QoE metric descriptions

The Excel file QoE analytics – report field list is useful when configuring triggers. It helps you determine which report contains the required data. Enable macros for the file to work! Example: suppose you need to find a report that contains the RTT metric. To do this, locate the RTT metric in the upper filter table, type "Yes" in the cell below it, then press Enter. As a result, the main table below will be filtered, showing only the reports containing the RTT metric: Each report includes a note specifying where to find it (scroll to the beginning of the document to see the note).

NetFlow

Metric	Description	Values
Delta of octets	Difference in traffic (bytes) between the beginning and end of the selected period
Delta of fragmented packets	Difference in IP packets divided into parts/fragments between the beginning and end of the selected period
RTT	Round-trip time — the total time required to send a signal and receive confirmation. It represents latency and consists of transmission time between two points within a single flow. A flow in DPI includes all network activity within a source/destination socket (source IP:port / destination IP:port).
Source AS	AS number of the source host
Destination AS	AS number of the subscriber
IPv4 source address after NAT	IP address translated by NAT from private to public for external communication and Internet access
Source port after NAT	Port translated by NAT from private to public for external communication and Internet access
Channel/Bridge	Channel — vChannel number. Bridge — number of the bridge through which the traffic passes
Service class	Traffic classes cs0 — cs7. More details	0 — cs0 1 — cs1 … 7 — cs7
Receiver and sender IP interface index	Traffic direction	1 — to whom the traffic is directed 2 — from whom the traffic originates Example: First — outgoing traffic; Second — incoming traffic

ClickStream

All ClickStream metrics are defined only for HTTP traffic. Metrics for HTTPS traffic cannot be determined because it is encrypted.
Metric	Description	Values
Path	The URL path the subscriber visited
Source request URL	The resource from which the request originated. Used during redirection: records the address from which the user was redirected
User agent	User agent string. Identifies the device used for the request
Method	The request method used to contact the server	0 — undefined 1 — GET 2 — POST 3 — PUT 4 — DELETE
Result code	HTTP response code returned by the server	200 — OK 403 — Forbidden
Content size	Amount of data (in bytes) returned by the server in response to the request
Content type	HTTP Content-Type, used to determine the MIME type of the resource
Blocked	Bitmask indicating whether the resource was blocked or redirected	0x3 for HTTP 0x1 for others
Host type	Type of host	1 — HTTP 2 — CNAME 3 — SNI 4 — QUIC

DNS flow

Metric	Description
Host	Domain name of the DNS host from the DNS response
Host category	Automatically determined category of the accessed host
Total	Number of raw log entries grouped into a single record in the aggregated log
Sessions	Number of subscriber Internet sessions in the aggregated log
Hosts	Number of hosts in the aggregated log
Host categories	Number of host categories in the aggregated log
DNS host IPs	Number of unique IP addresses of DNS hosts
Logins	Number of logins in the aggregated log
Subscribers	Number of subscribers in the aggregated log
Channels	Number of vChannels in the aggregated log
Time	Session start time
Session ID	Session identifier
Login	Subscriber login
IPv4 source address	Source address of the request — can be either subscriber or host
IPv6 source address
Source port
IPv4 destination addr	Destination address of the request — can be either subscriber or host
IPv6 destination addr
Destination port
DNS transport	Protocol used for DNS query transmission
DNS host IP	IP address of the DNS host
DNS host port	Port used by the DNS host
Subscriber	Subscriber’s IP address
Subscriber port	Port used by the subscriber
Rrclass	RR Class in the DNS query
DNS type	Type of DNS record (defines the function): 1 — A 5 — CNAME
TTL	Time-to-live for caching this DNS record on a non-authoritative DNS server
DNS data	RDATA content, base64 encoded — can be used to identify IPs belonging to a host
VLAN ID	Unique VLAN identifier
Post VLAN ID	VLAN ID after route modification
DPI ID	DPI number (found in GUI: Administrator → Equipment)
Channel/Bridge	Channel — vChannel number. Bridge — bridge number through which traffic passes
MPLS labels	Labels used for packet routing in MPLS networks

GTP flow

GTP (GPRS Tunneling Protocol) is an IP-based group of connection protocols used in GSM, UMTS, and LTE networks. Mobile operators use GTP as a tunneling protocol for data transfer. It consists of two planes:

GTP-C (Control Plane) — control information such as connection parameters

GTP-U (User Plane) — user data, such as voice or application data

DPI decodes GTP-C, and this information is exported via IPFIX to “GTP flow” and “Raw GTP flow” reports in the GUI.

GTP logs are used for:

Base station load analysis — distribution of subscribers and traffic monitoring, useful for LBS (Location-Based Services)

Anomaly monitoring — detecting deviations in base station load

Subscriber tracking — visualizing on maps, analyzing movement routes, and current location

Some operators also use GTP logs to link IP addresses with IMSI (subscriber identifier), combining data from different systems (DPI, billing, etc.).
Reports are based on GTP-C V1 and GTP-C V2 versions.
Access to GTP logs is available only to users with a QoE Standard license. More details

Metric	Description and possible values
Date	Date and time of subscriber registration on the base station. In the aggregated log, it depends on the aggregation period
Time
SIM card number	Subscriber data
Phone number
IMEI	Unique device identifier that includes manufacturer, model, and assembly location information
IPv4 subscriber address	Subscriber’s IP address, which may change depending on location
IPv6 subscriber address
Subscriber timestamp	Time when the subscriber location (ULI) was registered — when switching between base stations
Country code	Country where the base station is located 0 — undefined 250 — Russia
Country name
Network (operator) code	Operator code for the base station 0 — undefined 1 — MTS 2 — Megafon 20 — Tele2 99 — Beeline
Network (operator) name
Coverage area code	Cell identifier within the coverage area (may correspond to multiple base stations)
Base station code	Code of the base station to which the subscriber is connected
DPI ID	DPI number (found in GUI: Administrator → Equipment)
Total	Number of raw log entries collapsed into one aggregated record
Sessions	Number of subscriber Internet sessions
Latitude	Latitude of the base station connected to the subscriber
Longitude	Longitude of the base station connected to the subscriber
Element ID	Geographic element identifier — composed of country code, network code, base station code, and coverage area code
Element name	Geographic name — composed of country code, network code, base station code, and coverage area code
Element description	Description of the geographic area — composed of country code, network code, base station code, and coverage area code
Session ID	Subscriber Internet session ID
GTP version	GTP protocol version (1 or 2)
Request ID	Internet session data
Response ID
Result code	Result code of the operation
Success	Indicates whether the operation completed successfully
SGW control plane IP	Fields describing parameters and identifiers of SGW/PGW connections for control and data separation, including IP addresses and TEIDs
SGW control plane TEID
SGW user plane IP
SGW user plane TEID
PGW control plane IP
PGW control plane TEID
PGW user plane IP
PGW user plane TEID
Access point name	Traffic type; may be a custom value
Rat	Radio access technology — defines whether the subscriber uses Bluetooth, Wi-Fi, GSM, UMTS, LTE, or 5G.