Command:

fdpi_cli dump flow cache format

Output example:

nthr=1 slic=3 proto=6 ip_1=192.168.4.20:65163 ip_2=217.69.133.145:443 ssid=1675E5CF5FB1337 dpip=91 ittr=16 tmlb='2019/10/30 02:02:51, -357.642147s (4148500652028035 ticks)' ialf=0 drct=0x1 iown=1 ilst=1 btsip=0x2 tcpbts_0='-APRSF' tcpbts_1='-AP-S-' qoest=0 qoef_0=0 qoef_1=0 qoer_0=6 qoer_1=6 whip=94.140.198.86:33326 itrnsld=1 igcache=0 gre_pid=0 gre_mtd=0

Field descriptions:

• nthr=1 — thread number where the entry is placed (for multicluster setups, it may differ from iown)
• slic=3 — cache slice number
• proto=6 — IP protocol
• ip_1=192.168.4.20:65163 ip_2=217.69.133.145:443 — pair of IP addresses and ports identifying the entry. If the protocol does not use ports, the trailing values are 0
• ssid=1675E5CF5FB1337 — session identifier
• dpip=91 — DPI protocol
• ittr=16 — index in the reused entry queue
• tmlb='2019/10/30 02:02:51, -357.642147s (4148500652028035 ticks)' — last access time for the entry
• ialf=0 — processing queue number:
  • en_nalfs_shrt = 0 — short-lived queue
  • en_nalfs_long = 1 — long-lived queue
• drct=0x1 — conditions under which the entry was created. The lower 4 bits define the packet direction used to create the key and, accordingly, the ownership of src_ip and dst_ip
  drct = h_ip_1 < h_ip_2 :
  • drct == 0 — h_ip_1 is src_ip
  • drct == 1 — h_ip_1 is dst_ip
    the upper 4 bits define the flw_dir used when the key was created
• iown=1 — thread number that created the entry
• ilst=1 — thread number that last processed the entry
• btsip=0x2 — service bits for flow processing
• tcpbts_0='-APRSF' tcpbts_1='-AP-S-' — TCP connection flags in both directions:

  ( tcp_bits_ & 0x0020 ) ? 'U' : '-' 
  ( tcp_bits_ & 0x0010 ) ? 'A' : '-'
  ( tcp_bits_ & 0x0008 ) ? 'P' : '-'
  ( tcp_bits_ & 0x0004 ) ? 'R' : '-'
  ( tcp_bits_ & 0x0002 ) ? 'S' : '-'
  ( tcp_bits_ & 0x0001 ) ? 'F' : '-'

• qoest=0 — QoE status:
  • enst_none = 0,
  • enst_ack — waiting for client ACK in response to server SYN+ACK
  • enst_fin_ack — waiting for server FIN+ACK in response to client FIN
  • enst_ack_srvfin — waiting for server ACK in response to client FIN+ACK (server sent FIN first)
• qoef_0=0 qoef_1=0 — number of fragmented packets in both directions
• qoer_0=6 qoer_1=6 — number of retransmissions in both directions
• pktp_0=1 pktp_1=0 — number of packets with payload in both directions, up to 65000
• btsp_0=1 btsp_1=0 — payload volume in both directions, up to 65K
• whoisc=0 or 1 — connection initiator
• Optional — if NAT translation is present:
  • whip=94.140.198.86:33326 — allocated public IP address and port
  • itrnsld=1 — profile data index used to allocate the public address
  • igcache=0 — index in the corresponding gray-to-public address translation cache slice
  • gre_pid=0 — detected callid
  • gre_mtd=0 — public address allocation method for GRE