General description

VAS Experts DPI exports statistics in formats:

IPFIX (NetFlow v10)

netflow5 v5

IPFIX (NetFlow v10)

Full statisctics by sessions is exported for the billing system. You can find the description of format in Configuring export in IPFIX section. To collect, process and store NetFlow, we suggest using the QoE Store software and the DPIUI2 graphical interface.

The section Loging using IPFIX describes the export of meta-information:

ClickStream

SIP

FTP

instant messengers (XMPP)

mail protocols (POP, IMAP, SMTP)

raw unresolved metadata.

NetFlow v5

This format is supported by most of free and commercial tools for collecting and analysing stat data. For your convenience, we deliver free SW to view and analyse statistics - slightly adopted version of nfsen, with extensions to build reports by protocols and independent systems' names.

Transmission of the DPI information by netflow5 has some peculiarities:

The information on the used protocol is defined in dstport field (port number). The port number specified by IANA association for the protocol is used when available. However, for the protocols with floating number (torrents, skype and so on) the special number in the upper range (49152-65534) is reserved. This range is specified by IANA for private ports. The port number 65535 is assigned for protocols that failed to be detected.

The statistics by protocols is transmitted in aggregated format. DPI accumulates statistics by the protocol by combining an information from various sessions. Then DPI sends this information to a collector within the specified schedule. This method allows dramatical reduction of amount of transmitted data.

Direction information is defined by dst_as field (independent system's number)

The statistics by directions is transmitted in aggregated format. DPI accumulates statistics by the direction (AS number) by combining an information from various sessions. Then DPI sends this information to a collector within the specified schedule. This method allows dramatical reduction of amount of transmitted data.