This table lists the applications supported by the latest release of LogRhythm NetMon. An application can be a website that generates traffic (for example, Google or Gmail) or it can be the underlying protocol of the traffic (for example, IP or TCP).

You can perform in-depth analysis of specific application traffic in the NetMon interface. With this valuable data, you can locate suspicious data transfers, network policy violations, and advanced attacks.

Protocol NameLong Protocol NameAttribute NameFull Attribute NameAttribute TypeAttribute Description
InternalInternalsessionSessionstringSession UUID.
InternalInternalsrcmacSrcMACuint64Source MAC address.
InternalInternaldestmacDestMACuint64Destination MAC address.
InternalInternalsrcipSrcIPuint32Source IP address.
InternalInternaldestipDestIPuint32Destination IP address.
InternalInternalpacketpathPacketPathstringPacket path.
InternalInternalflowsessioncountFlowSessionCountuint32Flow Session Count.
InternalInternalsrcportSrcPortuint32Source Port.
InternalInternaldestportDestPortuint32Destination Port.
InternalInternalflowcompletedFlowCompletedboolFlow Completed flag.
InternalInternaldelayDelaystringDelay.
InternalInternalprotocolProtocoluint32Protocol.
InternalInternaltotalpacketsTotalPacketsuint64Total packets in the session.
InternalInternaltimestartTimeStartuint64Start time of the flow.
InternalInternaltimeupdatedTimeUpdateduint64Time updated.
InternalInternaldestbytesDestBytesuint64Destination bytes.
InternalInternalsrcbytesSrcBytesuint64Source bytes.
InternalInternalflowtypeFlowTypeFlowTypeFlow type.
InternalInternalpacketsdeltaPacketsDeltauint64Packets delta between update.
InternalInternaltimedeltaTimeDeltauint64Time delta between update.
InternalInternaldestbytesdeltaDestBytesDeltauint64Destination byte delta between update.
InternalInternalsrcbytesdeltaSrcBytesDeltauint64Source byte delta between update.
InternalInternalcustomapplicationCustomApplicationbytesCustom Application.
InternalInternalflowstateFlowStateFlowStateFlow State type.
InternalInternalcapturedCapturedboolCaptured flag.
InternalInternalchildflownumberChildFlowNumberuint32Child Flow number.
InternalInternaltotalbytesTotalBytesuint64Total bytes of the session.
InternalInternaltotalbytesdeltaTotalBytesDeltauint64Total bytes delta between update.
InternalInternalapplicationApplicationstringApplication.
InternalInternalapplicationpathApplicationPathstringApplication Path.
InternalInternaldurationDurationuint64Duration of the flow.
InternalInternalmessagesizeMessageSizeuint64Size of the DPI message.
InternalInternalthreadidThreadIDuint32Thread ID.
InternalInternalfieldcountFieldCountuint64Total fields in DPI message.
InternalInternaldebugmessageDebugMessagestringDebug message.
InternalInternalapplicationidApplicationIDuint32Application ID.
InternalInternaltimepreviousTimePreviousuint64Time Previous.
InternalInternalwrittenWrittenboolCapture written flag.
InternalInternalcaptureremovedCaptureRemovedboolCapture removed flag.
InternalInternalsrcip6SrcIP6uint32Source IP6 address.
InternalInternaldestip6DestIP6uint32Destination IP6 address.
InternalInternalnormalizedsyslogdataNormalizedSyslogDatastringNormalized Syslog data.
InternalInternaltimeendTimeEnduint64Time End.
InternalInternalheaderwrittenHeaderWrittenboolHeader written flag.
InternalInternalconnectionestablishedConnectionEstablishedboolConnection Established flag.
InternalInternalmaxrepeatedfieldcountMaxRepeatedFieldCountuint32Maximum number of fields indexed by ElasticSearch.
InternalInternalfieldcountindexedFieldCountIndexeduint32Field count indexed by ElasticSearch.
InternalInternalemailAttachmentsEmailAttachmentsEmailAttachEmail attachment structure.
InternalInternalcustomfieldsCustomFieldsCustomFieldCustom Fields.
InternalInternalrepeatedfieldcountRepeatedFieldCountuint64Total repeated fields in DPI message.
InternalInternalflowclassifiedFlowClassifiedboolFlow Classified.
InternalInternalvlanidVlanIDuint32VLAN ID.
InternalInternalhttpclientcontentHttpClientContentbytesHttp Client Content.
InternalInternalhttpservercontentHttpServerContentbytesHttp Server Content.
InternalInternalreplayedReplayedboolWhether the session was replayed via PCAP.
InternalInternalpcapfilenamePcapFilenamestringName of the PCAP file the session was replayed from.
InternalInternalblacklistedBlacklistedboolWhether the session has been blacklisted from further processing and storage.
InternalInternalapplicationtagsApplicationTagsstringOne or more sub-categories of a flow’s application.
InternalInternalapplicationfamilyApplicationFamilystringTop level categorization of a flow’s application.
InternalInternalnetmonhostnameNetmonHostnamestringThe Network Monitor hostname that processed the flow.
0zz00zz0.comloginloginq_proto_0zz0bytesUser's login string.
0zz00zz0.comactionactionq_proto_0zz0bytesIndicates the action executed by the user.
0zz00zz0.comfilenamefilenameq_proto_0zz0bytesName of the transferred file.
0zz00zz0.comupload_descriptionupload_descriptionq_proto_0zz0bytesDescription of the uploaded file.
0zz00zz0.comemail_addressemail_addressq_proto_0zz0bytesUser's email address.
0zz00zz0.comdownload_urldownload_urlq_proto_0zz0bytesLink of the downloaded file.
3gpp_li3GPP LIversionversionq_proto_3gpp_liuint32Version
flashplugin_updateAdobe Flash Plugin Updatenew_versionnew_versionq_proto_flashplugin_updatebytesNew version number, as returned by Adobe Web Server.
flashplugin_updateAdobe Flash Plugin Updatecurrent_versioncurrent_versionq_proto_flashplugin_updatebytesCurrent flash-plugin version number installed on the client.
adobe_updateAdobe Update Managercomponent_list_namecomponent_list_nameq_proto_adobe_updatebytesName of a piece of Adobe software we have a new version for.
adobe_updateAdobe Update Managercomponent_list_desccomponent_list_descq_proto_adobe_updatebytesShort component update description, including version number.
adobe_updateAdobe Update Managercomponent_list_versioncomponent_list_versionq_proto_adobe_updatebytesLast component version available."
adobe_updateAdobe Update Managercomponent_list_urlcomponent_list_urlq_proto_adobe_updatebytesComponent update download link."
adobe_updateAdobe Update Managerupdate_managerupdate_managerq_proto_adobe_updatebytesAdobe Update Manager version and identifier.
adobe_updateAdobe Update Managerproduct_nameproduct_nameq_proto_adobe_updatebytesUser's request for a product update.
adobe_updateAdobe Update Manageractionactionq_proto_adobe_updatebytesIndicates the action executed by the user.
amqpAdvance Message Queuing Protocolmajor_versionmajor_versionq_proto_amqpuint32Major version of the protocol used by the client.
amqpAdvance Message Queuing Protocolminor_versionminor_versionq_proto_amqpuint32Minor version of the protocol used by the client.
amqpAdvance Message Queuing Protocolresponse_timeresponse_timeq_proto_amqpstringServer response time during the connection procedure.
amqpAdvance Message Queuing Protocolexchange_typeexchange_typeq_proto_amqpbytesMode of AMQP exchange.
amqpAdvance Message Queuing Protocolrouting_keyrouting_keyq_proto_amqpbytesVirtual address used to route a message.
amqpAdvance Message Queuing Protocolcorrelation_idcorrelation_idq_proto_amqpbytesIdentifier used to correlate the application.
amqpAdvance Message Queuing Protocolreplytoreplytoq_proto_amqpbytesAddresse of the reply queue.
adcAdvanced Direct Connectfile_hashfile_hashq_proto_adcbytesHash of the transferred file.
adcAdvanced Direct Connectfilenamefilenameq_proto_adcbytesName of the transferred file.
adcAdvanced Direct Connectclient_versionclient_versionq_proto_adcbytesName and version of the client used by the peer.
adcAdvanced Direct Connectqueryqueryq_proto_adcbytesQuery sent to find a file.
adcAdvanced Direct Connectcommand_codecommand_codeq_proto_adcbytesMessage action, as extracted from the three letters following the message type.
aim_expressAIM expressloginloginq_proto_aim_expressbytesUser's login string.
aim_expressAIM expressmessagemessageq_proto_aim_expressbytesContains the chat message.
aim_expressAIM expresssendersenderq_proto_aim_expressbytesContains the identity of the sender of a chat session or a file transfer.
aim_expressAIM expressreceiverreceiverq_proto_aim_expressbytesContains the identity of the receiver for a chat message or a file transfer.
aim_expressAIM expresschat_idchat_idq_proto_aim_expressbytesWindow chat id.
aim_expressAIM expressversionversionq_proto_aim_expressbytesClient version.
aim_expressAIM expresscontact_logincontact_loginq_proto_aim_expressbytesContact login.
aim_expressAIM expresscontact_statuscontact_statusq_proto_aim_expressbytesContact status.
aim_expressAIM expressclient_statusclient_statusq_proto_aim_expressbytesStatus of connected user.
aim_transferAIM Transferfilenamefilenameq_proto_aim_transferbytesName of the transferred file.
aim_transferAIM Transferfilename_encodingfilename_encodingq_proto_aim_transferbytesEncoding of the transferred file name.
aim_transferAIM Transferfilesizefilesizeq_proto_aim_transferuint32Size (byte) of the transferred file.
aimAOL Instant Messenger (formerly OSCAR)loginloginq_proto_aimbytesUser's login string.
aimAOL Instant Messenger (formerly OSCAR)channelchannelq_proto_aimbytesChat room name.
aimAOL Instant Messenger (formerly OSCAR)messagemessageq_proto_aimbytesContains the chat message.
aimAOL Instant Messenger (formerly OSCAR)sendersenderq_proto_aimbytesContains the identity of the sender of a chat session or a file transfer.
aimAOL Instant Messenger (formerly OSCAR)receiverreceiverq_proto_aimbytesContains the identity of the receiver for a chat message or a file transfer.
aimAOL Instant Messenger (formerly OSCAR)user_emailuser_emailq_proto_aimbytesEmail Address of an AIN user.
aimAOL Instant Messenger (formerly OSCAR)user_agentuser_agentq_proto_aimbytesName of the software used.
aimAOL Instant Messenger (formerly OSCAR)client_statusclient_statusq_proto_aimbytesStatus of connected user.
aimAOL Instant Messenger (formerly OSCAR)serviceserviceq_proto_aimbytesCurrent service identification string.
aimAOL Instant Messenger (formerly OSCAR)filenamefilenameq_proto_aimbytesName of the transferred file.
aimAOL Instant Messenger (formerly OSCAR)filename_encodingfilename_encodingq_proto_aimbytesEncoding of the transferred file name.
aimAOL Instant Messenger (formerly OSCAR)filesizefilesizeq_proto_aimuint32Size (byte) of the transferred file.
aimAOL Instant Messenger (formerly OSCAR)versionversionq_proto_aimbytesAIM software version.
aimAOL Instant Messenger (formerly OSCAR)file_senderfile_senderq_proto_aimbytesContains the identity of the sender of a file transfer.
aimAOL Instant Messenger (formerly OSCAR)file_receiverfile_receiverq_proto_aimbytesContains the identity of the receiver for a file transfer.
aimAOL Instant Messenger (formerly OSCAR)contact_logincontact_loginq_proto_aimbytesContact login.
aimAOL Instant Messenger (formerly OSCAR)contact_statuscontact_statusq_proto_aimbytesContact status.
aimAOL Instant Messenger (formerly OSCAR)icon_buddyicon_buddyq_proto_aimbytesThe contact whose icon was downloaded.
aimAOL Instant Messenger (formerly OSCAR)internal_ip_addressinternal_ip_addressq_proto_aimstringInternal IP address of the contact.
aimAOL Instant Messenger (formerly OSCAR)external_ip_addressexternal_ip_addressq_proto_aimstringExternal IP address of the contact.
aimAOL Instant Messenger (formerly OSCAR)message_rawmessage_rawq_proto_aimbytesMessage raw value.
appstoreApple App Storedevice_typedevice_typeq_proto_appstorebytesTarget device (iPhone, iPod,...).
appstoreApple App Storeapplication_nameapplication_nameq_proto_appstorebytesName of the downloaded app.
facetimeApple FaceTimeservice_durationservice_durationq_proto_facetimeuint324 bytes integer value indicating, when the service is ended, the duration of it in seconds
facetimeApple FaceTimeservice_idservice_idq_proto_facetimeuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
facetimeApple FaceTimeserviceserviceq_proto_facetimebytesCurrent service identification string.
facetimeApple FaceTimeservice_duration_tvservice_duration_tvq_proto_facetimestringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
facetimeApple FaceTimeservice_statsservice_statsq_proto_facetimebytesComposite attribute containing the packet metrics used for each new service type detection, extracting when performing STATISTICAL detection method only. Note: this attribute won't be extracted in case of session expiration (eg. when the current service is not ended properly by the user).
afpApple Filing Protocolfilenamefilenameq_proto_afpbytesName of the transferred file.
afpApple Filing Protocolfile_chunk_lenfile_chunk_lenq_proto_afpuint64Size of the transferred piece.
afpApple Filing Protocolfile_chunk_data_offsetfile_chunk_data_offsetq_proto_afpuint64Offset of the transferred data.
apple_updateApple Updatepkg_namepkg_nameq_proto_apple_updatebytespkg_name (package name) is the name of the software being updated.
archiveArchive.orgloginloginq_proto_archivebytesUser's login string.
archiveArchive.orgquery_textquery_textq_proto_archivebytesQuery sent to the search engine.
archiveArchive.orgactionactionq_proto_archivebytesIndicates the action executed by the user.
archiveArchive.orgfilenamefilenameq_proto_archivebytesName of the transferred file.
archiveArchive.orgsubjectsubjectq_proto_archivebytesFile subject.
aresAresnicknamenicknameq_proto_aresbytesContains the user identity of the Ares connection.
aresAresqueryqueryq_proto_aresbytesQuery sent to find a file.
aresAresfile_hashfile_hashq_proto_aresbytesHash of the transferred file.
aresArespeer_infopeer_infoq_proto_aresuint32Structure containing a classification prediction of a network peer. The clep_peer_t structure (ixE 4.18.x) provides the IP v4 or v6 address (ul3l4_addr_t), the transport protocol ID (TCP/UDP/etc.), the listening port, and the list of protocols to be classified in case of successful prediction.
badongoBadongo.comloginloginq_proto_badongobytesUser's login string.
badongoBadongo.comactionactionq_proto_badongobytesIndicates the action executed by the user.
badongoBadongo.comfilenamefilenameq_proto_badongobytesName of the transferred file.
badongoBadongo.comupload_descriptionupload_descriptionq_proto_badongobytesDescription of the uploaded file.
badooBadoo.comloginloginq_proto_badoobytesUser's login string.
badooBadoo.comsendersenderq_proto_badoobytesContains the identity of the sender of a chat session or a file transfer.
badooBadoo.comreceiverreceiverq_proto_badoobytesContains the identity of the receiver for a chat message or a file transfer.
badooBadoo.commessagemessageq_proto_badoobytesContains the chat message.
badooBadoo.comcontact_logincontact_loginq_proto_badoobytesContact login.
baiduBaidu.comquery_textquery_textq_proto_baidubytesQuery sent to the search engine.
baiduBaidu.comquery_rawquery_rawq_proto_baidubytesContains the query sent to the search engine as indicated in the URL.
beboBebo.comloginloginq_proto_bebobytesUser's login string.
bingBing.com (formerly MSN Search)query_rawquery_rawq_proto_bingbytesContains the query sent to the search engine as indicated in the URL.
bingBing.com (formerly MSN Search)query_textquery_textq_proto_bingbytesQuery sent to the search engine.
bittorrentBitTorrenttrackertrackerq_proto_bittorrentbytesBitTorrent tracker URL.
bittorrentBitTorrentuser_agentuser_agentq_proto_bittorrentbytesName of the software used.
bittorrentBitTorrentclient_versionclient_versionq_proto_bittorrentbytesVersion of the software.
bittorrentBitTorrentcanceled_chunk_numbercanceled_chunk_numberq_proto_bittorrentuint32Number of the canceled piece.
bittorrentBitTorrentcanceled_chunk_lengthcanceled_chunk_lengthq_proto_bittorrentuint32Size of the canceled piece.
bittorrentBitTorrentcanceled_chunk_data_offsetcanceled_chunk_data_offsetq_proto_bittorrentuint32Offset of the canceled data.
bittorrentBitTorrentfile_chunk_numberfile_chunk_numberq_proto_bittorrentuint32Number of the transferred piece.
bittorrentBitTorrentfile_chunk_lenfile_chunk_lenq_proto_bittorrentuint32Size of the transferred piece.
bittorrentBitTorrentfile_chunk_data_offsetfile_chunk_data_offsetq_proto_bittorrentuint32Offset of the transferred data.
bittorrentBitTorrenttorrent_filenametorrent_filenameq_proto_bittorrentbytesName of the torrent file.
bittorrentBitTorrentpiece_lengthpiece_lengthq_proto_bittorrentuint32Chunk size, for the specified file.
bittorrentBitTorrentfilenamefilenameq_proto_bittorrentbytesName of the transferred file.
bittorrentBitTorrentfilesizefilesizeq_proto_bittorrentuint32Size (byte) of the transferred file.
bittorrentBitTorrentpeer_share_ippeer_share_ipq_proto_bittorrentstringIP address used by a peer to share his files.
bittorrentBitTorrentpeer_share_idpeer_share_idq_proto_bittorrentbytesID used by a peer to share his files.
bittorrentBitTorrentfile_completedfile_completedq_proto_bittorrentbytesCompleted file.
bittorrentBitTorrentfile_downloadedfile_downloadedq_proto_bittorrentbytesDownloaded file.
bittorrentBitTorrentfile_incompletefile_incompleteq_proto_bittorrentbytesIncomplete file.
bittorrentBitTorrentfile_leftfile_leftq_proto_bittorrentbytesLeft file.
bittorrentBitTorrentfile_uploadedfile_uploadedq_proto_bittorrentbytesUploaded file.
bittorrentBitTorrentclassification_typeclassification_typeq_proto_bittorrentbytesHow the protocol has been classified. Always returns Deterministic" if the port list has not been set."
bittorrentBitTorrentpeer_infopeer_infoq_proto_bittorrentuint32Structure containing a classification prediction of a network peer. The clep_peer_t structure (ixE 4.18.x) provides the IP v4 or v6 address (ul3l4_addr_t), the transport protocol ID (TCP/UDP/etc.), the listening port, and the list of protocols to be classified in case of successful prediction.
bgpBorder Gateway Protocolidentifieridentifierq_proto_bgpstringBGP Identifier of the sender
bgpBorder Gateway Protocolpath_attr_value_local_prefpath_attr_value_local_prefq_proto_bgpuint32Local preference value
bgpBorder Gateway Protocolpath_attr_value_as_numpath_attr_value_as_numq_proto_bgpuint32As number
bgpBorder Gateway Protocolpath_attr_value_next_hop_ippath_attr_value_next_hop_ipq_proto_bgpstringIP address of the next hop
bgpBorder Gateway Protocolwithdrawn_prefixwithdrawn_prefixq_proto_bgpstringContains Ip addresses Prefixes
bgpBorder Gateway Protocolnlri_prefixnlri_prefixq_proto_bgpstringContains IP addresses prefix
bssapBSS Application Parttimestamptimestampq_proto_bssapstringMessage timestamp
bssapBSS Application Partvalidity_periodvalidity_periodq_proto_bssapbytesValidity period for the message
bssapBSS Application Partimsi_receiverimsi_receiverq_proto_bssapbytesInternational Mobile Subscriber Identity of the receiver
bssapBSS Application Partimei_receiverimei_receiverq_proto_bssapbytesInternational Mobile Equipment Identity of the receiver
bssapBSS Application Partmsisdn_receivermsisdn_receiverq_proto_bssapbytesMobile Subscriber Integrated Services Digital Network Number of the receiver
bssapBSS Application Partimsi_senderimsi_senderq_proto_bssapbytesInternational Mobile Subscriber Identity of the sender
bssapBSS Application Partimei_senderimei_senderq_proto_bssapbytesInternational Mobile Equipment Identity of the sender
bssapBSS Application Partmsisdn_sendermsisdn_senderq_proto_bssapbytesMobile Subscriber Integrated Services Digital Network Number of the sender
chapChallenge Handshake Authentication Protocolchallenge_namechallenge_nameq_proto_chapbytesHostname of the peer initiating the authentication process.
chapChallenge Handshake Authentication Protocolresponse_nameresponse_nameq_proto_chapbytesHostname of the peer responding to challenge.
chapChallenge Handshake Authentication Protocolmessage_typemessage_typeq_proto_chapbytesType of message sent.
chrome_updateChrome Updatenew_versionnew_versionq_proto_chrome_updatebytesNew version number returned by the server.
chrome_updateChrome Updatecurrent_versioncurrent_versionq_proto_chrome_updatebytesCurrent version installed on the host.
chrome_updateChrome Updateplugin_idplugin_idq_proto_chrome_updatebytesPlugin Id for the updated plugin.
chrome_updateChrome Updateplugin_new_versionplugin_new_versionq_proto_chrome_updatebytesNew version number returned by the server for the plugin.
chrome_updateChrome Updateplugin_current_versionplugin_current_versionq_proto_chrome_updatebytesPlugin version number currently installed.
cipCommon Industrial Protocolvendor_idvendor_idq_proto_cipuint32Value indentifying the Vendor.
cipCommon Industrial Protocolekey_vendor_idekey_vendor_idq_proto_cipuint32Value indentifying the Vendor in the Electronic Key.
cipCommon Industrial Protocolekey_device_typeekey_device_typeq_proto_cipuint32Value indicating the device Type in the Electronic Key.
cipCommon Industrial Protocolrequest_path_sizerequest_path_sizeq_proto_cipuint32The number of 16 bit words in the Request_Path field.
cipCommon Industrial Protocolattr_vendor_idattr_vendor_idq_proto_cipuint32The vendor ID is a unique number assigned to the various vendors of products.
cipCommon Industrial Protocolattr_device_typeattr_device_typeq_proto_cipuint32Identifies the device profile that a particular product is using.
cipCommon Industrial Protocolattr_product_codeattr_product_codeq_proto_cipuint32Identifies a particular product within a device type of an individual vendor.
cipCommon Industrial Protocolattr_statusattr_statusq_proto_cipuint32Represents the current status of the entire device.
cipCommon Industrial Protocolattr_serial_numberattr_serial_numberq_proto_cipuint32Number used in conjunction with the Vendor ID to form a unique identifier for each device on any CIP network.
cipCommon Industrial Protocolattr_product_nameattr_product_nameq_proto_cipbytesShort description of the product/product family represented by the product code. The same product code may have a variety of product name.
cipCommon Industrial Protocolnumber_of_servicesnumber_of_servicesq_proto_cipuint32Returns the number of services contained whithin CIP message (request and reply).
cipCommon Industrial Protocolattr_ccvattr_ccvq_proto_cipuint32Value modified each time any nonvolatile attribute is altered. It can be a CRC or a counter for instance. The presence of this attibute among the indentity attributes is optional.
cipCommon Industrial Protocolpath_logical_seg_class_valuepath_logical_seg_class_valueq_proto_cipuint32Defines Class type of the logical segment (lower byte first).
cupsCommon Unix Printer Systemprinterprinterq_proto_cupsbytesURI addressing the CUPS printer.
cupsCommon Unix Printer Systemlocationlocationq_proto_cupsbytesLocation of the Printer.
cupsCommon Unix Printer Systeminformationinformationq_proto_cupsbytesInformation on Printer.
cupsCommon Unix Printer Systemmodelmodelq_proto_cupsbytesPrinter model.
prontoCommuniGate Pronto!msg_idmsg_idq_proto_prontobytesIdentifier of the message.
prontoCommuniGate Pronto!msglist_receivermsglist_receiverq_proto_prontobytesFull address of email receiver in a message list.
prontoCommuniGate Pronto!msglist_receiver_emailmsglist_receiver_emailq_proto_prontobytesEmail address of the email receiver.
prontoCommuniGate Pronto!msglist_receiver_aliasmsglist_receiver_aliasq_proto_prontobytesName of email receiver.
prontoCommuniGate Pronto!client_statusclient_statusq_proto_prontobytesStatus of connected user.
prontoCommuniGate Pronto!messagemessageq_proto_prontobytesContains the chat message.
prontoCommuniGate Pronto!importanceimportanceq_proto_prontouint32Indicates if the email has been marked by the user.
prontoCommuniGate Pronto!datedateq_proto_prontobytesMessage sending date. Can be extracted on different format depending on the platform (RFC1123 pattern on mobile platform, ISO format for Windows application and webmail).
prontoCommuniGate Pronto!sender_emailsender_emailq_proto_prontobytesEmail address of the email sender.
prontoCommuniGate Pronto!sender_aliassender_aliasq_proto_prontobytesName of the email sender.
prontoCommuniGate Pronto!msglist_datemsglist_dateq_proto_prontobytesMessage date in a message list. Can be extracted on different format depending on the platform.
prontoCommuniGate Pronto!msglist_subjectmsglist_subjectq_proto_prontobytesMessage subject in a message list.
prontoCommuniGate Pronto!msglist_sendermsglist_senderq_proto_prontobytesFull address of email sender (alias followed by email address).
prontoCommuniGate Pronto!draftdraftq_proto_prontouint32Indicates if the email is a draft or has really been posted
prontoCommuniGate Pronto!attach_idattach_idq_proto_prontobytesAttachment identifier.
prontoCommuniGate Pronto!session_idsession_idq_proto_prontobytesUniquely identifies the current user session.
prontoCommuniGate Pronto!codec_namecodec_nameq_proto_prontobytesName of the codec.
prontoCommuniGate Pronto!codec_idcodec_idq_proto_prontouint32Number identifying the codec.
prontoCommuniGate Pronto!media_portmedia_portq_proto_prontouint32The mentioned UDP port number to be used.
prontoCommuniGate Pronto!media_addressmedia_addressq_proto_prontostringThe mentioned IPv4 address to be used.
prontoCommuniGate Pronto!media_protomedia_protoq_proto_prontobytesProtocol used in client stream.
prontoCommuniGate Pronto!media_typemedia_typeq_proto_prontobytesContains the media type.
prontoCommuniGate Pronto!callercallerq_proto_prontobytesContains the identity (or the phone number) of the initiator of the call.
prontoCommuniGate Pronto!calleecalleeq_proto_prontobytesContains the identity (or the phone number) of the called party for a call.
prontoCommuniGate Pronto!call_idcall_idq_proto_prontobytesCall id, extracted for each call.
prontoCommuniGate Pronto!versionversionq_proto_prontobytesServer version number.
prontoCommuniGate Pronto!msglist_foldermsglist_folderq_proto_prontobytesIndicates the directory from a message list.
prontoCommuniGate Pronto!chat_attach_urlchat_attach_urlq_proto_prontobytesTODO
prontoCommuniGate Pronto!chat_attachchat_attachq_proto_prontobytesTODO
prontoCommuniGate Pronto!chat_datechat_dateq_proto_prontobytesMessage sending date on ISO format.
prontoCommuniGate Pronto!chat_receiverchat_receiverq_proto_prontobytesContains the identity of the receiver for a chat message.
prontoCommuniGate Pronto!chat_senderchat_senderq_proto_prontobytesContains the identity of the sender of a chat message.
prontoCommuniGate Pronto!folderfolderq_proto_prontobytesIndicates the directory from where messages are read.
prontoCommuniGate Pronto!attach_typeattach_typeq_proto_prontobytesContent type of the sent attached file.
prontoCommuniGate Pronto!attach_filenameattach_filenameq_proto_prontobytesAttachment name.
prontoCommuniGate Pronto!subjectsubjectq_proto_prontobytesMessage subject.
prontoCommuniGate Pronto!sendersenderq_proto_prontobytesContains the identity of the sender of a chat session or a file transfer.
prontoCommuniGate Pronto!receiver_typereceiver_typeq_proto_prontobytesType of the email receiver.
prontoCommuniGate Pronto!receiver_emailreceiver_emailq_proto_prontobytesEmail address of message receiver (included cc and bcc receivers).
prontoCommuniGate Pronto!receiver_aliasreceiver_aliasq_proto_prontobytesName of email receiver (included cc and bcc receivers).
prontoCommuniGate Pronto!receiverreceiverq_proto_prontobytesFull address of email receiver (including cc and bcc receivers).
capwapControl And Provisioning of Wireless Access Pointsbssidbssidq_proto_capwapstringEUI-48 MAC address of the radio receiving the packet.
capwapControl And Provisioning of Wireless Access Pointsbssid_64bssid_64q_proto_capwapuint64EUI-64 MAC address of the radio receiving the packet.
dailymotionDailymotion.comloginloginq_proto_dailymotionbytesUser's login string.
dailymotionDailymotion.comemailemailq_proto_dailymotionbytesParent entry, for fields belonging to the same email.
dailymotionDailymotion.comquery_textquery_textq_proto_dailymotionbytesQuery sent to the search engine.
dailymotionDailymotion.comquery_rawquery_rawq_proto_dailymotionbytesContains the query sent to the search engine as indicated in the URL.
dtlsDatagram Transport Layer Securityserver_nameserver_nameq_proto_dtlsbytesDomain name mentioned in Client Hello message.
dtlsDatagram Transport Layer Securitycommon_namecommon_nameq_proto_dtlsbytesDomain name mentioned in the certificate.
dtlsDatagram Transport Layer Securitysubject_alt_namesubject_alt_nameq_proto_dtlsbytesIdentifies a list of host names which belong to the same certificate.
dtlsDatagram Transport Layer Securitycertificate_issuer_cncertificate_issuer_cnq_proto_dtlsbytesCommon name of the subject formatted according to RFC 1779.
debian_updateDebian/Ubuntu Updatepackage_versionpackage_versionq_proto_debian_updatebytesRepository packet version.
debian_updateDebian/Ubuntu Updatepackage_namepackage_nameq_proto_debian_updatebytesDebian packet name.
diameterDiameterframed_ipframed_ipq_proto_diameterbytesIP address.
diameterDiameteracct_record_numberacct_record_numberq_proto_diameteruint32Unique identifier for one record within a session
diameterDiameteracct_record_typeacct_record_typeq_proto_diameteruint32Record type
diameterDiameteracct_output_octetsacct_output_octetsq_proto_diameteruint64Indicates how many octets have been sent to the port in the course of delivering this service
diameterDiameteracct_input_octetsacct_input_octetsq_proto_diameteruint64Indicates how many octets have been received from the port over the course of this service being provided
diameterDiameteracct_sub_session_idacct_sub_session_idq_proto_diameteruint64Sub-session identifier
diameterDiameteracct_multi_session_idacct_multi_session_idq_proto_diameterbytesLink between multiple accounting sessions
diameterDiameteracct_session_idacct_session_idq_proto_diameterbytesAccounting session ID.
diameterDiameterterminate_causeterminate_causeq_proto_diameteruint32This attribute indicates how the session was terminated
diameterDiameterdestination_hostdestination_hostq_proto_diameterbytesDestination Diameter host for the current message
diameterDiameterauth_request_typeauth_request_typeq_proto_diameteruint32Requested authentication type
diameterDiameterresult_coderesult_codeq_proto_diameteruint32Indicates whether a particular Diameter request was completed successfully not
diameterDiameterorigin_hostorigin_hostq_proto_diameterbytesSource Diameter host for the current message
diameterDiametersession_idsession_idq_proto_diameterbytesUniquely identifies the current user session.
diameterDiametercalling_station_idcalling_station_idq_proto_diameterbytesClient id.
diameterDiametercalled_station_idcalled_station_idq_proto_diameterbytesThe phone number that the user called, using Dialed Number Identification (DNIS) or similar technology.
diameterDiameternas_portnas_portq_proto_diameteruint32Physical port number of the user on the NAS
diameterDiameternas_port_typenas_port_typeq_proto_diameteruint32Indicates the type of the physical port of the NAS that is authenticating the user.
diameterDiameternas_port_idnas_port_idq_proto_diameterbytesIndicates the physical port number of the NAS that is authenticating the user.
diameterDiameternas_ipnas_ipq_proto_diameterbytesIP address of the NAS originating the Access-Request
diameterDiameternas_idnas_idq_proto_diameterbytesUnique identifier of the NAS originating the Access-Request
diameterDiameterloginloginq_proto_diameterbytesUser's login string.
diameterDiameterend_to_end_idend_to_end_idq_proto_diameteruint32Used to detect duplicate messages
diameterDiameterhop_by_hop_idhop_by_hop_idq_proto_diameteruint32Used to match Diameter request and reply messages
diameterDiameterapplication_idapplication_idq_proto_diameteruint32Identify which application the message is applicable for
diameterDiametercommand_codecommand_codeq_proto_diameteruint32Command associated with the Diameter request
diameterDiameterprocessing_anomaly_attrprocessing_anomaly_attrq_proto_diameteruint32Gives an attribute ID, or an attribute structure (parent attribute ID), not extracted because of the anomaly.
diameterDiameterprocessing_anomaly_typeprocessing_anomaly_typeq_proto_diameterbytesDefines the category of the anomaly.
diameterDiameteravp_codeavp_codeq_proto_diameteruint32AVP code (cf. IANA).
dicomDICOMpdu_data_pdv_lenpdu_data_pdv_lenq_proto_dicomuint32Length of data contained in a PDV.
dicomDICOMpdu_data_pdv_elem_tag_gnpdu_data_pdv_elem_tag_gnq_proto_dicomuint32The Tag of an Element describes the nature of data. This attribute is the Group Number part of the tag, basically first 16 bits, see section 7.1.1 Data Element Fields in part dicom_vr_part05.pdf.
dicomDICOMpdu_data_pdv_elem_tag_enpdu_data_pdv_elem_tag_enq_proto_dicomuint32The Tag of an Element describes the nature of data. This attribute is the Element Number part of the tag, basically second 16 bits, see section 7.1.1 Data Element Fields in part dicom_vr_part05.pdf.
dicomDICOMpdu_data_pdv_elem_tag_rawpdu_data_pdv_elem_tag_rawq_proto_dicomuint32The Tag of an Element describes the nature of data. This attribute is the raw value of the TAG including the Group Number and Element Number.
dicomDICOMpdu_data_pdv_elem_keywordpdu_data_pdv_elem_keywordq_proto_dicombytesTranslation of the Tag in human readable format as described in dicom_pdv_part07.pdf.
dicomDICOMpdu_data_pdv_elem_vrpdu_data_pdv_elem_vrq_proto_dicombytesVR (Value Representation) of the Elememt.
dicomDICOMpdu_data_pdv_elem_lenpdu_data_pdv_elem_lenq_proto_dicomuint32Length of the Element
dicomDICOMpdu_data_pdv_elem_val_aepdu_data_pdv_elem_val_aeq_proto_dicombytesValue Representation for Application Entity (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_aspdu_data_pdv_elem_val_asq_proto_dicombytesValue Representation for Age String (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_cspdu_data_pdv_elem_val_csq_proto_dicombytesValue Representation for Code String (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_dapdu_data_pdv_elem_val_daq_proto_dicombytesValue Representation for Date (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_dspdu_data_pdv_elem_val_dsq_proto_dicombytesValue Representation for Decimal String (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_dtpdu_data_pdv_elem_val_dtq_proto_dicombytesValue Representation for Date Time (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_ispdu_data_pdv_elem_val_isq_proto_dicombytesValue Representation for Integer String (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_lopdu_data_pdv_elem_val_loq_proto_dicombytesValue Representation for Long String (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_ltpdu_data_pdv_elem_val_ltq_proto_dicombytesValue Representation for Long Text (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_pnpdu_data_pdv_elem_val_pnq_proto_dicombytesValue Representation for Person Name (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_shpdu_data_pdv_elem_val_shq_proto_dicombytesValue Representation for Short String (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_sspdu_data_pdv_elem_val_ssq_proto_dicomuint32Value Representation for Signed Short (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as signed short.
dicomDICOMpdu_data_pdv_elem_val_stpdu_data_pdv_elem_val_stq_proto_dicombytesValue Representation for Short Text (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_tmpdu_data_pdv_elem_val_tmq_proto_dicombytesValue Representation for Time (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_ucpdu_data_pdv_elem_val_ucq_proto_dicombytesValue Representation for Unlimited Characters (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_uipdu_data_pdv_elem_val_uiq_proto_dicombytesValue Representation for Unique Identifier (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_ulpdu_data_pdv_elem_val_ulq_proto_dicomuint32Value Representation for Unsigned Long (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as unsigned long.
dicomDICOMpdu_data_pdv_elem_val_urpdu_data_pdv_elem_val_urq_proto_dicombytesValue Representation for Universal Resource (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
dicomDICOMpdu_data_pdv_elem_val_uspdu_data_pdv_elem_val_usq_proto_dicomuint32Value Representation for Unsigned Short (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as unsigned short.
dicomDICOMpdu_data_pdv_elem_val_utpdu_data_pdv_elem_val_utq_proto_dicombytesValue Representation for Unlimited Text (dicom_vr_part05.pdf). Attribute with this VR is expected to be displayed as string.
directconnectDirectConnect (NMDC)loginloginq_proto_directconnectbytesUser's login string.
directconnectDirectConnect (NMDC)queryqueryq_proto_directconnectbytesQuery sent to find a file.
directconnectDirectConnect (NMDC)query_wayquery_wayq_proto_directconnectbytesWay of the query.
directconnectDirectConnect (NMDC)sr_filenamesr_filenameq_proto_directconnectbytesThe name of a file returned by a search query.
directconnectDirectConnect (NMDC)sr_filesizesr_filesizeq_proto_directconnectbytesThe size of a file returned by a search query.
directconnectDirectConnect (NMDC)sr_filehashsr_filehashq_proto_directconnectbytesThe hash of a file returned by a search query.
directconnectDirectConnect (NMDC)file_hashfile_hashq_proto_directconnectbytesHash of the transferred file.
directconnectDirectConnect (NMDC)file_is_compressedfile_is_compressedq_proto_directconnectuint32Tells whether a file is compressed or not.
directconnectDirectConnect (NMDC)file_compression_typefile_compression_typeq_proto_directconnectbytesTells the compression type.
directconnectDirectConnect (NMDC)file_chunk_data_offsetfile_chunk_data_offsetq_proto_directconnectuint32Offset of the transferred data.
directconnectDirectConnect (NMDC)file_chunk_lenfile_chunk_lenq_proto_directconnectuint32Size of the transferred piece.
directconnectDirectConnect (NMDC)peer_infopeer_infoq_proto_directconnectuint32Structure containing a classification prediction of a network peer. The clep_peer_t structure (ixE 4.18.x) provides the IP v4 or v6 address (ul3l4_addr_t), the transport protocol ID (TCP/UDP/etc.), the listening port, and the list of protocols to be classified in case of successful prediction.
dcerpcDistributed Computing Environment - Remote Procedure Callserviceserviceq_proto_dcerpcbytesCurrent service identification string.
dcerpcDistributed Computing Environment - Remote Procedure Callinterface_uuidinterface_uuidq_proto_dcerpcbytesID of the interface.
dcerpcDistributed Computing Environment - Remote Procedure Callcall_idcall_idq_proto_dcerpcuint32ID of the call.
dcerpcDistributed Computing Environment - Remote Procedure Callntlm_domainntlm_domainq_proto_dcerpcbytesDomain" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
dcerpcDistributed Computing Environment - Remote Procedure Callntlm_userntlm_userq_proto_dcerpcbytesUser" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
dcerpcDistributed Computing Environment - Remote Procedure Callntlm_workstationntlm_workstationq_proto_dcerpcbytesWorkstation" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
dcerpcDistributed Computing Environment - Remote Procedure Callntlm_identifierntlm_identifierq_proto_dcerpcbytesNTLM protocol Signature (null-terminated string).
dcerpcDistributed Computing Environment - Remote Procedure Callntlm_message_typentlm_message_typeq_proto_dcerpcuint32NTLM message type.
dcerpcDistributed Computing Environment - Remote Procedure Calllengthlengthq_proto_dcerpcuint32Packet length. (only when over UDP)
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_address_string_binding_tower_idorpc_address_string_binding_tower_idq_proto_dcerpcuint32A numeric value that uniquely identifies an RPC transport protocol.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_major_versionorpc_major_versionq_proto_dcerpcuint32DCOM Remote Protocol major version.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_minor_versionorpc_minor_versionq_proto_dcerpcuint32DCOM Remote Protocol minor version.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_stdobjref_oxidorpc_stdobjref_oxidq_proto_dcerpcuint64object exporter identifier (OXID): A 64-bit number that uniquely identifies an object exporter within an object server provided by a STANDARD OBJREF (STDOBJREF). This attribute is only extracted for these <UUID, opnum> couples: <00000143-0000-0000-c000-000000000046, 3>, <000001a0-0000-0000-c000-000000000046, 4>.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_stdobjref_oidorpc_stdobjref_oidq_proto_dcerpcuint64A 64-bit number that uniquely identifies an object server provided by a STANDARD OBJREF (STDOBJREF). This attribute is only extracted for these <UUID, opnum> couples: <00000143-0000-0000-c000-000000000046, 3>, <000001a0-0000-0000-c000-000000000046, 4>.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_stdobjref_ipidorpc_stdobjref_ipidq_proto_dcerpcbytesA 128-bit number that uniquely identifies an interface on an object within an object exporter, provided by a STANDARD OBJREF (STDOBJREF)). This attribute is only extracted for these <UUID, opnum> couples: <00000143-0000-0000-c000-000000000046, 3>, <000001a0-0000-0000-c000-000000000046, 4>.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_objref_custom_clsidorpc_objref_custom_clsidq_proto_dcerpcbytesThe CLSID type specifies a CLSID for a GUID that identifies an object class, this attribute is extracted from a OBJREF_CUSTOM.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_objref_iidorpc_objref_iidq_proto_dcerpcbytesA 64-bit attribute which specifies the IID of the COM interface pointed to by an interface pointer.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_cidorpc_cidq_proto_dcerpcbytesA UUID that is passed as part of an ORPC call to identify a chain of calls that are causally related.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_objref_custom_act_prop_in_info_obj_clsidorpc_objref_custom_act_prop_in_info_obj_clsidq_proto_dcerpcbytesClass ID (UUID) of the remotely instantiated object by the client in string format.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_objref_custom_act_prop_in_info_itf_countorpc_objref_custom_act_prop_in_info_itf_countq_proto_dcerpcuint32Number of interfaces UUID listed to access instantiated object.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_objref_custom_act_prop_in_info_itf_idorpc_objref_custom_act_prop_in_info_itf_idq_proto_dcerpcbytesInterface UUID of an instantiated object in string format.
dcerpcDistributed Computing Environment - Remote Procedure Callitem_context_iditem_context_idq_proto_dcerpcuint32Index of the current context item
dcerpcDistributed Computing Environment - Remote Procedure Callabstract_itf_uuidabstract_itf_uuidq_proto_dcerpcbytesInterface UUID allowing to identify RPC interface to call.
dcerpcDistributed Computing Environment - Remote Procedure Callabstract_itf_versionabstract_itf_versionq_proto_dcerpcuint32Version number of interface to call. It is defined on 32 bits.
dcerpcDistributed Computing Environment - Remote Procedure Calltransfer_itf_uuidtransfer_itf_uuidq_proto_dcerpcbytesInterface UUID allowing to identify RPC interface to get reply.
dcerpcDistributed Computing Environment - Remote Procedure Calltransfer_itf_versiontransfer_itf_versionq_proto_dcerpcuint32Version number of interface to get reply. It is defined on 32 bits.
dcerpcDistributed Computing Environment - Remote Procedure Callresult_ack_resultresult_ack_resultq_proto_dcerpcuint32Negociation result of the given presentation transfer syntax (0 stands for Acceptance).
dcerpcDistributed Computing Environment - Remote Procedure Callresult_ack_reasonresult_ack_reasonq_proto_dcerpcuint32Reason detailing non acceptance of the given transfer syntax, usually set to 0 when transfer syntax is accepted (Q_DCERPC_RESULT_ACK == 0)
dcerpcDistributed Computing Environment - Remote Procedure Callresult_transfer_syntax_uuidresult_transfer_syntax_uuidq_proto_dcerpcbytesUUID of selected transfer syntax, 0 stands for transfer syntax is not selected"."
dcerpcDistributed Computing Environment - Remote Procedure Callresult_transfer_syntax_versionresult_transfer_syntax_versionq_proto_dcerpcuint32Version of selected transfer syntax, usually also set to 0 when UUID is 0.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_address_security_binding_sec_providerorpc_address_security_binding_sec_providerq_proto_dcerpcuint32Defines type of security provider, known values defined at 'https://docs.microsoft.com/en-us/windows/desktop/com/com-authentication-service-constants', 'https://msdn.microsoft.com/en-us/library/cc243578.aspx'.
dcerpcDistributed Computing Environment - Remote Procedure Callorpc_address_security_binding_princ_nameorpc_address_security_binding_princ_nameq_proto_dcerpcbytesDefines the service name used by client for authentication, this attribute is a null-terminated Unicode string and it is optional. This field not present if security provider is RPC_C_AUTHN_NONE (see https://msdn.microsoft.com/en-us/library/cc226839.aspx).
dcerpcDistributed Computing Environment - Remote Procedure Callac_item_context_idac_item_context_idq_proto_dcerpcuint32Index of the current context item.
dcerpcDistributed Computing Environment - Remote Procedure Callac_abstract_itf_uuidac_abstract_itf_uuidq_proto_dcerpcbytesInterface UUID allowing to identify RPC interface to call.
dcerpcDistributed Computing Environment - Remote Procedure Callac_abstract_itf_versionac_abstract_itf_versionq_proto_dcerpcuint32Version number of interface to call. It is defined on 32 bits.
dcerpcDistributed Computing Environment - Remote Procedure Callac_transfer_itf_uuidac_transfer_itf_uuidq_proto_dcerpcbytesInterface UUID allowing to identify RPC interface to get reply.
dcerpcDistributed Computing Environment - Remote Procedure Callac_transfer_itf_versionac_transfer_itf_versionq_proto_dcerpcuint32Version number of interface to get reply.
dcerpcDistributed Computing Environment - Remote Procedure Callac_result_ack_resultac_result_ack_resultq_proto_dcerpcuint32Negotiation result of the given presentation transfer syntax (0x00 stands for Acceptance, 0x03 is specific to Microsoft implementation of DCERPC).
dcerpcDistributed Computing Environment - Remote Procedure Callac_result_ack_reasonac_result_ack_reasonq_proto_dcerpcuint32Reason detailing non acceptance of the given transfer syntax, usually set to 0 when transfer syntax is accepted (Q_DCERPC_RESULT_ACK == 0). This attribute is not raised if Q_DCERPC_RESULT_ACK does not match either 0, 1, 2.
dcerpcDistributed Computing Environment - Remote Procedure Callac_result_transfer_syntax_uuidac_result_transfer_syntax_uuidq_proto_dcerpcbytesUUID of selected transfer syntax, 0 stands for transfer syntax is not selected"."
dcerpcDistributed Computing Environment - Remote Procedure Callac_result_transfer_syntax_versionac_result_transfer_syntax_versionq_proto_dcerpcuint32Version of selected transfer syntax, usually also set to 0 when UUID is 0.
dcerpcDistributed Computing Environment - Remote Procedure Callrtt_tvrtt_tvq_proto_dcerpcstringTime between request and response expressed in a timeval.
dcerpcDistributed Computing Environment - Remote Procedure Callsecondary_addrsecondary_addrq_proto_dcerpcbytesSecondary address is an alternative for subsequent transport connection requests to establish concurrent session to the server
dnp3Distributed Network Protocoldl_start_syncdl_start_syncq_proto_dnp3uint32Header start magic field.
dnp3Distributed Network Protocoldl_destdl_destq_proto_dnp3uint32Destination address of the frame.
dnp3Distributed Network Protocoldl_srcdl_srcq_proto_dnp3uint32Source address of the frame.
dnp3Distributed Network Protocoldl_crcdl_crcq_proto_dnp3uint32CRC Checksum field.
dnp3Distributed Network Protocolal_obj_type_fieldal_obj_type_fieldq_proto_dnp3uint32First object type in the application layer control field. Only the first object is handled. This attribute is not raised in case of fragmented DNP3 application data.
dnsDomain Name Servicequeryqueryq_proto_dnsbytesDNS Query sent.
dnsDomain Name Serviceqdcountqdcountq_proto_dnsuint32Number of queries.
dnsDomain Name Serviceancountancountq_proto_dnsuint32Number of answers.
dnsDomain Name Servicenscountnscountq_proto_dnsuint32Number of answers in the 'authority' section.
dnsDomain Name Servicearcountarcountq_proto_dnsuint32Number of additional answers.
dnsDomain Name Servicetransaction_idtransaction_idq_proto_dnsuint32DNS unique transaction ID.
dnsDomain Name Servicenamenameq_proto_dnsbytesName of the request
dnsDomain Name Servicehosthostq_proto_dnsbytesHost name
dnsDomain Name Servicehost_addrhost_addrq_proto_dnsstringIPV4 Host address
dnsDomain Name Servicereverse_addrreverse_addrq_proto_dnsstringIP address returned to the PTR request.
dnsDomain Name Serviceresponse_timeresponse_timeq_proto_dnsstringElapsed time between sending of the dns request and reception of its response.
dnsDomain Name Servicettlttlq_proto_dnsuint32Time (in seconds) a DNS information returned by the server will be kept in cache.
dnsDomain Name Servicesection_typesection_typeq_proto_dnsbytesType of section for each DNS answer.
dnsDomain Name Serviceflagsflagsq_proto_dnsuint3216-bit representation of some DNS header flags. These fields are described in RFC 1035 section 4.1.1 Header section format" and are the following: QA, Opcode, AA, TC, RD, RA, Z, RCODE."
dnsDomain Name Servicedns_querydns_queryq_proto_dnsboolDNS query.
dnsDomain Name Serviceopcodeopcodeq_proto_dnsuint32A four bit field that specifies kind of query in this message. This value is set by the originator of a query and copied into the response.
dnsDomain Name Serviceclassclassq_proto_dnsuint32DNS query class
dnsDomain Name Servicehost_classhost_classq_proto_dnsuint32DNS response class
dnsDomain Name Serviceweb_application_infoweb_application_infoq_proto_dnsuint32Structure containing metadata for classification of known HTTP/HTTPS based web applications. These metadata are based on Type A (IPv4) DNS responses returned from the server. The ul3l4_addr_t structure contains the web application protocol path, classified using the requested host name, and the IPv4 address resolved by the server. The extraction of this attribute can be produced on DNS requests instead of being produced on DNS responses, if the prototune query_base_web_application_info is set to 1. In this case the IPv4 address information is not relevant.
dnsDomain Name Servicekrb5_message_typekrb5_message_typeq_proto_dnsuint32Message type.
dnsDomain Name Servicekrb5_servicekrb5_serviceq_proto_dnsbytesService type.
dnsDomain Name Servicekrb5_serverkrb5_serverq_proto_dnsbytesName of the server requiring Kerberos authentication.
dnsDomain Name Servicekrb5_enc_data_typekrb5_enc_data_typeq_proto_dnsuint32Indicates type of Encrypted data (hash) sent in the AS-RQ message.
dnsDomain Name Servicekrb5_pa_data_typekrb5_pa_data_typeq_proto_dnsuint32PA-DATA type.
dnsDomain Name Servicekrb5_ticket_name_typekrb5_ticket_name_typeq_proto_dnsuint32Ticket name-type.
dnsDomain Name Servicekrb5_ticket_namekrb5_ticket_nameq_proto_dnsbytesTicket name component.
dnsDomain Name Servicekrb5_realmkrb5_realmq_proto_dnsbytesRealm in KRB-ERROR message.
dnsDomain Name Servicekrb5_err_crealmkrb5_err_crealmq_proto_dnsbytesRealm in KRB-ERROR message.
dnsDomain Name Servicekrb5_err_realmkrb5_err_realmq_proto_dnsbytesCorrect realm in KRB-ERROR message.
dnsDomain Name Servicekrb5_err_cname_typekrb5_err_cname_typeq_proto_dnsuint32KRB-ERROR cname type.
dnsDomain Name Servicekrb5_err_cname_namekrb5_err_cname_nameq_proto_dnsbytesKRB-ERROR message cname component.
dnsDomain Name Servicekrb5_err_sname_typekrb5_err_sname_typeq_proto_dnsuint32KRB-ERROR message server sname type.
dnsDomain Name Servicekrb5_err_sname_namekrb5_err_sname_nameq_proto_dnsbytesKRB-ERROR message server sname component.
dnsDomain Name Servicekrb5_err_textkrb5_err_textq_proto_dnsbytesKRB-ERROR message error description.
dnsDomain Name Servicednssec_rrsig_signer_namednssec_rrsig_signer_nameq_proto_dnsbytesSigner's name. This field could be empty. Notably when signer is DNS Root zone.
dnsDomain Name Servicemdns_service_namemdns_service_nameq_proto_dnsbytes'mdns' advertised service name.
dhcpDynamic Host Configuration Protocolciaddrciaddrq_proto_dhcpstringCurrent client ip address.
dhcpDynamic Host Configuration Protocolyiaddryiaddrq_proto_dhcpstringNew ip address attributed to the client.
dhcpDynamic Host Configuration Protocolsiaddrsiaddrq_proto_dhcpstringIp address of next server (used when booting via a server).
dhcpDynamic Host Configuration Protocolgiaddrgiaddrq_proto_dhcpstringRelay agent ip address (used when booting via a relay agent).
dhcpDynamic Host Configuration Protocolchaddrchaddrq_proto_dhcpstringClient hardware address.
dhcpDynamic Host Configuration Protocolsnamesnameq_proto_dhcpbytesServer host name (optional).
dhcpDynamic Host Configuration Protocolsubnetmasksubnetmaskq_proto_dhcpstringSubnet mask assigned to the client.
dhcpDynamic Host Configuration Protocolrouterrouterq_proto_dhcpstringList of gateway's ip addresses.
dhcpDynamic Host Configuration Protocoldns_serverdns_serverq_proto_dhcpstringList of dns server's ip addresses.
dhcpDynamic Host Configuration Protocolbootfilenamebootfilenameq_proto_dhcpbytesFile name used when initializing
dhcpDynamic Host Configuration Protocolcircuit_idcircuit_idq_proto_dhcpbytesA suboption that contains the circuit identifier
dhcpDynamic Host Configuration Protocolremote_idremote_idq_proto_dhcpbytesThe remote agent
dhcpDynamic Host Configuration Protocolremote_id_typeremote_id_typeq_proto_dhcpbytesAn suboption that contains the remote agent identifier.
dhcpDynamic Host Configuration Protocolremote_id_subtyperemote_id_subtypeq_proto_dhcpbytesSubtype for the remote agent
dhcpDynamic Host Configuration Protocolip_lease_timeip_lease_timeq_proto_dhcpuint32In a server reply (dhcpoffer), a dhcp server uses this option to specify the lease time it is willing to offer. the time is in seconds
dhcpDynamic Host Configuration Protocolend_statusend_statusq_proto_dhcpuint32An event sent when dhcp session expires. it's equal to 1 when a release message was observed and 0 if not
dhcpDynamic Host Configuration Protocolxidxidq_proto_dhcpuint32Transaction ID, a random number chosen by the client, used by the client and server to associate requests and responses.
dhcpDynamic Host Configuration Protocolhost_namehost_nameq_proto_dhcpbytesHost name sent by the client in the DCHP option 12 (optional).
dhcpDynamic Host Configuration Protocoldomain_namedomain_nameq_proto_dhcpbytesDNS server name sent by the server in the DHCP option 15 for further use by the client (optional).
dhcpDynamic Host Configuration Protocolclient_fqdnclient_fqdnq_proto_dhcpbytesFully qualified host name sent by the client in the DHCP option 81 (optional).
dhcp6Dynamic Host Configuration Protocol for IPv6xidxidq_proto_dhcp6uint32Transaction ID, a random number chosen by the client, used by the client and server to associate requests and responses.
dhcp6Dynamic Host Configuration Protocol for IPv6chaddrchaddrq_proto_dhcp6stringClient hardware address.
dhcp6Dynamic Host Configuration Protocol for IPv6ip_lease_timeip_lease_timeq_proto_dhcp6uint32A DHCPv6 server uses this option to specify the lease time it is willing to offer (time period in second)
dhcp6Dynamic Host Configuration Protocol for IPv6client_fqdnclient_fqdnq_proto_dhcp6bytesFully qualified domain name sent by the client in the DHCPv6 option 39. This metadata is not raised in case of decoding error.
dhcp6Dynamic Host Configuration Protocol for IPv6duid_typeduid_typeq_proto_dhcp6uint32DUID type.
dhcp6Dynamic Host Configuration Protocol for IPv6shaddrshaddrq_proto_dhcp6stringServer hardware address.
dhcp6Dynamic Host Configuration Protocol for IPv6requested_option_coderequested_option_codeq_proto_dhcp6uint32Option code for an option requested by the client.
dhcp6Dynamic Host Configuration Protocol for IPv6ia_prefix_optionia_prefix_optionq_proto_dhcp6uint32Option type.
dhcp6Dynamic Host Configuration Protocol for IPv6ia_prefix_lengthia_prefix_lengthq_proto_dhcp6uint32Length of the option data.
dhcp6Dynamic Host Configuration Protocol for IPv6ia_prefix_preferred_life_timeia_prefix_preferred_life_timeq_proto_dhcp6uint32Recommended preferred lifetime for the IPv6 prefix in the option expressed in seconds.
dhcp6Dynamic Host Configuration Protocol for IPv6ia_prefix_valid_life_timeia_prefix_valid_life_timeq_proto_dhcp6uint32The valid lifetime for the IPv6 prefix in the option expressed in seconds.
dhcp6Dynamic Host Configuration Protocol for IPv6iapd_iaidiapd_iaidq_proto_dhcp6uint32Unique identifier for a IA_PD option.
dhcp6Dynamic Host Configuration Protocol for IPv6enterprise_numberenterprise_numberq_proto_dhcp6uint32The vendor's Enterprise Number as registered with IANA.
dimpDynamic Internet Messaging Programattach_typeattach_typeq_proto_dimpbytesContent type of the sent attached file.
dimpDynamic Internet Messaging Programreceiver_aliasreceiver_aliasq_proto_dimpbytesName of email receiver (included cc and bcc receivers).
dimpDynamic Internet Messaging Programreceiver_emailreceiver_emailq_proto_dimpbytesEmail address of message receiver (included cc and bcc receivers).
dimpDynamic Internet Messaging Programsender_aliassender_aliasq_proto_dimpbytesName of the email sender.
dimpDynamic Internet Messaging Programsender_emailsender_emailq_proto_dimpbytesEmail address of the email sender.
dimpDynamic Internet Messaging Programsubjectsubjectq_proto_dimpbytesMessage subject.
dimpDynamic Internet Messaging Programdatedateq_proto_dimpbytesMessage date.
dimpDynamic Internet Messaging Programattach_filenameattach_filenameq_proto_dimpbytesAttachment name.
dimpDynamic Internet Messaging Programactionactionq_proto_dimpbytesIndicates if the message is read (Read) or composed (Compose).
dimpDynamic Internet Messaging Programmsg_idmsg_idq_proto_dimpbytesIdentifier of the message.
dimpDynamic Internet Messaging Programmsglist_subjectmsglist_subjectq_proto_dimpbytesMessage subject in a message list.
dimpDynamic Internet Messaging Programmsglist_sender_emailmsglist_sender_emailq_proto_dimpbytesAddress of email sender.
dimpDynamic Internet Messaging Programloginloginq_proto_dimpbytesUser's login string.
dimpDynamic Internet Messaging Programpasswordpasswordq_proto_dimpbytesUser's password string.
ebayeBay.comquery_textquery_textq_proto_ebaybytesQuery sent to the search engine.
ebayeBay.comquery_rawquery_rawq_proto_ebaybytesContains the query sent to the search engine as indicated in the URL.
ebuddyeBuddy.comcontact_messagecontact_messageq_proto_ebuddybytesUser's contact IM personal message.
ebuddyeBuddy.comcontact_logincontact_loginq_proto_ebuddybytesContact login.
ebuddyeBuddy.commessagemessageq_proto_ebuddybytesContains the chat message.
ebuddyeBuddy.comreceiverreceiverq_proto_ebuddybytesContains the identity of the receiver for a chat message or a file transfer.
ebuddyeBuddy.comsendersenderq_proto_ebuddybytesContains the identity of the sender of a chat session or a file transfer.
ebuddyeBuddy.comclient_messageclient_messageq_proto_ebuddybytesUser's IM personal message.
ebuddyeBuddy.come_actione_actionq_proto_ebuddybytesAction of the user.
ebuddyeBuddy.comloginloginq_proto_ebuddybytesUser's login string.
edonkeyEdonkeyloginloginq_proto_edonkeybytesUser's login string.
edonkeyEdonkeyqueryqueryq_proto_edonkeybytesQuery sent to find a file.
edonkeyEdonkeyfilenamefilenameq_proto_edonkeybytesName of the transferred file.
enipEthernet/IPcommandcommandq_proto_enipuint32Command code which has been sent by the request.
enipEthernet/IPstatusstatusq_proto_enipuint32Status code.
enipEthernet/IPsession_handlesession_handleq_proto_enipuint32Session id. Some commands do not require a session handle.
enipEthernet/IPdata_item_countdata_item_countq_proto_enipuint32Number of items to follow in the packet.
enipEthernet/IPdata_type_iddata_type_idq_proto_enipuint32Type of encapsulated item.
enipEthernet/IPdata_lengthdata_lengthq_proto_enipuint32Length in bytes of command data section.
enipEthernet/IPoptionsoptionsq_proto_enipuint32Options. Its behavior or use is not defined yet (Future use).
enipEthernet/IPcsd_interface_handlecsd_interface_handleq_proto_enipuint32Communications interface ID. Is part of Command Specific Data (CSD).
enipEthernet/IPcsd_timeoutcsd_timeoutq_proto_enipuint32Timeout in seconds used by routers. Is part of Command Specific Data (CSD).
enipEthernet/IPcsd_cpf_data_item_countcsd_cpf_data_item_countq_proto_enipuint32Number of items to follow in the packet.
enipEthernet/IPcsd_cpf_item_type_idcsd_cpf_item_type_idq_proto_enipuint32Type of encapsulated item.
enipEthernet/IPcsd_cpf_item_lengthcsd_cpf_item_lengthq_proto_enipuint32Size of encapsulated item.
activesyncExchange ActiveSync (EAS)loginloginq_proto_activesyncbytesUser's login string.
activesyncExchange ActiveSync (EAS)actionactionq_proto_activesyncbytesIndicates if the message is read (Read) or composed (Compose).
activesyncExchange ActiveSync (EAS)sendersenderq_proto_activesyncbytesFull address of email sender (alias followed by email address).
activesyncExchange ActiveSync (EAS)sender_emailsender_emailq_proto_activesyncbytesEmail address of the email sender.
activesyncExchange ActiveSync (EAS)sender_aliassender_aliasq_proto_activesyncbytesName of the email sender.
activesyncExchange ActiveSync (EAS)receiverreceiverq_proto_activesyncbytesFull address of email receiver (including cc and bcc receivers).
activesyncExchange ActiveSync (EAS)receiver_emailreceiver_emailq_proto_activesyncbytesEmail address of message receiver (included cc and bcc receivers).
activesyncExchange ActiveSync (EAS)receiver_aliasreceiver_aliasq_proto_activesyncbytesName of email receiver (included cc and bcc receivers).
activesyncExchange ActiveSync (EAS)receiver_typereceiver_typeq_proto_activesyncbytesType of the email receiver.
activesyncExchange ActiveSync (EAS)replytoreplytoq_proto_activesyncbytesEmail address to use in a reply for this message.
activesyncExchange ActiveSync (EAS)datedateq_proto_activesyncbytesMessage date.
activesyncExchange ActiveSync (EAS)subjectsubjectq_proto_activesyncbytesMessage subject.
activesyncExchange ActiveSync (EAS)msg_idmsg_idq_proto_activesyncbytesIdentifier of the message.
activesyncExchange ActiveSync (EAS)content_typecontent_typeq_proto_activesyncbytesIndicates the content type of transferred file.
activesyncExchange ActiveSync (EAS)content_transfer_encodingcontent_transfer_encodingq_proto_activesyncbytesContains the encoding of the content
activesyncExchange ActiveSync (EAS)encodingencodingq_proto_activesyncbytesPage encoding
activesyncExchange ActiveSync (EAS)attach_idattach_idq_proto_activesyncbytesAttachment identifier.
activesyncExchange ActiveSync (EAS)attach_filenameattach_filenameq_proto_activesyncbytesAttachment name.
activesyncExchange ActiveSync (EAS)attach_typeattach_typeq_proto_activesyncbytesContent type of the sent attached file.
activesyncExchange ActiveSync (EAS)attach_sizeattach_sizeq_proto_activesyncuint32Attached file MIME size.
activesyncExchange ActiveSync (EAS)attach_transfer_encodingattach_transfer_encodingq_proto_activesyncbytesContains the encoding of the attached content
activesyncExchange ActiveSync (EAS)folderlist_item_namefolderlist_item_nameq_proto_activesyncbytesMessage folder name.
activesyncExchange ActiveSync (EAS)folderlist_item_idfolderlist_item_idq_proto_activesyncbytesMessage folder unique identifier.
activesyncExchange ActiveSync (EAS)timezone_rawtimezone_rawq_proto_activesyncbytesTimezone to be used. The extracted data is a base64 encoded structure.
activesyncExchange ActiveSync (EAS)timezone_standard_nametimezone_standard_nameq_proto_activesyncbytesIt contains an optional description for standard time.
activesyncExchange ActiveSync (EAS)timezone_daylight_nametimezone_daylight_nameq_proto_activesyncbytesIt contains an optional description for DST.
activesyncExchange ActiveSync (EAS)creation_timecreation_timeq_proto_activesyncbytesCreation time of the entry.
activesyncExchange ActiveSync (EAS)end_timeend_timeq_proto_activesyncbytesEnd time of the meeting.
activesyncExchange ActiveSync (EAS)locationlocationq_proto_activesyncbytesLocation of the meeting.
activesyncExchange ActiveSync (EAS)organizer_emailorganizer_emailq_proto_activesyncbytesThis element is an optional element that specifies the e-mail address of the user who created the calendar item.
activesyncExchange ActiveSync (EAS)reminderreminderq_proto_activesyncuint32Reminder element is an optional element that specifies the number of minutes before the calendar item's start time to display a reminder notice.
activesyncExchange ActiveSync (EAS)calendar_subjectcalendar_subjectq_proto_activesyncbytesSubject element is an optional element that specifies the subject of the calendar item.
activesyncExchange ActiveSync (EAS)start_timestart_timeq_proto_activesyncbytesstart_time element is an optional element that specifies the start time of the calendar item.
activesyncExchange ActiveSync (EAS)calendar_idcalendar_idq_proto_activesyncbytesElement that specifies an ID that uniquely identifies a single event or recurring series.
activesyncExchange ActiveSync (EAS)recurrence_intervalrecurrence_intervalq_proto_activesyncuint32Element that specifies the interval between recurrences.
activesyncExchange ActiveSync (EAS)attendee_nameattendee_nameq_proto_activesyncbytesSpecifies the attendee's name.
activesyncExchange ActiveSync (EAS)attendee_emailattendee_emailq_proto_activesyncbytesSpecifies the attendee's email address.
facebookFacebookmessagemessageq_proto_facebookbytesInstant message content.
facebookFacebookfeed_textfeed_textq_proto_facebookbytesfeed text.
facebookFacebookreceiverreceiverq_proto_facebookbytesInstant message recipient name.
facebookFacebooksender_emailsender_emailq_proto_facebookbytesEmail address of the message sender.
facebookFacebookquery_textquery_textq_proto_facebookbytesQuery sent to the search engine.
facebookFacebookloginloginq_proto_facebookbytesUser's login string.
facebookFacebookactionactionq_proto_facebookbytesIndicates the action executed by the user.
facebookFacebookserver_nameserver_nameq_proto_facebookbytesDomain name mentioned in CHLO message of the underlying transport protocol Zero.
facebook_appsFacebook Appsapplication_actionapplication_actionq_proto_facebook_appsbytesIndicates the action executed by the user.
facebook_appsFacebook Appsapplication_nameapplication_nameq_proto_facebook_appsbytesName of the application.
facebook_mailFacebook Mailattach_typeattach_typeq_proto_facebook_mailbytesContent type of the sent attached file.
facebook_mailFacebook Mailattach_filenameattach_filenameq_proto_facebook_mailbytesAttachment name.
facebook_mailFacebook Mailsender_emailsender_emailq_proto_facebook_mailbytesEmail address of the email sender.
facebook_mailFacebook Mailreceiver_emailreceiver_emailq_proto_facebook_mailbytesEmail address of message receiver (included cc and bcc receivers).
facebook_mailFacebook Mailactionactionq_proto_facebook_mailbytesIndicates if the message is read (Read) or composed (Compose).
facebook_mailFacebook Mailsubjectsubjectq_proto_facebook_mailbytesMessage subject.
facebook_mailFacebook Mailloginloginq_proto_facebook_mailbytesUser's login string.
facebook_mailFacebook Mailsession_idsession_idq_proto_facebook_mailbytesUniquely identifies the current user session.
facebook_messengerFacebook Messengerservice_idservice_idq_proto_facebook_messengeruint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
facebook_messengerFacebook Messengerserviceserviceq_proto_facebook_messengerbytesCurrent service identification string.
facebook_messengerFacebook Messengerservice_durationservice_durationq_proto_facebook_messengeruint324 bytes integer value indicating, when the service is ended, the length of it in seconds
facebook_messengerFacebook Messengerservice_duration_tvservice_duration_tvq_proto_facebook_messengerstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
facebook_messengerFacebook Messengeruiduidq_proto_facebook_messengerbytesGeneric user ID.
ftpFile Transfer Protocolloginloginq_proto_ftpbytesUser's login string.
ftpFile Transfer Protocolpasswordpasswordq_proto_ftpbytesUser's password string.
ftpFile Transfer Protocolfilenamefilenameq_proto_ftpbytesName of the transferred file.
ftpFile Transfer Protocolmethodmethodq_proto_ftpbytesContains the FTP command sent.
ftpFile Transfer Protocolfilesizefilesizeq_proto_ftpuint32Size (byte) of the transferred file.
ftpFile Transfer Protocolloadwayloadwayq_proto_ftpbytesContains the file transfer way (Upload vs Download).
ftpFile Transfer Protocoloffsetoffsetq_proto_ftpuint32Indicates the start offset of the file transfer.
ftpFile Transfer Protocolgreeting_messagegreeting_messageq_proto_ftpbytesFirst line of the server banner.
ftpFile Transfer Protocolreturn_contentreturn_contentq_proto_ftpbytesMessage of server's response.
ftpFile Transfer Protocoltransfer_durationtransfer_durationq_proto_ftpstringElapsed time (in seconds) between the beginning of a transfer (ftp code 150) and the first packet signaling the end with success of the transfer (ftp code 226)
ftpFile Transfer Protocolindexindexq_proto_ftpuint32Identifier of the request and response in a FTP flow.
ftpFile Transfer Protocolmethod_contentmethod_contentq_proto_ftpbytesMethod parameter
ftpFile Transfer Protocoldata_port_start_offsetdata_port_start_offsetq_proto_ftpuint32Offset to the first FTP port byte given in the PORT command.
ftpFile Transfer Protocoldata_port_end_offsetdata_port_end_offsetq_proto_ftpuint32Offset to the first byte which is not part of the TCP port value, given in the PORT command.
ftp_dataFile Transfer Protocol Datacontentcontentq_proto_ftp_databytesFile content
fixFinancial Information eXchange (FIX)transaction_timetransaction_timeq_proto_fixbytesTime the order request was initiated/released by the trading system.
fixFinancial Information eXchange (FIX)symbolsymbolq_proto_fixbytesCommon representation of the security.
fixFinancial Information eXchange (FIX)order_typeorder_typeq_proto_fixbytesOrder type.
fixFinancial Information eXchange (FIX)order_statusorder_statusq_proto_fixbytesDescribes the current state of a chain of orders.
fixFinancial Information eXchange (FIX)order_qtyorder_qtyq_proto_fixbytesQuantity ordered.
fixFinancial Information eXchange (FIX)order_idorder_idq_proto_fixbytesUnique identifier for an order.
fixFinancial Information eXchange (FIX)message_typemessage_typeq_proto_fixbytesDefines FIX message type.
firefox_updateFirefox Updateplugin_new_versionplugin_new_versionq_proto_firefox_updatebytesPlugin version after update.
firefox_updateFirefox Updateplugin_nameplugin_nameq_proto_firefox_updatebytesName of the plugin.
firefox_updateFirefox Updatenew_versionnew_versionq_proto_firefox_updatebytesBrowser version after update.
firefox_updateFirefox Updatecurrent_versioncurrent_versionq_proto_firefox_updatebytesBrowser version before update.
freebsd_updateFreeBSD Updatespackage_namepackage_nameq_proto_freebsd_updatebytesSoftware package name.
giopGeneral Inter-ORB Protocolversionversionq_proto_giopbytesCurrent GIOP version.
giopGeneral Inter-ORB Protocolior_type_idior_type_idq_proto_giopbytesIOR object's repository id.
giopGeneral Inter-ORB Protocolmessage_typemessage_typeq_proto_giopbytesGIOP message type.
giopGeneral Inter-ORB Protocolrequest_operationrequest_operationq_proto_giopbytesName of the request sent to the server.
giopGeneral Inter-ORB Protocolrequest_idrequest_idq_proto_giopuint32ID used to associate a reply message with a request message.
gmail_basicGmail Basicdatedateq_proto_gmail_basicbytesMessage date.
gmail_basicGmail Basicsender_aliassender_aliasq_proto_gmail_basicbytesName of the email sender.
gmail_basicGmail Basicsender_emailsender_emailq_proto_gmail_basicbytesEmail address of the email sender.
gmail_basicGmail Basicloginloginq_proto_gmail_basicbytesUser's login string. It's also sender id in case of e-mail compose/send workflow (use session_id to correlate email and login).
gmail_basicGmail Basicsubjectsubjectq_proto_gmail_basicbytesMessage subject.
gmail_basicGmail Basicreceiver_typereceiver_typeq_proto_gmail_basicbytesType of the email receiver.
gmail_basicGmail Basicreceiver_aliasreceiver_aliasq_proto_gmail_basicbytesName of email receiver (included cc and bcc receivers).
gmail_basicGmail Basicreceiver_emailreceiver_emailq_proto_gmail_basicbytesEmail address of message receiver (included cc and bcc receivers).
gmail_basicGmail Basicattach_typeattach_typeq_proto_gmail_basicbytesContent type of the sent attached file.
gmail_basicGmail Basicattach_filenameattach_filenameq_proto_gmail_basicbytesAttachment name.
gmail_basicGmail Basicattach_idattach_idq_proto_gmail_basicbytesAttachment identifier.
gmail_basicGmail Basicdraftdraftq_proto_gmail_basicuint32Indicates if the email is a draft or has really been posted
gmail_basicGmail Basicmsg_idmsg_idq_proto_gmail_basicbytesIdentifier of the message.
gmail_basicGmail Basicactionactionq_proto_gmail_basicbytesIndicates if the message is read (Read) or composed (Compose).
gmail_basicGmail Basicattach_sizeattach_sizeq_proto_gmail_basicuint32Attached file MIME size.
gmail_basicGmail Basicsession_idsession_idq_proto_gmail_basicbytesUniquely identifies the current user session.
gmail_basicGmail Basicencodingencodingq_proto_gmail_basicbytesPage encoding
gmail_mobileGmail Mobilemsglist_subjectmsglist_subjectq_proto_gmail_mobilebytesMessage subject in a message list.
gmail_mobileGmail Mobilemsglist_msgidmsglist_msgidq_proto_gmail_mobilebytesMessage identifier.
gmail_mobileGmail Mobilemsglist_sender_aliasmsglist_sender_aliasq_proto_gmail_mobilebytesName of email sender.
gmail_mobileGmail Mobilemsglist_foldermsglist_folderq_proto_gmail_mobilebytesIndicates the directory from a message list.
gmail_mobileGmail Mobilecontact_emailcontact_emailq_proto_gmail_mobilebytesEmail address of a contact.
gmail_mobileGmail Mobilecontact_aliascontact_aliasq_proto_gmail_mobilebytesAlias of a contact.
gmail_mobileGmail Mobiledatedateq_proto_gmail_mobilebytesMessage date.
gmail_mobileGmail Mobileattach_filenameattach_filenameq_proto_gmail_mobilebytesAttachment name.
gmail_mobileGmail Mobileattach_idattach_idq_proto_gmail_mobilebytesAttachment identifier.
gmail_mobileGmail Mobileemail_indexemail_indexq_proto_gmail_mobilebytesIndex of the request which the email is attached to.
gmail_mobileGmail Mobilesubjectsubjectq_proto_gmail_mobilebytesMessage subject.
gmail_mobileGmail Mobilereceiver_typereceiver_typeq_proto_gmail_mobilebytesType of the email receiver.
gmail_mobileGmail Mobilereceiver_aliasreceiver_aliasq_proto_gmail_mobilebytesName of email receiver (included cc and bcc receivers).
gmail_mobileGmail Mobilereceiver_emailreceiver_emailq_proto_gmail_mobilebytesEmail address of message receiver (included cc and bcc receivers).
gmail_mobileGmail Mobilesender_aliassender_aliasq_proto_gmail_mobilebytesName of the email sender.
gmail_mobileGmail Mobilesender_emailsender_emailq_proto_gmail_mobilebytesEmail address of the email sender.
gmail_mobileGmail Mobileactionactionq_proto_gmail_mobilebytesIndicates if the message is read (Read) or composed (Compose).
gmail_mobileGmail Mobileloginloginq_proto_gmail_mobilebytesUser's login string.
gmail_mobileGmail Mobilesession_idsession_idq_proto_gmail_mobilebytesUniquely identifies the current user session.
gmail_mobileGmail Mobilemsglist_receiver_aliasmsglist_receiver_aliasq_proto_gmail_mobilebytesName of email receiver.
gmail_mobileGmail Mobiledraftdraftq_proto_gmail_mobileuint32Indicates if the email is a draft or has really been posted
gmail_mobileGmail Mobilenamenameq_proto_gmail_mobilebytesUser's full name.
gmail_mobileGmail Mobileencodingencodingq_proto_gmail_mobilebytesPage encoding
gmail_mobileGmail Mobilemsglist_sender_emailmsglist_sender_emailq_proto_gmail_mobilebytesAddress of email sender.
gmail_mobileGmail Mobilemsglist_receiver_emailmsglist_receiver_emailq_proto_gmail_mobilebytesEmail address of the email receiver.
gmail_mobileGmail Mobilemsglist_datemsglist_dateq_proto_gmail_mobilebytesMessage date in a message list.
gmail_mobileGmail Mobilereplytoreplytoq_proto_gmail_mobilebytesEmail address to use in a reply for this message.
gmail_mobileGmail Mobileattach_typeattach_typeq_proto_gmail_mobilebytesContent type of the sent attached file.
gmail_mobileGmail Mobileattach_sizeattach_sizeq_proto_gmail_mobileuint32Attached file MIME size.
gmail_mobileGmail Mobilelast_activitylast_activityq_proto_gmail_mobilebytesTime elapsed since last account activity.
gmail_mobileGmail Mobilelast_activity_timestamplast_activity_timestampq_proto_gmail_mobilestringLast account-activity timestamp.
gmail_mobileGmail Mobilecurrent_ip_addresscurrent_ip_addressq_proto_gmail_mobilestringIP address of the logged user.
gmail_mobileGmail Mobileother_ip_addressother_ip_addressq_proto_gmail_mobilestringIP address of the other logged user.
gmail_mobileGmail Mobileattach_transfer_encodingattach_transfer_encodingq_proto_gmail_mobilebytesContains the encoding of the attached content
gmail_mobileGmail Mobilepasswordpasswordq_proto_gmail_mobilebytesUser's password string.
gmxGMX webmailattach_filenameattach_filenameq_proto_gmxbytesAttachment name.
gmxGMX webmailreceiver_emailreceiver_emailq_proto_gmxbytesEmail address of message receiver (included cc and bcc receivers).
gmxGMX webmailsender_emailsender_emailq_proto_gmxbytesEmail address of the email sender.
gmxGMX webmailsubjectsubjectq_proto_gmxbytesMessage subject.
gmxGMX webmailloginloginq_proto_gmxbytesUser's login string.
gnutellaGnutellauser_agentuser_agentq_proto_gnutellabytesName of the software used.
gnutellaGnutellaserverserverq_proto_gnutellabytesName of the server from which the file is downloaded.
gnutellaGnutellaqueryqueryq_proto_gnutellabytesQuery sent to find a file.
gnutellaGnutellafilenamefilenameq_proto_gnutellabytesName of the transferred file.
google_adsGoogle Adsad_url_fullad_url_fullq_proto_google_adsbytesComplete ad URL.
google_adsGoogle Adsad_statusad_statusq_proto_google_adsbytesIndicates whether the ad has been displayed or clicked.
gmail_chatGoogle Chatloginloginq_proto_gmail_chatbytesUser's login string.
gmail_chatGoogle Chatmessagemessageq_proto_gmail_chatbytesContains the chat message.
google_earthGoogle Earthquery_rawquery_rawq_proto_google_earthbytesContains the query sent to the search engine as indicated in the URL.
google_earthGoogle Earthquery_textquery_textq_proto_google_earthbytesQuery sent to the search engine.
google_groupsGoogle Groupssender_emailsender_emailq_proto_google_groupsbytesEmail address of the email sender.
google_groupsGoogle Groupsactionactionq_proto_google_groupsbytesIndicates if the message is read (Read) or composed (Compose).
google_groupsGoogle Groupsmsglist_subjectmsglist_subjectq_proto_google_groupsbytesMessage subject in a message list.
google_groupsGoogle Groupsgroup_namegroup_nameq_proto_google_groupsbytesName of the group the user has subscribed to.
google_groupsGoogle Groupsreceiver_emailreceiver_emailq_proto_google_groupsbytesEmail address of message receiver (included cc and bcc receivers).
google_groupsGoogle Groupssubjectsubjectq_proto_google_groupsbytesMessage subject.
google_groupsGoogle Groupsmsglist_sender_emailmsglist_sender_emailq_proto_google_groupsbytesAddress of email sender.
gmailGoogle Mailsession_idsession_idq_proto_gmailbytesUniquely identifies the current user session.
gmailGoogle Mailloginloginq_proto_gmailbytesUser's login string.
gmailGoogle Mailnamenameq_proto_gmailbytesUser's full name.
gmailGoogle Mailencodingencodingq_proto_gmailbytesPage encoding
gmailGoogle Mailmsglist_sender_aliasmsglist_sender_aliasq_proto_gmailbytesName of email sender.
gmailGoogle Mailmsglist_sender_emailmsglist_sender_emailq_proto_gmailbytesAddress of email sender.
gmailGoogle Mailmsglist_receiver_aliasmsglist_receiver_aliasq_proto_gmailbytesName of email receiver.
gmailGoogle Mailmsglist_receiver_emailmsglist_receiver_emailq_proto_gmailbytesEmail address of the email receiver.
gmailGoogle Mailmsglist_subjectmsglist_subjectq_proto_gmailbytesMessage subject in a message list.
gmailGoogle Mailmsglist_msgidmsglist_msgidq_proto_gmailbytesMessage identifier.
gmailGoogle Mailmsglist_datemsglist_dateq_proto_gmailbytesMessage date in a message list.
gmailGoogle Mailmsglist_foldermsglist_folderq_proto_gmailbytesIndicates the directory from a message list.
gmailGoogle Mailsender_emailsender_emailq_proto_gmailbytesEmail address of the email sender.
gmailGoogle Mailsender_aliassender_aliasq_proto_gmailbytesName of the email sender.
gmailGoogle Mailreal_sender_domainreal_sender_domainq_proto_gmailbytesDomain of the email sender.
gmailGoogle Mailreal_sender_msgidreal_sender_msgidq_proto_gmailbytesEmail identifier.
gmailGoogle Mailreceiver_emailreceiver_emailq_proto_gmailbytesEmail address of message receiver (included cc and bcc receivers).
gmailGoogle Mailreceiver_aliasreceiver_aliasq_proto_gmailbytesName of email receiver (included cc and bcc receivers).
gmailGoogle Mailreceiver_typereceiver_typeq_proto_gmailbytesType of the email receiver.
gmailGoogle Mailreplytoreplytoq_proto_gmailbytesEmail address to use in a reply for this message.
gmailGoogle Maildatedateq_proto_gmailbytesMessage date.
gmailGoogle Mailsubjectsubjectq_proto_gmailbytesMessage subject.
gmailGoogle Mailmsg_idmsg_idq_proto_gmailbytesIdentifier of the message.
gmailGoogle Mailattach_idattach_idq_proto_gmailbytesAttachment identifier.
gmailGoogle Mailattach_filenameattach_filenameq_proto_gmailbytesAttachment name.
gmailGoogle Mailattach_typeattach_typeq_proto_gmailbytesContent type of the sent attached file.
gmailGoogle Mailattach_sizeattach_sizeq_proto_gmailuint32Attached file MIME size.
gmailGoogle Mailthumbnailthumbnailq_proto_gmailuint32Indicates whether this attachment is an image thumbnail.
gmailGoogle Maildraftdraftq_proto_gmailuint32Indicates if the email is a draft or has really been posted
gmailGoogle Mailactionactionq_proto_gmailbytesIndicates if the message is read (Read) or composed (Compose).
gmailGoogle Mailversionversionq_proto_gmailbytesGmail version used.
gmailGoogle Maillast_activitylast_activityq_proto_gmailbytesTime elapsed since last account activity.
gmailGoogle Maillast_activity_timestamplast_activity_timestampq_proto_gmailstringLast account activity timestamp.
gmailGoogle Mailcurrent_ip_addresscurrent_ip_addressq_proto_gmailstringIP address of the logged user.
gmailGoogle Mailother_ip_addressother_ip_addressq_proto_gmailstringIP address of the other logged user.
gmailGoogle Mailcontact_emailcontact_emailq_proto_gmailbytesEmail address of a contact.
gmailGoogle Mailcontact_aliascontact_aliasq_proto_gmailbytesAlias of a contact.
gmailGoogle Mailemail_indexemail_indexq_proto_gmailbytesIndex of the request which the email is attached to.
gmailGoogle Mailattach_id_tempattach_id_tempq_proto_gmailbytesTemporary value for attach_id of an attachment, it is present during attachment uploading (it is use to correlate uploaded attachment and sending the associated email).
google_mapsGoogle Mapsquery_textquery_textq_proto_google_mapsbytesQuery sent to the search engine.
google_mapsGoogle Mapsquery_rawquery_rawq_proto_google_mapsbytesContains the query sent to the search engine as indicated in the URL.
google_mapsGoogle Mapsstart_addr_rawstart_addr_rawq_proto_google_mapsbytesDeparture point as indicated in the URL as indicated in the URL.
google_mapsGoogle Mapsstart_addrstart_addrq_proto_google_mapsbytesEncoded departure point .
google_playGoogle Play Storeapplication_nameapplication_nameq_proto_google_playbytesName of the downloaded app.
googleGoogle Searchquery_textquery_textq_proto_googlebytesQuery sent to the search engine.
googleGoogle Searchquery_rawquery_rawq_proto_googlebytesContains the query sent to the search engine as indicated in the URL.
gtalkGoogle Talk (incl. Hangouts and Allo and Duo)service_idservice_idq_proto_gtalkuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
gtalkGoogle Talk (incl. Hangouts and Allo and Duo)serviceserviceq_proto_gtalkbytesCurrent service identification string.
gtalkGoogle Talk (incl. Hangouts and Allo and Duo)service_durationservice_durationq_proto_gtalkuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
gtalkGoogle Talk (incl. Hangouts and Allo and Duo)service_duration_tvservice_duration_tvq_proto_gtalkstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
gotomypcGoToMyPC Remote Accessserviceserviceq_proto_gotomypcbytesCurrent service identification string.
gotomypcGoToMyPC Remote Accessservice_idservice_idq_proto_gotomypcuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
gougouGougou.comquery_rawquery_rawq_proto_gougoubytesContains the query sent to the search engine as indicated in the URL.
gougouGougou.comquery_textquery_textq_proto_gougoubytesQuery sent to the search engine.
gtpv2GPRS Tunneling Protocol version 2processing_anomaly_typeprocessing_anomaly_typeq_proto_gtpv2bytesDefines the category of the anomaly.
gtpv2GPRS Tunneling Protocol version 2processing_anomaly_attrprocessing_anomaly_attrq_proto_gtpv2uint32Gives an attribute ID, or an attribute structure (parent attribute ID), not extracted because of the anomaly.
gtpv2GPRS Tunneling Protocol version 2uli_field_typeuli_field_typeq_proto_gtpv2uint32Type of the field
gtpv2GPRS Tunneling Protocol version 2uli_mcculi_mccq_proto_gtpv2uint32Mobile Country Code (MCC) present in the identity
gtpv2GPRS Tunneling Protocol version 2uli_mnculi_mncq_proto_gtpv2uint32Mobile Network Code (MNC) present in the identity
gtpv2GPRS Tunneling Protocol version 2uli_eciuli_eciq_proto_gtpv2uint32E-UTRAN Cell Identifier (ECI) present in the identity of type ECGI.
gtpv2GPRS Tunneling Protocol version 2uli_ciuli_ciq_proto_gtpv2uint32Cell Identifier (CI) present in the identity of type CGI.
gtpv2GPRS Tunneling Protocol version 2uli_taculi_tacq_proto_gtpv2uint32Tracking Area Code (TAC) present in the identity of type TAI.
gtpv2GPRS Tunneling Protocol version 2uli_laculi_lacq_proto_gtpv2uint32Location Area Code (LAC) present in the identity of type LAI,RAI, SAI or CGI.
gtpv2GPRS Tunneling Protocol version 2uli_saculi_sacq_proto_gtpv2uint32Service Area Code (SAC) present in the identity of type SAI.
gtpv2GPRS Tunneling Protocol version 2uli_raculi_racq_proto_gtpv2uint32Routing Area Code (RAC) present in the identity of type RAI.
gtpv2GPRS Tunneling Protocol version 2sn_mccsn_mccq_proto_gtpv2uint32Mobile Country Code (MCC) of the Serving NEtwork.
gtpv2GPRS Tunneling Protocol version 2sn_mncsn_mncq_proto_gtpv2uint32Mobile Network Code (MNC) of the Serving Network.
h225H225call_setupcall_setupq_proto_h225stringCall setup delay.
h225H225call_durationcall_durationq_proto_h225stringCall duration.
h225H225session_durationsession_durationq_proto_h225stringCall setup duration.
h225H225start_timestart_timeq_proto_h225stringStart date of the call.
h225H225time_before_spktime_before_spkq_proto_h225stringWaiting delay before speak
h225H225call_idcall_idq_proto_h225bytesCall id, extracted for each call.
h225H225end_statusend_statusq_proto_h225bytesStatus of the call end
h225H225media_attr_encodingmedia_attr_encodingq_proto_h225bytesThe encoding of media data.
h225H225callercallerq_proto_h225bytesContains the identity (or the phone number) of the initiator of the call.
h225H225calleecalleeq_proto_h225bytesContains the identity (or the phone number) of the called party for a call.
h225H225methodmethodq_proto_h225bytesThe command
h225H225h245_addrh245_addrq_proto_h225stringAddress used by h245 session.
h225H225request_call_idrequest_call_idq_proto_h225bytesCall's id in the message.
h225H225request_callerrequest_callerq_proto_h225bytesContains the identity (or the phone number) of the initiator in the message
h225H225request_calleerequest_calleeq_proto_h225bytesContains the identity (or the phone number) of the called party in the message.
h225H225audio_dataaudio_dataq_proto_h225bytesEncoding can be used in audio flow.
h225H225media_control_channel_addrmedia_control_channel_addrq_proto_h225stringAddress used for a rtcp channel.
h225H225media_channel_addrmedia_channel_addrq_proto_h225stringAddress used for a rtp channel.
h225H225h245_methodh245_methodq_proto_h225bytesThe command for a H245 message.
h225H225languagelanguageq_proto_h225bytesUsed language.
h225H225product_idproduct_idq_proto_h225bytesH225 product component identifier.
h225H225versionversionq_proto_h225bytesVersion of the H225 VoIP client software.
h245H245media_attr_encodingmedia_attr_encodingq_proto_h245bytesThe encoding of media data.
h245H245methodmethodq_proto_h245bytesThe command
h245H245media_control_channel_addrmedia_control_channel_addrq_proto_h245stringAddress used for a rtcp channel.
h245H245media_channel_addrmedia_channel_addrq_proto_h245stringAddress used for a rtp channel.
h248_binaryh248 Protocol (Megaco) in binary modecontext_idcontext_idq_proto_h248_binaryuint32The context ID identifies the context. It is assigned by the Media Gateway. It can be an integer, -" (null context), "*" (all) or "$" (choose)."
h248_binaryh248 Protocol (Megaco) in binary modecall_idcall_idq_proto_h248_binarybytesCall id, extracted for each call.
h248_binaryh248 Protocol (Megaco) in binary modeactionactionq_proto_h248_binarybytesThe action designates the command that is executed during the transaction. The coommand name is postfixed by Req if the transaction is a request, by Reply if the transaction is a reply
h248_binaryh248 Protocol (Megaco) in binary modefrom_ipfrom_ipq_proto_h248_binarystringSource IPv4 address
h248_binaryh248 Protocol (Megaco) in binary modeto_ipto_ipq_proto_h248_binarystringDestination IPv4 address
h248_binaryh248 Protocol (Megaco) in binary modesrc_audio_connectionsrc_audio_connectionq_proto_h248_binarybytesSource audio connection type
h248_binaryh248 Protocol (Megaco) in binary modesrc_video_connectionsrc_video_connectionq_proto_h248_binarybytesSource video connection type
h248_binaryh248 Protocol (Megaco) in binary modedst_audio_connectiondst_audio_connectionq_proto_h248_binarybytesDestination audio connection type
h248_binaryh248 Protocol (Megaco) in binary modedst_video_connectiondst_video_connectionq_proto_h248_binarybytesDestination video connection type
h248_binaryh248 Protocol (Megaco) in binary moderesponse_coderesponse_codeq_proto_h248_binaryuint32Return code, extracted from the reply
h248_texth248 Protocol (Megaco) in text modecontext_idcontext_idq_proto_h248_textbytesThe context ID identifies the context. It is assigned by the Media Gateway. It can be an integer, -" (null context), "*" (all) or "$" (choose)."
h248_texth248 Protocol (Megaco) in text modecall_idcall_idq_proto_h248_textbytesCall id, extracted for each call.
h248_texth248 Protocol (Megaco) in text modeactionactionq_proto_h248_textbytesThe action designates the command that is executed during the transaction. The coommand name is postfixed by Req if the transaction is a request, by Reply if the transaction is a reply
h248_texth248 Protocol (Megaco) in text modefrom_ipfrom_ipq_proto_h248_textstringSource IPv4 address
h248_texth248 Protocol (Megaco) in text modeto_ipto_ipq_proto_h248_textstringDestination IPv4 address
h248_texth248 Protocol (Megaco) in text modesrc_audio_connectionsrc_audio_connectionq_proto_h248_textbytesSource audio connection type
h248_texth248 Protocol (Megaco) in text modesrc_video_connectionsrc_video_connectionq_proto_h248_textbytesSource video connection type
h248_texth248 Protocol (Megaco) in text modedst_audio_connectiondst_audio_connectionq_proto_h248_textbytesDestination audio connection type
h248_texth248 Protocol (Megaco) in text modedst_video_connectiondst_video_connectionq_proto_h248_textbytesDestination video connection type
h248_texth248 Protocol (Megaco) in text moderesponse_coderesponse_codeq_proto_h248_textuint32Return code, extracted from the reply
haproxyHAProxyipv4_src_addripv4_src_addrq_proto_haproxystringIPv4 source address.
haproxyHAProxyipv4_dst_addripv4_dst_addrq_proto_haproxystringIPv4 destination address.
haproxyHAProxysrc_portsrc_portq_proto_haproxyuint32Source port.
haproxyHAProxydst_portdst_portq_proto_haproxyuint32Destination port.
hi5Hi5.comnicknamenicknameq_proto_hi5bytesUser's profile displayed name.
hi5Hi5.compasswordpasswordq_proto_hi5bytesUser's password string.
hi5Hi5.comloginloginq_proto_hi5bytesUser's login string.
hi5Hi5.comis_mobile_serviceis_mobile_serviceq_proto_hi5uint32Whether or not the access was made through a mobile device.
hi5Hi5.comuiduidq_proto_hi5bytesGeneric user ID.
high_entropyHigh Entropyentropyentropyq_proto_high_entropyuint32Computed entropy value.
hike_messengerHike Messengerservice_idservice_idq_proto_hike_messengeruint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
hike_messengerHike Messengerserviceserviceq_proto_hike_messengerbytesCurrent service identification string.
hsrpHot Standby Router Protocolvirtual_addrvirtual_addrq_proto_hsrpstringVirtual IP address used by the group.
httpHyperText Transfer Protocolserverserverq_proto_httpbytesNormalized web server name, including lowercase transformation and suffix cleaning. The value is extracted from an absolute URI (if present), or from the Host: header value by default (extracted once per HTTP request).
httpHyperText Transfer Protocollocationlocationq_proto_httpbytesDestination address where the client is redirected.
httpHyperText Transfer Protocolrefererrefererq_proto_httpbytesSource address from which the client obtained the requested URI.
httpHyperText Transfer Protocolreferer_serverreferer_serverq_proto_httpbytesContains the host or the website name of the referrer.
httpHyperText Transfer Protocoluri_fulluri_fullq_proto_httpbytesComplete name (scheme/authority + path + request) of a web resource.
httpHyperText Transfer Protocoluser_agentuser_agentq_proto_httpbytesSoftware used by the client to access the web page.
httpHyperText Transfer Protocolmime_typemime_typeq_proto_httpbytesContent type of the request or the web page.
httpHyperText Transfer Protocolcontent_dispositioncontent_dispositionq_proto_httpbytesInformation related to the disposition of the content present on the web page.
httpHyperText Transfer Protocolmethodmethodq_proto_httpbytesHTTP command sent by the client.
httpHyperText Transfer Protocolproxy_authproxy_authq_proto_httpbytesAuthentication type on the proxy.
httpHyperText Transfer Protocolproxy_loginproxy_loginq_proto_httpbytesLogin used for proxy authentication.
httpHyperText Transfer Protocolproxy_realmproxy_realmq_proto_httpbytesParameter used for proxy authentication.
httpHyperText Transfer Protocolsmb_clientsmb_clientq_proto_httpbytesName of the computer during NTLM authentication (Windows environment).
httpHyperText Transfer Protocolversionversionq_proto_httpbytesProtocol version.
httpHyperText Transfer Protocolserver_agentserver_agentq_proto_httpbytesName of the server software.
httpHyperText Transfer Protocolrttrttq_proto_httpstringServer response time, calculated between the HTTP Request, and the client acknowledgment of the first non-empty HTTP Response packet.
httpHyperText Transfer Protocoldirectorydirectoryq_proto_httpbytesDirectory of the accessed web page.
httpHyperText Transfer Protocolcookiecookieq_proto_httpbytesRaw value of the HTTP Cookie header line, containing the HTTP request cookies.
httpHyperText Transfer Protocolcodecodeq_proto_httpuint32Return code sent by the server.
httpHyperText Transfer Protocolcontent_lencontent_lenq_proto_httpuint64Contains the content length of the HTTP request/response.
httpHyperText Transfer Protocolfilenamefilenameq_proto_httpbytesName of uploaded file. Extracted if Content-Disposition" field has a "filename-parm" ("filename")."
httpHyperText Transfer Protocolheader_rawheader_rawq_proto_httpbytesOne HTTP header line (field and value).
httpHyperText Transfer Protocolauth_usernameauth_usernameq_proto_httpbytesLogin used in the HTTP Authorization request extension for authentication. The supported authentication methods are Basic and Digest.
httpHyperText Transfer Protocolauth_passwordauth_passwordq_proto_httpbytesPassword used in the HTTP request Authorization extension. The only supported authentication method for password extraction is Basic.
httpHyperText Transfer Protocolpart_filenamepart_filenameq_proto_httpbytesName of uploaded file. Extracted if Content-Disposition" field has a "filename-parm" ("filename"). Extracted only if content-type is "multipart"."
httpHyperText Transfer Protocolcontent_encodingcontent_encodingq_proto_httpbytesContains content encoding format.
httpHyperText Transfer Protocolaccept_encodingaccept_encodingq_proto_httpbytesContains the accepted encoding's.
httpHyperText Transfer Protocolntlm_domainntlm_domainq_proto_httpbytesDomain" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
httpHyperText Transfer Protocolntlm_userntlm_userq_proto_httpbytesUser" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
httpHyperText Transfer Protocolntlm_workstationntlm_workstationq_proto_httpbytesWorkstation" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
httpHyperText Transfer Protocolfile_typefile_typeq_proto_httpbytesReceived or sent file content type (prefix-based pattern recognition) exchanged using this protocol.
httpHyperText Transfer Protocoldatedateq_proto_httpbytesContains the date of the response (DATE HTTP header).
httpHyperText Transfer Protocolcontentcontentq_proto_httpbytesMessage content.
httpHyperText Transfer Protocolvideo_codecvideo_codecq_proto_httpbytesVideo Codec.
httpHyperText Transfer Protocolaudio_codecaudio_codecq_proto_httpbytesAudio Codec.
httpHyperText Transfer Protocolntlm_identifierntlm_identifierq_proto_httpbytesNTLM protocol Signature (null-terminated string).
httpHyperText Transfer Protocolntlm_message_typentlm_message_typeq_proto_httpuint32NTLM message type.
httpHyperText Transfer Protocolcontent_typecontent_typeq_proto_httpbytesIndicates the content type of transferred file.
httpHyperText Transfer Protocolheader_private_nameheader_private_nameq_proto_httpbytesOne HTTP header line (field) starting with X-" (private header)."
httpHyperText Transfer Protocolheader_private_valueheader_private_valueq_proto_httpbytesOne HTTP header line (value) starting with X-" (private header)."
httpHyperText Transfer Protocolreferer_fragmentreferer_fragmentq_proto_httpbytesContains the fragment passed with the referrer.
httpHyperText Transfer Protocolreferer_schemereferer_schemeq_proto_httpbytesContains the scheme of the referrer.
http_proxyHyperText Transfer Protocol proxyserverserverq_proto_http_proxybytesNormalized web server name, including lowercase transformation and suffix cleaning. The value is extracted from an absolute URI (if present), or from the Host: header value by default (extracted once per HTTP request).
http_proxyHyperText Transfer Protocol proxyhosthostq_proto_http_proxybytesHost name value extracted from the Host header.
http_proxyHyperText Transfer Protocol proxyuri_fulluri_fullq_proto_http_proxybytesComplete name (scheme/authority + path + request) of a web resource.
http_proxyHyperText Transfer Protocol proxyuser_agentuser_agentq_proto_http_proxybytesName of the software used.
http_proxyHyperText Transfer Protocol proxymethodmethodq_proto_http_proxybytesCommand sent by the client
http_proxyHyperText Transfer Protocol proxyheader_rawheader_rawq_proto_http_proxybytesOne HTTP header line (field and value).
http_proxyHyperText Transfer Protocol proxyheader_nameheader_nameq_proto_http_proxybytesOne HTTP header line (field).
http_proxyHyperText Transfer Protocol proxyheader_valueheader_valueq_proto_http_proxybytesOne HTTP header line (value).
http_proxyHyperText Transfer Protocol proxyheader_statuslineheader_statuslineq_proto_http_proxybytesThe status line, just before the header lines.
http_proxyHyperText Transfer Protocol proxycodecodeq_proto_http_proxyuint32Return code sent by the server.
http_proxyHyperText Transfer Protocol proxyportportq_proto_http_proxyuint32Port containing in HTTP CONNECT request.
http_proxyHyperText Transfer Protocol proxytunneled_applicationtunneled_applicationq_proto_http_proxyuint32This shall be triggered if we can classify based on request CONNECT URI and user-agent, then return the top application ID.
http_proxyHyperText Transfer Protocol proxyprocessing_anomaly_typeprocessing_anomaly_typeq_proto_http_proxybytesDefines the category of the anomaly.
http_proxyHyperText Transfer Protocol proxyheader_end_offsetheader_end_offsetq_proto_http_proxyuint32Offset to the first byte after the last HTTP PROXY Header-line (\r\n included). This is an offset to the '\r' character of the second carriage return.
http_proxyHyperText Transfer Protocol proxyuriuriq_proto_http_proxybytesPartially normalized URL form (path + request) of a web resource, with UNRESERVED percent-encoded characters decoding (RFC3986).
http2HyperText Transfer Protocol version 2frame_lengthframe_lengthq_proto_http2uint32Frame length (not including header).
http2HyperText Transfer Protocol version 2stream_idstream_idq_proto_http2uint32Stream identifier.
http2HyperText Transfer Protocol version 2hosthostq_proto_http2bytesHost name value extracted from the :host header.
http2HyperText Transfer Protocol version 2server_agentserver_agentq_proto_http2bytesName of the server software.
http2HyperText Transfer Protocol version 2locationlocationq_proto_http2bytesDestination address where the client is redirected.
http2HyperText Transfer Protocol version 2refererrefererq_proto_http2bytesSource address from which the client obtained the requested URI.
http2HyperText Transfer Protocol version 2uri_rawuri_rawq_proto_http2bytesComplete name (scheme/authority + path + request) of a web resource.
http2HyperText Transfer Protocol version 2cookiecookieq_proto_http2bytesRaw value of the HTTP Cookie header line, containing the HTTP request cookies.
http2HyperText Transfer Protocol version 2content_dispositioncontent_dispositionq_proto_http2bytesInformation related to the disposition of the content present on the web page.
http2HyperText Transfer Protocol version 2content_lencontent_lenq_proto_http2uint64Contains the content length of the HTTP2 request/response.
http2HyperText Transfer Protocol version 2content_encodingcontent_encodingq_proto_http2bytesContains content encoding format.
http2HyperText Transfer Protocol version 2codecodeq_proto_http2uint32Return code sent by the server.
http2HyperText Transfer Protocol version 2methodmethodq_proto_http2bytesHTTP2 command sent by the client.
http2HyperText Transfer Protocol version 2user_agentuser_agentq_proto_http2bytesSoftware used by the client to access the web page.
http2HyperText Transfer Protocol version 2mime_typemime_typeq_proto_http2bytesContent type of the request or the web page.
http2HyperText Transfer Protocol version 2header_rawheader_rawq_proto_http2bytesOne HTTP2 header line (field and value).
http2HyperText Transfer Protocol version 2datedateq_proto_http2bytesMessage date.
http2HyperText Transfer Protocol version 2decompress_sizedecompress_sizeq_proto_http2uint32Contains length of decompressed data.
icloudiCloud (Apple)serviceserviceq_proto_icloudbytesCurrent service identification string.
identIdentification Protocolserver_portserver_portq_proto_identuint32TCP server's port
identIdentification Protocolclient_portclient_portq_proto_identuint32TCP client's port
imoIMO Video Calling Applicationserviceserviceq_proto_imobytesCurrent service identification string.
imoIMO Video Calling Applicationservice_idservice_idq_proto_imouint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
imoIMO Video Calling Applicationservice_durationservice_durationq_proto_imouint324 bytes integer value indicating, when the service is ended, the length of it in seconds.
imoIMO Video Calling Applicationservice_duration_tvservice_duration_tvq_proto_imostringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
mimpIMP mobile versionattach_filenameattach_filenameq_proto_mimpbytesAttachment name.
mimpIMP mobile versiondatedateq_proto_mimpbytesMessage date.
mimpIMP mobile versionsender_emailsender_emailq_proto_mimpbytesEmail address of the email sender.
mimpIMP mobile versionsubjectsubjectq_proto_mimpbytesMessage subject.
mimpIMP mobile versionreceiver_emailreceiver_emailq_proto_mimpbytesEmail address of message receiver (included cc and bcc receivers).
mimpIMP mobile versionmsglist_subjectmsglist_subjectq_proto_mimpbytesMessage subject in a message list.
mimpIMP mobile versionpasswordpasswordq_proto_mimpbytesUser's password string.
mimpIMP mobile versionloginloginq_proto_mimpbytesUser's login string.
mimpIMP mobile versionactionactionq_proto_mimpbytesIndicates if the message is read (Read) or composed (Compose).
mimpIMP mobile versionattach_sizeattach_sizeq_proto_mimpuint32Attached file MIME size.
icaIndependant Computing Architecture (Citrix)applicationapplicationq_proto_icabytesApplication name used by the client, decoded into UTF-8 format.
icaIndependant Computing Architecture (Citrix)login_infologin_infoq_proto_icabytesLogin information for the given connection (host, username, network domain).
icaIndependant Computing Architecture (Citrix)serviceserviceq_proto_icabytesCurrent service identification string.
icaIndependant Computing Architecture (Citrix)login_info_utf16login_info_utf16q_proto_icabytesLogin information for the given connection (host, username, network domain), in UTF-16 format.
iaxInter Asterisk eXchangepacket_typepacket_typeq_proto_iaxbytesPacket type.
iaxInter Asterisk eXchangetrunk_timestamptrunk_timestampq_proto_iaxuint32Timestamp (in ms) after the start of this call, indicating the time at which this trunk packet was transmitted.
iaxInter Asterisk eXchangetrunk_call_data_offsettrunk_call_data_offsetq_proto_iaxuint32Trunk call data offset in bytes in the UDP Stream.
iaxInter Asterisk eXchangemessage_namemessage_nameq_proto_iaxbytesFor full IAX2 frames, message_name is the name of a frame.
iaxInter Asterisk eXchangesubclass_namesubclass_nameq_proto_iaxbytesThe command string for a message_name" type packet."
iaxInter Asterisk eXchangeelement_nameelement_nameq_proto_iaxbytesName of the information coming from a packet of type Full" whose message_id is "IAX"."
icapInternet Content Adaptation Protocolx_client_ip_respmod_reqx_client_ip_respmod_reqq_proto_icapbytesThe IP source address of the encapsulated HTTP request, when using the X-Client-IP ICAP header extension (draft-stecher-icap-subid-00).
icapInternet Content Adaptation Protocolreferer_respmod_reqreferer_respmod_reqq_proto_icapbytesThe HTTP referer embedded in the ICAP RESPMOD request (see http).
icapInternet Content Adaptation Protocolcontent_type_respmod_reqcontent_type_respmod_reqq_proto_icapbytesThe HTTP content_type embedded in the http response part of the ICAP RESPMOD request (see http).
icapInternet Content Adaptation Protocoluser_agent_respmod_requser_agent_respmod_reqq_proto_icapbytesThe HTTP user_agent embedded in the ICAP RESPMOD request (see http).
icapInternet Content Adaptation Protocolhost_respmod_reqhost_respmod_reqq_proto_icapbytesThe HTTP host embedded in the ICAP RESPMOD request (see http).
icapInternet Content Adaptation Protocoluri_respmod_requri_respmod_reqq_proto_icapbytesThe HTTP uri embedded in the ICAP RESPMOD request (see http).
icapInternet Content Adaptation Protocolmethod_respmod_reqmethod_respmod_reqq_proto_icapbytesThe HTTP method embedded in the ICAP RESPMOD request (see http).
icapInternet Content Adaptation Protocolcode_respmod_reqcode_respmod_reqq_proto_icapuint32The HTTP code embedded in the ICAP RESPMOD request (see http).
icmpInternet Control Message Protocolrttrttq_proto_icmpstringResponse time of a ping command.
icmp6Internet Control Message Protocol for IP6rttrttq_proto_icmp6stringResponse time of a ping command.
icmp6Internet Control Message Protocol for IP6link_layer_addr_typelink_layer_addr_typeq_proto_icmp6uint32Type of link-layer address (source or target).
icmp6Internet Control Message Protocol for IP6link_layer_mac_addrlink_layer_mac_addrq_proto_icmp6stringLink-layer address in MAC format (if applicable).
icmp6Internet Control Message Protocol for IP6link_layer_eui64_addrlink_layer_eui64_addrq_proto_icmp6uint64Link-layer address in EUI64 format (if applicable).
icmp6Internet Control Message Protocol for IP6mtumtuq_proto_icmp6uint32Maximum transmission unit.
igmpInternet Group Management Protocolversionversionq_proto_igmpuint32Protocol version.
igmpInternet Group Management Protocoladdressaddressq_proto_igmpstringMulticast address.
igmpInternet Group Management Protocolrecord_maddressrecord_maddressq_proto_igmpstringThe multicast address in this record
imapInternet Message Access Protocol version 4methodmethodq_proto_imapbytesCommand sent by the client
imapInternet Message Access Protocol version 4server_responseserver_responseq_proto_imapbytesFirst line of every server's tagged response, including pipe lined responses.
imapInternet Message Access Protocol version 4loginloginq_proto_imapbytesUser's login string.
imapInternet Message Access Protocol version 4passwordpasswordq_proto_imapbytesUser's password string.
imapInternet Message Access Protocol version 4subjectsubjectq_proto_imapbytesMessage subject.
imapInternet Message Access Protocol version 4datedateq_proto_imapbytesMessage date.
imapInternet Message Access Protocol version 4sendersenderq_proto_imapbytesFull address of email sender (alias followed by email address).
imapInternet Message Access Protocol version 4receiverreceiverq_proto_imapbytesFull address of email receiver (including cc and bcc receivers).
imapInternet Message Access Protocol version 4msglist_subjectmsglist_subjectq_proto_imapbytesMessage subject in a message list.
imapInternet Message Access Protocol version 4msglist_sendermsglist_senderq_proto_imapbytesFull address of email sender (alias and email address).
imapInternet Message Access Protocol version 4msglist_receivermsglist_receiverq_proto_imapbytesFull address of email receiver in a message list.
imapInternet Message Access Protocol version 4msglist_mime_typemsglist_mime_typeq_proto_imapbytesContent type of the email.
imapInternet Message Access Protocol version 4msglist_attach_mime_typemsglist_attach_mime_typeq_proto_imapbytesContent type of the attachment (in a list).
imapInternet Message Access Protocol version 4msglist_attach_filenamemsglist_attach_filenameq_proto_imapbytesName of file attached to message (in a list).
imapInternet Message Access Protocol version 4user_agentuser_agentq_proto_imapbytesName of the software used.
imapInternet Message Access Protocol version 4attach_filenameattach_filenameq_proto_imapbytesAttachment name.
imapInternet Message Access Protocol version 4file_typefile_typeq_proto_imapbytesReceived or sent file content type (prefix-based pattern recognition) exchanged using this protocol.
imapInternet Message Access Protocol version 4requestrequestq_proto_imapboolParent entry, empty, for client request and server response.
imapInternet Message Access Protocol version 4msglist_entrymsglist_entryq_proto_imapboolParent entry, for different elements belonging to the same message of a message list.
imapInternet Message Access Protocol version 4msglist_attachmsglist_attachq_proto_imapboolParent entry for attached file in a list of emails.
imapInternet Message Access Protocol version 4sender_entrysender_entryq_proto_imapboolParent entry, for different elements belonging to the sender.
imapInternet Message Access Protocol version 4receiver_entryreceiver_entryq_proto_imapboolParent entry, for different elements belonging to the email receiver.
imapInternet Message Access Protocol version 4msglist_sender_entrymsglist_sender_entryq_proto_imapboolParent entry for a sender in a message list.
imapInternet Message Access Protocol version 4msglist_receiver_entrymsglist_receiver_entryq_proto_imapboolParent entry for a receiver in a message list.
imapInternet Message Access Protocol version 4receivedreceivedq_proto_imapboolParent entry, for fields added by each relay
imapInternet Message Access Protocol version 4msg_idmsg_idq_proto_imapbytesIdentifier of the message.
imapInternet Message Access Protocol version 4attach_sizeattach_sizeq_proto_imapuint32Attached file MIME size.
imapInternet Message Access Protocol version 4attach_typeattach_typeq_proto_imapbytesContent type of the sent attached file.
imapInternet Message Access Protocol version 4attach_size_decodedattach_size_decodedq_proto_imapuint32Base64-decoded attached file content size in Bytes.
imapInternet Message Access Protocol version 4email_boundaryemail_boundaryq_proto_imapbytesboundary used to separate different parts of the message body.
imapInternet Message Access Protocol version 4auth_typeauth_typeq_proto_imapbytesThe type of used authentication.
imapInternet Message Access Protocol version 4ntlm_domainntlm_domainq_proto_imapbytesDomain" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
imapInternet Message Access Protocol version 4ntlm_userntlm_userq_proto_imapbytesUser" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
imapInternet Message Access Protocol version 4ntlm_workstationntlm_workstationq_proto_imapbytesWorkstation" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
imapInternet Message Access Protocol version 4ntlm_identifierntlm_identifierq_proto_imapbytesNTLM protocol Signature (null-terminated string).
imapInternet Message Access Protocol version 4ntlm_message_typentlm_message_typeq_proto_imapuint32NTLM message type.
imapInternet Message Access Protocol version 4resent_fromresent_fromq_proto_imapbytesFull address of the person for whom message is resent.
imapInternet Message Access Protocol version 4resent_from_emailresent_from_emailq_proto_imapbytesEmail address of the person for whom message is resent.
imapInternet Message Access Protocol version 4resent_from_aliasresent_from_aliasq_proto_imapbytesName of the person for whom message is resent.
imapInternet Message Access Protocol version 4resent_senderresent_senderq_proto_imapbytesFull address of the person who has actually resent the message.
imapInternet Message Access Protocol version 4resent_sender_emailresent_sender_emailq_proto_imapbytesEmail address of the person who has actually resent the message.
imapInternet Message Access Protocol version 4resent_sender_aliasresent_sender_aliasq_proto_imapbytesName of the person who has actually resent the message.
imapInternet Message Access Protocol version 4msglist_msgidmsglist_msgidq_proto_imapbytesMessage identifier.
imapInternet Message Access Protocol version 4msglist_receiver_typemsglist_receiver_typeq_proto_imapbytesType of the email receiver.
imapInternet Message Access Protocol version 4msglist_boundarymsglist_boundaryq_proto_imapbytesboundary used to separate different parts of the message body.
imapInternet Message Access Protocol version 4msglist_content_transfer_encodingmsglist_content_transfer_encodingq_proto_imapbytesContains the encoding of the content
imapInternet Message Access Protocol version 4msglist_mime_versionmsglist_mime_versionq_proto_imapbytesVersion of the message body format standard used in the mail protocol in a message list.
imapInternet Message Access Protocol version 4msglist_return_pathmsglist_return_pathq_proto_imapbytesReturn path in a message list.
imapInternet Message Access Protocol version 4msglist_resent_frommsglist_resent_fromq_proto_imapbytesFull address of the person for whom message is resent in a message list.
imapInternet Message Access Protocol version 4msglist_resent_from_aliasmsglist_resent_from_aliasq_proto_imapbytesName of the person for whom message is resent in a message list.
imapInternet Message Access Protocol version 4msglist_resent_from_emailmsglist_resent_from_emailq_proto_imapbytesEmail address of the person for whom message is resent in a message list.
imapInternet Message Access Protocol version 4msglist_resent_sendermsglist_resent_senderq_proto_imapbytesFull address of the person who has actually resent the message in a message list.
imapInternet Message Access Protocol version 4msglist_resent_sender_aliasmsglist_resent_sender_aliasq_proto_imapbytesName of the person who has actually resent the message in a message list.
imapInternet Message Access Protocol version 4msglist_resent_sender_emailmsglist_resent_sender_emailq_proto_imapbytesEmail address of the person who has actually resent the message in a message list.
imapInternet Message Access Protocol version 4attach_content_idattach_content_idq_proto_imapbytesAttached file content identifier.
imapInternet Message Access Protocol version 4attach_content_descattach_content_descq_proto_imapbytesDescriptive information for the attached file content.
imapInternet Message Access Protocol version 4content_idcontent_idq_proto_imapbytesIndicates the identifier of the email content.
imapInternet Message Access Protocol version 4content_desccontent_descq_proto_imapbytesIndicates the description of the email content.
imapInternet Message Access Protocol version 4received_byreceived_byq_proto_imapbytesContains the name of the receiving host.
imapInternet Message Access Protocol version 4msglist_received_from_namemsglist_received_from_nameq_proto_imapbytesContains the sending host name
imapInternet Message Access Protocol version 4msglist_received_from_ipmsglist_received_from_ipq_proto_imapstringContains the IP address of the sending host name
imapInternet Message Access Protocol version 4msglist_received_by_namemsglist_received_by_nameq_proto_imapbytesContains the receiving host name
imapInternet Message Access Protocol version 4msglist_received_by_ipmsglist_received_by_ipq_proto_imapstringContains the IP address of the receiving host name
imapInternet Message Access Protocol version 4msglist_received_withmsglist_received_withq_proto_imapbytesContains the software used to send the email
imapInternet Message Access Protocol version 4msglist_received_datemsglist_received_dateq_proto_imapbytesDate when the transport service relayed the message
imapInternet Message Access Protocol version 4msglist_received_bymsglist_received_byq_proto_imapbytesContains the name of the receiving host.
imapInternet Message Access Protocol version 4msglist_received_server_agentmsglist_received_server_agentq_proto_imapbytesContains the name of the sever agent
imapInternet Message Access Protocol version 4mime_versionmime_versionq_proto_imapbytesVersion of the message body format standard used in the mail protocol.
imapInternet Message Access Protocol version 4return_pathreturn_pathq_proto_imapbytesMessage return path.
imapInternet Message Access Protocol version 4server_versionserver_versionq_proto_imapbytesThe version of the IMAP server. It is given by the CAPABILITY command server result.
imapInternet Message Access Protocol version 4flagsflagsq_proto_imapbytesA list of named tokens associated with the message.
imapInternet Message Access Protocol version 4request_linerequest_lineq_proto_imapbytesClient-to-Server IMAP request full line.
imapInternet Message Access Protocol version 4trailertrailerq_proto_imapbytesOptional data found after the advertised size of an email, ending with a ')', in a FETCH response.
imapInternet Message Access Protocol version 4server_response_lineserver_response_lineq_proto_imapbytesFirst line of every server's untagged response, including pipe lined responses.
impInternet Messaging Programattach_sizeattach_sizeq_proto_impuint32Attached file MIME size.
impInternet Messaging Programdatedateq_proto_impbytesMessage date.
impInternet Messaging Programactionactionq_proto_impbytesIndicates if the message is read (Read) or composed (Compose).
impInternet Messaging Programmsglist_receiver_emailmsglist_receiver_emailq_proto_impbytesEmail address of the email receiver.
impInternet Messaging Programsender_emailsender_emailq_proto_impbytesEmail address of the email sender.
impInternet Messaging Programmsglist_subjectmsglist_subjectq_proto_impbytesMessage subject in a message list.
impInternet Messaging Programattach_typeattach_typeq_proto_impbytesContent type of the sent attached file.
impInternet Messaging Programsubjectsubjectq_proto_impbytesMessage subject.
impInternet Messaging Programreceiver_emailreceiver_emailq_proto_impbytesEmail address of message receiver (included cc and bcc receivers).
impInternet Messaging Programattach_filenameattach_filenameq_proto_impbytesAttachment name.
impInternet Messaging Programpasswordpasswordq_proto_impbytesUser's password string.
impInternet Messaging Programloginloginq_proto_impbytesUser's login string.
impInternet Messaging Programsession_idsession_idq_proto_impbytesUniquely identifies the current user session.
impInternet Messaging Programversionversionq_proto_impbytesIMP version deployed.
impInternet Messaging Programmsglist_sender_emailmsglist_sender_emailq_proto_impbytesAddress of email sender.
ippInternet Printing Protocolversionversionq_proto_ippbytesProtocol version.
ipInternet Protocolfragment_buffered_countfragment_buffered_countq_proto_ipuint32Number of segments that have been buffered for defragmentation
ipInternet Protocolfragment_buffered_sizefragment_buffered_sizeq_proto_ipuint32Sizes sum of segments that have been buffered for defragmentation
ircInternet Relay Chatloginloginq_proto_ircbytesUser's login string.
ircInternet Relay Chatlogin_serverlogin_serverq_proto_ircbytesConcatenated login and server: <login>@<server>.
ircInternet Relay Chatnicknamenicknameq_proto_ircbytesUser's alias.
ircInternet Relay Chatserverserverq_proto_ircbytesServer name to which the user is connected.
ircInternet Relay Chatmessagemessageq_proto_ircbytesContains the chat message.
ircInternet Relay Chatsendersenderq_proto_ircbytesContains the identity of the sender of a chat session or a file transfer.
ircInternet Relay Chatreceiverreceiverq_proto_ircbytesContains the identity of the receiver for a chat message or a file transfer.
ircInternet Relay Chatchannelchannelq_proto_ircbytesChat room name.
ircInternet Relay Chatmode_channelmode_channelq_proto_ircbytesName of the irc channel.
ircInternet Relay Chatmode_statusmode_statusq_proto_ircbytesStatus of the irc channel.
ircInternet Relay Chatfilenamefilenameq_proto_ircbytesName of the transferred file.
ircInternet Relay Chatfile_identifierfile_identifierq_proto_ircbytesFile correlation key.
ircInternet Relay Chatfilesizefilesizeq_proto_ircuint32Size (byte) of the transferred file.
isakmpInternet Security Association and Key Management Protocolversionversionq_proto_isakmpbytesProtocol version.
isakmpInternet Security Association and Key Management Protocollife_durationlife_durationq_proto_isakmpuint32Life time of connection parameters.
isupISDN User Partmessage_tsmessage_tsq_proto_isupstringTimestamp of ISUP message
isupISDN User Partmessage_waymessage_wayq_proto_isupbytesWay of message
isupISDN User Partcallercallerq_proto_isupbytesCalling party number
isupISDN User Partcalleecalleeq_proto_isupbytesCalled party number
isupISDN User Partorig_point_codeorig_point_codeq_proto_isupuint32Originating Point Code
isupISDN User Partdest_point_codedest_point_codeq_proto_isupuint32Destination Point Code
isupISDN User Partstart_timestart_timeq_proto_isupstringStart date of the call
isupISDN User Partsession_durationsession_durationq_proto_isupstringCall session duration (elapsed time between the sending of SETUP command and the end of the communication)
isupISDN User Parttime_before_spktime_before_spkq_proto_isupstringWaiting delay before speak
isupISDN User Partcall_setupcall_setupq_proto_isupstringCall setup delay.
isupISDN User Partcall_durationcall_durationq_proto_isupstringCall duration
isupISDN User Partcall_idcall_idq_proto_isupuint64Internal unique call identifier
bmffISO Base Media File Formatvideo_typevideo_typeq_proto_bmffbytesFile format.
bmffISO Base Media File Formatvideo_brandvideo_brandq_proto_bmffbytesNormalized video format specification identifier.
bmffISO Base Media File Formatvideo_durationvideo_durationq_proto_bmffuint32Duration of the video in seconds.
bmffISO Base Media File Formatvideo_widthvideo_widthq_proto_bmffuint32Width of the video in pixels.
bmffISO Base Media File Formatvideo_heightvideo_heightq_proto_bmffuint32Height of the video in pixels.
bmffISO Base Media File Formatvideo_dataratevideo_datarateq_proto_bmffuint32Video bitrate in kilobits per second.
bmffISO Base Media File Formatvideo_avgdataratevideo_avgdatarateq_proto_bmffuint32Average video bitrate in kilobits per second.
java_updateJava Updatetypetypeq_proto_java_updatebytesVersion type of updated Java.
java_updateJava Updatenew_versionnew_versionq_proto_java_updatebytesNew version number returned by the server.
kakaotalkKakaoTalkmime_typemime_typeq_proto_kakaotalkbytesMime type of the file beeing transferred.
kakaotalkKakaoTalkfilenamefilenameq_proto_kakaotalkbytesName of the transferred file.
kakaotalkKakaoTalkloginloginq_proto_kakaotalkuint64User's login string.
kakaotalkKakaoTalkserviceserviceq_proto_kakaotalkbytesCurrent service identification string.
kakaotalkKakaoTalkservice_duration_tvservice_duration_tvq_proto_kakaotalkstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
kakaotalkKakaoTalkservice_durationservice_durationq_proto_kakaotalkuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
kaskusKaskus.co.idquery_textquery_textq_proto_kaskusbytesQuery sent to the search engine.
kaskusKaskus.co.idquery_rawquery_rawq_proto_kaskusbytesContains the query sent to the search engine as indicated in the URL.
kaskusKaskus.co.idtitletitleq_proto_kaskusbytesTitle of the current page.
kazaaKazaa (FastTrack protocol)mime_typemime_typeq_proto_kazaabytesType of the downloaded file.
kazaaKazaa (FastTrack protocol)filenamefilenameq_proto_kazaabytesName of the transferred file.
kazaaKazaa (FastTrack protocol)loginloginq_proto_kazaabytesUser's login string.
krb5Kerberosloginloginq_proto_krb5bytesUser's login string.
krb5Kerberosserviceserviceq_proto_krb5bytesCurrent service identification string.
krb5Kerberosserverserverq_proto_krb5bytesName of the server requiring Kerberos authentication.
krb5Kerberosenc_data_typeenc_data_typeq_proto_krb5uint32Indicate type of Encrypted data (hash) sent in the AS-RQ message.
krb5Kerberospa_data_typepa_data_typeq_proto_krb5uint32PA-DATA type.
krb5Kerberosticket_name_typeticket_name_typeq_proto_krb5uint32Ticket name-type.
krb5Kerberosticket_nameticket_nameq_proto_krb5bytesTicket name component.
krb5Kerberosrealmrealmq_proto_krb5bytesRealm in KRB-ERROR message.
krb5Kerberoserr_crealmerr_crealmq_proto_krb5bytesRealm in KRB-ERROR message.
krb5Kerberoserr_realmerr_realmq_proto_krb5bytesCorrect realm in KRB-ERROR message.
krb5Kerberoserr_cname_typeerr_cname_typeq_proto_krb5uint32KRB-ERROR cname type.
krb5Kerberoserr_cname_nameerr_cname_nameq_proto_krb5bytesKRB-ERROR message cname component.
krb5Kerberoserr_sname_typeerr_sname_typeq_proto_krb5uint32KRB-ERROR message server sname type.
krb5Kerberoserr_sname_nameerr_sname_nameq_proto_krb5bytesKRB-ERROR message server sname component.
krb5Kerberoserr_texterr_textq_proto_krb5bytesKRB-ERROR message error description.
krb5Kerberoserror_codeerror_codeq_proto_krb5uint32Error code in KRB-ERROR message.
krb5Kerberoscname_typecname_typeq_proto_krb5uint32cname type.
krb5Kerberoscname_stringcname_stringq_proto_krb5bytesstring representation of cname.
laposte_webmailLa Poste Webmailloginloginq_proto_laposte_webmailbytesUser's login string.
l2tpLayer 2 Tunneling Protocolhostnamehostnameq_proto_l2tpbytesName of the issuing LAC or LNS.
l2tpLayer 2 Tunneling Protocolvendor_namevendor_nameq_proto_l2tpbytesVendor specific string describing the type of LAC or LNS being used.
ldapLighweight Directory Access Protocolmessage_typemessage_typeq_proto_ldapbytesMessage type.
ldapLighweight Directory Access Protocolmessage_idmessage_idq_proto_ldapuint32Message identification.
ldapLighweight Directory Access Protocolnamenameq_proto_ldapbytesName of the LDAP element, in the LDAP tree (RFC2251).
ldapLighweight Directory Access Protocolhostnamehostnameq_proto_ldapbytesHostname extracted from a logon response to a CLDAP searchRequest.
ldapLighweight Directory Access Protocolkrb5_message_typekrb5_message_typeq_proto_ldapuint32Message type.
ldapLighweight Directory Access Protocolkrb5_servicekrb5_serviceq_proto_ldapbytesService type.
ldapLighweight Directory Access Protocolkrb5_serverkrb5_serverq_proto_ldapbytesName of the server requiring Kerberos authentication.
ldapLighweight Directory Access Protocolkrb5_ticket_namekrb5_ticket_nameq_proto_ldapbytesTicket name component.
ldapLighweight Directory Access Protocolkrb5_realmkrb5_realmq_proto_ldapbytesRealm in KRB-ERROR message.
ldapLighweight Directory Access Protocolkrb5_err_cname_namekrb5_err_cname_nameq_proto_ldapbytesKRB-ERROR message cname component.
ldapLighweight Directory Access Protocolkrb5_err_sname_namekrb5_err_sname_nameq_proto_ldapbytesKRB-ERROR message server sname component.
ldapLighweight Directory Access Protocolkrb5_err_textkrb5_err_textq_proto_ldapbytesKRB-ERROR message error description.
ldapLighweight Directory Access Protocolsasl_lensasl_lenq_proto_ldapuint32sasl buffer size in bytes.
lineLineproto_versionproto_versionq_proto_linebytesProtocol version currently used by the client.
lineLinecall_byte_countcall_byte_countq_proto_lineuint32(Deprecated) The count of bytes that were exchanged during the call.
lineLinecall_pkt_countcall_pkt_countq_proto_lineuint32(Deprecated) The count of data packets that were exchanged during the call.
lineLineserviceserviceq_proto_linebytesCurrent service identification string.
lineLineservice_duration_tvservice_duration_tvq_proto_linestringtimeval structure indicating, when the service is ended, the length of it in seconds and microseconds.
lineLineservice_durationservice_durationq_proto_lineuint324 bytes integer value indicating, when the service is ended, the length of it in seconds.
lineLineservice_idservice_idq_proto_lineuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
lineLineservice_statsservice_statsq_proto_linebytesComposite attribute containing the packet metrics used for each new service type detection, extracting when performing STATISTICAL detection method only. Note: this attribute won't be extracted in case of session expiration (eg. when the current service is not ended properly by the user).
lprLine Printer Remoteloginloginq_proto_lprbytesUser's login string.
lprLine Printer Remoteserverserverq_proto_lprbytesName of the machine that sent a file to print.
lprLine Printer Remotejobjobq_proto_lprbytesName of the printed file.
linkedinLinkedInreceiver_emailreceiver_emailq_proto_linkedinbytesEmail address of message receiver (included cc and bcc receivers).
linkedinLinkedInsender_emailsender_emailq_proto_linkedinbytesEmail address of the email sender.
linkedinLinkedInquery_textquery_textq_proto_linkedinbytesQuery sent to the search engine.
linkedinLinkedInfolderfolderq_proto_linkedinbytesIndicates the directory from where messages are read.
linkedinLinkedInsubjectsubjectq_proto_linkedinbytesMessage subject.
linkedinLinkedInmsglist_subjectmsglist_subjectq_proto_linkedinbytesMessage subject in a message list.
linkedinLinkedInmsglist_sendermsglist_senderq_proto_linkedinbytesFull address of email sender (alias and email address).
linkedinLinkedInmsglist_foldermsglist_folderq_proto_linkedinbytesIndicates the directory from a message list.
linkedinLinkedInloginloginq_proto_linkedinbytesUser's login string.
livemail_mobileLive hotmail for mobilereceiver_emailreceiver_emailq_proto_livemail_mobilebytesEmail address of message receiver (included cc and bcc receivers).
livemail_mobileLive hotmail for mobilesender_emailsender_emailq_proto_livemail_mobilebytesEmail address of the email sender.
livemail_mobileLive hotmail for mobileloginloginq_proto_livemail_mobilebytesUser's login string.
livemail_mobileLive hotmail for mobilemsglist_sender_emailmsglist_sender_emailq_proto_livemail_mobilebytesAddress of email sender.
livemail_mobileLive hotmail for mobilemsglist_subjectmsglist_subjectq_proto_livemail_mobilebytesMessage subject in a message list.
livemail_mobileLive hotmail for mobileattach_filenameattach_filenameq_proto_livemail_mobilebytesAttachment name.
livemail_mobileLive hotmail for mobilesubjectsubjectq_proto_livemail_mobilebytesMessage subject.
livemail_mobileLive hotmail for mobileactionactionq_proto_livemail_mobilebytesIndicates if the message is read (Read) or composed (Compose).
livemail_mobileLive hotmail for mobileattach_sizeattach_sizeq_proto_livemail_mobileuint32Attached file MIME size.
lotusnotesLotus Notesloginloginq_proto_lotusnotesbytesUser's login string.
lotusnotesLotus Notesorganizationorganizationq_proto_lotusnotesbytesOrganization.
lotusnotesLotus Notesserviceserviceq_proto_lotusnotesbytesCurrent service identification string.
lotusnotesLotus Notesversionversionq_proto_lotusnotesbytesClient version.
lotusnotesLotus Notessubjectsubjectq_proto_lotusnotesbytesMessage subject.
lotusnotesLotus Notesmime_versionmime_versionq_proto_lotusnotesbytesMIME version.
lotusnotesLotus Notesmsg_idmsg_idq_proto_lotusnotesbytesIdentifier of the message.
lotusnotesLotus Notesreplytoreplytoq_proto_lotusnotesbytesEmail address to use in a reply for this message.
lotusnotesLotus Notesheader_nameheader_nameq_proto_lotusnotesbytesLotusnotes header name (used for the Email service).
lotusnotesLotus Notesheader_valueheader_valueq_proto_lotusnotesbytesLotusnotes header value (used for the Email service).
lotusnotesLotus Notessender_aliassender_aliasq_proto_lotusnotesbytesName of the email sender.
lotusnotesLotus Notessender_emailsender_emailq_proto_lotusnotesbytesEmail address of the email sender.
lotusnotesLotus Notesreceiver_aliasreceiver_aliasq_proto_lotusnotesbytesName of email receiver (included cc and bcc receivers).
lotusnotesLotus Notesreceiver_emailreceiver_emailq_proto_lotusnotesbytesEmail address of message receiver (included cc and bcc receivers).
lotusnotesLotus Notesreceiver_typereceiver_typeq_proto_lotusnotesbytesType of the email receiver.
lotusnotesLotus Notesattach_idattach_idq_proto_lotusnotesbytesAttachment identifier.
lotusnotesLotus Notesattach_filenameattach_filenameq_proto_lotusnotesbytesAttachment name.
lotusnotesLotus Notesattach_sizeattach_sizeq_proto_lotusnotesuint32Attached file MIME size.
lotusnotesLotus Notesattach_compressattach_compressq_proto_lotusnotesbytesThe compression method used for the attached file download.
lotusnotesLotus Notesattach_content_seqattach_content_seqq_proto_lotusnotesuint32Sequence number of a attach file part.
lotusnotesLotus Notesattach_content_sizeattach_content_sizeq_proto_lotusnotesuint32Size of a attach file part.
mplus_messengerM+ Messengerservice_idservice_idq_proto_mplus_messengeruint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
mplus_messengerM+ Messengerserviceserviceq_proto_mplus_messengerbytesCurrent service identification string.
mashareMa-Share.comactionactionq_proto_masharebytesIndicates the action executed by the user.
mashareMa-Share.comfilenamefilenameq_proto_masharebytesName of the transferred file.
mailru_agentMail.ru Agentmsg_receivermsg_receiverq_proto_mailru_agentbytesThe person who chat or voice is done with
mailru_agentMail.ru Agentmsgmsgq_proto_mailru_agentbytesExchanged message during a chat
mailru_agentMail.ru Agentim_actionim_actionq_proto_mailru_agentbytesAction of the user.
mailru_agentMail.ru Agentuseruserq_proto_mailru_agentbytesApplication user name.
mailruMail.ru Webmailsender_emailsender_emailq_proto_mailrubytesEmail address of the email sender.
mailruMail.ru Webmailsubjectsubjectq_proto_mailrubytesMessage subject.
mailruMail.ru Webmailreceiver_emailreceiver_emailq_proto_mailrubytesEmail address of message receiver (included cc and bcc receivers).
mailruMail.ru Webmailmsglist_subjectmsglist_subjectq_proto_mailrubytesMessage subject in a message list.
mailruMail.ru Webmailmsglist_receiver_emailmsglist_receiver_emailq_proto_mailrubytesEmail address of the email receiver.
mailruMail.ru Webmailmsglist_sender_emailmsglist_sender_emailq_proto_mailrubytesAddress of email sender.
mailruMail.ru Webmailloginloginq_proto_mailrubytesUser's login string.
mailruMail.ru Webmailattach_filenameattach_filenameq_proto_mailrubytesAttachment name.
mailruMail.ru Webmailactionactionq_proto_mailrubytesIndicates if the message is read (Read) or composed (Compose).
mandriva_updateMandriva Updatepackage_namepackage_nameq_proto_mandriva_updatebytesName of the downloaded package.
mandriva_updateMandriva Updatepackage_versionpackage_versionq_proto_mandriva_updatebytesVersion number of the downloaded package.
mandriva_updateMandriva Updatepackage_archipackage_archiq_proto_mandriva_updatebytesArchi of package.
mandriva_updateMandriva Updatepackage_distribpackage_distribq_proto_mandriva_updatebytesVersion of the currently upgraded-distribution
mms_isoManufacturing Message Specification (ISO 9506 )service_tagservice_tagq_proto_mms_isouint32Returns the decimal value of the Encoded Tag" indicating which service/function is called (read,write, ...). See table "MMS Confirmed Services TAG" in http://www.c-epc.com/Technological%20data/mms/Mmsenc3.pdf."
mms_isoManufacturing Message Specification (ISO 9506 )service_rawservice_rawq_proto_mms_isouint32Returns the raw value of the Encoded Tag" (ASN1) indicating which service/function is called (read,write, ...). See table "MMS Confirmed Services TAG" in http://www.c-epc.com/Technological%20data/mms/Mmsenc3.pdf"
mgcpMedia Gateway Control Protocolmethodmethodq_proto_mgcpbytesThe command
mgcpMedia Gateway Control Protocolendpointendpointq_proto_mgcpbytesHandset identifier
mgcpMedia Gateway Control Protocolversionversionq_proto_mgcpbytesProtocol version
mgcpMedia Gateway Control Protocoltidtidq_proto_mgcpuint32Transaction identifier
mgcpMedia Gateway Control Protocolcodecodeq_proto_mgcpuint32Return code of a query
mgcpMedia Gateway Control Protocolpackets_sentpackets_sentq_proto_mgcpuint32Number of RTP packets sent
mgcpMedia Gateway Control Protocoloctets_sentoctets_sentq_proto_mgcpuint32Number of RTP octets sent
mgcpMedia Gateway Control Protocolpackets_receivedpackets_receivedq_proto_mgcpuint32Number of RTP packets received
mgcpMedia Gateway Control Protocoloctets_receivedoctets_receivedq_proto_mgcpuint32Number of RTP octets received
mgcpMedia Gateway Control Protocolpackets_lostpackets_lostq_proto_mgcpuint32Number of lost RTP packets
mgcpMedia Gateway Control Protocoljitterjitterq_proto_mgcpuint32Observed Jitter for RTP packets
mgcpMedia Gateway Control Protocollatencylatencyq_proto_mgcpuint32Observed latency for RTP packets
mgcpMedia Gateway Control Protocolcall_durationcall_durationq_proto_mgcpstringCall duration.
mgcpMedia Gateway Control Protocolsession_durationsession_durationq_proto_mgcpstringCall setup duration.
mgcpMedia Gateway Control Protocolphone_numberphone_numberq_proto_mgcpbytesThe phone number.
mgcpMedia Gateway Control Protocoleventeventq_proto_mgcpbytesObserved events
mgcpMedia Gateway Control Protocolmessage_typemessage_typeq_proto_mgcpbytesThe message type
mgcpMedia Gateway Control Protocolcall_waycall_wayq_proto_mgcpbytesThe call Way (In, Out)
mgcpMedia Gateway Control Protocolstart_timestart_timeq_proto_mgcpstringStart date of the call.
mgcpMedia Gateway Control Protocolmodemodeq_proto_mgcpbytesContains the connection mode (sendrcv, recvonly, ...)
mgcpMedia Gateway Control ProtocolnotifiedEntitynotifiedentityq_proto_mgcpbytesContains the identity of the notified identity
mgcpMedia Gateway Control Protocolmedia_typemedia_typeq_proto_mgcpbytesContains the media type.
mgcpMedia Gateway Control Protocolmedia_protomedia_protoq_proto_mgcpbytesProtocol used in client stream.
mgcpMedia Gateway Control Protocolmedia_formatmedia_formatq_proto_mgcpuint32Client's protocol formats available.
mgcpMedia Gateway Control Protocolsignalsignalq_proto_mgcpbytesContains the received/sent signal
mgcpMedia Gateway Control Protocoldigitmapdigitmapq_proto_mgcpbytesContains the digitmap
mgcpMedia Gateway Control Protocolcallercallerq_proto_mgcpbytesContains the identity (or the phone number) of the initiator of the call.
mgcpMedia Gateway Control Protocolcalleecalleeq_proto_mgcpbytesContains the identity (or the phone number) of the called party for a call.
mgcpMedia Gateway Control Protocolconnection_idconnection_idq_proto_mgcpbytesConnection identifier
mgcpMedia Gateway Control Protocolmedia_attr_typemedia_attr_typeq_proto_mgcpuint32Contains the media type (audio or video).
mgcpMedia Gateway Control Protocolmedia_attr_encodingmedia_attr_encodingq_proto_mgcpbytesThe encoding of media data.
mgcpMedia Gateway Control Protocolmedia_attr_ratemedia_attr_rateq_proto_mgcpbytesThe encoding rate.
mgcpMedia Gateway Control Protocolmedia_attr_parammedia_attr_paramq_proto_mgcpbytesSession attribute value.
mgcpMedia Gateway Control Protocolmedia_attr_labelmedia_attr_labelq_proto_mgcpbytesName of the described session attribute.
mgcpMedia Gateway Control Protocolmedia_attr_addrmedia_attr_addrq_proto_mgcpstringThe mentioned IPv4 address to be used.
mgcpMedia Gateway Control Protocolmedia_attr_channelmedia_attr_channelq_proto_mgcpbytesThe channel value.
mgcpMedia Gateway Control Protocolmedia_attr_transportmedia_attr_transportq_proto_mgcpbytesThe transport protocol (TCP or UDP).
mgcpMedia Gateway Control Protocolmedia_attr_valuemedia_attr_valueq_proto_mgcpbytesLine value of the media attribute.
mgcpMedia Gateway Control Protocolcall_idcall_idq_proto_mgcpbytesCall id, extracted for each call.
msrpMessage Session Relay Protocolsession_idsession_idq_proto_msrpbytesUniquely identifies the current user session.
msrpMessage Session Relay Protocolauthorityauthorityq_proto_msrpbytesThe authority component of the MSRP URI.
msrpMessage Session Relay Protocoluriuriq_proto_msrpbytesThe MSRP URI.
msrpMessage Session Relay Protocolpath_typepath_typeq_proto_msrpbytespath_entry attribute type.
mmsMicrosoft Multimedia Streamingfilenamefilenameq_proto_mmsbytesName of the file currently broadcasted.
lyncMicrosoft Skype for Business (Desktop)service_idservice_idq_proto_lyncuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
lyncMicrosoft Skype for Business (Desktop)serviceserviceq_proto_lyncbytesCurrent service identification string.
ms_teamsMicrosoft teamsserviceserviceq_proto_ms_teamsbytesCurrent service identification string, v5 only.
ms_teamsMicrosoft teamsservice_idservice_idq_proto_ms_teamsuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer), v5 only.
ms_teamsMicrosoft teamsservice_durationservice_durationq_proto_ms_teamsuint324 bytes integer value indicating, when the service is ended, the length of it in seconds, v5 only.
ms_teamsMicrosoft teamsservice_duration_tvservice_duration_tvq_proto_ms_teamsstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds, v5 only.
modbusModbusprotocol_idprotocol_idq_proto_modbusuint32Protocol ID. Modbus protocol is identified by the value 0.
modbusModbuslengthlengthq_proto_modbusuint32The length field is a byte count of the following fields, including the Unit Identifier and data fields.
modbusModbustransaction_idtransaction_idq_proto_modbusuint32Transaction Identifier set by the client to uniquely identify each request. Used for transaction pairing.
modbusModbusfunction_subcodefunction_subcodeq_proto_modbusuint32The function subcode specifies the modbus function_code action.
modbusModbusstarting_addressstarting_addressq_proto_modbusuint32The data address of the first coil or register.
modbusModbusquantity_of_coilsquantity_of_coilsq_proto_modbusuint32Total number of coils requested.
modbusModbusoutput_addressoutput_addressq_proto_modbusuint32The data address of the coil or register.
modbusModbusoutput_valueoutput_valueq_proto_modbusuint32Value to write.
modbusModbusquantity_of_outputsquantity_of_outputsq_proto_modbusuint32The number of coils or registers to write.
modbusModbusbyte_countbyte_countq_proto_modbusuint32The number of data bytes to follow.
modbusModbusfile_numberfile_numberq_proto_modbusuint32Identifier of the file.
modbusModbusrecord_numberrecord_numberq_proto_modbusuint32Starting record number within the file.
modbusModbusrecord_lengthrecord_lengthq_proto_modbusuint32The length of the record to be read.
modbusModbusreference_addressreference_addressq_proto_modbusuint32Address of the reference.
modbusModbusand_maskand_maskq_proto_modbusuint32AND mask applied when writing the data of the register.
modbusModbusor_maskor_maskq_proto_modbusuint32OR mask applied when writing the data of the register.
modbusModbusfifo_pointer_addressfifo_pointer_addressq_proto_modbusuint32Queue content address.
modbusModbusfifo_countfifo_countq_proto_modbusuint32Quantity of data registers in the queue.
modbusModbusoutput_dataoutput_dataq_proto_modbusuint32Exception status outputs, packed into one byte (one bit per output).
modbusModbusstatusstatusq_proto_modbusuint32Response status word.
modbusModbusevent_countevent_countq_proto_modbusuint32Event counter.
modbusModbusmessage_countmessage_countq_proto_modbusuint32Quantity of messages processed by the remote device.
modbus_rtuModbus Remote Terminal Unitslave_addrslave_addrq_proto_modbus_rtuuint32Value of slave address field.
modbus_rtuModbus Remote Terminal Unitcrccrcq_proto_modbus_rtuuint32CRC Checksum field.
mongodbMongodb Protocolrequest_message_lengthrequest_message_lengthq_proto_mongodbuint32Mongodb request length
mongodbMongodb Protocolrequest_request_idrequest_request_idq_proto_mongodbuint32Unique identifiant of the request
mongodbMongodb Protocolrequest_response_idrequest_response_idq_proto_mongodbuint32Unique identifiant of the response
mongodbMongodb Protocolrequest_op_coderequest_op_codeq_proto_mongodbuint32Type of message
mongodbMongodb Protocolresponse_message_lengthresponse_message_lengthq_proto_mongodbuint32Mongodb response length
mongodbMongodb Protocolresponse_request_idresponse_request_idq_proto_mongodbuint32Unique identifiant of the response
mongodbMongodb Protocolresponse_response_idresponse_response_idq_proto_mongodbuint32Unique identifiant of the request
mongodbMongodb Protocolresponse_op_coderesponse_op_codeq_proto_mongodbuint32Type of message
mountMountflavorflavorq_proto_mountuint32Authentification supported by the server
mountMountflavorsflavorsq_proto_mountuint32Number of authentification flavors supported by the server
mountMountlength_fhandlelength_fhandleq_proto_mountuint32Length of the file handle
mountMountstatusstatusq_proto_mountuint32Information status on the request process.
mountMountpath_valuepath_valueq_proto_mountbytesValue of the data path string.
mountMountpath_lengthpath_lengthq_proto_mountuint32Length of the data path string.
mpegtsMPEG-Transport Streamchunk_lenchunk_lenq_proto_mpegtsuint32Data length.
mqttMQ Telemetry Transportprotocol_nameprotocol_nameq_proto_mqttbytesName of the protocol encoded in UTF-8. Should not contain NULL character.
mqttMQ Telemetry Transportclient_idclient_idq_proto_mqttbytesClient identifier. In MQTT 3.1 it cannot exceed 23 bytes while in 3.1.1 it can exceed this limit but will be limited to 65536 bytes as any other string value of MQTT.
mqttMQ Telemetry Transporttopictopicq_proto_mqttbytesName of the topic to which the client subscribes.
mapiMS Exchange Message APIloginloginq_proto_mapibytesUser's login string.
mapiMS Exchange Message APIlogin_serverlogin_serverq_proto_mapibytesConcatenated login and server: <login>@<server>.
mapiMS Exchange Message APIhosthostq_proto_mapibytesClient's hostname.
mapiMS Exchange Message APIdomaindomainq_proto_mapibytesNetwork domain of the client.
mapiMS Exchange Message APIactionactionq_proto_mapibytesIndicates if the message is read (Read) or composed (Compose).
mapiMS Exchange Message APIattach_sizeattach_sizeq_proto_mapiuint32Attached file MIME size.
mapiMS Exchange Message APIattach_filenameattach_filenameq_proto_mapibytesAttachment name (UTF-16).
mapiMS Exchange Message APImsg_idmsg_idq_proto_mapibytesIdentifier of the message.
msnMSN Messengerloginloginq_proto_msnbytesUser's login string.
msnMSN Messengersendersenderq_proto_msnbytesContains the identity of the sender of a chat session or a file transfer.
msnMSN Messengerreceiverreceiverq_proto_msnbytesContains the identity of the receiver for a chat message or a file transfer.
msnMSN Messengermessagemessageq_proto_msnbytesContains the chat message.
msnMSN Messengerfile_senderfile_senderq_proto_msnbytesContains the identity of the sender of a file transfer.
msnMSN Messengerfile_receiverfile_receiverq_proto_msnbytesContains the identity of the receiver for a file transfer.
msnMSN Messengerfilenamefilenameq_proto_msnbytesName of the transferred file.
msnMSN Messengercontact_logincontact_loginq_proto_msnbytesContact login.
msn_searchMSN Searchquery_textquery_textq_proto_msn_searchbytesQuery sent to the search engine.
msn_searchMSN Searchquery_rawquery_rawq_proto_msn_searchbytesContains the query sent to the search engine as indicated in the URL.
mmseMultiMedia Messages Encapsulationreceiverreceiverq_proto_mmsebytesMMS receiver.
mmseMultiMedia Messages Encapsulationnb_receivernb_receiverq_proto_mmseuint32Number of receiver for the same MMS.
mmseMultiMedia Messages Encapsulationversionversionq_proto_mmsebytesProtocol version.
mmseMultiMedia Messages Encapsulationtidtidq_proto_mmsebytesTransaction identifier.
mmseMultiMedia Messages Encapsulationsendersenderq_proto_mmsebytesMMS sender.
mmseMultiMedia Messages Encapsulationsubjectsubjectq_proto_mmsebytesMMS subject.
mmseMultiMedia Messages Encapsulationcontent_typecontent_typeq_proto_mmsebytesThe content type of the message.
mmseMultiMedia Messages Encapsulationmessage_idmessage_idq_proto_mmsebytesA unique reference assigned to the message. The ID enables a client to match delivery reports with previously sent messages.
mmseMultiMedia Messages Encapsulationcontent_locationcontent_locationq_proto_mmsebytesSpecifies a reference to the stored version of the MM that can be retrieved or can be used to obtain information about the MM using the WSP/HTTP GET or M-Mbox-View-req.
mmseMultiMedia Messages Encapsulationresponse_status_coderesponse_status_codeq_proto_mmseuint32It is used by the originating MMS Proxy-Relay to inform the MMS Client, which has performed a submission or a forward the result of that particular operation.
mmseMultiMedia Messages Encapsulationresponse_status_textresponse_status_textq_proto_mmsebytesDescription which qualifies the response_status_code. The description may be based on the on the status code names contained in RFC1893.
mmseMultiMedia Messages Encapsulationmessage_szmessage_szq_proto_mmseuint32Full size of message in octets.
mmseMultiMedia Messages Encapsulationcontent_part_typecontent_part_typeq_proto_mmsebytesMessage sub-part type.
mmseMultiMedia Messages Encapsulationcontent_part_idcontent_part_idq_proto_mmsebytesMessage sub-part ID.
mmseMultiMedia Messages Encapsulationcontent_part_filenamecontent_part_filenameq_proto_mmsebytesName of the file containing the current message sub-part data.
muteMutepeer_infopeer_infoq_proto_muteuint32Structure containing a classification prediction of a network peer. The clep_peer_t structure (ixE 4.18.x) provides the IP v4 or v6 address (ul3l4_addr_t), the transport protocol ID (TCP/UDP/etc.), the listening port, and the list of protocols to be classified in case of successful prediction.
myspaceMySpace.comquery_rawquery_rawq_proto_myspacebytesContains the query sent to the search engine as indicated in the URL.
myspaceMySpace.comquery_textquery_textq_proto_myspacebytesQuery sent to the search engine.
myspaceMySpace.comloginloginq_proto_myspacebytesUser's login string.
mysqlMySQL Protocolloginloginq_proto_mysqlbytesUser's login string.
mysqlMySQL Protocolbasebaseq_proto_mysqlbytesDatabase name.
mysqlMySQL Protocolqueryqueryq_proto_mysqlbytesSQL query sent by the client.
mysqlMySQL Protocolsqlstate_codesqlstate_codeq_proto_mysqlbytesSQL error code.
mysqlMySQL Protocolquery_idquery_idq_proto_mysqlbytesRequest identifier. It is used to correlate SQL queries with query parameter values (Bind Variables).
mysqlMySQL Protocolnumber_columnsnumber_columnsq_proto_mysqluint64Column count in the result data set retrieved from server after a SQL query.
mysqlMySQL Protocolnumber_rowsnumber_rowsq_proto_mysqluint32Row count in the result data set retrieved from server after a SQL query.
mysqlMySQL Protocolvariable_idvariable_idq_proto_mysqlbytesQuery parameter (Bind Variable) identifier within a SQL request.
mysqlMySQL Protocolvariable_typevariable_typeq_proto_mysqlbytesData type of a SQL query parameter (Bind Variable).
mysqlMySQL Protocolerrorerrorq_proto_mysqlbytesError message associated to a request.
mysqlMySQL Protocolerror_codeerror_codeq_proto_mysqluint32Error code associated to a request.
netbiosNetbioscallercallerq_proto_netbiosbytesName of the caller.
netbiosNetbioscalleecalleeq_proto_netbiosbytesName of the called member.
nbnsNetbios Name Serviceserviceserviceq_proto_nbnsbytesCurrent service identification string.
nbnsNetbios Name Servicequeryqueryq_proto_nbnsbytesQueried name (QUESTION_NAME) in a request.
nbnsNetbios Name Servicetransaction_idtransaction_idq_proto_nbnsuint32Name service transaction identifier.
nbnsNetbios Name Servicemessage_typemessage_typeq_proto_nbnsbytesNBNS message type.
nbnsNetbios Name Servicerecord_namerecord_nameq_proto_nbnsbytesFirst answered resource record name (RR_NAME) in a response.
netbsd_updateNetBSD Updatespackage_namepackage_nameq_proto_netbsd_updatebytesSoftware package name.
netflixNetflix.comloginloginq_proto_netflixbytesUser's login string.
netflixNetflix.comtitletitleq_proto_netflixbytesTitle of the movie.
netflixNetflix.comdescriptiondescriptionq_proto_netflixbytesSynopsis of the movie.
netlogNetlog.comloginloginq_proto_netlogbytesUser's login string.
nfsNetwork File Systemversionversionq_proto_nfsbytesUsed version
nfsNetwork File Systemfilenamefilenameq_proto_nfsbytesAccessed, written or read file name.
nfsNetwork File Systemoffsetoffsetq_proto_nfsuint64Offset of the written/read file. Extracted on READ and WRITE procedure replies.
nfsNetwork File Systemfilesizefilesizeq_proto_nfsuint64Size of the file.
nfsNetwork File Systemuiduidq_proto_nfsuint32Generic user ID.
nfsNetwork File Systemgidgidq_proto_nfsuint32Identifier of the file owner's group (see page 21 of RFC 1813).
nfsNetwork File Systemmodemodeq_proto_nfsuint32Protection mode bits (see page 22 of RFC 1813).
nfsNetwork File Systemtype_stringtype_stringq_proto_nfsbytesFile type (see page 19 of RFC 1813).
nfsNetwork File Systemcurrent_statecurrent_stateq_proto_nfsbytesIndicate RENAME procedure filename state.
nfsNetwork File Systemsymlink_namesymlink_nameq_proto_nfsbytesIndicate the symbolic link name on SYMLINK procedure.
nfs4Network File System version 4.0filenamefilenameq_proto_nfs4bytesAccessed, written or read file name. Extracted on operations CREATE, OPEN, READDIR, RENAME, REMOVE, LOOKUP, SECINFO
nfs4Network File System version 4.0filesizefilesizeq_proto_nfs4uint64Size of the file.
nfs4Network File System version 4.0symlink_namesymlink_nameq_proto_nfs4bytesIndicate the symbolic link name on operations LINK and READLINK.
nfs4Network File System version 4.0modemodeq_proto_nfs4uint32Protection mode bits (RFC 7530 section 6.2.2).
nfs4Network File System version 4.0offsetoffsetq_proto_nfs4uint64Offset of the written/read file. Extracted on READ, WRITE, LOCK, LOCKU, LOCKT and COMMIT operations calls.
nntpNetwork News Transport Protocolsendersenderq_proto_nntpbytesFull address of email sender (alias followed by email address).
nntpNetwork News Transport Protocolnewsgroupnewsgroupq_proto_nntpbytesNewsgroup name.
nntpNetwork News Transport Protocolsubjectsubjectq_proto_nntpbytesMessage subject.
nntpNetwork News Transport Protocolloginloginq_proto_nntpbytesUser's login string.
nntpNetwork News Transport Protocolpasswordpasswordq_proto_nntpbytesUser's password string.
nntpNetwork News Transport Protocolattach_filenameattach_filenameq_proto_nntpbytesAttachment name.
ntpNetwork Time Protocolreference_clockreference_clockq_proto_ntpstringReference clock IP address.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)query_textquery_textq_proto_niconico_dougabytesDecoded query text.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)query_rawquery_rawq_proto_niconico_dougabytesQuery in raw HTML
niconico_dougaNicovideo.jp (aka Nico Nico Douga)video_durationvideo_durationq_proto_niconico_dougabytesDuration of the video in seconds.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)videoidvideoidq_proto_niconico_dougabytesNico nico video identifier.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)tagtagq_proto_niconico_dougabytesVideo tag.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)titletitleq_proto_niconico_dougabytesTitle of the video.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)descriptiondescriptionq_proto_niconico_dougabytesSynopsis of the video.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)datedateq_proto_niconico_dougabytesRelease date of the video.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)nicknamenicknameq_proto_niconico_dougabytesUser nickname.
niconico_dougaNicovideo.jp (aka Nico Nico Douga)loginloginq_proto_niconico_dougabytesUser's login string.
odnoklassnikiOdnoklassniki.rugroup_namegroup_nameq_proto_odnoklassnikibytesName of the group the user has subscribed to.
odnoklassnikiOdnoklassniki.ruloginloginq_proto_odnoklassnikibytesUser's login string.
oovooOovoologinloginq_proto_oovoobytesUser's login string.
ospfOpen Shortest Path Firstnetmasknetmaskq_proto_ospfstringThe network mask associated with this interface.
ospfOpen Shortest Path Firstdead_intervaldead_intervalq_proto_ospfuint32The number of seconds before declaring a silent router down.
ospfOpen Shortest Path Firstdesigned_routerdesigned_routerq_proto_ospfstringThe identity of the Designated Router for this network, in the view of the sending router>.
ospfOpen Shortest Path Firstbackup_routerbackup_routerq_proto_ospfstringThe identity of the Backup Designated Router for this network, in the view of the sending router.
ospfOpen Shortest Path Firstneighborneighborq_proto_ospfstringThe Router IDs of each router from whom valid Hello packets have been seen recently on the network.
ospfOpen Shortest Path Firstls_typels_typeq_proto_ospfuint32The type of the LSA.
ospfOpen Shortest Path Firstls_idls_idq_proto_ospfstringThis field identifies the portion of the internet environment that is being described by the LSA.
ospfOpen Shortest Path Firstls_adv_routerls_adv_routerq_proto_ospfstringThe Router ID of the router that originated the LSA.
ospfOpen Shortest Path Firstls_seq_numberls_seq_numberq_proto_ospfuint32Detects old or duplicate LSAs.
ospfOpen Shortest Path Firstls_netmaskls_netmaskq_proto_ospfstringThe IP address mask for the network.
ospfOpen Shortest Path Firstls_metricls_metricq_proto_ospfuint32The cost of this route.
ospfOpen Shortest Path Firstls_attach_routerls_attach_routerq_proto_ospfstringThe Router IDs of each of the routers attached to the network.
ospfOpen Shortest Path Firstlink_idlink_idq_proto_ospfstringIdentifies the object that this router link connects to.
ospfOpen Shortest Path Firstlink_datalink_dataq_proto_ospfstringFor connections to stub networks, Link Data specifies the network's IP address mask. For unnumbered point-to-point connections, it specifies the interface's MIB-II [Ref8] ifIndex value. For the other link types it specifies the router interface's IP address.
ospfOpen Shortest Path Firstdd_seq_nbrdd_seq_nbrq_proto_ospfuint32Used to sequence the collection of Database Description Packets.
ospfOpen Shortest Path Firstexternal_fwd_addrexternal_fwd_addrq_proto_ospfstringData traffic for the advertised destination will be forwarded to this address.
ospfOpen Shortest Path Firstexternal_route_tagexternal_route_tagq_proto_ospfuint32A 32-bit field attached to each external route.
openbsd_updateOpenBSD Updatespackage_namepackage_nameq_proto_openbsd_updatebytesSoftware package name.
openvpnOpenVPNseqseqq_proto_openvpnuint32Sequence number
opera_updateOpera Updatenew_versionnew_versionq_proto_opera_updatebytesNew version of Opera which will be installed.
opera_updateOpera Updatecurrent_versioncurrent_versionq_proto_opera_updatebytesOpera version currently installed.
orangemailOrange webmailattach_filenameattach_filenameq_proto_orangemailbytesAttachment name.
orangemailOrange webmailreceiver_emailreceiver_emailq_proto_orangemailbytesEmail address of message receiver (included cc and bcc receivers).
orangemailOrange webmailsender_emailsender_emailq_proto_orangemailbytesEmail address of the email sender.
orangemailOrange webmailsubjectsubjectq_proto_orangemailbytesMessage subject.
orangemailOrange webmailactionactionq_proto_orangemailbytesIndicates if the message is read (Read) or composed (Compose).
orangemailOrange webmailmsglist_subjectmsglist_subjectq_proto_orangemailbytesMessage subject in a message list.
orangemailOrange webmailattach_sizeattach_sizeq_proto_orangemailuint32Attached file MIME size.
orangemailOrange webmailloginloginq_proto_orangemailbytesUser's login string.
owaOutlook Web Appmsglist_subjectmsglist_subjectq_proto_owabytesMessage subject in a message list.
owaOutlook Web Appreceiver_emailreceiver_emailq_proto_owabytesEmail address of message receiver (included cc and bcc receivers).
owaOutlook Web Appsender_emailsender_emailq_proto_owabytesEmail address of the email sender.
owaOutlook Web Appattach_filenameattach_filenameq_proto_owabytesAttachment name.
owaOutlook Web Appactionactionq_proto_owabytesIndicates if the message is read (Read) or composed (Compose).
owaOutlook Web Appsession_idsession_idq_proto_owabytesUniquely identifies the current user session.
owaOutlook Web Appattach_sizeattach_sizeq_proto_owauint32Attached file MIME size.
owaOutlook Web Apploginloginq_proto_owabytesUser's login string.
owaOutlook Web Appmsglist_receiver_emailmsglist_receiver_emailq_proto_owabytesEmail address of the email receiver.
owaOutlook Web Appmsglist_sender_emailmsglist_sender_emailq_proto_owabytesAddress of email sender.
owaOutlook Web Appsubjectsubjectq_proto_owabytesMessage subject.
paltalkPalTalkuiduidq_proto_paltalkuint32Generic user ID.
paltalkPalTalkloginloginq_proto_paltalkbytesUser's login string.
paltalkPalTalkuser_emailuser_emailq_proto_paltalkbytesUser's email address.
paltalkPalTalkcontact_uidcontact_uidq_proto_paltalkuint32Contact ID.
paltalkPalTalkcontact_logincontact_loginq_proto_paltalkbytesContact login.
paltalkPalTalkchat_idchat_idq_proto_paltalkbytesWindow chat id.
paltalkPalTalkchannelchannelq_proto_paltalkbytesChat room name.
paltalkPalTalkmessagemessageq_proto_paltalkbytesContains the chat message.
paltalkPalTalkencodingencodingq_proto_paltalkbytesMessage encoding.
paltalkPalTalksendersenderq_proto_paltalkbytesContains the identity of the sender of a chat session or a file transfer.
paltalkPalTalkreceiverreceiverq_proto_paltalkbytesContains the identity of the receiver for a chat message or a file transfer.
paltalkPalTalksender_uidsender_uidq_proto_paltalkuint32Message sender's unique identifier.
paltalkPalTalkreceiver_uidreceiver_uidq_proto_paltalkuint32Message receiver's unique identifier.
paltalkPalTalkcall_idcall_idq_proto_paltalkbytesCall id, extracted for each call.
paltalkPalTalkstart_timestart_timeq_proto_paltalkstringStart date of the call.
paltalkPalTalkcallercallerq_proto_paltalkbytesContains the identity (or the phone number) of the initiator of the call.
paltalkPalTalkcaller_uidcaller_uidq_proto_paltalkuint32Caller's unique identifier.
paltalkPalTalkcalleecalleeq_proto_paltalkbytesContains the identity (or the phone number) of the called party for a call.
paltalkPalTalkcallee_uidcallee_uidq_proto_paltalkuint32Callee's unique identifier.
paltalkPalTalkcall_durationcall_durationq_proto_paltalkstringCall duration.
paltalkPalTalkcaller_addrcaller_addrq_proto_paltalkstringAddress which could be used by the initiator of the call.
paltalkPalTalkcallee_addrcallee_addrq_proto_paltalkstringAddress which could be used by the called party.
paltalk_transferPalTalk Transfer Protocolloginloginq_proto_paltalk_transferbytesUser's login string.
paltalk_transferPalTalk Transfer Protocolreceiverreceiverq_proto_paltalk_transferbytesContains the identity of the receiver for a file transfer.
paltalk_transferPalTalk Transfer Protocolsender_uidsender_uidq_proto_paltalk_transferuint32File sender's UID
paltalk_transferPalTalk Transfer Protocolreceiver_uidreceiver_uidq_proto_paltalk_transferuint32File receiver's UID
paltalk_transferPalTalk Transfer Protocolfilenamefilenameq_proto_paltalk_transferbytesName of the transferred file.
paltalk_transferPalTalk Transfer Protocolfilesizefilesizeq_proto_paltalk_transferuint32Size (byte) of the transferred file.
papPassword Authentication Protocolloginloginq_proto_papbytesUser's login string.
papPassword Authentication Protocolpasswordpasswordq_proto_papbytesUser's password string.
papPassword Authentication Protocolmessage_typemessage_typeq_proto_papbytesMessage type.
pcccPC-cubedobject_tnsobject_tnsq_proto_pcccuint32Transaction identifier of the PCCC object coded over 2 bytes, request and related response must share the same TNS value.
pcccPC-cubedrouting_info_dst_linkrouting_info_dst_linkq_proto_pcccuint32Destination link address.
pcccPC-cubedrouting_info_src_linkrouting_info_src_linkq_proto_pcccuint32Source link address.
perforcePerforce Protocolparameter_nameparameter_nameq_proto_perforcebytesName of the perforce parameter.
perforcePerforce Protocolparameter_valueparameter_valueq_proto_perforcebytesValue of the perforce parameter.
perforcePerforce Protocolparameter_sizeparameter_sizeq_proto_perforceuint32Size in bytes of the parameter value.
perfspotPerfspot.comis_mobile_serviceis_mobile_serviceq_proto_perfspotuint32Whether or not the access was made through a mobile device.
perfspotPerfspot.compasswordpasswordq_proto_perfspotbytesUser's password string.
perfspotPerfspot.comloginloginq_proto_perfspotbytesUser's login string.
pptpPoint-to-Point Tunneling Protocolversionversionq_proto_pptpbytesProtocol version.
pptpPoint-to-Point Tunneling Protocolvendorvendorq_proto_pptpbytesThe type of PAC being used, or the type of PNS software being used
pop3Post Office Protocol (Version 3)loginloginq_proto_pop3bytesUser's login string.
pop3Post Office Protocol (Version 3)passwordpasswordq_proto_pop3bytesUser's password string.
pop3Post Office Protocol (Version 3)sender_emailsender_emailq_proto_pop3bytesEmail address of the email sender.
pop3Post Office Protocol (Version 3)sender_aliassender_aliasq_proto_pop3bytesName of the email sender.
pop3Post Office Protocol (Version 3)receiver_emailreceiver_emailq_proto_pop3bytesEmail address of message receiver (included cc and bcc receivers).
pop3Post Office Protocol (Version 3)subjectsubjectq_proto_pop3bytesMessage subject.
pop3Post Office Protocol (Version 3)datedateq_proto_pop3bytesMessage date.
pop3Post Office Protocol (Version 3)mime_typemime_typeq_proto_pop3bytesContent type of received email body.
pop3Post Office Protocol (Version 3)methodmethodq_proto_pop3bytesCommand sent by the client
pop3Post Office Protocol (Version 3)attach_filenameattach_filenameq_proto_pop3bytesAttachment name.
pop3Post Office Protocol (Version 3)attach_typeattach_typeq_proto_pop3bytesContent type of the sent attached file.
pop3Post Office Protocol (Version 3)login_serverlogin_serverq_proto_pop3bytesConcatenated login and server: <login>@<server>.
pop3Post Office Protocol (Version 3)message_idmessage_idq_proto_pop3bytesA unique identifier of the message.
pop3Post Office Protocol (Version 3)user_agentuser_agentq_proto_pop3bytesName of the software used.
pop3Post Office Protocol (Version 3)sender_entrysender_entryq_proto_pop3boolParent entry, for different elements belonging to the sender.
pop3Post Office Protocol (Version 3)receiver_entryreceiver_entryq_proto_pop3boolParent entry, for different elements belonging to the email receiver.
pop3Post Office Protocol (Version 3)requestrequestq_proto_pop3boolParent entry, empty, for client request and server response.
pop3Post Office Protocol (Version 3)receivedreceivedq_proto_pop3boolParent entry, for fields added by each relay
pop3Post Office Protocol (Version 3)content_typecontent_typeq_proto_pop3bytesIndicates the content type of transferred file.
pop3Post Office Protocol (Version 3)content_languagecontent_languageq_proto_pop3bytesLanguage of message content.
pop3Post Office Protocol (Version 3)attach_filename_cdispoattach_filename_cdispoq_proto_pop3bytesAttachment name. The attachment name is extracted from 'Content-Disposition' field.
pop3Post Office Protocol (Version 3)attach_sizeattach_sizeq_proto_pop3uint32Attached file MIME size.
pop3Post Office Protocol (Version 3)attach_size_decodedattach_size_decodedq_proto_pop3uint32Base64-decoded attached file content size in Bytes.
pop3Post Office Protocol (Version 3)email_boundaryemail_boundaryq_proto_pop3bytesboundary used to separate different parts of the message body.
pop3Post Office Protocol (Version 3)resent_fromresent_fromq_proto_pop3bytesFull address of the person for whom message is resent.
pop3Post Office Protocol (Version 3)resent_from_emailresent_from_emailq_proto_pop3bytesEmail address of the person for whom message is resent.
pop3Post Office Protocol (Version 3)resent_from_aliasresent_from_aliasq_proto_pop3bytesName of the person for whom message is resent.
pop3Post Office Protocol (Version 3)resent_senderresent_senderq_proto_pop3bytesFull address of the person who has actually resent the message.
pop3Post Office Protocol (Version 3)resent_sender_emailresent_sender_emailq_proto_pop3bytesEmail address of the person who has actually resent the message.
pop3Post Office Protocol (Version 3)resent_sender_aliasresent_sender_aliasq_proto_pop3bytesName of the person who has actually resent the message.
pop3Post Office Protocol (Version 3)content_idcontent_idq_proto_pop3bytesIndicates the identifier of the email content.
pop3Post Office Protocol (Version 3)content_desccontent_descq_proto_pop3bytesIndicates the description of the email content.
pop3Post Office Protocol (Version 3)attach_content_idattach_content_idq_proto_pop3bytesAttached file content identifier.
pop3Post Office Protocol (Version 3)attach_content_descattach_content_descq_proto_pop3bytesDescriptive information for the attached file content.
pop3Post Office Protocol (Version 3)mime_versionmime_versionq_proto_pop3bytesVersion of the message body format standard used in the mail protocol.
pop3Post Office Protocol (Version 3)return_pathreturn_pathq_proto_pop3bytesMessage return path.
pop3Post Office Protocol (Version 3)received_byreceived_byq_proto_pop3bytesContains the name of the receiving host.
postgresPostgreSQLloginloginq_proto_postgresbytesUser's login string.
postgresPostgreSQLbasebaseq_proto_postgresbytesDatabase name.
postgresPostgreSQLserver_versionserver_versionq_proto_postgresbytesServer version
postgresPostgreSQLproto_versionproto_versionq_proto_postgresbytesProtocol version used
postgresPostgreSQLqueryqueryq_proto_postgresbytesSQL query sent by the client.
postgresPostgreSQLerrorerrorq_proto_postgresbytesError message
postgresPostgreSQLpasswordpasswordq_proto_postgresbytesUser's password string.
postgresPostgreSQLauthentification_typeauthentification_typeq_proto_postgresbytesAuthentication method requested by the server.
postgresPostgreSQLsqlstate_codesqlstate_codeq_proto_postgresbytesSQL error code.
postgresPostgreSQLquery_idquery_idq_proto_postgresbytesRequest identifier. It is used to correlate SQL queries with query parameter values (Bind Variables).
postgresPostgreSQLvariable_idvariable_idq_proto_postgresbytesQuery parameter (Bind Variable) identifier within a SQL request.
postgresPostgreSQLvariable_typevariable_typeq_proto_postgresbytesData type of a SQL query parameter (Bind Variable).
postgresPostgreSQLvariable_formatvariable_formatq_proto_postgresuint32Format of a SQL query parameter (Bind Variable).
pplivePPlivemethodmethodq_proto_pplivebytesContains the method used for a PPLive Live Streaming command
pricerunnerPriceRunnerquery_textquery_textq_proto_pricerunnerbytesQuery sent to the search engine.
pricerunnerPriceRunnerquery_rawquery_rawq_proto_pricerunnerbytesContains the query sent to the search engine as indicated in the URL.
q931Q.931displaydisplayq_proto_q931bytesDisplay name.
q931Q.931call_durationcall_durationq_proto_q931stringCall duration.
q931Q.931setup_delaysetup_delayq_proto_q931stringCall setup delay
q931Q.931session_durationsession_durationq_proto_q931stringCall setup duration.
q931Q.931callercallerq_proto_q931bytesContains the identity (or the phone number) of the initiator of the call.
q931Q.931calleecalleeq_proto_q931bytesContains the identity (or the phone number) of the called party for a call.
qqQQloginloginq_proto_qqbytesUser's login string.
qqQQversion_codeversion_codeq_proto_qqbytesThe protocol version number used by the client.
qqQQmsg_typemsg_typeq_proto_qquint32QQ command name.
qqQQserviceserviceq_proto_qqbytesCurrent service identification string.
qqQQcallercallerq_proto_qqbytesContains the identity (or the phone number) of the initiator of the call.
qqQQcalleecalleeq_proto_qqbytesContains the identity (or the phone number) of the called party for a call.
qqQQmsg_codemsg_codeq_proto_qquint32(deprecated) QQ command number.
qqQQcall_durationcall_durationq_proto_qqstringCall duration.
qqQQservice_idservice_idq_proto_qquint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
qqQQuser_iduser_idq_proto_qqbytesUnique identifier related to a single user. This attribute is available for clear traffic from Mobile applications, it may be not available for traffic from recent web browsers enforcing use of TLS.
qq_webQQ.comuser_iduser_idq_proto_qq_webbytesUnique identifier related to a single user. This attribute is available for clear traffic from Mobile applications, it may be not available for traffic from recent web browsers enforcing use of TLS.
quakeQuakeserverserverq_proto_quakebytesServer name.
quicquicserver_nameserver_nameq_proto_quicbytesDomain name mentioned in CHLO message.
quicquicuser_agentuser_agentq_proto_quicbytesName of the software used.
qvodQVOD Playerpeer_ippeer_ipq_proto_qvodstringIPv4 address of the QVOD peer.
rambler_webmailRambler webmailattach_filenameattach_filenameq_proto_rambler_webmailbytesAttachment name.
rambler_webmailRambler webmailsubjectsubjectq_proto_rambler_webmailbytesMessage subject.
rambler_webmailRambler webmailactionactionq_proto_rambler_webmailbytesIndicates if the message is read (Read) or composed (Compose).
rambler_webmailRambler webmailmsglist_subjectmsglist_subjectq_proto_rambler_webmailbytesMessage subject in a message list.
rambler_webmailRambler webmailattach_sizeattach_sizeq_proto_rambler_webmailuint32Attached file MIME size.
rambler_webmailRambler webmailreceiver_emailreceiver_emailq_proto_rambler_webmailbytesEmail address of message receiver (included cc and bcc receivers).
rambler_webmailRambler webmailsender_emailsender_emailq_proto_rambler_webmailbytesEmail address of the email sender.
rambler_webmailRambler webmailmsglist_receiver_emailmsglist_receiver_emailq_proto_rambler_webmailbytesEmail address of the email receiver.
rambler_webmailRambler webmailmsglist_sender_emailmsglist_sender_emailq_proto_rambler_webmailbytesAddress of email sender.
rambler_webmailRambler webmaildomaindomainq_proto_rambler_webmailbytesDomain name used for the email address of the user.
rambler_webmailRambler webmailloginloginq_proto_rambler_webmailbytesUser's login string.
ramblerRambler.ruquery_textquery_textq_proto_ramblerbytesQuery sent to the search engine.
ramblerRambler.ruquery_rawquery_rawq_proto_ramblerbytesContains the query sent to the search engine as indicated in the URL.
ramblerRambler.ruloginloginq_proto_ramblerbytesUser's login string.
ramblerRambler.rudomaindomainq_proto_ramblerbytesDomain name used for the login of the user.
rapidshareRapidShare.comactionactionq_proto_rapidsharebytesIndicates the action executed by the user.
rapidshareRapidShare.comfilenamefilenameq_proto_rapidsharebytesName of the transferred file.
rapidshareRapidShare.comfilesizefilesizeq_proto_rapidshareuint32Size (byte) of the transferred file.
rapidshareRapidShare.commethodmethodq_proto_rapidsharebytesHTTP method used for this action.
rapidshareRapidShare.comemail_addressemail_addressq_proto_rapidsharebytesUser email address.
rapidshareRapidShare.comdownload_urldownload_urlq_proto_rapidsharebytesDownloaded file URL.
rtcpReal Time Control Protocolcnamecnameq_proto_rtcpbytesUser name.
rtcpReal Time Control Protocolnamenameq_proto_rtcpbytesComplete user name.
rtcpReal Time Control Protocolemailemailq_proto_rtcpbytesUser's email address.
rtcpReal Time Control Protocolphonephoneq_proto_rtcpbytesUser's phone number.
rtcpReal Time Control Protocolloclocq_proto_rtcpbytesUser's location.
rtcpReal Time Control Protocoltooltoolq_proto_rtcpbytesClient's software.
rtcpReal Time Control Protocolnotenoteq_proto_rtcpbytesUser's comments.
rtcpReal Time Control Protocolrr_jitterrr_jitterq_proto_rtcpuint32Jitter value (in receiver report).
rtcpReal Time Control Protocolrr_cumlostrr_cumlostq_proto_rtcpuint32Contains the cumulative number of lost packets (in receiver reports).
rtcpReal Time Control Protocolrr_ssrc_idrr_ssrc_idq_proto_rtcpuint32Identity of the source that sent the receiver report.
rtcpReal Time Control Protocolssrcssrcq_proto_rtcpuint32Identity of the Synchronization source
rtcpReal Time Control Protocolrr_pkt_sender_ssrcrr_pkt_sender_ssrcq_proto_rtcpuint32The synchronization source identifier for the originator of this Receiver Report packet.
rtcpReal Time Control Protocolrr_highestseqnumrr_highestseqnumq_proto_rtcpuint32highest sequence number received in an RTP data packet from source SSRC_n
rtcpReal Time Control Protocolrr_lsrrr_lsrq_proto_rtcpuint32The middle 32 bits out of 64 in the NTP timestamp
rtcpReal Time Control Protocolrr_dlsrrr_dlsrq_proto_rtcpuint32The delay between receiving the last RR packet from source n and sending reception report block.
rtcpReal Time Control Protocolsr_pkt_sender_ssrcsr_pkt_sender_ssrcq_proto_rtcpuint32The synchronization source identifier for the originator of this Sender Report packet.
rtcpReal Time Control Protocolsr_ntp_ts_mswsr_ntp_ts_mswq_proto_rtcpuint32NTP timestamp, most significant word
rtcpReal Time Control Protocolsr_ntp_ts_lswsr_ntp_ts_lswq_proto_rtcpuint32NTP timestamp, least significant word
rtcpReal Time Control Protocolsr_rtp_tssr_rtp_tsq_proto_rtcpuint32RTP timestamp
rtcpReal Time Control Protocolsr_pkt_countsr_pkt_countq_proto_rtcpuint32The total number of RTP data packets transmitted by the sender
rtcpReal Time Control Protocolsr_octet_countsr_octet_countq_proto_rtcpuint32The total number of payload octets transmitted in RTP
rtcpReal Time Control Protocolsr_ssrc_idsr_ssrc_idq_proto_rtcpuint32The SSRC identifier of the source
rtcpReal Time Control Protocolsr_cumlostsr_cumlostq_proto_rtcpuint32>Contains the cumulative number of lost packets (in sender reports).
rtcpReal Time Control Protocolsr_highestseqnumsr_highestseqnumq_proto_rtcpuint32highest sequence number received in an RTP data packet from source SSRC_n
rtcpReal Time Control Protocolsr_jittersr_jitterq_proto_rtcpuint32Jitter value (in Sender report).
rtcpReal Time Control Protocolsr_lsrsr_lsrq_proto_rtcpuint32The middle 32 bits out of 64 in the NTP timestamp
rtcpReal Time Control Protocolsr_dlsrsr_dlsrq_proto_rtcpuint32The delay between receiving the last SR packet from source n and sending reception report block.
rtmpReal Time Messaging Protocolpage_urlpage_urlq_proto_rtmpbytesURL of the webpage where the audio/video content is streamed.
rtmpReal Time Messaging Protocolstream_urlstream_urlq_proto_rtmpbytesURL of the streamed audio/video.
rtmpReal Time Messaging Protocolapp_nameapp_nameq_proto_rtmpbytesName of the application accessing the streamed content.
rtmpReal Time Messaging Protocolstart_timestart_timeq_proto_rtmpuint32The timestamp of the beginning of the streamed audio/video (in ms).
rtmpReal Time Messaging Protocolstop_timestop_timeq_proto_rtmpuint32The timestamp of the end of the streamed audio/video (in ms).
rtmpReal Time Messaging Protocolencryptionencryptionq_proto_rtmpbytesName of the encryption used.
rtpReal Time Protocolend_sessionend_sessionq_proto_rtpbytesThe end_session attribute is raised at the end of the RTP session
rtpReal Time Protocolcodec_namecodec_nameq_proto_rtpbytesName of the codec.
rtpReal Time Protocolunsequnseqq_proto_rtpuint32Contains the number of miss ordered packets (use sum).
rtpReal Time Protocolssrcssrcq_proto_rtpuint32Identity of the Synchronization source
rtpReal Time Protocoltimestamptimestampq_proto_rtpuint32RTP packet timestamp.
rtpReal Time Protocolmos_sessionmos_sessionq_proto_rtpuint32Standard Mean Opinion Score voice quality indicator. The value is derived from the Rfactor indicator, following the ITU-T G.107.1 wideband Rfactor to MOS equations. The extracted value is multiplied by 1000. The following codecs are supported: PCM, GSM(AMR-NB), G.723.1, G.729-A, EVRC, EVRCB, G.722.2(AMR-WB).
rtpReal Time Protocolrfactorrfactorq_proto_rtpuint32Rfactor indicator value, following the E-model from ITU-T G.107 and G.107.1. The calculation method is valid for narrowband (rfactor<=100) and wideband (rfactor<=129) codecs. The extracted value is multiplied by 1000. The following codecs are supported: PCM, AMR(GSM-FR), AMR-WB(G.722.2), G.723.1, G.729-A, EVRC, EVRCB. AMR and AMR-WB codecs support features multi-bitrate (codec modes) Rfactor evaluation. The codec-specific transmission impairment parameters used to compute the Rfactor were extracted from the ITU-T G.113 recommendation for narrowband codecs (PCM, G.723.1, G.729-A, GSM), and from ITU-T G.113.1 for wideband codecs (G.722.2). Additional equipment related impairment parameters (for G.722.2) were extracted from the Instrumental Estimation of E-Model Parameters For Wideband Speech Codecs study results at EURASIP.
rtpReal Time Protocolsession_durationsession_durationq_proto_rtpstringCall setup duration.
rtpReal Time Protocolcsrccsrcq_proto_rtpuint32Identit(y)(ies) of the source(s) contributing for the payload. There is one csrc per contributing source.
rtpReal Time Protocolparent_call_idparent_call_idq_proto_rtpbytesCall Identifier extracted from SIP/SDP.
rtpReal Time Protocolservice_idservice_idq_proto_rtpuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
rtpReal Time Protocolserviceserviceq_proto_rtpbytesCurrent service identification string.
rtpReal Time Protocolservice_durationservice_durationq_proto_rtpuint324 bytes integer value indicating, when the service is ended, the length of it in seconds.
rtpReal Time Protocolservice_duration_tvservice_duration_tvq_proto_rtpstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
rtspReal Time Streaming Protocoluser_agentuser_agentq_proto_rtspbytesClient's software.
rtspReal Time Streaming Protocolfilenamefilenameq_proto_rtspbytesName of the streamed file.
rtspReal Time Streaming Protocolmethodmethodq_proto_rtspbytesRTSP command sent by the client.
rtspReal Time Streaming Protocolserver_agentserver_agentq_proto_rtspbytesName of the server software.
rtspReal Time Streaming Protocolserverserverq_proto_rtspbytesName of the streaming server.
rtspReal Time Streaming Protocoldirectorydirectoryq_proto_rtspbytesFile directory.
rtspReal Time Streaming Protocolcodecodeq_proto_rtspuint32Server return code.
rtspReal Time Streaming Protocoluriuriq_proto_rtspbytesComplete name (path + filename) of a web resource (truncated at 1503 characters).
rtspReal Time Streaming Protocolurilast64urilast64q_proto_rtspbytesuri last 64 characters of the uri.
rtspReal Time Streaming Protocolurilenurilenq_proto_rtspuint32uri length.
rtspReal Time Streaming Protocoluri_fulluri_fullq_proto_rtspbytesComplete name (path + filename) of a web resource (not truncated).
rtspReal Time Streaming Protocolheader_nameheader_nameq_proto_rtspbytesOne RTSP header line (field).
rtspReal Time Streaming Protocolheader_valueheader_valueq_proto_rtspbytesOne RTSP header line (value).
rtspReal Time Streaming Protocolheader_statuslineheader_statuslineq_proto_rtspbytesThe status line, just before the header lines.
rtspReal Time Streaming Protocolversionversionq_proto_rtspbytesProtocol version.
rtspReal Time Streaming Protocolcseqcseqq_proto_rtspbytesSequence number.
rtspReal Time Streaming Protocolstart_timestart_timeq_proto_rtspstringStart date of the call.
rtspReal Time Streaming Protocolsession_durationsession_durationq_proto_rtspstringCall setup duration.
rtspReal Time Streaming Protocolmedia_attr_valuemedia_attr_valueq_proto_rtspbytesLine value of the media attribute.
rtspReal Time Streaming Protocolmedia_attr_typemedia_attr_typeq_proto_rtspuint32Contains the media type (audio or video).
rtspReal Time Streaming Protocolmedia_attr_encodingmedia_attr_encodingq_proto_rtspbytesThe encoding of media data.
rtspReal Time Streaming Protocolmedia_attr_ratemedia_attr_rateq_proto_rtspbytesThe encoding rate.
rtspReal Time Streaming Protocolmedia_attr_parammedia_attr_paramq_proto_rtspbytesSession attribute value.
rtspReal Time Streaming Protocolmedia_attr_labelmedia_attr_labelq_proto_rtspbytesName of the described session attribute.
rtspReal Time Streaming Protocolmedia_attr_addrmedia_attr_addrq_proto_rtspstringThe mentioned IPv4 address to be used.
rtspReal Time Streaming Protocolmedia_attr_channelmedia_attr_channelq_proto_rtspbytesThe channel value.
rtspReal Time Streaming Protocolmedia_attr_transportmedia_attr_transportq_proto_rtspbytesThe transport protocol (TCP or UDP).
rtspReal Time Streaming Protocolmedia_typemedia_typeq_proto_rtspbytesContains the media type.
rtspReal Time Streaming Protocolmedia_protomedia_protoq_proto_rtspbytesProtocol used in client stream.
rtspReal Time Streaming Protocolmedia_formatmedia_formatq_proto_rtspuint32Client's protocol formats available.
rtspReal Time Streaming Protocoluri_start_offseturi_start_offsetq_proto_rtspuint32Offset to the first URI byte in the stream.
rtspReal Time Streaming Protocoluri_end_offseturi_end_offsetq_proto_rtspuint32Offset to the first byte which is not part of the URI in the stream.
redhat_updateRedHat Updatekernel_namekernel_nameq_proto_redhat_updatebytesKernel package or package linked to the kernel.
redhat_updateRedHat Updatekernel_versionkernel_versionq_proto_redhat_updatebytesVersion number of the kernel package.
redhat_updateRedHat Updatekernel_archikernel_archiq_proto_redhat_updatebytesArchi of package kernel.
redhat_updateRedHat Updatekernel_distribkernel_distribq_proto_redhat_updatebytesDistrib linked to this kernel package.
redhat_updateRedHat Updatepackage_namepackage_nameq_proto_redhat_updatebytesName of the downloaded package.
redhat_updateRedHat Updatepackage_versionpackage_versionq_proto_redhat_updatebytesVersion number of the downloaded package.
redhat_updateRedHat Updatepackage_archipackage_archiq_proto_redhat_updatebytesArchi of package.
redhat_updateRedHat Updatepackage_distribpackage_distribq_proto_redhat_updatebytesDistrib linked to this package.
radiusRemote Authentication Dial-In User Serviceloginloginq_proto_radiusbytesUser-Name (an attribute defined in RFC2865).
radiusRemote Authentication Dial-In User Servicecalling_station_idcalling_station_idq_proto_radiusbytesClient id.
radiusRemote Authentication Dial-In User Serviceframed_ipframed_ipq_proto_radiusstringFramed-IP-Address (an attribute defined in RFC2865).
radiusRemote Authentication Dial-In User Serviceacct_session_idacct_session_idq_proto_radiusbytesAccounting session ID.
radiusRemote Authentication Dial-In User Servicecalled_station_idcalled_station_idq_proto_radiusbytesThe phone number that the user called, using Dialed Number Identification (DNIS) or similar technology.
radiusRemote Authentication Dial-In User Servicenas_idnas_idq_proto_radiusbytesUnique identifier of the NAS originating the Access-Request
radiusRemote Authentication Dial-In User Servicenas_ipnas_ipq_proto_radiusstringIP address of the NAS originating the Access-Request
radiusRemote Authentication Dial-In User Servicenas_portnas_portq_proto_radiusuint32Physical port number of the user on the NAS
radiusRemote Authentication Dial-In User Servicenas_port_typenas_port_typeq_proto_radiusuint32Indicates the type of physical port the network access server (NAS) is using to authenticate the user.
radiusRemote Authentication Dial-In User Servicenas_port_idnas_port_idq_proto_radiusbytesIdentifies the NAS.
radiusRemote Authentication Dial-In User Servicecallback_numbercallback_numberq_proto_radiusbytesContains the dialing string to be used for callback
radiusRemote Authentication Dial-In User Serviceterminate_causeterminate_causeq_proto_radiusuint32This attribute indicates how the session was terminated
radiusRemote Authentication Dial-In User Serviceacct_output_octetsacct_output_octetsq_proto_radiusuint32Indicates how many octets have been sent to the port in the course of delivering this service
radiusRemote Authentication Dial-In User Serviceacct_input_octetsacct_input_octetsq_proto_radiusuint32Indicates how many octets have been received from the port over the course of this service being provided
radiusRemote Authentication Dial-In User Servicesession_timeoutsession_timeoutq_proto_radiusuint32The maximum number of seconds of service to be provided to the user before termination of the session or prompt.
radiusRemote Authentication Dial-In User Serviceidle_timeoutidle_timeoutq_proto_radiusuint32The maximum number of consecutive seconds of idle connection allowed to the user before termination of the session or prompt.
radiusRemote Authentication Dial-In User Servicestart_timestart_timeq_proto_radiusstringIndicates the beginning of the user service.
radiusRemote Authentication Dial-In User Servicestop_timestop_timeq_proto_radiusstringIndicates the end of the user service.
radiusRemote Authentication Dial-In User Serviceframed_ipv6_routeframed_ipv6_routeq_proto_radiusbytesProvides the routing information to be configured for the user on the NAS
radiusRemote Authentication Dial-In User Serviceframed_ipv6_poolframed_ipv6_poolq_proto_radiusbytesContains the name of an assigned pool that SHOULD be used to assign an IPv6 prefix for the user.
radiusRemote Authentication Dial-In User Serviceavp_ipv4avp_ipv4q_proto_radiusstringAn IPv4 address. (CLEP_DATA_IP_ADDR)
radiusRemote Authentication Dial-In User Serviceavp_intavp_intq_proto_radiusuint32An 8, 24 or 32 bits integer value. (CLEP_DATA_UINT32)
radiusRemote Authentication Dial-In User Serviceavp_int64avp_int64q_proto_radiusuint64A 64 bits integer value. (CLEP_DATA_UINT64)
radiusRemote Authentication Dial-In User Serviceavp_vendor_idavp_vendor_idq_proto_radiusuint32SMI Network Management Private Enterprise Code. (CLEP_DATA_UINT32)
radiusRemote Authentication Dial-In User Serviceavp_interface_idavp_interface_idq_proto_radiusuint64IPv6 interface identifier. (CLEP_DATA_UINT64)
radiusRemote Authentication Dial-In User Service3gpp_sgsn_address3gpp_sgsn_addressq_proto_radiusstringIP address of the SGSN
radiusRemote Authentication Dial-In User Service3gpp_sgsn_mcc_mnc3gpp_sgsn_mcc_mncq_proto_radiusuint32MCC and MNC of the SGSN
radiusRemote Authentication Dial-In User Service3gpp_imsi3gpp_imsiq_proto_radiusbytesIMSI for the user
radiusRemote Authentication Dial-In User Serviceframed_ip_netmaskframed_ip_netmaskq_proto_radiusstringFramed-IP-Netmask (an attribute defined in RFC2865).
rdpRemote Desktop Protocol (Windows Terminal Server)versionversionq_proto_rdpbytesRDP Version used.
rdpRemote Desktop Protocol (Windows Terminal Server)client_buildclient_buildq_proto_rdpuint32RDP client build.
rdpRemote Desktop Protocol (Windows Terminal Server)desktop_widthdesktop_widthq_proto_rdpuint32desktop width.
rdpRemote Desktop Protocol (Windows Terminal Server)desktop_heightdesktop_heightq_proto_rdpuint32desktop height.
rdpRemote Desktop Protocol (Windows Terminal Server)hostname_asciihostname_asciiq_proto_rdpbytesClient hostname, in ASCII.
rdpRemote Desktop Protocol (Windows Terminal Server)domain_asciidomain_asciiq_proto_rdpbytesClient domain, in ASCII.
rdpRemote Desktop Protocol (Windows Terminal Server)username_asciiusername_asciiq_proto_rdpbytesClient login, in ASCII.
rdpRemote Desktop Protocol (Windows Terminal Server)default_usernamedefault_usernameq_proto_rdpbytesUser's default login, provided at RDP's client runtime.
rdpRemote Desktop Protocol (Windows Terminal Server)encryptedencryptedq_proto_rdpuint32Indicates if the traffic is encrypted with TLS or CresDDP.
rdpRemote Desktop Protocol (Windows Terminal Server)io_channel_idio_channel_idq_proto_rdpuint32IO channel ID.
rdpRemote Desktop Protocol (Windows Terminal Server)channel_idchannel_idq_proto_rdpuint32Communication channel ID.
rdpRemote Desktop Protocol (Windows Terminal Server)channel_namechannel_nameq_proto_rdpbytesCommunication channel name (An 8-byte array containing a unique 7-character ANSI channel name and a null terminator).
rdpRemote Desktop Protocol (Windows Terminal Server)channel_disabledchannel_disabledq_proto_rdpuint32Tells whether the channel is disabled.
rdpRemote Desktop Protocol (Windows Terminal Server)channel_encrypt_waychannel_encrypt_wayq_proto_rdpbytesTells whether the channel is encrypted.
rdpRemote Desktop Protocol (Windows Terminal Server)channel_prioritychannel_priorityq_proto_rdpbytesChannel priority.
rdpRemote Desktop Protocol (Windows Terminal Server)keyboard_typekeyboard_typeq_proto_rdpuint32The keyboard type.
rdpRemote Desktop Protocol (Windows Terminal Server)keyboard_subtypekeyboard_subtypeq_proto_rdpuint32The keyboard subtype.
rdpRemote Desktop Protocol (Windows Terminal Server)keyboard_function_keykeyboard_function_keyq_proto_rdpuint32The number of function keys on the keyboard.
rdpRemote Desktop Protocol (Windows Terminal Server)ime_filename_asciiime_filename_asciiq_proto_rdpbytesThe input method editor (IME) file name associated with the active input locale, in ASCII.
rdpRemote Desktop Protocol (Windows Terminal Server)client_product_idclient_product_idq_proto_rdpuint32The client product ID.
rdpRemote Desktop Protocol (Windows Terminal Server)serial_numberserial_numberq_proto_rdpuint32Serial number.
rdpRemote Desktop Protocol (Windows Terminal Server)client_dig_product_id_asciiclient_dig_product_id_asciiq_proto_rdpbytesContains a value that uniquely identifies the client, in ASCII.
rdpRemote Desktop Protocol (Windows Terminal Server)server_sec_cert_key_algoserver_sec_cert_key_algoq_proto_rdpuint32Type of algorithm used by certificate key (0x0001 == RSA).
rdpRemote Desktop Protocol (Windows Terminal Server)server_sec_cert_pub_key_magicserver_sec_cert_pub_key_magicq_proto_rdpbytesName of algorithm used by certificate key.
rdpRemote Desktop Protocol (Windows Terminal Server)server_sec_cert_versionserver_sec_cert_versionq_proto_rdpuint32Raw value (32 bits) of version field.
rdpRemote Desktop Protocol (Windows Terminal Server)server_sec_cert_countserver_sec_cert_countq_proto_rdpuint32Number of certificates in the chain.
rdpRemote Desktop Protocol (Windows Terminal Server)color_depthcolor_depthq_proto_rdpuint32Color depth requested by RDP client. RDP specifications mention it must be ignored if post_beta_2_color_depth is raised.
rdpRemote Desktop Protocol (Windows Terminal Server)post_beta_2_color_depthpost_beta_2_color_depthq_proto_rdpuint32Color depth requested by RDP client. RDP specifications mention it must be ignored if high_color_depth is raised.
rdpRemote Desktop Protocol (Windows Terminal Server)high_color_depthhigh_color_depthq_proto_rdpuint32Color depth requested by RDP client.
rloginRemote Loginclient_loginclient_loginq_proto_rloginbytesName of the client host.
rloginRemote Loginserver_loginserver_loginq_proto_rloginbytesUser login.
rloginRemote Loginserver_passwordserver_passwordq_proto_rloginbytesUser password.
rloginRemote Loginterm_typeterm_typeq_proto_rloginbytesTerminal type used to establish the remote session.
rloginRemote Loginspeedspeedq_proto_rloginuint32Connection speed.
rpcRemote Procedure Callprogramprogramq_proto_rpcuint32Program Identifier.
rpcRemote Procedure Callversionversionq_proto_rpcuint32Version of the RPC protocol.
rpcRemote Procedure Callprogram_versionprogram_versionq_proto_rpcuint32Version of the used program over RPC.
rpcRemote Procedure Callprocedureprocedureq_proto_rpcuint32Contains the request used by the application program (NFS, YelloPages, ...).
rpcRemote Procedure Callstatestateq_proto_rpcuint32Status of the command response.
rpcRemote Procedure Callxidxidq_proto_rpcuint32Identifier of the request or the reply.
rpcRemote Procedure Callmessage_typemessage_typeq_proto_rpcbytesMessage type (Call or Reply).
rshRemote Shellloginloginq_proto_rshbytesUser's login string.
rshRemote Shellserverserverq_proto_rshbytesRemote server.
rsyncRemote synchronous (file transfer)modulemoduleq_proto_rsyncbytesName of the group in which files are gathered.
rsyncRemote synchronous (file transfer)loginloginq_proto_rsyncbytesUser's login string.
rsyncRemote synchronous (file transfer)passwordpasswordq_proto_rsyncbytesUser's password string.
rsyncRemote synchronous (file transfer)filenamefilenameq_proto_rsyncbytesName of the transferred file.
rsyncRemote synchronous (file transfer)filesizefilesizeq_proto_rsyncuint32Size (byte) of the transferred file.
rsyncRemote synchronous (file transfer)file_is_compressedfile_is_compressedq_proto_rsyncuint32Tells whether a file is compressed or not.
rsyncRemote synchronous (file transfer)file_chunk_numberfile_chunk_numberq_proto_rsyncuint32Number of the transferred piece.
rsyncRemote synchronous (file transfer)file_chunk_lenfile_chunk_lenq_proto_rsyncuint32Size of the transferred piece.
rsyncRemote synchronous (file transfer)file_chunk_data_offsetfile_chunk_data_offsetq_proto_rsyncuint32Offset of the transferred data.
rip2Routing Information Protocol V2ip_addrip_addrq_proto_rip2stringIP address of a router.
rip2Routing Information Protocol V2next_hopenext_hopeq_proto_rip2stringThe immediate next hop IP address to which packets to the destination specified by this route entry should be forwarded.
rip2Routing Information Protocol V2netmasknetmaskq_proto_rip2stringThe Subnet Mask field contains the subnet mask which is applied to the IP address to yield the non-host portion of the address.
rip2Routing Information Protocol V2metricmetricq_proto_rip2uint32Total distance to a router.
rip2Routing Information Protocol V2authenticationauthenticationq_proto_rip2bytesAuthentication content (password for example).
s1apS1 Application Protocolep_nameep_nameq_proto_s1apbytesElementary Procedure name.
s1apS1 Application Protocolep_mme_ue_idep_mme_ue_idq_proto_s1apuint32Mobility Management Entity Identifier (MME UE S1AP ID).
s1apS1 Application Protocolep_enb_ue_idep_enb_ue_idq_proto_s1apuint32E-UTRAN NodeB Identifier (eNB UE S1AP ID).
s1apS1 Application Protocolep_ie_nameep_ie_nameq_proto_s1apbytesInformation Element name.
s1apS1 Application Protocolep_ie_rab_addrep_ie_rab_addrq_proto_s1apstringTransport Layer Address (IPv4).
s1apS1 Application Protocolep_ie_rab_teidep_ie_rab_teidq_proto_s1apbytesGTP Tunnel Endpoint Identifier (GTP-TEID).
s1apS1 Application Protocolep_ie_taiep_ie_taiq_proto_s1apbytesTracking Area Identifier (TAI).
s1apS1 Application Protocolep_ie_cgiep_ie_cgiq_proto_s1apbytesE-UTRAN Cell Global Identifier (E-UTRAN CGI).
s1apS1 Application Protocolprocessing_anomaly_typeprocessing_anomaly_typeq_proto_s1apbytesDefines the category of the anomaly.
s1apS1 Application Protocolprocessing_anomaly_attrprocessing_anomaly_attrq_proto_s1apuint32Gives an attribute ID, or an attribute structure (parent attribute ID), not extracted because of the anomaly.
samsung_appsSamsung Appsis_smartphoneis_smartphoneq_proto_samsung_appsuint32Boolean attribute indicating whether the client is a smartphone(1) or not(0).
secondlifeSecondLife.comloginloginq_proto_secondlifebytesUser's login string.
secondlifeSecondLife.commessagemessageq_proto_secondlifebytesContent of chat message.
secondlifeSecondLife.commessage_typemessage_typeq_proto_secondlifebytesMessage type.
secondlifeSecondLife.comsource_namesource_nameq_proto_secondlifebytesSource name.
secondlifeSecondLife.comsource_typesource_typeq_proto_secondlifebytesSource type.
secondlifeSecondLife.comchat_typechat_typeq_proto_secondlifebytesChat message type.
aimsSecure AIMloginloginq_proto_aimsbytesUser's login string.
sshSecure Shellrttrttq_proto_sshstringServer response time.
sshSecure Shellversionversionq_proto_sshbytesProtocol version.
sshSecure Shelluser_agentuser_agentq_proto_sshbytesProtocol version, software version and optional comments sent by the client.
sshSecure Shellserver_agentserver_agentq_proto_sshbytesProtocol version, software version and optional comments sent by the server.
sshSecure Shelltsp_alg_kextsp_alg_kexq_proto_sshbytesList of proposed algorithms for key exchange. Each value is separated by a comma.
sshSecure Shelltsp_alg_server_host_keytsp_alg_server_host_keyq_proto_sshbytesList of proposed algorithms for server host key. Each value is separated by a comma.
sshSecure Shelltsp_alg_encrypt_ctstsp_alg_encrypt_ctsq_proto_sshbytesList of proposed symmetric encryption algorithms for traffic from client to server. Each value is separated by a comma.
sshSecure Shelltsp_alg_encrypt_stctsp_alg_encrypt_stcq_proto_sshbytesList of proposed symmetric encryption algorithms for traffic from server to client. Each value is separated by a comma.
sshSecure Shelltsp_alg_mac_ctstsp_alg_mac_ctsq_proto_sshbytesList of proposed algorithms for Message Authentication Code (MAC) on traffic from client to server. Each value is separated by a comma.
sshSecure Shelltsp_alg_mac_stctsp_alg_mac_stcq_proto_sshbytesList of proposed algorithms for Message Authentication Code (MAC) on traffic from server to client. Each value is separated by a comma.
sshSecure Shelltsp_alg_comp_ctstsp_alg_comp_ctsq_proto_sshbytesList of proposed algorithms for compression on traffic from client to server. Each value is separated by a comma.
sshSecure Shelltsp_alg_comp_stctsp_alg_comp_stcq_proto_sshbytesList of proposed algorithms for compression on traffic from server to client. Each value is separated by a comma.
sshSecure Shelltsp_server_key_typetsp_server_key_typeq_proto_sshbytesAlgorithm related to public host key of the server.
sshSecure Shelltsp_alg_kex_guessed_ctstsp_alg_kex_guessed_ctsq_proto_sshbytesThis attribute indicates what algorithm should be in use for key exchange from client to server, based on usual way client and server choose their algorithm for key exchange. This algorithm is only used for key exchange validation, not for encryption.
sshSecure Shelltsp_alg_kex_guessed_stctsp_alg_kex_guessed_stcq_proto_sshbytesThis attribute indicates what algorithm should be in use for key exchange from server to client, based on usual way client and server choose their algorithm for key exchange. This algorithm is only used for key exchange validation, not for encryption.
sshSecure Shelltsp_alg_encrypt_guessed_ctstsp_alg_encrypt_guessed_ctsq_proto_sshbytesThis attribute indicates what algorithm should be in use for symmetric encryption from client to server, based on usual way client and server choose their algorithm for encryption.
sshSecure Shelltsp_alg_encrypt_guessed_stctsp_alg_encrypt_guessed_stcq_proto_sshbytesThis attribute indicates what algorithm should be in use for symmetric encryption from server to client, based on usual way client and server choose their algorithm for encryption.
sshSecure Shelltsp_alg_mac_guessed_ctstsp_alg_mac_guessed_ctsq_proto_sshbytesThis attribute indicates what algorithm should be in use for Message Authenticate Code (MAC) from client to server, based on usual way client and server choose their algorithm for MAC.
sshSecure Shelltsp_alg_mac_guessed_stctsp_alg_mac_guessed_stcq_proto_sshbytesThis attribute indicates what algorithm should be in use for Message Authenticate Code (MAC) from server to client, based on usual way client and server choose their algorithm for MAC.
sshSecure Shelltsp_comp_guessed_ctstsp_comp_guessed_ctsq_proto_sshbytesThis attribute indicates what algorithm should be in use for compression. from client to server, based on usual way client and server choose their algorithm for compression.
sshSecure Shelltsp_comp_guessed_stctsp_comp_guessed_stcq_proto_sshbytesThis attribute indicates what algorithm should be in use for compression. from server to client, based on usual way client and server choose their algorithm for compression.
sslSecure Socket Layercommon_namecommon_nameq_proto_sslbytesDomain name mentioned in the certificate.
sslSecure Socket Layerserver_nameserver_nameq_proto_sslbytesDomain name mentioned in Client Hello message.
sslSecure Socket Layersupported_next_protocolsupported_next_protocolq_proto_sslbytesSupported protocol on top of SSL specified by the server in the Next Protocol Negotiation or Application Layer Protocol Negotiation [RFC7301] TLS extensions.
sslSecure Socket Layerissuerissuerq_proto_sslbytesCertificate Authority.
sslSecure Socket Layervalidity_not_beforevalidity_not_beforeq_proto_sslbytesCertificate's validity start date, in UTCTime format : YYMMDDHHMMSSZ.
sslSecure Socket Layervalidity_not_aftervalidity_not_afterq_proto_sslbytesCertificate's validity end date, in UTCTime format : YYMMDDHHMMSSZ.
sslSecure Socket Layersubject_alt_namesubject_alt_nameq_proto_sslbytesIdentifies a list of host names which belong to the same certificate.
sslSecure Socket Layerorganization_nameorganization_nameq_proto_sslbytesOrganisation name mentioned in the certificate.
sslSecure Socket Layerindexindexq_proto_ssluint32Identifier of the request and response in a SSL flow.
sslSecure Socket Layerrequest_sizerequest_sizeq_proto_ssluint64Contains the total length in bytes of the request or the response (including SSL headers). This attribute is computed at the end of the request or response.
sslSecure Socket Layercipher_suite_idcipher_suite_idq_proto_ssluint32Id of the cipher suite handled by the server.
sslSecure Socket Layerprotocol_versionprotocol_versionq_proto_ssluint32This attribute is extracted once per flow and indicates which SSL/TLS protocol was chosen by the server for this session.
sslSecure Socket Layercommon_name_rawcommon_name_rawq_proto_sslbytesDomain name mentioned in the certificate not decoded.
sslSecure Socket Layerparent_common_nameparent_common_nameq_proto_sslbytesDomain name mentioned in the original certificate (the session to be resumed).
sslSecure Socket Layerserver_name_rawserver_name_rawq_proto_sslbytesDomain name mentioned in Client Hello message not decoded.
sslSecure Socket Layerclient_hello_extension_typeclient_hello_extension_typeq_proto_ssluint32Integer which define the type of extension on the client request
sslSecure Socket Layerserver_hello_extension_typeserver_hello_extension_typeq_proto_ssluint32Integer which define the type of extension on the server response
sslSecure Socket Layercertificate_dn_subjectcertificate_dn_subjectq_proto_sslbytesDistinguished name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_cncertificate_subject_cnq_proto_sslbytesCommon name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_lcertificate_subject_lq_proto_sslbytesLocality name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_stcertificate_subject_stq_proto_sslbytesState Or Province name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_ocertificate_subject_oq_proto_sslbytesOrganization name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_oucertificate_subject_ouq_proto_sslbytesOrganization Unit name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_ccertificate_subject_cq_proto_sslbytesCountry name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_subject_streetcertificate_subject_streetq_proto_sslbytesStreet address of the subject formatted according to RFC 1779, delimiters (< and >) are used to avoid issue with special characters.
sslSecure Socket Layercertificate_dn_issuercertificate_dn_issuerq_proto_sslbytesDistinguished name of the issuer formatted according to RFC 1779.
sslSecure Socket Layercertificate_issuer_cncertificate_issuer_cnq_proto_sslbytesCommon name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_issuer_lcertificate_issuer_lq_proto_sslbytesLocality name of the issuer formatted according to RFC 1779.
sslSecure Socket Layercertificate_issuer_stcertificate_issuer_stq_proto_sslbytesState Or Province name of the issuer formatted according to RFC 1779.
sslSecure Socket Layercertificate_issuer_ocertificate_issuer_oq_proto_sslbytesOrganization name of the subject formatted according to RFC 1779.
sslSecure Socket Layercertificate_issuer_oucertificate_issuer_ouq_proto_sslbytesOrganization Unit name of the issuer formatted according to RFC 1779.
sslSecure Socket Layercertificate_issuer_ccertificate_issuer_cq_proto_sslbytesCountry name of the subject issuer according to RFC 1779.
sslSecure Socket Layercertificate_issuer_streetcertificate_issuer_streetq_proto_sslbytesStreet address of the issuer formatted according to RFC 1779, delimiters (< and >) are used to avoid issue with special characters.
sslSecure Socket Layerclient_hello_extension_lenclient_hello_extension_lenq_proto_ssluint32Length in bytes of client hello extension payload.
sslSecure Socket Layerserver_hello_extension_lenserver_hello_extension_lenq_proto_ssluint32Length in bytes of server hello extension payload.
sslSecure Socket Layerext_sig_algorithms_lenext_sig_algorithms_lenq_proto_ssluint32Length in bytes of list of signature algorithms, so twice the number of algorithms. (Algorithms are encoded over two bytes.)
sslSecure Socket Layerext_sig_algorithm_schemeext_sig_algorithm_schemeq_proto_ssluint32Signature scheme, aka hash, signature, ... (All SSL versions)
sslSecure Socket Layercertificate_subject_key_algo_oidcertificate_subject_key_algo_oidq_proto_sslbytesOID defining type of algorithm related to the subject key. (in string format)
sslSecure Socket Layercertificate_subject_key_sizecertificate_subject_key_sizeq_proto_ssluint32SKI length in bytes (Subject Key Info, algorithm and value)
sslSecure Socket Layerext_ec_supported_groups_nbext_ec_supported_groups_nbq_proto_ssluint32Number of elliptic curves.
sslSecure Socket Layerext_ec_supported_groups_typeext_ec_supported_groups_typeq_proto_ssluint32Type of the elliptic curve supported.
sslSecure Socket Layerserver_supported_versionserver_supported_versionq_proto_ssluint32Version of SSL/TLS supported by the server, this value comes from extension named supported version" in TLS. Final version chosen by server will be given by attribute protocol_version."
sslSecure Socket Layerclient_supported_versionclient_supported_versionq_proto_ssluint32Version of SSL/TLS supported by the client, this value comes from extension named supported version" in TLS. Final version chosen by server will be given by attribute protocol_version."
sslSecure Socket Layercert_extension_oidcert_extension_oidq_proto_sslbytesOID defining type of certificate extension in human readable string format.
sslSecure Socket Layerclient_hello_versionclient_hello_versionq_proto_ssluint32SSL/TLS client version field value.
sslSecure Socket Layerserver_hello_versionserver_hello_versionq_proto_ssluint32SSL/TLS server version field value.
smbServer Message Block (Windows File Server)loginloginq_proto_smbbytesUser's login string.
smbServer Message Block (Windows File Server)serviceserviceq_proto_smbbytesService Type.
smbServer Message Block (Windows File Server)user_iduser_idq_proto_smbuint32User identifier (SMB usmb_v1 only).
smbServer Message Block (Windows File Server)directorydirectoryq_proto_smbbytesName of the shared directory on the server host.
smbServer Message Block (Windows File Server)pathpathq_proto_smbbytesThe server/share name of the resource to which the client attempts to connect.
smbServer Message Block (Windows File Server)domaindomainq_proto_smbbytesDomain name (NTLMSSP domain).
smbServer Message Block (Windows File Server)native_osnative_osq_proto_smbbytesClient's operating system.
smbServer Message Block (Windows File Server)command_stringcommand_stringq_proto_smbbytesCommand name.
smbServer Message Block (Windows File Server)filenamefilenameq_proto_smbbytesName of the transferred file.
smbServer Message Block (Windows File Server)filesizefilesizeq_proto_smbuint64Size (byte) of the transferred file.
smbServer Message Block (Windows File Server)versionversionq_proto_smbuint32Protocol version.
smbServer Message Block (Windows File Server)hosthostq_proto_smbbytesSMB client host name (NTLMSSP workstation).
smbServer Message Block (Windows File Server)krb5_servicekrb5_serviceq_proto_smbbytesService type.
smbServer Message Block (Windows File Server)krb5_serverkrb5_serverq_proto_smbbytesName of the server requiring Kerberos authentication.
smbServer Message Block (Windows File Server)krb5_realmkrb5_realmq_proto_smbbytesRealm in KRB-ERROR message.
smbServer Message Block (Windows File Server)file_typefile_typeq_proto_smbuint32file type.
smbServer Message Block (Windows File Server)ntlm_userntlm_userq_proto_smbbytesUser" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
smbServer Message Block (Windows File Server)ntlm_domainntlm_domainq_proto_smbbytesDomain" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
smbServer Message Block (Windows File Server)ntlm_workstationntlm_workstationq_proto_smbbytesWorkstation" attribute of the NTLM protocol, extracted from NTLM Authenticate (3) messages."
smbServer Message Block (Windows File Server)ntlm_identifierntlm_identifierq_proto_smbbytesNTLM protocol Signature (null-terminated string).
smbServer Message Block (Windows File Server)ntlm_message_typentlm_message_typeq_proto_smbuint32NTLM message type.
smbServer Message Block (Windows File Server)dcerpc_servicedcerpc_serviceq_proto_smbbytesThe DCERPC protocol is an RPC implementation used in Distributed Computing Environments. This protocol is used by many software applications including Microsft Exchange.
smbServer Message Block (Windows File Server)dcerpc_interface_uuiddcerpc_interface_uuidq_proto_smbbytesID of the interface.
smbServer Message Block (Windows File Server)dcerpc_call_iddcerpc_call_idq_proto_smbuint32ID of the call.
smbServer Message Block (Windows File Server)dcerpc_context_iddcerpc_context_idq_proto_smbuint32ID of the context.
smbServer Message Block (Windows File Server)dcerpc_opnumdcerpc_opnumq_proto_smbuint32ID of specific function call to the interface.
smbServer Message Block (Windows File Server)header_lengthheader_lengthq_proto_smbuint32The size, in bytes, of the SMB2 header structure.
smbServer Message Block (Windows File Server)credit_chargecredit_chargeq_proto_smbuint32This field indicates the number of credits that this request consumes.
smbServer Message Block (Windows File Server)channelchannelq_proto_smbuint32This field is an indication to the server about the client's Channel change.
smbServer Message Block (Windows File Server)credits_requestedcredits_requestedq_proto_smbuint32On a request, this field indicates the number of credits the client is requesting.
smbServer Message Block (Windows File Server)flagsflagsq_proto_smbuint32This field indicates how to process the operation.
smbServer Message Block (Windows File Server)session_idsession_idq_proto_smbuint64Uniquely identifies the current user session.
smbServer Message Block (Windows File Server)dcerpc_item_context_iddcerpc_item_context_idq_proto_smbuint32Index of the current context item
smbServer Message Block (Windows File Server)dcerpc_abstract_itf_uuiddcerpc_abstract_itf_uuidq_proto_smbbytesInterface UUID allowing to identifies RPC interface to call.
smbServer Message Block (Windows File Server)dcerpc_abstract_itf_versiondcerpc_abstract_itf_versionq_proto_smbuint32Version number of interface to call. It is defined on 32 bits.
smbServer Message Block (Windows File Server)dcerpc_transfer_itf_uuiddcerpc_transfer_itf_uuidq_proto_smbbytesInterface UUID allowing to identifies RPC interface to get reply.
smbServer Message Block (Windows File Server)dcerpc_transfer_itf_versiondcerpc_transfer_itf_versionq_proto_smbuint32Version number of interface to get reply. It is defined on 32 bits.
smbServer Message Block (Windows File Server)dcerpc_result_ack_resultdcerpc_result_ack_resultq_proto_smbuint32Negociation result of the given presentation transfer syntax (0 stands for Acceptance).
smbServer Message Block (Windows File Server)dcerpc_result_ack_reasondcerpc_result_ack_reasonq_proto_smbuint32Reason detailing non acceptance of the given transfer syntax, usually set to 0 when transfer syntax is accepted (Q_DCERPC_RESULT_ACK_RESULT == 0)
smbServer Message Block (Windows File Server)dcerpc_result_transfer_syntax_uuiddcerpc_result_transfer_syntax_uuidq_proto_smbbytesUUID of selected transfer syntax, 0 stands for transfer syntax is not selected"."
smbServer Message Block (Windows File Server)dcerpc_result_transfer_syntax_versiondcerpc_result_transfer_syntax_versionq_proto_smbuint32Version of selected transfer syntax, usually also set to 0 when UUID is 0.
smbServer Message Block (Windows File Server)set_info_fix_struct_sizeset_info_fix_struct_sizeq_proto_smbuint32Size of fix part of SET_INFO header (request or response).
smbServer Message Block (Windows File Server)set_info_sizeset_info_sizeq_proto_smbuint32The length, in bytes, of the information to be set.
smbServer Message Block (Windows File Server)set_info_file_rename_root_dirset_info_file_rename_root_dirq_proto_smbuint64Handle/ID of parent directory of the file to rename.
smbServer Message Block (Windows File Server)set_info_file_filename_lengthset_info_file_filename_lengthq_proto_smbuint32Length of the file name field.
smbServer Message Block (Windows File Server)read_lengthread_lengthq_proto_smbuint32This field is set in READ request. It is the size in bytes of number of bytes to read at a given offset (see Q_SMB_READ_OFFSET) from file referenced by GUID (Q_SMB_FILE_ID). This field can be 0.
smbServer Message Block (Windows File Server)read_offsetread_offsetq_proto_smbuint64This field is set in READ request. It is the offset in bytes from which read must be made from file referenced by GUID (Q_SMB_FILE_ID).
smbServer Message Block (Windows File Server)read_data_lengthread_data_lengthq_proto_smbuint32This field is set in READ response. It is the size of data read from file referenced by from file referenced by GUID (Q_SMB_FILE_ID).
smbServer Message Block (Windows File Server)read_data_remainingread_data_remainingq_proto_smbuint32This field is set in READ response. It is the size in bytes of the remaining data being sent on the Channel specified in the request.
smbServer Message Block (Windows File Server)write_lengthwrite_lengthq_proto_smbuint32This field is set in WRITE request. It is the size in bytes of number of bytes to write at a given offset (see Q_SMB_WRITE_OFFSET) in file referenced by GUID (Q_SMB_FILE_ID). This field can be 0.
smbServer Message Block (Windows File Server)write_offsetwrite_offsetq_proto_smbuint64This field is set in WRITE request. It is the offset in bytes from which write must be made in file referenced by GUID (Q_SMB_FILE_ID).
smbServer Message Block (Windows File Server)write_countwrite_countq_proto_smbuint32This field is set in WRITE response. It is the size of data written in file referenced by from file referenced by GUID (Q_SMB_FILE_ID).
smbServer Message Block (Windows File Server)write_data_remainingwrite_data_remainingq_proto_smbuint32This field is set in WRITE response. It is a reserved field, raise it whatever it contains, It should be set to 0 by server.
smbServer Message Block (Windows File Server)tcax_rsp_native_fstcax_rsp_native_fsq_proto_smbbytesName of the file system on the local resource to which the returned Tree ID is connected (null terminated Unicode or OEM characters).
sipSession Initiation Protocolmethodmethodq_proto_sipbytesThe command
sipSession Initiation Protocoluriuriq_proto_sipbytesContains the URI (similar to To: field)
sipSession Initiation Protocolreply_codereply_codeq_proto_sipbytesReturn status code.
sipSession Initiation Protocolmime_typemime_typeq_proto_sipbytesData type.
sipSession Initiation Protocoluser_agentuser_agentq_proto_sipbytesClient's software.
sipSession Initiation Protocolrequest_call_idrequest_call_idq_proto_sipbytesCall's id extracted for each sip request.
sipSession Initiation Protocolserver_agentserver_agentq_proto_sipbytesServer's software.
sipSession Initiation Protocolsubjectsubjectq_proto_sipbytesthe subject header present in the SIP packet
sipSession Initiation Protocoldatedateq_proto_sipbytesContains the date and time.
sipSession Initiation Protocolcall_idcall_idq_proto_sipbytesCall id, extracted for each call.
sipSession Initiation Protocoltime_before_spktime_before_spkq_proto_sipstringWaiting delay before speak
sipSession Initiation Protocolcall_durationcall_durationq_proto_sipstringCall duration.
sipSession Initiation Protocolcallercallerq_proto_sipbytesContains the identity (or the phone number) of the initiator of the call.
sipSession Initiation Protocolcalleecalleeq_proto_sipbytesContains the identity (or the phone number) of the called party for a call.
sipSession Initiation Protocolcaller_addrcaller_addrq_proto_sipstringAddress which could be used by the initiator of the call.
sipSession Initiation Protocolcallee_addrcallee_addrq_proto_sipstringAddress which could be used by the called party.
sipSession Initiation Protocolmedia_typemedia_typeq_proto_sipbytesContains the media type.
sipSession Initiation Protocolmedia_protomedia_protoq_proto_sipbytesProtocol used in client stream.
sipSession Initiation Protocolmedia_formatmedia_formatq_proto_sipuint32Client's protocol formats available.
sipSession Initiation Protocoluser_iduser_idq_proto_sipbytesClient identifier used for his registering with a SIP server.
sipSession Initiation Protocoldomaindomainq_proto_sipbytesCaller's or callee's domain
sipSession Initiation Protocolconnection_info_nb_addrconnection_info_nb_addrq_proto_sipuint32Number of addresses defined for the connection (see RFC 4566 section 5.14).
sipSession Initiation Protocoldata_nb_portsdata_nb_portsq_proto_sipuint32Number of ports defined for the connection (see RFC 4566 section 5.14).
sipSession Initiation Protocolmime_type_mainmime_type_mainq_proto_sipbytesPrimary part of the MIME type.
sipSession Initiation Protocolmime_type_submime_type_subq_proto_sipbytesSecond part of the MIME type.
stunSession Traversal Utilities for NATmapped_address_ipv4mapped_address_ipv4q_proto_stunstringIPv4 address to be mapped.
stunSession Traversal Utilities for NATxor_mapped_address_ipv4xor_mapped_address_ipv4q_proto_stunstringIPv4 address to be mapped, in XORed version (obfuscated).
stunSession Traversal Utilities for NATmagic_cookiemagic_cookieq_proto_stunuint32The magic cookie used to deobfuscate the XOR Mapped Port and XOR Mapped Address.
stunSession Traversal Utilities for NATremote_address_ipv4remote_address_ipv4q_proto_stunstringIPv4 address of the distant peer as seen from the STUN relay server.
stunSession Traversal Utilities for NATrealmrealmq_proto_stunbytesRealm in message used for authentication.
stunSession Traversal Utilities for NATsoftwaresoftwareq_proto_stunbytesDescription of the software used being used by the agent sending the message.
stunSession Traversal Utilities for NATunxor_mapped_address_ipv4unxor_mapped_address_ipv4q_proto_stunstringIPv4 address to be mapped, in decoded XOR version (deobfuscated).
smppShort message peer-to-peer protocolsendersenderq_proto_smppbytesSender's address.
smppShort message peer-to-peer protocolreceiverreceiverq_proto_smppbytesReceiver's address.
silverlightSilverlight (Microsoft Smooth Streaming)video_dataratevideo_datarateq_proto_silverlightbytesVideo bitrate in kilobits per second.
smtpSimple Mail Transfer Protocolloginloginq_proto_smtpbytesUser's login string.
smtpSimple Mail Transfer Protocolpasswordpasswordq_proto_smtpbytesUser's password string.
smtpSimple Mail Transfer Protocolsender_aliassender_aliasq_proto_smtpbytesName of the email sender.
smtpSimple Mail Transfer Protocolsender_emailsender_emailq_proto_smtpbytesEmail address of the email sender.
smtpSimple Mail Transfer Protocolsender_domainsender_domainq_proto_smtpbytesDomain of the sender's email address.
smtpSimple Mail Transfer Protocolreceiver_domainreceiver_domainq_proto_smtpbytesDomain of the recipient's email address.
smtpSimple Mail Transfer Protocolreceiver_emailreceiver_emailq_proto_smtpbytesEmail address of message receiver (included cc and bcc receivers).
smtpSimple Mail Transfer Protocolmethodmethodq_proto_smtpbytesCommand sent by the client
smtpSimple Mail Transfer Protocolresponse_coderesponse_codeq_proto_smtpuint32Return code
smtpSimple Mail Transfer Protocolserver_responseserver_responseq_proto_smtpbytesThe return code of the server
smtpSimple Mail Transfer Protocolsubjectsubjectq_proto_smtpbytesMessage subject.
smtpSimple Mail Transfer Protocoldatedateq_proto_smtpbytesMessage date.
smtpSimple Mail Transfer Protocolmime_typemime_typeq_proto_smtpbytesMail's content type.
smtpSimple Mail Transfer Protocolmsg_idmsg_idq_proto_smtpbytesIdentifier of the message.
smtpSimple Mail Transfer Protocoluser_agentuser_agentq_proto_smtpbytesName of the software used.
smtpSimple Mail Transfer Protocolstart_timestart_timeq_proto_smtpstringStarting time of SMTP session
smtpSimple Mail Transfer Protocolstop_timestop_timeq_proto_smtpstringEnding time of SMTP session
smtpSimple Mail Transfer Protocoldurationdurationq_proto_smtpstringDuration of the SMTP session
smtpSimple Mail Transfer Protocolattach_typeattach_typeq_proto_smtpbytesContent type of the sent attached file.
smtpSimple Mail Transfer Protocolattach_sizeattach_sizeq_proto_smtpuint32Attached file MIME size.
smtpSimple Mail Transfer Protocolattach_dispositionattach_dispositionq_proto_smtpbytesFull 'Content-Disposition' header value starting with attached file disposition (inline, attachment, ...).
smtpSimple Mail Transfer Protocolattach_filenameattach_filenameq_proto_smtpbytesAttachment name.
smtpSimple Mail Transfer Protocolserverserverq_proto_smtpbytesContains the name of the used SMTP server
smtpSimple Mail Transfer Protocolreplytoreplytoq_proto_smtpbytesEmail address to use in a reply for this message.
smtpSimple Mail Transfer Protocolfile_typefile_typeq_proto_smtpbytesReceived or sent file content type (prefix-based pattern recognition) exchanged using this protocol.
smtpSimple Mail Transfer Protocolemailemailq_proto_smtpboolParent entry, for fields belonging to the same email.
smtpSimple Mail Transfer Protocolsender_entrysender_entryq_proto_smtpboolParent entry, for different elements belonging to the sender.
smtpSimple Mail Transfer Protocolmailfrommailfromq_proto_smtpboolContains the domain and the sender's email
smtpSimple Mail Transfer Protocolrcpttorcpttoq_proto_smtpboolDomain and recipient's email address (used by RCPT TO method).
smtpSimple Mail Transfer Protocolreceiver_entryreceiver_entryq_proto_smtpboolParent entry, for different elements belonging to the email receiver.
smtpSimple Mail Transfer Protocolrequestrequestq_proto_smtpboolParent entry, empty, for client request and server response.
smtpSimple Mail Transfer Protocolattachattachq_proto_smtpboolParent entry, for attach fields in a message.
smtpSimple Mail Transfer Protocolcontentcontentq_proto_smtpbytesFull message content (headers, body, attachments). The data is extracted in streamed mode, line per line.
smtpSimple Mail Transfer Protocolreceivedreceivedq_proto_smtpboolParent entry, for fields added by each relay
smtpSimple Mail Transfer Protocolendendq_proto_smtpVoidIndicates the end of a top-level parent attribute. This attribute's behavior depends on the method used to extract it: 1) If using the ixEngine v4 API function uevent_hook_add_parms", it will be extracted like any other attribute. 2) If using the ixEngine v4 API function "afc_metadata_add", it will generate an attribute having the attribute ID of the associated top-level parent attribute and the ctb_metadata_attr.qm_end flag set to 1. 3) In ixEngine v5, the "qmdpi_result_attr_getnext" function allows user to get attribute information (flow, proto_id, attr_id, data, data_len and flags). When the parent attribute is ended, the QMDPI_ATTR_PARENT_END flag is set to 1."
smtpSimple Mail Transfer Protocolattach_filename_cdispoattach_filename_cdispoq_proto_smtpbytesAttachment name. The attachment name is extracted from 'Content-Disposition' field.
smtpSimple Mail Transfer Protocolattach_size_decodedattach_size_decodedq_proto_smtpuint32Base64-decoded attached file content size in Bytes.
smtpSimple Mail Transfer Protocolemail_boundaryemail_boundaryq_proto_smtpbytesboundary used to separate different parts of the message body.
smtpSimple Mail Transfer Protocolresent_fromresent_fromq_proto_smtpbytesFull address of the person for whom message is resent.
smtpSimple Mail Transfer Protocolresent_from_emailresent_from_emailq_proto_smtpbytesEmail address of the person for whom message is resent.
smtpSimple Mail Transfer Protocolresent_from_aliasresent_from_aliasq_proto_smtpbytesName of the person for whom message is resent.
smtpSimple Mail Transfer Protocolresent_senderresent_senderq_proto_smtpbytesFull address of the person who has actually resent the message.
smtpSimple Mail Transfer Protocolresent_sender_emailresent_sender_emailq_proto_smtpbytesEmail address of the person who has actually resent the message.
smtpSimple Mail Transfer Protocolresent_sender_aliasresent_sender_aliasq_proto_smtpbytesName of the person who has actually resent the message.
smtpSimple Mail Transfer Protocolattach_content_idattach_content_idq_proto_smtpbytesAttached file content identifier.
smtpSimple Mail Transfer Protocolattach_content_descattach_content_descq_proto_smtpbytesDescriptive information for the attached file content.
smtpSimple Mail Transfer Protocolcontent_idcontent_idq_proto_smtpbytesIndicates the identifier of the email content.
smtpSimple Mail Transfer Protocolcontent_desccontent_descq_proto_smtpbytesIndicates the description of the email content.
smtpSimple Mail Transfer Protocolreceived_byreceived_byq_proto_smtpbytesContains the name of the receiving host.
smtpSimple Mail Transfer Protocolmime_versionmime_versionq_proto_smtpbytesVersion of the message body format standard used in the mail protocol.
smtpSimple Mail Transfer Protocolreturn_pathreturn_pathq_proto_smtpbytesMessage return path.
smtpSimple Mail Transfer Protocolclient_domainclient_domainq_proto_smtpbytesClient domain information as found in the EHLO or HELO SMTP command parameter. This parameter gives the SMTP client domain name to the server. It can be sent as a FQDN or an IP address
smtpSimple Mail Transfer Protocolx_originating_ip4x_originating_ip4q_proto_smtpstringThe IP address of client who sent the email.
smtpSimple Mail Transfer Protocolx_originating_strx_originating_strq_proto_smtpbytesNon-standard SMTP header representing the origin IP address (IPv4 or IPv6) of client in string format.
smtpSimple Mail Transfer Protocolin_reply_toin_reply_toq_proto_smtpbytesEmail address of the original message used when creating a reply message.
snmpSimple Network Management Protocolcommunitycommunityq_proto_snmpbytesCommunity name.
snmpSimple Network Management Protocolmethodmethodq_proto_snmpbytesSNMP request type.
snmpSimple Network Management Protocolrequest_idrequest_idq_proto_snmpuint32Request Identifier.
snmpSimple Network Management Protocoloidoidq_proto_snmpbytesObject Identifier.
snmpSimple Network Management Protocolvalue_lenvalue_lenq_proto_snmpuint32Size of value_raw in bytes.
snmpSimple Network Management Protocolnamenameq_proto_snmpbytesName the user.
snppSimple Network Paging Protocolloginloginq_proto_snppbytesUser's login string.
snppSimple Network Paging Protocolpasswordpasswordq_proto_snppbytesUser's password string.
snppSimple Network Paging Protocolmethodmethodq_proto_snppbytesContains the SNPP command.
snppSimple Network Paging Protocolcaller_idcaller_idq_proto_snppbytesLogin of person who send the message.
snppSimple Network Paging Protocolmessagemessageq_proto_snppbytesContains the message sent to the pager.
snppSimple Network Paging Protocolpager_idpager_idq_proto_snppbytesContains pager number.
ssdpSimple Service Discovery Protocolheader_valueheader_valueq_proto_ssdpbytesHeader data.
ssdpSimple Service Discovery Protocolheader_nameheader_nameq_proto_ssdpbytesHeader name.
ssdpSimple Service Discovery Protocolcontent_lengthcontent_lengthq_proto_ssdpbytesLength of the request body in bytes. (CONTENT-LENGTH field value)
ssdpSimple Service Discovery Protocolcache_controlcache_controlq_proto_ssdpbytesContains max-age directive (max-age=) followed by an integer that specifies the validity duration in seconds. (CACHE-CONTROL field value)
ssdpSimple Service Discovery Protocolserver_agentserver_agentq_proto_ssdpbytesServer information (SERVER field value). It contains the product tokens: <OS name/OS version> <UPnP/upnp version> <product name/product version>.
ssdpSimple Service Discovery Protocollocationlocationq_proto_ssdpbytesURL for UPnP description of the device. (LOCATION field value)
ssdpSimple Service Discovery Protocolhosthostq_proto_ssdpbytesDomain name or IP address and optional port. (HOST field value)
ssdpSimple Service Discovery Protocolunique_service_nameunique_service_nameq_proto_ssdpbytesUnique service name. (USN field value)
ssdpSimple Service Discovery Protocolnotification_sub_typenotification_sub_typeq_proto_ssdpbytesNotification sub type. (NTS field value)
ssdpSimple Service Discovery Protocolnotification_typenotification_typeq_proto_ssdpbytesNotification type. (NT field value)
ssdpSimple Service Discovery Protocolsearch_targetsearch_targetq_proto_ssdpbytesSearch target. (ST field value)
ssdpSimple Service Discovery Protocoluriuriq_proto_ssdpbytesURI contained in the request.
ssdpSimple Service Discovery Protocolversionversionq_proto_ssdpbytesVersion of the SSDP protocol used in the message.
ssdpSimple Service Discovery Protocolmethodmethodq_proto_ssdpbytesContains the SSDP command.
sina_webmailSina Webmailfolderlistfolderlistq_proto_sina_webmailbytesContains the message folder list.
sina_webmailSina Webmailmsglist_datemsglist_dateq_proto_sina_webmailbytesMessage date in a message list.
sina_webmailSina Webmailmsglist_subjectmsglist_subjectq_proto_sina_webmailbytesMessage subject in a message list.
sina_webmailSina Webmailmsglist_receiver_aliasmsglist_receiver_aliasq_proto_sina_webmailbytesName of email receiver.
sina_webmailSina Webmailmsglist_receiver_emailmsglist_receiver_emailq_proto_sina_webmailbytesEmail address of the email receiver.
sina_webmailSina Webmailmsglist_receivermsglist_receiverq_proto_sina_webmailbytesFull address of email receiver in a message list.
sina_webmailSina Webmailmsglist_sender_aliasmsglist_sender_aliasq_proto_sina_webmailbytesName of email sender.
sina_webmailSina Webmailmsglist_sender_emailmsglist_sender_emailq_proto_sina_webmailbytesAddress of email sender.
sina_webmailSina Webmailmsglist_sendermsglist_senderq_proto_sina_webmailbytesFull address of email sender (alias and email address).
sina_webmailSina Webmailmsglist_msgidmsglist_msgidq_proto_sina_webmailbytesMessage identifier.
sina_webmailSina Webmaildatedateq_proto_sina_webmailbytesMessage date.
sina_webmailSina Webmailcontentcontentq_proto_sina_webmailbytesMessage content.
sina_webmailSina Webmailimportanceimportanceq_proto_sina_webmailuint32Indicates if the email has been marked by the user.
sina_webmailSina Webmailsubjectsubjectq_proto_sina_webmailbytesMessage subject.
sina_webmailSina Webmailreceiver_typereceiver_typeq_proto_sina_webmailbytesType of the email receiver.
sina_webmailSina Webmailreceiver_aliasreceiver_aliasq_proto_sina_webmailbytesName of email receiver (included cc and bcc receivers).
sina_webmailSina Webmailreceiver_emailreceiver_emailq_proto_sina_webmailbytesEmail address of message receiver (included cc and bcc receivers).
sina_webmailSina Webmailreceiverreceiverq_proto_sina_webmailbytesFull address of email receiver (including cc and bcc receivers).
sina_webmailSina Webmailsender_aliassender_aliasq_proto_sina_webmailbytesName of the email sender.
sina_webmailSina Webmailsender_emailsender_emailq_proto_sina_webmailbytesEmail address of the email sender.
sina_webmailSina Webmailsendersenderq_proto_sina_webmailbytesFull address of email sender (alias followed by email address).
sina_webmailSina Webmailactionactionq_proto_sina_webmailbytesIndicates the action executed by the user.
sina_webmailSina Webmailattach_idattach_idq_proto_sina_webmailbytesAttachment identifier.
sina_webmailSina Webmailattach_sizeattach_sizeq_proto_sina_webmailuint32Attached file MIME size.
sina_webmailSina Webmailattach_filenameattach_filenameq_proto_sina_webmailbytesAttachment name.
sina_webmailSina Webmailmsg_idmsg_idq_proto_sina_webmailbytesIdentifier of the message.
sina_webmailSina Webmaildraftdraftq_proto_sina_webmailuint32Indicates if the email is a draft or has really been posted
sina_webmailSina Webmailattach_typeattach_typeq_proto_sina_webmailbytesContent type of the sent attached file.
sina_webmailSina Webmailis_htmlis_htmlq_proto_sina_webmailuint32Specifies the email content format is html or not
sina_webmailSina Webmailfolderfolderq_proto_sina_webmailbytesIndicates the directory from where messages are read.
sina_webmailSina Webmailfolderlist_item_namefolderlist_item_nameq_proto_sina_webmailbytesMessage folder name.
sina_webmailSina Webmailfolderlist_item_idfolderlist_item_idq_proto_sina_webmailbytesMessage folder unique identifier.
sina_webmailSina Webmailmsglist_foldermsglist_folderq_proto_sina_webmailbytesIndicates the directory from a message list.
sina_weiboSina Weibouser_iduser_idq_proto_sina_weibobytesUnique identifier related to a single user. This attribute is available for clear traffic from Mobile applications, it may be not available for traffic from recent web browsers enforcing use of TLS.
sccpSkinny Client Control Protocolcall_idcall_idq_proto_sccpuint32Call id, extracted for each call.
sccpSkinny Client Control Protocolcallercallerq_proto_sccpbytesContains the identity (or the phone number) of the initiator of the call.
sccpSkinny Client Control Protocolcalleecalleeq_proto_sccpbytesContains the identity (or the phone number) of the called party for a call.
sccpSkinny Client Control Protocolcallernamecallernameq_proto_sccpbytesCalling party identity
sccpSkinny Client Control Protocolcalleenamecalleenameq_proto_sccpbytesCalled party identity
sccpSkinny Client Control Protocoldevice_typedevice_typeq_proto_sccpuint32Device type
sccpSkinny Client Control Protocoldevice_namedevice_nameq_proto_sccpbytesDevice name
sccpSkinny Client Control Protocolstart_timestart_timeq_proto_sccpstringStart date of the call.
sccpSkinny Client Control Protocolcall_durationcall_durationq_proto_sccpstringCall duration.
sccpSkinny Client Control Protocolnb_pkt_sentnb_pkt_sentq_proto_sccpuint32Number of RTP packets sent
sccpSkinny Client Control Protocolnb_pkt_rcvnb_pkt_rcvq_proto_sccpuint32Number of RTP packets received
sccpSkinny Client Control Protocolnb_byt_sentnb_byt_sentq_proto_sccpuint32Number of RTP octets sent
sccpSkinny Client Control Protocolnb_byt_rcvnb_byt_rcvq_proto_sccpuint32Number of RTP octets received
sccpSkinny Client Control Protocolnb_pkt_lostnb_pkt_lostq_proto_sccpuint32Number of RTP packets lost
sccpSkinny Client Control Protocolstats_jitterstats_jitterq_proto_sccpuint32Observed Jitter for RTP packets
sccpSkinny Client Control Protocolstats_latencystats_latencyq_proto_sccpuint32Observed latency for RTP packets
sccpSkinny Client Control Protocolmessage_typemessage_typeq_proto_sccpuint32The type of the message.
sccpSkinny Client Control Protocolcall_waycall_wayq_proto_sccpuint32The call Way (In, Out)
sccpSkinny Client Control Protocolcallstatecallstateq_proto_sccpuint32Status of the current call
sccpSkinny Client Control Protocolcodeccodecq_proto_sccpuint32The codec used in the RTP session
sccpSkinny Client Control Protocolsoftkeyeventsoftkeyeventq_proto_sccpuint32Contains the soft key event
skyblogSkyblogloginloginq_proto_skyblogbytesUser's login string.
skypeSkypeversionversionq_proto_skypebytesSkype client version.
skypeSkypeserviceserviceq_proto_skypebytesCurrent service identification string.
skypeSkypeservice_idservice_idq_proto_skypeuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
skypeSkypeservice_durationservice_durationq_proto_skypeuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
skypeSkypeservice_duration_tvservice_duration_tvq_proto_skypestringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
skypeSkypeservice_statsservice_statsq_proto_skypebytesComposite attribute containing the packet metrics used for each new service type detection, extracting when performing STATISTICAL detection method only. Note: this attribute won't be extracted in case of session expiration (eg. when the current service is not ended properly by the user).
skypeSkypeservice_divergenceservice_divergenceq_proto_skypeuint32The minimal distance" between the real traffic and its theoretical model as implemented in the Qosmos plugin."
slackSlackservice_idservice_idq_proto_slackuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
slackSlackservice_duration_tvservice_duration_tvq_proto_slackstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
slackSlackservice_durationservice_durationq_proto_slackuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
slackSlackserviceserviceq_proto_slackbytesCurrent service identification string.
socks4SOCKet Secure v4remote_addrremote_addrq_proto_socks4stringRemote IP address.
socks4SOCKet Secure v4remote_nameremote_nameq_proto_socks4bytesFully qualified remote domain name.
socks5SOCKet Secure v5remote_addrremote_addrq_proto_socks5stringRemote IP address.
socks5SOCKet Secure v5remote_nameremote_nameq_proto_socks5bytesFully qualified remote domain name.
socks5SOCKet Secure v5loginloginq_proto_socks5bytesUser's login string.
socks5SOCKet Secure v5passwordpasswordq_proto_socks5bytesUser's password string.
slskSoulSeekqueryqueryq_proto_slskbytesQuery sent to find a file.
slskSoulSeekversionversionq_proto_slskuint32Current version of the Soulseek client.
slskSoulSeekfilenamefilenameq_proto_slskbytesName of the transferred file.
slskSoulSeekfilesizefilesizeq_proto_slskuint32Size (byte) of the transferred file.
slskSoulSeekfile_idfile_idq_proto_slskuint64Unique identifier of a file, based on IP of peer and the unique token for this combination file/peer.
slskSoulSeektransfer_waytransfer_wayq_proto_slskbytesIndicates whether the file is uploaded or downloaded.
slskSoulSeekpasswordpasswordq_proto_slskbytesUser's password string.
slskSoulSeekloginloginq_proto_slskbytesUser's login string.
spdySPDYstream_idstream_idq_proto_spdyuint32Stream identifier.
spdySPDYlengthlengthq_proto_spdyuint32Length of the message starting at the offset of this field.
spdySPDYstatus_codestatus_codeq_proto_spdyuint32An indicator for why the stream is being terminated.
spdySPDYheader_countheader_countq_proto_spdyuint32The number of repeating name/value pairs following this field
spdySPDYheader_nameheader_nameq_proto_spdybytesHeader name, prefixed by a ':' if it's a mandatory SPDY header.
spdySPDYheader_valueheader_valueq_proto_spdybytesHeader value.
spdySPDYassociated_stream_idassociated_stream_idq_proto_spdyuint32Identifier for a stream which this stream is associated to.
spdySPDYhosthostq_proto_spdybytesHost name value extracted from the Host header.
spdySPDYserver_agentserver_agentq_proto_spdybytesName of the server software.
spdySPDYlocationlocationq_proto_spdybytesDestination address where the client is redirected.
spdySPDYrefererrefererq_proto_spdybytesSource address from which the client obtained the requested URI.
spdySPDYuri_rawuri_rawq_proto_spdybytesComplete name (scheme/authority + path + request) of a web resource.
spdySPDYcookiecookieq_proto_spdybytesRaw value of the SPDY Cookie header line, containing the SPDY request cookies.
spdySPDYcontent_dispositioncontent_dispositionq_proto_spdybytesInformation related to the disposition of the content present on the web page.
spdySPDYcontent_lencontent_lenq_proto_spdybytesContains the content length of the SPDY request/response.
spdySPDYmethodmethodq_proto_spdybytesSPDY command sent by the client.
spdySPDYuser_agentuser_agentq_proto_spdybytesSoftware used by the client to access the web page.
spdySPDYmime_typemime_typeq_proto_spdybytesContent type of the request or the web page.
spdySPDYcontent_transfer_encodingcontent_transfer_encodingq_proto_spdybytesCorresponds to HTTP's Transfer-Encoding header. Contains the content encoding (TRANSFER-ENCODING HTTP header).
spdySPDYcontent_encodingcontent_encodingq_proto_spdybytesContains content encoding format.
spdySPDYdatedateq_proto_spdybytesMessage date.
spdySPDYcodecodeq_proto_spdyuint32Return code sent by the server.
speedtestSpeedtesttesttestq_proto_speedtestbytesDefines which connection test is being performed.
squirrelmailSquirrelMailcontact_emailcontact_emailq_proto_squirrelmailbytesEmail address of a contact.
squirrelmailSquirrelMailcontact_aliascontact_aliasq_proto_squirrelmailbytesAlias of a contact.
squirrelmailSquirrelMailmsglist_sender_aliasmsglist_sender_aliasq_proto_squirrelmailbytesName of email sender.
squirrelmailSquirrelMailmsglist_sender_emailmsglist_sender_emailq_proto_squirrelmailbytesAddress of email sender.
squirrelmailSquirrelMailmsglist_subjectmsglist_subjectq_proto_squirrelmailbytesMessage subject in a message list.
squirrelmailSquirrelMailmsglist_datemsglist_dateq_proto_squirrelmailbytesMessage date in a message list.
squirrelmailSquirrelMailmsglist_receiver_aliasmsglist_receiver_aliasq_proto_squirrelmailbytesName of email receiver.
squirrelmailSquirrelMailmsglist_receiver_emailmsglist_receiver_emailq_proto_squirrelmailbytesEmail address of the email receiver.
squirrelmailSquirrelMailmsglist_msgidmsglist_msgidq_proto_squirrelmailbytesMessage identifier.
squirrelmailSquirrelMailattach_sizeattach_sizeq_proto_squirrelmailuint32Attached file MIME size.
squirrelmailSquirrelMaildatedateq_proto_squirrelmailbytesMessage date.
squirrelmailSquirrelMailsender_aliassender_aliasq_proto_squirrelmailbytesName of the email sender.
squirrelmailSquirrelMailsender_emailsender_emailq_proto_squirrelmailbytesEmail address of the email sender.
squirrelmailSquirrelMailmsg_idmsg_idq_proto_squirrelmailbytesIdentifier of the message.
squirrelmailSquirrelMailfolderfolderq_proto_squirrelmailbytesIndicates the directory from where messages are read.
squirrelmailSquirrelMailsubjectsubjectq_proto_squirrelmailbytesMessage subject.
squirrelmailSquirrelMailreceiver_typereceiver_typeq_proto_squirrelmailbytesType of the email receiver.
squirrelmailSquirrelMailreceiver_aliasreceiver_aliasq_proto_squirrelmailbytesName of email receiver (included cc and bcc receivers).
squirrelmailSquirrelMailreceiver_emailreceiver_emailq_proto_squirrelmailbytesEmail address of message receiver (included cc and bcc receivers).
squirrelmailSquirrelMailattach_typeattach_typeq_proto_squirrelmailbytesContent type of the sent attached file.
squirrelmailSquirrelMailattach_filenameattach_filenameq_proto_squirrelmailbytesAttachment name.
squirrelmailSquirrelMaildraftdraftq_proto_squirrelmailuint32Indicates if the email is a draft or has really been posted
squirrelmailSquirrelMailactionactionq_proto_squirrelmailbytesIndicates if the message is read (Read) or composed (Compose).
squirrelmailSquirrelMaillogin_serverlogin_serverq_proto_squirrelmailbytesConcatenated login and server: <login>@<server>.
squirrelmailSquirrelMailpasswordpasswordq_proto_squirrelmailbytesUser's password string.
squirrelmailSquirrelMailloginloginq_proto_squirrelmailbytesUser's login string.
squirrelmailSquirrelMailmsglist_foldermsglist_folderq_proto_squirrelmailbytesIndicates the directory from a message list.
squirrelmailSquirrelMailattach_idattach_idq_proto_squirrelmailbytesAttachment identifier.
spidStatistical Protocol IDentificationfound_protocolfound_protocolq_proto_spidbytesProtocol name that has been discovered by SPID.
spidStatistical Protocol IDentificationdivergencedivergenceq_proto_spiduint32Divergence giving the distance" between the flow content and the selected SPID model. The smaller the divergence, the better the classification."
sctpStream Control Transmission Protocolchunk_data_tsnchunk_data_tsnq_proto_sctpuint32The Transmission Sequence Number is a global sequence number of chunks.
sctpStream Control Transmission Protocolchunk_data_protochunk_data_protoq_proto_sctpuint32Indicating the data type (or protocol) containing in the chunk.
sctpStream Control Transmission Protocolchunk_data_lenchunk_data_lenq_proto_sctpuint32The chunk data length (the payload length).
syslogSyslogcodecodeq_proto_syslogbytesMessage type.
t38T.38callercallerq_proto_t38bytesCalling subscriber identification
t38T.38calleecalleeq_proto_t38bytesCalled subscriber identification
t38T.38fax_message_numberfax_message_numberq_proto_t38bytesIdentification associated to the following FAX messages: CSI the called subscriber identification (which is equal to the callee), CIG the calling subscriber identification (which is the caller), PWD the password, SEP the selective polling, PSA the polled subaddress, TSI the transmitting subscriber identification, SUB the subaddress and SID the sender identification.
tdsTabular Data Streamloginloginq_proto_tdsbytesUser's login string.
tdsTabular Data Streampasswordpasswordq_proto_tdsbytesUser's password string.
tdsTabular Data Streamhostnamehostnameq_proto_tdsbytesName of workstation communicating with the SQL server.
tdsTabular Data Streamapplicationapplicationq_proto_tdsbytesName of application used to connect to the database.
tdsTabular Data Streamserverserverq_proto_tdsbytesName of server hosting the SQL Server.
tdsTabular Data Streamlibrarylibraryq_proto_tdsbytesName of network dynamic-link library used.
tdsTabular Data Streamdatabase_namedatabase_nameq_proto_tdsbytesName of the used database.
tdsTabular Data Streamlanguagelanguageq_proto_tdsbytesUser locale.
tdsTabular Data Streamqueryqueryq_proto_tdsbytesSQL query sent by the client.
tdsTabular Data Streamlogin_encryptedlogin_encryptedq_proto_tdsuint32This attribute is set to one if the login phase is encrypted. Implemented conforming to the Microsoft 2014 MS-TDS official specification (http://msdn.microsoft.com/en-us/library/dd304523.aspx); beware, the behaviour may be different with old releases of MS SQL Server not supporting the standard.
tdsTabular Data Streamquery_idquery_idq_proto_tdsbytesRequest identifier. It is used to correlate SQL queries with query parameter values (Bind Variables).
tdsTabular Data Streambind_variablebind_variableq_proto_tdsbytesParent attribute containing attributes related to a query parameter (Bind Variable).
tdsTabular Data Streamvariable_typevariable_typeq_proto_tdsbytesData type of a SQL query parameter (Bind Variable).
tdsTabular Data Streamvariable_idvariable_idq_proto_tdsbytesQuery parameter (Bind Variable) identifier within a SQL request.
tdsTabular Data Streamvariable_formatvariable_formatq_proto_tdsuint32Format of a SQL query parameter (Bind Variable).
tdsTabular Data Streamnumber_columnsnumber_columnsq_proto_tdsuint64Column count in the result data set retrieved from server after a SQL query.
tdsTabular Data Streamnumber_rowsnumber_rowsq_proto_tdsuint32Row count in the result data set retrieved from server after a SQL query.
tdsTabular Data Streamsqlstate_codesqlstate_codeq_proto_tdsuint32SQL error code.
taggedTagged.comloginloginq_proto_taggedbytesUser's login string.
taggedTagged.compasswordpasswordq_proto_taggedbytesUser's password string.
tangoTango Video Callscallee_idcallee_idq_proto_tangobytesCalled part identifier.
tangoTango Video Callscaller_idcaller_idq_proto_tangobytesCalling part identifier.
tangoTango Video Callscalleecalleeq_proto_tangobytesContains the identity (or the phone number) of the called party for a call.
tangoTango Video Callscallercallerq_proto_tangobytesContains the identity (or the phone number) of the initiator of the call.
tangoTango Video Callscall_idcall_idq_proto_tangobytesCall id, extracted for each call.
tangoTango Video Callsphone_numberphone_numberq_proto_tangobytesUser's phone number.
tangoTango Video Callsuser_emailuser_emailq_proto_tangobytesUser's email address.
tangoTango Video Callsloginloginq_proto_tangobytesUser's login string.
tangoTango Video Callsuser_iduser_idq_proto_tangobytesUnique user identifier.
tangoTango Video Callsdevice_iddevice_idq_proto_tangobytesUser's device identifier.
tangoTango Video Callscall_durationcall_durationq_proto_tangouint32Call duration.
tangoTango Video Callsserviceserviceq_proto_tangobytesCurrent service identification string.
tangoTango Video Callsattach_filenameattach_filenameq_proto_tangobytesTransferred file name.
tangoTango Video Callsservice_duration_tvservice_duration_tvq_proto_tangostringTimeval structure indicating, when the service is ended, the duration of it in seconds and microseconds.
tangoTango Video Callsservice_durationservice_durationq_proto_tangouint324 bytes integer value indicating, when the service is ended, the duration of it in seconds.
tangoTango Video Callsservice_idservice_idq_proto_tangouint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
tangoTango Video Callsservice_statsservice_statsq_proto_tangobytesComposite attribute containing the packet metrics used for each new service type detection, extracting when performing STATISTICAL detection method only. Note: this attribute won't be extracted in case of session expiration (eg. when the current service is not ended properly by the user).
tchatcheTchatcheloginloginq_proto_tchatchebytesUser's login string.
tchatcheTchatchepasswordpasswordq_proto_tchatchebytesUser's password string.
teamspeakTeamspeak v2channel_descriptionchannel_descriptionq_proto_teamspeakbytesChannel description (long)
teamspeakTeamspeak v2channel_actionchannel_actionq_proto_teamspeakbytesAction associated to a channel
teamspeakTeamspeak v2channel_topicchannel_topicq_proto_teamspeakbytesChannel topic (short)
teamspeakTeamspeak v2channel_userchannel_userq_proto_teamspeakbytesUser associated to an action on a channel
teamspeakTeamspeak v2channel_namechannel_nameq_proto_teamspeakbytesChannel name
teamspeakTeamspeak v2channel_idchannel_idq_proto_teamspeakuint32Channel ID
teamspeakTeamspeak v2contact_uidcontact_uidq_proto_teamspeakuint32Contact ID.
teamspeakTeamspeak v2contact_aliascontact_aliasq_proto_teamspeakbytesContact alias.
teamspeakTeamspeak v2message_scopemessage_scopeq_proto_teamspeakuint32Message scope
teamspeakTeamspeak v2messagemessageq_proto_teamspeakbytesContains the chat message.
teamspeakTeamspeak v2receiver_uidreceiver_uidq_proto_teamspeakuint32Receiver ID for this message
teamspeakTeamspeak v2receiverreceiverq_proto_teamspeakbytesContains the identity of the receiver for a chat message or a file transfer.
teamspeakTeamspeak v2sender_uidsender_uidq_proto_teamspeakuint32Sender ID for this message
teamspeakTeamspeak v2sendersenderq_proto_teamspeakbytesContains the identity of the sender of a chat session or a file transfer.
teamspeakTeamspeak v2channelchannelq_proto_teamspeakbytesChat room name.
teamspeakTeamspeak v2greeting_messagegreeting_messageq_proto_teamspeakbytesServer greeting message
teamspeakTeamspeak v2server_versionserver_versionq_proto_teamspeakbytesServer software version
teamspeakTeamspeak v2server_nameserver_nameq_proto_teamspeakbytesServer name
teamspeakTeamspeak v2server_platformserver_platformq_proto_teamspeakbytesServer architecture
teamspeakTeamspeak v2client_versionclient_versionq_proto_teamspeakbytesClient software version
teamspeakTeamspeak v2client_softwareclient_softwareq_proto_teamspeakbytesClient software name
teamspeakTeamspeak v2client_platformclient_platformq_proto_teamspeakbytesClient architecture
teamspeakTeamspeak v2client_uidclient_uidq_proto_teamspeakuint32Client session ID
teamspeakTeamspeak v2session_idsession_idq_proto_teamspeakuint32Uniquely identifies the current user session.
teamspeakTeamspeak v2passwordpasswordq_proto_teamspeakbytesUser's password string.
teamspeakTeamspeak v2loginloginq_proto_teamspeakbytesUser's login string.
teamspeakTeamspeak v2nicknamenicknameq_proto_teamspeakbytesUser nickname
telegramTelegramserviceserviceq_proto_telegrambytesCurrent service identification string.
telegramTelegramservice_idservice_idq_proto_telegramuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
telegramTelegramservice_durationservice_durationq_proto_telegramuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
telegramTelegramservice_duration_tvservice_duration_tvq_proto_telegramstringstructure indicating, when the service is ended, the length of it in second and microseconds.
telnetTelnetloginloginq_proto_telnetbytesUser's login string.
telnetTelnetpasswordpasswordq_proto_telnetbytesUser's password string.
telnetTelnetterm_typeterm_typeq_proto_telnetbytesTerminal type.
telnetTelnetrttrttq_proto_telnetstringServer response time.
teredoTeredo protocolserver_ipserver_ipq_proto_teredostringThe IPv4 network address of the Teredo server involved in the exchange, read from the encapsulated IPv6 packet header
teredoTeredo protocolclient_ipclient_ipq_proto_teredostringClient's mapped IPv4 net address.
teredoTeredo protocolorigin_client_iporigin_client_ipq_proto_teredostringIPv4 client address as visible in the Origin Indication
teredoTeredo protocolclient_idclient_idq_proto_teredobytesClient identifier, set up during its configuration
teredoTeredo protocolauth_valueauth_valueq_proto_teredobytesClient Authentication string
tcpTransmission Control Protocolseg_buffered_countseg_buffered_countq_proto_tcpuint32Number of segments that have been buffered for reassembly
tcpTransmission Control Protocolseg_buffered_sizeseg_buffered_sizeq_proto_tcpuint32Sizes sum of segments that have been buffered for reassembly
tnsTransparent Network Service (Oracle)loginloginq_proto_tnsbytesUser's login string.
tnsTransparent Network Service (Oracle)passwordpasswordq_proto_tnsbytesUser's password string.
tnsTransparent Network Service (Oracle)basebaseq_proto_tnsbytesDatabase name.
tnsTransparent Network Service (Oracle)server_hostnameserver_hostnameq_proto_tnsbytesDatabase server hostname.
tnsTransparent Network Service (Oracle)server_osserver_osq_proto_tnsbytesDatabase server operating system.
tnsTransparent Network Service (Oracle)client_osclient_osq_proto_tnsbytesClient machine operating system.
tnsTransparent Network Service (Oracle)client_hostnameclient_hostnameq_proto_tnsbytesClient machine hostname.
tnsTransparent Network Service (Oracle)client_program_pathclient_program_pathq_proto_tnsbytesClient program absolute path.
tnsTransparent Network Service (Oracle)client_program_nameclient_program_nameq_proto_tnsbytesClient program name.
tnsTransparent Network Service (Oracle)queryqueryq_proto_tnsbytesSQL query sent by the client.
tnsTransparent Network Service (Oracle)response_sizeresponse_sizeq_proto_tnsuint32Unitary size in bytes of one the PDUs returned by the server.
tnsTransparent Network Service (Oracle)response_timeresponse_timeq_proto_tnsstringElapsed time between sending of the tns request and reception of its response.
tnsTransparent Network Service (Oracle)rdbms_versionrdbms_versionq_proto_tnsbytesVersion of the Relational Data Base Management System
tnsTransparent Network Service (Oracle)oracle_versionoracle_versionq_proto_tnsuint32Version of the Oracle server
tnsTransparent Network Service (Oracle)sqlstate_codesqlstate_codeq_proto_tnsbytesSQL error code.
tnsTransparent Network Service (Oracle)variable_idvariable_idq_proto_tnsbytesQuery parameter (Bind Variable) identifier within a SQL request.
tnsTransparent Network Service (Oracle)variable_typevariable_typeq_proto_tnsbytesData type of a SQL query parameter (Bind Variable).
tnsTransparent Network Service (Oracle)number_columnsnumber_columnsq_proto_tnsuint64Column count in the result data set retrieved from server after a SQL query.
tnsTransparent Network Service (Oracle)number_rowsnumber_rowsq_proto_tnsuint32Row count in the result data set retrieved from server after a SQL query.
tftpTrivial File Transfer Protocolfilenamefilenameq_proto_tftpbytesName of the transferred file.
tftpTrivial File Transfer Protocolrequest_filenamerequest_filenameq_proto_tftpbytesName of the requested file.
tftpTrivial File Transfer Protocolfilesizefilesizeq_proto_tftpuint32Size (byte) of the transferred file.
tftpTrivial File Transfer Protocolmodemodeq_proto_tftpbytesFile transfer mode (Netascii/ Binary/ Mail).
tftpTrivial File Transfer Protocolqueryqueryq_proto_tftpbytesCommand type.
twitterTwittermedia_urlmedia_urlq_proto_twitterbytesURL of the image which is shared inside a tweet (legacy Twitter API).
twitterTwittertweettweetq_proto_twitterbytesText of a tweet or a direct message.
twitterTwitteruser_iduser_idq_proto_twitterbytesUser id appearing in the result of a request.
twitterTwitterparam_screen_nameparam_screen_nameq_proto_twitterbytesUser screen name used as request parameter.
twitterTwitterparam_user_idparam_user_idq_proto_twitterbytesUser id used as request parameter.
twitterTwitteractionactionq_proto_twitterbytesIndicates the action executed by the user.
twitterTwitterloginloginq_proto_twitterbytesUser's login string.
twitterTwittersession_idsession_idq_proto_twitterbytesUniquely identifies the current user session.
unknownUnknown virtual protocolmaybe_application_idmaybe_application_idq_proto_unknownuint32Possible application's ID for this flow.
unknownUnknown virtual protocolmaybe_applicationmaybe_applicationq_proto_unknownbytesPossible application's name for this flow.
unknownUnknown virtual protocolmaybe_familymaybe_familyq_proto_unknownbytesProtocol family of a possible application for this flow.
upnpupnpserver_agentserver_agentq_proto_upnpbytesServer information (SERVER field value). It contains the product tokens: <OS name/OS version> <UPnP/upnp version> <product name/product version>, v5 only.
upnpupnpuser_agentuser_agentq_proto_upnpbytesClient information (USER-AGENT field value). It contains the product tokens: <OS name/OS version> <UPnP/upnp version> <product name/product version>,v5 only.
ustreamUStreampasswordpasswordq_proto_ustreambytesUser's password string.
ustreamUStreamloginloginq_proto_ustreambytesUser's login string.
ustreamUStreamquery_textquery_textq_proto_ustreambytesQuery sent to the search engine.
ustreamUStreamquery_rawquery_rawq_proto_ustreambytesContains the query sent to the search engine as indicated in the URL.
viadeoViadeo.comloginloginq_proto_viadeobytesUser's login string.
viadeoViadeo.comcontact_emailcontact_emailq_proto_viadeobytesContact's mail address.
viberViberfilesizefilesizeq_proto_viberuint64Size (byte) of the transferred file.
viberViberserviceserviceq_proto_viberbytesCurrent service identification string.
viberViberservice_idservice_idq_proto_viberuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
viberViberservice_durationservice_durationq_proto_viberuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
viberViberservice_duration_tvservice_duration_tvq_proto_viberstringstructure indicating, when the service is ended, the length of it in second and microseconds.
vxlanVirtual Extensible Lanvxlan_idvxlan_idq_proto_vxlanuint32VLAN Identifier of the frame.
vkontakteVk.com (Vkontakte)group_namegroup_nameq_proto_vkontaktebytesName of the group the user has subscribed to.
vkontakteVk.com (Vkontakte)contact_uidcontact_uidq_proto_vkontaktebytesContact ID.
vkontakteVk.com (Vkontakte)account_uidaccount_uidq_proto_vkontaktebytesUser ID.
vkontakteVk.com (Vkontakte)loginloginq_proto_vkontaktebytesUser's login string.
webexWebExserviceserviceq_proto_webexbytesCurrent service identification string, v5 only.
webexWebExservice_idservice_idq_proto_webexuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer), v5 only.
webexWebExservice_durationservice_durationq_proto_webexuint324 bytes integer value indicating, when the service is ended, the length of it in seconds, v5 only.
webexWebExservice_duration_tvservice_duration_tvq_proto_webexstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds, v5 only.
wechatWeChatservice_idservice_idq_proto_wechatuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
wechatWeChatserviceserviceq_proto_wechatbytesCurrent service identification string.
wechatWeChatservice_durationservice_durationq_proto_wechatuint324 bytes integer value indicating, when the service is ended, the length of it in seconds
wechatWeChatservice_duration_tvservice_duration_tvq_proto_wechatstringstructure indicating, when the service is ended, the length of it in second and microseconds.
wechatWeChatuser_iduser_idq_proto_wechatbytesUnique identifier related to a single user. This attribute is available for clear traffic from Mobile applications, it may be not available for traffic from recent web browsers enforcing use of TLS.
whatsappWhatsApp Messengerversionversionq_proto_whatsappbytesProgram version.
whatsappWhatsApp Messengerservice_idservice_idq_proto_whatsappuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
whatsappWhatsApp Messengerserviceserviceq_proto_whatsappbytesCurrent service identification string.
whatsappWhatsApp Messengerservice_duration_tvservice_duration_tvq_proto_whatsappstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds.
whatsappWhatsApp Messengerservice_durationservice_durationq_proto_whatsappuint324 bytes integer value indicating, when the service is ended, the length of it in seconds.
wikipediaWikipedia.comquery_textquery_textq_proto_wikipediabytesQuery sent to the search engine.
wikipediaWikipedia.comquery_rawquery_rawq_proto_wikipediabytesContains the query sent to the search engine as indicated in the URL.
live_groupsWindows Live Groupsloginloginq_proto_live_groupsbytesUser's login string.
live_groupsWindows Live Groupsgroup_namegroup_nameq_proto_live_groupsbytesName of the group the user has subscribed to.
live_groupsWindows Live Groupssender_emailsender_emailq_proto_live_groupsbytesEmail address of the email sender.
live_groupsWindows Live Groupssubjectsubjectq_proto_live_groupsbytesMessage subject.
live_groupsWindows Live Groupsactionactionq_proto_live_groupsbytesIndicates if the message is read (Read) or composed (Compose).
live_groupsWindows Live Groupsmsglist_subjectmsglist_subjectq_proto_live_groupsbytesMessage subject in a message list.
live_groupsWindows Live Groupsmsglist_sender_emailmsglist_sender_emailq_proto_live_groupsbytesAddress of email sender.
live_hotmailWindows Live Hotmailloginloginq_proto_live_hotmailbytesUser's login string.
live_hotmailWindows Live Hotmailsender_emailsender_emailq_proto_live_hotmailbytesEmail address of the email sender.
live_hotmailWindows Live Hotmailreceiver_emailreceiver_emailq_proto_live_hotmailbytesEmail address of message receiver (included cc and bcc receivers).
live_hotmailWindows Live Hotmailsubjectsubjectq_proto_live_hotmailbytesMessage subject.
live_hotmailWindows Live Hotmailattach_filenameattach_filenameq_proto_live_hotmailbytesAttachment name. Generally encoded in UTF-8, it can be in UTF-16 in some cases.
live_hotmailWindows Live Hotmailactionactionq_proto_live_hotmailbytesIndicates if the message is read (Read) or composed (Compose).
windows_marketplaceWindows Marketplaceapplication_nameapplication_nameq_proto_windows_marketplacebytesName of the downloaded app.
windows_updateWindows Updateplatformplatformq_proto_windows_updatebytesIndicating the Windows version using this update
windows_updateWindows Updatekbkbq_proto_windows_updatebyteskb (Knowledge base) is a unique internal Microsoft number to identify different software and updates.
winmxWinmxloginloginq_proto_winmxbytesUser's login string.
winmxWinmxqueryqueryq_proto_winmxbytesQuery sent to find a file.
winmxWinmxfilenamefilenameq_proto_winmxbytesName of the transferred file.
winmxWinmxfilesizefilesizeq_proto_winmxuint32Size (byte) of the transferred file.
winmxWinmxfile_chunk_lenfile_chunk_lenq_proto_winmxuint32Size of the transferred piece.
winmxWinmxfile_chunk_data_offsetfile_chunk_data_offsetq_proto_winmxuint32Offset of the transferred data.
winmxWinmxloadwayloadwayq_proto_winmxbytesContains the file transfer way (Upload vs Download).
wspWireless Session Protocolpdu_typepdu_typeq_proto_wspbytesMessage type.
wspWireless Session Protocoluriuriq_proto_wspbytesComplete name (path + filename) of a web resource.
wspWireless Session Protocolconnect_rttconnect_rttq_proto_wspstringConnection establishment time.
wspWireless Session Protocolquery_rttquery_rttq_proto_wspstringElapsed time between a request and its response.
wspWireless Session Protocolserverserverq_proto_wspbytesServer name.
wspWireless Session Protocoluser_agentuser_agentq_proto_wspbytesClient mobile name.
wspWireless Session Protocolmime_typemime_typeq_proto_wspbytesData type.
wspWireless Session Protocolrequest_sizerequest_sizeq_proto_wspuint32Contains the total length of the request or the response (including headers).
wspWireless Session Protocolmime_type_mainmime_type_mainq_proto_wspbytesPrimary part of the MIME type.
wspWireless Session Protocolmime_type_submime_type_subq_proto_wspbytesSecond part of the MIME type.
wspWireless Session Protocolprofileprofileq_proto_wspbytesA link for a full description of the used user_agent.
wspWireless Session Protocolindexindexq_proto_wspuint32Identifier of the request and response in a WSP flow.
wspWireless Session Protocolindex_clientindex_clientq_proto_wspuint32Identifier of the request in a WSP flow.
wspWireless Session Protocolindex_serverindex_serverq_proto_wspuint32Identifier of the response in a WSP flow.
xdmcpX Display Manager Control Protocolclient_ipclient_ipq_proto_xdmcpstringClient IPv4 address.
xdmcpX Display Manager Control Protocolserver_ipserver_ipq_proto_xdmcpstringServer IPv4 address.
xdmcpX Display Manager Control Protocolserver_statusserver_statusq_proto_xdmcpbytesX11 server availability.
x25X.25calling_addrcalling_addrq_proto_x25bytesCalling station address.
x25X.25called_addrcalled_addrq_proto_x25bytesCalled station address.
x25X.25pkt_typepkt_typeq_proto_x25bytesPacket type.
xcapXcapsupplementary_servicesupplementary_serviceq_proto_xcapbytesSupplementary Service in VoLTE flow (only with auid simservs)
xcapXcapauidauidq_proto_xcapbytesID of the application
jabberXMPP Protocol (Jabber)loginloginq_proto_jabberbytesUser's login string.
jabberXMPP Protocol (Jabber)nicknamenicknameq_proto_jabberbytescontains the used username.
jabberXMPP Protocol (Jabber)versionversionq_proto_jabberbytesJABBER software version.
jabberXMPP Protocol (Jabber)user_agentuser_agentq_proto_jabberbytesName of the software used.
jabberXMPP Protocol (Jabber)ososq_proto_jabberbytesClient operating system.
jabberXMPP Protocol (Jabber)messagemessageq_proto_jabberbytesContains the chat message.
jabberXMPP Protocol (Jabber)encodingencodingq_proto_jabberbytesMessage encoding.
jabberXMPP Protocol (Jabber)sendersenderq_proto_jabberbytesContains the identity of the sender of a chat session or a file transfer.
jabberXMPP Protocol (Jabber)receiverreceiverq_proto_jabberbytesContains the identity of the receiver for a chat message or a file transfer.
jabberXMPP Protocol (Jabber)file_senderfile_senderq_proto_jabberbytesContains the identity of the sender of a file transfer.
jabberXMPP Protocol (Jabber)file_receiverfile_receiverq_proto_jabberbytesContains the identity of the receiver for a file transfer.
jabberXMPP Protocol (Jabber)filenamefilenameq_proto_jabberbytesName of the transferred file.
jabberXMPP Protocol (Jabber)filesizefilesizeq_proto_jabberuint32Size (byte) of the transferred file.
jabberXMPP Protocol (Jabber)file_sidfile_sidq_proto_jabberbytesTransferred file identifier.
jabberXMPP Protocol (Jabber)contact_logincontact_loginq_proto_jabberbytesContact login.
jabberXMPP Protocol (Jabber)contact_namecontact_nameq_proto_jabberbytesContact name.
jabberXMPP Protocol (Jabber)contact_statuscontact_statusq_proto_jabberbytesContact status.
jabberXMPP Protocol (Jabber)call_idcall_idq_proto_jabberbytesCall id, extracted for each call.
jabberXMPP Protocol (Jabber)start_timestart_timeq_proto_jabberstringStart date of the call.
jabberXMPP Protocol (Jabber)callercallerq_proto_jabberbytesContains the identity (or the phone number) of the initiator of the call.
jabberXMPP Protocol (Jabber)calleecalleeq_proto_jabberbytesContains the identity (or the phone number) of the called party for a call.
jabberXMPP Protocol (Jabber)call_durationcall_durationq_proto_jabberstringCall duration.
jabberXMPP Protocol (Jabber)end_statusend_statusq_proto_jabberbytesSession end reason.
jabberXMPP Protocol (Jabber)caller_addrcaller_addrq_proto_jabberstringAddress which could be used by the initiator of the call.
jabberXMPP Protocol (Jabber)callee_addrcallee_addrq_proto_jabberstringAddress which could be used by the called party.
jabberXMPP Protocol (Jabber)file_chunk_lenfile_chunk_lenq_proto_jabberuint32Size of the transferred piece.
jabberXMPP Protocol (Jabber)file_chunk_numberfile_chunk_numberq_proto_jabberuint32Number of the transferred piece.
jabberXMPP Protocol (Jabber)file_chunk_sidfile_chunk_sidq_proto_jabberbytesTransferred file identifier.
yahoo_groupsYahoo groupsloginloginq_proto_yahoo_groupsbytesUser's login string.
yahoo_groupsYahoo groupsquery_rawquery_rawq_proto_yahoo_groupsbytesContains the query sent to the search engine as indicated in the URL.
yahoo_groupsYahoo groupsquery_textquery_textq_proto_yahoo_groupsbytesQuery sent to the search engine.
yahoo_groupsYahoo groupsgroup_namegroup_nameq_proto_yahoo_groupsbytesName of the group the user has subscribed to.
yahoo_groupsYahoo groupsnamenameq_proto_yahoo_groupsbytesUser's full name.
yahoo_groupsYahoo groupssender_emailsender_emailq_proto_yahoo_groupsbytesEmail address of the email sender.
yahoo_groupsYahoo groupssubjectsubjectq_proto_yahoo_groupsbytesMessage subject.
ymail_classicYahoo Mail classicloginloginq_proto_ymail_classicbytesUser's login string.
ymail_classicYahoo Mail classicsession_idsession_idq_proto_ymail_classicbytesUniquely identifies the current user session.
ymail_classicYahoo Mail classicsender_emailsender_emailq_proto_ymail_classicbytesEmail address of the email sender.
ymail_classicYahoo Mail classicreceiver_emailreceiver_emailq_proto_ymail_classicbytesEmail address of message receiver (included cc and bcc receivers).
ymail_classicYahoo Mail classicsubjectsubjectq_proto_ymail_classicbytesMessage subject.
ymail_classicYahoo Mail classicattach_filenameattach_filenameq_proto_ymail_classicbytesAttachment name.
ymail_classicYahoo Mail classicattach_sizeattach_sizeq_proto_ymail_classicuint32Attached file MIME size.
ymail_classicYahoo Mail classicactionactionq_proto_ymail_classicbytesIndicates if the message is read (Read) or composed (Compose).
ymail2Yahoo Mail v.2.0msglist_subjectmsglist_subjectq_proto_ymail2bytesMessage subject in a message list.
ymail2Yahoo Mail v.2.0msglist_sender_emailmsglist_sender_emailq_proto_ymail2bytesAddress of email sender.
ymail2Yahoo Mail v.2.0msglist_receiver_emailmsglist_receiver_emailq_proto_ymail2bytesEmail address of the email receiver.
ymail2Yahoo Mail v.2.0loginloginq_proto_ymail2bytesUser's login string.
ymail2Yahoo Mail v.2.0receiver_emailreceiver_emailq_proto_ymail2bytesEmail address of message receiver (included cc and bcc receivers).
ymail2Yahoo Mail v.2.0sender_emailsender_emailq_proto_ymail2bytesEmail address of the email sender.
ymail2Yahoo Mail v.2.0attach_sizeattach_sizeq_proto_ymail2uint32Attached file MIME size.
ymail2Yahoo Mail v.2.0attach_filenameattach_filenameq_proto_ymail2bytesAttachment name.
ymail2Yahoo Mail v.2.0actionactionq_proto_ymail2bytesIndicates if the message is read (Read) or composed (Compose).
ymail2Yahoo Mail v.2.0session_idsession_idq_proto_ymail2bytesUniquely identifies the current user session.
ymail2Yahoo Mail v.2.0subjectsubjectq_proto_ymail2bytesMessage subject.
yahoo_mapsYahoo Mapsquery_textquery_textq_proto_yahoo_mapsbytesQuery sent to the search engine.
ymsgYahoo Messengercallercallerq_proto_ymsgbytesContains the identity (or the phone number) of the initiator of the call.
ymsgYahoo Messengercalleecalleeq_proto_ymsgbytesContains the identity (or the phone number) of the called party for a call.
ymsgYahoo Messengerloginloginq_proto_ymsgbytesUser's login string.
ymsgYahoo Messengerversionversionq_proto_ymsgbytesThe protocol version number used by the method.
ymsgYahoo Messengerclient_versionclient_versionq_proto_ymsgbytesClient version.
ymsgYahoo Messengermessagemessageq_proto_ymsgbytesContains the chat message.
ymsgYahoo Messengermessage_lenmessage_lenq_proto_ymsguint32Contains the length of the chat message.
ymsgYahoo Messengerencodingencodingq_proto_ymsgbytesMessage encoding.
ymsgYahoo Messengersendersenderq_proto_ymsgbytesContains the identity of the sender of a chat session or a file transfer.
ymsgYahoo Messengerreceiverreceiverq_proto_ymsgbytesContains the identity of the receiver for a chat message or a file transfer.
ymsgYahoo Messengerchat_idchat_idq_proto_ymsgbytesWindow chat id.
ymsgYahoo Messengertimestamptimestampq_proto_ymsgstringPacket timestamp.
ymsgYahoo Messengerserviceserviceq_proto_ymsgbytesCurrent service identification string.
ymsgYahoo Messengersessionidsessionidq_proto_ymsguint32Identification number of session.
ymsgYahoo Messengercontact_logincontact_loginq_proto_ymsgbytesContact login.
ymsgYahoo Messengerclient_firstnameclient_firstnameq_proto_ymsgbytesFirst name of the user.
ymsgYahoo Messengerclient_lastnameclient_lastnameq_proto_ymsgbytesLast name of the user.
ymsgYahoo Messengerclient_countryclient_countryq_proto_ymsgbytesCountry of the user.
ymsgYahoo Messengerchannelchannelq_proto_ymsgbytesChat room name.
ymsgYahoo Messengerfile_senderfile_senderq_proto_ymsgbytesContains the identity of the sender of a file transfer.
ymsgYahoo Messengerfile_receiverfile_receiverq_proto_ymsgbytesContains the identity of the receiver for a file transfer.
ymsgYahoo Messengerfile_urlfile_urlq_proto_ymsgbytesURL of the transfered file.
ymsgYahoo Messengerfilenamefilenameq_proto_ymsgbytesName of the transferred file.
ymsgYahoo Messengerfilesizefilesizeq_proto_ymsguint32Size (byte) of the transferred file.
ymsgYahoo Messengerfilehashfilehashq_proto_ymsgbytesHash of transferred file.
ymsgYahoo Messengerclient_local_ipclient_local_ipq_proto_ymsgstringClient local ip.
ymsgYahoo Messengerchannel_namechannel_nameq_proto_ymsgbytesChannel name
ymsgYahoo Messengerchannel_actionchannel_actionq_proto_ymsgbytesAction associated to a channel
ymsgYahoo Messengerchannel_userchannel_userq_proto_ymsgbytesUser associated to an action on a channel
ymsgYahoo Messengerclient_ipclient_ipq_proto_ymsgstringUser IP address.
ymsgYahoo Messengerserver_ipserver_ipq_proto_ymsgstringServer IP address.
ymsgYahoo Messengercall_durationcall_durationq_proto_ymsgstringCall duration.
ymsgYahoo Messengertransfer_idtransfer_idq_proto_ymsgbytesTransfer identifier.
ymsgYahoo Messengerwebcam_brandwebcam_brandq_proto_ymsgbytesWebcam brand.
ymsgYahoo Messengerconference_idconference_idq_proto_ymsgbytesroom identifier for a given conference
ymsg_confYahoo Messenger conference serviceloginloginq_proto_ymsg_confbytesUser's login string.
ymsg_confYahoo Messenger conference servicecallercallerq_proto_ymsg_confbytesContains the identity (or the phone number) of the initiator of the call.
ymsg_confYahoo Messenger conference servicecall_durationcall_durationq_proto_ymsg_confstringCall duration.
ymsg_transferYahoo Messenger Transfer Protocolloginloginq_proto_ymsg_transferbytesUser's login string.
ymsg_transferYahoo Messenger Transfer Protocolfile_senderfile_senderq_proto_ymsg_transferbytesContains the identity of the sender of a file transfer.
ymsg_transferYahoo Messenger Transfer Protocolfile_receiverfile_receiverq_proto_ymsg_transferbytesContains the identity of the receiver for a file transfer.
ymsg_transferYahoo Messenger Transfer Protocolfilenamefilenameq_proto_ymsg_transferbytesName of the transferred file.
ymsg_transferYahoo Messenger Transfer Protocolfilesizefilesizeq_proto_ymsg_transferuint32Size (byte) of the transferred file.
ymsg_transferYahoo Messenger Transfer Protocolfile_urlfile_urlq_proto_ymsg_transferbytesURL of the transferred file.
ymsg_transferYahoo Messenger Transfer Protocolclient_ipclient_ipq_proto_ymsg_transferstringUser IP address.
ymsg_transferYahoo Messenger Transfer Protocolserver_ipserver_ipq_proto_ymsg_transferstringServer IP address.
ymsg_videoYahoo Messenger Videologinloginq_proto_ymsg_videobytesUser's login string.
ymsg_videoYahoo Messenger Videowebcam_brandwebcam_brandq_proto_ymsg_videobytesBrand of webcam.
yahoo_searchYahoo Searchquery_textquery_textq_proto_yahoo_searchbytesQuery sent to the search engine.
yahoo_searchYahoo Searchquery_rawquery_rawq_proto_yahoo_searchbytesContains the query sent to the search engine as indicated in the URL.
ymail_mobile_newYahoo webmail for mobileattach_sizeattach_sizeq_proto_ymail_mobile_newuint32Attached file MIME size.
ymail_mobile_newYahoo webmail for mobileattach_filenameattach_filenameq_proto_ymail_mobile_newbytesAttachment name.
ymail_mobile_newYahoo webmail for mobilesubjectsubjectq_proto_ymail_mobile_newbytesMessage subject.
ymail_mobile_newYahoo webmail for mobileactionactionq_proto_ymail_mobile_newbytesIndicates if the message is read (Read) or composed (Compose).
ymail_mobile_newYahoo webmail for mobileloginloginq_proto_ymail_mobile_newbytesUser's login string.
ymail_mobile_newYahoo webmail for mobilesession_idsession_idq_proto_ymail_mobile_newbytesUniquely identifies the current user session.
ymsg_webmessengerYahoo Webmessengerserviceserviceq_proto_ymsg_webmessengerbytesCurrent service identification string.
ymsg_webmessengerYahoo Webmessengermessagemessageq_proto_ymsg_webmessengerbytesContains the chat message.
ymsg_webmessengerYahoo Webmessengerreceiverreceiverq_proto_ymsg_webmessengerbytesContains the identity of the receiver for a chat message or a file transfer.
ymsg_webmessengerYahoo Webmessengersendersenderq_proto_ymsg_webmessengerbytesContains the identity of the sender of a chat session or a file transfer.
ymsg_webmessengerYahoo Webmessengercontact_logincontact_loginq_proto_ymsg_webmessengerbytesContact login.
yandex_webmailYandex webmailreceiver_emailreceiver_emailq_proto_yandex_webmailbytesEmail address of message receiver (included cc and bcc receivers).
yandex_webmailYandex webmailsender_emailsender_emailq_proto_yandex_webmailbytesEmail address of the email sender.
yandex_webmailYandex webmailattach_filenameattach_filenameq_proto_yandex_webmailbytesAttachment name.
yandex_webmailYandex webmailattach_sizeattach_sizeq_proto_yandex_webmailuint32Attached file MIME size.
yandex_webmailYandex webmailmsg_idmsg_idq_proto_yandex_webmailbytesIdentifier of the message.
yandex_webmailYandex webmailactionactionq_proto_yandex_webmailbytesIndicates if the message is read (Read) or composed (Compose).
yandex_webmailYandex webmailsubjectsubjectq_proto_yandex_webmailbytesMessage subject.
yandex_webmailYandex webmailmsglist_receiver_emailmsglist_receiver_emailq_proto_yandex_webmailbytesEmail address of the email receiver.
yandex_webmailYandex webmailmsglist_sender_emailmsglist_sender_emailq_proto_yandex_webmailbytesAddress of email sender.
yandex_webmailYandex webmailmsglist_subjectmsglist_subjectq_proto_yandex_webmailbytesMessage subject in a message list.
yandex_webmailYandex webmailloginloginq_proto_yandex_webmailbytesUser's login string.
yandexYandex.ruloginloginq_proto_yandexbytesUser's login string.
yandexYandex.ruquery_rawquery_rawq_proto_yandexbytesContains the query sent to the search engine as indicated in the URL.
yandexYandex.ruquery_textquery_textq_proto_yandexbytesQuery sent to the search engine.
youtubeYoutube.comloginloginq_proto_youtubebytesUser's login string.
youtubeYoutube.comquery_textquery_textq_proto_youtubebytesQuery sent to the search engine.
youtubeYoutube.comurlurlq_proto_youtubebytesContains the url for embedded players
youtubeYoutube.comnamenameq_proto_youtubebytesName the user.
youtubeYoutube.comvideoidvideoidq_proto_youtubebytesContains the unique identifier of the uploaded video
youtubeYoutube.commethodmethodq_proto_youtubebytesContains the method used
zimbraZimbra Webmailloginloginq_proto_zimbrabytesUser's login string.
zimbraZimbra Webmailmsglist_sender_emailmsglist_sender_emailq_proto_zimbrabytesAddress of email sender.
zimbraZimbra Webmailmsglist_receiver_emailmsglist_receiver_emailq_proto_zimbrabytesEmail address of the email receiver.
zimbraZimbra Webmailmsglist_subjectmsglist_subjectq_proto_zimbrabytesMessage subject in a message list.
zimbraZimbra Webmailsender_emailsender_emailq_proto_zimbrabytesEmail address of the email sender.
zimbraZimbra Webmailreceiver_emailreceiver_emailq_proto_zimbrabytesEmail address of message receiver (included cc and bcc receivers).
zimbraZimbra Webmailsubjectsubjectq_proto_zimbrabytesMessage subject.
zimbraZimbra Webmailmsg_idmsg_idq_proto_zimbrabytesIdentifier of the message.
zimbraZimbra Webmailattach_filenameattach_filenameq_proto_zimbrabytesAttachment name.
zimbraZimbra Webmailattach_sizeattach_sizeq_proto_zimbrauint32Attached file MIME size.
zimbraZimbra Webmailactionactionq_proto_zimbrabytesIndicates if the message is read (Read) or composed (Compose).
zimbra_standardZimbra Webmail Standard Versionmsglist_subjectmsglist_subjectq_proto_zimbra_standardbytesMessage subject in a message list.
zimbra_standardZimbra Webmail Standard Versionmsg_idmsg_idq_proto_zimbra_standardbytesIdentifier of the message.
zimbra_standardZimbra Webmail Standard Versionsender_emailsender_emailq_proto_zimbra_standardbytesEmail address of the email sender.
zimbra_standardZimbra Webmail Standard Versionreceiver_emailreceiver_emailq_proto_zimbra_standardbytesEmail address of message receiver (included cc and bcc receivers).
zimbra_standardZimbra Webmail Standard Versionattach_sizeattach_sizeq_proto_zimbra_standarduint32Attached file MIME size.
zimbra_standardZimbra Webmail Standard Versionattach_filenameattach_filenameq_proto_zimbra_standardbytesAttachment name.
zimbra_standardZimbra Webmail Standard Versionsubjectsubjectq_proto_zimbra_standardbytesMessage subject.
zimbra_standardZimbra Webmail Standard Versionactionactionq_proto_zimbra_standardbytesIndicates if the message is read (Read) or composed (Compose).
zimbra_standardZimbra Webmail Standard Versionloginloginq_proto_zimbra_standardbytesUser's login string.
zoomZoomserviceserviceq_proto_zoombytesCurrent service identification string.
zoomZoomservice_idservice_idq_proto_zoomuint32Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for specific cases (example: File Transfer).
zoomZoomservice_durationservice_durationq_proto_zoomuint324 bytes integer value indicating, when the service is ended, the length of it in seconds.
zoomZoomservice_duration_tvservice_duration_tvq_proto_zoomstringTimeval structure indicating, when the service is ended, the length of it in second and microseconds