Description of QoE metrics

Netflow

Metric	Description	Values
Octet delta	Traffic difference (bytes) at the beginning and end of the specified period
Fragmented packets delta	Difference of IP packets divided into parts/fragments at the beginning and at the end of the specified period
RTT	Round-trip time is the time taken to send the signal plus the time it takes to confirm that the signal has been received. This round-trip time therefore consists of the time it takes to transmit a signal between two points within a single flow. All network activity within a source/destination socket (source IP:port /destination IP:port) is taken as a flow in DPI
Source AS	AS host number
Destination AS	Subscriber's AS number
Post nat source IPv4-address	An IP address converted from private to public by NAT to communicate with external devices and access the Internet
Post nat source port	A port converted by NAT from private to public for communicating with external devices and accessing the Internet
Vchannel/Bridge	Vchannel — vChannel number. Bridge — number of the bridge through which the traffic goes
Service class	Traffic classes cs0 — cs7. For more details see Traffic distribution by class for the tariff plan	0 — cs0 1 — cs1 … 7 — cs7
Receiver IP-interface index and Sender IP-interface index	Traffic direction	1 — to whom traffic is directed; 2 — where the traffic comes from. Example: The first option is outbound traffic; The second option is inbound traffic. Array

Clickstream

All Clickstream metrics are defined for HTTP traffic only. Metrics for HTTPS traffic cannot be defined because it is encrypted.
Metric	Description	Values
Path	The address to which the subscriber went
Referer	The resource from which the request came. Used for redirection: the address from which the user went to the redirection page is memorized
User agent	Allows you to understand from which device the request was made
Method	Server request method	0 — undefined 1 — GET 2 — POST 3 — PUT 4 — DELETE
Result code	The HTTP code that the server returned	200 — ОК 403 — Forbidden
Content length	How many bytes of information the server returned in response to the request
Content type	Content-Type in HTTP, used to define the MIME type of a resource
Locked	Bitmask, contains an indication that the resource has been blocked or redirected	0x3 for HTTP 0x1 for the rest
Host type	1 for HTTP 2 — CNAME 3 — SNI 4 — QUIC

DNS Flow

Metric	Description
Host	DNS host domain name from the DNS response
Host category	Category of the involved host, determined automatically
Total	Number of records from the raw log, grouped into a single entry in the aggregated log
Sessions	Number of internet sessions of the subscriber in the aggregated log
Hosts	Number of hosts in the aggregated log
Host categories	Number of host categories in the aggregated log
DNS hosts IPs	Number of unique IP addresses of DNS hosts
Logins	Number of logins in the aggregated log
Subscribers	Number of subscribers in the aggregated log
Channels	Number of vChannels in the aggregated log
Time	Time of session start
Session ID	Session ID
Login	Subscriber login
Source IPv4-address	Information about the source of the request. The source can be either a subscriber or a host
Source IPv6-address
Source port
Destination IPv4-address	Information about the recipient of the request. The recipient can be either a subscriber or a host
Destination IPv6-address
Destination port
DNS transport	Protocol used for transmitting DNS requests
DNS host IP	IP address of the DNS host
DNS host port	Port used by the DNS host
Subscriber	IP address of the subscriber
Subscriber port	Port used by the subscriber
Rrclass	Resource class (RR Class) in the DNS request
DNS type	Indicates the function of the server in processing and storing DNS requests in the domain name system: 1 - A 5 - CNAME
TTL	The acceptable time for storing this resource record in the cache of a non-responsive DNS server
DNS data	RDATA encoded in base64. For example, it is possible to find out which IPs belong to the host
VLAN ID	Unique identifier of the virtual local area network
Post VLAN ID	VLAN ID after route change
DPI ID	Number of DPI, taken from GUI: Administrator → Equipment
Vchannel/Bridge	Channel — number of vChannel. Bridge — number of the bridge through which traffic flows
MPLS labels	Labels for routing packets in MPLS networks

GTP Flow

GTP (GPRS Tunneling Protocol) is a group of IP-based connection protocols used in GSM, UMTS, and LTE networks. The GTP protocol is used by mobile operators as a tunnel for data transmission. It consists of two layers:

GTP-C (Control Plane) — service information, such as connection fields.

GTP-U (User Plane) — user data, such as voice information.

DPI decodes GTP-C, and this information is sent to IPFIX in the “GTP flow” and “Raw GTP flow” reports in the GUI.

GTP logs are used for the following tasks:

Base station load analysis: distribution of subscribers across base stations and traffic monitoring, which is useful for LBS (Location-Based Services).

Anomaly monitoring: tracking changes in the load on base stations to identify deviations from the norm.

Subscriber tracking on the map and movement analysis: visualization on the map is possible, as well as route analysis and current location.

Some operators also use GTP logs to link IP and IMSI (subscriber identifier) to consolidate user information from various information systems (DPI, billing, etc.).

The report is based on versions GTP-C V1 and GTP-C V2. Access to GTP Log is available only to users with a QoE Standard license. More details

Metric	Description and possible values
Date	Date and time of subscriber registration at the tower. In the aggregated log, this time depends on the aggregation time
Time
SIM card number	Subscriber details
Phone number
IMEI	Unique phone identification number, contains information about the manufacturer, model and place of assembly
Subscriber ipv4 address	Subscriber data may vary depending on the subscriber's location
Subscriber ipv6 address
Time of ULI	Time at which the subscriber's location (ULI) was recorded (when the subscriber switched from one tower to another)
Mobile country code	Information about the country where the tower is located 0 - not defined (?) 250 – Russia
Country name
Mobile network (operator) code	Information about the operator who owns the tower 0 - not defined (?) 1 - MTS 2 - Megafon 20 – Tele2 99 - Beeline
Network (operator) name
Service/Tracking area code	In which cell the subscriber is located. Can match multiple base stations
Base station code	The base station to which the subscriber has connected. There may be several of them in the coverage area
DPI ID	DPI number, taken from GUI: Administrator → Equipment
Total	The number of records from the raw log, collapsed into one record of the aggregated log
Sessions	Number of subscriber Internet sessions
Latitude	Location (latitude) of the base station to which the subscriber connected
Longitude	Location (longitude) of the base station to which the subscriber connected
Cell ID	Identifier of the area in which the subscriber is located. Consists of several values: - Country code - Network (operator) code - Base station code - Coverage area code
Cell name	The name of the location in which the subscriber is located. Consists of several values: - Country code - Network (operator) code - Base station code - Coverage area code
Cell description	Description of the area in which the subscriber is located. Consists of several values: - Country code - Network (operator) code - Base station code - Coverage area code
Session ID	Subscriber Internet session ID
GTP version	Protocol version. Possible values: 1, 2
Request message ID	Internet session data
Response message ID
Result code	Code indicating the result of the operation
Success	Indicates whether the operation completed successfully
SGW control plane IP	Fields describing connection parameters and identification at the network gateway level (SGW and PGW) for data transfer and control. Includes IP addresses and tunnel identifiers (TEIDs) to differentiate between management traffic and user data.
SGW control plane TEID
SGW data plane IP
SGW data plane TEID
PGW control plane IP
PGW control plane TEID
PGW data plane IP
PGW data plane TEID
Access Point Name	Traffic type. The name can be custom
Rat	Radio access technology (radio access technology). Indicates what technology the subscriber uses - Bluetooth, Wi-Fi, GSM, UMTS, LTE or 5G.