© 2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 69 of 70
Field
L2 In
L2 Out
IPv4 In
IPV4 Out
IPv6 In
IPv6 Out
Notes
mac source address
output
-
-
-
-
-
-
mac destination
address input
Yes
-
Yes
-
Yes
-
mac destination
address output
-
Yes
-
Yes
-
Yes
ipv4 version
-
-
Yes
Yes
Yes
Yes
ipv4 tos
-
-
Yes
Yes
Yes
Yes
ipv4 protocol
-
-
Yes
Yes
Yes
Yes
Must use if any of src/dest port, ICMP code/type,
IGMP type, or TCP flags is used.
ipv4 ttl
-
-
Yes
Yes
Yes
Yes
ipv4 version
-
-
Yes
Yes
Yes
Yes
Same as IP_VERSION
ipv4 tos
-
-
Yes
Yes
Yes
Yes
Same as IP_TOS
ipv4 ttl
-
-
Yes
Yes
Yes
Yes
Same as IP_TTL
ipv4 protocol
-
-
Yes
Yes
Yes
Yes
Same as IP_PROT. Must use if any of src/dest port,
ICMP code/type, IGMP type, or TCP flags is used.
ipv4 source address
-
-
Yes
Yes
-
-
ipv4 destination
address
-
-
Yes
Yes
-
-
icmp ipv4 type
-
-
Yes
Yes
-
-
icmp ipv4 code
-
-
Yes
Yes
-
-
igmp type
-
-
Yes
Yes
-
-
ipv6 version
-
-
Yes
Yes
Yes
Yes
Same as IP_VERSION
ipv6 protocol
-
-
Yes
Yes
Yes
Yes
Same as IP_PROT. Must use if any of src/dest port,
ICMP code/type, IGMP type, or TCP flags is used.
ipv6 source address
-
-
-
-
Yes
Yes
ipv6 destination
address
-
-
-
-
Yes
Yes
ipv6 traffic-class
-
-
Yes
Yes
Yes
Yes
Same as IP_TOS
ipv6 hop-limit
-
-
Yes
Yes
Yes
Yes
Same as IP_TTL
icmp ipv6 type
-
-
-
-
Yes
Yes
icmp ipv6 code
-
-
-
-
Yes
Yes
source-port
-
-
Yes
Yes
Yes
Yes
destination-port
-
-
Yes
Yes
Yes
Yes
bytes long
Yes
Yes
Yes
Yes
Yes
Yes
Packet size = (Ethernet frame size including FCS - 18
bytes)
Recommended: Avoid this field and use
CNT_BYTES_LAYER2_LONG
packets long
Yes
Yes
Yes
Yes
Yes
Yes
timestamp absolute
first
Yes
Yes
Yes
Yes
Yes
Yes
timestamp absolute
last
Yes
Yes
Yes
Yes
Yes
Yes
tcp flags
Yes
Yes
Yes
Yes
Yes
Yes
Collects all flags
bytes layer2 long
Yes
Yes
Yes
Yes
Yes
Yes