Table of Contents
Description of QoE metrics
Netflow
| Metric | Description | Values |
|---|---|---|
| Octet delta | Traffic difference (bytes) at the beginning and end of the specified period | |
| Fragmented packets delta | Difference of IP packets divided into parts/fragments at the beginning and at the end of the specified period | |
| RTT | Round-trip time is the time taken to send the signal plus the time it takes to confirm that the signal has been received. This round-trip time therefore consists of the time it takes to transmit a signal between two points within a single flow. All network activity within a source/destination socket (source IP:port /destination IP:port) is taken as a flow in DPI | |
| Source AS | AS host number | |
| Destination AS | Subscriber's AS number | |
| Post nat source IPv4-address | An IP address converted from private to public by NAT to communicate with external devices and access the Internet | |
| Post nat source port | A port converted by NAT from private to public for communicating with external devices and accessing the Internet | |
| Vchannel/Bridge | Vchannel — vChannel number. Bridge — number of the bridge through which the traffic goes | |
| Service class | Traffic classes cs0 — cs7. For more details see Traffic distribution by class for the tariff plan | 0 — cs0 1 — cs1 … 7 — cs7 |
| Receiver IP-interface index and Sender IP-interface index | Traffic direction | 1 — to whom traffic is directed; 2 — where the traffic comes from. Example: The first option is outbound traffic; The second option is inbound traffic.  |
Clickstream
All Clickstream metrics are defined for HTTP traffic only.
Metrics for HTTPS traffic cannot be defined because it is encrypted.
Metrics for HTTPS traffic cannot be defined because it is encrypted.
| Metric | Description | Values |
|---|---|---|
| Path | The address to which the subscriber went | |
| Referer | The resource from which the request came. Used for redirection: the address from which the user went to the redirection page is memorized | |
| User agent | Allows you to understand from which device the request was made | |
| Method | Server request method | 0 — undefined 1 — GET 2 — POST 3 — PUT 4 — DELETE |
| Result code | The HTTP code that the server returned | 200 — ОК 403 — Forbidden |
| Content length | How many bytes of information the server returned in response to the request | |
| Content type | Content-Type in HTTP, used to define the MIME type of a resource | |
| Locked | Bitmask, contains an indication that the resource has been blocked or redirected | 0x3 for HTTP 0x1 for the rest |
| Host type | 1 for HTTP 2 — CNAME 3 — SNI 4 — QUIC |
DNS Flow
| Metric | Description |
|---|---|
| Host | DNS host domain name from the DNS response |
| Host category | Category of the involved host, determined automatically |
| Total | Number of records from the raw log, grouped into a single entry in the aggregated log |
| Sessions | Number of internet sessions of the subscriber in the aggregated log |
| Hosts | Number of hosts in the aggregated log |
| Host categories | Number of host categories in the aggregated log |
| DNS hosts IPs | Number of unique IP addresses of DNS hosts |
| Logins | Number of logins in the aggregated log |
| Subscribers | Number of subscribers in the aggregated log |
| Channels | Number of vChannels in the aggregated log |
| Time | Time of session start |
| Session ID | Session ID |
| Login | Subscriber login |
| Source IPv4-address | Information about the source of the request. The source can be either a subscriber or a host |
| Source IPv6-address | |
| Source port | |
| Destination IPv4-address | Information about the recipient of the request. The recipient can be either a subscriber or a host |
| Destination IPv6-address | |
| Destination port | |
| DNS transport | Protocol used for transmitting DNS requests |
| DNS host IP | IP address of the DNS host |
| DNS host port | Port used by the DNS host |
| Subscriber | IP address of the subscriber |
| Subscriber port | Port used by the subscriber |
| Rrclass | Resource class (RR Class) in the DNS request |
| DNS type | Indicates the function of the server in processing and storing DNS requests in the domain name system: 1 - A 5 - CNAME |
| TTL | The acceptable time for storing this resource record in the cache of a non-responsive DNS server |
| DNS data | RDATA encoded in base64. For example, it is possible to find out which IPs belong to the host |
| VLAN ID | Unique identifier of the virtual local area network |
| Post VLAN ID | VLAN ID after route change |
| DPI ID | Number of DPI, taken from GUI: Administrator → Equipment |
| Vchannel/Bridge | Channel — number of vChannel. Bridge — number of the bridge through which traffic flows |
| MPLS labels | Labels for routing packets in MPLS networks |
GTP Flow
GTP (GPRS Tunneling Protocol) is a group of IP-based connection protocols used in GSM, UMTS, and LTE networks. The GTP protocol is used by mobile operators as a tunnel for data transmission. It consists of two layers:
- GTP-C (Control Plane) — service information, such as connection fields.
- GTP-U (User Plane) — user data, such as voice information.
DPI decodes GTP-C, and this information is sent to IPFIX in the “GTP flow” and “Raw GTP flow” reports in the GUI.
GTP logs are used for the following tasks:
- Base station load analysis: distribution of subscribers across base stations and traffic monitoring, which is useful for LBS (Location-Based Services).
- Anomaly monitoring: tracking changes in the load on base stations to identify deviations from the norm.
- Subscriber tracking on the map and movement analysis: visualization on the map is possible, as well as route analysis and current location.
Some operators also use GTP logs to link IP and IMSI (subscriber identifier) to consolidate user information from various information systems (DPI, billing, etc.).
The report is based on versions GTP-C V1 and GTP-C V2. Access to GTP Log is available only to users with a QoE Standard license. More details
| Metric | Description and possible values |
|---|---|
| Date | Date and time of subscriber registration at the tower. In the aggregated log, this time depends on the aggregation time |
| Time | |
| SIM card number | Subscriber details |
| Phone number | |
| IMEI | Unique phone identification number, contains information about the manufacturer, model and place of assembly |
| Subscriber ipv4 address | Subscriber data may vary depending on the subscriber's location |
| Subscriber ipv6 address | |
| Time of ULI | Time at which the subscriber's location (ULI) was recorded (when the subscriber switched from one tower to another) |
| Mobile country code | Information about the country where the tower is located 0 - not defined (?) 250 – Russia |
| Country name | |
| Mobile network (operator) code | Information about the operator who owns the tower 0 - not defined (?) 1 - MTS 2 - Megafon 20 – Tele2 99 - Beeline |
| Network (operator) name | |
| Service/Tracking area code | In which cell the subscriber is located. Can match multiple base stations |
| Base station code | The base station to which the subscriber has connected. There may be several of them in the coverage area |
| DPI ID | DPI number, taken from GUI: Administrator → Equipment |
| Total | The number of records from the raw log, collapsed into one record of the aggregated log |
| Sessions | Number of subscriber Internet sessions |
| Latitude | Location (latitude) of the base station to which the subscriber connected |
| Longitude | Location (longitude) of the base station to which the subscriber connected |
| Cell ID | Identifier of the area in which the subscriber is located. Consists of several values: - Country code - Network (operator) code - Base station code - Coverage area code |
| Cell name | The name of the location in which the subscriber is located. Consists of several values: - Country code - Network (operator) code - Base station code - Coverage area code |
| Cell description | Description of the area in which the subscriber is located. Consists of several values: - Country code - Network (operator) code - Base station code - Coverage area code |
| Session ID | Subscriber Internet session ID |
| GTP version | Protocol version. Possible values: 1, 2 |
| Request message ID | Internet session data |
| Response message ID | |
| Result code | Code indicating the result of the operation |
| Success | Indicates whether the operation completed successfully |
| SGW control plane IP | Fields describing connection parameters and identification at the network gateway level (SGW and PGW) for data transfer and control. Includes IP addresses and tunnel identifiers (TEIDs) to differentiate between management traffic and user data. |
| SGW control plane TEID | |
| SGW data plane IP | |
| SGW data plane TEID | |
| PGW control plane IP | |
| PGW control plane TEID | |
| PGW data plane IP | |
| PGW data plane TEID | |
| Access Point Name | Traffic type. The name can be custom |
| Rat | Radio access technology (radio access technology). Indicates what technology the subscriber uses - Bluetooth, Wi-Fi, GSM, UMTS, LTE or 5G. |