/*

 ** packet-netflow.c

 **

 ** (c) 2002 bill fumerola <fumerola@yahoo-inc.com>

 ** (C) 2005-06 Luca Deri <deri@ntop.org>

 **

 ** All rights reserved.

 **

 ** Wireshark - Network traffic analyzer

 ** By Gerald Combs <gerald@wireshark.org>

 ** Copyright 1998 Gerald Combs

 **

 ** SPDX-License-Identifier: GPL-2.0-or-later

 *****************************************************************************

 **

 ** Previous NetFlow dissector written by Matthew Smart <smart@monkey.org>

 ** NetFlow v9 support added by same.

 **

 ** NetFlow v9 patches by Luca Deri <deri@ntop.org>

 **

 ** See

 **

 ** http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/tflow_wp.htm

 ** http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html

 **

 ** Cisco ASA5500 Series

 ** http://www.cisco.com/en/US/docs/security/asa/asa83/netflow/netflow.html

 **

 ** ( https://tools.ietf.org/html/rfc3954 ? for NetFlow v9 information)

 **

 ** IPFIX

 ** https://tools.ietf.org/html/rfc5103 Bidirectional Flow Export Using IP Flow Information Export (IPFIX)

 ** https://tools.ietf.org/html/rfc5610 Exporting Type Information for

 **                                     IP Flow Information Export (IPFIX) Information Elements

 ** https://tools.ietf.org/html/rfc7011 Specification of the IP Flow Information Export (IPFIX) Protocol

 **                                     for the Exchange of Flow Information

 ** https://tools.ietf.org/html/rfc7012 Information Model for IP Flow Information Export (IPFIX)

 ** https://tools.ietf.org/html/rfc7013 Guidelines for Authors and Reviewers of

 **                                     IP Flow Information Export (IPFIX) Information Elements

 **

 ** https://www.iana.org/assignments/ipfix/ipfix.xml     [version dated: 2014-08-13]

 ** https://www.iana.org/assignments/psamp-parameters/psamp-parameters.xml

 ** for IPFIX

 **

 *****************************************************************************

 **

 ** this code was written from the following documentation:

 **

 ** http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/nfc/nfc_3_6/iug/format.pdf

 ** http://www.caida.org/tools/measurement/cflowd/configuration/configuration-9.html

 **

 ** some documentation is more accurate then others. in some cases, live data and

 ** information contained in responses from vendors were also used. some fields

 ** are dissected as vendor specific fields.

 **

 ** See also

 **

 ** https://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html

 **

 *****************************************************************************

 ** NetFlow forwarding status and template fixes

 ** by Aamer Akhter <aakhter@cisco.com>

 ** Copyright 2010, cisco Systems, Inc.

 **

 ** $Yahoo: //depot/fumerola/packet-netflow/packet-netflow.c#14 $

 **

 *****************************************************************************

 **

 **

 */

/*

 * ToDo: [11/23/2011: WMeier]

 *

 *  1. (See the various XXX comments)

 *  2. Template processing:

 *     a. Verify that template with same src_addr, ... ,ID is actually identical to that previously seen ?

 *        Handle changes ? Don't use template to dissect data packets previous to the packet with the templates.

 *        Essentially; need to keep the packet number containing the first copy of the template.

 *

 */

/*

 * November 2010: acferen:  Add ntop nProbe and Plixer Mailinizer extensions

 *

 * nProbe changes are for nprobe >= 5.5.6.  Earlier nprobe versions

 * "supported" some of the same fields, but they used element IDs that

 * collide with standard IDs.  Because of this versions prior to 5.5.6

 * using IDs above 80 (nprobe extensions) cannot be decoded correctly.

 *

 * nprobe supports extensions in v9 and IPFIX.  IPFIX is done in the

 * standard way.  See the NTOP_BASE for handling v9 with no collisions

 * (maybe).

 *

 * Plixer changes are just new field definitions.  (IPFIX only)

 *

 * extended core code to allow naming vendor extensions.

 *

 * Put the length for variable length strings in a tree under the

 * decoded string.  Wonder if this might be overkill.  Could probably

 * just format the "(Variable length)" string to include the actual

 * length.

 *

 * Did some minor cleanup.

 *

 * Note for WMeier...  Added YYY comments with some XXX comments.

 */

/*

 * March 2015: uhei:  Add Citrix Netscaler AppFlow extensions

 * used documentation found at:

 * https://raw.githubusercontent.com/splunk/ipfix/master/app/Splunk_TA_IPFIX/bin/IPFIX/information-elements/5951.xml

 *

 * December 2015: uhei:  Add Barracuda NGFirewall extensions

 * used documentation found at:

 * https://campus.barracuda.com/download/pdf/article/41116166

 *

 * December 2017: uhei

 * Updated IEs from https://www.iana.org/assignments/ipfix/ipfix.xhtml

 * Includes updates for RFC8038, RFC8158

 *

 * April 2019: uhei

 * Updated IEs from https://www.iana.org/assignments/ipfix/ipfix.xhtml

 * Includes updates for RFC8549

 */

#include "config.h"

#define WS_LOG_DOMAIN "packet-netflow"

#include <wireshark.h>

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/sminmpec.h>

#include <epan/to_str.h>

#include <epan/expert.h>

#include <epan/addr_resolv.h>

#include <epan/conversation.h>

#include <epan/proto_data.h>

#include <epan/tfs.h>

#include <epan/unit_strings.h>

#include <epan/iana-info.h>

#include <wsutil/array.h>

#include <wsutil/str_util.h>

#include "packet-tcp.h"

#include "packet-udp.h"

#include "packet-ntp.h"

#include "packet-e212.h"

void proto_register_netflow(void);

void proto_reg_handoff_netflow(void);

static int dissect_tcp_netflow(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data);

/* 4739 is IPFIX.

   2055 and 9996 are common defaults for Netflow

 */

#define NETFLOW_UDP_PORTS "2055,9996"

#define IPFIX_UDP_PORTS   "4739"

#define REVPEN            29305

static dissector_handle_t netflow_handle;

static dissector_handle_t netflow_tcp_handle;

static dissector_handle_t eth_handle;

/* If you want sort of safely to send enterprise specific element IDs

   using v9 you need to stake a claim in the wilds with the high bit

   set.  Still no naming authority, but at least it will never collide

   with valid IPFIX */

#define NTOP_BASE 57472u                /* nprobe >= 5.5.6 */

/*

 *  global_netflow_ports : holds the configured range of ports for netflow

 */

static range_t *global_netflow_ports;

/*

 *  global_ipfix_ports : holds the configured range of ports for IPFIX

 */

static range_t *global_ipfix_ports;

static bool netflow_preference_desegment = true;

static bool netflow_preference_tcpflags_1byte_cwr;

/*

 * Flowset (template) ID's

 */

#define FLOWSET_ID_V9_DATA_TEMPLATE         0

#define FLOWSET_ID_V9_OPTIONS_TEMPLATE      1

#define FLOWSET_ID_V10_DATA_TEMPLATE        2

#define FLOWSET_ID_V10_OPTIONS_TEMPLATE     3

#define FLOWSET_ID_RESERVED_MIN             4

#define FLOWSET_ID_RESERVED_MAX           255

#define FLOWSET_ID_DATA_MIN               256

#define FLOWSET_ID_DATA_MAX             65535

static const range_string rs_flowset_ids[] = {

    { FLOWSET_ID_V9_DATA_TEMPLATE    , FLOWSET_ID_V9_DATA_TEMPLATE    , "Data Template (V9)"             },

    { FLOWSET_ID_V9_OPTIONS_TEMPLATE , FLOWSET_ID_V9_OPTIONS_TEMPLATE , "Options Template(V9)"           },

    { FLOWSET_ID_V10_DATA_TEMPLATE   , FLOWSET_ID_V10_DATA_TEMPLATE   , "Data Template (V10 [IPFIX])"    },

    { FLOWSET_ID_V10_OPTIONS_TEMPLATE, FLOWSET_ID_V10_OPTIONS_TEMPLATE, "Options Template (V10 [IPFIX])" },

    { FLOWSET_ID_RESERVED_MIN        , FLOWSET_ID_RESERVED_MAX        , "(Reserved)"                     },

    { FLOWSET_ID_DATA_MIN            , FLOWSET_ID_DATA_MAX            , "(Data)"                         },

    { 0,           0,          NULL                   }

};

/*

 * pdu identifiers & sizes

 */

#define V1PDU_SIZE                 (4 * 12)

#define V5PDU_SIZE                 (4 * 12)

#define V7PDU_SIZE                 (4 * 13)

#define V8PDU_AS_SIZE              (4 *  7)

#define V8PDU_PROTO_SIZE           (4 *  7)

#define V8PDU_SPREFIX_SIZE         (4 *  8)

#define V8PDU_DPREFIX_SIZE         (4 *  8)

#define V8PDU_MATRIX_SIZE          (4 * 10)

#define V8PDU_DESTONLY_SIZE        (4 * 8)

#define V8PDU_SRCDEST_SIZE         (4 * 10)

#define V8PDU_FULL_SIZE            (4 * 11)

#define V8PDU_TOSAS_SIZE           (V8PDU_AS_SIZE + 4)

#define V8PDU_TOSPROTOPORT_SIZE    (V8PDU_PROTO_SIZE + 4)

#define V8PDU_TOSSRCPREFIX_SIZE    (V8PDU_SPREFIX_SIZE)

#define V8PDU_TOSDSTPREFIX_SIZE    (V8PDU_DPREFIX_SIZE)

#define V8PDU_TOSMATRIX_SIZE       (V8PDU_MATRIX_SIZE)

#define V8PDU_PREPORTPROTOCOL_SIZE (4 * 10)

#define VARIABLE_LENGTH 65535

static const value_string v5_sampling_mode[] = {

    {0, "No sampling mode configured"},

    {1, "Packet Interval sampling mode configured"},

    {2, "Random sampling mode configured"},

    {0, NULL}

};

static const value_string ipfix_sampling_mode[] = {

    {0, "No sampling mode configured"},

    {1, "Deterministic sampling"},

    {2, "Random sampling"},

    {0, NULL}

};

enum {

    V8PDU_NO_METHOD = 0,

    V8PDU_AS_METHOD,

    V8PDU_PROTO_METHOD,

    V8PDU_SPREFIX_METHOD,

    V8PDU_DPREFIX_METHOD,

    V8PDU_MATRIX_METHOD,

    V8PDU_DESTONLY_METHOD,

    V8PDU_SRCDEST_METHOD,

    V8PDU_FULL_METHOD,

    V8PDU_TOSAS_METHOD,

    V8PDU_TOSPROTOPORT_METHOD,

    V8PDU_TOSSRCPREFIX_METHOD,

    V8PDU_TOSDSTPREFIX_METHOD,

    V8PDU_TOSMATRIX_METHOD,

    V8PDU_PREPORTPROTOCOL_METHOD

};

static const value_string v8_agg[] = {

    {V8PDU_AS_METHOD,               "V8 AS aggregation"},

    {V8PDU_PROTO_METHOD,            "V8 Proto/Port aggregation"},

    {V8PDU_SPREFIX_METHOD,          "V8 Source Prefix aggregation"},

    {V8PDU_DPREFIX_METHOD,          "V8 Destination Prefix aggregation"},

    {V8PDU_MATRIX_METHOD,           "V8 Network Matrix aggregation"},

    {V8PDU_DESTONLY_METHOD,         "V8 Destination aggregation (Cisco Catalyst)"},

    {V8PDU_SRCDEST_METHOD,          "V8 Src/Dest aggregation (Cisco Catalyst)"},

    {V8PDU_FULL_METHOD,             "V8 Full aggregation (Cisco Catalyst)"},

    {V8PDU_TOSAS_METHOD,            "V8 TOS+AS aggregation"},

    {V8PDU_TOSPROTOPORT_METHOD,     "V8 TOS+Protocol aggregation"},

    {V8PDU_TOSSRCPREFIX_METHOD,     "V8 TOS+Source Prefix aggregation"},

    {V8PDU_TOSDSTPREFIX_METHOD,     "V8 TOS+Destination Prefix aggregation"},

    {V8PDU_TOSMATRIX_METHOD,        "V8 TOS+Prefix Matrix aggregation"},

    {V8PDU_PREPORTPROTOCOL_METHOD,  "V8 Port+Protocol aggregation"},

    {0, NULL}

};

static value_string_ext v8_agg_ext = VALUE_STRING_EXT_INIT(v8_agg);

/* Max number of entries/scopes per template */

/* Space is allocated dynamically so there isn't really a need to

   bound this except to cap possible memory use.  Unfortunately if

   this value is too low we can't decode any template with more than

   v9_tmplt_max_fields fields in it.  The best compromise seems

   to be to make v9_tmplt_max_fields a user preference.

   A value of 0 will be unlimited.

*/

#define V9_TMPLT_MAX_FIELDS_DEF   60

static unsigned v9_tmplt_max_fields = V9_TMPLT_MAX_FIELDS_DEF;

typedef struct _v9_v10_tmplt_entry {

    uint16_t     type;

    uint16_t     length;

    uint32_t     pen;

    const char *pen_str;

} v9_v10_tmplt_entry_t;

typedef enum {

    TF_SCOPES=0,

    TF_ENTRIES,

    /* START IPFIX VENDOR FIELDS */

    TF_PLIXER,

    TF_NTOP,

    TF_IXIA,

    TF_NETSCALER,

    TF_BARRACUDA,

    TF_GIGAMON,

    TF_CISCO,

    TF_NIAGARA_NETWORKS,

    TF_FASTIP,

    TF_JUNIPER,

    TF_NO_VENDOR_INFO

} v9_v10_tmplt_fields_type_t;

#define TF_NUM 2

#define TF_NUM_EXT TF_NO_VENDOR_INFO+1   /* includes vendor fields */

typedef struct _v9_v10_tmplt {

    /* For linking back to show where fields were defined */

    uint32_t template_frame_number;

    address  src_addr;

    uint32_t src_port;

    address  dst_addr;

    uint32_t dst_port;

    uint32_t src_id;   /* SourceID in NetFlow V9, Observation Domain ID in IPFIX */

    uint16_t tmplt_id;

    unsigned length;

    uint16_t field_count[TF_NUM];                /* 0:scopes; 1:entries  */

    v9_v10_tmplt_entry_t *fields_p[TF_NUM_EXT];  /* 0:scopes; 1:entries; n:vendor_entries  */

} v9_v10_tmplt_t;

/* Map from (conversation+obs-domain-id+flowset-id) -> v9_v10_tmplt_entry_t*    */

/* Confusingly, for key, fill in only relevant parts of v9_v10_tmplt_entry_t... */

static wmem_map_t *v9_v10_tmplt_table;

static const value_string v9_v10_template_types[] = {

    {   1, "BYTES" },

    {   2, "PKTS" },

    {   3, "FLOWS" },

    {   4, "PROTOCOL" },

    {   5, "IP_TOS" },

    {   6, "TCP_FLAGS" },

    {   7, "L4_SRC_PORT" },

    {   8, "IP_SRC_ADDR" },

    {   9, "SRC_MASK" },

    {  10, "INPUT_SNMP" },

    {  11, "L4_DST_PORT" },

    {  12, "IP_DST_ADDR" },

    {  13, "DST_MASK" },

    {  14, "OUTPUT_SNMP" },

    {  15, "IP_NEXT_HOP" },

    {  16, "SRC_AS" },

    {  17, "DST_AS" },

    {  18, "BGP_NEXT_HOP" },

    {  19, "MUL_DPKTS" },

    {  20, "MUL_DOCTETS" },

    {  21, "LAST_SWITCHED" },

    {  22, "FIRST_SWITCHED" },

    {  23, "OUT_BYTES" },

    {  24, "OUT_PKTS" },

    {  25, "IP LENGTH MINIMUM" },

    {  26, "IP LENGTH MAXIMUM" },

    {  27, "IPV6_SRC_ADDR" },

    {  28, "IPV6_DST_ADDR" },

    {  29, "IPV6_SRC_MASK" },

    {  30, "IPV6_DST_MASK" },

    {  31, "FLOW_LABEL" },

    {  32, "ICMP_TYPE" },

    {  33, "IGMP_TYPE" },

    {  34, "SAMPLING_INTERVAL" },

    {  35, "SAMPLING_ALGORITHM" },

    {  36, "FLOW_ACTIVE_TIMEOUT" },

    {  37, "FLOW_INACTIVE_TIMEOUT" },

    {  38, "ENGINE_TYPE" },

    {  39, "ENGINE_ID" },

    {  40, "TOTAL_BYTES_EXP" },

    {  41, "TOTAL_PKTS_EXP" },

    {  42, "TOTAL_FLOWS_EXP" },

    {  43, "IPV4_ROUTER_SC" },

    {  44, "IP_SRC_PREFIX" },

    {  45, "IP_DST_PREFIX" },

    {  46, "MPLS_TOP_LABEL_TYPE" },

    {  47, "MPLS_TOP_LABEL_ADDR" },

    {  48, "FLOW_SAMPLER_ID" },

    {  49, "FLOW_SAMPLER_MODE" },

    {  50, "FLOW_SAMPLER_RANDOM_INTERVAL" },

    {  51, "FLOW_CLASS" },

    {  52, "IP TTL MINIMUM" },

    {  53, "IP TTL MAXIMUM" },

    {  54, "IPv4 ID" },

    {  55, "DST_TOS" },

    {  56, "SRC_MAC" },

    {  57, "DST_MAC" },

    {  58, "SRC_VLAN" },

    {  59, "DST_VLAN" },

    {  60, "IP_PROTOCOL_VERSION" },

    {  61, "DIRECTION" },

    {  62, "IPV6_NEXT_HOP" },

    {  63, "BGP_IPV6_NEXT_HOP" },

    {  64, "IPV6_OPTION_HEADERS" },

    {  70, "MPLS_LABEL_1" },

    {  71, "MPLS_LABEL_2" },

    {  72, "MPLS_LABEL_3" },

    {  73, "MPLS_LABEL_4" },

    {  74, "MPLS_LABEL_5" },

    {  75, "MPLS_LABEL_6" },

    {  76, "MPLS_LABEL_7" },

    {  77, "MPLS_LABEL_8" },

    {  78, "MPLS_LABEL_9" },

    {  79, "MPLS_LABEL_10" },

    {  80, "DESTINATION_MAC" },

    {  81, "SOURCE_MAC" },

    {  82, "IF_NAME" },

    {  83, "IF_DESC" },

    {  84, "SAMPLER_NAME" },

    {  85, "BYTES_TOTAL" },

    {  86, "PACKETS_TOTAL" },

    {  88, "FRAGMENT_OFFSET" },

    {  89, "FORWARDING_STATUS" },

    {  90, "VPN_ROUTE_DISTINGUISHER" },

    {  91, "mplsTopLabelPrefixLength" },

    {  92, "SRC_TRAFFIC_INDEX" },

    {  93, "DST_TRAFFIC_INDEX" },

    {  94, "APPLICATION_DESC" },

    {  95, "APPLICATION_ID" },

    {  96, "APPLICATION_NAME" },

    {  98, "postIpDiffServCodePoint" },

    {  99, "multicastReplicationFactor" },

    { 101, "classificationEngineId" },

    { 128, "DST_AS_PEER" },

    { 129, "SRC_AS_PEER" },

    { 130, "exporterIPv4Address" },

    { 131, "exporterIPv6Address" },

    { 132, "DROPPED_BYTES" },

    { 133, "DROPPED_PACKETS" },

    { 134, "DROPPED_BYTES_TOTAL" },

    { 135, "DROPPED_PACKETS_TOTAL" },

    { 136, "flowEndReason" },

    { 137, "commonPropertiesId" },

    { 138, "observationPointId" },

    { 139, "icmpTypeCodeIPv6" },

    { 140, "MPLS_TOP_LABEL_IPv6_ADDRESS" },

    { 141, "lineCardId" },

    { 142, "portId" },

    { 143, "meteringProcessId" },

    { 144, "FLOW_EXPORTER" },

    { 145, "templateId" },

    { 146, "wlanChannelId" },

    { 147, "wlanSSID" },

    { 148, "flowId" },

    { 149, "observationDomainId" },

    { 150, "flowStartSeconds" },

    { 151, "flowEndSeconds" },

    { 152, "flowStartMilliseconds" },

    { 153, "flowEndMilliseconds" },

    { 154, "flowStartMicroseconds" },

    { 155, "flowEndMicroseconds" },

    { 156, "flowStartNanoseconds" },

    { 157, "flowEndNanoseconds" },

    { 158, "flowStartDeltaMicroseconds" },

    { 159, "flowEndDeltaMicroseconds" },

    { 160, "systemInitTimeMilliseconds" },

    { 161, "flowDurationMilliseconds" },

    { 162, "flowDurationMicroseconds" },

    { 163, "observedFlowTotalCount" },

    { 164, "ignoredPacketTotalCount" },

    { 165, "ignoredOctetTotalCount" },

    { 166, "notSentFlowTotalCount" },

    { 167, "notSentPacketTotalCount" },

    { 168, "notSentOctetTotalCount" },

    { 169, "destinationIPv6Prefix" },

    { 170, "sourceIPv6Prefix" },

    { 171, "postOctetTotalCount" },

    { 172, "postPacketTotalCount" },

    { 173, "flowKeyIndicator" },

    { 174, "postMCastPacketTotalCount" },

    { 175, "postMCastOctetTotalCount" },

    { 176, "ICMP_IPv4_TYPE" },

    { 177, "ICMP_IPv4_CODE" },

    { 178, "ICMP_IPv6_TYPE" },

    { 179, "ICMP_IPv6_CODE" },

    { 180, "UDP_SRC_PORT" },

    { 181, "UDP_DST_PORT" },

    { 182, "TCP_SRC_PORT" },

    { 183, "TCP_DST_PORT" },

    { 184, "TCP_SEQ_NUM" },

    { 185, "TCP_ACK_NUM" },

    { 186, "TCP_WINDOW_SIZE" },

    { 187, "TCP_URGENT_PTR" },

    { 188, "TCP_HEADER_LEN" },

    { 189, "IP_HEADER_LEN" },

    { 190, "IP_TOTAL_LEN" },

    { 191, "payloadLengthIPv6" },

    { 192, "IP_TTL" },

    { 193, "nextHeaderIPv6" },

    { 194, "mplsPayloadLength" },

    { 195, "IP_DSCP" },

    { 196, "IP_PRECEDENCE" },

    { 197, "IP_FRAGMENT_FLAGS" },

    { 198, "DELTA_BYTES_SQUARED" },

    { 199, "TOTAL_BYTES_SQUARED" },

    { 200, "MPLS_TOP_LABEL_TTL" },

    { 201, "MPLS_LABEL_STACK_OCTETS" },

    { 202, "MPLS_LABEL_STACK_DEPTH" },

    { 203, "MPLS_TOP_LABEL_EXP" },

    { 204, "IP_PAYLOAD_LENGTH" },

    { 205, "UDP_LENGTH" },

    { 206, "IS_MULTICAST" },

    { 207, "IP_HEADER_WORDS" },

    { 208, "IP_OPTION_MAP" },

    { 209, "TCP_OPTION_MAP" },

    { 210, "paddingOctets" },

    { 211, "collectorIPv4Address" },

    { 212, "collectorIPv6Address" },

    { 213, "collectorInterface" },

    { 214, "collectorProtocolVersion" },

    { 215, "collectorTransportProtocol" },

    { 216, "collectorTransportPort" },

    { 217, "exporterTransportPort" },

    { 218, "tcpSynTotalCount" },

    { 219, "tcpFinTotalCount" },

    { 220, "tcpRstTotalCount" },

    { 221, "tcpPshTotalCount" },

    { 222, "tcpAckTotalCount" },

    { 223, "tcpUrgTotalCount" },

    { 224, "ipTotalLength" },

    { 225, "postNATSourceIPv4Address" },

    { 226, "postNATDestinationIPv4Address" },

    { 227, "postNAPTSourceTransportPort" },

    { 228, "postNAPTDestinationTransportPort" },

    { 229, "natOriginatingAddressRealm" },

    { 230, "natEvent" },

    { 231, "initiatorOctets" },

    { 232, "responderOctets" },

    { 233, "firewallEvent" },

    { 234, "ingressVRFID" },

    { 235, "egressVRFID" },

    { 236, "VRFname" },

    { 237, "postMplsTopLabelExp" },

    { 238, "tcpWindowScale" },

    { 239, "biflowDirection" },

    { 240, "ethernetHeaderLength" },

    { 241, "ethernetPayloadLength" },

    { 242, "ethernetTotalLength" },

    { 243, "dot1qVlanId" },

    { 244, "dot1qPriority" },

    { 245, "dot1qCustomerVlanId" },

    { 246, "dot1qCustomerPriority" },

    { 247, "metroEvcId" },

    { 248, "metroEvcType" },

    { 249, "pseudoWireId" },

    { 250, "pseudoWireType" },

    { 251, "pseudoWireControlWord" },

    { 252, "ingressPhysicalInterface" },

    { 253, "egressPhysicalInterface" },

    { 254, "postDot1qVlanId" },

    { 255, "postDot1qCustomerVlanId" },

    { 256, "ethernetType" },

    { 257, "postIpPrecedence" },

    { 258, "collectionTimeMilliseconds" },

    { 259, "exportSctpStreamId" },

    { 260, "maxExportSeconds" },

    { 261, "maxFlowEndSeconds" },

    { 262, "messageMD5Checksum" },

    { 263, "messageScope" },

    { 264, "minExportSeconds" },

    { 265, "minFlowStartSeconds" },

    { 266, "opaqueOctets" },

    { 267, "sessionScope" },

    { 268, "maxFlowEndMicroseconds" },

    { 269, "maxFlowEndMilliseconds" },

    { 270, "maxFlowEndNanoseconds" },

    { 271, "minFlowStartMicroseconds" },

    { 272, "minFlowStartMilliseconds" },

    { 273, "minFlowStartNanoseconds" },

    { 274, "collectorCertificate" },

    { 275, "exporterCertificate" },

    { 276, "dataRecordsReliability" },

    { 277, "observationPointType" },

    { 278, "newConnectionDeltaCount" },

    { 279, "connectionSumDurationSeconds" },

    { 280, "connectionTransactionId" },

    { 281, "postNATSourceIPv6Address" },

    { 282, "postNATDestinationIPv6Address" },

    { 283, "natPoolId" },

    { 284, "natPoolName" },

    { 285, "anonymizationFlags" },

    { 286, "anonymizationTechnique" },

    { 287, "informationElementIndex" },

    { 288, "p2pTechnology" },

    { 289, "tunnelTechnology" },

    { 290, "encryptedTechnology" },

    { 291, "basicList" },

    { 292, "subTemplateList" },

    { 293, "subTemplateMultiList" },

    { 294, "bgpValidityState" },

    { 295, "IPSecSPI" },

    { 296, "greKey" },

    { 297, "natType" },

    { 298, "initiatorPackets" },

    { 299, "responderPackets" },

    { 300, "observationDomainName" },

    { 301, "selectionSequenceId" },

    { 302, "selectorId" },

    { 303, "informationElementId" },

    { 304, "selectorAlgorithm" },

    { 305, "samplingPacketInterval" },

    { 306, "samplingPacketSpace" },

    { 307, "samplingTimeInterval" },

    { 308, "samplingTimeSpace" },

    { 309, "samplingSize" },

    { 310, "samplingPopulation" },

    { 311, "samplingProbability" },

    { 312, "dataLinkFrameSize" },

    { 313, "IP_SECTION HEADER" },

    { 314, "IP_SECTION PAYLOAD" },

    { 315, "dataLinkFrameSection" },

    { 316, "mplsLabelStackSection" },

    { 317, "mplsPayloadPacketSection" },

    { 318, "selectorIdTotalPktsObserved" },

    { 319, "selectorIdTotalPktsSelected" },

    { 320, "absoluteError" },

    { 321, "relativeError" },

    { 322, "observationTimeSeconds" },

    { 323, "observationTimeMilliseconds" },

    { 324, "observationTimeMicroseconds" },

    { 325, "observationTimeNanoseconds" },

    { 326, "digestHashValue" },

    { 327, "hashIPPayloadOffset" },

    { 328, "hashIPPayloadSize" },

    { 329, "hashOutputRangeMin" },

    { 330, "hashOutputRangeMax" },

    { 331, "hashSelectedRangeMin" },

    { 332, "hashSelectedRangeMax" },

    { 333, "hashDigestOutput" },

    { 334, "hashInitialiserValue" },

    { 335, "selectorName" },

    { 336, "upperCILimit" },

    { 337, "lowerCILimit" },

    { 338, "confidenceLevel" },

    { 339, "informationElementDataType" },

    { 340, "informationElementDescription" },

    { 341, "informationElementName" },

    { 342, "informationElementRangeBegin" },

    { 343, "informationElementRangeEnd" },

    { 344, "informationElementSemantics" },

    { 345, "informationElementUnits" },

    { 346, "privateEnterpriseNumber" },

    { 347, "virtualStationInterfaceId" },

    { 348, "virtualStationInterfaceName" },

    { 349, "virtualStationUUID" },

    { 350, "virtualStationName" },

    { 351, "layer2SegmentId" },

    { 352, "layer2OctetDeltaCount" },

    { 353, "layer2OctetTotalCount" },

    { 354, "ingressUnicastPacketTotalCount" },

    { 355, "ingressMulticastPacketTotalCount" },

    { 356, "ingressBroadcastPacketTotalCount" },

    { 357, "egressUnicastPacketTotalCount" },

    { 358, "egressBroadcastPacketTotalCount" },

    { 359, "monitoringIntervalStartMilliSeconds" },

    { 360, "monitoringIntervalEndMilliSeconds" },

    { 361, "portRangeStart" },

    { 362, "portRangeEnd" },

    { 363, "portRangeStepSize" },

    { 364, "portRangeNumPorts" },

    { 365, "staMacAddress" },

    { 366, "staIPv4Address" },

    { 367, "wtpMacAddress" },

    { 368, "ingressInterfaceType" },

    { 369, "egressInterfaceType" },

    { 370, "rtpSequenceNumber" },

    { 371, "userName" },

    { 372, "applicationCategoryName" },

    { 373, "applicationSubCategoryName" },

    { 374, "applicationGroupName" },

    { 375, "originalFlowsPresent" },

    { 376, "originalFlowsInitiated" },

    { 377, "originalFlowsCompleted" },

    { 378, "distinctCountOfSourceIPAddress" },

    { 379, "distinctCountOfDestinationIPAddress" },

    { 380, "distinctCountOfSourceIPv4Address" },

    { 381, "distinctCountOfDestinationIPv4Address" },

    { 382, "distinctCountOfSourceIPv6Address" },

    { 383, "distinctCountOfDestinationIPv6Address" },

    { 384, "valueDistributionMethod" },

    { 385, "rfc3550JitterMilliseconds" },

    { 386, "rfc3550JitterMicroseconds" },

    { 387, "rfc3550JitterNanoseconds" },

    { 388, "dot1qDEI" },

    { 389, "dot1qCustomerDEI" },

    { 390, "flowSelectorAlgorithm" },

    { 391, "flowSelectedOctetDeltaCount" },

    { 392, "flowSelectedPacketDeltaCount" },

    { 393, "flowSelectedFlowDeltaCount" },

    { 394, "selectorIDTotalFlowsObserved" },

    { 395, "selectorIDTotalFlowsSelected" },

    { 396, "samplingFlowInterval" },

    { 397, "samplingFlowSpacing" },

    { 398, "flowSamplingTimeInterval" },

    { 399, "flowSamplingTimeSpacing" },

    { 400, "hashFlowDomain" },

    { 401, "transportOctetDeltaCount" },

    { 402, "transportPacketDeltaCount" },

    { 403, "originalExporterIPv4Address" },

    { 404, "originalExporterIPv6Address" },

    { 405, "originalObservationDomainId" },

    { 406, "intermediateProcessId" },

    { 407, "ignoredDataRecordTotalCount" },

    { 408, "dataLinkFrameType" },

    { 409, "sectionOffset" },

    { 410, "sectionExportedOctets" },

    { 411, "dot1qServiceInstanceTag" },

    { 412, "dot1qServiceInstanceId" },

    { 413, "dot1qServiceInstancePriority" },

    { 414, "dot1qCustomerSourceMacAddress" },

    { 415, "dot1qCustomerDestinationMacAddress" },

    { 416, "deprecated [dup of layer2OctetDeltaCount]" },

    { 417, "postLayer2OctetDeltaCount" },

    { 418, "postMCastLayer2OctetDeltaCount" },

    { 419, "deprecated [dup of layer2OctetTotalCount" },

    { 420, "postLayer2OctetTotalCount" },

    { 421, "postMCastLayer2OctetTotalCount" },

    { 422, "minimumLayer2TotalLength" },

    { 423, "maximumLayer2TotalLength" },

    { 424, "droppedLayer2OctetDeltaCount" },

    { 425, "droppedLayer2OctetTotalCount" },

    { 426, "ignoredLayer2OctetTotalCount" },

    { 427, "notSentLayer2OctetTotalCount" },

    { 428, "layer2OctetDeltaSumOfSquares" },

    { 429, "layer2OctetTotalSumOfSquares" },

    { 430, "layer2FrameDeltaCount" },

    { 431, "layer2FrameTotalCount" },

    { 432, "pseudoWireDestinationIPv4Address" },

    { 433, "ignoredLayer2FrameTotalCount" },

    { 434, "mibObjectValueInteger" },

    { 435, "mibObjectValueOctetString" },

    { 436, "mibObjectValueOID" },

    { 437, "mibObjectValueBits" },

    { 438, "mibObjectValueIPAddress" },

    { 439, "mibObjectValueCounter" },

    { 440, "mibObjectValueGauge" },

    { 441, "mibObjectValueTimeTicks" },

    { 442, "mibObjectValueUnsigned" },

    { 443, "mibObjectValueTable" },

    { 444, "mibObjectValueRow" },

    { 445, "mibObjectIdentifier" },

    { 446, "mibSubIdentifier" },

    { 447, "mibIndexIndicator" },

    { 448, "mibCaptureTimeSemantics" },

    { 449, "mibContextEngineID" },

    { 450, "mibContextName" },

    { 451, "mibObjectName" },

    { 452, "mibObjectDescription" },

    { 453, "mibObjectSyntax" },

    { 454, "mibModuleName" },

    { 455, "mobileIMSI" },

    { 456, "mobileMSISDN" },

    { 457, "httpStatusCode" },

    { 458, "sourceTransportPortsLimit" },

    { 459, "httpRequestMethod" },

    { 460, "httpRequestHost" },

    { 461, "httpRequestTarget" },

    { 462, "httpMessageVersion" },

    { 463, "natInstanceID" },

    { 464, "internalAddressRealm" },

    { 465, "externalAddressRealm" },

    { 466, "natQuotaExceededEvent" },

    { 467, "natThresholdEvent" },

    { 468, "httpUserAgent" },

    { 469, "httpContentType" },

    { 470, "httpReasonPhrase" },

    { 471, "maxSessionEntries" },

    { 472, "maxBIBEntries" },

    { 473, "maxEntriesPerUser" },

    { 474, "maxSubscribers" },

    { 475, "maxFragmentsPendingReassembly" },

    { 476, "addressPoolHighThreshold" },

    { 477, "addressPoolLowThreshold" },

    { 478, "addressPortMappingHighThreshold" },

    { 479, "addressPortMappingLowThreshold" },

    { 480, "addressPortMappingPerUserHighThreshold" },

    { 481, "globalAddressMappingHighThreshold" },

    { 482, "vpnIdentifier" },

    { 483, "bgpCommunity" },

    { 484, "bgpSourceCommunityList" },

    { 485, "bgpDestinationCommunityList" },

    { 486, "bgpExtendedCommunity" },

    { 487, "bgpSourceExtendedCommunityList" },

    { 488, "bgpDestinationExtendedCommunityList" },

    { 489, "bgpLargeCommunity" },

    { 490, "bgpSourceLargeCommunityList" },

    { 491, "bgpDestinationLargeCommunityList" },

    { 492, "srhFlagsIPv6" },

    { 493, "srhTagIPv6" },

    { 494, "srhSegmentIPv6" },

    { 495, "srhActiveSegmentIPv6" },

    { 496, "srhSegmentIPv6BasicList" },

    { 497, "srhSegmentIPv6ListSection" },

    { 498, "srhSegmentsIPv6Left" },

    { 499, "srhIPv6Section" },

    { 500, "srhIPv6ActiveSegmentType" },

    { 501, "srhSegmentIPv6LocatorLength" },

    { 502, "srhSegmentIPv6EndpointBehavior" },

    { 505, "gtpuFlags" },

    { 506, "gtpuMsgType" },

    { 507, "gtpuTEid" },

    { 508, "gtpuSequenceNum" },

    { 509, "gtpuQFI" },

    { 510, "gtpuPduType" },

    /* Ericsson NAT Logging */

    { 24628, "NAT_LOG_FIELD_IDX_CONTEXT_ID" },

    { 24629, "NAT_LOG_FIELD_IDX_CONTEXT_NAME" },

    { 24630, "NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC" },

    { 24631, "NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC" },

    { 24632, "NAT_LOG_FIELD_IDX_IPV4_INT_ADDR" },

    { 24633, "NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR" },

    { 24634, "NAT_LOG_FIELD_IDX_EXT_PORT_FIRST" },

    { 24635, "NAT_LOG_FIELD_IDX_EXT_PORT_LAST" },

    /* Cisco ASA5500 Series NetFlow */

    { 33000, "INGRESS_ACL_ID" },

    { 33001, "EGRESS_ACL_ID" },

    { 33002, "FW_EXT_EVENT" },

    /* Boundary bprobe */

    { 33610, "METER_VERSION"},

    { 33611, "METER_OS_SYSNAME"},

    { 33612, "METER_OS_NODENAME"},

    { 33613, "METER_OS_RELEASE"},

    { 33614, "METER_OS_VERSION"},

    { 33615, "METER_OS_MACHINE"},

    { 33623, "EPOCH_SECOND"},

    { 33624, "NIC_NAME"},

    { 33625, "NIC_ID"},

    { 33626, "NIC_MAC"},

    { 33627, "NIC_IP"},

    { 33628, "COLLISIONS"},

    { 33629, "ERRORS"},

    { 33630, "NIC_DRIVER_NAME"},

    { 33631, "NIC_DRIVER_VERSION"},

    { 33632, "NIC_FIRMWARE_VERSION"},

    { 33633, "METER_OS_DISTRIBUTION_NAME"},

    { 33634, "BOND_INTERFACE_MODE"},

    { 33635, "BOND_INTERFACE_PHYSICAL_NIC_COUNT"},

    { 33636, "BOND_INTERFACE_ID"},

    /* Cisco TrustSec */

    { 34000, "SGT_SOURCE_TAG" },

    { 34001, "SGT_DESTINATION_TAG" },

    { 34002, "SGT_SOURCE_NAME" },

    { 34003, "SGT_DESTINATION_NAME" },

    /* medianet performance monitor */

    { 37000, "PACKETS_DROPPED" },

    { 37003, "BYTE_RATE" },

    { 37004, "APPLICATION_MEDIA_BYTES" },

    { 37006, "APPLICATION_MEDIA_BYTE_RATE" },

    { 37007, "APPLICATION_MEDIA_PACKETS" },

    { 37009, "APPLICATION_MEDIA_PACKET_RATE" },

    { 37011, "APPLICATION_MEDIA_EVENT" },

    { 37012, "MONITOR_EVENT" },

    { 37013, "TIMESTAMP_INTERVAL" },

    { 37014, "TRANSPORT_PACKETS_EXPECTED" },

    { 37016, "TRANSPORT_ROUND_TRIP_TIME" },

    { 37017, "TRANSPORT_EVENT_PACKET_LOSS" },

    { 37019, "TRANSPORT_PACKETS_LOST" },

    { 37021, "TRANSPORT_PACKETS_LOST_RATE" },

    { 37022, "TRANSPORT_RTP_SSRC" },

    { 37023, "TRANSPORT_RTP_JITTER_MEAN" },

    { 37024, "TRANSPORT_RTP_JITTER_MIN" },

    { 37025, "TRANSPORT_RTP_JITTER_MAX" },

    { 37041, "TRANSPORT_RTP_PAYLOAD_TYPE" },

    { 37071, "TRANSPORT_BYTES_OUT_OF_ORDER" },

    { 37074, "TRANSPORT_PACKETS_OUT_OF_ORDER" },

    { 37083, "TRANSPORT_TCP_WINDOWS_SIZE_MIN" },

    { 37084, "TRANSPORT_TCP_WINDOWS_SIZE_MAX" },

    { 37085, "TRANSPORT_TCP_WINDOWS_SIZE_MEAN" },

    { 37086, "TRANSPORT_TCP_MAXIMUM_SEGMENT_SIZE" },

    /* Cisco ASA 5500 */

    { 40000, "AAA_USERNAME" },

    { 40001, "XLATE_SRC_ADDR_IPV4" },

    { 40002, "XLATE_DST_ADDR_IPV4" },

    { 40003, "XLATE_SRC_PORT" },

    { 40004, "XLATE_DST_PORT" },

    { 40005, "FW_EVENT" },

    /* v9 nTop extensions. */

    {  80 + NTOP_BASE, "SRC_FRAGMENTS" },

    {  81 + NTOP_BASE, "DST_FRAGMENTS" },

    {  82 + NTOP_BASE, "SRC_TO_DST_MAX_THROUGHPUT" },

    {  83 + NTOP_BASE, "SRC_TO_DST_MIN_THROUGHPUT" },

    {  84 + NTOP_BASE, "SRC_TO_DST_AVG_THROUGHPUT" },

    {  85 + NTOP_BASE, "SRC_TO_SRC_MAX_THROUGHPUT" },

    {  86 + NTOP_BASE, "SRC_TO_SRC_MIN_THROUGHPUT" },

    {  87 + NTOP_BASE, "SRC_TO_SRC_AVG_THROUGHPUT" },

    {  88 + NTOP_BASE, "NUM_PKTS_UP_TO_128_BYTES" },

    {  89 + NTOP_BASE, "NUM_PKTS_128_TO_256_BYTES" },

    {  90 + NTOP_BASE, "NUM_PKTS_256_TO_512_BYTES" },

    {  91 + NTOP_BASE, "NUM_PKTS_512_TO_1024_BYTES" },

    {  92 + NTOP_BASE, "NUM_PKTS_1024_TO_1514_BYTES" },

    {  93 + NTOP_BASE, "NUM_PKTS_OVER_1514_BYTES" },

    {  98 + NTOP_BASE, "CUMULATIVE_ICMP_TYPE" },

    { 101 + NTOP_BASE, "SRC_IP_COUNTRY" },

    { 102 + NTOP_BASE, "SRC_IP_CITY" },

    { 103 + NTOP_BASE, "DST_IP_COUNTRY" },

    { 104 + NTOP_BASE, "DST_IP_CITY" },

    { 105 + NTOP_BASE, "FLOW_PROTO_PORT" },

    { 106 + NTOP_BASE, "UPSTREAM_TUNNEL_ID" },

    { 107 + NTOP_BASE, "LONGEST_FLOW_PKT" },

    { 108 + NTOP_BASE, "SHORTEST_FLOW_PKT" },

    { 109 + NTOP_BASE, "RETRANSMITTED_IN_PKTS" },

    { 110 + NTOP_BASE, "RETRANSMITTED_OUT_PKTS" },

    { 111 + NTOP_BASE, "OOORDER_IN_PKTS" },

    { 112 + NTOP_BASE, "OOORDER_OUT_PKTS" },

    { 113 + NTOP_BASE, "UNTUNNELED_PROTOCOL" },

    { 114 + NTOP_BASE, "UNTUNNELED_IPV4_SRC_ADDR" },

    { 115 + NTOP_BASE, "UNTUNNELED_L4_SRC_PORT" },

    { 116 + NTOP_BASE, "UNTUNNELED_IPV4_DST_ADDR" },

    { 117 + NTOP_BASE, "UNTUNNELED_L4_DST_PORT" },

    { 118 + NTOP_BASE, "L7_PROTO" },

    { 119 + NTOP_BASE, "L7_PROTO_NAME" },

    { 120 + NTOP_BASE, "DOWNSTREAM_TUNNEL_ID" },

    { 121 + NTOP_BASE, "FLOW_USER_NAME" },

    { 122 + NTOP_BASE, "FLOW_SERVER_NAME" },

    { 123 + NTOP_BASE, "CLIENT_NW_LATENCY_MS" },

    { 124 + NTOP_BASE, "SERVER_NW_LATENCY_MS" },

    { 125 + NTOP_BASE, "APPL_LATENCY_MS" },

    { 126 + NTOP_BASE, "PLUGIN_NAME" },

    { 127 + NTOP_BASE, "RETRANSMITTED_IN_BYTES" },

    { 128 + NTOP_BASE, "RETRANSMITTED_OUT_BYTES" },

    { 130 + NTOP_BASE, "SIP_CALL_ID" },

    { 131 + NTOP_BASE, "SIP_CALLING_PARTY" },

    { 132 + NTOP_BASE, "SIP_CALLED_PARTY" },

    { 133 + NTOP_BASE, "SIP_RTP_CODECS" },

    { 134 + NTOP_BASE, "SIP_INVITE_TIME" },

    { 135 + NTOP_BASE, "SIP_TRYING_TIME" },

    { 136 + NTOP_BASE, "SIP_RINGING_TIME" },

    { 137 + NTOP_BASE, "SIP_INVITE_OK_TIME" },

    { 138 + NTOP_BASE, "SIP_INVITE_FAILURE_TIME" },

    { 139 + NTOP_BASE, "SIP_BYE_TIME" },

    { 140 + NTOP_BASE, "SIP_BYE_OK_TIME" },

    { 141 + NTOP_BASE, "SIP_CANCEL_TIME" },

    { 142 + NTOP_BASE, "SIP_CANCEL_OK_TIME" },

    { 143 + NTOP_BASE, "SIP_RTP_IPV4_SRC_ADDR" },

    { 144 + NTOP_BASE, "SIP_RTP_L4_SRC_PORT" },

    { 145 + NTOP_BASE, "SIP_RTP_IPV4_DST_ADDR" },

    { 146 + NTOP_BASE, "SIP_RTP_L4_DST_PORT" },

    { 147 + NTOP_BASE, "SIP_RESPONSE_CODE" },

    { 148 + NTOP_BASE, "SIP_REASON_CAUSE" },

    { 150 + NTOP_BASE, "RTP_FIRST_SEQ" },

    { 151 + NTOP_BASE, "RTP_FIRST_TS" },

    { 152 + NTOP_BASE, "RTP_LAST_SEQ" },

    { 153 + NTOP_BASE, "RTP_LAST_TS" },

    { 154 + NTOP_BASE, "RTP_IN_JITTER" },

    { 155 + NTOP_BASE, "RTP_OUT_JITTER" },

    { 156 + NTOP_BASE, "RTP_IN_PKT_LOST" },

    { 157 + NTOP_BASE, "RTP_OUT_PKT_LOST" },

    { 158 + NTOP_BASE, "RTP_OUT_PAYLOAD_TYPE" },

    { 159 + NTOP_BASE, "RTP_IN_MAX_DELTA" },

    { 160 + NTOP_BASE, "RTP_OUT_MAX_DELTA" },

    { 161 + NTOP_BASE, "RTP_IN_PAYLOAD_TYPE" },

    { 168 + NTOP_BASE, "SRC_PROC_PID" },

    { 169 + NTOP_BASE, "SRC_PROC_NAME" },

    { 180 + NTOP_BASE, "HTTP_URL" },

    { 181 + NTOP_BASE, "HTTP_RET_CODE" },

    { 182 + NTOP_BASE, "HTTP_REFERER" },

    { 183 + NTOP_BASE, "HTTP_UA" },

    { 184 + NTOP_BASE, "HTTP_MIME" },

    { 185 + NTOP_BASE, "SMTP_MAIL_FROM" },

    { 186 + NTOP_BASE, "SMTP_RCPT_TO" },

    { 187 + NTOP_BASE, "HTTP_HOST" },

    { 188 + NTOP_BASE, "SSL_SERVER_NAME" },

    { 189 + NTOP_BASE, "BITTORRENT_HASH" },

    { 195 + NTOP_BASE, "MYSQL_SRV_VERSION" },

    { 196 + NTOP_BASE, "MYSQL_USERNAME" },

    { 197 + NTOP_BASE, "MYSQL_DB" },

    { 198 + NTOP_BASE, "MYSQL_QUERY" },

    { 199 + NTOP_BASE, "MYSQL_RESPONSE" },

    { 200 + NTOP_BASE, "ORACLE_USERNAME" },

    { 201 + NTOP_BASE, "ORACLE_QUERY" },

    { 202 + NTOP_BASE, "ORACLE_RSP_CODE" },

    { 203 + NTOP_BASE, "ORACLE_RSP_STRING" },

    { 204 + NTOP_BASE, "ORACLE_QUERY_DURATION" },

    { 205 + NTOP_BASE, "DNS_QUERY" },

    { 206 + NTOP_BASE, "DNS_QUERY_ID" },

    { 207 + NTOP_BASE, "DNS_QUERY_TYPE" },

    { 208 + NTOP_BASE, "DNS_RET_CODE" },

    { 209 + NTOP_BASE, "DNS_NUM_ANSWERS" },

    { 210 + NTOP_BASE, "POP_USER" },

    { 220 + NTOP_BASE, "GTPV1_REQ_MSG_TYPE" },

    { 221 + NTOP_BASE, "GTPV1_RSP_MSG_TYPE" },

    { 222 + NTOP_BASE, "GTPV1_C2S_TEID_DATA" },

    { 223 + NTOP_BASE, "GTPV1_C2S_TEID_CTRL" },

    { 224 + NTOP_BASE, "GTPV1_S2C_TEID_DATA" },

    { 225 + NTOP_BASE, "GTPV1_S2C_TEID_CTRL" },

    { 226 + NTOP_BASE, "GTPV1_END_USER_IP" },

    { 227 + NTOP_BASE, "GTPV1_END_USER_IMSI" },

    { 228 + NTOP_BASE, "GTPV1_END_USER_MSISDN" },

    { 229 + NTOP_BASE, "GTPV1_END_USER_IMEI" },

    { 230 + NTOP_BASE, "GTPV1_APN_NAME" },

    { 231 + NTOP_BASE, "GTPV1_RAI_MCC" },

    { 232 + NTOP_BASE, "GTPV1_RAI_MNC" },

    { 233 + NTOP_BASE, "GTPV1_ULI_CELL_LAC" },

    { 234 + NTOP_BASE, "GTPV1_ULI_CELL_CI" },

    { 235 + NTOP_BASE, "GTPV1_ULI_SAC" },

    { 236 + NTOP_BASE, "GTPV1_RAT_TYPE" },

    { 240 + NTOP_BASE, "RADIUS_REQ_MSG_TYPE" },

    { 241 + NTOP_BASE, "RADIUS_RSP_MSG_TYPE" },

    { 242 + NTOP_BASE, "RADIUS_USER_NAME" },

    { 243 + NTOP_BASE, "RADIUS_CALLING_STATION_ID" },

    { 244 + NTOP_BASE, "RADIUS_CALLED_STATION_ID" },

    { 245 + NTOP_BASE, "RADIUS_NAS_IP_ADDR" },

    { 246 + NTOP_BASE, "RADIUS_NAS_IDENTIFIER" },

    { 247 + NTOP_BASE, "RADIUS_USER_IMSI" },

    { 248 + NTOP_BASE, "RADIUS_USER_IMEI" },

    { 249 + NTOP_BASE, "RADIUS_FRAMED_IP_ADDR" },

    { 250 + NTOP_BASE, "RADIUS_ACCT_SESSION_ID" },

    { 251 + NTOP_BASE, "RADIUS_ACCT_STATUS_TYPE" },

    { 252 + NTOP_BASE, "RADIUS_ACCT_IN_OCTETS" },

    { 253 + NTOP_BASE, "RADIUS_ACCT_OUT_OCTETS" },

    { 254 + NTOP_BASE, "RADIUS_ACCT_IN_PKTS" },

    { 255 + NTOP_BASE, "RADIUS_ACCT_OUT_PKTS" },

    { 260 + NTOP_BASE, "IMAP_LOGIN" },

    { 270 + NTOP_BASE, "GTPV2_REQ_MSG_TYPE" },

    { 271 + NTOP_BASE, "GTPV2_RSP_MSG_TYPE" },

    { 272 + NTOP_BASE, "GTPV2_C2S_S1U_GTPU_TEID" },

    { 273 + NTOP_BASE, "GTPV2_C2S_S1U_GTPU_IP" },

    { 274 + NTOP_BASE, "GTPV2_S2C_S1U_GTPU_TEID" },

    { 275 + NTOP_BASE, "GTPV2_S2C_S1U_GTPU_IP" },

    { 276 + NTOP_BASE, "GTPV2_END_USER_IMSI" },

    { 277 + NTOP_BASE, "GTPV2_END_USER_MSISDN" },

    { 278 + NTOP_BASE, "GTPV2_APN_NAME" },

    { 279 + NTOP_BASE, "GTPV2_ULI_MCC" },

    { 280 + NTOP_BASE, "GTPV2_ULI_MNC" },

    { 281 + NTOP_BASE, "GTPV2_ULI_CELL_TAC" },

    { 282 + NTOP_BASE, "GTPV2_ULI_CELL_ID" },

    { 283 + NTOP_BASE, "GTPV2_RAT_TYPE" },

    { 284 + NTOP_BASE, "GTPV2_PDN_IP" },

    { 285 + NTOP_BASE, "GTPV2_END_USER_IMEI" },

    { 290 + NTOP_BASE, "SRC_AS_PATH_1" },

    { 291 + NTOP_BASE, "SRC_AS_PATH_2" },

    { 292 + NTOP_BASE, "SRC_AS_PATH_3" },

    { 293 + NTOP_BASE, "SRC_AS_PATH_4" },

    { 294 + NTOP_BASE, "SRC_AS_PATH_5" },

    { 295 + NTOP_BASE, "SRC_AS_PATH_6" },

    { 296 + NTOP_BASE, "SRC_AS_PATH_7" },

    { 297 + NTOP_BASE, "SRC_AS_PATH_8" },

    { 298 + NTOP_BASE, "SRC_AS_PATH_9" },

    { 299 + NTOP_BASE, "SRC_AS_PATH_10" },

    { 300 + NTOP_BASE, "DST_AS_PATH_1" },

    { 301 + NTOP_BASE, "DST_AS_PATH_2" },

    { 302 + NTOP_BASE, "DST_AS_PATH_3" },

    { 303 + NTOP_BASE, "DST_AS_PATH_4" },

    { 304 + NTOP_BASE, "DST_AS_PATH_5" },

    { 305 + NTOP_BASE, "DST_AS_PATH_6" },

    { 306 + NTOP_BASE, "DST_AS_PATH_7" },

    { 307 + NTOP_BASE, "DST_AS_PATH_8" },

    { 308 + NTOP_BASE, "DST_AS_PATH_9" },

    { 309 + NTOP_BASE, "DST_AS_PATH_10" },

    { 320 + NTOP_BASE, "MYSQL_APPL_LATENCY_USEC" },

    { 321 + NTOP_BASE, "GTPV0_REQ_MSG_TYPE" },

    { 322 + NTOP_BASE, "GTPV0_RSP_MSG_TYPE" },

    { 323 + NTOP_BASE, "GTPV0_TID" },

    { 324 + NTOP_BASE, "GTPV0_END_USER_IP" },

    { 325 + NTOP_BASE, "GTPV0_END_USER_MSISDN" },

    { 326 + NTOP_BASE, "GTPV0_APN_NAME" },

    { 327 + NTOP_BASE, "GTPV0_RAI_MCC" },

    { 328 + NTOP_BASE, "GTPV0_RAI_MNC" },

    { 329 + NTOP_BASE, "GTPV0_RAI_CELL_LAC" },

    { 330 + NTOP_BASE, "GTPV0_RAI_CELL_RAC" },

    { 331 + NTOP_BASE, "GTPV0_RESPONSE_CAUSE" },

    { 332 + NTOP_BASE, "GTPV1_RESPONSE_CAUSE" },

    { 333 + NTOP_BASE, "GTPV2_RESPONSE_CAUSE" },

    { 334 + NTOP_BASE, "NUM_PKTS_TTL_5_32" },

    { 335 + NTOP_BASE, "NUM_PKTS_TTL_32_64" },

    { 336 + NTOP_BASE, "NUM_PKTS_TTL_64_96" },

    { 337 + NTOP_BASE, "NUM_PKTS_TTL_96_128" },

    { 338 + NTOP_BASE, "NUM_PKTS_TTL_128_160" },

    { 339 + NTOP_BASE, "NUM_PKTS_TTL_160_192" },

    { 340 + NTOP_BASE, "NUM_PKTS_TTL_192_224" },

    { 341 + NTOP_BASE, "NUM_PKTS_TTL_224_255" },

    { 342 + NTOP_BASE, "GTPV1_RAI_LAC" },

    { 343 + NTOP_BASE, "GTPV1_RAI_RAC" },

    { 344 + NTOP_BASE, "GTPV1_ULI_MCC" },

    { 345 + NTOP_BASE, "GTPV1_ULI_MNC" },

    { 346 + NTOP_BASE, "NUM_PKTS_TTL_2_5" },

    { 347 + NTOP_BASE, "NUM_PKTS_TTL_EQ_1" },

    { 348 + NTOP_BASE, "RTP_SIP_CALL_ID" },

    { 349 + NTOP_BASE, "IN_SRC_OSI_SAP" },

    { 350 + NTOP_BASE, "OUT_DST_OSI_SAP" },

    { 351 + NTOP_BASE, "WHOIS_DAS_DOMAIN" },

    { 352 + NTOP_BASE, "DNS_TTL_ANSWER" },

    { 353 + NTOP_BASE, "DHCP_CLIENT_MAC" },

    { 354 + NTOP_BASE, "DHCP_CLIENT_IP" },

    { 355 + NTOP_BASE, "DHCP_CLIENT_NAME" },

    { 356 + NTOP_BASE, "FTP_LOGIN" },

    { 357 + NTOP_BASE, "FTP_PASSWORD" },

    { 358 + NTOP_BASE, "FTP_COMMAND" },

    { 359 + NTOP_BASE, "FTP_COMMAND_RET_CODE" },

    { 360 + NTOP_BASE, "HTTP_METHOD" },

    { 361 + NTOP_BASE, "HTTP_SITE" },

    { 362 + NTOP_BASE, "SIP_C_IP" },

    { 363 + NTOP_BASE, "SIP_CALL_STATE" },

    { 364 + NTOP_BASE, "EPP_REGISTRAR_NAME" },

    { 365 + NTOP_BASE, "EPP_CMD" },

    { 366 + NTOP_BASE, "EPP_CMD_ARGS" },

    { 367 + NTOP_BASE, "EPP_RSP_CODE" },

    { 368 + NTOP_BASE, "EPP_REASON_STR" },

    { 369 + NTOP_BASE, "EPP_SERVER_NAME" },

    { 370 + NTOP_BASE, "RTP_IN_MOS" },

    { 371 + NTOP_BASE, "RTP_IN_R_FACTOR" },

    { 372 + NTOP_BASE, "SRC_PROC_USER_NAME" },

    { 373 + NTOP_BASE, "SRC_FATHER_PROC_PID" },

    { 374 + NTOP_BASE, "SRC_FATHER_PROC_NAME" },

    { 375 + NTOP_BASE, "DST_PROC_PID" },

    { 376 + NTOP_BASE, "DST_PROC_NAME" },

    { 377 + NTOP_BASE, "DST_PROC_USER_NAME" },

    { 378 + NTOP_BASE, "DST_FATHER_PROC_PID" },

    { 379 + NTOP_BASE, "DST_FATHER_PROC_NAME" },

    { 380 + NTOP_BASE, "RTP_RTT" },

    { 381 + NTOP_BASE, "RTP_IN_TRANSIT" },

    { 382 + NTOP_BASE, "RTP_OUT_TRANSIT" },

    { 383 + NTOP_BASE, "SRC_PROC_ACTUAL_MEMORY" },

    { 384 + NTOP_BASE, "SRC_PROC_PEAK_MEMORY" },

    { 385 + NTOP_BASE, "SRC_PROC_AVERAGE_CPU_LOAD" },

    { 386 + NTOP_BASE, "SRC_PROC_NUM_PAGE_FAULTS" },

    { 387 + NTOP_BASE, "DST_PROC_ACTUAL_MEMORY" },

    { 388 + NTOP_BASE, "DST_PROC_PEAK_MEMORY" },

    { 389 + NTOP_BASE, "DST_PROC_AVERAGE_CPU_LOAD" },

    { 390 + NTOP_BASE, "DST_PROC_NUM_PAGE_FAULTS" },

    { 391 + NTOP_BASE, "DURATION_IN" },

    { 392 + NTOP_BASE, "DURATION_OUT" },

    { 393 + NTOP_BASE, "SRC_PROC_PCTG_IOWAIT" },

    { 394 + NTOP_BASE, "DST_PROC_PCTG_IOWAIT" },

    { 395 + NTOP_BASE, "RTP_DTMF_TONES" },

    { 396 + NTOP_BASE, "UNTUNNELED_IPV6_SRC_ADDR" },