variable
This IE is omitted for NetFlow v9.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
natEvent
230
1
11 for Session Quota Exceeded, 12 for Port Quota Exceeded, 15 for PBA client block limit Exceeded, 16 for PBA Port Quota Exceeded.
natPoolName
284
Variable
This IE is omitted for NetFlow v9.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
sourceIPv6Address
27
16
natEvent
230
1
11 for Session Quota Exceeded, 12 for Port Quota Exceeded, 15 for PBA client block limit Exceeded, 16 for PBA Port Quota Exceeded.
natPoolName
284
Variable
This IE is omitted for NetFlow v9.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
sourceIPv4Address
8
4
sourceIPv6Address
27
16
DS-Lite remote endpoint IPv6 address.
natEvent
230
1
11 for Session Quota Exceeded, 12 for Port Quota Exceeded, 15 for PBA client block limit Exceeded, 16 for PBA Port Quota Exceeded.
natPoolName
284
Variable
This IE is omitted for NetFlow v9.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The egress routing-domain ID.
sourceIPv4Address
8
4
postNATSourceIPv4Address
225
4
portRangeStart
361
2
portRangeEnd
362
2
natEvent
230
1
13 for PBA, block Allocated, 14 for PBA, block released.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The egress routing-domain ID.
sourceIPv6Address
27
16
postNATSourceIPv4Address
225
4
portRangeStart
361
2
portRangeEnd
362
2
natEvent
230
1
13 for PBA, block Allocated, 14 for PBA, block released.
Information Element (IE)
ID
Size (Bytes)
Notes
observationTimeMilliseconds
323
8
ingressVRFID
234
4
The "client" routing-domain ID.
egressVRFID
235
4
The egress routing-domain ID.
sourceIPv6Address
27
16
postNATSourceIPv4Address
225
4
portRangeStart
361
2
portRangeEnd
362
2
natEvent
230
1
13 for PBA, block Allocated, 14 for PBA, block released.
Information Element (IE)
ID
Size (Bytes)
destinationIPv4Address
12
4
destinationTransportPort
11
2
egressVRFID
235
4
flowDurationMilliseconds
161
4
flowStartMilliseconds
152
8
ingressVRFID
234
4
natEvent
230
1
natOriginatingAddressRealm
229
1
natPoolName
284
Variable
observationTimeMilliseconds
323
8
portRangeEnd
362
2
portRangeStart
361
2
postNAPTDestinationTransportPort
228
2
postNAPTSourceTransportPort
227
2
postNATDestinationIPv4Address
226
4
postNATDestinationIPv6Address
282
16
postNATSourceIPv4Address
225
4
protocolIdentifier
4
1
sourceIPv4Address
8
4
sourceIPv6Address
27
16
sourceTransportPort
7
2