This is an old revision of the document!
QoE metric descriptions
The Excel file QoE analytics – report field list is useful when configuring triggers. It helps you determine which report contains the required data.
Enable macros for the file to work!
Example: suppose you need to find a report that contains the RTT metric.
To do this, locate the RTT metric in the upper filter table, type "Yes" in the cell below it, then press Enter.
As a result, the main table below will be filtered, showing only the reports containing the RTT metric:
Enable macros for the file to work!
Example: suppose you need to find a report that contains the RTT metric.
To do this, locate the RTT metric in the upper filter table, type "Yes" in the cell below it, then press Enter.
As a result, the main table below will be filtered, showing only the reports containing the RTT metric:
Each report includes a note specifying where to find it (scroll to the beginning of the document to see the note).
NetFlow
| Metric | Description | Values |
|---|---|---|
| Delta of octets | Difference in traffic (bytes) between the beginning and end of the selected period | |
| Delta of fragmented packets | Difference in IP packets divided into parts/fragments between the beginning and end of the selected period | |
| RTT | Round-trip time — the total time required to send a signal and receive confirmation. It represents latency and consists of transmission time between two points within a single flow. A flow in DPI includes all network activity within a source/destination socket (source IP:port / destination IP:port). | |
| Source AS | AS number of the source host | |
| Destination AS | AS number of the subscriber | |
| IPv4 source address after NAT | IP address translated by NAT from private to public for external communication and Internet access | |
| Source port after NAT | Port translated by NAT from private to public for external communication and Internet access | |
| Channel/Bridge | Channel — vChannel number. Bridge — number of the bridge through which the traffic passes | |
| Service class | Traffic classes cs0 — cs7. More details | 0 — cs0 1 — cs1 … 7 — cs7 |
| Receiver and sender IP interface index | Traffic direction | 1 — to whom the traffic is directed 2 — from whom the traffic originates Example: First — outgoing traffic; Second — incoming traffic |
ClickStream
All ClickStream metrics are defined only for HTTP traffic.
Metrics for HTTPS traffic cannot be determined because it is encrypted.
Metrics for HTTPS traffic cannot be determined because it is encrypted.
| Metric | Description | Values |
|---|---|---|
| Path | The URL path the subscriber visited | |
| Source request URL | The resource from which the request originated. Used during redirection: records the address from which the user was redirected | |
| User agent | User agent string. Identifies the device used for the request | |
| Method | The request method used to contact the server | 0 — undefined 1 — GET 2 — POST 3 — PUT 4 — DELETE |
| Result code | HTTP response code returned by the server | 200 — OK 403 — Forbidden |
| Content size | Amount of data (in bytes) returned by the server in response to the request | |
| Content type | HTTP Content-Type, used to determine the MIME type of the resource | |
| Blocked | Bitmask indicating whether the resource was blocked or redirected | 0x3 for HTTP 0x1 for others |
| Host type | Type of host | 1 — HTTP 2 — CNAME 3 — SNI 4 — QUIC |
DNS flow
| Metric | Description |
|---|---|
| Host | Domain name of the DNS host from the DNS response |
| Host category | Automatically determined category of the accessed host |
| Total | Number of raw log entries grouped into a single record in the aggregated log |
| Sessions | Number of subscriber Internet sessions in the aggregated log |
| Hosts | Number of hosts in the aggregated log |
| Host categories | Number of host categories in the aggregated log |
| DNS host IPs | Number of unique IP addresses of DNS hosts |
| Logins | Number of logins in the aggregated log |
| Subscribers | Number of subscribers in the aggregated log |
| Channels | Number of vChannels in the aggregated log |
| Time | Session start time |
| Session ID | Session identifier |
| Login | Subscriber login |
| IPv4 source address | Source address of the request — can be either subscriber or host |
| IPv6 source address | |
| Source port | |
| IPv4 destination addr | Destination address of the request — can be either subscriber or host |
| IPv6 destination addr | |
| Destination port | |
| DNS transport | Protocol used for DNS query transmission |
| DNS host IP | IP address of the DNS host |
| DNS host port | Port used by the DNS host |
| Subscriber | Subscriber’s IP address |
| Subscriber port | Port used by the subscriber |
| Rrclass | RR Class in the DNS query |
| DNS type | Type of DNS record (defines the function): 1 — A 5 — CNAME |
| TTL | Time-to-live for caching this DNS record on a non-authoritative DNS server |
| DNS data | RDATA content, base64 encoded — can be used to identify IPs belonging to a host |
| VLAN ID | Unique VLAN identifier |
| Post VLAN ID | VLAN ID after route modification |
| DPI ID | DPI number (found in GUI: Administrator → Equipment) |
| Channel/Bridge | Channel — vChannel number. Bridge — bridge number through which traffic passes |
| MPLS labels | Labels used for packet routing in MPLS networks |
GTP flow
GTP (GPRS Tunneling Protocol) is an IP-based group of connection protocols used in GSM, UMTS, and LTE networks. Mobile operators use GTP as a tunneling protocol for data transfer. It consists of two planes:
- GTP-C (Control Plane) — control information such as connection parameters
- GTP-U (User Plane) — user data, such as voice or application data
DPI decodes GTP-C, and this information is exported via IPFIX to “GTP flow” and “Raw GTP flow” reports in the GUI.
GTP logs are used for:
- Base station load analysis — distribution of subscribers and traffic monitoring, useful for LBS (Location-Based Services)
- Anomaly monitoring — detecting deviations in base station load
- Subscriber tracking — visualizing on maps, analyzing movement routes, and current location
Some operators also use GTP logs to link IP addresses with IMSI (subscriber identifier), combining data from different systems (DPI, billing, etc.).
Reports are based on GTP-C V1 and GTP-C V2 versions.
Access to GTP logs is available only to users with a QoE Standard license. More details
| Metric | Description and possible values |
|---|---|
| Date | Date and time of subscriber registration on the base station. In the aggregated log, it depends on the aggregation period |
| Time | |
| SIM card number | Subscriber data |
| Phone number | |
| IMEI | Unique device identifier that includes manufacturer, model, and assembly location information |
| IPv4 subscriber address | Subscriber’s IP address, which may change depending on location |
| IPv6 subscriber address | |
| Subscriber timestamp | Time when the subscriber location (ULI) was registered — when switching between base stations |
| Country code | Country where the base station is located 0 — undefined 250 — Russia |
| Country name | |
| Network (operator) code | Operator code for the base station 0 — undefined 1 — MTS 2 — Megafon 20 — Tele2 99 — Beeline |
| Network (operator) name | |
| Coverage area code | Cell identifier within the coverage area (may correspond to multiple base stations) |
| Base station code | Code of the base station to which the subscriber is connected |
| DPI ID | DPI number (found in GUI: Administrator → Equipment) |
| Total | Number of raw log entries collapsed into one aggregated record |
| Sessions | Number of subscriber Internet sessions |
| Latitude | Latitude of the base station connected to the subscriber |
| Longitude | Longitude of the base station connected to the subscriber |
| Element ID | Geographic element identifier — composed of country code, network code, base station code, and coverage area code |
| Element name | Geographic name — composed of country code, network code, base station code, and coverage area code |
| Element description | Description of the geographic area — composed of country code, network code, base station code, and coverage area code |
| Session ID | Subscriber Internet session ID |
| GTP version | GTP protocol version (1 or 2) |
| Request ID | Internet session data |
| Response ID | |
| Result code | Result code of the operation |
| Success | Indicates whether the operation completed successfully |
| SGW control plane IP | Fields describing parameters and identifiers of SGW/PGW connections for control and data separation, including IP addresses and TEIDs |
| SGW control plane TEID | |
| SGW user plane IP | |
| SGW user plane TEID | |
| PGW control plane IP | |
| PGW control plane TEID | |
| PGW user plane IP | |
| PGW user plane TEID | |
| Access point name | Traffic type; may be a custom value |
| Rat | Radio access technology — defines whether the subscriber uses Bluetooth, Wi-Fi, GSM, UMTS, LTE, or 5G. |
Was this information helpful?