epan/dissectors/packet-netflow.c

   1 /*
   2  ** packet-netflow.c
   3  **
   4  ** (c) 2002 bill fumerola <fumerola@yahoo-inc.com>
   5  ** (C) 2005-06 Luca Deri <deri@ntop.org>
   6  **
   7  ** All rights reserved.
   8  **
   9  ** Wireshark - Network traffic analyzer
  10  ** By Gerald Combs <gerald@wireshark.org>
  11  ** Copyright 1998 Gerald Combs
  12  **
  13  ** SPDX-License-Identifier: GPL-2.0-or-later
  14  *****************************************************************************
  15  **
  16  ** Previous NetFlow dissector written by Matthew Smart <smart@monkey.org>
  17  ** NetFlow v9 support added by same.
  18  **
  19  ** NetFlow v9 patches by Luca Deri <deri@ntop.org>
  20  **
  21  ** See
  22  **
  23  ** http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/tflow_wp.htm
  24  ** http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html
  25  **
  26  ** Cisco ASA5500 Series
  27  ** http://www.cisco.com/en/US/docs/security/asa/asa83/netflow/netflow.html
  28  **
  29  ** ( https://tools.ietf.org/html/rfc3954 ? for NetFlow v9 information)
  30  **
  31  ** IPFIX
  32  ** https://tools.ietf.org/html/rfc5103 Bidirectional Flow Export Using IP Flow Information Export (IPFIX)
  33  ** https://tools.ietf.org/html/rfc5610 Exporting Type Information for
  34  **                                     IP Flow Information Export (IPFIX) Information Elements
  35  ** https://tools.ietf.org/html/rfc7011 Specification of the IP Flow Information Export (IPFIX) Protocol
  36  **                                     for the Exchange of Flow Information
  37  ** https://tools.ietf.org/html/rfc7012 Information Model for IP Flow Information Export (IPFIX)
  38  ** https://tools.ietf.org/html/rfc7013 Guidelines for Authors and Reviewers of
  39  **                                     IP Flow Information Export (IPFIX) Information Elements
  40  **
  41  ** https://www.iana.org/assignments/ipfix/ipfix.xml     [version dated: 2014-08-13]
  42  ** https://www.iana.org/assignments/psamp-parameters/psamp-parameters.xml
  43  ** for IPFIX
  44  **
  45  *****************************************************************************
  46  **
  47  ** this code was written from the following documentation:
  48  **
  49  ** http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/nfc/nfc_3_6/iug/format.pdf
  50  ** http://www.caida.org/tools/measurement/cflowd/configuration/configuration-9.html
  51  **
  52  ** some documentation is more accurate then others. in some cases, live data and
  53  ** information contained in responses from vendors were also used. some fields
  54  ** are dissected as vendor specific fields.
  55  **
  56  ** See also
  57  **
  58  ** https://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html
  59  **
  60  *****************************************************************************
  61  ** NetFlow forwarding status and template fixes
  62  ** by Aamer Akhter <aakhter@cisco.com>
  63  ** Copyright 2010, cisco Systems, Inc.
  64  **
  65  ** $Yahoo: //depot/fumerola/packet-netflow/packet-netflow.c#14 $
  66  **
  67  *****************************************************************************
  68  **
  69  **
  70  */
  71
  72 /*
  73  * ToDo: [11/23/2011: WMeier]
  74  *
  75  *  1. (See the various XXX comments)
  76  *  2. Template processing:
  77  *     a. Verify that template with same src_addr, ... ,ID is actually identical to that previously seen ?
  78  *        Handle changes ? Don't use template to dissect data packets previous to the packet with the templates.
  79  *        Essentially; need to keep the packet number containing the first copy of the template.
  80  *
  81  */
  82
  83 /*
  84  * November 2010: acferen:  Add ntop nProbe and Plixer Mailinizer extensions
  85  *
  86  * nProbe changes are for nprobe >= 5.5.6.  Earlier nprobe versions
  87  * "supported" some of the same fields, but they used element IDs that
  88  * collide with standard IDs.  Because of this versions prior to 5.5.6
  89  * using IDs above 80 (nprobe extensions) cannot be decoded correctly.
  90  *
  91  * nprobe supports extensions in v9 and IPFIX.  IPFIX is done in the
  92  * standard way.  See the NTOP_BASE for handling v9 with no collisions
  93  * (maybe).
  94  *
  95  * Plixer changes are just new field definitions.  (IPFIX only)
  96  *
  97  * extended core code to allow naming vendor extensions.
  98  *
  99  * Put the length for variable length strings in a tree under the
 100  * decoded string.  Wonder if this might be overkill.  Could probably
 101  * just format the "(Variable length)" string to include the actual
 102  * length.
 103  *
 104  * Did some minor cleanup.
 105  *
 106  * Note for WMeier...  Added YYY comments with some XXX comments.
 107  */
 108
 109 /*
 110  * March 2015: uhei:  Add Citrix Netscaler AppFlow extensions
 111  * used documentation found at:
 112  * https://raw.githubusercontent.com/splunk/ipfix/master/app/Splunk_TA_IPFIX/bin/IPFIX/information-elements/5951.xml
 113  *
 114  * December 2015: uhei:  Add Barracuda NGFirewall extensions
 115  * used documentation found at:
 116  * https://campus.barracuda.com/download/pdf/article/41116166
 117  *
 118  * December 2017: uhei
 119  * Updated IEs from https://www.iana.org/assignments/ipfix/ipfix.xhtml
 120  * Includes updates for RFC8038, RFC8158
 121  *
 122  * April 2019: uhei
 123  * Updated IEs from https://www.iana.org/assignments/ipfix/ipfix.xhtml
 124  * Includes updates for RFC8549
 125  */
 126
 127 #define WS_LOG_DOMAIN "packet-netflow"
 128 #include "config.h"
 129 #include <wireshark.h>
 130 #include <epan/packet.h>
 131 #include <epan/prefs.h>
 132 #include <epan/ipproto.h>
 133 #include <epan/sminmpec.h>
 134 #include <epan/to_str.h>
 135 #include <epan/expert.h>
 136 #include <epan/addr_resolv.h>
 137 #include <epan/conversation.h>
 138 #include <epan/proto_data.h>
 139 #include <epan/tfs.h>
 140 #include <epan/unit_strings.h>
 141
 142 #include <wsutil/array.h>
 143 #include <wsutil/str_util.h>
 144 #include "packet-tcp.h"
 145 #include "packet-udp.h"
 146 #include "packet-ntp.h"
 147
 148 void proto_register_netflow(void);
 149 void proto_reg_handoff_netflow(void);
 150
 151 static int dissect_tcp_netflow(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data);
 152
 153
 154 /* 4739 is IPFIX.
 155    2055 and 9996 are common defaults for Netflow
 156  */
 157 #define NETFLOW_UDP_PORTS "2055,9996"
 158 #define IPFIX_UDP_PORTS   "4739"
 159 #define REVPEN            29305
 160 static dissector_handle_t netflow_handle;
 161 static dissector_handle_t netflow_tcp_handle;
 162 static dissector_handle_t eth_handle;
 163
 164 /* If you want sort of safely to send enterprise specific element IDs
 165    using v9 you need to stake a claim in the wilds with the high bit
 166    set.  Still no naming authority, but at least it will never collide
 167    with valid IPFIX */
 168 #define NTOP_BASE 57472u                /* nprobe >= 5.5.6 */
 169
 170 /*
 171  *  global_netflow_ports : holds the configured range of ports for netflow
 172  */
 173 static range_t *global_netflow_ports;
 174 /*
 175  *  global_ipfix_ports : holds the configured range of ports for IPFIX
 176  */
 177 static range_t *global_ipfix_ports;
 178
 179 static bool netflow_preference_desegment = true;
 180
 181 static bool netflow_preference_tcpflags_1byte_cwr;
 182
 183 /*
 184  * Flowset (template) ID's
 185  */
 186 #define FLOWSET_ID_V9_DATA_TEMPLATE         0
 187 #define FLOWSET_ID_V9_OPTIONS_TEMPLATE      1
 188 #define FLOWSET_ID_V10_DATA_TEMPLATE        2
 189 #define FLOWSET_ID_V10_OPTIONS_TEMPLATE     3
 190 #define FLOWSET_ID_RESERVED_MIN             4
 191 #define FLOWSET_ID_RESERVED_MAX           255
 192 #define FLOWSET_ID_DATA_MIN               256
 193 #define FLOWSET_ID_DATA_MAX             65535
 194
 195 static const range_string rs_flowset_ids[] = {
 196     { FLOWSET_ID_V9_DATA_TEMPLATE    , FLOWSET_ID_V9_DATA_TEMPLATE    , "Data Template (V9)"             },
 197     { FLOWSET_ID_V9_OPTIONS_TEMPLATE , FLOWSET_ID_V9_OPTIONS_TEMPLATE , "Options Template(V9)"           },
 198     { FLOWSET_ID_V10_DATA_TEMPLATE   , FLOWSET_ID_V10_DATA_TEMPLATE   , "Data Template (V10 [IPFIX])"    },
 199     { FLOWSET_ID_V10_OPTIONS_TEMPLATE, FLOWSET_ID_V10_OPTIONS_TEMPLATE, "Options Template (V10 [IPFIX])" },
 200     { FLOWSET_ID_RESERVED_MIN        , FLOWSET_ID_RESERVED_MAX        , "(Reserved)"                     },
 201     { FLOWSET_ID_DATA_MIN            , FLOWSET_ID_DATA_MAX            , "(Data)"                         },
 202     { 0,           0,          NULL                   }
 203 };
 204
 205 /*
 206  * pdu identifiers & sizes
 207  */
 208
 209 #define V1PDU_SIZE                 (4 * 12)
 210 #define V5PDU_SIZE                 (4 * 12)
 211 #define V7PDU_SIZE                 (4 * 13)
 212 #define V8PDU_AS_SIZE              (4 *  7)
 213 #define V8PDU_PROTO_SIZE           (4 *  7)
 214 #define V8PDU_SPREFIX_SIZE         (4 *  8)
 215 #define V8PDU_DPREFIX_SIZE         (4 *  8)
 216 #define V8PDU_MATRIX_SIZE          (4 * 10)
 217 #define V8PDU_DESTONLY_SIZE        (4 * 8)
 218 #define V8PDU_SRCDEST_SIZE         (4 * 10)
 219 #define V8PDU_FULL_SIZE            (4 * 11)
 220 #define V8PDU_TOSAS_SIZE           (V8PDU_AS_SIZE + 4)
 221 #define V8PDU_TOSPROTOPORT_SIZE    (V8PDU_PROTO_SIZE + 4)
 222 #define V8PDU_TOSSRCPREFIX_SIZE    (V8PDU_SPREFIX_SIZE)
 223 #define V8PDU_TOSDSTPREFIX_SIZE    (V8PDU_DPREFIX_SIZE)
 224 #define V8PDU_TOSMATRIX_SIZE       (V8PDU_MATRIX_SIZE)
 225 #define V8PDU_PREPORTPROTOCOL_SIZE (4 * 10)
 226
 227 #define VARIABLE_LENGTH 65535
 228
 229 static const value_string v5_sampling_mode[] = {
 230     {0, "No sampling mode configured"},
 231     {1, "Packet Interval sampling mode configured"},
 232     {2, "Random sampling mode configured"},
 233     {0, NULL}
 234 };
 235
 236 static const value_string ipfix_sampling_mode[] = {
 237     {0, "No sampling mode configured"},
 238     {1, "Deterministic sampling"},
 239     {2, "Random sampling"},
 240     {0, NULL}
 241 };
 242
 243 enum {
 244     V8PDU_NO_METHOD = 0,
 245     V8PDU_AS_METHOD,
 246     V8PDU_PROTO_METHOD,
 247     V8PDU_SPREFIX_METHOD,
 248     V8PDU_DPREFIX_METHOD,
 249     V8PDU_MATRIX_METHOD,
 250     V8PDU_DESTONLY_METHOD,
 251     V8PDU_SRCDEST_METHOD,
 252     V8PDU_FULL_METHOD,
 253     V8PDU_TOSAS_METHOD,
 254     V8PDU_TOSPROTOPORT_METHOD,
 255     V8PDU_TOSSRCPREFIX_METHOD,
 256     V8PDU_TOSDSTPREFIX_METHOD,
 257     V8PDU_TOSMATRIX_METHOD,
 258     V8PDU_PREPORTPROTOCOL_METHOD
 259 };
 260
 261 static const value_string v8_agg[] = {
 262     {V8PDU_AS_METHOD,               "V8 AS aggregation"},
 263     {V8PDU_PROTO_METHOD,            "V8 Proto/Port aggregation"},
 264     {V8PDU_SPREFIX_METHOD,          "V8 Source Prefix aggregation"},
 265     {V8PDU_DPREFIX_METHOD,          "V8 Destination Prefix aggregation"},
 266     {V8PDU_MATRIX_METHOD,           "V8 Network Matrix aggregation"},
 267     {V8PDU_DESTONLY_METHOD,         "V8 Destination aggregation (Cisco Catalyst)"},
 268     {V8PDU_SRCDEST_METHOD,          "V8 Src/Dest aggregation (Cisco Catalyst)"},
 269     {V8PDU_FULL_METHOD,             "V8 Full aggregation (Cisco Catalyst)"},
 270     {V8PDU_TOSAS_METHOD,            "V8 TOS+AS aggregation"},
 271     {V8PDU_TOSPROTOPORT_METHOD,     "V8 TOS+Protocol aggregation"},
 272     {V8PDU_TOSSRCPREFIX_METHOD,     "V8 TOS+Source Prefix aggregation"},
 273     {V8PDU_TOSDSTPREFIX_METHOD,     "V8 TOS+Destination Prefix aggregation"},
 274     {V8PDU_TOSMATRIX_METHOD,        "V8 TOS+Prefix Matrix aggregation"},
 275     {V8PDU_PREPORTPROTOCOL_METHOD,  "V8 Port+Protocol aggregation"},
 276     {0, NULL}
 277 };
 278 static value_string_ext v8_agg_ext = VALUE_STRING_EXT_INIT(v8_agg);
 279
 280
 281 /* Max number of entries/scopes per template */
 282 /* Space is allocated dynamically so there isn't really a need to
 283    bound this except to cap possible memory use.  Unfortunately if
 284    this value is too low we can't decode any template with more than
 285    v9_tmplt_max_fields fields in it.  The best compromise seems
 286    to be to make v9_tmplt_max_fields a user preference.
 287    A value of 0 will be unlimited.
 288 */
 289 #define V9_TMPLT_MAX_FIELDS_DEF   60
 290 static unsigned v9_tmplt_max_fields = V9_TMPLT_MAX_FIELDS_DEF;
 291
 292 typedef struct _v9_v10_tmplt_entry {
 293     uint16_t     type;
 294     uint16_t     length;
 295     uint32_t     pen;
 296     const char *pen_str;
 297 } v9_v10_tmplt_entry_t;
 298
 299 typedef enum {
 300     TF_SCOPES=0,
 301     TF_ENTRIES,
 302     /* START IPFIX VENDOR FIELDS */
 303     TF_PLIXER,
 304     TF_NTOP,
 305     TF_IXIA,
 306     TF_NETSCALER,
 307     TF_BARRACUDA,
 308     TF_GIGAMON,
 309     TF_CISCO,
 310     TF_NIAGARA_NETWORKS,
 311     TF_FASTIP,
 312     TF_JUNIPER,
 313     TF_NO_VENDOR_INFO
 314 } v9_v10_tmplt_fields_type_t;
 315 #define TF_NUM 2
 316 #define TF_NUM_EXT TF_NO_VENDOR_INFO+1   /* includes vendor fields */
 317
 318 typedef struct _v9_v10_tmplt {
 319     /* For linking back to show where fields were defined */
 320     uint32_t template_frame_number;
 321     address  src_addr;
 322     uint32_t src_port;
 323     address  dst_addr;
 324     uint32_t dst_port;
 325     uint32_t src_id;   /* SourceID in NetFlow V9, Observation Domain ID in IPFIX */
 326     uint16_t tmplt_id;
 327     unsigned length;
 328     uint16_t field_count[TF_NUM];                /* 0:scopes; 1:entries  */
 329     v9_v10_tmplt_entry_t *fields_p[TF_NUM_EXT];  /* 0:scopes; 1:entries; n:vendor_entries  */
 330 } v9_v10_tmplt_t;
 331
 332
 333 /* Map from (conversation+obs-domain-id+flowset-id) -> v9_v10_tmplt_entry_t*    */
 334 /* Confusingly, for key, fill in only relevant parts of v9_v10_tmplt_entry_t... */
 335 wmem_map_t *v9_v10_tmplt_table;
 336
 337
 338 static const value_string v9_v10_template_types[] = {
 339     {   1, "BYTES" },
 340     {   2, "PKTS" },
 341     {   3, "FLOWS" },
 342     {   4, "PROTOCOL" },
 343     {   5, "IP_TOS" },
 344     {   6, "TCP_FLAGS" },
 345     {   7, "L4_SRC_PORT" },
 346     {   8, "IP_SRC_ADDR" },
 347     {   9, "SRC_MASK" },
 348     {  10, "INPUT_SNMP" },
 349     {  11, "L4_DST_PORT" },
 350     {  12, "IP_DST_ADDR" },
 351     {  13, "DST_MASK" },
 352     {  14, "OUTPUT_SNMP" },
 353     {  15, "IP_NEXT_HOP" },
 354     {  16, "SRC_AS" },
 355     {  17, "DST_AS" },
 356     {  18, "BGP_NEXT_HOP" },
 357     {  19, "MUL_DPKTS" },
 358     {  20, "MUL_DOCTETS" },
 359     {  21, "LAST_SWITCHED" },
 360     {  22, "FIRST_SWITCHED" },
 361     {  23, "OUT_BYTES" },
 362     {  24, "OUT_PKTS" },
 363     {  25, "IP LENGTH MINIMUM" },
 364     {  26, "IP LENGTH MAXIMUM" },
 365     {  27, "IPV6_SRC_ADDR" },
 366     {  28, "IPV6_DST_ADDR" },
 367     {  29, "IPV6_SRC_MASK" },
 368     {  30, "IPV6_DST_MASK" },
 369     {  31, "FLOW_LABEL" },
 370     {  32, "ICMP_TYPE" },
 371     {  33, "IGMP_TYPE" },
 372     {  34, "SAMPLING_INTERVAL" },
 373     {  35, "SAMPLING_ALGORITHM" },
 374     {  36, "FLOW_ACTIVE_TIMEOUT" },
 375     {  37, "FLOW_INACTIVE_TIMEOUT" },
 376     {  38, "ENGINE_TYPE" },
 377     {  39, "ENGINE_ID" },
 378     {  40, "TOTAL_BYTES_EXP" },
 379     {  41, "TOTAL_PKTS_EXP" },
 380     {  42, "TOTAL_FLOWS_EXP" },
 381     {  43, "IPV4_ROUTER_SC" },
 382     {  44, "IP_SRC_PREFIX" },
 383     {  45, "IP_DST_PREFIX" },
 384     {  46, "MPLS_TOP_LABEL_TYPE" },
 385     {  47, "MPLS_TOP_LABEL_ADDR" },
 386     {  48, "FLOW_SAMPLER_ID" },
 387     {  49, "FLOW_SAMPLER_MODE" },
 388     {  50, "FLOW_SAMPLER_RANDOM_INTERVAL" },
 389     {  51, "FLOW_CLASS" },
 390     {  52, "IP TTL MINIMUM" },
 391     {  53, "IP TTL MAXIMUM" },
 392     {  54, "IPv4 ID" },
 393     {  55, "DST_TOS" },
 394     {  56, "SRC_MAC" },
 395     {  57, "DST_MAC" },
 396     {  58, "SRC_VLAN" },
 397     {  59, "DST_VLAN" },
 398     {  60, "IP_PROTOCOL_VERSION" },
 399     {  61, "DIRECTION" },
 400     {  62, "IPV6_NEXT_HOP" },
 401     {  63, "BGP_IPV6_NEXT_HOP" },
 402     {  64, "IPV6_OPTION_HEADERS" },
 403     {  70, "MPLS_LABEL_1" },
 404     {  71, "MPLS_LABEL_2" },
 405     {  72, "MPLS_LABEL_3" },
 406     {  73, "MPLS_LABEL_4" },
 407     {  74, "MPLS_LABEL_5" },
 408     {  75, "MPLS_LABEL_6" },
 409     {  76, "MPLS_LABEL_7" },
 410     {  77, "MPLS_LABEL_8" },
 411     {  78, "MPLS_LABEL_9" },
 412     {  79, "MPLS_LABEL_10" },
 413     {  80, "DESTINATION_MAC" },
 414     {  81, "SOURCE_MAC" },
 415     {  82, "IF_NAME" },
 416     {  83, "IF_DESC" },
 417     {  84, "SAMPLER_NAME" },
 418     {  85, "BYTES_TOTAL" },
 419     {  86, "PACKETS_TOTAL" },
 420     {  88, "FRAGMENT_OFFSET" },
 421     {  89, "FORWARDING_STATUS" },
 422     {  90, "VPN_ROUTE_DISTINGUISHER" },
 423     {  91, "mplsTopLabelPrefixLength" },
 424     {  92, "SRC_TRAFFIC_INDEX" },
 425     {  93, "DST_TRAFFIC_INDEX" },
 426     {  94, "APPLICATION_DESC" },
 427     {  95, "APPLICATION_ID" },
 428     {  96, "APPLICATION_NAME" },
 429     {  98, "postIpDiffServCodePoint" },
 430     {  99, "multicastReplicationFactor" },
 431     { 101, "classificationEngineId" },
 432     { 128, "DST_AS_PEER" },
 433     { 129, "SRC_AS_PEER" },
 434     { 130, "exporterIPv4Address" },
 435     { 131, "exporterIPv6Address" },
 436     { 132, "DROPPED_BYTES" },
 437     { 133, "DROPPED_PACKETS" },
 438     { 134, "DROPPED_BYTES_TOTAL" },
 439     { 135, "DROPPED_PACKETS_TOTAL" },
 440     { 136, "flowEndReason" },
 441     { 137, "commonPropertiesId" },
 442     { 138, "observationPointId" },
 443     { 139, "icmpTypeCodeIPv6" },
 444     { 140, "MPLS_TOP_LABEL_IPv6_ADDRESS" },
 445     { 141, "lineCardId" },
 446     { 142, "portId" },
 447     { 143, "meteringProcessId" },
 448     { 144, "FLOW_EXPORTER" },
 449     { 145, "templateId" },
 450     { 146, "wlanChannelId" },
 451     { 147, "wlanSSID" },
 452     { 148, "flowId" },
 453     { 149, "observationDomainId" },
 454     { 150, "flowStartSeconds" },
 455     { 151, "flowEndSeconds" },
 456     { 152, "flowStartMilliseconds" },
 457     { 153, "flowEndMilliseconds" },
 458     { 154, "flowStartMicroseconds" },
 459     { 155, "flowEndMicroseconds" },
 460     { 156, "flowStartNanoseconds" },
 461     { 157, "flowEndNanoseconds" },
 462     { 158, "flowStartDeltaMicroseconds" },
 463     { 159, "flowEndDeltaMicroseconds" },
 464     { 160, "systemInitTimeMilliseconds" },
 465     { 161, "flowDurationMilliseconds" },
 466     { 162, "flowDurationMicroseconds" },
 467     { 163, "observedFlowTotalCount" },
 468     { 164, "ignoredPacketTotalCount" },
 469     { 165, "ignoredOctetTotalCount" },
 470     { 166, "notSentFlowTotalCount" },
 471     { 167, "notSentPacketTotalCount" },
 472     { 168, "notSentOctetTotalCount" },
 473     { 169, "destinationIPv6Prefix" },
 474     { 170, "sourceIPv6Prefix" },
 475     { 171, "postOctetTotalCount" },
 476     { 172, "postPacketTotalCount" },
 477     { 173, "flowKeyIndicator" },
 478     { 174, "postMCastPacketTotalCount" },
 479     { 175, "postMCastOctetTotalCount" },
 480     { 176, "ICMP_IPv4_TYPE" },
 481     { 177, "ICMP_IPv4_CODE" },
 482     { 178, "ICMP_IPv6_TYPE" },
 483     { 179, "ICMP_IPv6_CODE" },
 484     { 180, "UDP_SRC_PORT" },
 485     { 181, "UDP_DST_PORT" },
 486     { 182, "TCP_SRC_PORT" },
 487     { 183, "TCP_DST_PORT" },
 488     { 184, "TCP_SEQ_NUM" },
 489     { 185, "TCP_ACK_NUM" },
 490     { 186, "TCP_WINDOW_SIZE" },
 491     { 187, "TCP_URGENT_PTR" },
 492     { 188, "TCP_HEADER_LEN" },
 493     { 189, "IP_HEADER_LEN" },
 494     { 190, "IP_TOTAL_LEN" },
 495     { 191, "payloadLengthIPv6" },
 496     { 192, "IP_TTL" },
 497     { 193, "nextHeaderIPv6" },
 498     { 194, "mplsPayloadLength" },
 499     { 195, "IP_DSCP" },
 500     { 196, "IP_PRECEDENCE" },
 501     { 197, "IP_FRAGMENT_FLAGS" },
 502     { 198, "DELTA_BYTES_SQUARED" },
 503     { 199, "TOTAL_BYTES_SQUARED" },
 504     { 200, "MPLS_TOP_LABEL_TTL" },
 505     { 201, "MPLS_LABEL_STACK_OCTETS" },
 506     { 202, "MPLS_LABEL_STACK_DEPTH" },
 507     { 203, "MPLS_TOP_LABEL_EXP" },
 508     { 204, "IP_PAYLOAD_LENGTH" },
 509     { 205, "UDP_LENGTH" },
 510     { 206, "IS_MULTICAST" },
 511     { 207, "IP_HEADER_WORDS" },
 512     { 208, "IP_OPTION_MAP" },
 513     { 209, "TCP_OPTION_MAP" },
 514     { 210, "paddingOctets" },
 515     { 211, "collectorIPv4Address" },
 516     { 212, "collectorIPv6Address" },
 517     { 213, "collectorInterface" },
 518     { 214, "collectorProtocolVersion" },
 519     { 215, "collectorTransportProtocol" },
 520     { 216, "collectorTransportPort" },
 521     { 217, "exporterTransportPort" },
 522     { 218, "tcpSynTotalCount" },
 523     { 219, "tcpFinTotalCount" },
 524     { 220, "tcpRstTotalCount" },
 525     { 221, "tcpPshTotalCount" },
 526     { 222, "tcpAckTotalCount" },
 527     { 223, "tcpUrgTotalCount" },
 528     { 224, "ipTotalLength" },
 529     { 225, "postNATSourceIPv4Address" },
 530     { 226, "postNATDestinationIPv4Address" },
 531     { 227, "postNAPTSourceTransportPort" },
 532     { 228, "postNAPTDestinationTransportPort" },
 533     { 229, "natOriginatingAddressRealm" },
 534     { 230, "natEvent" },
 535     { 231, "initiatorOctets" },
 536     { 232, "responderOctets" },
 537     { 233, "firewallEvent" },
 538     { 234, "ingressVRFID" },
 539     { 235, "egressVRFID" },
 540     { 236, "VRFname" },
 541     { 237, "postMplsTopLabelExp" },
 542     { 238, "tcpWindowScale" },
 543     { 239, "biflowDirection" },
 544     { 240, "ethernetHeaderLength" },
 545     { 241, "ethernetPayloadLength" },
 546     { 242, "ethernetTotalLength" },
 547     { 243, "dot1qVlanId" },
 548     { 244, "dot1qPriority" },
 549     { 245, "dot1qCustomerVlanId" },
 550     { 246, "dot1qCustomerPriority" },
 551     { 247, "metroEvcId" },
 552     { 248, "metroEvcType" },
 553     { 249, "pseudoWireId" },
 554     { 250, "pseudoWireType" },
 555     { 251, "pseudoWireControlWord" },
 556     { 252, "ingressPhysicalInterface" },
 557     { 253, "egressPhysicalInterface" },
 558     { 254, "postDot1qVlanId" },
 559     { 255, "postDot1qCustomerVlanId" },
 560     { 256, "ethernetType" },
 561     { 257, "postIpPrecedence" },
 562     { 258, "collectionTimeMilliseconds" },
 563     { 259, "exportSctpStreamId" },
 564     { 260, "maxExportSeconds" },
 565     { 261, "maxFlowEndSeconds" },
 566     { 262, "messageMD5Checksum" },
 567     { 263, "messageScope" },
 568     { 264, "minExportSeconds" },
 569     { 265, "minFlowStartSeconds" },
 570     { 266, "opaqueOctets" },
 571     { 267, "sessionScope" },
 572     { 268, "maxFlowEndMicroseconds" },
 573     { 269, "maxFlowEndMilliseconds" },
 574     { 270, "maxFlowEndNanoseconds" },
 575     { 271, "minFlowStartMicroseconds" },
 576     { 272, "minFlowStartMilliseconds" },
 577     { 273, "minFlowStartNanoseconds" },
 578     { 274, "collectorCertificate" },
 579     { 275, "exporterCertificate" },
 580     { 276, "dataRecordsReliability" },
 581     { 277, "observationPointType" },
 582     { 278, "newConnectionDeltaCount" },
 583     { 279, "connectionSumDurationSeconds" },
 584     { 280, "connectionTransactionId" },
 585     { 281, "postNATSourceIPv6Address" },
 586     { 282, "postNATDestinationIPv6Address" },
 587     { 283, "natPoolId" },
 588     { 284, "natPoolName" },
 589     { 285, "anonymizationFlags" },
 590     { 286, "anonymizationTechnique" },
 591     { 287, "informationElementIndex" },
 592     { 288, "p2pTechnology" },
 593     { 289, "tunnelTechnology" },
 594     { 290, "encryptedTechnology" },
 595     { 291, "basicList" },
 596     { 292, "subTemplateList" },
 597     { 293, "subTemplateMultiList" },
 598     { 294, "bgpValidityState" },
 599     { 295, "IPSecSPI" },
 600     { 296, "greKey" },
 601     { 297, "natType" },
 602     { 298, "initiatorPackets" },
 603     { 299, "responderPackets" },
 604     { 300, "observationDomainName" },
 605     { 301, "selectionSequenceId" },
 606     { 302, "selectorId" },
 607     { 303, "informationElementId" },
 608     { 304, "selectorAlgorithm" },
 609     { 305, "samplingPacketInterval" },
 610     { 306, "samplingPacketSpace" },
 611     { 307, "samplingTimeInterval" },
 612     { 308, "samplingTimeSpace" },
 613     { 309, "samplingSize" },
 614     { 310, "samplingPopulation" },
 615     { 311, "samplingProbability" },
 616     { 312, "dataLinkFrameSize" },
 617     { 313, "IP_SECTION HEADER" },
 618     { 314, "IP_SECTION PAYLOAD" },
 619     { 315, "dataLinkFrameSection" },
 620     { 316, "mplsLabelStackSection" },
 621     { 317, "mplsPayloadPacketSection" },
 622     { 318, "selectorIdTotalPktsObserved" },
 623     { 319, "selectorIdTotalPktsSelected" },
 624     { 320, "absoluteError" },
 625     { 321, "relativeError" },
 626     { 322, "observationTimeSeconds" },
 627     { 323, "observationTimeMilliseconds" },
 628     { 324, "observationTimeMicroseconds" },
 629     { 325, "observationTimeNanoseconds" },
 630     { 326, "digestHashValue" },
 631     { 327, "hashIPPayloadOffset" },
 632     { 328, "hashIPPayloadSize" },
 633     { 329, "hashOutputRangeMin" },
 634     { 330, "hashOutputRangeMax" },
 635     { 331, "hashSelectedRangeMin" },
 636     { 332, "hashSelectedRangeMax" },
 637     { 333, "hashDigestOutput" },
 638     { 334, "hashInitialiserValue" },
 639     { 335, "selectorName" },
 640     { 336, "upperCILimit" },
 641     { 337, "lowerCILimit" },
 642     { 338, "confidenceLevel" },
 643     { 339, "informationElementDataType" },
 644     { 340, "informationElementDescription" },
 645     { 341, "informationElementName" },
 646     { 342, "informationElementRangeBegin" },
 647     { 343, "informationElementRangeEnd" },
 648     { 344, "informationElementSemantics" },
 649     { 345, "informationElementUnits" },
 650     { 346, "privateEnterpriseNumber" },
 651     { 347, "virtualStationInterfaceId" },
 652     { 348, "virtualStationInterfaceName" },
 653     { 349, "virtualStationUUID" },
 654     { 350, "virtualStationName" },
 655     { 351, "layer2SegmentId" },
 656     { 352, "layer2OctetDeltaCount" },
 657     { 353, "layer2OctetTotalCount" },
 658     { 354, "ingressUnicastPacketTotalCount" },
 659     { 355, "ingressMulticastPacketTotalCount" },
 660     { 356, "ingressBroadcastPacketTotalCount" },
 661     { 357, "egressUnicastPacketTotalCount" },
 662     { 358, "egressBroadcastPacketTotalCount" },
 663     { 359, "monitoringIntervalStartMilliSeconds" },
 664     { 360, "monitoringIntervalEndMilliSeconds" },
 665     { 361, "portRangeStart" },
 666     { 362, "portRangeEnd" },
 667     { 363, "portRangeStepSize" },
 668     { 364, "portRangeNumPorts" },
 669     { 365, "staMacAddress" },
 670     { 366, "staIPv4Address" },
 671     { 367, "wtpMacAddress" },
 672     { 368, "ingressInterfaceType" },
 673     { 369, "egressInterfaceType" },
 674     { 370, "rtpSequenceNumber" },
 675     { 371, "userName" },
 676     { 372, "applicationCategoryName" },
 677     { 373, "applicationSubCategoryName" },
 678     { 374, "applicationGroupName" },
 679     { 375, "originalFlowsPresent" },
 680     { 376, "originalFlowsInitiated" },
 681     { 377, "originalFlowsCompleted" },
 682     { 378, "distinctCountOfSourceIPAddress" },
 683     { 379, "distinctCountOfDestinationIPAddress" },
 684     { 380, "distinctCountOfSourceIPv4Address" },
 685     { 381, "distinctCountOfDestinationIPv4Address" },
 686     { 382, "distinctCountOfSourceIPv6Address" },
 687     { 383, "distinctCountOfDestinationIPv6Address" },
 688     { 384, "valueDistributionMethod" },
 689     { 385, "rfc3550JitterMilliseconds" },
 690     { 386, "rfc3550JitterMicroseconds" },
 691     { 387, "rfc3550JitterNanoseconds" },
 692     { 388, "dot1qDEI" },
 693     { 389, "dot1qCustomerDEI" },
 694     { 390, "flowSelectorAlgorithm" },
 695     { 391, "flowSelectedOctetDeltaCount" },
 696     { 392, "flowSelectedPacketDeltaCount" },
 697     { 393, "flowSelectedFlowDeltaCount" },
 698     { 394, "selectorIDTotalFlowsObserved" },
 699     { 395, "selectorIDTotalFlowsSelected" },
 700     { 396, "samplingFlowInterval" },
 701     { 397, "samplingFlowSpacing" },
 702     { 398, "flowSamplingTimeInterval" },
 703     { 399, "flowSamplingTimeSpacing" },
 704     { 400, "hashFlowDomain" },
 705     { 401, "transportOctetDeltaCount" },
 706     { 402, "transportPacketDeltaCount" },
 707     { 403, "originalExporterIPv4Address" },
 708     { 404, "originalExporterIPv6Address" },
 709     { 405, "originalObservationDomainId" },
 710     { 406, "intermediateProcessId" },
 711     { 407, "ignoredDataRecordTotalCount" },
 712     { 408, "dataLinkFrameType" },
 713     { 409, "sectionOffset" },
 714     { 410, "sectionExportedOctets" },
 715     { 411, "dot1qServiceInstanceTag" },
 716     { 412, "dot1qServiceInstanceId" },
 717     { 413, "dot1qServiceInstancePriority" },
 718     { 414, "dot1qCustomerSourceMacAddress" },
 719     { 415, "dot1qCustomerDestinationMacAddress" },
 720     { 416, "deprecated [dup of layer2OctetDeltaCount]" },
 721     { 417, "postLayer2OctetDeltaCount" },
 722     { 418, "postMCastLayer2OctetDeltaCount" },
 723     { 419, "deprecated [dup of layer2OctetTotalCount" },
 724     { 420, "postLayer2OctetTotalCount" },
 725     { 421, "postMCastLayer2OctetTotalCount" },
 726     { 422, "minimumLayer2TotalLength" },
 727     { 423, "maximumLayer2TotalLength" },
 728     { 424, "droppedLayer2OctetDeltaCount" },
 729     { 425, "droppedLayer2OctetTotalCount" },
 730     { 426, "ignoredLayer2OctetTotalCount" },
 731     { 427, "notSentLayer2OctetTotalCount" },
 732     { 428, "layer2OctetDeltaSumOfSquares" },
 733     { 429, "layer2OctetTotalSumOfSquares" },
 734     { 430, "layer2FrameDeltaCount" },
 735     { 431, "layer2FrameTotalCount" },
 736     { 432, "pseudoWireDestinationIPv4Address" },
 737     { 433, "ignoredLayer2FrameTotalCount" },
 738     { 434, "mibObjectValueInteger" },
 739     { 435, "mibObjectValueOctetString" },
 740     { 436, "mibObjectValueOID" },
 741     { 437, "mibObjectValueBits" },
 742     { 438, "mibObjectValueIPAddress" },
 743     { 439, "mibObjectValueCounter" },
 744     { 440, "mibObjectValueGauge" },
 745     { 441, "mibObjectValueTimeTicks" },
 746     { 442, "mibObjectValueUnsigned" },
 747     { 443, "mibObjectValueTable" },
 748     { 444, "mibObjectValueRow" },
 749     { 445, "mibObjectIdentifier" },
 750     { 446, "mibSubIdentifier" },
 751     { 447, "mibIndexIndicator" },
 752     { 448, "mibCaptureTimeSemantics" },
 753     { 449, "mibContextEngineID" },
 754     { 450, "mibContextName" },
 755     { 451, "mibObjectName" },
 756     { 452, "mibObjectDescription" },
 757     { 453, "mibObjectSyntax" },
 758     { 454, "mibModuleName" },
 759     { 455, "mobileIMSI" },
 760     { 456, "mobileMSISDN" },
 761     { 457, "httpStatusCode" },
 762     { 458, "sourceTransportPortsLimit" },
 763     { 459, "httpRequestMethod" },
 764     { 460, "httpRequestHost" },
 765     { 461, "httpRequestTarget" },
 766     { 462, "httpMessageVersion" },
 767     { 463, "natInstanceID" },
 768     { 464, "internalAddressRealm" },
 769     { 465, "externalAddressRealm" },
 770     { 466, "natQuotaExceededEvent" },
 771     { 467, "natThresholdEvent" },
 772     { 468, "httpUserAgent" },
 773     { 469, "httpContentType" },
 774     { 470, "httpReasonPhrase" },
 775     { 471, "maxSessionEntries" },
 776     { 472, "maxBIBEntries" },
 777     { 473, "maxEntriesPerUser" },
 778     { 474, "maxSubscribers" },
 779     { 475, "maxFragmentsPendingReassembly" },
 780     { 476, "addressPoolHighThreshold" },
 781     { 477, "addressPoolLowThreshold" },
 782     { 478, "addressPortMappingHighThreshold" },
 783     { 479, "addressPortMappingLowThreshold" },
 784     { 480, "addressPortMappingPerUserHighThreshold" },
 785     { 481, "globalAddressMappingHighThreshold" },
 786     { 482, "vpnIdentifier" },
 787     { 483, "bgpCommunity" },
 788     { 484, "bgpSourceCommunityList" },
 789     { 485, "bgpDestinationCommunityList" },
 790     { 486, "bgpExtendedCommunity" },
 791     { 487, "bgpSourceExtendedCommunityList" },
 792     { 488, "bgpDestinationExtendedCommunityList" },
 793     { 489, "bgpLargeCommunity" },
 794     { 490, "bgpSourceLargeCommunityList" },
 795     { 491, "bgpDestinationLargeCommunityList" },
 796     { 492, "srhFlagsIPv6" },
 797     { 493, "srhTagIPv6" },
 798     { 494, "srhSegmentIPv6" },
 799     { 495, "srhActiveSegmentIPv6" },
 800     { 496, "srhSegmentIPv6BasicList" },
 801     { 497, "srhSegmentIPv6ListSection" },
 802     { 498, "srhSegmentsIPv6Left" },
 803     { 499, "srhIPv6Section" },
 804     { 500, "srhIPv6ActiveSegmentType" },
 805     { 501, "srhSegmentIPv6LocatorLength" },
 806     { 502, "srhSegmentIPv6EndpointBehavior" },
 807     { 505, "gtpuFlags" },
 808     { 506, "gtpuMsgType" },
 809     { 507, "gtpuTEid" },
 810     { 508, "gtpuSequenceNum" },
 811     { 509, "gtpuQFI" },
 812     { 510, "gtpuPduType" },
 813     /* Ericsson NAT Logging */
 814     { 24628, "NAT_LOG_FIELD_IDX_CONTEXT_ID" },
 815     { 24629, "NAT_LOG_FIELD_IDX_CONTEXT_NAME" },
 816     { 24630, "NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC" },
 817     { 24631, "NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC" },
 818     { 24632, "NAT_LOG_FIELD_IDX_IPV4_INT_ADDR" },
 819     { 24633, "NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR" },
 820     { 24634, "NAT_LOG_FIELD_IDX_EXT_PORT_FIRST" },
 821     { 24635, "NAT_LOG_FIELD_IDX_EXT_PORT_LAST" },
 822     /* Cisco ASA5500 Series NetFlow */
 823     { 33000, "INGRESS_ACL_ID" },
 824     { 33001, "EGRESS_ACL_ID" },
 825     { 33002, "FW_EXT_EVENT" },
 826     /* Boundary bprobe */
 827     { 33610, "METER_VERSION"},
 828     { 33611, "METER_OS_SYSNAME"},
 829     { 33612, "METER_OS_NODENAME"},
 830     { 33613, "METER_OS_RELEASE"},
 831     { 33614, "METER_OS_VERSION"},
 832     { 33615, "METER_OS_MACHINE"},
 833     { 33623, "EPOCH_SECOND"},
 834     { 33624, "NIC_NAME"},
 835     { 33625, "NIC_ID"},
 836     { 33626, "NIC_MAC"},
 837     { 33627, "NIC_IP"},
 838     { 33628, "COLLISIONS"},
 839     { 33629, "ERRORS"},
 840     { 33630, "NIC_DRIVER_NAME"},
 841     { 33631, "NIC_DRIVER_VERSION"},
 842     { 33632, "NIC_FIRMWARE_VERSION"},
 843     { 33633, "METER_OS_DISTRIBUTION_NAME"},
 844     { 33634, "BOND_INTERFACE_MODE"},
 845     { 33635, "BOND_INTERFACE_PHYSICAL_NIC_COUNT"},
 846     { 33636, "BOND_INTERFACE_ID"},
 847     /* Cisco TrustSec */
 848     { 34000, "SGT_SOURCE_TAG" },
 849     { 34001, "SGT_DESTINATION_TAG" },
 850     { 34002, "SGT_SOURCE_NAME" },
 851     { 34003, "SGT_DESTINATION_NAME" },
 852     /* medianet performance monitor */
 853     { 37000, "PACKETS_DROPPED" },
 854     { 37003, "BYTE_RATE" },
 855     { 37004, "APPLICATION_MEDIA_BYTES" },
 856     { 37006, "APPLICATION_MEDIA_BYTE_RATE" },
 857     { 37007, "APPLICATION_MEDIA_PACKETS" },
 858     { 37009, "APPLICATION_MEDIA_PACKET_RATE" },
 859     { 37011, "APPLICATION_MEDIA_EVENT" },
 860     { 37012, "MONITOR_EVENT" },
 861     { 37013, "TIMESTAMP_INTERVAL" },
 862     { 37014, "TRANSPORT_PACKETS_EXPECTED" },
 863     { 37016, "TRANSPORT_ROUND_TRIP_TIME" },
 864     { 37017, "TRANSPORT_EVENT_PACKET_LOSS" },
 865     { 37019, "TRANSPORT_PACKETS_LOST" },
 866     { 37021, "TRANSPORT_PACKETS_LOST_RATE" },
 867     { 37022, "TRANSPORT_RTP_SSRC" },
 868     { 37023, "TRANSPORT_RTP_JITTER_MEAN" },
 869     { 37024, "TRANSPORT_RTP_JITTER_MIN" },
 870     { 37025, "TRANSPORT_RTP_JITTER_MAX" },
 871     { 37041, "TRANSPORT_RTP_PAYLOAD_TYPE" },
 872     { 37071, "TRANSPORT_BYTES_OUT_OF_ORDER" },
 873     { 37074, "TRANSPORT_PACKETS_OUT_OF_ORDER" },
 874     { 37083, "TRANSPORT_TCP_WINDOWS_SIZE_MIN" },
 875     { 37084, "TRANSPORT_TCP_WINDOWS_SIZE_MAX" },
 876     { 37085, "TRANSPORT_TCP_WINDOWS_SIZE_MEAN" },
 877     { 37086, "TRANSPORT_TCP_MAXIMUM_SEGMENT_SIZE" },
 878     /* Cisco ASA 5500 */
 879     { 40000, "AAA_USERNAME" },
 880     { 40001, "XLATE_SRC_ADDR_IPV4" },
 881     { 40002, "XLATE_DST_ADDR_IPV4" },
 882     { 40003, "XLATE_SRC_PORT" },
 883     { 40004, "XLATE_DST_PORT" },
 884     { 40005, "FW_EVENT" },
 885     /* v9 nTop extensions. */
 886     {  80 + NTOP_BASE, "SRC_FRAGMENTS" },
 887     {  81 + NTOP_BASE, "DST_FRAGMENTS" },
 888     {  82 + NTOP_BASE, "SRC_TO_DST_MAX_THROUGHPUT" },
 889     {  83 + NTOP_BASE, "SRC_TO_DST_MIN_THROUGHPUT" },
 890     {  84 + NTOP_BASE, "SRC_TO_DST_AVG_THROUGHPUT" },
 891     {  85 + NTOP_BASE, "SRC_TO_SRC_MAX_THROUGHPUT" },
 892     {  86 + NTOP_BASE, "SRC_TO_SRC_MIN_THROUGHPUT" },
 893     {  87 + NTOP_BASE, "SRC_TO_SRC_AVG_THROUGHPUT" },
 894     {  88 + NTOP_BASE, "NUM_PKTS_UP_TO_128_BYTES" },
 895     {  89 + NTOP_BASE, "NUM_PKTS_128_TO_256_BYTES" },
 896     {  90 + NTOP_BASE, "NUM_PKTS_256_TO_512_BYTES" },
 897     {  91 + NTOP_BASE, "NUM_PKTS_512_TO_1024_BYTES" },
 898     {  92 + NTOP_BASE, "NUM_PKTS_1024_TO_1514_BYTES" },
 899     {  93 + NTOP_BASE, "NUM_PKTS_OVER_1514_BYTES" },
 900     {  98 + NTOP_BASE, "CUMULATIVE_ICMP_TYPE" },
 901     { 101 + NTOP_BASE, "SRC_IP_COUNTRY" },
 902     { 102 + NTOP_BASE, "SRC_IP_CITY" },
 903     { 103 + NTOP_BASE, "DST_IP_COUNTRY" },
 904     { 104 + NTOP_BASE, "DST_IP_CITY" },
 905     { 105 + NTOP_BASE, "FLOW_PROTO_PORT" },
 906     { 106 + NTOP_BASE, "UPSTREAM_TUNNEL_ID" },
 907     { 107 + NTOP_BASE, "LONGEST_FLOW_PKT" },
 908     { 108 + NTOP_BASE, "SHORTEST_FLOW_PKT" },
 909     { 109 + NTOP_BASE, "RETRANSMITTED_IN_PKTS" },
 910     { 110 + NTOP_BASE, "RETRANSMITTED_OUT_PKTS" },
 911     { 111 + NTOP_BASE, "OOORDER_IN_PKTS" },
 912     { 112 + NTOP_BASE, "OOORDER_OUT_PKTS" },
 913     { 113 + NTOP_BASE, "UNTUNNELED_PROTOCOL" },
 914     { 114 + NTOP_BASE, "UNTUNNELED_IPV4_SRC_ADDR" },
 915     { 115 + NTOP_BASE, "UNTUNNELED_L4_SRC_PORT" },
 916     { 116 + NTOP_BASE, "UNTUNNELED_IPV4_DST_ADDR" },
 917     { 117 + NTOP_BASE, "UNTUNNELED_L4_DST_PORT" },
 918     { 118 + NTOP_BASE, "L7_PROTO" },
 919     { 119 + NTOP_BASE, "L7_PROTO_NAME" },
 920     { 120 + NTOP_BASE, "DOWNSTREAM_TUNNEL_ID" },
 921     { 121 + NTOP_BASE, "FLOW_USER_NAME" },
 922     { 122 + NTOP_BASE, "FLOW_SERVER_NAME" },
 923     { 123 + NTOP_BASE, "CLIENT_NW_LATENCY_MS" },
 924     { 124 + NTOP_BASE, "SERVER_NW_LATENCY_MS" },
 925     { 125 + NTOP_BASE, "APPL_LATENCY_MS" },
 926     { 126 + NTOP_BASE, "PLUGIN_NAME" },
 927     { 127 + NTOP_BASE, "RETRANSMITTED_IN_BYTES" },
 928     { 128 + NTOP_BASE, "RETRANSMITTED_OUT_BYTES" },
 929     { 130 + NTOP_BASE, "SIP_CALL_ID" },
 930     { 131 + NTOP_BASE, "SIP_CALLING_PARTY" },
 931     { 132 + NTOP_BASE, "SIP_CALLED_PARTY" },
 932     { 133 + NTOP_BASE, "SIP_RTP_CODECS" },
 933     { 134 + NTOP_BASE, "SIP_INVITE_TIME" },
 934     { 135 + NTOP_BASE, "SIP_TRYING_TIME" },
 935     { 136 + NTOP_BASE, "SIP_RINGING_TIME" },
 936     { 137 + NTOP_BASE, "SIP_INVITE_OK_TIME" },
 937     { 138 + NTOP_BASE, "SIP_INVITE_FAILURE_TIME" },
 938     { 139 + NTOP_BASE, "SIP_BYE_TIME" },
 939     { 140 + NTOP_BASE, "SIP_BYE_OK_TIME" },
 940     { 141 + NTOP_BASE, "SIP_CANCEL_TIME" },
 941     { 142 + NTOP_BASE, "SIP_CANCEL_OK_TIME" },
 942     { 143 + NTOP_BASE, "SIP_RTP_IPV4_SRC_ADDR" },
 943     { 144 + NTOP_BASE, "SIP_RTP_L4_SRC_PORT" },
 944     { 145 + NTOP_BASE, "SIP_RTP_IPV4_DST_ADDR" },
 945     { 146 + NTOP_BASE, "SIP_RTP_L4_DST_PORT" },
 946     { 147 + NTOP_BASE, "SIP_RESPONSE_CODE" },
 947     { 148 + NTOP_BASE, "SIP_REASON_CAUSE" },
 948     { 150 + NTOP_BASE, "RTP_FIRST_SEQ" },
 949     { 151 + NTOP_BASE, "RTP_FIRST_TS" },
 950     { 152 + NTOP_BASE, "RTP_LAST_SEQ" },
 951     { 153 + NTOP_BASE, "RTP_LAST_TS" },
 952     { 154 + NTOP_BASE, "RTP_IN_JITTER" },
 953     { 155 + NTOP_BASE, "RTP_OUT_JITTER" },
 954     { 156 + NTOP_BASE, "RTP_IN_PKT_LOST" },
 955     { 157 + NTOP_BASE, "RTP_OUT_PKT_LOST" },
 956     { 158 + NTOP_BASE, "RTP_OUT_PAYLOAD_TYPE" },
 957     { 159 + NTOP_BASE, "RTP_IN_MAX_DELTA" },
 958     { 160 + NTOP_BASE, "RTP_OUT_MAX_DELTA" },
 959     { 161 + NTOP_BASE, "RTP_IN_PAYLOAD_TYPE" },
 960     { 168 + NTOP_BASE, "SRC_PROC_PID" },
 961     { 169 + NTOP_BASE, "SRC_PROC_NAME" },
 962     { 180 + NTOP_BASE, "HTTP_URL" },
 963     { 181 + NTOP_BASE, "HTTP_RET_CODE" },
 964     { 182 + NTOP_BASE, "HTTP_REFERER" },
 965     { 183 + NTOP_BASE, "HTTP_UA" },
 966     { 184 + NTOP_BASE, "HTTP_MIME" },
 967     { 185 + NTOP_BASE, "SMTP_MAIL_FROM" },
 968     { 186 + NTOP_BASE, "SMTP_RCPT_TO" },
 969     { 187 + NTOP_BASE, "HTTP_HOST" },
 970     { 188 + NTOP_BASE, "SSL_SERVER_NAME" },
 971     { 189 + NTOP_BASE, "BITTORRENT_HASH" },
 972     { 195 + NTOP_BASE, "MYSQL_SRV_VERSION" },
 973     { 196 + NTOP_BASE, "MYSQL_USERNAME" },
 974     { 197 + NTOP_BASE, "MYSQL_DB" },
 975     { 198 + NTOP_BASE, "MYSQL_QUERY" },
 976     { 199 + NTOP_BASE, "MYSQL_RESPONSE" },
 977     { 200 + NTOP_BASE, "ORACLE_USERNAME" },
 978     { 201 + NTOP_BASE, "ORACLE_QUERY" },
 979     { 202 + NTOP_BASE, "ORACLE_RSP_CODE" },
 980     { 203 + NTOP_BASE, "ORACLE_RSP_STRING" },
 981     { 204 + NTOP_BASE, "ORACLE_QUERY_DURATION" },
 982     { 205 + NTOP_BASE, "DNS_QUERY" },
 983     { 206 + NTOP_BASE, "DNS_QUERY_ID" },
 984     { 207 + NTOP_BASE, "DNS_QUERY_TYPE" },
 985     { 208 + NTOP_BASE, "DNS_RET_CODE" },
 986     { 209 + NTOP_BASE, "DNS_NUM_ANSWERS" },
 987     { 210 + NTOP_BASE, "POP_USER" },
 988     { 220 + NTOP_BASE, "GTPV1_REQ_MSG_TYPE" },
 989     { 221 + NTOP_BASE, "GTPV1_RSP_MSG_TYPE" },
 990     { 222 + NTOP_BASE, "GTPV1_C2S_TEID_DATA" },
 991     { 223 + NTOP_BASE, "GTPV1_C2S_TEID_CTRL" },
 992     { 224 + NTOP_BASE, "GTPV1_S2C_TEID_DATA" },
 993     { 225 + NTOP_BASE, "GTPV1_S2C_TEID_CTRL" },
 994     { 226 + NTOP_BASE, "GTPV1_END_USER_IP" },
 995     { 227 + NTOP_BASE, "GTPV1_END_USER_IMSI" },
 996     { 228 + NTOP_BASE, "GTPV1_END_USER_MSISDN" },
 997     { 229 + NTOP_BASE, "GTPV1_END_USER_IMEI" },
 998     { 230 + NTOP_BASE, "GTPV1_APN_NAME" },
 999     { 231 + NTOP_BASE, "GTPV1_RAI_MCC" },
1000     { 232 + NTOP_BASE, "GTPV1_RAI_MNC" },
1001     { 233 + NTOP_BASE, "GTPV1_ULI_CELL_LAC" },
1002     { 234 + NTOP_BASE, "GTPV1_ULI_CELL_CI" },
1003     { 235 + NTOP_BASE, "GTPV1_ULI_SAC" },
1004     { 236 + NTOP_BASE, "GTPV1_RAT_TYPE" },
1005     { 240 + NTOP_BASE, "RADIUS_REQ_MSG_TYPE" },
1006     { 241 + NTOP_BASE, "RADIUS_RSP_MSG_TYPE" },
1007     { 242 + NTOP_BASE, "RADIUS_USER_NAME" },
1008     { 243 + NTOP_BASE, "RADIUS_CALLING_STATION_ID" },
1009     { 244 + NTOP_BASE, "RADIUS_CALLED_STATION_ID" },
1010     { 245 + NTOP_BASE, "RADIUS_NAS_IP_ADDR" },
1011     { 246 + NTOP_BASE, "RADIUS_NAS_IDENTIFIER" },
1012     { 247 + NTOP_BASE, "RADIUS_USER_IMSI" },
1013     { 248 + NTOP_BASE, "RADIUS_USER_IMEI" },
1014     { 249 + NTOP_BASE, "RADIUS_FRAMED_IP_ADDR" },
1015     { 250 + NTOP_BASE, "RADIUS_ACCT_SESSION_ID" },
1016     { 251 + NTOP_BASE, "RADIUS_ACCT_STATUS_TYPE" },
1017     { 252 + NTOP_BASE, "RADIUS_ACCT_IN_OCTETS" },
1018     { 253 + NTOP_BASE, "RADIUS_ACCT_OUT_OCTETS" },
1019     { 254 + NTOP_BASE, "RADIUS_ACCT_IN_PKTS" },
1020     { 255 + NTOP_BASE, "RADIUS_ACCT_OUT_PKTS" },
1021     { 260 + NTOP_BASE, "IMAP_LOGIN" },
1022     { 270 + NTOP_BASE, "GTPV2_REQ_MSG_TYPE" },
1023     { 271 + NTOP_BASE, "GTPV2_RSP_MSG_TYPE" },
1024     { 272 + NTOP_BASE, "GTPV2_C2S_S1U_GTPU_TEID" },
1025     { 273 + NTOP_BASE, "GTPV2_C2S_S1U_GTPU_IP" },
1026     { 274 + NTOP_BASE, "GTPV2_S2C_S1U_GTPU_TEID" },
1027     { 275 + NTOP_BASE, "GTPV2_S2C_S1U_GTPU_IP" },
1028     { 276 + NTOP_BASE, "GTPV2_END_USER_IMSI" },
1029     { 277 + NTOP_BASE, "GTPV2_END_USER_MSISDN" },
1030     { 278 + NTOP_BASE, "GTPV2_APN_NAME" },
1031     { 279 + NTOP_BASE, "GTPV2_ULI_MCC" },
1032     { 280 + NTOP_BASE, "GTPV2_ULI_MNC" },
1033     { 281 + NTOP_BASE, "GTPV2_ULI_CELL_TAC" },
1034     { 282 + NTOP_BASE, "GTPV2_ULI_CELL_ID" },
1035     { 283 + NTOP_BASE, "GTPV2_RAT_TYPE" },
1036     { 284 + NTOP_BASE, "GTPV2_PDN_IP" },
1037     { 285 + NTOP_BASE, "GTPV2_END_USER_IMEI" },
1038     { 290 + NTOP_BASE, "SRC_AS_PATH_1" },
1039     { 291 + NTOP_BASE, "SRC_AS_PATH_2" },
1040     { 292 + NTOP_BASE, "SRC_AS_PATH_3" },
1041     { 293 + NTOP_BASE, "SRC_AS_PATH_4" },
1042     { 294 + NTOP_BASE, "SRC_AS_PATH_5" },
1043     { 295 + NTOP_BASE, "SRC_AS_PATH_6" },
1044     { 296 + NTOP_BASE, "SRC_AS_PATH_7" },
1045     { 297 + NTOP_BASE, "SRC_AS_PATH_8" },
1046     { 298 + NTOP_BASE, "SRC_AS_PATH_9" },
1047     { 299 + NTOP_BASE, "SRC_AS_PATH_10" },
1048     { 300 + NTOP_BASE, "DST_AS_PATH_1" },
1049     { 301 + NTOP_BASE, "DST_AS_PATH_2" },
1050     { 302 + NTOP_BASE, "DST_AS_PATH_3" },
1051     { 303 + NTOP_BASE, "DST_AS_PATH_4" },
1052     { 304 + NTOP_BASE, "DST_AS_PATH_5" },
1053     { 305 + NTOP_BASE, "DST_AS_PATH_6" },
1054     { 306 + NTOP_BASE, "DST_AS_PATH_7" },
1055     { 307 + NTOP_BASE, "DST_AS_PATH_8" },
1056     { 308 + NTOP_BASE, "DST_AS_PATH_9" },
1057     { 309 + NTOP_BASE, "DST_AS_PATH_10" },
1058     { 320 + NTOP_BASE, "MYSQL_APPL_LATENCY_USEC" },
1059     { 321 + NTOP_BASE, "GTPV0_REQ_MSG_TYPE" },
1060     { 322 + NTOP_BASE, "GTPV0_RSP_MSG_TYPE" },
1061     { 323 + NTOP_BASE, "GTPV0_TID" },
1062     { 324 + NTOP_BASE, "GTPV0_END_USER_IP" },
1063     { 325 + NTOP_BASE, "GTPV0_END_USER_MSISDN" },
1064     { 326 + NTOP_BASE, "GTPV0_APN_NAME" },
1065     { 327 + NTOP_BASE, "GTPV0_RAI_MCC" },
1066     { 328 + NTOP_BASE, "GTPV0_RAI_MNC" },
1067     { 329 + NTOP_BASE, "GTPV0_RAI_CELL_LAC" },
1068     { 330 + NTOP_BASE, "GTPV0_RAI_CELL_RAC" },
1069     { 331 + NTOP_BASE, "GTPV0_RESPONSE_CAUSE" },
1070     { 332 + NTOP_BASE, "GTPV1_RESPONSE_CAUSE" },
1071     { 333 + NTOP_BASE, "GTPV2_RESPONSE_CAUSE" },
1072     { 334 + NTOP_BASE, "NUM_PKTS_TTL_5_32" },
1073     { 335 + NTOP_BASE, "NUM_PKTS_TTL_32_64" },
1074     { 336 + NTOP_BASE, "NUM_PKTS_TTL_64_96" },
1075     { 337 + NTOP_BASE, "NUM_PKTS_TTL_96_128" },
1076     { 338 + NTOP_BASE, "NUM_PKTS_TTL_128_160" },
1077     { 339 + NTOP_BASE, "NUM_PKTS_TTL_160_192" },
1078     { 340 + NTOP_BASE, "NUM_PKTS_TTL_192_224" },
1079     { 341 + NTOP_BASE, "NUM_PKTS_TTL_224_255" },
1080     { 342 + NTOP_BASE, "GTPV1_RAI_LAC" },
1081     { 343 + NTOP_BASE, "GTPV1_RAI_RAC" },
1082     { 344 + NTOP_BASE, "GTPV1_ULI_MCC" },
1083     { 345 + NTOP_BASE, "GTPV1_ULI_MNC" },
1084     { 346 + NTOP_BASE, "NUM_PKTS_TTL_2_5" },
1085     { 347 + NTOP_BASE, "NUM_PKTS_TTL_EQ_1" },
1086     { 348 + NTOP_BASE, "RTP_SIP_CALL_ID" },
1087     { 349 + NTOP_BASE, "IN_SRC_OSI_SAP" },
1088     { 350 + NTOP_BASE, "OUT_DST_OSI_SAP" },
1089     { 351 + NTOP_BASE, "WHOIS_DAS_DOMAIN" },
1090     { 352 + NTOP_BASE, "DNS_TTL_ANSWER" },
1091     { 353 + NTOP_BASE, "DHCP_CLIENT_MAC" },
1092     { 354 + NTOP_BASE, "DHCP_CLIENT_IP" },
1093     { 355 + NTOP_BASE, "DHCP_CLIENT_NAME" },
1094     { 356 + NTOP_BASE, "FTP_LOGIN" },
1095     { 357 + NTOP_BASE, "FTP_PASSWORD" },
1096     { 358 + NTOP_BASE, "FTP_COMMAND" },
1097     { 359 + NTOP_BASE, "FTP_COMMAND_RET_CODE" },
1098     { 360 + NTOP_BASE, "HTTP_METHOD" },
1099     { 361 + NTOP_BASE, "HTTP_SITE" },
1100     { 362 + NTOP_BASE, "SIP_C_IP" },
1101     { 363 + NTOP_BASE, "SIP_CALL_STATE" },
1102     { 364 + NTOP_BASE, "EPP_REGISTRAR_NAME" },
1103     { 365 + NTOP_BASE, "EPP_CMD" },
1104     { 366 + NTOP_BASE, "EPP_CMD_ARGS" },
1105     { 367 + NTOP_BASE, "EPP_RSP_CODE" },
1106     { 368 + NTOP_BASE, "EPP_REASON_STR" },
1107     { 369 + NTOP_BASE, "EPP_SERVER_NAME" },
1108     { 370 + NTOP_BASE, "RTP_IN_MOS" },
1109     { 371 + NTOP_BASE, "RTP_IN_R_FACTOR" },
1110     { 372 + NTOP_BASE, "SRC_PROC_USER_NAME" },
1111     { 373 + NTOP_BASE, "SRC_FATHER_PROC_PID" },
1112     { 374 + NTOP_BASE, "SRC_FATHER_PROC_NAME" },
1113     { 375 + NTOP_BASE, "DST_PROC_PID" },
1114     { 376 + NTOP_BASE, "DST_PROC_NAME" },
1115     { 377 + NTOP_BASE, "DST_PROC_USER_NAME" },
1116     { 378 + NTOP_BASE, "DST_FATHER_PROC_PID" },
1117     { 379 + NTOP_BASE, "DST_FATHER_PROC_NAME" },
1118     { 380 + NTOP_BASE, "RTP_RTT" },
1119     { 381 + NTOP_BASE, "RTP_IN_TRANSIT" },
1120     { 382 + NTOP_BASE, "RTP_OUT_TRANSIT" },
1121     { 383 + NTOP_BASE, "SRC_PROC_ACTUAL_MEMORY" },
1122     { 384 + NTOP_BASE, "SRC_PROC_PEAK_MEMORY" },
1123     { 385 + NTOP_BASE, "SRC_PROC_AVERAGE_CPU_LOAD" },
1124     { 386 + NTOP_BASE, "SRC_PROC_NUM_PAGE_FAULTS" },
1125     { 387 + NTOP_BASE, "DST_PROC_ACTUAL_MEMORY" },
1126     { 388 + NTOP_BASE, "DST_PROC_PEAK_MEMORY" },
1127     { 389 + NTOP_BASE, "DST_PROC_AVERAGE_CPU_LOAD" },
1128     { 390 + NTOP_BASE, "DST_PROC_NUM_PAGE_FAULTS" },
1129     { 391 + NTOP_BASE, "DURATION_IN" },
1130     { 392 + NTOP_BASE, "DURATION_OUT" },
1131     { 393 + NTOP_BASE, "SRC_PROC_PCTG_IOWAIT" },
1132     { 394 + NTOP_BASE, "DST_PROC_PCTG_IOWAIT" },
1133     { 395 + NTOP_BASE, "RTP_DTMF_TONES" },
1134     { 396 + NTOP_BASE, "UNTUNNELED_IPV6_SRC_ADDR" },
1135     { 397 + NTOP_BASE, "UNTUNNELED_IPV6_DST_ADDR" },
1136     { 398 + NTOP_BASE, "DNS_RESPONSE" },
1137     { 399 + NTOP_BASE, "DIAMETER_REQ_MSG_TYPE" },
1138     { 400 + NTOP_BASE, "DIAMETER_RSP_MSG_TYPE" },
1139     { 401 + NTOP_BASE, "DIAMETER_REQ_ORIGIN_HOST" },
1140     { 402 + NTOP_BASE, "DIAMETER_RSP_ORIGIN_HOST" },
1141     { 403 + NTOP_BASE, "DIAMETER_REQ_USER_NAME" },
1142     { 404 + NTOP_BASE, "DIAMETER_RSP_RESULT_CODE" },
1143     { 405 + NTOP_BASE, "DIAMETER_EXP_RES_VENDOR_ID" },
1144     { 406 + NTOP_BASE, "DIAMETER_EXP_RES_RESULT_CODE" },
1145     { 407 + NTOP_BASE, "S1AP_ENB_UE_S1AP_ID" },
1146     { 408 + NTOP_BASE, "S1AP_MME_UE_S1AP_ID" },
1147     { 409 + NTOP_BASE, "S1AP_MSG_EMM_TYPE_MME_TO_ENB" },
1148     { 410 + NTOP_BASE, "S1AP_MSG_ESM_TYPE_MME_TO_ENB" },
1149     { 411 + NTOP_BASE, "S1AP_MSG_EMM_TYPE_ENB_TO_MME" },
1150     { 412 + NTOP_BASE, "S1AP_MSG_ESM_TYPE_ENB_TO_MME" },
1151     { 413 + NTOP_BASE, "S1AP_CAUSE_ENB_TO_MME" },
1152     { 414 + NTOP_BASE, "S1AP_DETAILED_CAUSE_ENB_TO_MME" },
1153     { 415 + NTOP_BASE, "TCP_WIN_MIN_IN" },
1154     { 416 + NTOP_BASE, "TCP_WIN_MAX_IN" },
1155     { 417 + NTOP_BASE, "TCP_WIN_MSS_IN" },
1156     { 418 + NTOP_BASE, "TCP_WIN_SCALE_IN" },
1157     { 419 + NTOP_BASE, "TCP_WIN_MIN_OUT" },
1158     { 420 + NTOP_BASE, "TCP_WIN_MAX_OUT" },
1159     { 421 + NTOP_BASE, "TCP_WIN_MSS_OUT" },
1160     { 422 + NTOP_BASE, "TCP_WIN_SCALE_OUT" },
1161     { 423 + NTOP_BASE, "DHCP_REMOTE_ID" },
1162     { 424 + NTOP_BASE, "DHCP_SUBSCRIBER_ID" },
1163     { 425 + NTOP_BASE, "SRC_PROC_UID" },
1164     { 426 + NTOP_BASE, "DST_PROC_UID" },
1165     { 427 + NTOP_BASE, "APPLICATION_NAME" },
1166     { 428 + NTOP_BASE, "USER_NAME" },
1167     { 429 + NTOP_BASE, "DHCP_MESSAGE_TYPE" },
1168     { 430 + NTOP_BASE, "RTP_IN_PKT_DROP" },
1169     { 431 + NTOP_BASE, "RTP_OUT_PKT_DROP" },
1170     { 432 + NTOP_BASE, "RTP_OUT_MOS" },
1171     { 433 + NTOP_BASE, "RTP_OUT_R_FACTOR" },
1172     { 434 + NTOP_BASE, "RTP_MOS" },
1173     { 435 + NTOP_BASE, "GTPV2_S5_S8_GTPC_TEID" },
1174     { 436 + NTOP_BASE, "RTP_R_FACTOR" },
1175     { 437 + NTOP_BASE, "RTP_SSRC" },
1176     { 438 + NTOP_BASE, "PAYLOAD_HASH" },
1177     { 439 + NTOP_BASE, "GTPV2_C2S_S5_S8_GTPU_TEID" },
1178     { 440 + NTOP_BASE, "GTPV2_S2C_S5_S8_GTPU_TEID" },
1179     { 441 + NTOP_BASE, "GTPV2_C2S_S5_S8_GTPU_IP" },
1180     { 442 + NTOP_BASE, "GTPV2_S2C_S5_S8_GTPU_IP" },
1181     { 443 + NTOP_BASE, "SRC_AS_MAP" },
1182     { 444 + NTOP_BASE, "DST_AS_MAP" },
1183     { 445 + NTOP_BASE, "DIAMETER_HOP_BY_HOP_ID" },
1184     { 446 + NTOP_BASE, "UPSTREAM_SESSION_ID" },
1185     { 447 + NTOP_BASE, "DOWNSTREAM_SESSION_ID" },
1186     { 448 + NTOP_BASE, "SRC_IP_LONG" },
1187     { 449 + NTOP_BASE, "SRC_IP_LAT" },
1188     { 450 + NTOP_BASE, "DST_IP_LONG" },
1189     { 451 + NTOP_BASE, "DST_IP_LAT" },
1190     { 452 + NTOP_BASE, "DIAMETER_CLR_CANCEL_TYPE" },
1191     { 453 + NTOP_BASE, "DIAMETER_CLR_FLAGS" },
1192     { 454 + NTOP_BASE, "GTPV2_C2S_S5_S8_GTPC_IP" },
1193     { 455 + NTOP_BASE, "GTPV2_S2C_S5_S8_GTPC_IP" },
1194     { 456 + NTOP_BASE, "GTPV2_C2S_S5_S8_SGW_GTPU_TEID" },
1195     { 457 + NTOP_BASE, "GTPV2_S2C_S5_S8_SGW_GTPU_TEID" },
1196     { 458 + NTOP_BASE, "GTPV2_C2S_S5_S8_SGW_GTPU_IP" },
1197     { 459 + NTOP_BASE, "GTPV2_S2C_S5_S8_SGW_GTPU_IP" },
1198     { 460 + NTOP_BASE, "HTTP_X_FORWARDED_FOR" },
1199     { 461 + NTOP_BASE, "HTTP_VIA" },
1200     { 462 + NTOP_BASE, "SSDP_HOST" },
1201     { 463 + NTOP_BASE, "SSDP_USN" },
1202     { 464 + NTOP_BASE, "NETBIOS_QUERY_NAME" },
1203     { 465 + NTOP_BASE, "NETBIOS_QUERY_TYPE" },
1204     { 466 + NTOP_BASE, "NETBIOS_RESPONSE" },
1205     { 467 + NTOP_BASE, "NETBIOS_QUERY_OS" },
1206     { 468 + NTOP_BASE, "SSDP_SERVER" },
1207     { 469 + NTOP_BASE, "SSDP_TYPE" },
1208     { 470 + NTOP_BASE, "SSDP_METHOD" },
1209     { 471 + NTOP_BASE, "NPROBE_IPV4_ADDRESS" },
1210     { 0, NULL }
1211 };
1212 static value_string_ext v9_v10_template_types_ext = VALUE_STRING_EXT_INIT(v9_v10_template_types);
1213
1214 static const value_string v10_template_types_plixer[] = {
1215     { 100, "client_ip_v4" },
1216     { 101, "client_hostname" },
1217     { 102, "partner_name" },
1218     { 103, "server_hostname" },
1219     { 104, "server_ip_v4" },
1220     { 105, "recipient_address" },
1221     { 106, "event_id" },
1222     { 107, "msgid" },
1223     { 108, "priority" },
1224     { 109, "recipient_report_status" },
1225     { 110, "number_recipients" },
1226     { 111, "origination_time" },
1227     { 112, "encryption" },
1228     { 113, "service_version" },
1229     { 114, "linked_msgid" },
1230     { 115, "message_subject" },
1231     { 116, "sender_address" },
1232     { 117, "date_time" },
1233     { 118, "client_ip_v6" },
1234     { 119, "server_ip_v6" },
1235     { 120, "source_context" },
1236     { 121, "connector_id" },
1237     { 122, "source_component" },
1238     { 123, "unassigned" },                    /* added to allow direct lookup */
1239     { 124, "related_recipient_address" },
1240     { 125, "reference" },
1241     { 126, "return_path" },
1242     { 127, "message_info" },
1243     { 128, "directionality" },
1244     { 129, "tenant_id" },
1245     { 130, "original_client_ip_v4" },
1246     { 131, "original_server_ip_v4" },
1247     { 132, "custom_data" },
1248     { 133, "internal_message_id" },
1249     { 0, NULL }
1250 };
1251 static value_string_ext v10_template_types_plixer_ext = VALUE_STRING_EXT_INIT(v10_template_types_plixer);
1252
1253 static const value_string v10_template_types_ntop[] = {
1254     {  80, "SRC_FRAGMENTS" },
1255     {  81, "DST_FRAGMENTS" },
1256     {  82, "SRC_TO_DST_MAX_THROUGHPUT" },
1257     {  83, "SRC_TO_DST_MIN_THROUGHPUT" },
1258     {  84, "SRC_TO_DST_AVG_THROUGHPUT" },
1259     {  85, "SRC_TO_SRC_MAX_THROUGHPUT" },
1260     {  86, "SRC_TO_SRC_MIN_THROUGHPUT" },
1261     {  87, "SRC_TO_SRC_AVG_THROUGHPUT" },
1262     {  88, "NUM_PKTS_UP_TO_128_BYTES" },
1263     {  89, "NUM_PKTS_128_TO_256_BYTES" },
1264     {  90, "NUM_PKTS_256_TO_512_BYTES" },
1265     {  91, "NUM_PKTS_512_TO_1024_BYTES" },
1266     {  92, "NUM_PKTS_1024_TO_1514_BYTES" },
1267     {  93, "NUM_PKTS_OVER_1514_BYTES" },
1268     {  98, "CUMULATIVE_ICMP_TYPE" },
1269     { 101, "SRC_IP_COUNTRY" },
1270     { 102, "SRC_IP_CITY" },
1271     { 103, "DST_IP_COUNTRY" },
1272     { 104, "DST_IP_CITY" },
1273     { 105, "FLOW_PROTO_PORT" },
1274     { 106, "UPSTREAM_TUNNEL_ID" },
1275     { 107, "LONGEST_FLOW_PKT" },
1276     { 108, "SHORTEST_FLOW_PKT" },
1277     { 109, "RETRANSMITTED_IN_PKTS" },
1278     { 110, "RETRANSMITTED_OUT_PKTS" },
1279     { 111, "OOORDER_IN_PKTS" },
1280     { 112, "OOORDER_OUT_PKTS" },
1281     { 113, "UNTUNNELED_PROTOCOL" },
1282     { 114, "UNTUNNELED_IPV4_SRC_ADDR" },
1283     { 115, "UNTUNNELED_L4_SRC_PORT" },
1284     { 116, "UNTUNNELED_IPV4_DST_ADDR" },
1285     { 117, "UNTUNNELED_L4_DST_PORT" },
1286     { 118, "L7_PROTO" },
1287     { 119, "L7_PROTO_NAME" },
1288     { 120, "DOWNSTREAM_TUNNEL_ID" },
1289     { 121, "FLOW_USER_NAME" },
1290     { 122, "FLOW_SERVER_NAME" },
1291     { 123, "CLIENT_NW_LATENCY_MS" },
1292     { 124, "SERVER_NW_LATENCY_MS" },
1293     { 125, "APPL_LATENCY_MS" },
1294     { 126, "PLUGIN_NAME" },
1295     { 127, "RETRANSMITTED_IN_BYTES" },
1296     { 128, "RETRANSMITTED_OUT_BYTES" },
1297     { 130, "SIP_CALL_ID" },
1298     { 131, "SIP_CALLING_PARTY" },
1299     { 132, "SIP_CALLED_PARTY" },
1300     { 133, "SIP_RTP_CODECS" },
1301     { 134, "SIP_INVITE_TIME" },
1302     { 135, "SIP_TRYING_TIME" },
1303     { 136, "SIP_RINGING_TIME" },
1304     { 137, "SIP_INVITE_OK_TIME" },
1305     { 138, "SIP_INVITE_FAILURE_TIME" },
1306     { 139, "SIP_BYE_TIME" },
1307     { 140, "SIP_BYE_OK_TIME" },
1308     { 141, "SIP_CANCEL_TIME" },
1309     { 142, "SIP_CANCEL_OK_TIME" },
1310     { 143, "SIP_RTP_IPV4_SRC_ADDR" },
1311     { 144, "SIP_RTP_L4_SRC_PORT" },
1312     { 145, "SIP_RTP_IPV4_DST_ADDR" },
1313     { 146, "SIP_RTP_L4_DST_PORT" },
1314     { 147, "SIP_RESPONSE_CODE" },
1315     { 148, "SIP_REASON_CAUSE" },
1316     { 150, "RTP_FIRST_SEQ" },
1317     { 151, "RTP_FIRST_TS" },
1318     { 152, "RTP_LAST_SEQ" },
1319     { 153, "RTP_LAST_TS" },
1320     { 154, "RTP_IN_JITTER" },
1321     { 155, "RTP_OUT_JITTER" },
1322     { 156, "RTP_IN_PKT_LOST" },
1323     { 157, "RTP_OUT_PKT_LOST" },
1324     { 158, "RTP_OUT_PAYLOAD_TYPE" },
1325     { 159, "RTP_IN_MAX_DELTA" },
1326     { 160, "RTP_OUT_MAX_DELTA" },
1327     { 161, "RTP_IN_PAYLOAD_TYPE" },
1328     { 168, "SRC_PROC_PID" },
1329     { 169, "SRC_PROC_NAME" },
1330     { 180, "HTTP_URL" },
1331     { 181, "HTTP_RET_CODE" },
1332     { 182, "HTTP_REFERER" },
1333     { 183, "HTTP_UA" },
1334     { 184, "HTTP_MIME" },
1335     { 185, "SMTP_MAIL_FROM" },
1336     { 186, "SMTP_RCPT_TO" },
1337     { 187, "HTTP_HOST" },
1338     { 188, "SSL_SERVER_NAME" },
1339     { 189, "BITTORRENT_HASH" },
1340     { 195, "MYSQL_SRV_VERSION" },
1341     { 196, "MYSQL_USERNAME" },
1342     { 197, "MYSQL_DB" },
1343     { 198, "MYSQL_QUERY" },
1344     { 199, "MYSQL_RESPONSE" },
1345     { 200, "ORACLE_USERNAME" },
1346     { 201, "ORACLE_QUERY" },
1347     { 202, "ORACLE_RSP_CODE" },
1348     { 203, "ORACLE_RSP_STRING" },
1349     { 204, "ORACLE_QUERY_DURATION" },
1350     { 205, "DNS_QUERY" },
1351     { 206, "DNS_QUERY_ID" },
1352     { 207, "DNS_QUERY_TYPE" },
1353     { 208, "DNS_RET_CODE" },
1354     { 209, "DNS_NUM_ANSWERS" },
1355     { 210, "POP_USER" },
1356     { 220, "GTPV1_REQ_MSG_TYPE" },
1357     { 221, "GTPV1_RSP_MSG_TYPE" },
1358     { 222, "GTPV1_C2S_TEID_DATA" },
1359     { 223, "GTPV1_C2S_TEID_CTRL" },
1360     { 224, "GTPV1_S2C_TEID_DATA" },
1361     { 225, "GTPV1_S2C_TEID_CTRL" },
1362     { 226, "GTPV1_END_USER_IP" },
1363     { 227, "GTPV1_END_USER_IMSI" },
1364     { 228, "GTPV1_END_USER_MSISDN" },
1365     { 229, "GTPV1_END_USER_IMEI" },
1366     { 230, "GTPV1_APN_NAME" },
1367     { 231, "GTPV1_RAI_MCC" },
1368     { 232, "GTPV1_RAI_MNC" },
1369     { 233, "GTPV1_ULI_CELL_LAC" },
1370     { 234, "GTPV1_ULI_CELL_CI" },
1371     { 235, "GTPV1_ULI_SAC" },
1372     { 236, "GTPV1_RAT_TYPE" },
1373     { 240, "RADIUS_REQ_MSG_TYPE" },
1374     { 241, "RADIUS_RSP_MSG_TYPE" },
1375     { 242, "RADIUS_USER_NAME" },
1376     { 243, "RADIUS_CALLING_STATION_ID" },
1377     { 244, "RADIUS_CALLED_STATION_ID" },
1378     { 245, "RADIUS_NAS_IP_ADDR" },
1379     { 246, "RADIUS_NAS_IDENTIFIER" },
1380     { 247, "RADIUS_USER_IMSI" },
1381     { 248, "RADIUS_USER_IMEI" },
1382     { 249, "RADIUS_FRAMED_IP_ADDR" },
1383     { 250, "RADIUS_ACCT_SESSION_ID" },
1384     { 251, "RADIUS_ACCT_STATUS_TYPE" },
1385     { 252, "RADIUS_ACCT_IN_OCTETS" },
1386     { 253, "RADIUS_ACCT_OUT_OCTETS" },
1387     { 254, "RADIUS_ACCT_IN_PKTS" },
1388     { 255, "RADIUS_ACCT_OUT_PKTS" },
1389     { 260, "IMAP_LOGIN" },
1390     { 270, "GTPV2_REQ_MSG_TYPE" },
1391     { 271, "GTPV2_RSP_MSG_TYPE" },
1392     { 272, "GTPV2_C2S_S1U_GTPU_TEID" },
1393     { 273, "GTPV2_C2S_S1U_GTPU_IP" },
1394     { 274, "GTPV2_S2C_S1U_GTPU_TEID" },
1395     { 275, "GTPV2_S2C_S1U_GTPU_IP" },
1396     { 276, "GTPV2_END_USER_IMSI" },
1397     { 277, "GTPV2_END_USER_MSISDN" },
1398     { 278, "GTPV2_APN_NAME" },
1399     { 279, "GTPV2_ULI_MCC" },
1400     { 280, "GTPV2_ULI_MNC" },
1401     { 281, "GTPV2_ULI_CELL_TAC" },
1402     { 282, "GTPV2_ULI_CELL_ID" },
1403     { 283, "GTPV2_RAT_TYPE" },
1404     { 284, "GTPV2_PDN_IP" },
1405     { 285, "GTPV2_END_USER_IMEI" },
1406     { 290, "SRC_AS_PATH_1" },
1407     { 291, "SRC_AS_PATH_2" },
1408     { 292, "SRC_AS_PATH_3" },
1409     { 293, "SRC_AS_PATH_4" },
1410     { 294, "SRC_AS_PATH_5" },
1411     { 295, "SRC_AS_PATH_6" },
1412     { 296, "SRC_AS_PATH_7" },
1413     { 297, "SRC_AS_PATH_8" },
1414     { 298, "SRC_AS_PATH_9" },
1415     { 299, "SRC_AS_PATH_10" },
1416     { 300, "DST_AS_PATH_1" },
1417     { 301, "DST_AS_PATH_2" },
1418     { 302, "DST_AS_PATH_3" },
1419     { 303, "DST_AS_PATH_4" },
1420     { 304, "DST_AS_PATH_5" },
1421     { 305, "DST_AS_PATH_6" },
1422     { 306, "DST_AS_PATH_7" },
1423     { 307, "DST_AS_PATH_8" },
1424     { 308, "DST_AS_PATH_9" },
1425     { 309, "DST_AS_PATH_10" },
1426     { 320, "MYSQL_APPL_LATENCY_USEC" },
1427     { 321, "GTPV0_REQ_MSG_TYPE" },
1428     { 322, "GTPV0_RSP_MSG_TYPE" },
1429     { 323, "GTPV0_TID" },
1430     { 324, "GTPV0_END_USER_IP" },
1431     { 325, "GTPV0_END_USER_MSISDN" },
1432     { 326, "GTPV0_APN_NAME" },
1433     { 327, "GTPV0_RAI_MCC" },
1434     { 328, "GTPV0_RAI_MNC" },
1435     { 329, "GTPV0_RAI_CELL_LAC" },
1436     { 330, "GTPV0_RAI_CELL_RAC" },
1437     { 331, "GTPV0_RESPONSE_CAUSE" },
1438     { 332, "GTPV1_RESPONSE_CAUSE" },
1439     { 333, "GTPV2_RESPONSE_CAUSE" },
1440     { 334, "NUM_PKTS_TTL_5_32" },
1441     { 335, "NUM_PKTS_TTL_32_64" },
1442     { 336, "NUM_PKTS_TTL_64_96" },
1443     { 337, "NUM_PKTS_TTL_96_128" },
1444     { 338, "NUM_PKTS_TTL_128_160" },
1445     { 339, "NUM_PKTS_TTL_160_192" },
1446     { 340, "NUM_PKTS_TTL_192_224" },
1447     { 341, "NUM_PKTS_TTL_224_255" },
1448     { 342, "GTPV1_RAI_LAC" },
1449     { 343, "GTPV1_RAI_RAC" },
1450     { 344, "GTPV1_ULI_MCC" },
1451     { 345, "GTPV1_ULI_MNC" },
1452     { 346, "NUM_PKTS_TTL_2_5" },
1453     { 347, "NUM_PKTS_TTL_EQ_1" },
1454     { 348, "RTP_SIP_CALL_ID" },
1455     { 349, "IN_SRC_OSI_SAP" },
1456     { 350, "OUT_DST_OSI_SAP" },
1457     { 351, "WHOIS_DAS_DOMAIN" },
1458     { 352, "DNS_TTL_ANSWER" },
1459     { 353, "DHCP_CLIENT_MAC" },
1460     { 354, "DHCP_CLIENT_IP" },
1461     { 355, "DHCP_CLIENT_NAME" },
1462     { 356, "FTP_LOGIN" },
1463     { 357, "FTP_PASSWORD" },
1464     { 358, "FTP_COMMAND" },
1465     { 359, "FTP_COMMAND_RET_CODE" },
1466     { 360, "HTTP_METHOD" },
1467     { 361, "HTTP_SITE" },
1468     { 362, "SIP_C_IP" },
1469     { 363, "SIP_CALL_STATE" },
1470     { 364, "EPP_REGISTRAR_NAME" },
1471     { 365, "EPP_CMD" },
1472     { 366, "EPP_CMD_ARGS" },
1473     { 367, "EPP_RSP_CODE" },
1474     { 368, "EPP_REASON_STR" },
1475     { 369, "EPP_SERVER_NAME" },
1476     { 370, "RTP_IN_MOS" },
1477     { 371, "RTP_IN_R_FACTOR" },
1478     { 372, "SRC_PROC_USER_NAME" },
1479     { 373, "SRC_FATHER_PROC_PID" },
1480     { 374, "SRC_FATHER_PROC_NAME" },
1481     { 375, "DST_PROC_PID" },
1482     { 376, "DST_PROC_NAME" },
1483     { 377, "DST_PROC_USER_NAME" },
1484     { 378, "DST_FATHER_PROC_PID" },
1485     { 379, "DST_FATHER_PROC_NAME" },
1486     { 380, "RTP_RTT" },
1487     { 381, "RTP_IN_TRANSIT" },
1488     { 382, "RTP_OUT_TRANSIT" },
1489     { 383, "SRC_PROC_ACTUAL_MEMORY" },
1490     { 384, "SRC_PROC_PEAK_MEMORY" },
1491     { 385, "SRC_PROC_AVERAGE_CPU_LOAD" },
1492     { 386, "SRC_PROC_NUM_PAGE_FAULTS" },
1493     { 387, "DST_PROC_ACTUAL_MEMORY" },
1494     { 388, "DST_PROC_PEAK_MEMORY" },
1495     { 389, "DST_PROC_AVERAGE_CPU_LOAD" },
1496     { 390, "DST_PROC_NUM_PAGE_FAULTS" },
1497     { 391, "DURATION_IN" },
1498     { 392, "DURATION_OUT" },
1499     { 393, "SRC_PROC_PCTG_IOWAIT" },
1500     { 394, "DST_PROC_PCTG_IOWAIT" },
1501     { 395, "RTP_DTMF_TONES" },
1502     { 396, "UNTUNNELED_IPV6_SRC_ADDR" },
1503     { 397, "UNTUNNELED_IPV6_DST_ADDR" },
1504     { 398, "DNS_RESPONSE" },
1505     { 399, "DIAMETER_REQ_MSG_TYPE" },
1506     { 400, "DIAMETER_RSP_MSG_TYPE" },
1507     { 401, "DIAMETER_REQ_ORIGIN_HOST" },
1508     { 402, "DIAMETER_RSP_ORIGIN_HOST" },
1509     { 403, "DIAMETER_REQ_USER_NAME" },
1510     { 404, "DIAMETER_RSP_RESULT_CODE" },
1511     { 405, "DIAMETER_EXP_RES_VENDOR_ID" },
1512     { 406, "DIAMETER_EXP_RES_RESULT_CODE" },
1513     { 407, "S1AP_ENB_UE_S1AP_ID" },
1514     { 408, "S1AP_MME_UE_S1AP_ID" },
1515     { 409, "S1AP_MSG_EMM_TYPE_MME_TO_ENB" },
1516     { 410, "S1AP_MSG_ESM_TYPE_MME_TO_ENB" },
1517     { 411, "S1AP_MSG_EMM_TYPE_ENB_TO_MME" },
1518     { 412, "S1AP_MSG_ESM_TYPE_ENB_TO_MME" },
1519     { 413, "S1AP_CAUSE_ENB_TO_MME" },
1520     { 414, "S1AP_DETAILED_CAUSE_ENB_TO_MME" },
1521     { 415, "TCP_WIN_MIN_IN" },
1522     { 416, "TCP_WIN_MAX_IN" },
1523     { 417, "TCP_WIN_MSS_IN" },
1524     { 418, "TCP_WIN_SCALE_IN" },
1525     { 419, "TCP_WIN_MIN_OUT" },
1526     { 420, "TCP_WIN_MAX_OUT" },
1527     { 421, "TCP_WIN_MSS_OUT" },
1528     { 422, "TCP_WIN_SCALE_OUT" },
1529     { 423, "DHCP_REMOTE_ID" },
1530     { 424, "DHCP_SUBSCRIBER_ID" },
1531     { 425, "SRC_PROC_UID" },
1532     { 426, "DST_PROC_UID" },
1533     { 427, "APPLICATION_NAME" },
1534     { 428, "USER_NAME" },
1535     { 429, "DHCP_MESSAGE_TYPE" },
1536     { 430, "RTP_IN_PKT_DROP" },
1537     { 431, "RTP_OUT_PKT_DROP" },
1538     { 432, "RTP_OUT_MOS" },
1539     { 433, "RTP_OUT_R_FACTOR" },
1540     { 434, "RTP_MOS" },
1541     { 435, "GTPV2_S5_S8_GTPC_TEID" },
1542     { 436, "RTP_R_FACTOR" },
1543     { 437, "RTP_SSRC" },
1544     { 438, "PAYLOAD_HASH" },
1545     { 439, "GTPV2_C2S_S5_S8_GTPU_TEID" },
1546     { 440, "GTPV2_S2C_S5_S8_GTPU_TEID" },
1547     { 441, "GTPV2_C2S_S5_S8_GTPU_IP" },
1548     { 442, "GTPV2_S2C_S5_S8_GTPU_IP" },
1549     { 443, "SRC_AS_MAP" },
1550     { 444, "DST_AS_MAP" },
1551     { 445, "DIAMETER_HOP_BY_HOP_ID" },
1552     { 446, "UPSTREAM_SESSION_ID" },
1553     { 447, "DOWNSTREAM_SESSION_ID" },
1554     { 448, "SRC_IP_LONG" },
1555     { 449, "SRC_IP_LAT" },
1556     { 450, "DST_IP_LONG" },
1557     { 451, "DST_IP_LAT" },
1558     { 452, "DIAMETER_CLR_CANCEL_TYPE" },
1559     { 453, "DIAMETER_CLR_FLAGS" },
1560     { 454, "GTPV2_C2S_S5_S8_GTPC_IP" },
1561     { 455, "GTPV2_S2C_S5_S8_GTPC_IP" },
1562     { 456, "GTPV2_C2S_S5_S8_SGW_GTPU_TEID" },
1563     { 457, "GTPV2_S2C_S5_S8_SGW_GTPU_TEID" },
1564     { 458, "GTPV2_C2S_S5_S8_SGW_GTPU_IP" },
1565     { 459, "GTPV2_S2C_S5_S8_SGW_GTPU_IP" },
1566     { 460, "HTTP_X_FORWARDED_FOR" },
1567     { 461, "HTTP_VIA" },
1568     { 462, "SSDP_HOST" },
1569     { 463, "SSDP_USN" },
1570     { 464, "NETBIOS_QUERY_NAME" },
1571     { 465, "NETBIOS_QUERY_TYPE" },
1572     { 466, "NETBIOS_RESPONSE" },
1573     { 467, "NETBIOS_QUERY_OS" },
1574     { 468, "SSDP_SERVER" },
1575     { 469, "SSDP_TYPE" },
1576     { 470, "SSDP_METHOD" },
1577     { 471, "NPROBE_IPV4_ADDRESS" },
1578     { 0, NULL }
1579 };
1580 static value_string_ext v10_template_types_ntop_ext = VALUE_STRING_EXT_INIT(v10_template_types_ntop);
1581
1582 /* Ixia IxFlow */
1583 static const value_string v10_template_types_ixia[] = {
1584     {  110, "L7 Application ID" },
1585     {  111, "L7 Application Name" },
1586     {  120, "Source IP Country Code" },
1587     {  121, "Source IP Country Name" },
1588     {  122, "Source IP Region Code" },
1589     {  123, "Source IP Region Name" },
1590     {  125, "Source IP City Name" },
1591     {  126, "Source IP Latitude" },
1592     {  127, "Source IP Longitude" },
1593     {  140, "Destination IP Country Code" },
1594     {  141, "Destination IP Country Name" },
1595     {  142, "Destination IP Region Code" },
1596     {  143, "Destination IP Region Node" },
1597     {  145, "Destination IP City Name" },
1598     {  146, "Destination IP Latitude" },
1599     {  147, "Destination IP Longitude" },
1600     {  160, "OS Device ID" },
1601     {  161, "OS Device Name" },
1602     {  162, "Browser ID" },
1603     {  163, "Browser Name" },
1604     {  176, "Reverse Octet Delta Count" },
1605     {  177, "Reverse Packet Delta Count" },
1606     {  178, "Connection encryption type" },
1607     {  179, "Encryption Cipher Suite" },
1608     {  180, "Encryption Key Length" },
1609     {  181, "IMSI for 3/4G subscriber" },
1610     {  182, "HTTP Request User-Agent" },
1611     {  183, "Host Name" },
1612     {  184, "HTTP URI" },
1613     {  185, "DNS record TXT" },
1614     {  186, "Source AS Name" },
1615     {  187, "Destination AS Name" },
1616     {  188, "Transaction Latency (us)"},
1617     {  189, "DNS Query Names"},
1618     {  190, "DNS Answer Names"},
1619     {  191, "DNS Classes"},
1620     {  192, "Threat Type"},
1621     {  193, "Threat IPv4"},
1622     {  194, "Threat IPv6"},
1623     {  195, "HTTP Sessions"},
1624     {  196, "Request Time (s)"},
1625     {  197, "DNS Records"},
1626     {  198, "DNS Name"},
1627     {  199, "DNS Rdata IPv4"},
1628     {  200, "DNS Rdata IPv6"},
1629     {  201, "TLS SNI"},
1630     {  202, "DHCP Client Id"},
1631     {  203, "DHCP Client MAC"},
1632     {  204, "DHCP Events"},
1633     {  205, "DHCP Event Timestamp"},
1634     {  206, "DHCP Event Type"},
1635     {  207, "DHCP lease Duration"},
1636     {  208, "DHCP Servername"},
1637     {  209, "RADIUS Messages"},
1638     {  210, "RADIUS Message Rx Timestamp"},
1639     {  211, "RADIUS Event Timestamp"},
1640     {  212, "RADIUS Username"},
1641     {  213, "RADIUS NAS IPv4"},
1642     {  214, "RADIUS Service Type"},
1643     {  215, "RADIUS Framed Protocol"},
1644     {  216, "RADIUS Filter ID"},
1645     {  217, "RADIUS Reply Message"},
1646     {  218, "RADIUS Called Station ID"},
1647     {  219, "HTTP Connection"},
1648     {  220, "HTTP Accept"},
1649     {  221, "HTTP Accept-Language"},
1650     {  222, "HTTP Accept-Encoding"},
1651     {  223, "HTTP Reason"},
1652     {  224, "HTTP Server"},
1653     {  225, "RADIUS Calling Station ID"},
1654     {  226, "HTTP Content Length"},
1655     {  227, "HTTP Referer"},
1656     {  228, "HTTP UA-CPU"},
1657     {  229, "Email Messages"},
1658     {  230, "Email Msg ID"},
1659     {  231, "Email Msg Date"},
1660     {  232, "Email Msg Subject"},
1661     {  233, "Email Msg To"},
1662     {  234, "Email Msg From"},
1663     {  235, "Email Msg CC"},
1664     {  236, "Email Msg BCC"},
1665     {  237, "Email Msg Attachments"},
1666     {  238, "TLS Server Cert"},
1667     {  239, "TLS Server Cert Issuer"},
1668     {  240, "TLS Server Cert Issuer Attr"},
1669     {  241, "TLS Server Cert Issuer Value"},
1670     {  242, "TLS Server Cert Subject"},
1671     {  243, "TLS Server Cert Subject Attr"},
1672     {  244, "TLS Server Cert Subject Value"},
1673     {  245, "TLS Server Cert Valid Not Before"},
1674     {  246, "TLS Server Cert Valid Not After"},
1675     {  247, "TLS Server Cert Serial Number"},
1676     {  248, "TLS Server Cert Sign Algorithm"},
1677     {  249, "TLS Server Cert Subject PKI Algorithm"},
1678     {  250, "TLS Server Cert AltNames"},
1679     {  251, "TLS Server Cert AltNames Attr"},
1680     {  252, "TLS Server Cert AltNames Value"},
1681     {  253, "DNS Messages"},
1682     {  254, "DNS Transaction Id"},
1683     {  255, "DNS Msg Opcode"},
1684     {  256, "DNS Rec Request Type"},
1685     {  257, "DNS Msg Rcode"},
1686     {  258, "DNS Record TTL"},
1687     {  259, "DNS Raw Rdata"},
1688     {  260, "DNS Response Type"},
1689     {  261, "RADIUS Framed IP"},
1690     {  262, "DNS Msg QD Count"},
1691     {  263, "DNS Msg AN Count"},
1692     {  264, "DNS Msg NS Count"},
1693     {  265, "DNS Msg AR Count"},
1694     {  266, "DNS Msg Authoritative Answer"},
1695     {  267, "DNS Msg Truncation"},
1696     {  268, "DNS Msg Recursion Desired"},
1697     {  269, "DNS Msg Recursion Available"},
1698     {  270, "DNS Rdata Length"},
1699     {  271, "DNS Questions"},
1700     {  272, "DNS Query Type"},
1701     {  273, "DNS Query Name"},
1702     {  274, "DNS Section Type"},
1703     {  275, "DNS Msg QR Flag"},
1704     {  276, "DNS Cname"},
1705     {  277, "DNS Mail Exchange Domain"},
1706     {  278, "DHCP Agent Circuit ID"},
1707     {  279, "JA3 fingerprint string"},
1708     {  280, "TCP Connection Setup Time (us)"},
1709     {  281, "TCP Application Response Time (us)"},
1710     {  282, "TCP Count of Retransmitted Packets"},
1711     {  283, "Connection Average Round Trip Time (us)"},
1712     {  284, "UDP Average Response Time (us)"},
1713     {  285, "Time to complete a QUIC Handshake (us)"},
1714     {  286, "QUIC Network RTT (us)"},
1715     {  287, "QUIC RTT for Application Packets (us)"},
1716     {  288, "The Name of the Matched Filter"},
1717     {  289, "GTP IMSI"},
1718     {  290, "GTP ULI SAI LAC"},
1719     {  291, "GTP ULI RAI RAC"},
1720     {  292, "GTP ULI TAC"},
1721     {  293, "GTP ULI ECGI E NODEB ID"},
1722     {  294, "GTP ULI CELL ID"},
1723     {  295, "GTP ULI LAC"},
1724     {  296, "GTP ULI MCC"},
1725     {  297, "GTP ULI MNC"},
1726     {  298, "GTP MSISDN"},
1727     {  299, "GTP IMEI"},
1728     {  300, "GTP RAT Type"},
1729     {  301, "GTP Endpoint GSM Generation"},
1730     {  302, "GTP Uplink TEID"},
1731     {  303, "GTP Downlink TEID"},
1732     {  304, "GTP Uplink Tunnel IPv4 Address"},
1733     {  305, "GTP Downlink Tunnel IPv4 Address"},
1734     {  306, "GTP Uplink Tunnel IPv6 Address"},
1735     {  307, "GTP Downlink Tunnel IPv6 Address"},
1736     {  308, "GTP Uplink QCI/QFI"},
1737     {  309, "GTP Downlink QCI/QFI"},
1738     {  310, "GTP Uplink APN/DNN"},
1739     {  311, "GTP Downlink APN/DNN"},
1740     {  312, "GTP NSSAI SD"},
1741     {  313, "GTP NSSAI SST"},
1742     {  314, "GTP 5QI - UP"},
1743     {  315, "GTP 5QI - DOWN"},
1744     {  316, "STUN Response"},
1745     {  317, "STUN Reflexive Transport Address IPv6"},
1746     {  318, "STUN Reflexive Transport Address IPv4"},
1747     {  319, "STUN Reflexive Transport Address Port"},
1748     {  320, "HTTP Alternative Service"},
1749     {  321, "Unidirectional Flow"},
1750     {  322, "TLS Server Random"},
1751     {  323, "TLS Session ID"},
1752     {  324, "SIP To"},
1753     {  325, "SIP From"},
1754     {  326, "SIP Call ID"},
1755     {  327, "SIP Content Type"},
1756     {  328, "SIP Route"},
1757     {  329, "SIP Geolocation"},
1758     { 0, NULL }
1759 };
1760 static value_string_ext v10_template_types_ixia_ext = VALUE_STRING_EXT_INIT(v10_template_types_ixia);
1761
1762 /* Netscaler AppFlow */
1763 static const value_string v10_template_types_netscaler[] = {
1764     {  128, "Round Trip Time" },
1765     {  129, "Transaction Id" },
1766     {  130, "HTTP Request URL" },
1767     {  131, "HTTP Request Cookie" },
1768     {  132, "Flow Flags" },
1769     {  133, "Connection Id" },
1770     {  134, "Syslog Priority" },
1771     {  135, "Syslog Message" },
1772     {  136, "Syslog Timestamp" },
1773     {  140, "HTTP Request Referer" },
1774     {  141, "HTTP Request Method" },
1775     {  142, "HTTP Request Host" },
1776     {  143, "HTTP Request UserAgent" },
1777     {  144, "HTTP Response Status" },
1778     {  145, "HTTP Response Length" },
1779     {  146, "Server TTFB" },
1780     {  147, "Server TTLB" },
1781     {  150, "AppName Incarnation Number" },
1782     {  151, "AppName App Id" },
1783     {  152, "AppName" },
1784     {  153, "HTTP Request Received FB" },
1785     {  156, "HTTP Request Forwarded FB" },
1786     {  157, "HTTP Response Received FB" },
1787     {  158, "HTTP Response Forwarded FB" },
1788     {  159, "HTTP Request Received LB" },
1789     {  160, "HTTP Request Forwarded LB" },
1790     {  161, "Main Page Id" },
1791     {  162, "Main Page Core Id" },
1792     {  163, "HTTP Client Interaction Start Time" },
1793     {  164, "HTTP Client Render End Time" },
1794     {  165, "HTTP Client Render Start Time" },
1795     {  167, "App Template Name" },
1796     {  168, "HTTP Client Interaction End Time" },
1797     {  169, "HTTP Response Received LB" },
1798     {  170, "HTTP Response Forwarded LB" },
1799     {  171, "App Unit Name App Id" },
1800     {  172, "DB Login Flags" },
1801     {  173, "DB Request Type" },
1802     {  174, "DB Protocol Name" },
1803     {  175, "DB User Name" },
1804     {  176, "DB Database Name" },
1805     {  177, "DB Client Host Name" },
1806     {  178, "DB Request String" },
1807     {  179, "DB Response Status String" },
1808     {  180, "DB Response Status" },
1809     {  181, "DB Response Length" },
1810     {  182, "Client RTT" },
1811     {  183, "HTTP Content Type" },
1812     {  185, "HTTP Request Authorization" },
1813     {  186, "HTTP Request Via" },
1814     {  187, "HTTP Response Location" },
1815     {  188, "HTTP Response Set-Cookie" },
1816     {  189, "HTTP Response Set-Cookie2" },
1817     {  190, "HTTP Request X-Forwarded-For" },
1818     {  192, "Connection Chain ID" },
1819     {  193, "Connection Chain Hop Count" },
1820     {  200, "ICA Session Guid" },
1821     {  201, "ICA Client Version" },
1822     {  202, "ICA Client Type" },
1823     {  203, "ICA Client IP" },
1824     {  204, "ICA Client Host Name" },
1825     {  205, "AAA Username" },
1826     {  207, "ICA Domain Name" },
1827     {  208, "ICA Client Launcher" },
1828     {  209, "ICA Session Setup Time" },
1829     {  210, "ICA Server Name" },
1830     {  214, "ICA Session Reconnects" },
1831     {  215, "ICA RTT" },
1832     {  216, "ICA Clientside RX Bytes" },
1833     {  217, "ICA Clientside TX Bytes" },
1834     {  219, "ICA Clientside Packets Retransmit" },
1835     {  220, "ICA Serverside Packets Retransmit" },
1836     {  221, "ICA Clientside RTT" },
1837     {  222, "ICA Serverside RTT" },
1838     {  223, "ICA Session Update Begin Sec" },
1839     {  224, "ICA Session Update End Sec" },
1840     {  225, "ICA Channel Id1" },
1841     {  226, "ICA Channel Id1 Bytes" },
1842     {  227, "ICA Channel Id2" },
1843     {  228, "ICA Channel Id2 Bytes" },
1844     {  229, "ICA Channel Id3" },
1845     {  230, "ICA Channel Id3 Bytes" },
1846     {  231, "ICA Channel Id4" },
1847     {  232, "ICA Channel Id4 Bytes" },
1848     {  233, "ICA Channel Id5" },
1849     {  234, "ICA Channel Id5 Bytes" },
1850     {  235, "ICA Connection Priority" },
1851     {  236, "Application Startup Duration" },
1852     {  237, "ICA Launch Mechanism" },
1853     {  238, "ICA Application Name" },
1854     {  239, "Application Startup Time" },
1855     {  240, "ICA Application Termination Type" },
1856     {  241, "ICA Application Termination Time" },
1857     {  242, "ICA Session End Time" },
1858     {  243, "ICA Clientside Jitter" },
1859     {  244, "ICA Serverside Jitter" },
1860     {  245, "ICA App Process ID" },
1861     {  246, "ICA App Module Path" },
1862     {  247, "ICA Device Serial No" },
1863     {  248, "Msi Client Cookie" },
1864     {  249, "ICA Flags" },
1865     {  250, "ICA Username" },
1866     {  251, "License Type" },
1867     {  252, "Max License Count" },
1868     {  253, "Current License Consumed" },
1869     {  254, "ICA Network Update Start Time" },
1870     {  255, "ICA Network Update End Time" },
1871     {  256, "ICA Clientside SRTT" },
1872     {  257, "ICA Serverside SRTT" },
1873     {  258, "ICA Clientside Delay" },
1874     {  259, "ICA Serverside Delay" },
1875     {  260, "ICA Host Delay" },
1876     {  261, "ICA ClientSide WindowSize" },
1877     {  262, "ICA ServerSide WindowSize" },
1878     {  263, "ICA ClientSide RTO Count" },
1879     {  264, "ICA ServerSide RTO Count" },
1880     {  265, "ICA L7 Client Latency" },
1881     {  266, "ICA L7 Server Latency" },
1882     {  267, "HTTP Domain Name" },
1883     {  268, "CacheRedir Client Connection Core ID" },
1884     {  269, "CacheRedir Client Connection Transaction ID" },
1885     { 0, NULL }
1886 };
1887 static value_string_ext v10_template_types_netscaler_ext = VALUE_STRING_EXT_INIT(v10_template_types_netscaler);
1888
1889 static const value_string v10_template_types_gigamon[] = {
1890     { 1, "HttpReqUrl" },
1891     { 2, "HttpRspStatus" },
1892     { 101, "SslCertificateIssuerCommonName" },
1893     { 102, "SslCertificateSubjectCommonName" },
1894     { 103, "SslCertificateIssuer" },
1895     { 104, "SslCertificateSubject" },
1896     { 105, "SslCertificateValidNotBefore" },
1897     { 106, "SslCertificateValidNotAfter" },
1898     { 107, "SslCertificateSerialNumber" },
1899     { 108, "SslCertificateSignatureAlgorithm" },
1900     { 109, "SslCertificateSubjectPubAlgorithm" },
1901     { 110, "SslCertificateSubjectPubKeySize" },
1902     { 111, "SslCertificateSubjectAltName" },
1903     { 112, "SslServerNameIndication" },
1904     { 113, "SslServerVersion" },
1905     { 114, "SslServerCipher" },
1906     { 115, "SslServerCompressionMethod" },
1907     { 116, "SslServerSessionId" },
1908     { 201, "DnsIdentifier" },
1909     { 202, "DnsOpCode" },
1910     { 203, "DnsResponseCode" },
1911     { 204, "DnsQueryName" },
1912     { 205, "DnsResponseName" },
1913     { 206, "DnsResponseTTL" },
1914     { 207, "DnsResponseIPv4Address" },
1915     { 208, "DnsResponseIPv6Address" },
1916     { 209, "DnsBits" },
1917     { 210, "DnsQdCount" },
1918     { 211, "DnsAnCount" },
1919     { 212, "DnsNsCount" },
1920     { 213, "DnsArCount" },
1921     { 214, "DnsQueryType" },
1922     { 215, "DnsQueryClass" },
1923     { 216, "DnsResponseType" },
1924     { 217, "DnsResponseClass" },
1925     { 218, "DnsResponseRdLength" },
1926     { 219, "DnsResponseRdata" },
1927     { 220, "DnsAuthorityName" },
1928     { 221, "DnsAuthorityType" },
1929     { 222, "DnsAuthorityClass" },
1930     { 223, "DnsAuthorityTTL" },
1931     { 224, "DnsAuthorityRdLength" },
1932     { 225, "DnsAuthorityRdata" },
1933     { 226, "DnsAdditionalName" },
1934     { 227, "DnsAdditionalType" },
1935     { 228, "DnsAdditionalClass" },
1936     { 229, "DnsAdditionalTTL" },
1937     { 230, "DnsAdditionalRdLength" },
1938     { 231, "DnsAdditionalRdata" },
1939     { 0, NULL }
1940 };
1941 static value_string_ext v10_template_types_gigamon_ext = VALUE_STRING_EXT_INIT(v10_template_types_gigamon);
1942
1943 /* Barracuda NGFirewall IPFIX */
1944 static const value_string v10_template_types_barracuda[] = {
1945     {  1, "Timestamp" },
1946     {  2, "LogOp" },
1947     {  3, "TrafficType" },
1948     {  4, "FW Rule" },
1949     {  5, "ServiceName" },
1950     {  6, "Reason" },
1951     {  7, "ReasonText" },
1952     {  8, "BindIPv4Address" },
1953     {  9, "BindTransportPort" },
1954     {  10, "ConnIPv4Address" },
1955     {  11, "ConnTransportPort" },
1956     {  12, "AuditCounter" },
1957     { 0, NULL }
1958 };
1959 static value_string_ext v10_template_types_barracuda_ext = VALUE_STRING_EXT_INIT(v10_template_types_barracuda);
1960
1961 /* Cisco IPFIX */
1962 static const value_string v10_template_types_cisco[] = {
1963     {  4251, "Transport packets lost counter" },
1964     {  4254, "Transport RTP SSRC" },
1965     {  4257, "Transport RTP jitter maximum" },
1966     {  4273, "Transport RTP payload type" },
1967     {  4325, "Transport RTP jitter mean sum" },
1968     {  8233, "C3PL class cce-id" },
1969     {  8234, "C3PL class name" },
1970     {  8235, "C3PL class type" },
1971     {  8236, "C3PL policy cce-id" },
1972     {  8237, "C3PL policy name" },
1973     {  8238, "C3PL policy type" },
1974     {  9252, "Services WAAS segment" },
1975     {  9253, "Services WAAS passthrough reason" },
1976     {  9268, "Connection client counter packets retransmitted" },
1977     {  9272, "Connection transaction counter complete" },
1978     {  9273, "Connection transaction duration sum" },
1979     {  9292, "Connection server counter responses" },
1980     {  9300, "Connection delay response to-server histogram late" },
1981     {  9303, "Connection delay response to-server sum" },
1982     {  9306, "Connection delay application sum" },
1983     {  9307, "Connection delay application max" },
1984     {  9309, "Connection delay response client-to-server sum" },
1985     {  9313, "Connection delay network client-to-server sum" },
1986     {  9316, "Connection delay network to-client sum" },
1987     {  9319, "Connection delay network to-server sum" },
1988     {  9357, "Application HTTP URI statistics" },
1989     { 12232, "Application category name" },
1990     { 12233, "Application sub category name" },
1991     { 12234, "Application group name" },
1992     { 12235, "Application HTTP host" },
1993     { 12236, "Connection client IPv4 address" },
1994     { 12237, "Connection server IPv4 address" },
1995     { 12240, "Connection client transport port" },
1996     { 12241, "Connection server transport port" },
1997     { 12242, "Connection id" },
1998     { 12243, "Application traffic class" },
1999     { 12244, "Application business relevance" },
2000     { 0, NULL }
2001 };
2002 static value_string_ext v10_template_types_cisco_ext = VALUE_STRING_EXT_INIT(v10_template_types_cisco);
2003
2004 static const value_string v10_template_types_niagara_networks[] = {
2005     { 100, "SslServerNameIndication" },
2006     { 101, "SslServerVersion" },
2007     { 102, "SslServerVersionText" },
2008     { 103, "SslServerCipher" },
2009     { 104, "SslServerCipherText" },
2010     { 105, "SslConnectionEncryptionType" },
2011     { 106, "SslServerCompressionMethod" },
2012     { 107, "SslServerSessionId" },
2013     { 108, "SslCertificateIssuer" },
2014     { 109, "SslCertificateIssuerName" },
2015     { 110, "SslCertificateSubject" },
2016     { 111, "SslCertificateSubjectName" },
2017     { 112, "SslCertificateValidNotBefore" },
2018     { 113, "SslCertificateValidNotAfter" },
2019     { 114, "SslCertificateSerialNumber" },
2020     { 115, "SslCertificateSignatureAlgorithm" },
2021     { 116, "SslCertificateSignatureAlgorithmText" },
2022     { 117, "SslCertificateSubjectPublicKeySize" },
2023     { 118, "SslCertificateSubjectPublicAlgorithm" },
2024     { 119, "SslCertificateSubjectPublicAlgorithmText" },
2025     { 120, "SslCertificateSubjectAlgorithmText" },
2026     { 121, "SslCertificateSubjectAlternativeName" },
2027     { 122, "SslCertificateSha1" },
2028     { 200, "DnsIdentifier" },
2029     { 201, "DnsOpCode" },
2030     { 202, "DnsResponseCode" },
2031     { 203, "DnsQueryName" },
2032     { 204, "DnsResponseName" },
2033     { 205, "DnsResponseTTL" },
2034     { 206, "DnsResponseIPv4Addr" },
2035     { 207, "DnsResponseIPv4AddrText" },
2036     { 208, "DnsResponseIPv6Addr" },
2037     { 209, "DnsResponseIPv6AddrText" },
2038     { 210, "DnsBits" },
2039     { 211, "DnsQDCount" },
2040     { 212, "DnsANCount" },
2041     { 213, "DnsNSCount" },
2042     { 214, "DnsARCount" },
2043     { 215, "DnsQueryType" },
2044     { 216, "DnsQueryTypeText" },
2045     { 217, "DnsQueryClass" },
2046     { 218, "DnsQueryClassText" },
2047     { 219, "DnsResponseType" },
2048     { 220, "DnsResponseTypeText" },
2049     { 221, "DnsResponseClass" },
2050     { 222, "DnsResponseClassText" },
2051     { 223, "DnsResponseRDLength" },
2052     { 224, "DnsResponseRData" },
2053     { 225, "DnsAuthorityName" },
2054     { 226, "DnsAuthorityType" },
2055     { 227, "DnsAuthorityTypeText" },
2056     { 228, "DnsAuthorityClass" },
2057     { 229, "DnsAuthorityClassText" },
2058     { 230, "DnsAuthorityTTL" },
2059     { 231, "DnsAuthorityRDLength" },
2060     { 232, "DnsAuthorityRData" },
2061     { 233, "DnsAdditionalName" },
2062     { 234, "DnsAdditionalType" },
2063     { 235, "DnsAdditionalTypeText" },
2064     { 236, "DnsAdditionalClass" },
2065     { 237, "DnsAdditionalClassText" },
2066     { 238, "DnsAdditionalTTL" },
2067     { 239, "DnsAdditionalRDLength" },
2068     { 240, "DnsAdditionalRData" },
2069     { 300, "RadiusPacketTypeCode" },
2070     { 301, "RadiusPacketTypeCodeText" },
2071     { 302, "RadiusPacketIdentifier" },
2072     { 303, "RadiusAuthenticator" },
2073     { 304, "RadiusUserName" },
2074     { 305, "RadiusCallingStationId" },
2075     { 306, "RadiusCalledStationId" },
2076     { 307, "RadiusNasIpAddress" },
2077     { 308, "RadiusNasIpv6Address" },
2078     { 309, "RadiusNasIdentifier" },
2079     { 310, "RadiusFramedIpAddress" },
2080     { 311, "RadiusFramedIpv6Address" },
2081     { 312, "RadiusAcctSessionId" },
2082     { 313, "RadiusAcctStatusType" },
2083     { 314, "RadiusAcctInOctets" },
2084     { 315, "RadiusAcctOutOctets" },
2085     { 316, "RadiusAcctInPackets" },
2086     { 317, "RadiusAcctOutPackets" },
2087     { 318, "RadiusVsaVendorId" },
2088     { 319, "RadiusVsaName" },
2089     { 320, "RadiusVsaId" },
2090     { 321, "RadiusVsaValue" },
2091     { 0, NULL }
2092 };
2093 static value_string_ext v10_template_types_niagara_networks_ext = VALUE_STRING_EXT_INIT(v10_template_types_niagara_networks);
2094
2095 static const value_string v10_barracuda_logop[] = {
2096     { 0, "Unknown" },
2097     { 1, "Allow" },
2098     { 2, "LocalAllow" },
2099     { 3, "Block" },
2100     { 4, "LocalBlock" },
2101     { 5, "Remove" },
2102     { 6, "LocalRemove" },
2103     { 7, "Drop" },
2104     { 8, "Terminate" },
2105     { 9, "LocalTerminate" },
2106     { 10, "Change" },
2107     { 11, "Operation" },
2108     { 12, "Startup" },
2109     { 13, "Configuration" },
2110     { 14, "Rule" },
2111     { 15, "State" },
2112     { 16, "LocalState" },
2113     { 17, "Process" },
2114     { 18, "AdminAction" },
2115     { 19, "Deny" },
2116     { 20, "LocalDeny" },
2117     { 21, "SecurityEvent" },
2118     { 22, "Sync" },
2119     { 23, "Fail" },
2120     { 24, "LocalFail" },
2121     { 25, "ARP" },
2122     { 26, "Detect" },
2123     { 27, "LocalDetect" },
2124     { 28, "IntermediateReport" },
2125     { 0, NULL }
2126 };
2127
2128 static const value_string v10_barracuda_traffictype[] = {
2129     { 0, "Forwarding" },
2130     { 1, "Local In" },
2131     { 2, "Local Out" },
2132     { 3, "Loopback" },
2133     { 0, NULL }
2134 };
2135
2136 static const value_string v10_cisco_waas_segment[] = {
2137     {  0, "Unknown" },
2138     {  1, "Client Unoptimized" },
2139     {  2, "Server Optimized" },
2140     {  4, "Client Optimized" },
2141     {  8, "Server Unoptimized" },
2142     { 16, "Pass-Through" },
2143     {  0, NULL }
2144 };
2145
2146 static const value_string v10_cisco_waas_passthrough_reason[] = {
2147     {  0, "Unknown" },
2148     {  1, "PT_NO_PEER" },
2149     {  2, "PT_RJCT_CAP" },
2150     {  3, "PT_RJCT_RSRCS" },
2151     {  4, "PT_RJCT_NO_LICENSE" },
2152     {  5, "PT_APP_CONFIG" },
2153     {  6, "PT_GLB_CONFIG" },
2154     {  7, "PT_ASYMMETRIC" },
2155     {  8, "PT_IN_PROGRESS" },
2156     {  9, "PT_INTERMEDIATE" },
2157     { 10, "PT_OVERLOAD" },
2158     { 11, "PT_INT_ERROR" },
2159     { 12, "PT_APP_OVERRIDE" },
2160     { 13, "PT_SVR_BLACKLIST" },
2161     { 14, "PT_AD_VER_MISMTCH" },
2162     { 15, "PT_AD_AO_INCOMPAT" },
2163     { 16, "PT_AD_AOIM_PROGRESS" },
2164     { 17, "PT_DIRM_VER_MISMTCH" },
2165     { 18, "PT_PEER_OVERRIDE" },
2166     { 19, "PT_AD_OPT_PARSE_FAIL" },
2167     { 20, "PT_AD_PT_SERIAL_MODE" },
2168     { 21, "PT_SN_INTERCEPTION_ACL" },
2169     { 22, "PT_IP_FRAG_UNSUPP_PEER" },
2170     { 23, "PT_CLUSTER_MEMBER_INDX" },
2171     { 24, "PT_FLOW_QUERY_FAIL_INDX" },
2172     { 25, "PT_FLOWSW_INT_ACL_DENY_INX" },
2173     { 26, "PT_UNKNOWN_INDX" },
2174     { 27, "PT_FLOWSW_PLCY_INDX" },
2175     { 28, "PT_SNG_OVERLOAD_INDX" },
2176     { 29, "PT_CLUSTER_DEGRADE_INDX" },
2177     { 30, "PT_FLOW_LEARN_FAIL_INDX" },
2178     { 31, "PT_OVERALL_INDX" },
2179     { 32, "PT_ZBFW" },
2180     { 33, "PT_RTSP_ALG" },
2181     {  0, NULL }
2182 };
2183
2184 static const value_string v10_template_types_fastip[] = {
2185     { 0, "METER_VERSION"},
2186     { 1, "METER_OS_SYSNAME"},
2187     { 2, "METER_OS_NODENAME"},
2188     { 3, "METER_OS_RELEASE"},
2189     { 4, "METER_OS_VERSION"},
2190     { 5, "METER_OS_MACHINE"},
2191     { 6, "TCP_FLAGS"},
2192     { 13, "EPOCH_SECOND"},
2193     { 14, "NIC_NAME"},
2194     { 15, "NIC_ID"},
2195     { 16, "NIC_MAC"},
2196     { 17, "NIC_IP"},
2197     { 18, "COLLISIONS"},
2198     { 19, "ERRORS"},
2199     { 20, "NIC_DRIVER_NAME"},
2200     { 21, "NIC_DRIVER_VERSION"},
2201     { 22, "NIC_FIRMWARE_VERSION"},
2202     { 23, "METER_OS_DISTRIBUTION_NAME"},
2203     { 24, "BOND_INTERFACE_MODE"},
2204     { 25, "BOND_INTERFACE_PHYSICAL_NIC_COUNT"},
2205     { 26, "BOND_INTERFACE_ID"},
2206     { 200, "TCP_HANDSHAKE_RTT_USEC"},
2207     { 201, "APP_RTT_USEC"},
2208     { 0, NULL }
2209 };
2210 static value_string_ext v10_template_types_fastip_ext = VALUE_STRING_EXT_INIT(v10_template_types_fastip);
2211
2212 static const value_string v10_template_types_juniper[] = {
2213     {137, "OBSERVATION_DOMAIN_LEVEL_JUNIPER_COMMON_PROPERTIES"},
2214     {0, NULL}
2215 };
2216 static value_string_ext v10_template_types_juniper_ext = VALUE_STRING_EXT_INIT(v10_template_types_juniper);
2217
2218 static const value_string v10_juniper_cpid[] = {
2219     {1, "Forwarding Class and Drop Priority"},
2220     {2, "Forwarding Exception Details"},
2221     {3, "Forwarding Nexthop Details"},
2222     {4, "Egress Interface Details"},
2223     {5, "Ingress Underlying Interface Details"},
2224     {6, "Ingress Interface Details"},
2225     {0, NULL}
2226 };
2227 static value_string_ext v10_juniper_cpid_ext = VALUE_STRING_EXT_INIT(v10_juniper_cpid);
2228
2229 static const value_string v9_scope_field_types[] = {
2230     { 1, "System" },
2231     { 2, "Interface" },
2232     { 3, "Line Card" },
2233     { 4, "NetFlow Cache" },
2234     { 5, "Template" },
2235     { 0, NULL }
2236 };
2237 static value_string_ext v9_scope_field_types_ext = VALUE_STRING_EXT_INIT(v9_scope_field_types);
2238
2239 static const value_string v9_sampler_mode[] = {
2240     { 0, "Deterministic" },
2241     { 1, "Unknown" },  /* "Time-Based" ?? */
2242     { 2, "Random" },
2243     { 0, NULL }
2244 };
2245
2246 static const value_string v9_direction[] = {
2247     { 0, "Ingress" },
2248     { 1, "Egress" },
2249     { 0, NULL }
2250 };
2251
2252 static const value_string v10_ixia_dns_section_type[] = {
2253     {0, "Answer"},
2254     {1, "Authoritative NS"},
2255     {2, "Additional"},
2256     {0, NULL}
2257 };
2258
2259 static const value_string v10_ixia_req_res_flag[] = {
2260     {0, "Request"},
2261     {1, "Response"},
2262     {0, NULL}
2263 };
2264
2265 #define FORWARDING_STATUS_UNKNOWN 0
2266 #define FORWARDING_STATUS_FORWARD 1
2267 #define FORWARDING_STATUS_DROP    2
2268 #define FORWARDING_STATUS_CONSUME 3
2269
2270 static const value_string v9_forwarding_status[] = {
2271     { FORWARDING_STATUS_UNKNOWN, "Unknown"},  /* Observed on IOS-XR 3.2 */
2272     { FORWARDING_STATUS_FORWARD, "Forward"},  /* Observed on 7200 12.4(9)T */
2273     { FORWARDING_STATUS_DROP,    "Drop"},     /* Observed on 7200 12.4(9)T */
2274     { FORWARDING_STATUS_CONSUME, "Consume"},  /* Observed on 7200 12.4(9)T */
2275     { 0, NULL }
2276 };
2277
2278 static const value_string v9_forwarding_status_unknown_code[] = {
2279     {   0, NULL }
2280 };
2281
2282 static const value_string v9_forwarding_status_forward_code[] = {
2283     {   0, "Forwarded (Unknown)" },
2284     {   1, "Forwarded Fragmented" },
2285     {   2, "Forwarded not Fragmented" },
2286     {   0, NULL }
2287 };
2288
2289 static const value_string v9_forwarding_status_drop_code[] = {
2290     {   0, "Dropped (Unknown)" },
2291     {   1, "Drop ACL Deny" },
2292     {   2, "Drop ACL drop" },
2293     {   3, "Drop Unroutable" },
2294     {   4, "Drop Adjacency" },
2295     {   5, "Drop Fragmentation & DF set" },
2296     {   6, "Drop Bad header checksum" },
2297     {   7, "Drop Bad total Length" },
2298     {   8, "Drop Bad Header Length" },
2299     {   9, "Drop bad TTL" },
2300     {  10, "Drop Policer" },
2301     {  11, "Drop WRED" },
2302     {  12, "Drop RPF" },
2303     {  13, "Drop For us" },
2304     {  14, "Drop Bad output interface" },
2305     {  15, "Drop Hardware" },
2306     {   0, NULL }
2307 };
2308
2309 static const value_string v9_forwarding_status_consume_code[] = {
2310     {   0, "Consumed (Unknown)" },
2311     {   1, "Terminate Punt Adjacency" },
2312     {   2, "Terminate Incomplete Adjacency" },
2313     {   3, "Terminate For us" },
2314     {   0, NULL }
2315 };
2316
2317 static const value_string v9_firewall_event[] = {
2318     { 0, "Default (ignore)"},
2319     { 1, "Flow created"},
2320     { 2, "Flow deleted"},
2321     { 3, "Flow denied"},
2322     { 4, "Flow alert"},
2323     { 0, NULL }
2324 };
2325
2326 static const value_string v9_extended_firewall_event[] = {
2327     {    0, "ignore"},
2328     { 1001, "Flow denied by an ingress ACL"},
2329     { 1002, "Flow denied by an egress ACL"},
2330     { 1003, "Flow denied by security appliance"},
2331     { 1004, "Flow denied (TCP flow beginning with not TCP SYN)"},
2332     { 0, NULL }
2333 };
2334
2335 static const value_string engine_type[] = {
2336     { 0, "RP"},
2337     { 1, "VIP/Linecard"},
2338     { 2, "PFC/DFC" },
2339     { 0, NULL }
2340 };
2341
2342 static const value_string v9_flow_end_reason[] = {
2343     { 0, "Unknown"},
2344     { 1, "Idle timeout"},
2345     { 2, "Active timeout" },
2346     { 3, "End of Flow detected" },
2347     { 4, "Forced end" },
2348     { 5, "Lack of resources" },
2349     { 0, NULL }
2350 };
2351
2352 static const value_string v9_biflow_direction[] = {
2353     { 0, "Arbitrary"},
2354     { 1, "Initiator"},
2355     { 2, "ReverseInitiator" },
2356     { 3, "Perimeter" },
2357     { 0, NULL }
2358 };
2359
2360 static const value_string selector_algorithm[] = {
2361     { 0, "Reserved"},
2362     { 1, "Systematic count-based Sampling"},
2363     { 2, "Systematic time-based Sampling"},
2364     { 3, "Random n-out-of-N Sampling"},
2365     { 4, "Uniform probabilistic Sampling"},
2366     { 5, "Property match Filtering"},
2367     { 6, "Hash based Filtering using BOB"},
2368     { 7, "Hash based Filtering using IPSX"},
2369     { 8, "Hash based Filtering using CRC"},
2370     { 0, NULL }
2371 };
2372 static value_string_ext selector_algorithm_ext = VALUE_STRING_EXT_INIT(selector_algorithm);
2373
2374 static const value_string performance_monitor_specials[] = {
2375     { 0xFFFFFFFF, "Not Measured"},
2376     { 0xFFFF, "Not Measured"},
2377     { 0xFF, "Not Measured"},
2378     { 0, NULL }
2379 };
2380
2381 static const true_false_string mpls_bos_tfs = {
2382     "Bottom-of-Stack",
2383     ""
2384 };
2385
2386 static const value_string cflow_unknown_value[] = {
2387     { 0, "Unknown" },
2388     { 0, NULL }
2389 };
2390
2391 /* https://www.iana.org/assignments/ipfix/ipfix.xhtml#classification-engine-ids */
2392
2393 static const value_string classification_engine_types[] = {
2394     { 0, "invalid" },
2395     { 1, "IANA-L3" },
2396     { 2, "PANA-L3" },
2397     { 3, "IANA-L4" },
2398     { 4, "PANA-L4" },
2399     { 6, "USER-Defined" },
2400     { 12, "PANA-L2" },
2401     { 13, "PANA-L7" },
2402     { 18, "ETHERTYPE" },
2403     { 19, "LLC" },
2404     { 20, "PANA-L7-PEN" },
2405     { 21, "Qosmos ixEngine" },
2406     { 22, "ntop nDPI" },
2407     { 0, NULL }
2408 };
2409 /*
2410  * wireshark tree identifiers
2411  */
2412
2413 static int      proto_netflow;
2414
2415 static int      ett_netflow;
2416 static int      ett_unixtime;
2417 static int      ett_flow;
2418 static int      ett_flowtime;
2419 static int      ett_str_len;
2420 static int      ett_template;
2421 static int      ett_field;
2422 static int      ett_dataflowset;
2423 static int      ett_fwdstat;
2424 static int      ett_mpls_label;
2425 static int      ett_tcpflags;
2426 static int      ett_subtemplate_list;
2427 static int      ett_resiliency;
2428 static int      ett_data_link_frame_sec;
2429 static int      ett_srhflagsipv6;
2430 static int      ett_gtpflags;
2431
2432 /*
2433  * cflow header
2434  */
2435
2436 static int      hf_cflow_version;
2437 static int      hf_cflow_count;
2438 static int      hf_cflow_len;
2439 static int      hf_cflow_sysuptime;
2440 static int      hf_cflow_exporttime;
2441 static int      hf_cflow_unix_secs;
2442 static int      hf_cflow_unix_nsecs;
2443 static int      hf_cflow_timestamp;
2444 static int      hf_cflow_samplingmode;
2445 static int      hf_cflow_samplerate;
2446
2447 static int      hf_cflow_unknown_field_type;
2448 static int      hf_cflow_padding;
2449 static int      hf_cflow_reserved;
2450 static int      hf_cflow_extra_packets;
2451
2452 /*
2453  * cflow version specific info
2454  */
2455 static int      hf_cflow_sequence;
2456 static int      hf_cflow_engine_type;
2457 static int      hf_cflow_engine_id;
2458 static int      hf_cflow_source_id;
2459
2460 static int      hf_cflow_aggmethod;
2461 static int      hf_cflow_aggversion;
2462
2463 /* Version 9 */
2464
2465 static int      hf_cflow_flowset_id;
2466 static int      hf_cflow_flowset_length;
2467 static int      hf_cflow_template_id;
2468 static int      hf_cflow_template_field_count;
2469 static int      hf_cflow_template_field_type;
2470 static int      hf_cflow_template_field_length;
2471 static int      hf_cflow_option_scope_length;
2472 static int      hf_cflow_option_length;
2473 static int      hf_cflow_template_scope_field_type;
2474
2475 static int      hf_cflow_scope_system;
2476 static int      hf_cflow_scope_interface;
2477 static int      hf_cflow_scope_linecard;
2478 static int      hf_cflow_scope_cache;
2479 static int      hf_cflow_scope_template;
2480
2481 /* IPFIX */
2482 static int      hf_cflow_template_ipfix_total_field_count;
2483 static int      hf_cflow_template_ipfix_scope_field_count;
2484 static int      hf_cflow_template_ipfix_pen_provided;
2485 static int      hf_cflow_template_ipfix_field_type;
2486 static int      hf_cflow_template_ipfix_field_type_enterprise;
2487 static int      hf_cflow_template_ipfix_field_pen;
2488 static int      hf_cflow_subtemplate_id;
2489 static int      hf_cflow_subtemplate_semantic;
2490
2491 /* IPFIX / vendor */
2492 static int      hf_cflow_template_plixer_field_type;
2493 static int      hf_cflow_template_ntop_field_type;
2494 static int      hf_cflow_template_ixia_field_type;
2495 static int      hf_cflow_template_netscaler_field_type;
2496 static int      hf_cflow_template_barracuda_field_type;
2497 static int      hf_cflow_template_gigamon_field_type;
2498 static int      hf_cflow_template_cisco_field_type;
2499 static int      hf_cflow_template_niagara_networks_field_type;
2500 static int      hf_cflow_template_fastip_field_type;
2501 static int      hf_cflow_template_juniper_field_type;
2502
2503
2504 /*
2505  * pdu storage
2506  */
2507 static int      hf_cflow_srcaddr;
2508 static int      hf_cflow_srcaddr_v6;
2509 static int      hf_cflow_srcnet;
2510 static int      hf_cflow_dstaddr;
2511 static int      hf_cflow_dstaddr_v6;
2512 static int      hf_cflow_dstnet;
2513 static int      hf_cflow_nexthop;
2514 static int      hf_cflow_nexthop_v6;
2515 static int      hf_cflow_bgpnexthop;
2516 static int      hf_cflow_bgpnexthop_v6;
2517 static int      hf_cflow_inputint;
2518 static int      hf_cflow_outputint;
2519 static int      hf_cflow_flows;
2520 static int      hf_cflow_packets;
2521 static int      hf_cflow_octets;
2522 static int      hf_cflow_length_min;
2523 static int      hf_cflow_length_max;
2524 static int      hf_cflow_timedelta;
2525 static int      hf_cflow_sys_init_time;
2526 static int      hf_cflow_timestart;
2527 static int      hf_cflow_timeend;
2528 static int      hf_cflow_srcport;
2529 static int      hf_cflow_dstport;
2530 static int      hf_cflow_prot;
2531 static int      hf_cflow_tos;
2532 static int      hf_cflow_marked_tos;
2533 static int      hf_cflow_flags;
2534 static int      hf_cflow_tcpflags;
2535 static int      hf_cflow_tcpflags16;
2536 static int      hf_cflow_tcpflags_fin;
2537 static int      hf_cflow_tcpflags_syn;
2538 static int      hf_cflow_tcpflags_rst;
2539 static int      hf_cflow_tcpflags_psh;
2540 static int      hf_cflow_tcpflags_ack;
2541 static int      hf_cflow_tcpflags_urg;
2542 static int      hf_cflow_tcpflags_ece;
2543 static int      hf_cflow_tcpflags_cwr;
2544 static int      hf_cflow_tcpflags16_fin;
2545 static int      hf_cflow_tcpflags16_syn;
2546 static int      hf_cflow_tcpflags16_rst;
2547 static int      hf_cflow_tcpflags16_psh;
2548 static int      hf_cflow_tcpflags16_ack;
2549 static int      hf_cflow_tcpflags16_urg;
2550 static int      hf_cflow_tcpflags16_ece;
2551 static int      hf_cflow_tcpflags16_cwr;
2552 static int      hf_cflow_tcpflags16_ns;
2553 static int      hf_cflow_tcpflags_reserved;
2554 static int      hf_cflow_tcpflags16_reserved;
2555 static int      hf_cflow_tcpflags16_zero;
2556 static int      hf_cflow_dstas;
2557 static int      hf_cflow_srcas;
2558 static int      hf_cflow_dstmask;
2559 static int      hf_cflow_dstmask_v6;
2560 static int      hf_cflow_srcmask;
2561 static int      hf_cflow_srcmask_v6;
2562 static int      hf_cflow_routersc;
2563 static int      hf_cflow_mulpackets;
2564 static int      hf_cflow_muloctets;
2565 static int      hf_cflow_octets_exp;
2566 static int      hf_cflow_packets_exp;
2567 static int      hf_cflow_flows_exp;
2568 static int      hf_cflow_ipv4_router_sc;
2569 static int      hf_cflow_srcprefix;
2570 static int      hf_cflow_dstprefix;
2571 static int      hf_cflow_flow_class;
2572 static int      hf_cflow_ttl_minimum;
2573 static int      hf_cflow_ttl_maximum;
2574 static int      hf_cflow_frag_id;
2575 static int      hf_cflow_ip_version;
2576 static int      hf_cflow_icmp_type_code_ipv4;
2577 static int      hf_cflow_igmp_type;
2578 static int      hf_cflow_sampling_interval;
2579 static int      hf_cflow_sampling_algorithm;
2580 static int      hf_cflow_flow_active_timeout;
2581 static int      hf_cflow_flow_inactive_timeout;
2582 static int      hf_cflow_mpls_top_label_type;
2583 static int      hf_cflow_mpls_pe_addr;
2584 static int      hf_cflow_sampler_id;
2585 static int      hf_cflow_sampler_mode;
2586 static int      hf_cflow_sampler_random_interval;
2587 static int      hf_cflow_direction;
2588 static int      hf_cflow_if_name;
2589 static int      hf_cflow_if_descr;
2590 static int      hf_cflow_sampler_name;
2591 static int      hf_cflow_forwarding_status;
2592 static int      hf_cflow_forwarding_status_unknown_code;
2593 static int      hf_cflow_forwarding_status_forward_code;
2594 static int      hf_cflow_forwarding_status_consume_code;
2595 static int      hf_cflow_forwarding_status_drop_code;
2596 static int      hf_cflow_nbar_appl_desc;
2597 static int      hf_cflow_nbar_appl_id_class_eng_id;
2598 static int      hf_cflow_nbar_appl_id_selector_id;
2599 static int      hf_cflow_nbar_appl_name;
2600 static int      hf_cflow_peer_srcas;
2601 static int      hf_cflow_peer_dstas;
2602 static int      hf_cflow_flow_exporter;
2603 static int      hf_cflow_icmp_ipv4_type;
2604 static int      hf_cflow_icmp_ipv4_code;
2605 static int      hf_cflow_icmp_ipv6_type;
2606 static int      hf_cflow_icmp_ipv6_code;
2607 static int      hf_cflow_tcp_window_size;
2608 static int      hf_cflow_ipv4_total_length;
2609 static int      hf_cflow_ip_ttl;
2610 static int      hf_cflow_mpls_payload_length;
2611 static int      hf_cflow_ip_dscp;
2612 static int      hf_cflow_delta_octets_squared;
2613 static int      hf_cflow_total_octets_squared;
2614 static int      hf_cflow_udp_length;
2615 static int      hf_cflow_is_multicast;
2616 static int      hf_cflow_ip_header_words;
2617 static int      hf_cflow_option_map;
2618 static int      hf_cflow_section_header;
2619 static int      hf_cflow_section_payload;
2620 /* IPFIX (version 10) Information Elements */
2621 static int      hf_cflow_post_octets;
2622 static int      hf_cflow_post_packets;
2623 static int      hf_cflow_ipv6_flowlabel;
2624 static int      hf_cflow_post_tos;
2625 static int      hf_cflow_srcmac;
2626 static int      hf_cflow_post_dstmac;
2627 static int      hf_cflow_vlanid;
2628 static int      hf_cflow_post_vlanid;
2629 static int      hf_cflow_ipv6_exthdr;
2630 static int      hf_cflow_dstmac;
2631 static int      hf_cflow_post_srcmac;
2632 static int      hf_cflow_permanent_packets;
2633 static int      hf_cflow_permanent_octets;
2634 static int      hf_cflow_fragment_offset;
2635 static int      hf_cflow_mpls_vpn_rd;
2636 static int      hf_cflow_mpls_top_label_prefix_length; /* ID:  91 */
2637 static int      hf_cflow_src_traffic_index; /* ID:  92 */
2638 static int      hf_cflow_dst_traffic_index; /* ID:  93 */
2639 static int      hf_cflow_post_ip_diff_serv_code_point; /* ID:  98 */
2640 static int      hf_cflow_multicast_replication_factor; /* ID:  99 */
2641 static int      hf_cflow_classification_engine_id; /* ID: 101 */
2642 static int      hf_cflow_exporter_addr;
2643 static int      hf_cflow_exporter_addr_v6;
2644 static int      hf_cflow_drop_octets;
2645 static int      hf_cflow_drop_packets;
2646 static int      hf_cflow_drop_total_octets;
2647 static int      hf_cflow_drop_total_packets;
2648 static int      hf_cflow_flow_end_reason;
2649 static int      hf_cflow_common_properties_id;
2650 static int      hf_cflow_observation_point_id;
2651 static int      hf_cflow_mpls_pe_addr_v6;
2652 static int      hf_cflow_port_id;
2653 static int      hf_cflow_mp_id;
2654 static int      hf_cflow_wlan_channel_id;
2655 static int      hf_cflow_wlan_ssid;
2656 static int      hf_cflow_flow_id;
2657 static int      hf_cflow_od_id;
2658 static int      hf_cflow_abstimestart;
2659 static int      hf_cflow_abstimeend;
2660 static int      hf_cflow_dstnet_v6;
2661 static int      hf_cflow_srcnet_v6;
2662 static int      hf_cflow_ignore_packets;
2663 static int      hf_cflow_ignore_octets;
2664 static int      hf_cflow_notsent_flows;
2665 static int      hf_cflow_notsent_packets;
2666 static int      hf_cflow_notsent_octets;
2667 static int      hf_cflow_post_total_octets;
2668 static int      hf_cflow_post_total_packets;
2669 static int      hf_cflow_key;
2670 static int      hf_cflow_post_total_mulpackets;
2671 static int      hf_cflow_post_total_muloctets;
2672 static int      hf_cflow_tcp_seq_num;
2673 static int      hf_cflow_tcp_ack_num;
2674 static int      hf_cflow_tcp_urg_ptr;
2675 static int      hf_cflow_tcp_header_length;
2676 static int      hf_cflow_ip_header_length;
2677 static int      hf_cflow_ipv6_payload_length;
2678 static int      hf_cflow_ipv6_next_hdr;
2679 static int      hf_cflow_ip_precedence;
2680 static int      hf_cflow_ip_fragment_flags;
2681 static int      hf_cflow_mpls_top_label_ttl;
2682 static int      hf_cflow_mpls_label_length;
2683 static int      hf_cflow_mpls_label_depth;
2684 static int      hf_cflow_mpls_top_label_exp;
2685 static int      hf_cflow_ip_payload_length;
2686 static int      hf_cflow_tcp_option_map;
2687 static int      hf_cflow_collector_addr;
2688 static int      hf_cflow_collector_addr_v6;
2689 static int      hf_cflow_export_interface;
2690 static int      hf_cflow_export_protocol_version;
2691 static int      hf_cflow_export_prot;
2692 static int      hf_cflow_collector_port;
2693 static int      hf_cflow_exporter_port;
2694 static int      hf_cflow_total_tcp_syn;
2695 static int      hf_cflow_total_tcp_fin;
2696 static int      hf_cflow_total_tcp_rst;
2697 static int      hf_cflow_total_tcp_psh;
2698 static int      hf_cflow_total_tcp_ack;
2699 static int      hf_cflow_total_tcp_urg;
2700 static int      hf_cflow_ip_total_length;
2701 static int      hf_cflow_post_natsource_ipv4_address;      /* ID: 225 */
2702 static int      hf_cflow_post_natdestination_ipv4_address;      /* ID: 226 */
2703 static int      hf_cflow_post_naptsource_transport_port;      /* ID: 227 */
2704 static int      hf_cflow_post_naptdestination_transport_port;      /* ID: 228 */
2705 static int      hf_cflow_nat_originating_address_realm;      /* ID: 229 */
2706 static int      hf_cflow_nat_event;      /* ID: 230 */
2707 static int      hf_cflow_initiator_octets;      /* ID: 231 */
2708 static int      hf_cflow_responder_octets;      /* ID: 232 */
2709 static int      hf_cflow_firewall_event;      /* ID: 233 */
2710 static int      hf_cflow_ingress_vrfid;      /* ID: 234 */
2711 static int      hf_cflow_egress_vrfid;      /* ID: 235 */
2712 static int      hf_cflow_vrfname;      /* ID: 236 */
2713 static int      hf_cflow_post_mpls_top_label_exp;      /* ID: 237 */
2714 static int      hf_cflow_tcp_window_scale;      /* ID: 238 */
2715 static int      hf_cflow_biflow_direction;
2716 static int      hf_cflow_ethernet_header_length;      /* ID: 240 */
2717 static int      hf_cflow_ethernet_payload_length;      /* ID: 241 */
2718 static int      hf_cflow_ethernet_total_length;      /* ID: 242 */
2719 static int      hf_cflow_dot1q_vlan_id;      /* ID: 243 */
2720 static int      hf_cflow_dot1q_priority;      /* ID: 244 */
2721 static int      hf_cflow_dot1q_customer_vlan_id;      /* ID: 245 */
2722 static int      hf_cflow_dot1q_customer_priority;      /* ID: 246 */
2723 static int      hf_cflow_metro_evc_id;      /* ID: 247 */
2724 static int      hf_cflow_metro_evc_type;      /* ID: 248 */
2725 static int      hf_cflow_pseudo_wire_id;      /* ID: 249 */
2726 static int      hf_cflow_pseudo_wire_type;      /* ID: 250 */
2727 static int      hf_cflow_pseudo_wire_control_word;      /* ID: 251 */
2728 static int      hf_cflow_ingress_physical_interface;      /* ID: 252 */
2729 static int      hf_cflow_egress_physical_interface;      /* ID: 253 */
2730 static int      hf_cflow_post_dot1q_vlan_id;      /* ID: 254 */
2731 static int      hf_cflow_post_dot1q_customer_vlan_id;      /* ID: 255 */
2732 static int      hf_cflow_ethernet_type;      /* ID: 256 */
2733 static int      hf_cflow_post_ip_precedence;      /* ID: 257 */
2734 static int      hf_cflow_collection_time_milliseconds;      /* ID: 258 */
2735 static int      hf_cflow_export_sctp_stream_id;      /* ID: 259 */
2736 static int      hf_cflow_max_export_seconds;      /* ID: 260 */
2737 static int      hf_cflow_max_flow_end_seconds;      /* ID: 261 */
2738 static int      hf_cflow_message_md5_checksum;      /* ID: 262 */
2739 static int      hf_cflow_message_scope;      /* ID: 263 */
2740 static int      hf_cflow_min_export_seconds;      /* ID: 264 */
2741 static int      hf_cflow_min_flow_start_seconds;      /* ID: 265 */
2742 static int      hf_cflow_opaque_octets;      /* ID: 266 */
2743 static int      hf_cflow_session_scope;      /* ID: 267 */
2744 static int      hf_cflow_max_flow_end_microseconds;      /* ID: 268 */
2745 static int      hf_cflow_max_flow_end_milliseconds;      /* ID: 269 */
2746 static int      hf_cflow_max_flow_end_nanoseconds;      /* ID: 270 */
2747 static int      hf_cflow_min_flow_start_microseconds;      /* ID: 271 */
2748 static int      hf_cflow_min_flow_start_milliseconds;      /* ID: 272 */
2749 static int      hf_cflow_min_flow_start_nanoseconds;      /* ID: 273 */
2750 static int      hf_cflow_collector_certificate;      /* ID: 274 */
2751 static int      hf_cflow_exporter_certificate;      /* ID: 275 */
2752 static int      hf_cflow_data_records_reliability;      /* ID: 276 */
2753 static int      hf_cflow_observation_point_type;      /* ID: 277 */
2754 static int      hf_cflow_new_connection_delta_count;      /* ID: 278 */
2755 static int      hf_cflow_connection_sum_duration_seconds;      /* ID: 279 */
2756 static int      hf_cflow_connection_transaction_id;      /* ID: 280 */
2757 static int      hf_cflow_post_nat_source_ipv6_address;      /* ID: 281 */
2758 static int      hf_cflow_post_nat_destination_ipv6_address;      /* ID: 282 */
2759 static int      hf_cflow_nat_pool_id;      /* ID: 283 */
2760 static int      hf_cflow_nat_pool_name;      /* ID: 284 */
2761 static int      hf_cflow_anonymization_flags;      /* ID: 285 */
2762 static int      hf_cflow_anonymization_technique;      /* ID: 286 */
2763 static int      hf_cflow_information_element_index;      /* ID: 287 */
2764 static int      hf_cflow_p2p_technology;      /* ID: 288 */
2765 static int      hf_cflow_tunnel_technology;      /* ID: 289 */
2766 static int      hf_cflow_encrypted_technology;      /* ID: 290 */
2767 static int      hf_cflow_subtemplate_list;      /* ID: 292 */
2768 static int      hf_cflow_bgp_validity_state;      /* ID: 294 */
2769 static int      hf_cflow_ipsec_spi;      /* ID: 295 */
2770 static int      hf_cflow_gre_key;      /* ID: 296 */
2771 static int      hf_cflow_nat_type;      /* ID: 297 */
2772 static int      hf_cflow_initiator_packets;      /* ID: 298 */
2773 static int      hf_cflow_responder_packets;      /* ID: 299 */
2774 static int      hf_cflow_observation_domain_name;      /* ID: 300 */
2775 static int      hf_cflow_selection_sequence_id;      /* ID: 301 */
2776 static int      hf_cflow_selector_id;      /* ID: 302 */
2777 static int      hf_cflow_information_element_id;      /* ID: 303 */
2778 static int      hf_cflow_selector_algorithm;      /* ID: 304 */
2779 static int      hf_cflow_sampling_packet_interval;      /* ID: 305 */
2780 static int      hf_cflow_sampling_packet_space;      /* ID: 306 */
2781 static int      hf_cflow_sampling_time_interval;      /* ID: 307 */
2782 static int      hf_cflow_sampling_time_space;      /* ID: 308 */
2783 static int      hf_cflow_sampling_size;      /* ID: 309 */
2784 static int      hf_cflow_sampling_population;      /* ID: 310 */
2785 static int      hf_cflow_sampling_probability_float64;      /* ID: 311 */
2786 static int      hf_cflow_sampling_probability_float32;      /* ID: 311 */
2787 static int      hf_cflow_data_link_frame_size;      /* ID: 312 */
2788 static int      hf_cflow_data_link_frame_section;      /* ID: 315 */
2789 static int      hf_cflow_mpls_label_stack_section;      /* ID: 316 */
2790 static int      hf_cflow_mpls_payload_packet_section;      /* ID: 317 */
2791 static int      hf_cflow_selector_id_total_pkts_observed;      /* ID: 318 */
2792 static int      hf_cflow_selector_id_total_pkts_selected;      /* ID: 319 */
2793 static int      hf_cflow_absolute_error_float32;      /* ID: 320 */
2794 static int      hf_cflow_absolute_error_float64;      /* ID: 320 */
2795 static int      hf_cflow_relative_error_float32;      /* ID: 321 */
2796 static int      hf_cflow_relative_error_float64;      /* ID: 321 */
2797 static int      hf_cflow_observation_time_seconds;      /* ID: 322 */
2798 static int      hf_cflow_observation_time_milliseconds;      /* ID: 323 */
2799 static int      hf_cflow_observation_time_microseconds;      /* ID: 324 */
2800 static int      hf_cflow_observation_time_nanoseconds;      /* ID: 325 */
2801 static int      hf_cflow_digest_hash_value;      /* ID: 326 */
2802 static int      hf_cflow_hash_ippayload_offset;      /* ID: 327 */
2803 static int      hf_cflow_hash_ippayload_size;      /* ID: 328 */
2804 static int      hf_cflow_hash_output_range_min;      /* ID: 329 */
2805 static int      hf_cflow_hash_output_range_max;      /* ID: 330 */
2806 static int      hf_cflow_hash_selected_range_min;      /* ID: 331 */
2807 static int      hf_cflow_hash_selected_range_max;      /* ID: 332 */
2808 static int      hf_cflow_hash_digest_output;      /* ID: 333 */
2809 static int      hf_cflow_hash_initialiser_value;      /* ID: 334 */
2810 static int      hf_cflow_selector_name;      /* ID: 335 */
2811 static int      hf_cflow_upper_cilimit_float32;      /* ID: 336 */
2812 static int      hf_cflow_upper_cilimit_float64;      /* ID: 336 */
2813 static int      hf_cflow_lower_cilimit_float32;      /* ID: 337 */
2814 static int      hf_cflow_lower_cilimit_float64;      /* ID: 337 */
2815 static int      hf_cflow_confidence_level_float32;      /* ID: 338 */
2816 static int      hf_cflow_confidence_level_float64;      /* ID: 338 */
2817 static int      hf_cflow_information_element_data_type;      /* ID: 339 */
2818 static int      hf_cflow_information_element_description;      /* ID: 340 */
2819 static int      hf_cflow_information_element_name;      /* ID: 341 */
2820 static int      hf_cflow_information_element_range_begin;      /* ID: 342 */
2821 static int      hf_cflow_information_element_range_end;      /* ID: 343 */
2822 static int      hf_cflow_information_element_semantics;      /* ID: 344 */
2823 static int      hf_cflow_information_element_units;      /* ID: 345 */
2824 static int      hf_cflow_private_enterprise_number;      /* ID: 346 */
2825
2826 static int      hf_cflow_virtual_station_interface_id;      /* ID: 347 */
2827 static int      hf_cflow_virtual_station_interface_name;      /* ID: 348 */
2828 static int      hf_cflow_virtual_station_uuid;      /* ID: 349 */
2829 static int      hf_cflow_virtual_station_name;      /* ID: 350 */
2830 static int      hf_cflow_layer2_segment_id;      /* ID: 351 */
2831 static int      hf_cflow_layer2_octet_delta_count;      /* ID: 352 */
2832 static int      hf_cflow_layer2_octet_total_count;      /* ID: 353 */
2833 static int      hf_cflow_ingress_unicast_packet_total_count;      /* ID: 354 */
2834 static int      hf_cflow_ingress_multicast_packet_total_count;      /* ID: 355 */
2835 static int      hf_cflow_ingress_broadcast_packet_total_count;      /* ID: 356 */
2836 static int      hf_cflow_egress_unicast_packet_total_count;      /* ID: 357 */
2837 static int      hf_cflow_egress_broadcast_packet_total_count;      /* ID: 358 */
2838 static int      hf_cflow_monitoring_interval_start_milliseconds;      /* ID: 359 */
2839 static int      hf_cflow_monitoring_interval_end_milliseconds;      /* ID: 360 */
2840 static int      hf_cflow_port_range_start;      /* ID: 361 */
2841 static int      hf_cflow_port_range_end;      /* ID: 362 */
2842 static int      hf_cflow_port_range_step_size;      /* ID: 363 */
2843 static int      hf_cflow_port_range_num_ports;      /* ID: 364 */
2844 static int      hf_cflow_sta_mac_address;      /* ID: 365 */
2845 static int      hf_cflow_sta_ipv4_address;      /* ID: 366 */
2846 static int      hf_cflow_wtp_mac_address;      /* ID: 367 */
2847 static int      hf_cflow_ingress_interface_type;      /* ID: 368 */
2848 static int      hf_cflow_egress_interface_type;      /* ID: 369 */
2849 static int      hf_cflow_rtp_sequence_number;      /* ID: 370 */
2850 static int      hf_cflow_user_name;      /* ID: 371 */
2851 static int      hf_cflow_application_category_name;      /* ID: 372 */
2852 static int      hf_cflow_application_sub_category_name;      /* ID: 373 */
2853 static int      hf_cflow_application_group_name;      /* ID: 374 */
2854 static int      hf_cflow_original_flows_present;      /* ID: 375 */
2855 static int      hf_cflow_original_flows_initiated;      /* ID: 376 */
2856 static int      hf_cflow_original_flows_completed;      /* ID: 377 */
2857 static int      hf_cflow_distinct_count_of_source_ip_address;      /* ID: 378 */
2858 static int      hf_cflow_distinct_count_of_destinationip_address;      /* ID: 379 */
2859 static int      hf_cflow_distinct_count_of_source_ipv4_address;      /* ID: 380 */
2860 static int      hf_cflow_distinct_count_of_destination_ipv4_address;      /* ID: 381 */
2861 static int      hf_cflow_distinct_count_of_source_ipv6_address;      /* ID: 382 */
2862 static int      hf_cflow_distinct_count_of_destination_ipv6_address;      /* ID: 383 */
2863 static int      hf_cflow_value_distribution_method;      /* ID: 384 */
2864 static int      hf_cflow_rfc3550_jitter_milliseconds;      /* ID: 385 */
2865 static int      hf_cflow_rfc3550_jitter_microseconds;      /* ID: 386 */
2866 static int      hf_cflow_rfc3550_jitter_nanoseconds;      /* ID: 387 */
2867 static int      hf_cflow_dot1q_dei;      /* ID: 388 */
2868 static int      hf_cflow_dot1q_customer_dei;      /* ID: 389 */
2869 static int      hf_cflow_flow_selector_algorithm;      /* ID: 390 */
2870 static int      hf_cflow_flow_selected_octet_delta_count;      /* ID: 391 */
2871 static int      hf_cflow_flow_selected_packet_delta_count;      /* ID: 392 */
2872 static int      hf_cflow_flow_selected_flow_delta_count;      /* ID: 393 */
2873 static int      hf_cflow_selectorid_total_flows_observed;      /* ID: 394 */
2874 static int      hf_cflow_selectorid_total_flows_selected;      /* ID: 395 */
2875 static int      hf_cflow_sampling_flow_interval;      /* ID: 396 */
2876 static int      hf_cflow_sampling_flow_spacing;      /* ID: 397 */
2877 static int      hf_cflow_flow_sampling_time_interval;      /* ID: 398 */
2878 static int      hf_cflow_flow_sampling_time_spacing;      /* ID: 399 */
2879 static int      hf_cflow_hash_flow_domain;      /* ID: 400 */
2880 static int      hf_cflow_transport_octet_delta_count;      /* ID: 401 */
2881 static int      hf_cflow_transport_packet_delta_count;      /* ID: 402 */
2882 static int      hf_cflow_original_exporter_ipv4_address;      /* ID: 403 */
2883 static int      hf_cflow_original_exporter_ipv6_address;      /* ID: 404 */
2884 static int      hf_cflow_original_observation_domain_id;      /* ID: 405 */
2885 static int      hf_cflow_intermediate_process_id;      /* ID: 406 */
2886 static int      hf_cflow_ignored_data_record_total_count;      /* ID: 407 */
2887 static int      hf_cflow_data_link_frame_type;      /* ID: 408 */
2888 static int      hf_cflow_section_offset;      /* ID: 409 */
2889 static int      hf_cflow_section_exported_octets;      /* ID: 410 */
2890 static int      hf_cflow_dot1q_service_instance_tag;      /* ID: 411 */
2891 static int      hf_cflow_dot1q_service_instance_id;      /* ID: 412 */
2892 static int      hf_cflow_dot1q_service_instance_priority;      /* ID: 413 */
2893 static int      hf_cflow_dot1q_customer_source_mac_address;      /* ID: 414 */
2894 static int      hf_cflow_dot1q_customer_destination_mac_address;      /* ID: 415 */
2895 static int      hf_cflow_post_layer2_octet_delta_count;      /* ID: 417 */
2896 static int      hf_cflow_postm_cast_layer2_octet_delta_count;      /* ID: 418 */
2897 static int      hf_cflow_post_layer2_octet_total_count;      /* ID: 420 */
2898 static int      hf_cflow_postm_cast_layer2_octet_total_count;      /* ID: 421 */
2899 static int      hf_cflow_minimum_layer2_total_length;      /* ID: 422 */
2900 static int      hf_cflow_maximum_layer2_total_length;      /* ID: 423 */
2901 static int      hf_cflow_dropped_layer2_octet_delta_count;      /* ID: 424 */
2902 static int      hf_cflow_dropped_layer2_octet_total_count;      /* ID: 425 */
2903 static int      hf_cflow_ignored_layer2_octet_total_count;      /* ID: 426 */
2904 static int      hf_cflow_not_sent_layer2_octet_total_count;      /* ID: 427 */
2905 static int      hf_cflow_layer2_octet_delta_sum_of_squares;      /* ID: 428 */
2906 static int      hf_cflow_layer2_octet_total_sum_of_squares;      /* ID: 429 */
2907 static int      hf_cflow_layer2_frame_delta_count;      /* ID: 430 */
2908 static int      hf_cflow_layer2_frame_total_count;      /* ID: 431 */
2909 static int      hf_cflow_pseudo_wire_destination_ipv4_address;      /* ID: 432 */
2910 static int      hf_cflow_ignored_layer2_frame_total_count;      /* ID: 433 */
2911 static int      hf_cflow_mib_object_value_integer;      /* ID: 434 */
2912 static int      hf_cflow_mib_object_value_octetstring;      /* ID: 435 */
2913 static int      hf_cflow_mib_object_value_oid;      /* ID: 436 */
2914 static int      hf_cflow_mib_object_value_bits;      /* ID: 437 */
2915 static int      hf_cflow_mib_object_value_ipaddress;      /* ID: 438 */
2916 static int      hf_cflow_mib_object_value_counter;      /* ID: 439 */
2917 static int      hf_cflow_mib_object_value_gauge;      /* ID: 440 */
2918 static int      hf_cflow_mib_object_value_timeticks;      /* ID: 441 */
2919 static int      hf_cflow_mib_object_value_unsigned;      /* ID: 442 */
2920 static int      hf_cflow_mib_object_value_table;      /* ID: 443 */
2921 static int      hf_cflow_mib_object_value_row;      /* ID: 444 */
2922 static int      hf_cflow_mib_object_identifier;      /* ID: 445 */
2923 static int      hf_cflow_mib_subidentifier;      /* ID: 446 */
2924 static int      hf_cflow_mib_index_indicator;      /* ID: 447 */
2925 static int      hf_cflow_mib_capture_time_semantics;      /* ID: 448 */
2926 static int      hf_cflow_mib_context_engineid;      /* ID: 449 */
2927 static int      hf_cflow_mib_context_name;      /* ID: 450 */
2928 static int      hf_cflow_mib_object_name;      /* ID: 451 */
2929 static int      hf_cflow_mib_object_description;      /* ID: 452 */
2930 static int      hf_cflow_mib_object_syntax;      /* ID: 453 */
2931 static int      hf_cflow_mib_module_name;      /* ID: 454 */
2932 static int      hf_cflow_mobile_imsi;      /* ID: 455 */
2933 static int      hf_cflow_mobile_msisdn;      /* ID: 456 */
2934 static int      hf_cflow_http_statuscode;      /* ID: 457 */
2935 static int      hf_cflow_source_transport_ports_limit;      /* ID: 458 */
2936 static int      hf_cflow_http_request_method;      /* ID: 459 */
2937 static int      hf_cflow_http_request_host;      /* ID: 460 */
2938 static int      hf_cflow_http_request_target;      /* ID: 461 */
2939 static int      hf_cflow_http_message_version;      /* ID: 462 */
2940 static int      hf_cflow_nat_instanceid;      /* ID: 463 */
2941 static int      hf_cflow_internal_address_realm;      /* ID: 464 */
2942 static int      hf_cflow_external_address_realm;      /* ID: 465 */
2943 static int      hf_cflow_nat_quota_exceeded_event;      /* ID: 466 */
2944 static int      hf_cflow_nat_threshold_event;      /* ID: 467 */
2945 static int      hf_cflow_http_user_agent;      /* ID: 468 */
2946 static int      hf_cflow_http_content_type;      /* ID: 469 */
2947 static int      hf_cflow_http_reason_phrase;      /* ID: 470 */
2948 static int      hf_cflow_max_session_entries;      /* ID: 471 */
2949 static int      hf_cflow_max_bib_entries;      /* ID: 472 */
2950 static int      hf_cflow_max_entries_per_user;      /* ID: 473 */
2951 static int      hf_cflow_max_subscribers;      /* ID: 474 */
2952 static int      hf_cflow_max_fragments_pending_reassembly;      /* ID: 475 */
2953 static int      hf_cflow_addresspool_highthreshold;      /* ID: 476 */
2954 static int      hf_cflow_addresspool_lowthreshold;      /* ID: 477 */
2955 static int      hf_cflow_addressport_mapping_highthreshold;      /* ID: 478 */
2956 static int      hf_cflow_addressport_mapping_lowthreshold;      /* ID: 479 */
2957 static int      hf_cflow_addressport_mapping_per_user_highthreshold;      /* ID: 480 */
2958 static int      hf_cflow_global_addressmapping_highthreshold;      /* ID: 481 */
2959 static int      hf_cflow_vpn_identifier;      /* ID: 482 */
2960 static int      hf_cflow_bgp_community;      /* ID: 483 */
2961 static int      hf_cflow_bgp_source_community_list;      /* ID: 484 */
2962 static int      hf_cflow_bgp_destination_community_list;      /* ID: 485 */
2963 static int      hf_cflow_bgp_extended_community;      /* ID: 486 */
2964 static int      hf_cflow_bgp_source_extended_community_list;      /* ID: 487 */
2965 static int      hf_cflow_bgp_destination_extended_community_list;      /* ID: 488 */
2966 static int      hf_cflow_bgp_large_community;      /* ID: 489 */
2967 static int      hf_cflow_bgp_source_large_community_list;      /* ID: 490 */
2968 static int      hf_cflow_bgp_destination_large_community_list;      /* ID: 491 */
2969
2970 static int      hf_cflow_srh_flags_ipv6;      /* ID: 492 */
2971 static int      hf_cflow_srh_flags_ipv6_reserved;      /* Reserved / Unassigned RFC8754 */
2972 static int      hf_cflow_srh_flags_ipv6_oflag;      /* O-Flag RFC9259 */
2973 static int      hf_cflow_srh_tag_ipv6;      /* ID: 493 */
2974 static int      hf_cflow_srh_segment_ipv6;      /* ID: 494 */
2975 static int      hf_cflow_srh_active_segment_ipv6;      /* ID: 495 */
2976 static int      hf_cflow_srh_segment_ipv6_basic_list;      /* ID: 496 */
2977 static int      hf_cflow_srh_segment_ipv6_list_section;      /* ID: 497 */
2978 static int      hf_cflow_srh_segments_ipv6_left;      /* ID: 498 */
2979 static int      hf_cflow_srh_ipv6_section;      /* ID: 499 */
2980 static int      hf_cflow_srh_ipv6_active_segment_type;      /* ID: 500 */
2981 static int      hf_cflow_srh_segment_ipv6_locator_length;      /* ID: 501 */
2982 static int      hf_cflow_srh_segment_ipv6_endpoint_behaviour;      /* ID: 502 */
2983
2984 static int * const srh_flags_ipv6[] = {
2985         &hf_cflow_srh_flags_ipv6_reserved,
2986         &hf_cflow_srh_flags_ipv6_oflag,
2987         NULL
2988 };
2989
2990 static int      hf_cflow_gtpu_flags;      /* ID: 505 */
2991 static int      hf_gtpu_flags_version;
2992 static int      hf_gtpu_flags_pt;
2993 static int      hf_gtpu_flags_reserved;
2994 static int      hf_gtpu_flags_s;
2995 static int      hf_gtpu_flags_n;
2996 static int      hf_gtpu_flags_pn;
2997 static int      hf_cflow_gtpu_msg_type;      /* ID: 506 */
2998 static int      hf_cflow_gtpu_teid;      /* ID: 507 */
2999 static int      hf_cflow_gtpu_seq_num;      /* ID: 508 */
3000 static int      hf_cflow_gtpu_qfi;      /* ID: 509 */
3001 static int      hf_cflow_gtpu_pdu_type;      /* ID: 510 */
3002
3003 static int * const gtpu_flags[] = {
3004         &hf_gtpu_flags_version,
3005         &hf_gtpu_flags_pt,
3006         &hf_gtpu_flags_reserved,
3007         &hf_gtpu_flags_s,
3008         &hf_gtpu_flags_n,
3009         &hf_gtpu_flags_pn,
3010         NULL
3011 };
3012
3013 static int      hf_cflow_mpls_label;
3014 static int      hf_cflow_mpls_exp;
3015 static int      hf_cflow_mpls_bos;
3016
3017 #if 0
3018 static int      hf_cflow_nic_id;      /* ID: 33625 */
3019 #endif
3020 static int      hf_cflow_cts_sgt_source_tag;      /* ID: 34000 */
3021 static int      hf_cflow_cts_sgt_destination_tag;      /* ID: 34001 */
3022 static int      hf_cflow_cts_sgt_source_name;      /* ID: 34002 */
3023 static int      hf_cflow_cts_sgt_destination_name;      /* ID: 34003 */
3024 static int      hf_cflow_packets_dropped;      /* ID: 37000 */
3025 static int      hf_cflow_byte_rate;      /* ID: 37003 */
3026 static int      hf_cflow_application_media_bytes;      /* ID: 37004 */
3027 static int      hf_cflow_application_media_byte_rate;      /* ID: 37006 */
3028 static int      hf_cflow_application_media_packets;      /* ID: 37007 */
3029 static int      hf_cflow_application_media_packet_rate;      /* ID: 37009 */
3030 static int      hf_cflow_application_media_event;      /* ID: 37011 */
3031 static int      hf_cflow_monitor_event;      /* ID: 37012 */
3032 static int      hf_cflow_timestamp_interval;      /* ID: 37013 */
3033 static int      hf_cflow_transport_packets_expected;      /* ID: 37014 */
3034 static int      hf_cflow_transport_round_trip_time;      /* ID: 37016 */
3035 static int      hf_cflow_transport_round_trip_time_string;      /* ID: 37016 */
3036 static int      hf_cflow_transport_event_packet_loss;      /* ID: 37017 */
3037 static int      hf_cflow_transport_packets_lost;      /* ID: 37019 */
3038 static int      hf_cflow_transport_packets_lost_string;      /* ID: 37019 */
3039 static int      hf_cflow_transport_packets_lost_rate;      /* ID: 37021 */
3040 static int      hf_cflow_transport_packets_lost_rate_string;      /* ID: 37021 */
3041 static int      hf_cflow_transport_rtp_ssrc;      /* ID: 37022 */
3042 static int      hf_cflow_transport_rtp_jitter_mean;      /* ID: 37023 */
3043 static int      hf_cflow_transport_rtp_jitter_mean_string;      /* ID: 37023 */
3044 static int      hf_cflow_transport_rtp_jitter_min;      /* ID: 37024 */
3045 static int      hf_cflow_transport_rtp_jitter_min_string;      /* ID: 37024 */
3046 static int      hf_cflow_transport_rtp_jitter_max;      /* ID: 37025 */
3047 static int      hf_cflow_transport_rtp_jitter_max_string;      /* ID: 37025 */
3048
3049 static int      hf_cflow_transport_rtp_payload_type;      /* ID: 37041 */
3050 static int      hf_cflow_transport_rtp_payload_type_string;      /* ID: 37041 */
3051 static int      hf_cflow_transport_bytes_out_of_order;      /* ID: 37071 */
3052 /* static int      hf_cflow_transport_packets_out_of_order; */      /* ID: 37074 */
3053 static int      hf_cflow_transport_packets_out_of_order_string;      /* ID: 37074 */
3054 static int      hf_cflow_transport_tcp_window_size_min;      /* ID: 37083 */
3055 static int      hf_cflow_transport_tcp_window_size_min_string;      /* ID: 37083 */
3056 static int      hf_cflow_transport_tcp_window_size_max;      /* ID: 37084  */
3057 static int      hf_cflow_transport_tcp_window_size_max_string;      /* ID: 37084 */
3058 static int      hf_cflow_transport_tcp_window_size_mean;      /* ID: 37085  */
3059 static int      hf_cflow_transport_tcp_window_size_mean_string;      /* ID: 37085  */
3060 static int      hf_cflow_transport_tcp_maximum_segment_size;      /* ID: 37086  */
3061 static int      hf_cflow_transport_tcp_maximum_segment_size_string;      /* ID: 37086 */
3062
3063 /* Sequence analysis fields */
3064 static int      hf_cflow_sequence_analysis_expected_sn;
3065 static int      hf_cflow_sequence_analysis_previous_frame;
3066
3067 /* Ericsson SE NAT Logging */
3068 static int      hf_cflow_nat_context_id;   /* ID: 24628 */
3069 static int      hf_cflow_nat_context_name;   /* ID: 24629 */
3070 static int      hf_cflow_nat_assign_time;   /* ID: 24630 */
3071 static int      hf_cflow_nat_unassign_time;   /* ID: 24631 */
3072 static int      hf_cflow_nat_int_addr;   /* ID: 24632 */
3073 static int      hf_cflow_nat_ext_addr;   /* ID: 24633 */
3074 static int      hf_cflow_nat_ext_port_first;   /* ID: 24634 */
3075 static int      hf_cflow_nat_ext_port_last;   /* ID: 24635 */
3076
3077
3078 /* Cisco ASA 5500 Series */
3079 static int      hf_cflow_ingress_acl_id; /* NF_F_INGRESS_ACL_ID (33000) */
3080 static int      hf_cflow_egress_acl_id; /* NF_F_EGRESS_ACL_ID  (33001) */
3081 static int      hf_cflow_fw_ext_event; /* NF_F_FW_EXT_EVENT   (33002) */
3082 static int      hf_cflow_aaa_username; /* NF_F_USERNAME[_MAX] (40000) */
3083
3084 static int      hf_ipfix_enterprise_private_entry;
3085
3086 /* pie = private information element */
3087
3088 static int      hf_pie_cace;
3089 static int      hf_pie_cace_local_ipv4_address;
3090 static int      hf_pie_cace_remote_ipv4_address;
3091 static int      hf_pie_cace_local_ipv6_address;
3092 static int      hf_pie_cace_remote_ipv6_address;
3093 static int      hf_pie_cace_local_port;
3094 static int      hf_pie_cace_remote_port;
3095 static int      hf_pie_cace_local_ipv4_id;
3096 static int      hf_pie_cace_local_icmp_id;
3097 static int      hf_pie_cace_local_uid;
3098 static int      hf_pie_cace_local_pid;
3099 static int      hf_pie_cace_local_username_len;
3100 static int      hf_pie_cace_local_username;
3101 static int      hf_pie_cace_local_cmd_len;
3102 static int      hf_pie_cace_local_cmd;
3103
3104 static int      hf_pie_ntop;
3105 static int      hf_pie_ntop_src_fragments;
3106 static int      hf_pie_ntop_dst_fragments;
3107 static int      hf_pie_ntop_src_to_dst_max_throughput;
3108 static int      hf_pie_ntop_src_to_dst_min_throughput;
3109 static int      hf_pie_ntop_src_to_dst_avg_throughput;
3110 static int      hf_pie_ntop_dst_to_src_max_throughput;
3111 static int      hf_pie_ntop_dst_to_src_min_throughput;
3112 static int      hf_pie_ntop_dst_to_src_avg_throughput;
3113 static int      hf_pie_ntop_num_pkts_up_to_128_bytes;
3114 static int      hf_pie_ntop_num_pkts_128_to_256_bytes;
3115 static int      hf_pie_ntop_num_pkts_256_to_512_bytes;
3116 static int      hf_pie_ntop_num_pkts_512_to_1024_bytes;
3117 static int      hf_pie_ntop_num_pkts_1024_to_1514_bytes;
3118 static int      hf_pie_ntop_num_pkts_over_1514_bytes;
3119 static int      hf_pie_ntop_cumulative_icmp_type;
3120 static int      hf_pie_ntop_src_ip_country;
3121 static int      hf_pie_ntop_src_ip_city;
3122 static int      hf_pie_ntop_dst_ip_country;
3123 static int      hf_pie_ntop_dst_ip_city;
3124 static int      hf_pie_ntop_flow_proto_port;
3125
3126 static int      hf_pie_ntop_upstream_tunnel_id;
3127 static int      hf_pie_ntop_longest_flow_pkt;
3128 static int      hf_pie_ntop_shortest_flow_pkt;
3129 static int      hf_pie_ntop_retransmitted_in_pkts;
3130 static int      hf_pie_ntop_retransmitted_out_pkts;
3131 static int      hf_pie_ntop_ooorder_in_pkts;
3132 static int      hf_pie_ntop_ooorder_out_pkts;
3133 static int      hf_pie_ntop_untunneled_protocol;
3134 static int      hf_pie_ntop_untunneled_ipv4_src_addr;
3135 static int      hf_pie_ntop_untunneled_l4_src_port;
3136 static int      hf_pie_ntop_untunneled_ipv4_dst_addr;
3137 static int      hf_pie_ntop_untunneled_l4_dst_port;
3138
3139 static int      hf_pie_ntop_l7_proto;
3140 static int      hf_pie_ntop_l7_proto_name;
3141 static int      hf_pie_ntop_downstram_tunnel_id;
3142 static int      hf_pie_ntop_flow_user_name;
3143 static int      hf_pie_ntop_flow_server_name;
3144 static int      hf_pie_ntop_client_nw_latency_ms;
3145 static int      hf_pie_ntop_server_nw_latency_ms;
3146 static int      hf_pie_ntop_appl_latency_ms;
3147 static int      hf_pie_ntop_plugin_name;
3148 static int      hf_pie_ntop_retransmitted_in_bytes;
3149 static int      hf_pie_ntop_retransmitted_out_bytes;
3150 static int      hf_pie_ntop_sip_call_id;
3151 static int      hf_pie_ntop_sip_calling_party;
3152 static int      hf_pie_ntop_sip_called_party;
3153 static int      hf_pie_ntop_sip_rtp_codecs;
3154 static int      hf_pie_ntop_sip_invite_time;
3155 static int      hf_pie_ntop_sip_trying_time;
3156 static int      hf_pie_ntop_sip_ringing_time;
3157
3158 static int      hf_pie_ntop_sip_invite_ok_time;
3159 static int      hf_pie_ntop_sip_invite_failure_time;
3160 static int      hf_pie_ntop_sip_bye_time;
3161 static int      hf_pie_ntop_sip_bye_ok_time;
3162 static int      hf_pie_ntop_sip_cancel_time;
3163 static int      hf_pie_ntop_sip_cancel_ok_time;
3164 static int      hf_pie_ntop_sip_rtp_ipv4_src_addr;
3165 static int      hf_pie_ntop_sip_rtp_l4_src_port;
3166 static int      hf_pie_ntop_sip_rtp_ipv4_dst_addr;
3167 static int      hf_pie_ntop_sip_rtp_l4_dst_port;
3168 static int      hf_pie_ntop_sip_response_code;
3169 static int      hf_pie_ntop_sip_reason_cause;
3170 static int      hf_pie_ntop_rtp_first_seq;
3171 static int      hf_pie_ntop_rtp_first_ts;
3172 static int      hf_pie_ntop_rtp_last_seq;
3173 static int      hf_pie_ntop_rtp_last_ts;
3174 static int      hf_pie_ntop_rtp_in_jitter;
3175 static int      hf_pie_ntop_rtp_out_jitter;
3176 static int      hf_pie_ntop_rtp_in_pkt_lost;
3177 static int      hf_pie_ntop_rtp_out_pkt_lost;
3178 static int      hf_pie_ntop_rtp_out_payload_type;
3179 static int      hf_pie_ntop_rtp_in_max_delta;
3180 static int      hf_pie_ntop_rtp_out_max_delta;
3181 static int      hf_pie_ntop_rtp_in_payload_type;
3182 static int      hf_pie_ntop_src_proc_id;
3183 static int      hf_pie_ntop_src_proc_name;
3184 static int      hf_pie_ntop_http_url;
3185 static int      hf_pie_ntop_http_ret_code;
3186 static int      hf_pie_ntop_http_referer;
3187 static int      hf_pie_ntop_http_ua;
3188 static int      hf_pie_ntop_http_mime;
3189 static int      hf_pie_ntop_smtp_mail_from;
3190 static int      hf_pie_ntop_smtp_rcpt_to;
3191 static int      hf_pie_ntop_http_host;
3192 static int      hf_pie_ntop_ssl_server_name;
3193 static int      hf_pie_ntop_bittorrent_hash;
3194
3195 static int      hf_pie_ntop_mysql_srv_version;
3196 static int      hf_pie_ntop_mysql_username;
3197 static int      hf_pie_ntop_mysql_db;
3198 static int      hf_pie_ntop_mysql_query;
3199 static int      hf_pie_ntop_mysql_response;
3200
3201 static int      hf_pie_ntop_oracle_username;
3202 static int      hf_pie_ntop_oracle_query;
3203 static int      hf_pie_ntop_oracle_resp_code;
3204 static int      hf_pie_ntop_oracle_resp_string;
3205 static int      hf_pie_ntop_oracle_query_duration;
3206 static int      hf_pie_ntop_dns_query;
3207 static int      hf_pie_ntop_dns_query_id;
3208 static int      hf_pie_ntop_dns_query_type;
3209 static int      hf_pie_ntop_dns_ret_code;
3210 static int      hf_pie_ntop_dns_num_answers;
3211 static int      hf_pie_ntop_pop_user;
3212
3213 static int      hf_pie_ntop_gtpv1_req_msg_type;
3214 static int      hf_pie_ntop_gtpv1_rsp_msg_type;
3215 static int      hf_pie_ntop_gtpv1_c2s_teid_data;
3216 static int      hf_pie_ntop_gtpv1_c2s_teid_ctrl;
3217 static int      hf_pie_ntop_gtpv1_s2c_teid_data;
3218 static int      hf_pie_ntop_gtpv1_s2c_teid_ctrl;
3219 static int      hf_pie_ntop_gtpv1_end_user_ip;
3220 static int      hf_pie_ntop_gtpv1_end_user_imsi;
3221 static int      hf_pie_ntop_gtpv1_end_user_msisdn;
3222 static int      hf_pie_ntop_gtpv1_end_user_imei;
3223 static int      hf_pie_ntop_gtpv1_apn_name;
3224 static int      hf_pie_ntop_gtpv1_rai_mcc;
3225 static int      hf_pie_ntop_gtpv1_rai_mnc;
3226
3227 static int      hf_pie_ntop_gtpv1_uli_cell_lac;
3228 static int      hf_pie_ntop_gtpv1_uli_cell_ci;
3229 static int      hf_pie_ntop_gtpv1_uli_sac;
3230 static int      hf_pie_ntop_gtpv1_rai_type;
3231 static int      hf_pie_ntop_radius_req_msg_type;
3232 static int      hf_pie_ntop_radius_rsp_msg_type;
3233 static int      hf_pie_ntop_radius_user_name;
3234 static int      hf_pie_ntop_radius_calling_station_id;
3235 static int      hf_pie_ntop_radius_called_station_id;
3236 static int      hf_pie_ntop_radius_nas_ip_addr;
3237 static int      hf_pie_ntop_radius_nas_identifier;
3238 static int      hf_pie_ntop_radius_user_imsi;
3239 static int      hf_pie_ntop_radius_user_imei;
3240 static int      hf_pie_ntop_radius_framed_ip_addr;
3241 static int      hf_pie_ntop_radius_acct_session_id;
3242 static int      hf_pie_ntop_radius_acct_status_type;
3243 static int      hf_pie_ntop_radius_acct_in_octets;
3244 static int      hf_pie_ntop_radius_acct_out_octets;
3245 static int      hf_pie_ntop_radius_acct_in_pkts;
3246 static int      hf_pie_ntop_radius_acct_out_pkts;
3247 static int      hf_pie_ntop_imap_login;
3248
3249 static int      hf_pie_ntop_gtpv2_req_msg_type;
3250 static int      hf_pie_ntop_gtpv2_rsp_msg_type;
3251 static int      hf_pie_ntop_gtpv2_c2s_s1u_gtpu_teid;
3252 static int      hf_pie_ntop_gtpv2_c2s_s1u_gtpu_ip;
3253 static int      hf_pie_ntop_gtpv2_s2c_s1u_gtpu_teid;
3254 static int      hf_pie_ntop_gtpv2_s2c_s1u_gtpu_ip;
3255 static int      hf_pie_ntop_gtpv2_end_user_imsi;
3256 static int      hf_pie_ntop_gtpv2_and_user_msisdn;
3257 static int      hf_pie_ntop_gtpv2_apn_name;
3258 static int      hf_pie_ntop_gtpv2_uli_mcc;
3259 static int      hf_pie_ntop_gtpv2_uli_mnc;
3260 static int      hf_pie_ntop_gtpv2_uli_cell_tac;
3261 static int      hf_pie_ntop_gtpv2_uli_cell_id;
3262 static int      hf_pie_ntop_gtpv2_rat_type;
3263 static int      hf_pie_ntop_gtpv2_pdn_ip;
3264 static int      hf_pie_ntop_gtpv2_end_user_imei;
3265
3266 static int      hf_pie_ntop_src_as_path_1;
3267 static int      hf_pie_ntop_src_as_path_2;
3268 static int      hf_pie_ntop_src_as_path_3;
3269 static int      hf_pie_ntop_src_as_path_4;
3270 static int      hf_pie_ntop_src_as_path_5;
3271 static int      hf_pie_ntop_src_as_path_6;
3272 static int      hf_pie_ntop_src_as_path_7;
3273 static int      hf_pie_ntop_src_as_path_8;
3274 static int      hf_pie_ntop_src_as_path_9;
3275 static int      hf_pie_ntop_src_as_path_10;
3276 static int      hf_pie_ntop_dst_as_path_1;
3277 static int      hf_pie_ntop_dst_as_path_2;
3278 static int      hf_pie_ntop_dst_as_path_3;
3279 static int      hf_pie_ntop_dst_as_path_4;
3280 static int      hf_pie_ntop_dst_as_path_5;
3281 static int      hf_pie_ntop_dst_as_path_6;
3282 static int      hf_pie_ntop_dst_as_path_7;
3283 static int      hf_pie_ntop_dst_as_path_8;
3284 static int      hf_pie_ntop_dst_as_path_9;
3285 static int      hf_pie_ntop_dst_as_path_10;
3286
3287 static int      hf_pie_ntop_mysql_appl_latency_usec;
3288 static int      hf_pie_ntop_gtpv0_req_msg_type;
3289 static int      hf_pie_ntop_gtpv0_rsp_msg_type;
3290 static int      hf_pie_ntop_gtpv0_tid;
3291 static int      hf_pie_ntop_gtpv0_end_user_ip;
3292 static int      hf_pie_ntop_gtpv0_end_user_msisdn;
3293 static int      hf_pie_ntop_gtpv0_apn_name;
3294 static int      hf_pie_ntop_gtpv0_rai_mcc;
3295 static int      hf_pie_ntop_gtpv0_rai_mnc;
3296 static int      hf_pie_ntop_gtpv0_rai_cell_lac;
3297 static int      hf_pie_ntop_gtpv0_rai_cell_rac;
3298 static int      hf_pie_ntop_gtpv0_response_cause;
3299 static int      hf_pie_ntop_gtpv1_response_cause;
3300 static int      hf_pie_ntop_gtpv2_response_cause;
3301 static int      hf_pie_ntop_num_pkts_ttl_5_32;
3302 static int      hf_pie_ntop_num_pkts_ttl_32_64;
3303 static int      hf_pie_ntop_num_pkts_ttl_64_96;
3304 static int      hf_pie_ntop_num_pkts_ttl_96_128;
3305 static int      hf_pie_ntop_num_pkts_ttl_128_160;
3306 static int      hf_pie_ntop_num_pkts_ttl_160_192;
3307 static int      hf_pie_ntop_num_pkts_ttl_192_224;
3308 static int      hf_pie_ntop_num_pkts_ttl_224_255;
3309 static int      hf_pie_ntop_gtpv1_rai_lac;
3310 static int      hf_pie_ntop_gtpv1_rai_rac;
3311 static int      hf_pie_ntop_gtpv1_uli_mcc;
3312 static int      hf_pie_ntop_gtpv1_uli_mnc;
3313 static int      hf_pie_ntop_num_pkts_ttl_2_5;
3314 static int      hf_pie_ntop_num_pkts_ttl_eq_1;
3315 static int      hf_pie_ntop_rtp_sip_call_id;
3316 static int      hf_pie_ntop_in_src_osi_sap;
3317 static int      hf_pie_ntop_out_dst_osi_sap;
3318
3319 static int      hf_pie_ntop_whois_das_domain;
3320 static int      hf_pie_ntop_dns_ttl_answer;
3321 static int      hf_pie_ntop_dhcp_client_mac;
3322 static int      hf_pie_ntop_dhcp_client_ip;
3323 static int      hf_pie_ntop_dhcp_client_name;
3324 static int      hf_pie_ntop_ftp_login;
3325 static int      hf_pie_ntop_ftp_password;
3326 static int      hf_pie_ntop_ftp_command;
3327 static int      hf_pie_ntop_ftp_command_ret_code;
3328 static int      hf_pie_ntop_http_method;
3329 static int      hf_pie_ntop_http_site;
3330 static int      hf_pie_ntop_sip_c_ip;
3331 static int      hf_pie_ntop_sip_call_state;
3332 static int      hf_pie_ntop_rtp_in_mos;
3333 static int      hf_pie_ntop_rtp_in_r_factor;
3334 static int      hf_pie_ntop_src_proc_user_name;
3335 static int      hf_pie_ntop_src_father_proc_pid;
3336 static int      hf_pie_ntop_src_father_proc_name;
3337 static int      hf_pie_ntop_dst_proc_pid;
3338 static int      hf_pie_ntop_dst_proc_name;
3339 static int      hf_pie_ntop_dst_proc_user_name;
3340 static int      hf_pie_ntop_dst_father_proc_pid;
3341 static int      hf_pie_ntop_dst_father_proc_name;
3342 static int      hf_pie_ntop_rtp_rtt;
3343 static int      hf_pie_ntop_rtp_in_transit;
3344 static int      hf_pie_ntop_rtp_out_transit;
3345 static int      hf_pie_ntop_src_proc_actual_memory;
3346 static int      hf_pie_ntop_src_proc_peak_memory;
3347 static int      hf_pie_ntop_src_proc_average_cpu_load;
3348 static int      hf_pie_ntop_src_proc_num_page_faults;
3349 static int      hf_pie_ntop_dst_proc_actual_memory;
3350 static int      hf_pie_ntop_dst_proc_peak_memory;
3351 static int      hf_pie_ntop_dst_proc_average_cpu_load;
3352 static int      hf_pie_ntop_dst_proc_num_page_faults;
3353 static int      hf_pie_ntop_duration_in;
3354 static int      hf_pie_ntop_duration_out;
3355 static int      hf_pie_ntop_src_proc_pctg_iowait;
3356 static int      hf_pie_ntop_dst_proc_pctg_iowait;
3357 static int      hf_pie_ntop_rtp_dtmf_tones;
3358 static int      hf_pie_ntop_untunneled_ipv6_src_addr;
3359 static int      hf_pie_ntop_untunneled_ipv6_dst_addr;
3360 static int      hf_pie_ntop_dns_response;
3361
3362 static int      hf_pie_ntop_diameter_req_msg_type;
3363 static int      hf_pie_ntop_diameter_rsp_msg_type;
3364 static int      hf_pie_ntop_diameter_req_origin_host;
3365 static int      hf_pie_ntop_diameter_rsp_origin_host;
3366 static int      hf_pie_ntop_diameter_req_user_name;
3367 static int      hf_pie_ntop_diameter_rsp_result_code;
3368 static int      hf_pie_ntop_diameter_exp_res_vendor_id;
3369 static int      hf_pie_ntop_diameter_exp_res_result_code;
3370
3371 static int      hf_pie_ntop_s1ap_enb_ue_s1ap_id;
3372 static int      hf_pie_ntop_s1ap_mme_ue_s1ap_id;
3373 static int      hf_pie_ntop_s1ap_msg_emm_type_mme_to_enb;
3374 static int      hf_pie_ntop_s1ap_msg_esm_type_mme_to_enb;
3375 static int      hf_pie_ntop_s1ap_msg_emm_type_enb_to_mme;
3376 static int      hf_pie_ntop_s1ap_msg_esm_type_enb_to_mme;
3377 static int      hf_pie_ntop_s1ap_cause_enb_to_mme;
3378 static int      hf_pie_ntop_s1ap_detailed_cause_enb_to_mme;
3379
3380 static int      hf_pie_ntop_tcp_win_min_in;
3381 static int      hf_pie_ntop_tcp_win_max_in;
3382 static int      hf_pie_ntop_tcp_win_mss_in;
3383 static int      hf_pie_ntop_tcp_win_scale_in;
3384 static int      hf_pie_ntop_tcp_win_min_out;
3385 static int      hf_pie_ntop_tcp_win_max_out;
3386 static int      hf_pie_ntop_tcp_win_mss_out;
3387 static int      hf_pie_ntop_tcp_win_scale_out;
3388 static int      hf_pie_ntop_dhcp_remote_id;
3389 static int      hf_pie_ntop_dhcp_subscriber_id;
3390 static int      hf_pie_ntop_src_proc_uid;
3391 static int      hf_pie_ntop_dst_proc_uid;
3392 static int      hf_pie_ntop_application_name;
3393 static int      hf_pie_ntop_user_name;
3394 static int      hf_pie_ntop_dhcp_message_type;
3395 static int      hf_pie_ntop_rtp_in_pkt_drop;
3396 static int      hf_pie_ntop_rtp_out_pkt_drop;
3397 static int      hf_pie_ntop_rtp_out_mos;
3398 static int      hf_pie_ntop_rtp_out_r_factor;
3399 static int      hf_pie_ntop_rtp_mos;
3400 static int      hf_pie_ntop_gptv2_s5_s8_gtpc_teid;
3401 static int      hf_pie_ntop_rtp_r_factor;
3402 static int      hf_pie_ntop_rtp_ssrc;
3403 static int      hf_pie_ntop_payload_hash;
3404 static int      hf_pie_ntop_gtpv2_c2s_s5_s8_gtpu_teid;
3405 static int      hf_pie_ntop_gtpv2_s2c_s5_s8_gtpu_teid;
3406 static int      hf_pie_ntop_gtpv2_c2s_s5_s8_gtpu_ip;
3407 static int      hf_pie_ntop_gtpv2_s2c_s5_s8_gtpu_ip;
3408 static int      hf_pie_ntop_src_as_map;
3409 static int      hf_pie_ntop_dst_as_map;
3410 static int      hf_pie_ntop_diameter_hop_by_hop_id;
3411 static int      hf_pie_ntop_upstream_session_id;
3412 static int      hf_pie_ntop_downstream_session_id;
3413 static int      hf_pie_ntop_src_ip_long;
3414 static int      hf_pie_ntop_src_ip_lat;
3415 static int      hf_pie_ntop_dst_ip_long;
3416 static int      hf_pie_ntop_dst_ip_lat;
3417
3418 static int      hf_pie_ntop_diameter_clr_cancel_type;
3419 static int      hf_pie_ntop_diameter_clr_flags;
3420 static int      hf_pie_ntop_gtpv2_c2s_s5_s8_gtpc_ip;
3421 static int      hf_pie_ntop_gtpv2_s2c_s5_s8_gtpc_ip;
3422 static int      hf_pie_ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid;
3423 static int      hf_pie_ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid;
3424 static int      hf_pie_ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip;
3425 static int      hf_pie_ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip;
3426
3427 static int      hf_pie_ntop_http_x_forwarded_for;
3428 static int      hf_pie_ntop_http_via;
3429 static int      hf_pie_ntop_ssdp_host;
3430 static int      hf_pie_ntop_ssdp_usn;
3431 static int      hf_pie_ntop_netbios_query_name;
3432 static int      hf_pie_ntop_netbios_query_type;
3433 static int      hf_pie_ntop_netbios_response;
3434 static int      hf_pie_ntop_netbios_query_os;
3435 static int      hf_pie_ntop_ssdp_server;
3436 static int      hf_pie_ntop_ssdp_type;
3437 static int      hf_pie_ntop_ssdp_method;
3438 static int      hf_pie_ntop_nprobe_ipv4_address;
3439
3440 static int      hf_pie_plixer;
3441 static int      hf_pie_plixer_client_ip_v4;
3442 static int      hf_pie_plixer_client_hostname;     /* string */
3443 static int      hf_pie_plixer_partner_name;     /* string */
3444 static int      hf_pie_plixer_server_hostname;     /* string */
3445 static int      hf_pie_plixer_server_ip_v4;
3446 static int      hf_pie_plixer_recipient_address;     /* string */
3447 static int      hf_pie_plixer_event_id;
3448 static int      hf_pie_plixer_msgid;     /* string */
3449
3450 static int      hf_pie_plixer_priority;
3451 static int      hf_pie_plixer_recipient_report_status;
3452 static int      hf_pie_plixer_number_recipients;
3453 static int      hf_pie_plixer_origination_time;
3454 static int      hf_pie_plixer_encryption;     /* string */
3455 static int      hf_pie_plixer_service_version;     /* string */
3456 static int      hf_pie_plixer_linked_msgid;     /* string */
3457 static int      hf_pie_plixer_message_subject;     /* string */
3458 static int      hf_pie_plixer_sender_address;     /* string */
3459 static int      hf_pie_plixer_date_time;
3460
3461 static int      hf_pie_ixia;
3462 static int      hf_pie_ixia_l7_application_id;
3463 static int      hf_pie_ixia_l7_application_name;
3464 static int      hf_pie_ixia_source_ip_country_code;
3465 static int      hf_pie_ixia_source_ip_country_name;
3466 static int      hf_pie_ixia_source_ip_region_code;
3467 static int      hf_pie_ixia_source_ip_region_name;
3468 static int      hf_pie_ixia_source_ip_city_name;
3469 static int      hf_pie_ixia_source_ip_latitude;
3470 static int      hf_pie_ixia_source_ip_longitude;
3471 static int      hf_pie_ixia_destination_ip_country_code;
3472 static int      hf_pie_ixia_destination_ip_country_name;
3473 static int      hf_pie_ixia_destination_ip_region_code;
3474 static int      hf_pie_ixia_destination_ip_region_name;
3475 static int      hf_pie_ixia_destination_ip_city_name;
3476 static int      hf_pie_ixia_destination_ip_latitude;
3477 static int      hf_pie_ixia_destination_ip_longitude;
3478 static int      hf_pie_ixia_os_device_id;
3479 static int      hf_pie_ixia_os_device_name;
3480 static int      hf_pie_ixia_browser_id;
3481 static int      hf_pie_ixia_browser_name;
3482 static int      hf_pie_ixia_reverse_octet_delta_count;
3483 static int      hf_pie_ixia_reverse_packet_delta_count;
3484 static int      hf_pie_ixia_conn_encryption_type;
3485 static int      hf_pie_ixia_encryption_cipher;
3486 static int      hf_pie_ixia_encryption_keylen;
3487 static int      hf_pie_ixia_imsi;
3488 static int      hf_pie_ixia_user_agent;
3489 static int      hf_pie_ixia_host_name;
3490 static int      hf_pie_ixia_uri;
3491 static int      hf_pie_ixia_dns_txt;
3492 static int      hf_pie_ixia_source_as_name;
3493 static int      hf_pie_ixia_dest_as_name;
3494 static int      hf_pie_ixia_transaction_latency;
3495 static int      hf_pie_ixia_dns_query_names;
3496 static int      hf_pie_ixia_dns_answer_names;
3497 static int      hf_pie_ixia_dns_classes;
3498 static int      hf_pie_ixia_threat_type;
3499 static int      hf_pie_ixia_threat_ipv4;
3500 static int      hf_pie_ixia_threat_ipv6;
3501 static int      hf_pie_ixia_http_session;
3502 static int      hf_pie_ixia_request_time;
3503 static int      hf_pie_ixia_http_connection;
3504 static int      hf_pie_ixia_http_accept;
3505 static int      hf_pie_ixia_http_accept_language;
3506 static int      hf_pie_ixia_http_accept_encoding;
3507 static int      hf_pie_ixia_http_reason;
3508 static int      hf_pie_ixia_http_server;
3509 static int      hf_pie_ixia_http_content_length;
3510 static int      hf_pie_ixia_http_referer;
3511 static int      hf_pie_ixia_http_useragent_cpu;
3512 static int      hf_pie_ixia_dns_records;
3513 static int      hf_pie_ixia_dns_name;
3514 static int      hf_pie_ixia_dns_ipv4;
3515 static int      hf_pie_ixia_dns_ipv6;
3516 static int      hf_pie_ixia_dns_packets;
3517 static int      hf_pie_ixia_dns_transaction_id;
3518 static int      hf_pie_ixia_dns_opcode;
3519 static int      hf_pie_ixia_dns_request_type;
3520 static int      hf_pie_ixia_dns_response_code;
3521 static int      hf_pie_ixia_dns_record_ttl;
3522 static int      hf_pie_ixia_dns_raw_rdata;
3523 static int      hf_pie_ixia_dns_response_type;
3524 static int      hf_pie_ixia_dns_qdcount;
3525 static int      hf_pie_ixia_dns_ancount;
3526 static int      hf_pie_ixia_dns_nscount;
3527 static int      hf_pie_ixia_dns_arcount;
3528 static int      hf_pie_ixia_dns_auth_answer;
3529 static int      hf_pie_ixia_dns_trucation;
3530 static int      hf_pie_ixia_dns_recursion_desired;
3531 static int      hf_pie_ixia_dns_recursion_avail;
3532 static int      hf_pie_ixia_dns_rdata_len;
3533 static int      hf_pie_ixia_dns_questions;
3534 static int      hf_pie_ixia_dns_query_type;
3535 static int      hf_pie_ixia_dns_query_name;
3536 static int      hf_pie_ixia_dns_section_type;
3537 static int      hf_pie_ixia_dns_qr_flag;
3538 static int      hf_pie_ixia_dns_canonical_name;
3539 static int      hf_pie_ixia_dns_mx_domain;
3540 static int      hf_pie_ixia_tls_sni;
3541 static int      hf_pie_ixia_tls_srvr_cert;
3542 static int      hf_pie_ixia_tls_srvr_cert_issuer;
3543 static int      hf_pie_ixia_tls_srvr_cert_issuer_attr;
3544 static int      hf_pie_ixia_tls_srvr_cert_issuer_val;
3545 static int      hf_pie_ixia_tls_srvr_cert_subject;
3546 static int      hf_pie_ixia_tls_srvr_cert_subject_attr;
3547 static int      hf_pie_ixia_tls_srvr_cert_subject_val;
3548 static int      hf_pie_ixia_tls_srvr_cert_vld_nt_bfr;
3549 static int      hf_pie_ixia_tls_srvr_cert_vld_nt_aftr;
3550 static int      hf_pie_ixia_tls_srvr_cert_srl_num;
3551 static int      hf_pie_ixia_tls_srvr_cert_sign_algo;
3552 static int      hf_pie_ixia_tls_srvr_cert_subj_pki_algo;
3553 static int      hf_pie_ixia_tls_srvr_cert_altnames;
3554 static int      hf_pie_ixia_tls_srvr_cert_altnames_attr;
3555 static int      hf_pie_ixia_tls_srvr_cert_altnames_val;
3556 static int      hf_pie_ixia_dhcp_client_id;
3557 static int      hf_pie_ixia_dhcp_client_mac;
3558 static int      hf_pie_ixia_dhcp_messages;
3559 static int      hf_pie_ixia_dhcp_message_timestamp;
3560 static int      hf_pie_ixia_dhcp_message_type;
3561 static int      hf_pie_ixia_dhcp_lease_duration;
3562 static int      hf_pie_ixia_dhcp_servername;
3563 static int      hf_pie_ixia_dhcp_agent_circuit_id;
3564 static int      hf_pie_ixia_radius_events;
3565 static int      hf_pie_ixia_radius_timestamp;
3566 static int      hf_pie_ixia_radius_event_timestamp;
3567 static int      hf_pie_ixia_radius_username;
3568 static int      hf_pie_ixia_radius_nas_ipv4;
3569 static int      hf_pie_ixia_radius_service_type;
3570 static int      hf_pie_ixia_radius_framed_protocol;
3571 static int      hf_pie_ixia_radius_framed_ip;
3572 static int      hf_pie_ixia_radius_filter_id;
3573 static int      hf_pie_ixia_radius_reply_message;
3574 static int      hf_pie_ixia_radius_called_station_id;
3575 static int      hf_pie_ixia_radius_calling_station_id;
3576 static int      hf_pie_ixia_email_messages;
3577 static int      hf_pie_ixia_email_msg_id;
3578 static int      hf_pie_ixia_email_msg_date;
3579 static int      hf_pie_ixia_email_msg_subject;
3580 static int      hf_pie_ixia_email_msg_to;
3581 static int      hf_pie_ixia_email_msg_from;
3582 static int      hf_pie_ixia_email_msg_cc;
3583 static int      hf_pie_ixia_email_msg_bcc;
3584 static int      hf_pie_ixia_email_msg_attachments;
3585 static int      hf_pie_ixia_ja3_fingerprint_string;
3586 static int      hf_pie_ixia_tcp_conn_setup_time;
3587 static int      hf_pie_ixia_tcp_app_response_time;
3588 static int      hf_pie_ixia_tcp_retrans_pkt_count;
3589 static int      hf_pie_ixia_conn_avg_rtt;
3590 static int      hf_pie_ixia_udpAppResponseTime;
3591 static int      hf_pie_ixia_quicConnSetupTime;
3592 static int      hf_pie_ixia_quicConnRTT;
3593 static int      hf_pie_ixia_quicAppResponseTime;
3594 static int      hf_pie_ixia_matchedFilterName;
3595 static int      hf_pie_ixia_gtp_IMSI;
3596 static int      hf_pie_ixia_gtp_ULI_SAI_SAC;
3597 static int      hf_pie_ixia_gtp_ULI_RAI_RAC;
3598 static int      hf_pie_ixia_gtp_ULI_TAC;
3599 static int      hf_pie_ixia_gtp_ULI_ECGI_E_NODEB_ID;
3600 static int      hf_pie_ixia_gtp_ULI_CELL_ID;
3601 static int      hf_pie_ixia_gtp_ULI_LAC;
3602 static int      hf_pie_ixia_gtp_ULI_MCC;
3603 static int      hf_pie_ixia_gtp_ULI_MNC;
3604 static int      hf_pie_ixia_gtp_MSISDN;
3605 static int      hf_pie_ixia_gtp_IMEI;
3606 static int      hf_pie_ixia_gtp_RAT_type;
3607 static int      hf_pie_ixia_gtp_ep_gen;
3608 static int      hf_pie_ixia_gtp_up_TEID;
3609 static int      hf_pie_ixia_gtp_down_TEID;
3610 static int      hf_pie_ixia_gtp_up_ipv4_addr;
3611 static int      hf_pie_ixia_gtp_down_ipv4_addr;
3612 static int      hf_pie_ixia_gtp_up_ipv6_addr;
3613 static int      hf_pie_ixia_gtp_down_ipv6_addr;
3614 static int      hf_pie_ixia_gtp_up_QCI_QFI;
3615 static int      hf_pie_ixia_gtp_down_QCI_QFI;
3616 static int      hf_pie_ixia_gtp_up_APN_DNN;
3617 static int      hf_pie_ixia_gtp_down_APN_DNN;
3618 static int      hf_pie_ixia_gtp_NSSAI_SD;
3619 static int      hf_pie_ixia_gtp_NSSAI_SST;
3620 static int      hf_pie_ixia_gtp_5QI_up;
3621 static int      hf_pie_ixia_gtp_5QI_down;
3622 static int      hf_pie_ixia_stun_response;
3623 static int      hf_pie_ixia_stun_reflexive_ta_ipv4;
3624 static int      hf_pie_ixia_stun_reflexive_ta_ipv6;
3625 static int      hf_pie_ixia_stun_reflexive_ta_port;
3626 static int      hf_pie_ixia_http_alt_svc;
3627 static int      hf_pie_ixia_unidirectional;
3628 static int      hf_pie_ixia_http_tls_server_rand;
3629 static int      hf_pie_ixia_http_tls_session_id;
3630 static int      hf_pie_ixia_sip_to;
3631 static int      hf_pie_ixia_sip_from;
3632 static int      hf_pie_ixia_sip_call_id;
3633 static int      hf_pie_ixia_sip_content_type;
3634 static int      hf_pie_ixia_sip_route;
3635 static int      hf_pie_ixia_sip_geolocation;
3636 static int      hf_pie_ixia_diameter_message;
3637 static int      hf_pie_ixia_diameter_command_code;
3638 static int      hf_pie_ixia_diameter_request;
3639 static int      hf_pie_ixia_diameter_response;
3640 static int      hf_pie_ixia_diameter_application_id;
3641 static int      hf_pie_ixia_diameter_origin_host;
3642 static int      hf_pie_ixia_diameter_origin_realm;
3643 static int      hf_pie_ixia_diameter_dest_host;
3644 static int      hf_pie_ixia_diameter_dest_realm;
3645 static int      hf_pie_ixia_diameter_user_name;
3646 static int      hf_pie_ixia_diameter_sc_address;
3647 static int      hf_pie_ixia_diameter_auth_vector_rand;
3648 static int      hf_pie_ixia_diameter_auth_vector_xres;
3649 static int      hf_pie_ixia_diameter_auth_vector_autn;
3650 static int      hf_pie_ixia_diameter_auth_vector_kasme;
3651 static int      hf_pie_ixia_diameter_sub_data_ambr_max_req_bw_ul;
3652 static int      hf_pie_ixia_diameter_sub_data_ambr_max_req_bw_dl;
3653 static int      hf_pie_ixia_diameter_apn_configuration_profile;
3654 static int      hf_pie_ixia_diameter_access_restriction_data_flags;
3655 static int      hf_pie_ixia_diameter_route_record;
3656 static int      hf_pie_ixia_diameter_framed_ip_address;
3657 static int      hf_pie_ixia_diameter_3gpp_user_location_info;
3658 static int      hf_pie_ixia_diameter_called_station_id;
3659 static int      hf_pie_ixia_diameter_qos_class_identifier;
3660 static int      hf_pie_ixia_diameter_qos_max_req_bw_dl;
3661 static int      hf_pie_ixia_diameter_qos_max_req_bw_ul;
3662 static int      hf_pie_ixia_diameter_qos_guaranteed_br_ul;
3663 static int      hf_pie_ixia_diameter_qos_guaranteed_br_dl;
3664 static int      hf_pie_ixia_diameter_qos_apn_agg_max_br_ul;
3665 static int      hf_pie_ixia_diameter_qos_apn_agg_max_br_dl;
3666 static int      hf_pie_ixia_diameter_integrity_key;
3667 static int      hf_pie_ixia_diameter_confidentiality_key;
3668 static int      hf_pie_ixia_diameter_result_code;
3669 static int      hf_pie_ixia_diameter_subscription_id_data;
3670 static int      hf_pie_ixia_session_fingerprint;
3671 static int      hf_pie_ixia_session_parse_errors;
3672 static int      hf_pie_ixia_http_headers;
3673 static int      hf_pie_ixia_http_header_field;
3674 static int      hf_pie_ixia_http_header_value;
3675 static int      hf_pie_ixia_sip_packets;
3676 static int      hf_pie_ixia_sip_headers;
3677 static int      hf_pie_ixia_sip_type;
3678 static int      hf_pie_ixia_sip_header_field;
3679 static int      hf_pie_ixia_sip_header_value;
3680 static int      hf_pie_ixia_session_ip_scrambling_key_hash;
3681 static int      hf_pie_ixia_ja4a;
3682 static int      hf_pie_ixia_ja4b;
3683 static int      hf_pie_ixia_ja4c;
3684
3685 static int      hf_pie_netscaler;
3686 static int      hf_pie_netscaler_roundtriptime;
3687 static int      hf_pie_netscaler_transactionid;
3688 static int      hf_pie_netscaler_httprequrl;
3689 static int      hf_pie_netscaler_httpreqcookie;
3690 static int      hf_pie_netscaler_flowflags;
3691 static int      hf_pie_netscaler_connectionid;
3692 static int      hf_pie_netscaler_syslogpriority;
3693 static int      hf_pie_netscaler_syslogmessage;
3694 static int      hf_pie_netscaler_syslogtimestamp;
3695 static int      hf_pie_netscaler_httpreqreferer;
3696 static int      hf_pie_netscaler_httpreqmethod;
3697 static int      hf_pie_netscaler_httpreqhost;
3698 static int      hf_pie_netscaler_httprequseragent;
3699 static int      hf_pie_netscaler_httprspstatus;
3700 static int      hf_pie_netscaler_httprsplen;
3701 static int      hf_pie_netscaler_serverttfb;
3702 static int      hf_pie_netscaler_serverttlb;
3703 static int      hf_pie_netscaler_appnameincarnationnumber;
3704 static int      hf_pie_netscaler_appnameappid;
3705 static int      hf_pie_netscaler_appname;
3706 static int      hf_pie_netscaler_httpreqrcvfb;
3707 static int      hf_pie_netscaler_httpreqforwfb;
3708 static int      hf_pie_netscaler_httpresrcvfb;
3709 static int      hf_pie_netscaler_httpresforwfb;
3710 static int      hf_pie_netscaler_httpreqrcvlb;
3711 static int      hf_pie_netscaler_httpreqforwlb;
3712 static int      hf_pie_netscaler_mainpageid;
3713 static int      hf_pie_netscaler_mainpagecoreid;
3714 static int      hf_pie_netscaler_httpclientinteractionstarttime;
3715 static int      hf_pie_netscaler_httpclientrenderendtime;
3716 static int      hf_pie_netscaler_httpclientrenderstarttime;
3717 static int      hf_pie_netscaler_apptemplatename;
3718 static int      hf_pie_netscaler_httpclientinteractionendtime;
3719 static int      hf_pie_netscaler_httpresrcvlb;
3720 static int      hf_pie_netscaler_httpresforwlb;
3721 static int      hf_pie_netscaler_appunitnameappid;
3722 static int      hf_pie_netscaler_dbloginflags;
3723 static int      hf_pie_netscaler_dbreqtype;
3724 static int      hf_pie_netscaler_dbprotocolname;
3725 static int      hf_pie_netscaler_dbusername;
3726 static int      hf_pie_netscaler_dbdatabasename;
3727 static int      hf_pie_netscaler_dbclthostname;
3728 static int      hf_pie_netscaler_dbreqstring;
3729 static int      hf_pie_netscaler_dbrespstatusstring;
3730 static int      hf_pie_netscaler_dbrespstatus;
3731 static int      hf_pie_netscaler_dbresplength;
3732 static int      hf_pie_netscaler_clientrtt;
3733 static int      hf_pie_netscaler_httpcontenttype;
3734 static int      hf_pie_netscaler_httpreqauthorization;
3735 static int      hf_pie_netscaler_httpreqvia;
3736 static int      hf_pie_netscaler_httpreslocation;
3737 static int      hf_pie_netscaler_httpressetcookie;
3738 static int      hf_pie_netscaler_httpressetcookie2;
3739 static int      hf_pie_netscaler_httpreqxforwardedfor;
3740 static int      hf_pie_netscaler_connectionchainid;
3741 static int      hf_pie_netscaler_connectionchainhopcount;
3742 static int      hf_pie_netscaler_icasessionguid;
3743 static int      hf_pie_netscaler_icaclientversion;
3744 static int      hf_pie_netscaler_icaclienttype;
3745 static int      hf_pie_netscaler_icaclientip;
3746 static int      hf_pie_netscaler_icaclienthostname;
3747 static int      hf_pie_netscaler_aaausername;
3748 static int      hf_pie_netscaler_icadomainname;
3749 static int      hf_pie_netscaler_icaclientlauncher;
3750 static int      hf_pie_netscaler_icasessionsetuptime;
3751 static int      hf_pie_netscaler_icaservername;
3752 static int      hf_pie_netscaler_icasessionreconnects;
3753 static int      hf_pie_netscaler_icartt;
3754 static int      hf_pie_netscaler_icaclientsiderxbytes;
3755 static int      hf_pie_netscaler_icaclientsidetxbytes;
3756 static int      hf_pie_netscaler_icaclientsidepacketsretransmit;
3757 static int      hf_pie_netscaler_icaserversidepacketsretransmit;
3758 static int      hf_pie_netscaler_icaclientsidertt;
3759 static int      hf_pie_netscaler_icaserversidertt;
3760 static int      hf_pie_netscaler_icasessionupdatebeginsec;
3761 static int      hf_pie_netscaler_icasessionupdateendsec;
3762 static int      hf_pie_netscaler_icachannelid1;
3763 static int      hf_pie_netscaler_icachannelid1bytes;
3764 static int      hf_pie_netscaler_icachannelid2;
3765 static int      hf_pie_netscaler_icachannelid2bytes;
3766 static int      hf_pie_netscaler_icachannelid3;
3767 static int      hf_pie_netscaler_icachannelid3bytes;
3768 static int      hf_pie_netscaler_icachannelid4;
3769 static int      hf_pie_netscaler_icachannelid4bytes;
3770 static int      hf_pie_netscaler_icachannelid5;
3771 static int      hf_pie_netscaler_icachannelid5bytes;
3772 static int      hf_pie_netscaler_icaconnectionpriority;
3773 static int      hf_pie_netscaler_applicationstartupduration;
3774 static int      hf_pie_netscaler_icalaunchmechanism;
3775 static int      hf_pie_netscaler_icaapplicationname;
3776 static int      hf_pie_netscaler_applicationstartuptime;
3777 static int      hf_pie_netscaler_icaapplicationterminationtype;
3778 static int      hf_pie_netscaler_icaapplicationterminationtime;
3779 static int      hf_pie_netscaler_icasessionendtime;
3780 static int      hf_pie_netscaler_icaclientsidejitter;
3781 static int      hf_pie_netscaler_icaserversidejitter;
3782 static int      hf_pie_netscaler_icaappprocessid;
3783 static int      hf_pie_netscaler_icaappmodulepath;
3784 static int      hf_pie_netscaler_icadeviceserialno;
3785 static int      hf_pie_netscaler_msiclientcookie;
3786 static int      hf_pie_netscaler_icaflags;
3787 static int      hf_pie_netscaler_icausername;
3788 static int      hf_pie_netscaler_licensetype;
3789 static int      hf_pie_netscaler_maxlicensecount;
3790 static int      hf_pie_netscaler_currentlicenseconsumed;
3791 static int      hf_pie_netscaler_icanetworkupdatestarttime;
3792 static int      hf_pie_netscaler_icanetworkupdateendtime;
3793 static int      hf_pie_netscaler_icaclientsidesrtt;
3794 static int      hf_pie_netscaler_icaserversidesrtt;
3795 static int      hf_pie_netscaler_icaclientsidedelay;
3796 static int      hf_pie_netscaler_icaserversidedelay;
3797 static int      hf_pie_netscaler_icahostdelay;
3798 static int      hf_pie_netscaler_icaclientsidewindowsize;
3799 static int      hf_pie_netscaler_icaserversidewindowsize;
3800 static int      hf_pie_netscaler_icaclientsidertocount;
3801 static int      hf_pie_netscaler_icaserversidertocount;
3802 static int      hf_pie_netscaler_ical7clientlatency;
3803 static int      hf_pie_netscaler_ical7serverlatency;
3804 static int      hf_pie_netscaler_httpdomainname;
3805 static int      hf_pie_netscaler_cacheredirclientconnectioncoreid;
3806 static int      hf_pie_netscaler_cacheredirclientconnectiontransactionid;
3807
3808
3809 static int      hf_pie_barracuda;
3810 static int      hf_pie_barracuda_timestamp;
3811 static int      hf_pie_barracuda_logop;
3812 static int      hf_pie_barracuda_traffictype;
3813 static int      hf_pie_barracuda_fwrule;
3814 static int      hf_pie_barracuda_servicename;
3815 static int      hf_pie_barracuda_reason;
3816 static int      hf_pie_barracuda_reasontext;
3817 static int      hf_pie_barracuda_bindipv4address;
3818 static int      hf_pie_barracuda_bindtransportport;
3819 static int      hf_pie_barracuda_connipv4address;
3820 static int      hf_pie_barracuda_conntransportport;
3821 static int      hf_pie_barracuda_auditcounter;
3822
3823 static int      hf_pie_gigamon;
3824 static int      hf_pie_gigamon_httprequrl;
3825 static int      hf_pie_gigamon_httprspstatus;
3826 static int      hf_pie_gigamon_sslcertificateissuercommonname;
3827 static int      hf_pie_gigamon_sslcertificatesubjectcommonname;
3828 static int      hf_pie_gigamon_sslcertificateissuer;
3829 static int      hf_pie_gigamon_sslcertificatesubject;
3830 static int      hf_pie_gigamon_sslcertificatevalidnotbefore;
3831 static int      hf_pie_gigamon_sslcertificatevalidnotafter;
3832 static int      hf_pie_gigamon_sslcertificateserialnumber;
3833 static int      hf_pie_gigamon_sslcertificatesignaturealgorithm;
3834 static int      hf_pie_gigamon_sslcertificatesubjectpubalgorithm;
3835 static int      hf_pie_gigamon_sslcertificatesubjectpubkeysize;
3836 static int      hf_pie_gigamon_sslcertificatesubjectaltname;
3837 static int      hf_pie_gigamon_sslservernameindication;
3838 static int      hf_pie_gigamon_sslserverversion;
3839 static int      hf_pie_gigamon_sslservercipher;
3840 static int      hf_pie_gigamon_sslservercompressionmethod;
3841 static int      hf_pie_gigamon_sslserversessionid;
3842 static int      hf_pie_gigamon_dnsidentifier;
3843 static int      hf_pie_gigamon_dnsopcode;
3844 static int      hf_pie_gigamon_dnsresponsecode;
3845 static int      hf_pie_gigamon_dnsqueryname;
3846 static int      hf_pie_gigamon_dnsresponsename;
3847 static int      hf_pie_gigamon_dnsresponsettl;
3848 static int      hf_pie_gigamon_dnsresponseipv4address;
3849 static int      hf_pie_gigamon_dnsresponseipv6address;
3850 static int      hf_pie_gigamon_dnsbits;
3851 static int      hf_pie_gigamon_dnsqdcount;
3852 static int      hf_pie_gigamon_dnsancount;
3853 static int      hf_pie_gigamon_dnsnscount;
3854 static int      hf_pie_gigamon_dnsarcount;
3855 static int      hf_pie_gigamon_dnsquerytype;
3856 static int      hf_pie_gigamon_dnsqueryclass;
3857 static int      hf_pie_gigamon_dnsresponsetype;
3858 static int      hf_pie_gigamon_dnsresponseclass;
3859 static int      hf_pie_gigamon_dnsresponserdlength;
3860 static int      hf_pie_gigamon_dnsresponserdata;
3861 static int      hf_pie_gigamon_dnsauthorityname;
3862 static int      hf_pie_gigamon_dnsauthoritytype;
3863 static int      hf_pie_gigamon_dnsauthorityclass;
3864 static int      hf_pie_gigamon_dnsauthorityttl;
3865 static int      hf_pie_gigamon_dnsauthorityrdlength;
3866 static int      hf_pie_gigamon_dnsauthorityrdata;
3867 static int      hf_pie_gigamon_dnsadditionalname;
3868 static int      hf_pie_gigamon_dnsadditionaltype;
3869 static int      hf_pie_gigamon_dnsadditionalclass;
3870 static int      hf_pie_gigamon_dnsadditionalttl;
3871 static int      hf_pie_gigamon_dnsadditionalrdlength;
3872 static int      hf_pie_gigamon_dnsadditionalrdata;
3873
3874 static int      hf_pie_cisco;
3875 static int      hf_pie_cisco_transport_packets_lost_counter;
3876 static int      hf_pie_cisco_transport_rtp_ssrc;
3877 static int      hf_pie_cisco_transport_rtp_jitter_maximum;
3878 static int      hf_pie_cisco_transport_rtp_payload_type;
3879 static int      hf_pie_cisco_transport_rtp_jitter_mean_sum;
3880 static int      hf_pie_cisco_c3pl_class_cce_id;
3881 static int      hf_pie_cisco_c3pl_class_name;
3882 static int      hf_pie_cisco_c3pl_class_type;
3883 static int      hf_pie_cisco_c3pl_policy_cce_id;
3884 static int      hf_pie_cisco_c3pl_policy_name;
3885 static int      hf_pie_cisco_c3pl_policy_type;
3886 static int      hf_pie_cisco_connection_server_counter_responses;
3887 static int      hf_pie_cisco_connection_client_counter_packets_retransmitted;
3888 static int      hf_pie_cisco_connection_transaction_counter_complete;
3889 static int      hf_pie_cisco_connection_transaction_duration_sum;
3890 static int      hf_pie_cisco_connection_delay_response_to_server_histogram_late;
3891 static int      hf_pie_cisco_connection_delay_response_to_server_sum;
3892 static int      hf_pie_cisco_connection_delay_application_sum;
3893 static int      hf_pie_cisco_connection_delay_application_max;
3894 static int      hf_pie_cisco_connection_delay_response_client_to_server_sum;
3895 static int      hf_pie_cisco_connection_delay_network_client_to_server_sum;
3896 static int      hf_pie_cisco_connection_delay_network_to_client_sum;
3897 static int      hf_pie_cisco_connection_delay_network_to_server_sum;
3898 static int      hf_pie_cisco_services_waas_segment;
3899 static int      hf_pie_cisco_services_waas_passthrough_reason;
3900 static int      hf_pie_cisco_application_http_uri_statistics;
3901 static int      hf_pie_cisco_application_http_uri_statistics_count;
3902 static int      hf_pie_cisco_application_category_name;
3903 static int      hf_pie_cisco_application_sub_category_name;
3904 static int      hf_pie_cisco_application_group_name;
3905 static int      hf_pie_cisco_application_http_host;
3906 static int      hf_pie_cisco_application_http_host_app_id;
3907 static int      hf_pie_cisco_application_http_host_sub_app_id;
3908 static int      hf_pie_cisco_connection_client_ipv4_address;
3909 static int      hf_pie_cisco_connection_server_ipv4_address;
3910 static int      hf_pie_cisco_connection_client_transport_port;
3911 static int      hf_pie_cisco_connection_server_transport_port;
3912 static int      hf_pie_cisco_connection_id;
3913 static int      hf_pie_cisco_application_traffic_class;
3914 static int      hf_pie_cisco_application_business_relevance;
3915
3916 static int      hf_pie_niagara_networks;
3917 static int      hf_pie_niagara_networks_sslservernameindication;
3918 static int      hf_pie_niagara_networks_sslserverversion;
3919 static int      hf_pie_niagara_networks_sslserverversiontext;
3920 static int      hf_pie_niagara_networks_sslservercipher;
3921 static int      hf_pie_niagara_networks_sslserverciphertext;
3922 static int      hf_pie_niagara_networks_sslconnectionencryptiontype;
3923 static int      hf_pie_niagara_networks_sslservercompressionmethod;
3924 static int      hf_pie_niagara_networks_sslserversessionid;
3925 static int      hf_pie_niagara_networks_sslcertificateissuer;
3926 static int      hf_pie_niagara_networks_sslcertificateissuername;
3927 static int      hf_pie_niagara_networks_sslcertificatesubject;
3928 static int      hf_pie_niagara_networks_sslcertificatesubjectname;
3929 static int      hf_pie_niagara_networks_sslcertificatevalidnotbefore;
3930 static int      hf_pie_niagara_networks_sslcertificatevalidnotafter;
3931 static int      hf_pie_niagara_networks_sslcertificateserialnumber;
3932 static int      hf_pie_niagara_networks_sslcertificatesignaturealgorithm;
3933 static int      hf_pie_niagara_networks_sslcertificatesignaturealgorithmtext;
3934 static int      hf_pie_niagara_networks_sslcertificatesubjectpublickeysize;
3935 static int      hf_pie_niagara_networks_sslcertificatesubjectpublicalgorithm;
3936 static int      hf_pie_niagara_networks_sslcertificatesubjectpublicalgorithmtext;
3937 static int      hf_pie_niagara_networks_sslcertificatesubjectalgorithmtext;
3938 static int      hf_pie_niagara_networks_sslcertificatesubjectalternativename;
3939 static int      hf_pie_niagara_networks_sslcertificatesha1;
3940 static int      hf_pie_niagara_networks_dnsidentifier;
3941 static int      hf_pie_niagara_networks_dnsopcode;
3942 static int      hf_pie_niagara_networks_dnsresponsecode;
3943 static int      hf_pie_niagara_networks_dnsqueryname;
3944 static int      hf_pie_niagara_networks_dnsresponsename;
3945 static int      hf_pie_niagara_networks_dnsresponsettl;
3946 static int      hf_pie_niagara_networks_dnsresponseipv4addr;
3947 static int      hf_pie_niagara_networks_dnsresponseipv4addrtext;
3948 static int      hf_pie_niagara_networks_dnsresponseipv6addr;
3949 static int      hf_pie_niagara_networks_dnsresponseipv6addrtext;
3950 static int      hf_pie_niagara_networks_dnsbits;
3951 static int      hf_pie_niagara_networks_dnsqdcount;
3952 static int      hf_pie_niagara_networks_dnsancount;
3953 static int      hf_pie_niagara_networks_dnsnscount;
3954 static int      hf_pie_niagara_networks_dnsarcount;
3955 static int      hf_pie_niagara_networks_dnsquerytype;
3956 static int      hf_pie_niagara_networks_dnsquerytypetext;
3957 static int      hf_pie_niagara_networks_dnsqueryclass;
3958 static int      hf_pie_niagara_networks_dnsqueryclasstext;
3959 static int      hf_pie_niagara_networks_dnsresponsetype;
3960 static int      hf_pie_niagara_networks_dnsresponsetypetext;
3961 static int      hf_pie_niagara_networks_dnsresponseclass;
3962 static int      hf_pie_niagara_networks_dnsresponseclasstext;
3963 static int      hf_pie_niagara_networks_dnsresponserdlength;
3964 static int      hf_pie_niagara_networks_dnsresponserdata;
3965 static int      hf_pie_niagara_networks_dnsauthorityname;
3966 static int      hf_pie_niagara_networks_dnsauthoritytype;
3967 static int      hf_pie_niagara_networks_dnsauthoritytypetext;
3968 static int      hf_pie_niagara_networks_dnsauthorityclass;
3969 static int      hf_pie_niagara_networks_dnsauthorityclasstext;
3970 static int      hf_pie_niagara_networks_dnsauthorityttl;
3971 static int      hf_pie_niagara_networks_dnsauthorityrdlength;
3972 static int      hf_pie_niagara_networks_dnsauthorityrdata;
3973 static int      hf_pie_niagara_networks_dnsadditionalname;
3974 static int      hf_pie_niagara_networks_dnsadditionaltype;
3975 static int      hf_pie_niagara_networks_dnsadditionaltypetext;
3976 static int      hf_pie_niagara_networks_dnsadditionalclass;
3977 static int      hf_pie_niagara_networks_dnsadditionalclasstext;
3978 static int      hf_pie_niagara_networks_dnsadditionalttl;
3979 static int      hf_pie_niagara_networks_dnsadditionalrdlength;
3980 static int      hf_pie_niagara_networks_dnsadditionalrdata;
3981 static int      hf_pie_niagara_networks_radiuspackettypecode;
3982 static int      hf_pie_niagara_networks_radiuspackettypecodetext;
3983 static int      hf_pie_niagara_networks_radiuspacketidentifier;
3984 static int      hf_pie_niagara_networks_radiusauthenticator;
3985 static int      hf_pie_niagara_networks_radiususername;
3986 static int      hf_pie_niagara_networks_radiuscallingstationid;
3987 static int      hf_pie_niagara_networks_radiuscalledstationid;
3988 static int      hf_pie_niagara_networks_radiusnasipaddress;
3989 static int      hf_pie_niagara_networks_radiusnasipv6address;
3990 static int      hf_pie_niagara_networks_radiusnasidentifier;
3991 static int      hf_pie_niagara_networks_radiusframedipaddress;
3992 static int      hf_pie_niagara_networks_radiusframedipv6address;
3993 static int      hf_pie_niagara_networks_radiusacctsessionid;
3994 static int      hf_pie_niagara_networks_radiusacctstatustype;
3995 static int      hf_pie_niagara_networks_radiusacctinoctets;
3996 static int      hf_pie_niagara_networks_radiusacctoutoctets;
3997 static int      hf_pie_niagara_networks_radiusacctinpackets;
3998 static int      hf_pie_niagara_networks_radiusacctoutpackets;
3999 static int      hf_pie_niagara_networks_radiusvsavendorid;
4000 static int      hf_pie_niagara_networks_radiusvsaname;
4001 static int      hf_pie_niagara_networks_radiusvsaid;
4002 static int      hf_pie_niagara_networks_radiusvsavalue;
4003
4004 static int      hf_pie_fastip_meter_version;
4005 static int      hf_pie_fastip_meter_os_sysname;
4006 static int      hf_pie_fastip_meter_os_nodename;
4007 static int      hf_pie_fastip_meter_os_release;
4008 static int      hf_pie_fastip_meter_os_version;
4009 static int      hf_pie_fastip_meter_os_machine;
4010 static int      hf_pie_fastip_epoch_second;
4011 static int      hf_pie_fastip_nic_name;
4012 static int      hf_pie_fastip_nic_id;
4013 static int      hf_pie_fastip_nic_mac;
4014 static int      hf_pie_fastip_nic_ip;
4015 /*
4016 static int      hf_pie_fastip_collisions;
4017 static int      hf_pie_fastip_errors;
4018 */
4019 static int      hf_pie_fastip_nic_driver_name;
4020 static int      hf_pie_fastip_nic_driver_version;
4021 static int      hf_pie_fastip_nic_firmware_version;
4022 static int      hf_pie_fastip_meter_os_distribution;
4023 /*
4024 static int      hf_pie_fastip_bond_interface_mode;
4025 static int      hf_pie_fastip_bond_interface_physical_nic_count;
4026 static int      hf_pie_fastip_bond_interface_id;
4027 */
4028 static int      hf_pie_fastip_tcp_flags;
4029 static int      hf_pie_fastip_tcp_handshake_rtt_usec;
4030 static int      hf_pie_fastip_app_rtt_usec;
4031
4032 static int      hf_pie_juniper;
4033 static int      hf_pie_juniper_cpid_16bit;
4034 static int      hf_pie_juniper_cpid_32bit;
4035 static int      hf_pie_juniper_cpdesc_16bit;
4036 static int      hf_pie_juniper_cpdesc_32bit;
4037
4038 static int      hf_string_len_short;
4039 static int      hf_string_len_long;
4040
4041 static int      hf_template_frame;
4042
4043 static expert_field ei_cflow_entries;
4044 static expert_field ei_cflow_options;
4045 static expert_field ei_cflow_flowset_length;
4046 static expert_field ei_cflow_scopes;
4047 static expert_field ei_cflow_template_ipfix_scope_field_count_too_many;
4048 static expert_field ei_cflow_template_ipfix_scope_field_count;
4049 static expert_field ei_cflow_no_flow_information;
4050 static expert_field ei_cflow_mpls_label_bad_length;
4051 static expert_field ei_cflow_flowsets_impossible;
4052 static expert_field ei_cflow_no_template_found;
4053 static expert_field ei_transport_bytes_out_of_order;
4054 static expert_field ei_unexpected_sequence_number;
4055 static expert_field ei_cflow_subtemplate_bad_length;
4056
4057 static const value_string special_mpls_top_label_type[] = {
4058     {0, "Unknown"},
4059     {1, "TE-MIDPT"},
4060     {2, "ATOM"},
4061     {3, "VPN"},
4062     {4, "BGP"},
4063     {5, "LDP"},
4064     {0, NULL }
4065 };
4066
4067 static const value_string special_mib_capture_time_semantics[] = {
4068     {0, "undefined"},
4069     {1, "begin"},
4070     {2, "end"},
4071     {3, "export"},
4072     {4, "average"},
4073     {0, NULL }
4074 };
4075
4076 static const value_string special_nat_quota_exceeded_event[] = {
4077     {0, "Reserved"},
4078     {1, "Maximum session entries"},
4079     {2, "Maximum BIB entries"},
4080     {3, "Maximum entries per user"},
4081     {4, "Maximum active hosts or subscribers"},
4082     {5, "Maximum fragments pending reassembly"},
4083     {0, NULL }
4084 };
4085
4086 static const value_string special_nat_threshold_event[] = {
4087     {0, "Reserved"},
4088     {1, "Address pool high threshold event"},
4089     {2, "Address pool low threshold event"},
4090     {3, "Address and port mapping high threshold event"},
4091     {4, "Address and port mapping per user high threshold event"},
4092     {5, "Global address mapping high threshold event"},
4093     {0, NULL }
4094 };
4095
4096 static const value_string special_nat_event_type[] = {
4097     {0, "Reserved"},
4098     {1, "NAT translation create (Historic)"},
4099     {2, "NAT translation delete (Historic)"},
4100     {3, "NAT Addresses exhausted"},
4101     {4, "NAT44 session create"},
4102     {5, "NAT44 session delete"},
4103     {6, "NAT64 session create"},
4104     {7, "NAT64 session delete"},
4105     {8, "NAT44 BIB create"},
4106     {9, "NAT44 BIB delete"},
4107     {10, "NAT64 BIB create"},
4108     {11, "NAT64 BIB delete"},
4109     {12, "NAT ports exhausted"},
4110     {13, "Quota Exceeded"},
4111     {14, "Address binding create"},
4112     {15, "Address binding delete"},
4113     {16, "Port block allocation"},
4114     {17, "Port block de-allocation"},
4115     {18, "Threshold Reached"},
4116     {0, NULL }
4117 };
4118
4119 static int * const tcp_flags[] = {
4120     &hf_cflow_tcpflags_reserved,
4121     &hf_cflow_tcpflags_urg,
4122     &hf_cflow_tcpflags_ack,
4123     &hf_cflow_tcpflags_psh,
4124     &hf_cflow_tcpflags_rst,
4125     &hf_cflow_tcpflags_syn,
4126     &hf_cflow_tcpflags_fin,
4127     NULL
4128 };
4129
4130 static int * const tcp_flags_cwr[] = {
4131     &hf_cflow_tcpflags_cwr,
4132     &hf_cflow_tcpflags_ece,
4133     &hf_cflow_tcpflags_urg,
4134     &hf_cflow_tcpflags_ack,
4135     &hf_cflow_tcpflags_psh,
4136     &hf_cflow_tcpflags_rst,
4137     &hf_cflow_tcpflags_syn,
4138     &hf_cflow_tcpflags_fin,
4139     NULL
4140 };
4141
4142 static int * const tcp_flags16[] = {
4143     &hf_cflow_tcpflags16_zero,
4144     &hf_cflow_tcpflags16_reserved,
4145     &hf_cflow_tcpflags16_ns,
4146     &hf_cflow_tcpflags16_cwr,
4147     &hf_cflow_tcpflags16_ece,
4148     &hf_cflow_tcpflags16_urg,
4149     &hf_cflow_tcpflags16_ack,
4150     &hf_cflow_tcpflags16_psh,
4151     &hf_cflow_tcpflags16_rst,
4152     &hf_cflow_tcpflags16_syn,
4153     &hf_cflow_tcpflags16_fin,
4154     NULL
4155 };
4156
4157 static proto_item *
4158 proto_tree_add_mpls_label(proto_tree *pdutree, tvbuff_t *tvb, int offset, int length, int level)
4159 {
4160     proto_tree *mpls_tree;
4161     proto_item *ti;
4162     if( length == 3) {
4163         uint8_t b0 = tvb_get_uint8(tvb, offset);
4164         uint8_t b1 = tvb_get_uint8(tvb, offset + 1);
4165         uint8_t b2 = tvb_get_uint8(tvb, offset + 2);
4166
4167         uint32_t label = (b0<<12) + (b1<<4) + (b2>>4);
4168         uint8_t  exp   = (b2>>1) & 0x7;
4169         uint8_t  bos   =  b2     & 0x1;
4170
4171         mpls_tree = proto_tree_add_subtree_format(pdutree, tvb, offset, length, ett_mpls_label, &ti,
4172                                                   "MPLS-Label%d: %u exp-bits: %u %s",
4173                                                   level, label, exp, bos ? "bottom-of-stack" : "");
4174         proto_tree_add_item(mpls_tree, hf_cflow_mpls_label, tvb, offset,   3, ENC_BIG_ENDIAN);
4175         proto_tree_add_item(mpls_tree, hf_cflow_mpls_exp,   tvb, offset+2, 1, ENC_BIG_ENDIAN);
4176         proto_tree_add_item(mpls_tree, hf_cflow_mpls_bos,   tvb, offset+2, 1, ENC_NA);
4177
4178     } else {
4179         ti = proto_tree_add_expert_format(pdutree, NULL, &ei_cflow_mpls_label_bad_length,
4180                                           tvb, offset, length,
4181                                           "MPLS-Label%d: bad length %d", level, length);
4182     }
4183     return ti;
4184 }
4185
4186
4187 typedef struct _hdrinfo_t {
4188     uint8_t vspec;
4189     uint32_t src_id;            /* SourceID in NetFlow V9, Observation Domain ID in IPFIX */
4190     time_t  export_time_secs;  /* secs since epoch */
4191 } hdrinfo_t;
4192
4193 typedef int     dissect_pdu_t(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset,
4194                               hdrinfo_t *hdrinfo_p, uint32_t *flows_seen);
4195
4196 static int      dissect_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset,
4197                             hdrinfo_t *hdrinfo_p, uint32_t *flows_seen);
4198 static int      dissect_v8_aggpdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4199                                   int offset, hdrinfo_t *hdrinfo_p, uint32_t *flows_seen);
4200 static int      dissect_v8_flowpdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4201                                    int offset, hdrinfo_t *hdrinfo_p, uint32_t *flows_seen);
4202 static int      dissect_v9_v10_flowset(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4203                                    int offset, hdrinfo_t *hdrinfo_p, uint32_t *flows_seen);
4204 static int      dissect_v9_v10_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4205                                 int offset, uint16_t id, unsigned length, hdrinfo_t *hdrinfo_p,
4206                                 uint32_t *flows_seen);
4207 static unsigned dissect_v9_v10_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4208                                int offset, v9_v10_tmplt_t *tmplt_p, hdrinfo_t *hdrinfo_p,
4209                                uint32_t *flows_seen);
4210 static unsigned dissect_v9_pdu_scope(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4211                                int offset, v9_v10_tmplt_t *tmplt_p);
4212 static unsigned dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4213                                         int offset, v9_v10_tmplt_t *tmplt_p, hdrinfo_t *hdrinfo_p,
4214                                         v9_v10_tmplt_fields_type_t fields_type);
4215 static int      dissect_v9_v10_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4216                                                 int offset, int len, hdrinfo_t *hdrinfo_p, uint16_t flowset_id);
4217 static int      dissect_v9_v10_data_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree,
4218                                     int offset, int len, hdrinfo_t *hdrinfo_p, uint16_t flowset_id);
4219
4220 static const char *getprefix(wmem_allocator_t *pool, const uint32_t *address, unsigned prefix);
4221
4222 static int      flow_process_ints(proto_tree *pdutree, tvbuff_t *tvb,
4223                                   int offset);
4224 static int      flow_process_ports(proto_tree *pdutree, tvbuff_t *tvb,
4225                                    int offset);
4226 static int      flow_process_timeperiod(proto_tree *pdutree, tvbuff_t *tvb,
4227                                         int offset);
4228 static int      flow_process_aspair(proto_tree *pdutree, tvbuff_t *tvb,
4229                                     int offset);
4230 static int      flow_process_sizecount(proto_tree *pdutree, tvbuff_t *tvb,
4231                                        int offset);
4232
4233 static v9_v10_tmplt_t *v9_v10_tmplt_build_key(v9_v10_tmplt_t *tmplt_p, packet_info *pinfo, uint32_t src_id, uint16_t tmplt_id);
4234
4235
4236 static int
4237 flow_process_textfield(proto_tree *pdutree, tvbuff_t *tvb, int offset, int bytes, int hf)
4238 {
4239     proto_tree_add_item(pdutree, hf, tvb, offset, bytes, ENC_NA);
4240     offset += bytes;
4241
4242     return offset;
4243 }
4244
4245
4246 static int
4247 pen_to_type_hf_list(uint32_t pen) {
4248     switch (pen) {
4249     case VENDOR_PLIXER:
4250         return TF_PLIXER;
4251     case VENDOR_NTOP:
4252         return TF_NTOP;
4253     case VENDOR_IXIA:
4254         return TF_IXIA;
4255     case VENDOR_NETSCALER:
4256         return TF_NETSCALER;
4257     case VENDOR_BARRACUDA:
4258         return TF_BARRACUDA;
4259     case VENDOR_GIGAMON:
4260         return TF_GIGAMON;
4261     case VENDOR_CISCO:
4262         return TF_CISCO;
4263     case VENDOR_NIAGARA_NETWORKS:
4264         return TF_NIAGARA_NETWORKS;
4265     case VENDOR_FASTIP:
4266         return TF_FASTIP;
4267     case VENDOR_JUNIPER:
4268         return TF_JUNIPER;
4269     default:
4270         return TF_NO_VENDOR_INFO;
4271     }
4272 }
4273
4274
4275 /****************************************/
4276 /* Sequence analysis                    */
4277 /****************************************/
4278
4279 /* Observation domain -> domain state.  For now, just looking up by observation domain ID.
4280    TODO: consider also including transport info in key?  May be better to store separate
4281    map for each template/set ID inside the domain state? */
4282
4283 typedef struct netflow_domain_state_t {
4284     bool sequence_number_set;
4285     uint32_t current_sequence_number;
4286     uint32_t current_frame_number;
4287 } netflow_domain_state_t;
4288
4289 /* On first pass, check ongoing sequence of observation domain, and only store a result
4290    if the sequence number is not as expected */
4291 static void store_sequence_analysis_info(uint32_t domain_id, uint32_t seqnum, unsigned int version, uint32_t new_flows,
4292                                          packet_info *pinfo)
4293 {
4294     /* Find current domain info */
4295     /* XXX: "Each SCTP Stream counts sequence numbers separately," but
4296      * SCTP conversations are per association. This is correct for TCP
4297      * connections and UDP sessions, though.
4298      */
4299     conversation_t *conv = find_conversation_pinfo(pinfo, 0);
4300     if (conv == NULL) {
4301         return;
4302     }
4303     wmem_map_t *netflow_sequence_analysis_domain_hash = conversation_get_proto_data(conv, proto_netflow);
4304     if (netflow_sequence_analysis_domain_hash == NULL) {
4305         return;
4306     }
4307     netflow_domain_state_t *domain_state = (netflow_domain_state_t *)wmem_map_lookup(netflow_sequence_analysis_domain_hash,
4308                                                                                          GUINT_TO_POINTER(domain_id));
4309     if (domain_state == NULL) {
4310         /* Give up if we haven't seen a template for this domain id yet */
4311         return;
4312     }
4313
4314     /* Store result if not expected sequence.
4315        SequenceNumber represents SN of first flow in current packet, i.e. flows/data-records for previous
4316        frame have now been added (apart from V9, which just counts netflow frames). */
4317     if (domain_state->sequence_number_set &&
4318         (seqnum != domain_state->current_sequence_number)) {
4319
4320         /* Allocate state to remember - a deep copy of current domain */
4321         netflow_domain_state_t *result_state = wmem_new0(wmem_file_scope(), netflow_domain_state_t);
4322         *result_state = *domain_state;
4323
4324         /* Add into result table for current frame number */
4325         p_add_proto_data(wmem_file_scope(), pinfo, proto_netflow, 0, result_state);
4326     }
4327
4328     /* Update domain info for the next frame to consult.
4329        Add flows(data records) for all protocol versions except for 9, which just counts exported frames */
4330     domain_state->current_sequence_number = seqnum + ((version == 9) ? 1 : new_flows);
4331     domain_state->sequence_number_set = true;
4332     domain_state->current_frame_number = pinfo->num;
4333 }
4334
4335 /* Check for result stored indicating that sequence number wasn't as expected, and show in tree */
4336 static void show_sequence_analysis_info(uint32_t domain_id, uint32_t seqnum,
4337                                         packet_info *pinfo, tvbuff_t *tvb,
4338                                         proto_item *flow_sequence_ti, proto_tree *tree)
4339 {
4340     /* Look for info stored for this frame */
4341     netflow_domain_state_t *state = (netflow_domain_state_t *)p_get_proto_data(wmem_file_scope(), pinfo, proto_netflow, 0);
4342     if (state != NULL) {
4343         proto_item *ti;
4344
4345         /* Expected sequence number, i.e. what we stored in state when checking previous frame */
4346         ti = proto_tree_add_uint(tree, hf_cflow_sequence_analysis_expected_sn, tvb,
4347                                  0, 0, state->current_sequence_number);
4348         proto_item_set_generated(ti);
4349         expert_add_info_format(pinfo, flow_sequence_ti, &ei_unexpected_sequence_number,
4350                                "Unexpected flow sequence for domain ID %u (expected %u, got %u)",
4351                                domain_id, state->current_sequence_number, seqnum);
4352
4353         /* Avoid needing to open item to see what expected sequence number was... */
4354         proto_item_append_text(flow_sequence_ti, " (expected %u)", state->current_sequence_number);
4355
4356         /* Previous frame for this observation domain ID */
4357         ti = proto_tree_add_uint(tree, hf_cflow_sequence_analysis_previous_frame, tvb,
4358                                  0, 0, state->current_frame_number);
4359         proto_item_set_generated(ti);
4360     }
4361 }
4362
4363 /* Try to look up the transport name given the pen_type, ip_protocol and port_number.
4364    If found, append to port number item */
4365 static void netflow_add_transport_info(packet_info *pinfo, uint64_t pen_type, uint8_t ip_protocol,
4366                                        uint16_t port_number, proto_item *ti)
4367 {
4368     const char *port_str;
4369
4370     /* UDP */
4371     if ((ip_protocol == IP_PROTO_UDP) || (pen_type == 180) || (pen_type == 181)) {
4372         port_str = udp_port_to_display(pinfo->pool, port_number);
4373     }
4374     /* TCP */
4375     else if ((ip_protocol == IP_PROTO_TCP) || (pen_type == 182) || (pen_type == 183)) {
4376         port_str = tcp_port_to_display(pinfo->pool, port_number);
4377     }
4378     /* SCTP */
4379     else if (ip_protocol == IP_PROTO_SCTP) {
4380         port_str = sctp_port_to_display(pinfo->pool, port_number);
4381     }
4382     else {
4383         /* Didn't match any of these transports, so do nothing */
4384         return;
4385     }
4386
4387     proto_item_append_text(ti, " (%s)", port_str);
4388 }
4389
4390
4391 /* Main dissector function */
4392 static int
4393 dissect_netflow(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
4394 {
4395     proto_tree     *netflow_tree = NULL;
4396     proto_tree     *ti;
4397     proto_item     *timeitem;
4398     proto_tree     *timetree, *pdutree;
4399     unsigned int    pduret, ver, pdus, x;
4400     hdrinfo_t       hdrinfo;
4401     uint32_t        flow_sequence = 0; /* TODO: could be part of hdrinfo struct? */
4402     proto_item      *flow_sequence_ti = NULL;
4403     int             flow_len = -1;    /* v10 only */
4404     unsigned        available, pdusize, offset = 0;
4405     nstime_t        ts;
4406     dissect_pdu_t  *pduptr;
4407     uint32_t        flows_seen = 0;
4408
4409     ws_debug("start");
4410
4411     ver = tvb_get_ntohs(tvb, offset);
4412
4413     ws_debug("found version %d", ver);
4414
4415     switch (ver) {
4416     case 1:
4417         pdusize = V1PDU_SIZE;
4418         pduptr = &dissect_pdu;
4419         break;
4420     case 5:
4421         pdusize = V5PDU_SIZE;
4422         pduptr = &dissect_pdu;
4423         break;
4424     case 7:
4425         pdusize = V7PDU_SIZE;
4426         pduptr = &dissect_pdu;
4427         break;
4428     case 8:
4429         pdusize = -1;   /* deferred */
4430         pduptr = &dissect_v8_aggpdu;
4431         break;
4432     case 9:
4433     case 10: /* IPFIX */
4434         pdusize = -1;   /* deferred */
4435         pduptr = &dissect_v9_v10_flowset;
4436         break;
4437     default:
4438         /*  This does not appear to be a valid netflow packet;
4439          *  return 0 to let another dissector have a chance at
4440          *  dissecting it.
4441          */
4442         return 0;
4443     }
4444
4445     col_set_str(pinfo->cinfo, COL_PROTOCOL, "CFLOW");
4446     col_clear(pinfo->cinfo, COL_INFO);
4447     ws_debug("column cleared");
4448
4449     if (tree) {
4450         ti = proto_tree_add_item(tree, proto_netflow, tvb, offset, -1, ENC_NA);
4451         netflow_tree = proto_item_add_subtree(ti, ett_netflow);
4452     }
4453     ws_debug("tree added");
4454
4455     hdrinfo.vspec = ver;
4456     hdrinfo.src_id = 0;
4457
4458     if (tree)
4459         proto_tree_add_uint(netflow_tree, hf_cflow_version, tvb, offset, 2, ver);
4460     offset += 2;
4461
4462     pdus = tvb_get_ntohs(tvb, offset);
4463     if(ver == 10) {
4464         proto_tree_add_uint(netflow_tree, hf_cflow_len, tvb, offset, 2, pdus);
4465         flow_len = pdus;
4466     } else {
4467         proto_tree_add_uint(netflow_tree, hf_cflow_count, tvb, offset, 2, pdus);
4468     }
4469     offset += 2;
4470
4471     /*
4472      * set something interesting in the display now that we have info
4473      */
4474     if (ver == 9) {
4475         col_add_fstr(pinfo->cinfo, COL_INFO,
4476                         "total: %u (v%u) record%s", pdus, ver,
4477                         plurality(pdus, "", "s"));
4478     } else if (ver == 10) {
4479         int remaining = tvb_reported_length_remaining(tvb, offset) + 4;
4480
4481         if(remaining == flow_len)
4482             col_add_fstr(pinfo->cinfo, COL_INFO, "IPFIX flow (%4d bytes)",
4483                          flow_len);
4484         else
4485             col_add_fstr(pinfo->cinfo, COL_INFO,
4486                             "IPFIX partial flow (%u/%u bytes)",
4487                             remaining, flow_len);
4488     } else {
4489         col_add_fstr(pinfo->cinfo, COL_INFO,
4490                         "total: %u (v%u) flow%s", pdus, ver,
4491                         plurality(pdus, "", "s"));
4492     }
4493
4494     /*
4495      * The rest is only interesting if we're displaying/searching the
4496      * packet or if V9/V10 so we need to keep going to find any templates
4497      */
4498     if ( (ver != 9) && (ver != 10) && !tree )
4499         return tvb_reported_length(tvb);
4500
4501     if(ver != 10) {
4502         uint32_t sysuptime = tvb_get_ntohl(tvb, offset);
4503         nstime_t nsuptime;
4504
4505         nsuptime.secs = sysuptime / 1000;
4506         nsuptime.nsecs = (sysuptime % 1000) * 1000000;
4507         proto_tree_add_time(netflow_tree, hf_cflow_sysuptime, tvb,
4508                             offset, 4, &nsuptime);
4509         offset += 4;
4510     }
4511
4512     ts.secs = tvb_get_ntohl(tvb, offset);
4513     hdrinfo.export_time_secs = ts.secs;
4514
4515     if ((ver != 9) && (ver != 10)) {
4516         ts.nsecs = tvb_get_ntohl(tvb, offset + 4);
4517         timeitem = proto_tree_add_time(netflow_tree,
4518                                        hf_cflow_timestamp, tvb, offset,
4519                                        8, &ts);
4520     } else {
4521         ts.nsecs = 0;
4522         timeitem = proto_tree_add_time(netflow_tree,
4523                                        hf_cflow_timestamp, tvb, offset,
4524                                        4, &ts);
4525     }
4526
4527     timetree = proto_item_add_subtree(timeitem, ett_unixtime);
4528
4529     proto_tree_add_item(timetree,
4530                         (ver == 10) ? hf_cflow_exporttime : hf_cflow_unix_secs,
4531                         tvb, offset, 4, ENC_BIG_ENDIAN);
4532
4533     offset += 4;
4534
4535     if ((ver != 9) && (ver != 10)) {
4536         proto_tree_add_item(timetree, hf_cflow_unix_nsecs, tvb,
4537                             offset, 4, ENC_BIG_ENDIAN);
4538         offset += 4;
4539     }
4540
4541     /*
4542      * version specific header
4543      */
4544     if (ver == 5 || ver == 7 || ver == 8 || ver == 9 || ver == 10) {
4545         flow_sequence = tvb_get_ntohl(tvb, offset);
4546         flow_sequence_ti = proto_tree_add_item(netflow_tree, hf_cflow_sequence,
4547                                                tvb, offset, 4, ENC_BIG_ENDIAN);
4548         offset += 4;
4549     }
4550     if (ver == 5 || ver == 8) {
4551         proto_tree_add_item(netflow_tree, hf_cflow_engine_type,
4552                             tvb, offset++, 1, ENC_BIG_ENDIAN);
4553         proto_tree_add_item(netflow_tree, hf_cflow_engine_id,
4554                             tvb, offset++, 1, ENC_BIG_ENDIAN);
4555     } else if ((ver == 9) || (ver == 10)) {
4556         proto_tree_add_item(netflow_tree,
4557                             (ver == 9) ? hf_cflow_source_id : hf_cflow_od_id,
4558                             tvb, offset, 4, ENC_BIG_ENDIAN);
4559         hdrinfo.src_id = tvb_get_ntohl(tvb, offset);
4560         col_append_fstr(pinfo->cinfo, COL_INFO, " Obs-Domain-ID=%5u",
4561                         hdrinfo.src_id);
4562         offset += 4;
4563     }
4564     if (ver == 8) {
4565         hdrinfo.vspec = tvb_get_uint8(tvb, offset);
4566         switch (hdrinfo.vspec) {
4567         case V8PDU_AS_METHOD:
4568             pdusize = V8PDU_AS_SIZE;
4569             break;
4570         case V8PDU_PROTO_METHOD:
4571             pdusize = V8PDU_PROTO_SIZE;
4572             break;
4573         case V8PDU_SPREFIX_METHOD:
4574             pdusize = V8PDU_SPREFIX_SIZE;
4575             break;
4576         case V8PDU_DPREFIX_METHOD:
4577             pdusize = V8PDU_DPREFIX_SIZE;
4578             break;
4579         case V8PDU_MATRIX_METHOD:
4580             pdusize = V8PDU_MATRIX_SIZE;
4581             break;
4582         case V8PDU_DESTONLY_METHOD:
4583             pdusize = V8PDU_DESTONLY_SIZE;
4584             pduptr = &dissect_v8_flowpdu;
4585             break;
4586         case V8PDU_SRCDEST_METHOD:
4587             pdusize = V8PDU_SRCDEST_SIZE;
4588             pduptr = &dissect_v8_flowpdu;
4589             break;
4590         case V8PDU_FULL_METHOD:
4591             pdusize = V8PDU_FULL_SIZE;
4592             pduptr = &dissect_v8_flowpdu;
4593             break;
4594         case V8PDU_TOSAS_METHOD:
4595             pdusize = V8PDU_TOSAS_SIZE;
4596             break;
4597         case V8PDU_TOSPROTOPORT_METHOD:
4598             pdusize = V8PDU_TOSPROTOPORT_SIZE;
4599             break;
4600         case V8PDU_TOSSRCPREFIX_METHOD:
4601             pdusize = V8PDU_TOSSRCPREFIX_SIZE;
4602             break;
4603         case V8PDU_TOSDSTPREFIX_METHOD:
4604             pdusize = V8PDU_TOSDSTPREFIX_SIZE;
4605             break;
4606         case V8PDU_TOSMATRIX_METHOD:
4607             pdusize = V8PDU_TOSMATRIX_SIZE;
4608             break;
4609         case V8PDU_PREPORTPROTOCOL_METHOD:
4610             pdusize = V8PDU_PREPORTPROTOCOL_SIZE;
4611             break;
4612         default:
4613             pdusize = -1;
4614             hdrinfo.vspec = 0;
4615             break;
4616         }
4617         proto_tree_add_uint(netflow_tree, hf_cflow_aggmethod,
4618                             tvb, offset++, 1, hdrinfo.vspec);
4619         proto_tree_add_item(netflow_tree, hf_cflow_aggversion,
4620                             tvb, offset++, 1, ENC_BIG_ENDIAN);
4621     }
4622     if (ver == 7 || ver == 8)
4623         offset = flow_process_textfield(netflow_tree, tvb, offset, 4, hf_cflow_reserved);
4624     else if (ver == 5) {
4625         proto_tree_add_item(netflow_tree, hf_cflow_samplingmode,
4626                             tvb, offset, 2, ENC_BIG_ENDIAN);
4627         proto_tree_add_item(netflow_tree, hf_cflow_samplerate,
4628                             tvb, offset, 2, ENC_BIG_ENDIAN);
4629         offset += 2;
4630     }
4631
4632     if (pdus == 0) { /* no payload to decode - in theory */
4633         /* This is absurd, but does happen in practice.  */
4634         proto_tree_add_expert_format(netflow_tree, NULL, &ei_cflow_flowsets_impossible,
4635                                      tvb, offset, tvb_reported_length_remaining(tvb, offset),
4636                                      "FlowSets impossible - PDU Count is %d", pdus);
4637         return tvb_reported_length(tvb);
4638     }
4639     /*
4640      * everything below here should be payload
4641      */
4642     available = tvb_reported_length_remaining(tvb, offset);
4643     for (x = 1; ((ver != 10) && (x < pdus + 1)) || ((ver == 10) && ((available - pdusize) > 0)); x++) {
4644         /*
4645          * make sure we have a pdu's worth of data
4646          */
4647         available = tvb_reported_length_remaining(tvb, offset);
4648         if(((ver == 9) || (ver == 10)) && available >= 4) {
4649             /* pdusize can be different for each v9/v10 flowset */
4650             pdusize = tvb_get_ntohs(tvb, offset + 2);
4651         }
4652
4653         if (available < pdusize)
4654             break;
4655
4656         if ((ver == 9) || (ver == 10)) {
4657             pdutree = proto_tree_add_subtree_format(netflow_tree, tvb, offset, pdusize, ett_flow, NULL,
4658                                                     (ver == 9) ? "FlowSet %u" : "Set %u", x);
4659         } else {
4660             pdutree = proto_tree_add_subtree_format(netflow_tree, tvb, offset, pdusize, ett_flow, NULL,
4661                                                     "pdu %u/%u", x, pdus);
4662         }
4663
4664         /* Call callback function depending upon protocol version/spec */
4665         pduret = pduptr(tvb, pinfo, pdutree, offset, &hdrinfo, &flows_seen);
4666
4667         if (pduret < pdusize) pduret = pdusize; /* padding */
4668
4669         /*
4670          * if we came up short, stop processing
4671          */
4672         if ((pduret == pdusize) && (pduret != 0))
4673             offset += pduret;
4674         else
4675             break;
4676     }
4677
4678     /* Can only check sequence analysis once have seen how many flows were reported across
4679        all data sets (flows are not dissected if no template for set is present).
4680        N.B. will currently only work for v9 and v10 as earlier versions don't fill in src_id from
4681        observation domain id. */
4682     if ((ver == 5) || (ver == 7) || (ver == 8)  || (ver == 9) || (ver == 10)) {
4683         /* On first pass check sequence analysis */
4684         if (!pinfo->fd->visited) {
4685             if (ver != 10) {
4686                 flows_seen = pdus;  /* i.e. use value from header rather than counted value */
4687             }
4688             store_sequence_analysis_info(hdrinfo.src_id, flow_sequence, ver, flows_seen, pinfo);
4689         }
4690         /* Show any stored sequence analysis results */
4691         show_sequence_analysis_info(hdrinfo.src_id, flow_sequence, pinfo, tvb, flow_sequence_ti, netflow_tree);
4692     }
4693
4694     return tvb_reported_length(tvb);
4695 }
4696
4697 /*
4698  * flow_process_* == common groups of fields, probably could be inline
4699  */
4700
4701 static int
4702 flow_process_ints(proto_tree *pdutree, tvbuff_t *tvb, int offset)
4703 {
4704     proto_tree_add_item(pdutree, hf_cflow_inputint, tvb, offset, 2, ENC_BIG_ENDIAN);
4705     offset += 2;
4706
4707     proto_tree_add_item(pdutree, hf_cflow_outputint, tvb, offset, 2,
4708                         ENC_BIG_ENDIAN);
4709     offset += 2;
4710
4711     return offset;
4712 }
4713
4714 static int
4715 flow_process_ports(proto_tree *pdutree, tvbuff_t *tvb, int offset)
4716 {
4717     proto_tree_add_item(pdutree, hf_cflow_srcport, tvb, offset, 2, ENC_BIG_ENDIAN);
4718     offset += 2;
4719
4720     proto_tree_add_item(pdutree, hf_cflow_dstport, tvb, offset, 2, ENC_BIG_ENDIAN);
4721     offset += 2;
4722
4723     return offset;
4724 }
4725
4726 static int
4727 flow_process_timeperiod(proto_tree *pdutree, tvbuff_t *tvb, int offset)
4728 {
4729     nstime_t    ts_start, ts_end;
4730     int         offset_s, offset_e;
4731     nstime_t    ts_delta;
4732     uint32_t    msec_start, msec_end;
4733     uint32_t    msec_delta;
4734     proto_tree *timetree;
4735     proto_item *timeitem;
4736
4737
4738     msec_start = tvb_get_ntohl(tvb, offset);
4739     ts_start.secs = msec_start / 1000;
4740     ts_start.nsecs = (msec_start % 1000) * 1000000;
4741     offset_s = offset;
4742     offset += 4;
4743
4744     msec_end = tvb_get_ntohl(tvb, offset);
4745     ts_end.secs = msec_end / 1000;
4746     ts_end.nsecs = (msec_end % 1000) * 1000000;
4747     offset_e = offset;
4748     offset += 4;
4749
4750     msec_delta = msec_end - msec_start;
4751     ts_delta.secs = msec_delta / 1000;
4752     ts_delta.nsecs = (msec_delta % 1000) * 1000000;
4753
4754
4755     timeitem = proto_tree_add_time(pdutree, hf_cflow_timedelta, tvb,
4756                                    offset_s, 8, &ts_delta);
4757     proto_item_set_generated(timeitem);
4758     timetree = proto_item_add_subtree(timeitem, ett_flowtime);
4759
4760     proto_tree_add_time(timetree, hf_cflow_timestart, tvb, offset_s, 4,
4761                         &ts_start);
4762     proto_tree_add_time(timetree, hf_cflow_timeend, tvb, offset_e, 4,
4763                         &ts_end);
4764
4765     return offset;
4766 }
4767
4768
4769 static int
4770 flow_process_aspair(proto_tree *pdutree, tvbuff_t *tvb, int offset)
4771 {
4772     proto_tree_add_item(pdutree, hf_cflow_srcas, tvb, offset, 2, ENC_BIG_ENDIAN);
4773     offset += 2;
4774
4775     proto_tree_add_item(pdutree, hf_cflow_dstas, tvb, offset, 2, ENC_BIG_ENDIAN);
4776     offset += 2;
4777
4778     return offset;
4779 }
4780
4781 static int
4782 flow_process_sizecount(proto_tree *pdutree, tvbuff_t *tvb, int offset)
4783 {
4784     proto_tree_add_item(pdutree, hf_cflow_packets, tvb, offset, 4, ENC_BIG_ENDIAN);
4785     offset += 4;
4786
4787     proto_tree_add_item(pdutree, hf_cflow_octets, tvb, offset, 4, ENC_BIG_ENDIAN);
4788     offset += 4;
4789
4790     return offset;
4791 }
4792
4793 static int
4794 dissect_v8_flowpdu(tvbuff_t *tvb _U_, packet_info *pinfo _U_, proto_tree *pdutree, int offset,
4795                    hdrinfo_t *hdrinfo_p, uint32_t *flows_seen _U_)
4796 {
4797     int      startoffset = offset;
4798     uint8_t  verspec;
4799
4800     proto_tree_add_item(pdutree, hf_cflow_dstaddr, tvb, offset, 4, ENC_BIG_ENDIAN);
4801     offset += 4;
4802
4803     verspec = hdrinfo_p->vspec;
4804
4805     if (verspec != V8PDU_DESTONLY_METHOD) {
4806         proto_tree_add_item(pdutree, hf_cflow_srcaddr, tvb, offset, 4,
4807                             ENC_BIG_ENDIAN);
4808         offset += 4;
4809     }
4810     if (verspec == V8PDU_FULL_METHOD) {
4811         proto_tree_add_item(pdutree, hf_cflow_dstport, tvb, offset, 2,
4812                             ENC_BIG_ENDIAN);
4813         offset += 2;
4814         proto_tree_add_item(pdutree, hf_cflow_srcport, tvb, offset, 2,
4815                             ENC_BIG_ENDIAN);
4816         offset += 2;
4817     }
4818
4819     offset = flow_process_sizecount(pdutree, tvb, offset);
4820     offset = flow_process_timeperiod(pdutree, tvb, offset);
4821
4822     proto_tree_add_item(pdutree, hf_cflow_outputint, tvb, offset, 2,
4823                         ENC_BIG_ENDIAN);
4824     offset += 2;
4825
4826     if (verspec != V8PDU_DESTONLY_METHOD) {
4827         proto_tree_add_item(pdutree, hf_cflow_inputint, tvb, offset, 2, ENC_BIG_ENDIAN);
4828         offset += 2;
4829     }
4830
4831     proto_tree_add_item(pdutree, hf_cflow_tos, tvb, offset++, 1, ENC_BIG_ENDIAN);
4832     if (verspec == V8PDU_FULL_METHOD)
4833         proto_tree_add_item(pdutree, hf_cflow_prot, tvb, offset++, 1, ENC_BIG_ENDIAN);
4834     offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_marked_tos);
4835
4836     if (verspec == V8PDU_SRCDEST_METHOD)
4837         offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_reserved);
4838     else if (verspec == V8PDU_FULL_METHOD)
4839         offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_padding);
4840
4841     offset = flow_process_textfield(pdutree, tvb, offset, 4, hf_cflow_extra_packets);
4842
4843     proto_tree_add_item(pdutree, hf_cflow_routersc, tvb, offset, 4, ENC_BIG_ENDIAN);
4844     offset += 4;
4845
4846     return (offset - startoffset);
4847 }
4848
4849 /*
4850  * dissect a version 8 pdu, returning the length of the pdu processed
4851  */
4852
4853 static int
4854 dissect_v8_aggpdu(tvbuff_t *tvb _U_, packet_info *pinfo _U_, proto_tree *pdutree, int offset,
4855                   hdrinfo_t *hdrinfo_p, uint32_t *flows_seen _U_)
4856 {
4857     int      startoffset = offset;
4858     uint8_t  verspec;
4859     int      local_cflow_as;   /* hf_cflow_srcas     || hf_cflow_dstas    */
4860     int      local_cflow_net;  /* hf_cflow_srcnet    || hf_cflow_dstnet   */
4861     int      local_cflow_int;  /* hf_cflow_outputint || hf_cflow_inputint */
4862     int      local_cflow_mask; /* hf_cflow_srcmask   || hf_cflow_dstmask  */
4863
4864     proto_tree_add_item(pdutree, hf_cflow_flows, tvb, offset, 4, ENC_BIG_ENDIAN);
4865     offset += 4;
4866
4867     offset = flow_process_sizecount(pdutree, tvb, offset);
4868     offset = flow_process_timeperiod(pdutree, tvb, offset);
4869
4870     verspec = hdrinfo_p->vspec;
4871
4872     switch (verspec) {
4873
4874     case V8PDU_AS_METHOD:
4875     case V8PDU_TOSAS_METHOD:
4876         offset = flow_process_aspair(pdutree, tvb, offset);
4877
4878         offset = flow_process_ints(pdutree, tvb, offset);
4879
4880         if (verspec == V8PDU_TOSAS_METHOD) {
4881             proto_tree_add_item(pdutree, hf_cflow_tos, tvb,
4882                                 offset++, 1, ENC_BIG_ENDIAN);
4883             offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_padding);
4884             offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_reserved);
4885         }
4886
4887         break;
4888
4889     case V8PDU_PROTO_METHOD:
4890     case V8PDU_TOSPROTOPORT_METHOD:
4891         proto_tree_add_item(pdutree, hf_cflow_prot, tvb, offset++, 1, ENC_BIG_ENDIAN);
4892
4893         if (verspec == V8PDU_PROTO_METHOD)
4894             offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_padding);
4895         else if (verspec == V8PDU_TOSPROTOPORT_METHOD)
4896             proto_tree_add_item(pdutree, hf_cflow_tos, tvb, offset++, 1, ENC_BIG_ENDIAN);
4897
4898         offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_reserved);
4899         offset = flow_process_ports(pdutree, tvb, offset);
4900
4901         if (verspec == V8PDU_TOSPROTOPORT_METHOD)
4902             offset = flow_process_ints(pdutree, tvb, offset);
4903         break;
4904
4905     case V8PDU_SPREFIX_METHOD:
4906     case V8PDU_DPREFIX_METHOD:
4907     case V8PDU_TOSSRCPREFIX_METHOD:
4908     case V8PDU_TOSDSTPREFIX_METHOD:
4909         switch (verspec) {
4910         case V8PDU_SPREFIX_METHOD:
4911         case V8PDU_TOSSRCPREFIX_METHOD:
4912             local_cflow_net  = hf_cflow_srcnet;
4913             local_cflow_mask = hf_cflow_srcmask;
4914             local_cflow_as   = hf_cflow_srcas;
4915             local_cflow_int  = hf_cflow_inputint;
4916             break;
4917         case V8PDU_DPREFIX_METHOD:
4918         case V8PDU_TOSDSTPREFIX_METHOD:
4919         default:        /* stop warning that :
4920                            'local_cflow_*' may be used
4921                            uninitialized in this function */
4922             local_cflow_net  = hf_cflow_dstnet;
4923             local_cflow_mask = hf_cflow_dstmask;
4924             local_cflow_as   = hf_cflow_dstas;
4925             local_cflow_int  = hf_cflow_outputint;
4926             break;
4927         }
4928
4929         proto_tree_add_item(pdutree, local_cflow_net, tvb, offset, 4, ENC_NA);
4930         offset += 4;
4931
4932         proto_tree_add_item(pdutree, local_cflow_mask, tvb, offset++, 1, ENC_NA);
4933
4934         if ((verspec == V8PDU_SPREFIX_METHOD) || (verspec == V8PDU_DPREFIX_METHOD))
4935             offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_padding);
4936
4937         else if ((verspec == V8PDU_TOSSRCPREFIX_METHOD) || (verspec == V8PDU_TOSDSTPREFIX_METHOD))
4938             proto_tree_add_item(pdutree, hf_cflow_tos, tvb, offset++, 1, ENC_BIG_ENDIAN);
4939
4940         proto_tree_add_item(pdutree, local_cflow_as, tvb, offset, 2, ENC_BIG_ENDIAN);
4941         offset += 2;
4942
4943         proto_tree_add_item(pdutree, local_cflow_int, tvb, offset, 2, ENC_BIG_ENDIAN);
4944         offset += 2;
4945
4946         offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_reserved);
4947         break;
4948
4949     case V8PDU_MATRIX_METHOD:
4950     case V8PDU_TOSMATRIX_METHOD:
4951     case V8PDU_PREPORTPROTOCOL_METHOD:
4952         proto_tree_add_item(pdutree, hf_cflow_srcnet, tvb, offset, 4, ENC_BIG_ENDIAN);
4953         offset += 4;
4954
4955         proto_tree_add_item(pdutree, hf_cflow_dstnet, tvb, offset, 4, ENC_BIG_ENDIAN);
4956         offset += 4;
4957
4958         proto_tree_add_item(pdutree, hf_cflow_dstmask, tvb, offset++, 1, ENC_BIG_ENDIAN);
4959
4960         proto_tree_add_item(pdutree, hf_cflow_srcmask, tvb, offset++, 1, ENC_BIG_ENDIAN);
4961
4962         if ((verspec == V8PDU_TOSMATRIX_METHOD) ||
4963             (verspec == V8PDU_PREPORTPROTOCOL_METHOD)) {
4964             proto_tree_add_item(pdutree, hf_cflow_tos, tvb, offset++, 1, ENC_BIG_ENDIAN);
4965             if (verspec == V8PDU_TOSMATRIX_METHOD) {
4966                 offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_padding);
4967             } else if (verspec == V8PDU_PREPORTPROTOCOL_METHOD) {
4968                 proto_tree_add_item(pdutree, hf_cflow_prot, tvb, offset++, 1, ENC_BIG_ENDIAN);
4969             }
4970         } else {
4971             offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_reserved);
4972         }
4973
4974         if ((verspec == V8PDU_MATRIX_METHOD)
4975             || (verspec == V8PDU_TOSMATRIX_METHOD)) {
4976             offset = flow_process_aspair(pdutree, tvb, offset);
4977         } else if (verspec == V8PDU_PREPORTPROTOCOL_METHOD) {
4978             offset = flow_process_ports(pdutree, tvb, offset);
4979         }
4980
4981         offset = flow_process_ints(pdutree, tvb, offset);
4982         break;
4983     }
4984
4985     return (offset - startoffset);
4986 }
4987
4988 /* Dissect a version 9 FlowSet and return the length we processed. */
4989
4990 static int
4991 dissect_v9_v10_flowset(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int offset,
4992                        hdrinfo_t *hdrinfo_p, uint32_t *flows_seen)
4993 {
4994     proto_item *pi;
4995     int     length;
4996     uint16_t flowset_id;
4997     uint8_t ver;
4998
4999     ver = hdrinfo_p->vspec;
5000
5001     if ((ver != 9) && (ver != 10))
5002         return 0;
5003
5004     flowset_id = tvb_get_ntohs(tvb, offset);
5005     length = tvb_get_ntohs(tvb, offset + 2);
5006
5007     proto_tree_add_item(pdutree, hf_cflow_flowset_id, tvb, offset, 2, ENC_BIG_ENDIAN);
5008     offset += 2;
5009     proto_item_append_text(pdutree, " [id=%u]", flowset_id);
5010
5011     pi = proto_tree_add_item(pdutree, hf_cflow_flowset_length, tvb, offset, 2, ENC_BIG_ENDIAN);
5012     offset += 2;
5013
5014     if (length < 4) {
5015         expert_add_info_format(pinfo, pi, &ei_cflow_flowset_length,
5016                                "Flowset Length (%u) too short", length);
5017         return tvb_reported_length_remaining(tvb, offset-4);
5018     }
5019
5020     switch (flowset_id) {
5021     case FLOWSET_ID_V9_DATA_TEMPLATE:
5022     case FLOWSET_ID_V10_DATA_TEMPLATE:
5023         dissect_v9_v10_data_template(tvb, pinfo, pdutree, offset, length - 4, hdrinfo_p, flowset_id);
5024         break;
5025     case FLOWSET_ID_V9_OPTIONS_TEMPLATE:
5026     case FLOWSET_ID_V10_OPTIONS_TEMPLATE:
5027         dissect_v9_v10_options_template(tvb, pinfo, pdutree, offset, length - 4, hdrinfo_p, flowset_id);
5028         break;
5029     default:
5030         if (flowset_id >= FLOWSET_ID_DATA_MIN) {
5031             col_append_fstr(pinfo->cinfo, COL_INFO, " [Data:%u]", flowset_id);
5032             dissect_v9_v10_data(tvb, pinfo, pdutree, offset, flowset_id, (unsigned)length - 4, hdrinfo_p, flows_seen);
5033         }
5034         break;
5035     }
5036
5037     return (length);
5038 }
5039
5040 static int
5041 dissect_v9_v10_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int offset,
5042                     uint16_t id, unsigned length, hdrinfo_t *hdrinfo_p, uint32_t *flows_seen)
5043 {
5044     v9_v10_tmplt_t *tmplt_p;
5045     v9_v10_tmplt_t  tmplt_key;
5046     proto_tree     *data_tree;
5047     unsigned        pdu_len;
5048
5049     if (length == 0) {
5050         expert_add_info(pinfo, proto_tree_get_parent(pdutree), &ei_cflow_no_flow_information);
5051     }
5052
5053     /* Look up template */
5054     v9_v10_tmplt_build_key(&tmplt_key, pinfo, hdrinfo_p->src_id, id);
5055     tmplt_p = (v9_v10_tmplt_t *)wmem_map_lookup(v9_v10_tmplt_table, &tmplt_key);
5056     if ((tmplt_p != NULL)  && (tmplt_p->length != 0)) {
5057         int count = 1;
5058         proto_item *ti;
5059
5060         /* Provide a link back to template frame */
5061         ti = proto_tree_add_uint(pdutree, hf_template_frame, tvb,
5062                                  0, 0, tmplt_p->template_frame_number);
5063         if (tmplt_p->template_frame_number > pinfo->num) {
5064             proto_item_append_text(ti, " (received after this frame)");
5065         }
5066         proto_item_set_generated(ti);
5067
5068         /* Note: If the flow contains variable length fields then          */
5069         /*       tmplt_p->length will be less then actual length of the flow. */
5070         while (length >= tmplt_p->length) {
5071             data_tree = proto_tree_add_subtree_format(pdutree, tvb, offset, tmplt_p->length,
5072                                             ett_dataflowset, NULL, "Flow %d", count++);
5073
5074             pdu_len = dissect_v9_v10_pdu(tvb, pinfo, data_tree, offset, tmplt_p, hdrinfo_p, flows_seen);
5075
5076             offset += pdu_len;
5077             /* XXX - Throw an exception */
5078             length -= (pdu_len < length) ? pdu_len : length;
5079         }
5080         proto_item_append_text(pdutree, " (%u flows)", count-1);
5081         if (length != 0) {
5082             proto_tree_add_item(pdutree, hf_cflow_padding, tvb, offset, length, ENC_NA);
5083         }
5084     } else {
5085         proto_tree_add_expert_format(pdutree, NULL, &ei_cflow_no_template_found,
5086                                      tvb, offset, length,
5087                                      "Data (%u byte%s), no template found",
5088                                      length, plurality(length, "", "s"));
5089     }
5090
5091     return 0;
5092 }
5093
5094 #define GOT_LOCAL_ADDR  (1 << 0)
5095 #define GOT_REMOTE_ADDR (1 << 1)
5096 #define GOT_LOCAL_PORT  (1 << 2)
5097 #define GOT_REMOTE_PORT (1 << 3)
5098 #define GOT_IPv4_ID     (1 << 4)
5099 #define GOT_ICMP_ID     (1 << 5)
5100 #define GOT_UID         (1 << 6)
5101 #define GOT_PID         (1 << 7)
5102 #define GOT_USERNAME    (1 << 8)
5103 #define GOT_COMMAND     (1 << 9)
5104
5105 #define GOT_BASE ( \
5106         GOT_LOCAL_ADDR | \
5107         GOT_REMOTE_ADDR | \
5108         GOT_UID | \
5109         GOT_PID | \
5110         GOT_USERNAME | \
5111         GOT_COMMAND \
5112         )
5113
5114 #define GOT_TCP_UDP (GOT_BASE | GOT_LOCAL_PORT | GOT_REMOTE_PORT)
5115 #define GOT_ICMP    (GOT_BASE | GOT_IPv4_ID    | GOT_ICMP_ID)
5116
5117 static unsigned
5118 dissect_v9_v10_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int offset,
5119                    v9_v10_tmplt_t *tmplt_p, hdrinfo_t *hdrinfo_p, uint32_t *flows_seen)
5120 {
5121     int orig_offset = offset;
5122
5123     if ((tmplt_p->fields_p[TF_SCOPES] != NULL)
5124         && (tmplt_p->field_count[TF_SCOPES] > 0)) {
5125         if (hdrinfo_p->vspec == 9) {
5126             offset += dissect_v9_pdu_scope(tvb, pinfo, pdutree, offset, tmplt_p);
5127         } else if (hdrinfo_p->vspec == 10) {
5128             offset += dissect_v9_v10_pdu_data(tvb, pinfo, pdutree, offset, tmplt_p, hdrinfo_p, TF_SCOPES);
5129         }
5130     }
5131     offset += dissect_v9_v10_pdu_data(tvb, pinfo, pdutree, offset, tmplt_p, hdrinfo_p, TF_ENTRIES);
5132
5133     /* Inc number of flows seen in this overall PDU */
5134     (*flows_seen)++;
5135     return (unsigned) (offset - orig_offset);
5136 }
5137
5138 static unsigned
5139 dissect_v9_pdu_scope(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *pdutree, int offset,
5140                      v9_v10_tmplt_t *tmplt_p)
5141 {
5142     int   orig_offset;
5143     int   i;
5144
5145     DISSECTOR_ASSERT(tmplt_p->fields_p[TF_SCOPES] != NULL);
5146
5147     orig_offset = offset;
5148
5149     for(i = 0; i < tmplt_p->field_count[TF_SCOPES]; i++) {
5150         uint16_t type   = tmplt_p->fields_p[TF_SCOPES][i].type;
5151         uint16_t length = tmplt_p->fields_p[TF_SCOPES][i].length;
5152         if (length == 0) { /* XXX: Zero length fields probably shouldn't be included in the cached template */
5153             /* YYY: Maybe.  If you don't cache the zero length fields can you still compare that you actually  */
5154             /*      have the same template with the same ID. */
5155             continue;
5156         }
5157         switch (type) {
5158             /* XXX: template length fields should be validated during template processing ... */
5159         case 1: /* system */
5160             proto_tree_add_item(pdutree, hf_cflow_scope_system,
5161                                 tvb, offset, length, ENC_NA);
5162             break;
5163         case 2: /* interface */
5164             proto_tree_add_item(pdutree, hf_cflow_scope_interface,
5165                                 tvb, offset, length, ENC_BIG_ENDIAN);
5166             break;
5167         case 3: /* linecard */
5168             proto_tree_add_item(pdutree, hf_cflow_scope_linecard,
5169                                 tvb, offset, length, ENC_BIG_ENDIAN);
5170             break;
5171         case 4: /* netflow cache */
5172             proto_tree_add_item(pdutree, hf_cflow_scope_cache,
5173                                 tvb, offset, length, ENC_NA);
5174             break;
5175         case 5: /* tmplt */
5176             proto_tree_add_item(pdutree, hf_cflow_scope_template,
5177                                 tvb, offset, length, ENC_NA);
5178             break;
5179         default: /* unknown */
5180             proto_tree_add_item(pdutree, hf_cflow_unknown_field_type,
5181                                 tvb, offset, length, ENC_NA);
5182             break;
5183         }
5184         offset += length;
5185     }
5186     return (unsigned) (offset - orig_offset);
5187 }
5188
5189 /* Type of duration being calculated for a flow. */
5190 enum duration_type_e {
5191     duration_type_switched,
5192     duration_type_seconds,
5193     duration_type_milliseconds,
5194     duration_type_microseconds,
5195     duration_type_nanoseconds,
5196     duration_type_delta_milliseconds,
5197     duration_type_max    /* not used - for sizing only */
5198 };
5199
5200 /* SubTemplateList reference https://tools.ietf.org/html/rfc6313#section-4.5.2 */
5201 static void
5202 // NOLINTNEXTLINE(misc-no-recursion)
5203 dissect_v10_pdu_subtemplate_list(tvbuff_t* tvb, packet_info* pinfo, proto_item* pduitem, int offset,
5204                                  uint16_t length, hdrinfo_t* hdrinfo_p)
5205 {
5206     int            start_offset = offset;
5207     int            end_offset   = offset + length;
5208     uint32_t       semantic, subtemplate_id;
5209     v9_v10_tmplt_t *subtmplt_p;
5210     v9_v10_tmplt_t  tmplt_key;
5211     proto_tree     *pdutree = proto_item_add_subtree(pduitem, ett_subtemplate_list);
5212
5213     proto_tree_add_item_ret_uint(pdutree, hf_cflow_subtemplate_semantic, tvb, offset, 1, ENC_BIG_ENDIAN, &semantic);
5214     proto_tree_add_item_ret_uint(pdutree, hf_cflow_subtemplate_id, tvb, offset+1, 2, ENC_BIG_ENDIAN, &subtemplate_id);
5215     proto_item_append_text(pdutree, " (semantic = %u, subtemplate-id = %u)", semantic, subtemplate_id);
5216     offset += 3;
5217
5218     /* Look up template */
5219     v9_v10_tmplt_build_key(&tmplt_key, pinfo, hdrinfo_p->src_id, subtemplate_id);
5220     subtmplt_p = (v9_v10_tmplt_t *)wmem_map_lookup(v9_v10_tmplt_table, &tmplt_key);
5221
5222     if (subtmplt_p != NULL) {
5223         proto_item *ti;
5224         int        count = 1;
5225         proto_tree *sub_tree;
5226         unsigned   consumed;
5227
5228         /* Provide a link back to template frame */
5229         ti = proto_tree_add_uint(pdutree, hf_template_frame, tvb,
5230                                  0, 0, subtmplt_p->template_frame_number);
5231         if (subtmplt_p->template_frame_number > pinfo->num) {
5232             proto_item_append_text(ti, " (received after this frame)");
5233         }
5234         proto_item_set_generated(ti);
5235
5236         increment_dissection_depth(pinfo);
5237         while (offset < end_offset) {
5238             sub_tree = proto_tree_add_subtree_format(pdutree, tvb, offset, subtmplt_p->length,
5239                                                      ett_subtemplate_list, NULL, "List Item %d", count++);
5240             consumed = dissect_v9_v10_pdu_data(tvb, pinfo, sub_tree, offset, subtmplt_p, hdrinfo_p, TF_ENTRIES);
5241             if (0 == consumed) {
5242                 /* To protect against infinite loop in case of malformed records with
5243                    0 length template or tmplt_p->fields_p[1] == NULL or tmplt_p->field_count == 0
5244                 */
5245                 break;
5246             }
5247             offset += consumed;
5248         }
5249         decrement_dissection_depth(pinfo);
5250         if (offset != end_offset) {
5251             int data_bytes = offset - start_offset;
5252             proto_tree_add_expert_format(pdutree, NULL, &ei_cflow_subtemplate_bad_length,
5253                                          tvb, offset, length,
5254                                          "Field Length (%u bytes), Data Found (%u byte%s)",
5255                                          length, data_bytes, plurality(data_bytes, "", "s"));
5256         }
5257     } else {
5258         proto_tree_add_expert_format(pdutree, NULL, &ei_cflow_no_template_found,
5259                                      tvb, offset, length,
5260                                      "Subtemplate Data (%u byte%s), template %u not found",
5261                                      length, plurality(length, "", "s"), subtemplate_id);
5262     }
5263 }
5264
5265 static unsigned
5266 // NOLINTNEXTLINE(misc-no-recursion)
5267 dissect_v9_v10_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int offset,
5268                         v9_v10_tmplt_t *tmplt_p, hdrinfo_t *hdrinfo_p, v9_v10_tmplt_fields_type_t fields_type)
5269 {
5270     int                   orig_offset;
5271     int                   rev;
5272     nstime_t              ts_start[2][duration_type_max], ts_end[2][duration_type_max];
5273     int                   offset_s[2][duration_type_max], offset_e[2][duration_type_max];
5274     nstime_t              ts;
5275     uint32_t              msec_start[2][duration_type_max], msec_end[2][duration_type_max];
5276     int                   duration_type;
5277     uint32_t              msec_delta;
5278     nstime_t              ts_delta;
5279     uint32_t              usec;
5280     int                   i, j;
5281
5282     address               local_addr, remote_addr;
5283     uint16_t              local_port = 0, remote_port = 0/*, ipv4_id = 0, icmp_id = 0*/;
5284     uint32_t              uid = 0, pid = 0;
5285     int                   uname_len;
5286     char                 *uname_str = NULL;
5287     int                   cmd_len;
5288     char                 *cmd_str = NULL;
5289     uint16_t              got_flags = 0;
5290
5291     int                   string_len_short = 0;
5292     int                   string_len_long = 0;
5293
5294     proto_tree           *string_tree;
5295     proto_tree           *dl_frame_sec_tree;
5296     proto_tree           *juniper_resilincy_tree;
5297     uint32_t              cpid, cpdesc;
5298
5299     char                 *gen_str = NULL;
5300     int                   gen_str_offset = 0;
5301
5302     proto_item           *ti;
5303     proto_item           *cti;
5304     uint16_t              count;
5305     v9_v10_tmplt_entry_t *entries_p;
5306     proto_tree           *fwdstattree;
5307
5308     bool                 cace_pie_seen = false,
5309                          plixer_pie_seen = false,
5310                          ntop_pie_seen = false,
5311                          ixia_pie_seen = false,
5312                          netscaler_pie_seen = false,
5313                          barracuda_pie_seen = false,
5314                          gigamon_pie_seen = false,
5315                          cisco_pie_seen = false,
5316                          niagara_networks_pie_seen = false,
5317                          juniper_networks_pie_seen = false;
5318
5319
5320     uint8_t      ip_protocol = 0;
5321     uint16_t     port_number;
5322
5323     entries_p = tmplt_p->fields_p[fields_type];
5324     if (entries_p == NULL) {
5325         /* I don't think we can actually hit this condition.
5326            If we can, what would cause it?  Does this need a
5327            warn?  If so, what?
5328         */
5329         return 0;
5330     }
5331     orig_offset   = offset;
5332     count         = tmplt_p->field_count[fields_type];
5333
5334     for (i=0; i < (int)duration_type_max; i++) {
5335         offset_s[0][i]   = offset_s[1][i] = offset_e[0][i] = offset_e[1][i] = 0;
5336         msec_start[0][i] = msec_start[1][i] = msec_end[0][i] = msec_end[1][i] = 0;
5337     }
5338
5339     for (i = 0; i < count; i++) {
5340         uint64_t     pen_type;
5341         uint16_t     type;
5342         uint16_t     masked_type;
5343         uint16_t     length;
5344         uint32_t     pen;
5345         const char *pen_str;
5346         int          vstr_len;
5347
5348         type    = entries_p[i].type;
5349         length  = entries_p[i].length;
5350         pen     = entries_p[i].pen;
5351         pen_str = entries_p[i].pen_str;
5352
5353         if (length == 0) { /* XXX: Zero length fields probably shouldn't be included in the cached template */
5354             /* YYY: Maybe.  If you don't cache the zero length fields can you still compare that you actually */
5355             /* have the same template with the same ID. */
5356             /* XXX: One capture has been seen wherein the "length" field in the template is 0 even though
5357                     the field is actually present in the dataflow.
5358                     See: https://gitlab.com/wireshark/wireshark/-/issues/10432#c1
5359             */
5360             continue;
5361         }
5362         /* See if variable length field */
5363         vstr_len = 0;
5364         if (length == VARIABLE_LENGTH) {
5365             vstr_len = 1;
5366             string_len_short = length = tvb_get_uint8(tvb, offset);
5367             if (length == 255) {
5368                 vstr_len = 3;
5369                 string_len_long = length = tvb_get_ntohs(tvb, offset+1);
5370             }
5371             offset += vstr_len;
5372             if (length == 0) {
5373                 continue;
5374             }
5375             gen_str_offset = offset;
5376         }
5377
5378         /*  v9 types
5379          *    0x 0000 0000 0000 to
5380          *    0x 0000 0000 ffff
5381          *  v10 global types (presumably consistent with v9 types 0x0000 - 0x7fff)
5382          *    0x 0000 0000 0000 to
5383          *    0x 0000 0000 7fff
5384          *  V10 Enterprise types
5385          *    0x 0000 0001 0000 to
5386          *    0x ffff ffff 7fff
5387          */
5388         pen_type = masked_type = type;
5389         rev      = 0;
5390
5391         if ((hdrinfo_p->vspec == 10) && (type & 0x8000)) {
5392             pen_type = masked_type = type & 0x7fff;
5393             if (pen == REVPEN) { /* reverse PEN */
5394                 rev = 1;
5395             } else if (pen == 0) {
5396                 pen_type = (UINT64_C(0xffff) << 16) | pen_type;  /* hack to force "unknown" */
5397             } else {
5398                 pen_type = (((uint64_t)pen) << 16) | pen_type;
5399             }
5400         }
5401
5402         /* Provide a convenient (hidden) filter for any items belonging to a known PIE,
5403            but take care not to add > once. */
5404         switch (pen) {
5405             case VENDOR_CACE:
5406                 if (!cace_pie_seen) {
5407                     proto_item *pie_cace_ti = proto_tree_add_item(pdutree, hf_pie_cace, tvb, 0, 0, ENC_NA);
5408                     proto_item_set_hidden(pie_cace_ti);
5409                     cace_pie_seen = true;
5410                 }
5411                 break;
5412             case VENDOR_PLIXER:
5413                 if (!plixer_pie_seen) {
5414                     proto_item *pie_plixer_ti = proto_tree_add_item(pdutree, hf_pie_plixer, tvb, 0, 0, ENC_NA);
5415                     proto_item_set_hidden(pie_plixer_ti);
5416                     plixer_pie_seen = true;
5417                 }
5418                 break;
5419             case VENDOR_NTOP:
5420                 if (!ntop_pie_seen) {
5421                     proto_item *pie_ntop_ti = proto_tree_add_item(pdutree, hf_pie_ntop, tvb, 0, 0, ENC_NA);
5422                     proto_item_set_hidden(pie_ntop_ti);
5423                     ntop_pie_seen = true;
5424                 }
5425                 break;
5426             case VENDOR_IXIA:
5427                 if (!ixia_pie_seen) {
5428                     proto_item *pie_ixia_ti = proto_tree_add_item(pdutree, hf_pie_ixia, tvb, 0, 0, ENC_NA);
5429                     proto_item_set_hidden(pie_ixia_ti);
5430                     ixia_pie_seen = true;
5431                 }
5432                 break;
5433             case VENDOR_NETSCALER:
5434                 if (!netscaler_pie_seen) {
5435                     proto_item *pie_netscaler_ti = proto_tree_add_item(pdutree, hf_pie_netscaler, tvb, 0, 0, ENC_NA);
5436                     proto_item_set_hidden(pie_netscaler_ti);
5437                     netscaler_pie_seen = true;
5438                 }
5439                 break;
5440             case VENDOR_BARRACUDA:
5441                 if (!barracuda_pie_seen) {
5442                     proto_item *pie_barracuda_ti = proto_tree_add_item(pdutree, hf_pie_barracuda, tvb, 0, 0, ENC_NA);
5443                     proto_item_set_hidden(pie_barracuda_ti);
5444                     barracuda_pie_seen = true;
5445                 }
5446                 break;
5447             case VENDOR_GIGAMON:
5448                 if (!gigamon_pie_seen) {
5449                     proto_item *pie_gigamon_ti = proto_tree_add_item(pdutree, hf_pie_gigamon, tvb, 0, 0, ENC_NA);
5450                     proto_item_set_hidden(pie_gigamon_ti);
5451                     gigamon_pie_seen = true;
5452                 }
5453                 break;
5454             case VENDOR_CISCO:
5455                 if (!cisco_pie_seen) {
5456                     proto_item *pie_cisco_ti = proto_tree_add_item(pdutree, hf_pie_cisco, tvb, 0, 0, ENC_NA);
5457                     proto_item_set_hidden(pie_cisco_ti);
5458                     cisco_pie_seen = true;
5459                 }
5460                 break;
5461             case VENDOR_NIAGARA_NETWORKS:
5462                 if (!niagara_networks_pie_seen) {
5463                     proto_item *pie_niagara_networks_ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks, tvb, 0, 0, ENC_NA);
5464                     proto_item_set_hidden(pie_niagara_networks_ti);
5465                     niagara_networks_pie_seen = true;
5466                 }
5467                 break;
5468             case VENDOR_JUNIPER:
5469                 if(!juniper_networks_pie_seen) {
5470                     proto_item *pie_juniper_ti = proto_tree_add_item(pdutree, hf_pie_juniper, tvb, 0, 0, ENC_NA);
5471                     proto_item_set_hidden(pie_juniper_ti);
5472                     juniper_networks_pie_seen = true;
5473                 }
5474                 break;
5475
5476             default:
5477                 break;
5478         }
5479
5480         ti = NULL;
5481         switch (pen_type) {
5482
5483         case 1: /* bytes */
5484             ti = proto_tree_add_item(pdutree, hf_cflow_octets,
5485                                      tvb, offset, length, ENC_BIG_ENDIAN);
5486             break;
5487
5488         case 2: /* packets */
5489             ti = proto_tree_add_item(pdutree, hf_cflow_packets,
5490                                      tvb, offset, length, ENC_BIG_ENDIAN);
5491             break;
5492
5493         case 163: /*  observedFlowTotalCount */
5494         case 3: /* flows */
5495             ti = proto_tree_add_item(pdutree, hf_cflow_flows,
5496                                      tvb, offset, length, ENC_BIG_ENDIAN);
5497             break;
5498
5499         case 4: /* proto */
5500             /* Store this to help with possible port transport lookup */
5501             ip_protocol = tvb_get_uint8(tvb, offset);
5502             ti = proto_tree_add_item(pdutree, hf_cflow_prot,
5503                                      tvb, offset, length, ENC_BIG_ENDIAN);
5504             break;
5505
5506         case 5: /* TOS */
5507             ti = proto_tree_add_item(pdutree, hf_cflow_tos,
5508                                      tvb, offset, length, ENC_BIG_ENDIAN);
5509             break;
5510
5511         case 6: /* TCP flags */
5512             if (length == 1 && netflow_preference_tcpflags_1byte_cwr) {
5513                 ti = proto_tree_add_bitmask(pdutree, tvb, offset, hf_cflow_tcpflags, ett_tcpflags, tcp_flags_cwr, ENC_NA);
5514             } else if (length == 1) {
5515                 ti = proto_tree_add_bitmask(pdutree, tvb, offset, hf_cflow_tcpflags, ett_tcpflags, tcp_flags, ENC_NA);
5516             } else {
5517                 ti = proto_tree_add_bitmask(pdutree, tvb, offset, hf_cflow_tcpflags16, ett_tcpflags, tcp_flags16, ENC_NA);
5518             }
5519             break;
5520
5521         case 7: /* source port */
5522         case 180: /*  udpSourcePort */
5523         case 182: /*  tcpSourcePort */
5524             ti = proto_tree_add_item(pdutree, hf_cflow_srcport,
5525                                      tvb, offset, length, ENC_BIG_ENDIAN);
5526             port_number = tvb_get_ntohs(tvb, offset);
5527             netflow_add_transport_info(pinfo, pen_type, ip_protocol, port_number, ti);
5528             break;
5529
5530         case 8: /* source IP */
5531             /* IANA indicates this can only be an IPv4 Address */
5532             ti = proto_tree_add_item(pdutree, hf_cflow_srcaddr,
5533                                      tvb, offset, length, ENC_BIG_ENDIAN);
5534             break;
5535
5536         case 9: /* source mask */
5537             ti = proto_tree_add_item(pdutree, hf_cflow_srcmask,
5538                                      tvb, offset, length, ENC_BIG_ENDIAN);
5539             break;
5540
5541         case 10: /* input SNMP */
5542             ti = proto_tree_add_item(pdutree, hf_cflow_inputint,
5543                                      tvb, offset, length, ENC_BIG_ENDIAN);
5544             break;
5545
5546         case 11: /* dest port */
5547         case 181: /*  udpDestinationPort */
5548         case 183: /*  tcpDestinationPort */
5549             ti = proto_tree_add_item(pdutree, hf_cflow_dstport,
5550                                      tvb, offset, length, ENC_BIG_ENDIAN);
5551             port_number = tvb_get_ntohs(tvb, offset);
5552             netflow_add_transport_info(pinfo, pen_type, ip_protocol, port_number, ti);
5553             break;
5554
5555         case 12: /* dest IP */
5556             /* IANA indicates this can only be an IPv4 Address */
5557             ti = proto_tree_add_item(pdutree, hf_cflow_dstaddr,
5558                                      tvb, offset, length, ENC_BIG_ENDIAN);
5559             break;
5560
5561         case 13: /* dest mask */
5562             ti = proto_tree_add_item(pdutree, hf_cflow_dstmask,
5563                                      tvb, offset, length, ENC_BIG_ENDIAN);
5564             break;
5565
5566         case 14: /* output SNMP */
5567             ti = proto_tree_add_item(pdutree, hf_cflow_outputint,
5568                                      tvb, offset, length, ENC_BIG_ENDIAN);
5569             break;
5570
5571         case 15: /* nexthop IP */
5572             ti = proto_tree_add_item(pdutree, hf_cflow_nexthop,
5573                                      tvb, offset, length, ENC_BIG_ENDIAN);
5574             break;
5575
5576         case 16: /* source AS */
5577             ti = proto_tree_add_item(pdutree, hf_cflow_srcas,
5578                                      tvb, offset, length, ENC_BIG_ENDIAN);
5579             break;
5580
5581         case 17: /* dest AS */
5582             ti = proto_tree_add_item(pdutree, hf_cflow_dstas,
5583                                      tvb, offset, length, ENC_BIG_ENDIAN);
5584             break;
5585
5586         case 18: /* BGP nexthop IP */
5587             /* IANA indicates this can only be an IPv4 Address */
5588             ti = proto_tree_add_item(pdutree, hf_cflow_bgpnexthop,
5589                                      tvb, offset, length, ENC_BIG_ENDIAN);
5590             break;
5591
5592         case 19: /* multicast packets */
5593             ti = proto_tree_add_item(pdutree, hf_cflow_mulpackets,
5594                                      tvb, offset, length, ENC_BIG_ENDIAN);
5595             break;
5596
5597         case 20: /* multicast octets */
5598             ti = proto_tree_add_item(pdutree, hf_cflow_muloctets,
5599                                      tvb, offset, length, ENC_BIG_ENDIAN);
5600             break;
5601
5602         case 21: /* last switched */
5603             duration_type = (int)duration_type_switched;
5604             offset_e[rev][duration_type] = offset;
5605             msec_end[rev][duration_type] = tvb_get_ntohl(tvb, offset);
5606             ts_end[rev][duration_type].secs = msec_end[rev][duration_type] / 1000;
5607             ts_end[rev][duration_type].nsecs = (msec_end[rev][duration_type] % 1000) * 1000000;
5608             goto timestamp_common;
5609             break;
5610         case 22: /* first switched */
5611             duration_type = (int)duration_type_switched;
5612             offset_s[rev][duration_type] = offset;
5613             msec_start[rev][duration_type] = tvb_get_ntohl(tvb, offset);
5614             ts_start[rev][duration_type].secs = msec_start[rev][duration_type] / 1000;
5615             ts_start[rev][duration_type].nsecs = (msec_start[rev][duration_type] % 1000) * 1000000;
5616             goto timestamp_common;
5617             break;
5618
5619         case 150: /*  flowStartSeconds */
5620             duration_type = (int)duration_type_seconds;
5621             offset_s[rev][duration_type] = offset;
5622             ts_start[rev][duration_type].secs = tvb_get_ntohl(tvb, offset);
5623             ts_start[rev][duration_type].nsecs = 0;
5624             goto timestamp_common;
5625             break;
5626
5627         case 151: /*  flowEndSeconds */
5628             duration_type = (int)duration_type_seconds;
5629             offset_e[rev][duration_type] = offset;
5630             ts_end[rev][duration_type].secs = tvb_get_ntohl(tvb, offset);
5631             ts_end[rev][duration_type].nsecs = 0;
5632             goto timestamp_common;
5633             break;
5634
5635         case 152: /*  flowStartMilliseconds: 64-bit integer */
5636             duration_type = (int)duration_type_milliseconds;
5637             offset_s[rev][duration_type] = offset;
5638             ts_start[rev][duration_type].secs = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
5639             ts_start[rev][duration_type].nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) * 1000000;
5640             goto timestamp_common;
5641             break;
5642
5643         case 153: /*  flowEndMilliseconds; 64-bit integer */
5644             duration_type = (int)duration_type_milliseconds;
5645             offset_e[rev][duration_type] = offset;
5646             ts_end[rev][duration_type].secs  = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
5647             ts_end[rev][duration_type].nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) * 1000000;
5648             goto timestamp_common;
5649             break;
5650
5651         case 154: /*  flowStartMicroseconds: 64-bit NTP format */
5652             duration_type = (int)duration_type_microseconds;
5653             offset_s[rev][duration_type] = offset;
5654             ntp_to_nstime(tvb, offset, &ts_start[rev][duration_type]);
5655             goto timestamp_common;
5656             break;
5657
5658         case 155: /*  flowEndMicroseconds: 64-bit NTP format */
5659             /*  XXX: Not tested ...                    */
5660             duration_type = (int)duration_type_microseconds;
5661             offset_e[rev][duration_type] = offset;
5662             ntp_to_nstime(tvb, offset, &ts_end[rev][duration_type]);
5663             goto timestamp_common;
5664             break;
5665
5666         case 156: /*  flowStartNanoseconds: 64-bit NTP format */
5667             /*  XXX: Not tested ...                     */
5668             duration_type = (int)duration_type_nanoseconds;
5669             offset_s[rev][duration_type] = offset;
5670             ntp_to_nstime(tvb, offset, &ts_start[rev][duration_type]);
5671             goto timestamp_common;
5672             break;
5673
5674         case 157: /*  flowEndNanoseconds: 64-bit NTP format */
5675             /*  XXX: Not tested ...                   */
5676             duration_type = (int)duration_type_nanoseconds;
5677             offset_e[rev][duration_type] = offset;
5678             ntp_to_nstime(tvb, offset, &ts_end[rev][duration_type]);
5679             goto timestamp_common;
5680             break;
5681
5682         case 158: /*  flowStartDeltaMicroseconds: 32-bit integer; negative time offset   */
5683             /*   relative to the export time specified in the IPFIX Message Header */
5684             /*  XXX: Not tested ...                                                */
5685             duration_type = (int)duration_type_delta_milliseconds;
5686             offset_s[rev][duration_type]       = offset;
5687             usec                = tvb_get_ntohl(tvb, offset);
5688             ts_start[rev][duration_type].secs  = (time_t)(((uint64_t)(hdrinfo_p->export_time_secs)*1000000 - usec) / 1000000);
5689             ts_start[rev][duration_type].nsecs = (int)(((uint64_t)(hdrinfo_p->export_time_secs)*1000000 - usec) % 1000000) * 1000;
5690             goto timestamp_common;
5691             break;
5692
5693         case 159: /*  flowEndDeltaMicroseconds: 32-bit integer; negative time offset     */
5694             /*   relative to the export time specified in the IPFIX Message Header */
5695             /*  XXX: Not tested ...                                                */
5696             duration_type = (int)duration_type_delta_milliseconds;
5697             offset_e[rev][duration_type] = offset;
5698             usec          = tvb_get_ntohl(tvb, offset);
5699             ts_end[rev][duration_type].secs  = (time_t)(((uint64_t)(hdrinfo_p->export_time_secs)*1000000 - usec) / 1000000);
5700             ts_end[rev][duration_type].nsecs = (int)(((uint64_t)(hdrinfo_p->export_time_secs)*1000000 - usec) % 1000000) * 1000;
5701
5702             /* This code executed for all timestamp fields above  */
5703             /* Since bug 11295, cope with multiple durations in one flow - not really sure if it makes sense... */
5704         timestamp_common:
5705             if(offset_s[rev][duration_type] && offset_e[rev][duration_type]) {
5706                 proto_tree *timetree;
5707                 proto_item *timeitem;
5708
5709                 nstime_delta(&ts_delta, &ts_end[rev][duration_type], &ts_start[rev][duration_type]);
5710                 timeitem =
5711                     proto_tree_add_time(pdutree, hf_cflow_timedelta, tvb,
5712                                         offset_s[rev][duration_type], 0, &ts_delta);
5713                 proto_item_set_generated(timeitem);
5714                 timetree = proto_item_add_subtree(timeitem, ett_flowtime);
5715
5716                 /* Show the type/units used to calculate the duration */
5717                 switch (duration_type) {
5718                     case duration_type_switched:
5719                         proto_item_append_text(timeitem, " (switched)");
5720                         break;
5721                     case duration_type_seconds:
5722                         proto_item_append_text(timeitem, " (seconds)");
5723                         break;
5724                     case duration_type_milliseconds:
5725                         proto_item_append_text(timeitem, " (milliseconds)");
5726                         break;
5727                     case duration_type_microseconds:
5728                         proto_item_append_text(timeitem, " (microseconds)");
5729                         break;
5730                     case duration_type_nanoseconds:
5731                         proto_item_append_text(timeitem, " (nanoseconds)");
5732                         break;
5733                     case duration_type_delta_milliseconds:
5734                         proto_item_append_text(timeitem, " (delta milliseconds)");
5735                         break;
5736                     default:
5737                         break;
5738                 }
5739
5740                 /* Note: length of "start" is assumed to match that of "end" */
5741                 if (msec_start[rev][duration_type]) {
5742                     proto_tree_add_time(timetree, hf_cflow_timestart, tvb,
5743                                         offset_s[rev][duration_type], length, &ts_start[rev][duration_type]);
5744                 } else {
5745                     proto_tree_add_time(timetree, hf_cflow_abstimestart, tvb,
5746                                         offset_s[rev][duration_type], length, &ts_start[rev][duration_type]);
5747                 }
5748                 if (msec_end[rev][duration_type]) {
5749                     proto_tree_add_time(timetree, hf_cflow_timeend, tvb,
5750                                         offset_e[rev][duration_type], length, &ts_end[rev][duration_type]);
5751                 } else {
5752                     proto_tree_add_time(timetree, hf_cflow_abstimeend, tvb,
5753                                         offset_e[rev][duration_type], length, &ts_end[rev][duration_type]);
5754                 }
5755             }
5756             break;
5757
5758         case 23: /* postOctetDeltaCount */
5759             ti = proto_tree_add_item(pdutree, hf_cflow_post_octets,
5760                                      tvb, offset, length, ENC_BIG_ENDIAN);
5761             break;
5762
5763         case 24: /* postPacketDeltaCount */
5764             ti = proto_tree_add_item(pdutree, hf_cflow_post_packets,
5765                                      tvb, offset, length, ENC_BIG_ENDIAN);
5766             break;
5767
5768         case 25: /* length_min */
5769             ti = proto_tree_add_item(pdutree, hf_cflow_length_min,
5770                                      tvb, offset, length, ENC_BIG_ENDIAN);
5771             break;
5772
5773         case 26: /* length_max */
5774             ti = proto_tree_add_item(pdutree, hf_cflow_length_max,
5775                                      tvb, offset, length, ENC_BIG_ENDIAN);
5776             break;
5777
5778         case 27: /* IPv6 src addr */
5779             ti = proto_tree_add_item(pdutree, hf_cflow_srcaddr_v6,
5780                                      tvb, offset, length, ENC_NA);
5781             break;
5782
5783         case 28: /* IPv6 dst addr */
5784             ti = proto_tree_add_item(pdutree, hf_cflow_dstaddr_v6,
5785                                      tvb, offset, length, ENC_NA);
5786             break;
5787
5788         case 29: /* IPv6 src addr mask */
5789             ti = proto_tree_add_item(pdutree, hf_cflow_srcmask_v6,
5790                                      tvb, offset, length, ENC_BIG_ENDIAN);
5791             break;
5792
5793         case 30: /* IPv6 dst addr mask */
5794             ti = proto_tree_add_item(pdutree, hf_cflow_dstmask_v6,
5795                                      tvb, offset, length, ENC_BIG_ENDIAN);
5796             break;
5797
5798         case 31: /* flowLabelIPv6 */
5799             /* RFC5102 defines that Abstract Data Type of this
5800                 Information Element is unsigned32 */
5801             /* RFC3954 defines that length of this field is 3
5802                 Bytes */
5803             ti = proto_tree_add_item(pdutree, hf_cflow_ipv6_flowlabel,
5804                                      tvb, offset, length, ENC_BIG_ENDIAN);
5805             break;
5806
5807         case 32: /* ICMP_TYPE/ICMP_CODE IPv4 */
5808             ti = proto_tree_add_item(pdutree, hf_cflow_icmp_type_code_ipv4,
5809                                      tvb, offset, length, ENC_BIG_ENDIAN);
5810             break;
5811
5812         case 33: /* IGMP_TYPE */
5813             ti = proto_tree_add_item(pdutree, hf_cflow_igmp_type,
5814                                      tvb, offset, length, ENC_BIG_ENDIAN);
5815             break;
5816
5817         case 34: /* sampling interval */
5818             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_interval,
5819                                      tvb, offset, length, ENC_BIG_ENDIAN);
5820             break;
5821
5822         case 35: /* sampling algorithm */
5823                  /* "Deprecated in favor of 304 selectorAlgorithm" */
5824             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_algorithm,
5825                                      tvb, offset, length, ENC_BIG_ENDIAN);
5826             break;
5827
5828         case 36: /* flow active timeout */
5829             ti = proto_tree_add_item(pdutree, hf_cflow_flow_active_timeout,
5830                                      tvb, offset, length, ENC_BIG_ENDIAN);
5831             break;
5832
5833         case 37: /* flow inactive timeout */
5834             ti = proto_tree_add_item(pdutree, hf_cflow_flow_inactive_timeout,
5835                                      tvb, offset, length, ENC_BIG_ENDIAN);
5836             break;
5837
5838         case 38: /* engine type */
5839             ti = proto_tree_add_item(pdutree, hf_cflow_engine_type,
5840                                      tvb, offset, length, ENC_BIG_ENDIAN);
5841             break;
5842
5843         case 39: /* engine id*/
5844             ti = proto_tree_add_item(pdutree, hf_cflow_engine_id,
5845                                      tvb, offset, length, ENC_BIG_ENDIAN);
5846             break;
5847
5848         case 40: /* bytes exported */
5849             ti = proto_tree_add_item(pdutree, hf_cflow_octets_exp,
5850                                      tvb, offset, length, ENC_BIG_ENDIAN);
5851             break;
5852
5853         case 41: /* packets exported */
5854             ti = proto_tree_add_item(pdutree, hf_cflow_packets_exp,
5855                                      tvb, offset, length, ENC_BIG_ENDIAN);
5856             break;
5857
5858         case 42: /* flows exported */
5859             ti = proto_tree_add_item(pdutree, hf_cflow_flows_exp,
5860                                      tvb, offset, length, ENC_BIG_ENDIAN);
5861             break;
5862
5863         case 43: /* ipv4RouterSc */
5864                  /* platform-specific field for the Catalyst 5000/Catalyst 6000 family */
5865             ti = proto_tree_add_item(pdutree, hf_cflow_ipv4_router_sc,
5866                                      tvb, offset, length, ENC_BIG_ENDIAN);
5867             break;
5868
5869         case 44: /* IP source prefix */
5870             ti = proto_tree_add_item(pdutree, hf_cflow_srcprefix,
5871                                      tvb, offset, length, ENC_BIG_ENDIAN);
5872             break;
5873
5874         case 45: /* IP destination prefix */
5875             ti = proto_tree_add_item(pdutree, hf_cflow_dstprefix,
5876                                      tvb, offset, length, ENC_BIG_ENDIAN);
5877             break;
5878
5879         case 46: /* top MPLS label type*/
5880             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_top_label_type,
5881                                      tvb, offset, length, ENC_BIG_ENDIAN);
5882             break;
5883
5884         case 47: /* top MPLS label PE address*/
5885             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_pe_addr,
5886                                      tvb, offset, length, ENC_BIG_ENDIAN);
5887             break;
5888
5889         case 48: /* Flow Sampler ID */
5890             ti = proto_tree_add_item(pdutree, hf_cflow_sampler_id,
5891                                      tvb, offset, length, ENC_BIG_ENDIAN);
5892             break;
5893
5894         case 49: /* FLOW_SAMPLER_MODE  */
5895             ti = proto_tree_add_item(pdutree, hf_cflow_sampler_mode,
5896                                      tvb, offset, length, ENC_BIG_ENDIAN);
5897             break;
5898
5899         case 50: /* FLOW_SAMPLER_RANDOM_INTERVAL  */
5900             ti = proto_tree_add_item(pdutree, hf_cflow_sampler_random_interval,
5901                                      tvb, offset, length, ENC_BIG_ENDIAN);
5902             break;
5903
5904         case 51: /*  FLOW_CLASS */
5905             ti = proto_tree_add_item(pdutree, hf_cflow_flow_class,
5906                                      tvb, offset, length, ENC_BIG_ENDIAN);
5907             break;
5908
5909         case 52: /*  TTL_MINIMUM */
5910             ti = proto_tree_add_item(pdutree, hf_cflow_ttl_minimum,
5911                                      tvb, offset, length, ENC_BIG_ENDIAN);
5912             break;
5913
5914         case 53: /*  TTL_MAXIMUM */
5915             ti = proto_tree_add_item(pdutree, hf_cflow_ttl_maximum,
5916                                      tvb, offset, length, ENC_BIG_ENDIAN);
5917             break;
5918
5919         case 54: /* FRAG ID  */
5920             ti = proto_tree_add_item(pdutree, hf_cflow_frag_id,
5921                                      tvb, offset, length, ENC_BIG_ENDIAN);
5922             break;
5923
5924         case 55: /* postIpClassOfService */
5925             ti = proto_tree_add_item(pdutree, hf_cflow_post_tos,
5926                                      tvb, offset, length, ENC_BIG_ENDIAN);
5927             break;
5928
5929         case 56: /* sourceMacAddress */
5930             ti = proto_tree_add_item(pdutree, hf_cflow_srcmac,
5931                                      tvb, offset, length, ENC_NA);
5932             break;
5933
5934         case 57: /* postDestinationMacAddress */
5935             ti = proto_tree_add_item(pdutree, hf_cflow_post_dstmac,
5936                                      tvb, offset, length, ENC_NA);
5937             break;
5938
5939         case 58: /* vlanId */
5940             ti = proto_tree_add_item(pdutree, hf_cflow_vlanid,
5941                                      tvb, offset, length, ENC_BIG_ENDIAN);
5942             break;
5943
5944         case 59: /* postVlanId */
5945             ti = proto_tree_add_item(pdutree, hf_cflow_post_vlanid,
5946                                      tvb, offset, length, ENC_BIG_ENDIAN);
5947             break;
5948
5949         case 60: /* IP_VERSION */
5950             ti = proto_tree_add_item(pdutree, hf_cflow_ip_version,
5951                                      tvb, offset, length, ENC_BIG_ENDIAN);
5952             break;
5953
5954         case 61: /* DIRECTION   */
5955             ti = proto_tree_add_item(pdutree, hf_cflow_direction,
5956                                      tvb, offset, length, ENC_BIG_ENDIAN);
5957             break;
5958
5959         case 62: /* IPV6_NEXT_HOP */
5960             ti = proto_tree_add_item(pdutree, hf_cflow_nexthop_v6,
5961                                      tvb, offset, length, ENC_NA);
5962             break;
5963
5964         case 63: /* BGP_IPV6_NEXT_HOP */
5965             ti = proto_tree_add_item(pdutree, hf_cflow_bgpnexthop_v6,
5966                                      tvb, offset, length, ENC_NA);
5967             break;
5968
5969         case 64: /* ipv6ExtensionHeaders */
5970             ti = proto_tree_add_item(pdutree, hf_cflow_ipv6_exthdr,
5971                                      tvb, offset, length, ENC_BIG_ENDIAN);
5972             break;
5973
5974         case 70: /* MPLS label1*/
5975             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 1);
5976             break;
5977
5978         case 71: /* MPLS label2*/
5979             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 2);
5980             break;
5981
5982         case 72: /* MPLS label3*/
5983             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 3);
5984             break;
5985
5986         case 73: /* MPLS label4*/
5987             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 4);
5988             break;
5989
5990         case 74: /* MPLS label5*/
5991             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 5);
5992             break;
5993
5994         case 75: /* MPLS label6*/
5995             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 6);
5996             break;
5997
5998         case 76: /* MPLS label7*/
5999             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 7);
6000             break;
6001
6002         case 77: /* MPLS label8*/
6003             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 8);
6004             break;
6005
6006         case 78: /* MPLS label9*/
6007             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 9);
6008             break;
6009
6010         case 79: /* MPLS label10*/
6011             ti = proto_tree_add_mpls_label(pdutree, tvb, offset, length, 10);
6012             break;
6013
6014         case 80: /* destinationMacAddress */
6015             ti = proto_tree_add_item(pdutree, hf_cflow_dstmac,
6016                                      tvb, offset, length, ENC_NA);
6017             break;
6018
6019         case 81: /* postSourceMacAddress */
6020             ti = proto_tree_add_item(pdutree, hf_cflow_post_srcmac,
6021                                      tvb, offset, length, ENC_NA);
6022             break;
6023
6024         case 82: /* IF_NAME  */
6025             ti = proto_tree_add_item(pdutree, hf_cflow_if_name,
6026                                      tvb, offset, length, ENC_UTF_8);
6027             break;
6028
6029         case 83: /* IF_DESCR  */
6030             ti = proto_tree_add_item(pdutree, hf_cflow_if_descr,
6031                                      tvb, offset, length, ENC_UTF_8);
6032             break;
6033
6034         case 84: /* SAMPLER_NAME  */
6035                  /* "Deprecated in favor of 335 selectorName" */
6036             ti = proto_tree_add_item(pdutree, hf_cflow_sampler_name,
6037                                      tvb, offset, length, ENC_UTF_8);
6038             break;
6039
6040         case 85: /* BYTES_PERMANENT */
6041             ti = proto_tree_add_item(pdutree, hf_cflow_permanent_octets,
6042                                      tvb, offset, length, ENC_BIG_ENDIAN);
6043             break;
6044
6045         case 86: /* PACKETS_PERMANENT */
6046             ti = proto_tree_add_item(pdutree, hf_cflow_permanent_packets,
6047                                      tvb, offset, length, ENC_BIG_ENDIAN);
6048             break;
6049
6050         case 88: /* fragmentOffset */
6051             ti = proto_tree_add_item(pdutree, hf_cflow_fragment_offset,
6052                                      tvb, offset, length, ENC_BIG_ENDIAN);
6053             break;
6054
6055         case 89: {
6056             /* FORWARDING_STATUS */
6057             /* Forwarding status is encoded on 1 byte with
6058              * the 2 left bits giving the status and the 6
6059              * remaining bits giving the reason code. */
6060
6061             uint8_t             forwarding_status;
6062             const value_string *x_vs;
6063             int                 x_hf;
6064
6065             fwdstattree = proto_tree_add_subtree(pdutree, tvb, offset, length, ett_fwdstat, NULL, "Forwarding Status");
6066
6067             forwarding_status = tvb_get_uint8(tvb, offset)>>6;
6068             switch(forwarding_status) {
6069             default:
6070             case FORWARDING_STATUS_UNKNOWN:
6071                 x_vs = v9_forwarding_status_unknown_code;
6072                 x_hf = hf_cflow_forwarding_status_unknown_code;
6073                 break;
6074             case FORWARDING_STATUS_FORWARD:
6075                 x_vs = v9_forwarding_status_forward_code;
6076                 x_hf = hf_cflow_forwarding_status_forward_code;
6077                 break;
6078             case FORWARDING_STATUS_DROP:
6079                 x_vs = v9_forwarding_status_drop_code;
6080                 x_hf = hf_cflow_forwarding_status_drop_code;
6081                 break;
6082             case FORWARDING_STATUS_CONSUME:
6083                 x_vs = v9_forwarding_status_consume_code;
6084                 x_hf = hf_cflow_forwarding_status_consume_code;
6085                 break;
6086             }
6087
6088             proto_tree_add_item(fwdstattree, hf_cflow_forwarding_status,
6089                                 tvb, offset, length, ENC_BIG_ENDIAN);
6090
6091             proto_tree_add_item(fwdstattree, x_hf,
6092                                 tvb, offset, length, ENC_NA);
6093
6094             /* add status code to tree summary */
6095             if (length == 1) {
6096                 proto_item_append_text(ti, ": %s", val_to_str_const(forwarding_status,
6097                                                                     v9_forwarding_status, "(Unknown)"));
6098                 proto_item_append_text(ti, ": %s", val_to_str_const((tvb_get_uint8(tvb, offset)&0x3F),
6099                                                                     x_vs, "(Unknown)"));
6100             };
6101         }
6102             break;
6103
6104         case 90: /* mplsVpnRouteDistinguisher */
6105             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_vpn_rd,
6106                                      tvb, offset, length, ENC_NA);
6107             break;
6108
6109         case 91: /* mplsTopLabelPrefixLength */
6110             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_top_label_prefix_length,
6111                                      tvb, offset, length, ENC_BIG_ENDIAN);
6112             break;
6113
6114         case 92:
6115             ti = proto_tree_add_item(pdutree, hf_cflow_src_traffic_index,
6116                                      tvb, offset, length, ENC_BIG_ENDIAN);
6117             break;
6118
6119         case 93:
6120             ti = proto_tree_add_item(pdutree, hf_cflow_dst_traffic_index,
6121                                      tvb, offset, length, ENC_BIG_ENDIAN);
6122             break;
6123
6124         case 94: /* NBAR applicationDesc */
6125             ti = proto_tree_add_item(pdutree, hf_cflow_nbar_appl_desc,
6126                                      tvb, offset, length, ENC_UTF_8);
6127             break;
6128
6129         case 95: /* NBAR applicationId */
6130             ti = proto_tree_add_item(pdutree, hf_cflow_nbar_appl_id_class_eng_id,
6131                                      tvb, offset, 1, ENC_BIG_ENDIAN);
6132             proto_tree_add_item(pdutree, hf_cflow_nbar_appl_id_selector_id,
6133                                 tvb, offset+1, length -1, ENC_NA);
6134             break;
6135
6136         case 96: /* NBAR applicationName */
6137             ti = proto_tree_add_item(pdutree, hf_cflow_nbar_appl_name,
6138                                      tvb, offset, length, ENC_UTF_8);
6139             break;
6140
6141         case 98: /* postIpDiffServCodePoint */
6142             ti = proto_tree_add_item(pdutree, hf_cflow_post_ip_diff_serv_code_point,
6143                                      tvb, offset, length, ENC_BIG_ENDIAN);
6144             break;
6145
6146         case 99: /* multicastReplicationFactor */
6147             ti = proto_tree_add_item(pdutree, hf_cflow_multicast_replication_factor,
6148                                      tvb, offset, length, ENC_BIG_ENDIAN);
6149             break;
6150
6151         case 101:
6152             ti = proto_tree_add_item(pdutree, hf_cflow_classification_engine_id,
6153                                      tvb, offset, length, ENC_BIG_ENDIAN);
6154             break;
6155
6156         case 128: /* dest AS Peer */
6157             ti = proto_tree_add_item(pdutree, hf_cflow_peer_dstas,
6158                                      tvb, offset, length, ENC_BIG_ENDIAN);
6159             break;
6160
6161         case 129: /* source AS Peer*/
6162             ti = proto_tree_add_item(pdutree, hf_cflow_peer_srcas,
6163                                      tvb, offset, length, ENC_BIG_ENDIAN);
6164             break;
6165
6166         case 130: /*  exporterIPv4Address */
6167             ti = proto_tree_add_item(pdutree, hf_cflow_exporter_addr,
6168                                      tvb, offset, length, ENC_BIG_ENDIAN);
6169             break;
6170
6171         case 131: /*  exporterIPv6Address */
6172             ti = proto_tree_add_item(pdutree,
6173                                      hf_cflow_exporter_addr_v6,
6174                                      tvb, offset, length, ENC_NA);
6175             break;
6176
6177         case 132: /*  droppedOctetDeltaCount */
6178             ti = proto_tree_add_item(pdutree, hf_cflow_drop_octets,
6179                                      tvb, offset, length, ENC_BIG_ENDIAN);
6180             break;
6181
6182         case 133: /*  droppedPacketDeltaCount */
6183             ti = proto_tree_add_item(pdutree, hf_cflow_drop_packets,
6184                                      tvb, offset, length, ENC_BIG_ENDIAN);
6185             break;
6186
6187         case 134: /*  droppedOctetTotalCount */
6188             ti = proto_tree_add_item(pdutree, hf_cflow_drop_total_octets,
6189                                      tvb, offset, length, ENC_BIG_ENDIAN);
6190             break;
6191
6192         case 135: /*  droppedPacketTotalCount */
6193             ti = proto_tree_add_item(pdutree, hf_cflow_drop_total_packets,
6194                                      tvb, offset, length, ENC_BIG_ENDIAN);
6195             break;
6196
6197         case 136: /*  flowEndReason */
6198             ti = proto_tree_add_item(pdutree, hf_cflow_flow_end_reason,
6199                                      tvb, offset, length, ENC_BIG_ENDIAN);
6200             break;
6201
6202         case 137: /*  commonPropertiesId */
6203             ti = proto_tree_add_item(pdutree, hf_cflow_common_properties_id,
6204                                      tvb, offset, length, ENC_BIG_ENDIAN);
6205             break;
6206
6207         case 138: /*  observationPointId */
6208             ti = proto_tree_add_item(pdutree, hf_cflow_observation_point_id,
6209                                      tvb, offset, length, ENC_BIG_ENDIAN);
6210             break;
6211
6212         case 139: /* icmpTypeCodeIPv6 */
6213             proto_tree_add_item(pdutree, hf_cflow_icmp_ipv6_type,
6214                                      tvb, offset, 1, ENC_BIG_ENDIAN);
6215             ti = proto_tree_add_item(pdutree, hf_cflow_icmp_ipv6_code,
6216                                      tvb, offset + 1, 1, ENC_BIG_ENDIAN);
6217             break;
6218
6219         case 140: /*  mplsTopLabelIPv6Address */
6220             ti = proto_tree_add_item(pdutree,
6221                                      hf_cflow_mpls_pe_addr_v6,
6222                                      tvb, offset, length, ENC_NA);
6223             break;
6224
6225         case 141: /*  lineCardId */
6226             ti = proto_tree_add_item(pdutree, hf_cflow_scope_linecard,
6227                                      tvb, offset, length, ENC_BIG_ENDIAN);
6228             break;
6229
6230         case 142: /*  portId */
6231             ti = proto_tree_add_item(pdutree, hf_cflow_port_id,
6232                                      tvb, offset, length, ENC_BIG_ENDIAN);
6233             break;
6234
6235         case 143: /*  meteringProcessId */
6236             ti = proto_tree_add_item(pdutree, hf_cflow_mp_id,
6237                                      tvb, offset, length, ENC_BIG_ENDIAN);
6238             break;
6239
6240         case 144: /* FLOW EXPORTER */
6241             ti = proto_tree_add_item(pdutree, hf_cflow_flow_exporter,
6242                                      tvb, offset, length, ENC_BIG_ENDIAN);
6243             break;
6244
6245         case 145: /*  templateId */
6246             ti = proto_tree_add_item(pdutree, hf_cflow_template_id,
6247                                      tvb, offset, length, ENC_BIG_ENDIAN);
6248             break;
6249
6250         case 146: /*  wlanChannelId */
6251             ti = proto_tree_add_item(pdutree, hf_cflow_wlan_channel_id,
6252                                      tvb, offset, length, ENC_BIG_ENDIAN);
6253             break;
6254
6255         case 147: /*  wlanSSID */
6256             ti = proto_tree_add_item(pdutree, hf_cflow_wlan_ssid,
6257                                      tvb, offset, length, ENC_UTF_8);
6258             break;
6259
6260         case 148: /*  flowId */
6261             ti = proto_tree_add_item(pdutree, hf_cflow_flow_id,
6262                                      tvb, offset, length, ENC_BIG_ENDIAN);
6263             break;
6264
6265         case 149: /*  observationDomainId */
6266             ti = proto_tree_add_item(pdutree, hf_cflow_od_id,
6267                                      tvb, offset, length, ENC_BIG_ENDIAN);
6268             break;
6269
6270         case 160: /*  systemInitTimeMilliseconds */
6271             ts.secs  = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
6272             ts.nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) *1000000;
6273             ti = proto_tree_add_time(pdutree,
6274                                      hf_cflow_sys_init_time,
6275                                      tvb, offset, length, &ts);
6276             break;
6277
6278         case 161: /*  flowDurationMilliseconds */
6279             msec_delta = tvb_get_ntohl(tvb, offset);
6280             ts_delta.secs = msec_delta / 1000;
6281             ts_delta.nsecs = (msec_delta % 1000) * 1000000;
6282             ti = proto_tree_add_time(pdutree, hf_cflow_timedelta, tvb,
6283                                      offset, length, &ts_delta);
6284             break;
6285
6286         case 162: /*  flowDurationMicroseconds */
6287             msec_delta = tvb_get_ntohl(tvb, offset);
6288             ts_delta.secs = msec_delta / 1000000;
6289             ts_delta.nsecs = (msec_delta % 1000000) * 1000;
6290             ti = proto_tree_add_time(pdutree, hf_cflow_timedelta, tvb,
6291                                      offset, length, &ts_delta);
6292             break;
6293
6294         case 164: /*  ignoredPacketTotalCount */
6295             ti = proto_tree_add_item(pdutree, hf_cflow_ignore_packets,
6296                                      tvb, offset, length, ENC_BIG_ENDIAN);
6297             break;
6298
6299         case 165: /*  ignoredOctetTotalCount */
6300             ti = proto_tree_add_item(pdutree, hf_cflow_ignore_octets,
6301                                      tvb, offset, length, ENC_BIG_ENDIAN);
6302             break;
6303
6304         case 166: /*  notSentFlowTotalCount */
6305             ti = proto_tree_add_item(pdutree, hf_cflow_notsent_flows,
6306                                      tvb, offset, length, ENC_BIG_ENDIAN);
6307             break;
6308
6309         case 167: /*  notSentPacketTotalCount */
6310             ti = proto_tree_add_item(pdutree, hf_cflow_notsent_packets,
6311                                      tvb, offset, length, ENC_BIG_ENDIAN);
6312             break;
6313
6314         case 168: /*  notSentOctetTotalCount */
6315             ti = proto_tree_add_item(pdutree, hf_cflow_notsent_octets,
6316                                      tvb, offset, length, ENC_BIG_ENDIAN);
6317             break;
6318
6319         case 169: /* destinationIPv6Prefix */
6320             ti = proto_tree_add_item(pdutree, hf_cflow_dstnet_v6,
6321                                      tvb, offset, length, ENC_NA);
6322             break;
6323
6324         case 170: /* sourceIPv6Prefix */
6325             ti = proto_tree_add_item(pdutree, hf_cflow_srcnet_v6,
6326                                      tvb, offset, length, ENC_NA);
6327             break;
6328
6329         case 171: /* postOctetTotalCount */
6330             ti = proto_tree_add_item(pdutree, hf_cflow_post_total_octets,
6331                                      tvb, offset, length, ENC_BIG_ENDIAN);
6332             break;
6333
6334         case 172: /* postPacketTotalCount */
6335             ti = proto_tree_add_item(pdutree, hf_cflow_post_total_packets,
6336                                      tvb, offset, length, ENC_BIG_ENDIAN);
6337             break;
6338
6339         case 173: /* flowKeyIndicator */
6340             ti = proto_tree_add_item(pdutree, hf_cflow_key,
6341                                      tvb, offset, length, ENC_NA);
6342             break;
6343
6344         case 174: /* postMCastPacketTotalCount */
6345             ti = proto_tree_add_item(pdutree, hf_cflow_post_total_mulpackets,
6346                                      tvb, offset, length, ENC_BIG_ENDIAN);
6347             break;
6348
6349         case 175: /* postMCastOctetTotalCount */
6350             ti = proto_tree_add_item(pdutree, hf_cflow_post_total_muloctets,
6351                                      tvb, offset, length, ENC_BIG_ENDIAN);
6352             break;
6353
6354         case 176: /* ICMP_IPv4_TYPE */
6355             ti = proto_tree_add_item(pdutree, hf_cflow_icmp_ipv4_type,
6356                                      tvb, offset, length, ENC_BIG_ENDIAN);
6357             break;
6358
6359         case 177: /* ICMP_IPv4_CODE */
6360             ti = proto_tree_add_item(pdutree, hf_cflow_icmp_ipv4_code,
6361                                      tvb, offset, length, ENC_BIG_ENDIAN);
6362             break;
6363
6364         case 178: /* ICMP_IPv6_TYPE */
6365             ti = proto_tree_add_item(pdutree, hf_cflow_icmp_ipv6_type,
6366                                      tvb, offset, length, ENC_BIG_ENDIAN);
6367             break;
6368
6369         case 179: /* ICMP_IPv6_CODE */
6370             ti = proto_tree_add_item(pdutree, hf_cflow_icmp_ipv6_code,
6371                                      tvb, offset, length, ENC_BIG_ENDIAN);
6372             break;
6373
6374         case 184: /* tcpSequenceNumber */
6375             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_seq_num,
6376                                      tvb, offset, length, ENC_BIG_ENDIAN);
6377             break;
6378
6379         case 185: /* tcpAcknowledgementNumber */
6380             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_ack_num,
6381                                      tvb, offset, length, ENC_BIG_ENDIAN);
6382             break;
6383
6384         case 186: /* TCP_WINDOWS_SIZE */
6385             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_window_size,
6386                                      tvb, offset, length, ENC_BIG_ENDIAN);
6387             break;
6388
6389         case 187: /* tcpUrgentPointer */
6390             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_urg_ptr,
6391                                      tvb, offset, length, ENC_BIG_ENDIAN);
6392             break;
6393
6394         case 188: /* tcpHeaderLength */
6395             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_header_length,
6396                                      tvb, offset, length, ENC_BIG_ENDIAN);
6397             break;
6398
6399         case 189: /* ipHeaderLength */
6400             ti = proto_tree_add_item(pdutree, hf_cflow_ip_header_length,
6401                                      tvb, offset, length, ENC_BIG_ENDIAN);
6402             break;
6403
6404         case 190: /* IPV4_TOTAL_LENGTH */
6405             ti = proto_tree_add_item(pdutree, hf_cflow_ipv4_total_length,
6406                                      tvb, offset, length, ENC_BIG_ENDIAN);
6407             break;
6408
6409         case 191: /* payloadLengthIPv6 */
6410             ti = proto_tree_add_item(pdutree, hf_cflow_ipv6_payload_length,
6411                                      tvb, offset, length, ENC_BIG_ENDIAN);
6412             break;
6413
6414         case 192: /* IP_TTL */
6415             ti = proto_tree_add_item(pdutree, hf_cflow_ip_ttl,
6416                                      tvb, offset, length, ENC_BIG_ENDIAN);
6417             break;
6418
6419         case 193: /* nextHeaderIPv6 */
6420             ti = proto_tree_add_item(pdutree, hf_cflow_ipv6_next_hdr,
6421                                      tvb, offset, length, ENC_BIG_ENDIAN);
6422             break;
6423
6424         case 194: /* mplsPayloadLength */
6425             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_payload_length,
6426                                      tvb, offset, length, ENC_BIG_ENDIAN);
6427             break;
6428
6429         case 195: /* IP_DSCP */
6430             ti = proto_tree_add_item(pdutree, hf_cflow_ip_dscp,
6431                                      tvb, offset, length, ENC_BIG_ENDIAN);
6432             break;
6433
6434         case 196: /* ipPrecedence */
6435             ti = proto_tree_add_item(pdutree, hf_cflow_ip_precedence,
6436                                      tvb, offset, length, ENC_BIG_ENDIAN);
6437             break;
6438
6439         case 197: /* fragmentFlags */
6440             ti = proto_tree_add_item(pdutree, hf_cflow_ip_fragment_flags,
6441                                      tvb, offset, length, ENC_BIG_ENDIAN);
6442             break;
6443
6444         case 198: /* DELTA_BYTES_SQUARED */
6445             ti = proto_tree_add_item(pdutree, hf_cflow_delta_octets_squared,
6446                                      tvb, offset, length, ENC_BIG_ENDIAN);
6447             break;
6448
6449         case 199: /* TOTAL_BYTES_SQUARED */
6450             ti = proto_tree_add_item(pdutree, hf_cflow_total_octets_squared,
6451                                      tvb, offset, length, ENC_BIG_ENDIAN);
6452             break;
6453
6454         case 200: /* mplsTopLabelTTL */
6455             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_top_label_ttl,
6456                                      tvb, offset, length, ENC_BIG_ENDIAN);
6457             break;
6458
6459         case 201: /* mplsLabelStackLength */
6460             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_label_length,
6461                                      tvb, offset, length, ENC_BIG_ENDIAN);
6462             break;
6463
6464         case 202: /* mplsLabelStackDepth */
6465             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_label_depth,
6466                                      tvb, offset, length, ENC_BIG_ENDIAN);
6467             break;
6468
6469         case 203: /* mplsTopLabelExp */
6470             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_top_label_exp,
6471                                      tvb, offset, length, ENC_BIG_ENDIAN);
6472             break;
6473
6474         case 204: /* ipPayloadLength */
6475             ti = proto_tree_add_item(pdutree, hf_cflow_ip_payload_length,
6476                                      tvb, offset, length, ENC_BIG_ENDIAN);
6477             break;
6478
6479         case 205: /* UDP_LENGTH */
6480             ti = proto_tree_add_item(pdutree, hf_cflow_udp_length,
6481                                      tvb, offset, length, ENC_BIG_ENDIAN);
6482             break;
6483
6484         case 206: /* IS_MULTICAST */
6485             ti = proto_tree_add_item(pdutree, hf_cflow_is_multicast,
6486                                      tvb, offset, length, ENC_BIG_ENDIAN);
6487             break;
6488
6489         case 207: /* IP_HEADER_WORDS */
6490             ti = proto_tree_add_item(pdutree, hf_cflow_ip_header_words,
6491                                      tvb, offset, length, ENC_BIG_ENDIAN);
6492             break;
6493
6494         case 208: /* OPTION_MAP */
6495             ti = proto_tree_add_item(pdutree, hf_cflow_option_map,
6496                                      tvb, offset, length, ENC_NA);
6497             break;
6498
6499         case 209: /* tcpOptions */
6500             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_option_map,
6501                                      tvb, offset, length, ENC_NA);
6502             break;
6503
6504         case 210: /* paddingOctets */
6505             ti = proto_tree_add_item(pdutree, hf_cflow_padding, tvb, offset, length, ENC_NA);
6506             break;
6507
6508         case 211: /* collectorIPv4Address */
6509             ti = proto_tree_add_item(pdutree, hf_cflow_collector_addr,
6510                                      tvb, offset, length, ENC_BIG_ENDIAN);
6511             break;
6512
6513         case 212: /* collectorIPv6Address */
6514             ti = proto_tree_add_item(pdutree, hf_cflow_collector_addr_v6,
6515                                      tvb, offset, length, ENC_NA);
6516             break;
6517
6518         case 213: /* exportInterface */
6519             ti = proto_tree_add_item(pdutree, hf_cflow_export_interface,
6520                                      tvb, offset, length, ENC_BIG_ENDIAN);
6521             break;
6522
6523         case 214: /* exportProtocolVersion */
6524             ti = proto_tree_add_item(pdutree, hf_cflow_export_protocol_version,
6525                                      tvb, offset, length, ENC_BIG_ENDIAN);
6526             break;
6527
6528         case 215: /* exportTransportProtocol */
6529             ti = proto_tree_add_item(pdutree, hf_cflow_export_prot,
6530                                      tvb, offset, length, ENC_BIG_ENDIAN);
6531             break;
6532
6533         case 216: /* collectorTransportPort */
6534             ti = proto_tree_add_item(pdutree, hf_cflow_collector_port,
6535                                      tvb, offset, length, ENC_BIG_ENDIAN);
6536             break;
6537
6538         case 217: /* exporterTransportPort */
6539             ti = proto_tree_add_item(pdutree, hf_cflow_exporter_port,
6540                                      tvb, offset, length, ENC_BIG_ENDIAN);
6541             break;
6542
6543         case 218: /* tcpSynTotalCount */
6544             ti = proto_tree_add_item(pdutree, hf_cflow_total_tcp_syn,
6545                                      tvb, offset, length, ENC_BIG_ENDIAN);
6546             break;
6547
6548         case 219: /* tcpFinTotalCount */
6549             ti = proto_tree_add_item(pdutree, hf_cflow_total_tcp_fin,
6550                                      tvb, offset, length, ENC_BIG_ENDIAN);
6551             break;
6552
6553         case 220: /* tcpRstTotalCount */
6554             ti = proto_tree_add_item(pdutree, hf_cflow_total_tcp_rst,
6555                                      tvb, offset, length, ENC_BIG_ENDIAN);
6556             break;
6557
6558         case 221: /* tcpPshTotalCount */
6559             ti = proto_tree_add_item(pdutree, hf_cflow_total_tcp_psh,
6560                                      tvb, offset, length, ENC_BIG_ENDIAN);
6561             break;
6562
6563         case 222: /* tcpAckTotalCount */
6564             ti = proto_tree_add_item(pdutree, hf_cflow_total_tcp_ack,
6565                                      tvb, offset, length, ENC_BIG_ENDIAN);
6566             break;
6567
6568         case 223: /* tcpUrgTotalCount */
6569             ti = proto_tree_add_item(pdutree, hf_cflow_total_tcp_urg,
6570                                      tvb, offset, length, ENC_BIG_ENDIAN);
6571             break;
6572
6573         case 224: /* IP_TOTAL_LENGTH */
6574             ti = proto_tree_add_item(pdutree, hf_cflow_ip_total_length,
6575                                      tvb, offset, length, ENC_BIG_ENDIAN);
6576             break;
6577
6578         case 225: /* postNATSourceIPv4Address */
6579         case 40001: /* NF_F_XLATE_SRC_ADDR_IPV4 (Cisco ASA 5500 Series) */
6580             ti = proto_tree_add_item(pdutree, hf_cflow_post_natsource_ipv4_address,
6581                                      tvb, offset, length, ENC_BIG_ENDIAN);
6582             break;
6583
6584         case 226: /* postNATDestinationIPv4Address */
6585         case 40002: /* NF_F_XLATE_DST_ADDR_IPV4 (Cisco ASA 5500 Series) */
6586             ti = proto_tree_add_item(pdutree, hf_cflow_post_natdestination_ipv4_address,
6587                                      tvb, offset, length, ENC_BIG_ENDIAN);
6588             break;
6589
6590         case 227: /* postNAPTSourceTransportPort */
6591         case 40003: /* NF_F_XLATE_SRC_PORT (Cisco ASA 5500 Series) */
6592             ti = proto_tree_add_item(pdutree, hf_cflow_post_naptsource_transport_port,
6593                                      tvb, offset, length, ENC_BIG_ENDIAN);
6594             break;
6595
6596         case 228: /* postNAPTDestinationTransportPort */
6597         case 40004: /* NF_F_XLATE_DST_PORT (Cisco ASA 5500 Series) */
6598             ti = proto_tree_add_item(pdutree, hf_cflow_post_naptdestination_transport_port,
6599                                      tvb, offset, length, ENC_BIG_ENDIAN);
6600             break;
6601
6602         case 229: /* natOriginatingAddressRealm */
6603             ti = proto_tree_add_item(pdutree, hf_cflow_nat_originating_address_realm,
6604                                      tvb, offset, length, ENC_BIG_ENDIAN);
6605             break;
6606
6607         case 230: /* natEvent */
6608             ti = proto_tree_add_item(pdutree, hf_cflow_nat_event,
6609                                      tvb, offset, length, ENC_BIG_ENDIAN);
6610             break;
6611
6612         case 231: /* initiatorOctets */
6613             ti = proto_tree_add_item(pdutree, hf_cflow_initiator_octets,
6614                                      tvb, offset, length, ENC_BIG_ENDIAN);
6615             break;
6616
6617         case 232: /* responderOctets */
6618             ti = proto_tree_add_item(pdutree, hf_cflow_responder_octets,
6619                                      tvb, offset, length, ENC_BIG_ENDIAN);
6620             break;
6621
6622         case 233: /* firewallEvent */
6623         case 40005: /* NF_F_FW_EVENT (Cisco ASA 5500 Series) */
6624             ti = proto_tree_add_item(pdutree, hf_cflow_firewall_event,
6625                                      tvb, offset, length, ENC_BIG_ENDIAN);
6626             break;
6627
6628         case 234: /* ingressVRFID */
6629             ti = proto_tree_add_item(pdutree, hf_cflow_ingress_vrfid,
6630                                      tvb, offset, length, ENC_BIG_ENDIAN);
6631             break;
6632
6633         case 235: /* egressVRFID */
6634             ti = proto_tree_add_item(pdutree, hf_cflow_egress_vrfid,
6635                                      tvb, offset, length, ENC_BIG_ENDIAN);
6636             break;
6637
6638         case 236: /* VRFname */
6639             ti = proto_tree_add_item(pdutree, hf_cflow_vrfname,
6640                                      tvb, offset, length, ENC_UTF_8);
6641             break;
6642
6643         case 237: /* postMplsTopLabelExp */
6644             ti = proto_tree_add_item(pdutree, hf_cflow_post_mpls_top_label_exp,
6645                                      tvb, offset, length, ENC_BIG_ENDIAN);
6646             break;
6647
6648         case 238: /* tcpWindowScale */
6649             ti = proto_tree_add_item(pdutree, hf_cflow_tcp_window_scale,
6650                                      tvb, offset, length, ENC_BIG_ENDIAN);
6651             break;
6652
6653         case 239: /*  biflowDirection */
6654             ti = proto_tree_add_item(pdutree, hf_cflow_biflow_direction,
6655                                      tvb, offset, length, ENC_BIG_ENDIAN);
6656             break;
6657
6658         case 240: /* ethernetHeaderLength */
6659             ti = proto_tree_add_item(pdutree, hf_cflow_ethernet_header_length,
6660                                      tvb, offset, length, ENC_BIG_ENDIAN);
6661             break;
6662
6663         case 241: /* ethernetPayloadLength */
6664             ti = proto_tree_add_item(pdutree, hf_cflow_ethernet_payload_length,
6665                                      tvb, offset, length, ENC_BIG_ENDIAN);
6666             break;
6667
6668         case 242: /* ethernetTotalLength */
6669             ti = proto_tree_add_item(pdutree, hf_cflow_ethernet_total_length,
6670                                      tvb, offset, length, ENC_BIG_ENDIAN);
6671             break;
6672
6673         case 243: /* dot1qVlanId */
6674             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_vlan_id,
6675                                      tvb, offset, length, ENC_BIG_ENDIAN);
6676             break;
6677
6678         case 244: /* dot1qPriority */
6679             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_priority,
6680                                      tvb, offset, length, ENC_BIG_ENDIAN);
6681             break;
6682
6683         case 245: /* dot1qCustomerVlanId */
6684             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_customer_vlan_id,
6685                                      tvb, offset, length, ENC_BIG_ENDIAN);
6686             break;
6687
6688         case 246: /* dot1qCustomerPriority */
6689             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_customer_priority,
6690                                      tvb, offset, length, ENC_BIG_ENDIAN);
6691             break;
6692
6693         case 247: /* metroEvcId */
6694             ti = proto_tree_add_item(pdutree, hf_cflow_metro_evc_id,
6695                                      tvb, offset, length, ENC_UTF_8);
6696             break;
6697
6698         case 248: /* metroEvcType */
6699             ti = proto_tree_add_item(pdutree, hf_cflow_metro_evc_type,
6700                                      tvb, offset, length, ENC_BIG_ENDIAN);
6701             break;
6702
6703         case 249: /* pseudoWireId */
6704             ti = proto_tree_add_item(pdutree, hf_cflow_pseudo_wire_id,
6705                                      tvb, offset, length, ENC_BIG_ENDIAN);
6706             break;
6707
6708         case 250: /* pseudoWireType */
6709             ti = proto_tree_add_item(pdutree, hf_cflow_pseudo_wire_type,
6710                                      tvb, offset, length, ENC_BIG_ENDIAN);
6711             break;
6712
6713         case 251: /* pseudoWireControlWord */
6714             ti = proto_tree_add_item(pdutree, hf_cflow_pseudo_wire_control_word,
6715                                      tvb, offset, length, ENC_BIG_ENDIAN);
6716             break;
6717
6718         case 252: /* ingressPhysicalInterface */
6719             ti = proto_tree_add_item(pdutree, hf_cflow_ingress_physical_interface,
6720                                      tvb, offset, length, ENC_BIG_ENDIAN);
6721             break;
6722
6723         case 253: /* egressPhysicalInterface */
6724             ti = proto_tree_add_item(pdutree, hf_cflow_egress_physical_interface,
6725                                      tvb, offset, length, ENC_BIG_ENDIAN);
6726             break;
6727
6728         case 254: /* postDot1qVlanId */
6729             ti = proto_tree_add_item(pdutree, hf_cflow_post_dot1q_vlan_id,
6730                                      tvb, offset, length, ENC_BIG_ENDIAN);
6731             break;
6732
6733         case 255: /* postDot1qCustomerVlanId */
6734             ti = proto_tree_add_item(pdutree, hf_cflow_post_dot1q_customer_vlan_id,
6735                                      tvb, offset, length, ENC_BIG_ENDIAN);
6736             break;
6737
6738         case 256: /* ethernetType */
6739             ti = proto_tree_add_item(pdutree, hf_cflow_ethernet_type,
6740                                      tvb, offset, length, ENC_BIG_ENDIAN);
6741             break;
6742
6743         case 257: /* postIpPrecedence */
6744             ti = proto_tree_add_item(pdutree, hf_cflow_post_ip_precedence,
6745                                      tvb, offset, length, ENC_BIG_ENDIAN);
6746             break;
6747
6748         case 258: /* collectionTimeMilliseconds */
6749             ts.secs  = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
6750             ts.nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) *1000000;
6751             ti = proto_tree_add_time(pdutree,
6752                                      hf_cflow_collection_time_milliseconds,
6753                                      tvb, offset, length, &ts);
6754             break;
6755
6756         case 259: /* exportSctpStreamId */
6757             ti = proto_tree_add_item(pdutree, hf_cflow_export_sctp_stream_id,
6758                                      tvb, offset, length, ENC_BIG_ENDIAN);
6759             break;
6760
6761         case 260: /* maxExportSeconds */
6762             ts.secs = tvb_get_ntohl(tvb, offset);
6763             ts.nsecs = 0;
6764             ti = proto_tree_add_time(pdutree, hf_cflow_max_export_seconds,
6765                                      tvb, offset, length, &ts);
6766             break;
6767
6768         case 261: /* maxFlowEndSeconds */
6769             ts.secs = tvb_get_ntohl(tvb, offset);
6770             ts.nsecs = 0;
6771             ti = proto_tree_add_time(pdutree, hf_cflow_max_flow_end_seconds,
6772                                      tvb, offset, length, &ts);
6773             break;
6774
6775         case 262: /* messageMD5Checksum */
6776             ti = proto_tree_add_item(pdutree, hf_cflow_message_md5_checksum,
6777                                      tvb, offset, length, ENC_NA);
6778             break;
6779
6780         case 263: /* messageScope */
6781             ti = proto_tree_add_item(pdutree, hf_cflow_message_scope,
6782                                      tvb, offset, length, ENC_BIG_ENDIAN);
6783             break;
6784
6785         case 264: /* minExportSeconds */
6786             ts.secs = tvb_get_ntohl(tvb, offset);
6787             ts.nsecs = 0;
6788             ti = proto_tree_add_time(pdutree, hf_cflow_min_export_seconds,
6789                                      tvb, offset, length, &ts);
6790             break;
6791
6792         case 265: /* minFlowStartSeconds */
6793             ts.secs = tvb_get_ntohl(tvb, offset);
6794             ts.nsecs = 0;
6795             ti = proto_tree_add_time(pdutree, hf_cflow_min_flow_start_seconds,
6796                                      tvb, offset, length, &ts);
6797             break;
6798
6799         case 266: /* opaqueOctets */
6800             ti = proto_tree_add_item(pdutree, hf_cflow_opaque_octets,
6801                                      tvb, offset, length, ENC_NA);
6802             break;
6803
6804         case 267: /* sessionScope */
6805             ti = proto_tree_add_item(pdutree, hf_cflow_session_scope,
6806                                      tvb, offset, length, ENC_BIG_ENDIAN);
6807             break;
6808
6809         case 268: /* maxFlowEndMicroseconds */
6810             ti = proto_tree_add_item(pdutree, hf_cflow_max_flow_end_microseconds,
6811                                      tvb, offset, length, ENC_TIME_NTP|ENC_BIG_ENDIAN);
6812             break;
6813
6814         case 269: /* maxFlowEndMilliseconds */
6815             ts.secs =  (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
6816             ts.nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) * 1000000;
6817             ti = proto_tree_add_time(pdutree, hf_cflow_max_flow_end_milliseconds,
6818                                      tvb, offset, length, &ts);
6819             break;
6820
6821         case 270: /* maxFlowEndNanoseconds */
6822             ti = proto_tree_add_item(pdutree, hf_cflow_max_flow_end_nanoseconds,
6823                                      tvb, offset, length, ENC_TIME_NTP|ENC_BIG_ENDIAN);
6824             break;
6825
6826         case 271: /* minFlowStartMicroseconds */
6827             ti = proto_tree_add_item(pdutree, hf_cflow_min_flow_start_microseconds,
6828                                      tvb, offset, length, ENC_TIME_NTP|ENC_BIG_ENDIAN);
6829             break;
6830
6831         case 272: /* minFlowStartMilliseconds */
6832             ts.secs  = (tvb_get_ntohl(tvb, offset)/1000);
6833             ts.nsecs = (tvb_get_ntohl(tvb, offset)%1000) * 1000000;
6834             ti = proto_tree_add_time(pdutree, hf_cflow_min_flow_start_milliseconds,
6835                                      tvb, offset, length, &ts);
6836             break;
6837
6838         case 273: /* minFlowStartNanoseconds */
6839             ti = proto_tree_add_item(pdutree, hf_cflow_min_flow_start_nanoseconds,
6840                                      tvb, offset, length, ENC_TIME_NTP|ENC_BIG_ENDIAN);
6841             break;
6842
6843         case 274: /* collectorCertificate */
6844             ti = proto_tree_add_item(pdutree, hf_cflow_collector_certificate,
6845                                      tvb, offset, length, ENC_NA);
6846             break;
6847
6848         case 275: /* exporterCertificate */
6849             ti = proto_tree_add_item(pdutree, hf_cflow_exporter_certificate,
6850                                      tvb, offset, length, ENC_NA);
6851             break;
6852
6853         case 276:
6854             ti = proto_tree_add_item(pdutree, hf_cflow_data_records_reliability,
6855                                      tvb, offset, length, ENC_BIG_ENDIAN);
6856             break;
6857
6858         case 277:
6859             ti = proto_tree_add_item(pdutree, hf_cflow_observation_point_type,
6860                                      tvb, offset, length, ENC_BIG_ENDIAN);
6861             break;
6862
6863         case 278:
6864             ti = proto_tree_add_item(pdutree, hf_cflow_new_connection_delta_count,
6865                                      tvb, offset, length, ENC_BIG_ENDIAN);
6866             break;
6867
6868         case 279:
6869             ti = proto_tree_add_item(pdutree, hf_cflow_connection_sum_duration_seconds,
6870                                      tvb, offset, length, ENC_BIG_ENDIAN);
6871             break;
6872
6873         case 280:
6874             ti = proto_tree_add_item(pdutree, hf_cflow_connection_transaction_id,
6875                                      tvb, offset, length, ENC_BIG_ENDIAN);
6876             break;
6877
6878         case 281:
6879             ti = proto_tree_add_item(pdutree, hf_cflow_post_nat_source_ipv6_address,
6880                                      tvb, offset, length, ENC_NA);
6881             break;
6882
6883         case 282:
6884             ti = proto_tree_add_item(pdutree, hf_cflow_post_nat_destination_ipv6_address,
6885                                      tvb, offset, length, ENC_NA);
6886             break;
6887
6888         case 283:
6889             ti = proto_tree_add_item(pdutree, hf_cflow_nat_pool_id,
6890                                      tvb, offset, length, ENC_BIG_ENDIAN);
6891             break;
6892
6893         case 284:
6894             ti = proto_tree_add_item(pdutree, hf_cflow_nat_pool_name,
6895                                      tvb, offset, length, ENC_UTF_8);
6896             break;
6897
6898         case 285:
6899             ti = proto_tree_add_item(pdutree, hf_cflow_anonymization_flags,
6900                                      tvb, offset, length, ENC_NA);
6901             break;
6902
6903         case 286:
6904             ti = proto_tree_add_item(pdutree, hf_cflow_anonymization_technique,
6905                                      tvb, offset, length, ENC_BIG_ENDIAN);
6906             break;
6907
6908         case 287:
6909             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_index,
6910                                      tvb, offset, length, ENC_BIG_ENDIAN);
6911             break;
6912
6913         case 288:
6914             ti = proto_tree_add_item(pdutree, hf_cflow_p2p_technology,
6915                                      tvb, offset, length, ENC_UTF_8);
6916             break;
6917
6918         case 289:
6919             ti = proto_tree_add_item(pdutree, hf_cflow_tunnel_technology,
6920                                      tvb, offset, length, ENC_UTF_8);
6921             break;
6922
6923         case 290:
6924             ti = proto_tree_add_item(pdutree, hf_cflow_encrypted_technology,
6925                                      tvb, offset, length, ENC_UTF_8);
6926             break;
6927
6928         case 292:
6929             ti = proto_tree_add_item(pdutree, hf_cflow_subtemplate_list,
6930                                      tvb, offset, length, ENC_NA);
6931             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
6932             break;
6933
6934         case 294:
6935             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_validity_state,
6936                                      tvb, offset, length, ENC_BIG_ENDIAN);
6937             break;
6938
6939         case 295:
6940             ti = proto_tree_add_item(pdutree, hf_cflow_ipsec_spi,
6941                                      tvb, offset, length, ENC_BIG_ENDIAN);
6942             break;
6943
6944         case 296:
6945             ti = proto_tree_add_item(pdutree, hf_cflow_gre_key,
6946                                      tvb, offset, length, ENC_BIG_ENDIAN);
6947             break;
6948
6949         case 297:
6950             ti = proto_tree_add_item(pdutree, hf_cflow_nat_type,
6951                                      tvb, offset, length, ENC_BIG_ENDIAN);
6952             break;
6953
6954         case 298:
6955             ti = proto_tree_add_item(pdutree, hf_cflow_initiator_packets,
6956                                      tvb, offset, length, ENC_BIG_ENDIAN);
6957             break;
6958
6959         case 299:
6960             ti = proto_tree_add_item(pdutree, hf_cflow_responder_packets,
6961                                      tvb, offset, length, ENC_BIG_ENDIAN);
6962             break;
6963
6964         case 300:
6965             ti = proto_tree_add_item(pdutree, hf_cflow_observation_domain_name,
6966                                      tvb, offset, length, ENC_UTF_8);
6967             break;
6968
6969         case 301: /* selectionSequenceId */
6970             ti = proto_tree_add_item(pdutree, hf_cflow_selection_sequence_id,
6971                                      tvb, offset, length, ENC_BIG_ENDIAN);
6972             break;
6973
6974         case 302: /* selectorId */
6975             ti = proto_tree_add_item(pdutree, hf_cflow_selector_id,
6976                                      tvb, offset, length, ENC_BIG_ENDIAN);
6977             break;
6978
6979         case 303: /* informationElementId */
6980             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_id,
6981                                      tvb, offset, length, ENC_BIG_ENDIAN);
6982             break;
6983
6984         case 304: /* selectorAlgorithm */
6985             ti = proto_tree_add_item(pdutree, hf_cflow_selector_algorithm,
6986                                      tvb, offset, length, ENC_BIG_ENDIAN);
6987             break;
6988
6989         case 305: /* samplingPacketInterval */
6990             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_packet_interval,
6991                                      tvb, offset, length, ENC_BIG_ENDIAN);
6992             break;
6993
6994         case 306: /* samplingPacketSpace */
6995             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_packet_space,
6996                                      tvb, offset, length, ENC_BIG_ENDIAN);
6997             break;
6998
6999         case 307: /* samplingTimeInterval */
7000             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_time_interval,
7001                                      tvb, offset, length, ENC_BIG_ENDIAN);
7002             break;
7003
7004         case 308: /* samplingTimeSpace */
7005             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_time_space,
7006                                      tvb, offset, length, ENC_BIG_ENDIAN);
7007             break;
7008
7009         case 309: /* samplingSize */
7010             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_size,
7011                                      tvb, offset, length, ENC_BIG_ENDIAN);
7012             break;
7013
7014         case 310: /* samplingPopulation */
7015             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_population,
7016                                      tvb, offset, length, ENC_BIG_ENDIAN);
7017             break;
7018
7019         case 311: /* samplingProbability */
7020             if (length == 4) {
7021                 ti = proto_tree_add_item(pdutree, hf_cflow_sampling_probability_float32,
7022                                          tvb, offset, length, ENC_BIG_ENDIAN);
7023             } else {
7024                 ti = proto_tree_add_item(pdutree, hf_cflow_sampling_probability_float64,
7025                                          tvb, offset, length, ENC_BIG_ENDIAN);
7026             }
7027             break;
7028
7029         case 312:
7030             ti = proto_tree_add_item(pdutree, hf_cflow_data_link_frame_size,
7031                                      tvb, offset, length, ENC_BIG_ENDIAN);
7032             break;
7033
7034         case 313: /* SECTION_HEADER */
7035             ti = proto_tree_add_item(pdutree, hf_cflow_section_header,
7036                                      tvb, offset, length, ENC_NA);
7037             break;
7038
7039         case 314: /* SECTION_PAYLOAD */
7040             ti = proto_tree_add_item(pdutree, hf_cflow_section_payload,
7041                                      tvb, offset, length, ENC_NA);
7042             break;
7043
7044         case 315: /* Data Link Frame Section */
7045             {
7046                 bool save_writable;
7047                 address save_dl_src, save_dl_dst, save_net_src, save_net_dst, save_src, save_dst;
7048                 ti = proto_tree_add_item(pdutree, hf_cflow_data_link_frame_section,
7049                         tvb, offset, length, ENC_NA);
7050                 dl_frame_sec_tree = proto_item_add_subtree (ti, ett_data_link_frame_sec);
7051                 tvbuff_t *tvb_new = tvb_new_subset_length (tvb, offset, length);
7052
7053                 /* Before passing the packet to the eth dissector to decode IE315,
7054                  * need to save the addresses of the current netflow packet.
7055                  * This is because when we pass the packet to the next dissector,
7056                  * it will overwrite the info column
7057                  * (which currently displays the addresses of the netflow packet)
7058                  * with the addresses of the l2 packet carried by IE315.
7059                  * Once the decode of this IE is done we rewrite the info column with
7060                  * the saved addresses.
7061                  */
7062
7063                 /* Save Writable Context */
7064                 save_writable = col_get_writable (pinfo->cinfo, -1);
7065
7066                 /* Disable overwriting of the info column by the sub dissectors*/
7067                 col_set_writable (pinfo->cinfo, -1, false);
7068                 /* Save the source and destination addresses */
7069                 copy_address_shallow(&save_dl_src, &pinfo->dl_src);
7070                 copy_address_shallow(&save_dl_dst, &pinfo->dl_dst);
7071                 copy_address_shallow(&save_net_src, &pinfo->net_src);
7072                 copy_address_shallow(&save_net_dst, &pinfo->net_dst);
7073                 copy_address_shallow(&save_src, &pinfo->src);
7074                 copy_address_shallow(&save_dst, &pinfo->dst);
7075
7076                 /* Call the L2 dissector */
7077                 call_dissector(eth_handle, tvb_new, pinfo, dl_frame_sec_tree);
7078
7079                 /* reset the state of the info column */
7080                 col_set_writable (pinfo->cinfo, -1, save_writable);
7081                 /* Copy back the source and the destination addresses */
7082                 copy_address_shallow(&pinfo->dl_src, &save_dl_src);
7083                 copy_address_shallow(&pinfo->dl_dst, &save_dl_dst);
7084                 copy_address_shallow(&pinfo->net_src, &save_net_src);
7085                 copy_address_shallow(&pinfo->net_dst, &save_net_dst);
7086                 copy_address_shallow(&pinfo->src, &save_src);
7087                 copy_address_shallow(&pinfo->dst, &save_dst);
7088             }
7089             break;
7090
7091         case 316: /* mplsLabelStackSection */
7092             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_label_stack_section,
7093                                      tvb, offset, length, ENC_NA);
7094             break;
7095
7096         case 317: /* mplsPayloadPacketSection */
7097             ti = proto_tree_add_item(pdutree, hf_cflow_mpls_payload_packet_section,
7098                                      tvb, offset, length, ENC_NA);
7099             break;
7100
7101         case 318: /* selectorIdTotalPktsObserved */
7102             ti = proto_tree_add_item(pdutree, hf_cflow_selector_id_total_pkts_observed,
7103                                      tvb, offset, length, ENC_BIG_ENDIAN);
7104             break;
7105
7106         case 319: /* selectorIdTotalPktsSelected */
7107             ti = proto_tree_add_item(pdutree, hf_cflow_selector_id_total_pkts_selected,
7108                                      tvb, offset, length, ENC_BIG_ENDIAN);
7109             break;
7110
7111         case 320: /* absoluteError */
7112             if (length == 4) {
7113                 ti = proto_tree_add_item(pdutree, hf_cflow_absolute_error_float32,
7114                                          tvb, offset, length, ENC_BIG_ENDIAN);
7115             } else {
7116                 ti = proto_tree_add_item(pdutree, hf_cflow_absolute_error_float64,
7117                                          tvb, offset, length, ENC_BIG_ENDIAN);
7118             }
7119             break;
7120
7121         case 321: /* relativeError */
7122             if (length == 4) {
7123                 ti = proto_tree_add_item(pdutree, hf_cflow_relative_error_float32,
7124                                          tvb, offset, length, ENC_BIG_ENDIAN);
7125             } else {
7126                 ti = proto_tree_add_item(pdutree, hf_cflow_relative_error_float64,
7127                                          tvb, offset, length, ENC_BIG_ENDIAN);
7128             }
7129             break;
7130
7131         case 322: /* observationTimeSeconds */
7132             ts.secs = tvb_get_ntohl(tvb, offset);
7133             ts.nsecs = 0;
7134             ti = proto_tree_add_time(pdutree, hf_cflow_observation_time_seconds,
7135                                      tvb, offset, length, &ts);
7136             break;
7137
7138         case 323: /* observationTimeMilliseconds */
7139             ts.secs  = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
7140             ts.nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) * 1000000;
7141             ti = proto_tree_add_time(pdutree, hf_cflow_observation_time_milliseconds,
7142                                      tvb, offset, length, &ts);
7143             break;
7144
7145         case 324: /* observationTimeMicroseconds */
7146             ti = proto_tree_add_item(pdutree, hf_cflow_observation_time_microseconds,
7147                                      tvb, offset, length, ENC_TIME_NTP|ENC_BIG_ENDIAN);
7148             break;
7149
7150         case 325: /* observationTimeNanoseconds */
7151             ti = proto_tree_add_item(pdutree, hf_cflow_observation_time_nanoseconds,
7152                                      tvb, offset, length, ENC_TIME_NTP|ENC_BIG_ENDIAN);
7153             break;
7154
7155         case 326: /* digestHashValue */
7156             ti = proto_tree_add_item(pdutree, hf_cflow_digest_hash_value,
7157                                      tvb, offset, length, ENC_BIG_ENDIAN);
7158             break;
7159
7160         case 327: /* hashIPPayloadOffset */
7161             ti = proto_tree_add_item(pdutree, hf_cflow_hash_ippayload_offset,
7162                                      tvb, offset, length, ENC_BIG_ENDIAN);
7163             break;
7164
7165         case 328: /* hashIPPayloadSize */
7166             ti = proto_tree_add_item(pdutree, hf_cflow_hash_ippayload_size,
7167                                      tvb, offset, length, ENC_BIG_ENDIAN);
7168             break;
7169
7170         case 329: /* hashOutputRangeMin */
7171             ti = proto_tree_add_item(pdutree, hf_cflow_hash_output_range_min,
7172                                      tvb, offset, length, ENC_BIG_ENDIAN);
7173             break;
7174
7175         case 330: /* hashOutputRangeMax */
7176             ti = proto_tree_add_item(pdutree, hf_cflow_hash_output_range_max,
7177                                      tvb, offset, length, ENC_BIG_ENDIAN);
7178             break;
7179
7180         case 331: /* hashSelectedRangeMin */
7181             ti = proto_tree_add_item(pdutree, hf_cflow_hash_selected_range_min,
7182                                      tvb, offset, length, ENC_BIG_ENDIAN);
7183             break;
7184
7185         case 332: /* hashSelectedRangeMax */
7186             ti = proto_tree_add_item(pdutree, hf_cflow_hash_selected_range_max,
7187                                      tvb, offset, length, ENC_BIG_ENDIAN);
7188             break;
7189
7190         case 333: /* hashDigestOutput */
7191             ti = proto_tree_add_item(pdutree, hf_cflow_hash_digest_output,
7192                                      tvb, offset, length, ENC_BIG_ENDIAN);
7193             break;
7194
7195         case 334: /* hashInitialiserValue */
7196             ti = proto_tree_add_item(pdutree, hf_cflow_hash_initialiser_value,
7197                                      tvb, offset, length, ENC_BIG_ENDIAN);
7198             break;
7199
7200         case 335: /* selectorName */
7201             ti = proto_tree_add_item(pdutree, hf_cflow_selector_name,
7202                                      tvb, offset, length, ENC_UTF_8);
7203             break;
7204
7205         case 336: /* upperCILimit */
7206             if (length == 4) {
7207                 ti = proto_tree_add_item(pdutree, hf_cflow_upper_cilimit_float32,
7208                                          tvb, offset, length, ENC_BIG_ENDIAN);
7209             } else {
7210                 ti = proto_tree_add_item(pdutree, hf_cflow_upper_cilimit_float64,
7211                                          tvb, offset, length, ENC_BIG_ENDIAN);
7212             }
7213             break;
7214
7215         case 337: /* lowerCILimit */
7216             if (length == 4) {
7217                 ti = proto_tree_add_item(pdutree, hf_cflow_lower_cilimit_float32,
7218                                          tvb, offset, length, ENC_BIG_ENDIAN);
7219             } else {
7220                 ti = proto_tree_add_item(pdutree, hf_cflow_lower_cilimit_float64,
7221                                          tvb, offset, length, ENC_BIG_ENDIAN);
7222             }
7223             break;
7224
7225         case 338: /* confidenceLevel */
7226             if (length == 4) {
7227                 ti = proto_tree_add_item(pdutree, hf_cflow_confidence_level_float32,
7228                                          tvb, offset, length, ENC_BIG_ENDIAN);
7229             } else {
7230                 ti = proto_tree_add_item(pdutree, hf_cflow_confidence_level_float64,
7231                                          tvb, offset, length, ENC_BIG_ENDIAN);
7232             }
7233             break;
7234
7235         case 339: /* informationElementDataType */
7236             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_data_type,
7237                                      tvb, offset, length, ENC_BIG_ENDIAN);
7238             break;
7239
7240         case 340: /* informationElementDescription */
7241             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_description,
7242                                      tvb, offset, length, ENC_UTF_8);
7243             break;
7244
7245         case 341: /* informationElementName */
7246             {
7247                 const uint8_t *string;
7248                 ti = proto_tree_add_item_ret_string(pdutree, hf_cflow_information_element_name,
7249                                          tvb, offset, length, ENC_UTF_8|ENC_NA, pinfo->pool, &string);
7250                 /* Add name of element to root for this flow */
7251                 proto_item_append_text(pdutree, " [%s]", string);
7252             }
7253             break;
7254
7255         case 342: /* informationElementRangeBegin */
7256             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_range_begin,
7257                                      tvb, offset, length, ENC_BIG_ENDIAN);
7258             break;
7259
7260         case 343: /* informationElementRangeEnd */
7261             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_range_end,
7262                                      tvb, offset, length, ENC_BIG_ENDIAN);
7263             break;
7264
7265         case 344: /* informationElementSemantics */
7266             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_semantics,
7267                                      tvb, offset, length, ENC_BIG_ENDIAN);
7268             break;
7269
7270         case 345: /* informationElementUnits */
7271             ti = proto_tree_add_item(pdutree, hf_cflow_information_element_units,
7272                                      tvb, offset, length, ENC_BIG_ENDIAN);
7273             break;
7274
7275         case 346: /* privateEnterpriseNumber */
7276             ti = proto_tree_add_item(pdutree, hf_cflow_private_enterprise_number,
7277                                      tvb, offset, length, ENC_BIG_ENDIAN);
7278             break;
7279
7280         case 347: /* virtualStationInterfaceId */
7281             ti = proto_tree_add_item(pdutree, hf_cflow_virtual_station_interface_id,
7282                                      tvb, offset, length, ENC_NA);
7283             break;
7284
7285         case 348: /* virtualStationInterfaceName */
7286             ti = proto_tree_add_item(pdutree, hf_cflow_virtual_station_interface_name,
7287                                      tvb, offset, length, ENC_UTF_8);
7288             break;
7289
7290         case 349: /* virtualStationUUID */
7291             ti = proto_tree_add_item(pdutree, hf_cflow_virtual_station_uuid,
7292                                      tvb, offset, length, ENC_NA);
7293             break;
7294
7295         case 350: /* virtualStationName */
7296             ti = proto_tree_add_item(pdutree, hf_cflow_virtual_station_name,
7297                                      tvb, offset, length, ENC_UTF_8);
7298             break;
7299
7300         case 351: /* layer2SegmentId */
7301             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_segment_id,
7302                                      tvb, offset, length, ENC_BIG_ENDIAN);
7303             break;
7304
7305         case 416:
7306         case 352: /* layer2OctetDeltaCount */
7307             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_octet_delta_count,
7308                                      tvb, offset, length, ENC_BIG_ENDIAN);
7309             break;
7310
7311         case 419:
7312         case 353: /* layer2OctetTotalCount */
7313             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_octet_total_count,
7314                                      tvb, offset, length, ENC_BIG_ENDIAN);
7315             break;
7316
7317         case 354: /* ingressUnicastPacketTotalCount */
7318             ti = proto_tree_add_item(pdutree, hf_cflow_ingress_unicast_packet_total_count,
7319                                      tvb, offset, length, ENC_BIG_ENDIAN);
7320             break;
7321
7322         case 355: /* ingressMulticastPacketTotalCount */
7323             ti = proto_tree_add_item(pdutree, hf_cflow_ingress_multicast_packet_total_count,
7324                                      tvb, offset, length, ENC_BIG_ENDIAN);
7325             break;
7326
7327         case 356: /* ingressBroadcastPacketTotalCount */
7328             ti = proto_tree_add_item(pdutree, hf_cflow_ingress_broadcast_packet_total_count,
7329                                      tvb, offset, length, ENC_BIG_ENDIAN);
7330             break;
7331
7332         case 357: /* egressUnicastPacketTotalCount */
7333             ti = proto_tree_add_item(pdutree, hf_cflow_egress_unicast_packet_total_count,
7334                                      tvb, offset, length, ENC_BIG_ENDIAN);
7335             break;
7336
7337         case 358: /* egressBroadcastPacketTotalCount */
7338             ti = proto_tree_add_item(pdutree, hf_cflow_egress_broadcast_packet_total_count,
7339                                      tvb, offset, length, ENC_BIG_ENDIAN);
7340             break;
7341
7342         case 359: /* monitoringIntervalStartMilliSeconds */
7343             ts.secs  = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
7344             ts.nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) * 1000000;
7345             ti = proto_tree_add_time(pdutree, hf_cflow_monitoring_interval_start_milliseconds,
7346                                      tvb, offset, length, &ts);
7347             break;
7348
7349         case 360: /* monitoringIntervalEndMilliSeconds */
7350             ts.secs  = (time_t)(tvb_get_ntoh64(tvb, offset)/1000);
7351             ts.nsecs = (int)(tvb_get_ntoh64(tvb, offset)%1000) * 1000000;
7352             ti = proto_tree_add_time(pdutree, hf_cflow_monitoring_interval_end_milliseconds,
7353                                      tvb, offset, length, &ts);
7354             break;
7355
7356         case 361: /* portRangeStart */
7357             ti = proto_tree_add_item(pdutree, hf_cflow_port_range_start,
7358                                      tvb, offset, length, ENC_BIG_ENDIAN);
7359             break;
7360
7361         case 362: /* portRangeEnd */
7362             ti = proto_tree_add_item(pdutree, hf_cflow_port_range_end,
7363                                      tvb, offset, length, ENC_BIG_ENDIAN);
7364             break;
7365
7366         case 363: /* portRangeStepSize */
7367             ti = proto_tree_add_item(pdutree, hf_cflow_port_range_step_size,
7368                                      tvb, offset, length, ENC_BIG_ENDIAN);
7369             break;
7370
7371         case 364: /* portRangeNumPorts */
7372             ti = proto_tree_add_item(pdutree, hf_cflow_port_range_num_ports,
7373                                      tvb, offset, length, ENC_BIG_ENDIAN);
7374             break;
7375
7376         case 365: /* staMacAddress */
7377             ti = proto_tree_add_item(pdutree, hf_cflow_sta_mac_address,
7378                                      tvb, offset, length, ENC_NA);
7379             break;
7380
7381         case 366: /* staIPv4Address */
7382             ti = proto_tree_add_item(pdutree, hf_cflow_sta_ipv4_address,
7383                                      tvb, offset, length, ENC_BIG_ENDIAN);
7384             break;
7385
7386         case 367: /* wtpMacAddress */
7387             ti = proto_tree_add_item(pdutree, hf_cflow_wtp_mac_address,
7388                                      tvb, offset, length, ENC_NA);
7389             break;
7390
7391         case 368: /* ingressInterfaceType */
7392             ti = proto_tree_add_item(pdutree, hf_cflow_ingress_interface_type,
7393                                      tvb, offset, length, ENC_BIG_ENDIAN);
7394             break;
7395
7396         case 369: /* egressInterfaceType */
7397             ti = proto_tree_add_item(pdutree, hf_cflow_egress_interface_type,
7398                                      tvb, offset, length, ENC_BIG_ENDIAN);
7399             break;
7400
7401         case 370: /* rtpSequenceNumber */
7402             ti = proto_tree_add_item(pdutree, hf_cflow_rtp_sequence_number,
7403                                      tvb, offset, length, ENC_BIG_ENDIAN);
7404             break;
7405
7406         case 371: /* userName */
7407             ti = proto_tree_add_item(pdutree, hf_cflow_user_name,
7408                                      tvb, offset, length, ENC_UTF_8);
7409             break;
7410
7411         case 372: /* applicationCategoryName */
7412             ti = proto_tree_add_item(pdutree, hf_cflow_application_category_name,
7413                                      tvb, offset, length, ENC_UTF_8);
7414             break;
7415
7416         case 373: /* applicationSubCategoryName */
7417             ti = proto_tree_add_item(pdutree, hf_cflow_application_sub_category_name,
7418                                      tvb, offset, length, ENC_UTF_8);
7419             break;
7420
7421         case 374: /* applicationGroupName */
7422             ti = proto_tree_add_item(pdutree, hf_cflow_application_group_name,
7423                                      tvb, offset, length, ENC_UTF_8);
7424             break;
7425
7426         case 375: /* originalFlowsPresent */
7427             ti = proto_tree_add_item(pdutree, hf_cflow_original_flows_present,
7428                                      tvb, offset, length, ENC_BIG_ENDIAN);
7429             break;
7430
7431         case 376: /* originalFlowsInitiated */
7432             ti = proto_tree_add_item(pdutree, hf_cflow_original_flows_initiated,
7433                                      tvb, offset, length, ENC_BIG_ENDIAN);
7434             break;
7435
7436         case 377: /* originalFlowsCompleted */
7437             ti = proto_tree_add_item(pdutree, hf_cflow_original_flows_completed,
7438                                      tvb, offset, length, ENC_BIG_ENDIAN);
7439             break;
7440
7441         case 378: /* distinctCountOfSourceIPAddress */
7442             ti = proto_tree_add_item(pdutree, hf_cflow_distinct_count_of_source_ip_address,
7443                                      tvb, offset, length, ENC_BIG_ENDIAN);
7444             break;
7445
7446         case 379: /* distinctCountOfDestinationIPAddress */
7447             ti = proto_tree_add_item(pdutree, hf_cflow_distinct_count_of_destinationip_address,
7448                                      tvb, offset, length, ENC_BIG_ENDIAN);
7449             break;
7450
7451         case 380: /* distinctCountOfSourceIPv4Address */
7452             ti = proto_tree_add_item(pdutree, hf_cflow_distinct_count_of_source_ipv4_address,
7453                                      tvb, offset, length, ENC_BIG_ENDIAN);
7454             break;
7455
7456         case 381: /* distinctCountOfDestinationIPv4Address */
7457             ti = proto_tree_add_item(pdutree, hf_cflow_distinct_count_of_destination_ipv4_address,
7458                                      tvb, offset, length, ENC_BIG_ENDIAN);
7459             break;
7460
7461         case 382: /* distinctCountOfSourceIPv6Address */
7462             ti = proto_tree_add_item(pdutree, hf_cflow_distinct_count_of_source_ipv6_address,
7463                                      tvb, offset, length, ENC_BIG_ENDIAN);
7464             break;
7465
7466         case 383: /* distinctCountOfDestinationIPv6Address */
7467             ti = proto_tree_add_item(pdutree, hf_cflow_distinct_count_of_destination_ipv6_address,
7468                                      tvb, offset, length, ENC_BIG_ENDIAN);
7469             break;
7470
7471         case 384: /* valueDistributionMethod */
7472             ti = proto_tree_add_item(pdutree, hf_cflow_value_distribution_method,
7473                                      tvb, offset, length, ENC_BIG_ENDIAN);
7474             break;
7475
7476         case 385: /* rfc3550JitterMilliseconds */
7477             ti = proto_tree_add_item(pdutree, hf_cflow_rfc3550_jitter_milliseconds,
7478                                      tvb, offset, length, ENC_BIG_ENDIAN);
7479             break;
7480
7481         case 386: /* rfc3550JitterMicroseconds */
7482             ti = proto_tree_add_item(pdutree, hf_cflow_rfc3550_jitter_microseconds,
7483                                      tvb, offset, length, ENC_BIG_ENDIAN);
7484             break;
7485
7486         case 387: /* rfc3550JitterNanoseconds */
7487             ti = proto_tree_add_item(pdutree, hf_cflow_rfc3550_jitter_nanoseconds,
7488                                      tvb, offset, length, ENC_BIG_ENDIAN);
7489             break;
7490
7491         case 388: /* dot1qDEI */
7492             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_dei,
7493                                      tvb, offset, length, ENC_BIG_ENDIAN);
7494             break;
7495
7496         case 389: /* dot1qCustomerDEI */
7497             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_customer_dei,
7498                                      tvb, offset, length, ENC_BIG_ENDIAN);
7499             break;
7500
7501         case 390: /* flowSelectorAlgorithm */
7502             ti = proto_tree_add_item(pdutree, hf_cflow_flow_selector_algorithm,
7503                                      tvb, offset, length, ENC_BIG_ENDIAN);
7504             break;
7505
7506         case 391: /* flowSelectedOctetDeltaCount */
7507             ti = proto_tree_add_item(pdutree, hf_cflow_flow_selected_octet_delta_count,
7508                                      tvb, offset, length, ENC_BIG_ENDIAN);
7509             break;
7510
7511         case 392: /* flowSelectedPacketDeltaCount */
7512             ti = proto_tree_add_item(pdutree, hf_cflow_flow_selected_packet_delta_count,
7513                                      tvb, offset, length, ENC_BIG_ENDIAN);
7514             break;
7515
7516         case 393: /* flowSelectedFlowDeltaCount */
7517             ti = proto_tree_add_item(pdutree, hf_cflow_flow_selected_flow_delta_count,
7518                                      tvb, offset, length, ENC_BIG_ENDIAN);
7519             break;
7520
7521         case 394: /* selectorIDTotalFlowsObserved */
7522             ti = proto_tree_add_item(pdutree, hf_cflow_selectorid_total_flows_observed,
7523                                      tvb, offset, length, ENC_BIG_ENDIAN);
7524             break;
7525
7526         case 395: /* selectorIDTotalFlowsSelected */
7527             ti = proto_tree_add_item(pdutree, hf_cflow_selectorid_total_flows_selected,
7528                                      tvb, offset, length, ENC_BIG_ENDIAN);
7529             break;
7530
7531         case 396: /* samplingFlowInterval */
7532             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_flow_interval,
7533                                      tvb, offset, length, ENC_BIG_ENDIAN);
7534             break;
7535
7536         case 397: /* samplingFlowSpacing */
7537             ti = proto_tree_add_item(pdutree, hf_cflow_sampling_flow_spacing,
7538                                      tvb, offset, length, ENC_BIG_ENDIAN);
7539             break;
7540
7541         case 398: /* flowSamplingTimeInterval */
7542             ti = proto_tree_add_item(pdutree, hf_cflow_flow_sampling_time_interval,
7543                                      tvb, offset, length, ENC_BIG_ENDIAN);
7544             break;
7545
7546         case 399: /* flowSamplingTimeSpacing */
7547             ti = proto_tree_add_item(pdutree, hf_cflow_flow_sampling_time_spacing,
7548                                      tvb, offset, length, ENC_BIG_ENDIAN);
7549             break;
7550
7551         case 400: /* hashFlowDomain */
7552             ti = proto_tree_add_item(pdutree, hf_cflow_hash_flow_domain,
7553                                      tvb, offset, length, ENC_BIG_ENDIAN);
7554             break;
7555
7556         case 401: /* transportOctetDeltaCount */
7557             ti = proto_tree_add_item(pdutree, hf_cflow_transport_octet_delta_count,
7558                                      tvb, offset, length, ENC_BIG_ENDIAN);
7559             break;
7560
7561         case 402: /* transportPacketDeltaCount */
7562             ti = proto_tree_add_item(pdutree, hf_cflow_transport_packet_delta_count,
7563                                      tvb, offset, length, ENC_BIG_ENDIAN);
7564             break;
7565
7566         case 403: /* originalExporterIPv4Address */
7567             ti = proto_tree_add_item(pdutree, hf_cflow_original_exporter_ipv4_address,
7568                                      tvb, offset, length, ENC_BIG_ENDIAN);
7569             break;
7570
7571         case 404: /* originalExporterIPv6Address */
7572             ti = proto_tree_add_item(pdutree, hf_cflow_original_exporter_ipv6_address,
7573                                      tvb, offset, length, ENC_NA);
7574             break;
7575
7576         case 405: /* originalObservationDomainId */
7577             ti = proto_tree_add_item(pdutree, hf_cflow_original_observation_domain_id,
7578                                      tvb, offset, length, ENC_BIG_ENDIAN);
7579             break;
7580
7581         case 406: /* intermediateProcessId */
7582             ti = proto_tree_add_item(pdutree, hf_cflow_intermediate_process_id,
7583                                      tvb, offset, length, ENC_BIG_ENDIAN);
7584             break;
7585
7586         case 407: /* ignoredDataRecordTotalCount */
7587             ti = proto_tree_add_item(pdutree, hf_cflow_ignored_data_record_total_count,
7588                                      tvb, offset, length, ENC_BIG_ENDIAN);
7589             break;
7590
7591         case 408: /* dataLinkFrameType */
7592             ti = proto_tree_add_item(pdutree, hf_cflow_data_link_frame_type,
7593                                      tvb, offset, length, ENC_BIG_ENDIAN);
7594             break;
7595
7596         case 409: /* sectionOffset */
7597             ti = proto_tree_add_item(pdutree, hf_cflow_section_offset,
7598                                      tvb, offset, length, ENC_BIG_ENDIAN);
7599             break;
7600
7601         case 410: /* sectionExportedOctets */
7602             ti = proto_tree_add_item(pdutree, hf_cflow_section_exported_octets,
7603                                      tvb, offset, length, ENC_BIG_ENDIAN);
7604             break;
7605
7606         case 411: /* dot1qServiceInstanceTag */
7607             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_service_instance_tag,
7608                                      tvb, offset, length, ENC_NA);
7609             break;
7610
7611         case 412: /* dot1qServiceInstanceId */
7612             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_service_instance_id,
7613                                      tvb, offset, length, ENC_BIG_ENDIAN);
7614             break;
7615
7616         case 413: /* dot1qServiceInstancePriority */
7617             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_service_instance_priority,
7618                                      tvb, offset, length, ENC_BIG_ENDIAN);
7619             break;
7620
7621         case 414: /* dot1qCustomerSourceMacAddress */
7622             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_customer_source_mac_address,
7623                                      tvb, offset, length, ENC_NA);
7624             break;
7625
7626         case 415: /* dot1qCustomerDestinationMacAddress */
7627             ti = proto_tree_add_item(pdutree, hf_cflow_dot1q_customer_destination_mac_address,
7628                                      tvb, offset, length, ENC_NA);
7629             break;
7630
7631         case 417: /* postLayer2OctetDeltaCount */
7632             ti = proto_tree_add_item(pdutree, hf_cflow_post_layer2_octet_delta_count,
7633                                      tvb, offset, length, ENC_BIG_ENDIAN);
7634             break;
7635
7636         case 418: /* postMCastLayer2OctetDeltaCount */
7637             ti = proto_tree_add_item(pdutree, hf_cflow_postm_cast_layer2_octet_delta_count,
7638                                      tvb, offset, length, ENC_BIG_ENDIAN);
7639             break;
7640
7641         case 420: /* postLayer2OctetTotalCount */
7642             ti = proto_tree_add_item(pdutree, hf_cflow_post_layer2_octet_total_count,
7643                                      tvb, offset, length, ENC_BIG_ENDIAN);
7644             break;
7645
7646         case 421: /* postMCastLayer2OctetTotalCount */
7647             ti = proto_tree_add_item(pdutree, hf_cflow_postm_cast_layer2_octet_total_count,
7648                                      tvb, offset, length, ENC_BIG_ENDIAN);
7649             break;
7650
7651         case 422: /* minimumLayer2TotalLength */
7652             ti = proto_tree_add_item(pdutree, hf_cflow_minimum_layer2_total_length,
7653                                      tvb, offset, length, ENC_BIG_ENDIAN);
7654             break;
7655
7656         case 423: /* maximumLayer2TotalLength */
7657             ti = proto_tree_add_item(pdutree, hf_cflow_maximum_layer2_total_length,
7658                                      tvb, offset, length, ENC_BIG_ENDIAN);
7659             break;
7660
7661         case 424: /* droppedLayer2OctetDeltaCount */
7662             ti = proto_tree_add_item(pdutree, hf_cflow_dropped_layer2_octet_delta_count,
7663                                      tvb, offset, length, ENC_BIG_ENDIAN);
7664             break;
7665
7666         case 425: /* droppedLayer2OctetTotalCount */
7667             ti = proto_tree_add_item(pdutree, hf_cflow_dropped_layer2_octet_total_count,
7668                                      tvb, offset, length, ENC_BIG_ENDIAN);
7669             break;
7670
7671         case 426: /* ignoredLayer2OctetTotalCount */
7672             ti = proto_tree_add_item(pdutree, hf_cflow_ignored_layer2_octet_total_count,
7673                                      tvb, offset, length, ENC_BIG_ENDIAN);
7674             break;
7675
7676         case 427: /* notSentLayer2OctetTotalCount */
7677             ti = proto_tree_add_item(pdutree, hf_cflow_not_sent_layer2_octet_total_count,
7678                                      tvb, offset, length, ENC_BIG_ENDIAN);
7679             break;
7680
7681         case 428: /* layer2OctetDeltaSumOfSquares */
7682             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_octet_delta_sum_of_squares,
7683                                      tvb, offset, length, ENC_BIG_ENDIAN);
7684             break;
7685
7686         case 429: /* layer2OctetTotalSumOfSquares */
7687             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_octet_total_sum_of_squares,
7688                                      tvb, offset, length, ENC_BIG_ENDIAN);
7689             break;
7690
7691         case 430: /* layer2FrameDeltaCount */
7692             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_frame_delta_count,
7693                                      tvb, offset, length, ENC_BIG_ENDIAN);
7694             break;
7695
7696         case 431: /* layer2FrameTotalCount */
7697             ti = proto_tree_add_item(pdutree, hf_cflow_layer2_frame_total_count,
7698                                      tvb, offset, length, ENC_BIG_ENDIAN);
7699             break;
7700
7701         case 432: /* pseudoWireDestinationIPv4Address */
7702             ti = proto_tree_add_item(pdutree, hf_cflow_pseudo_wire_destination_ipv4_address,
7703                                      tvb, offset, length, ENC_BIG_ENDIAN);
7704             break;
7705
7706         case 433: /* ignoredLayer2FrameTotalCount */
7707             ti = proto_tree_add_item(pdutree, hf_cflow_ignored_layer2_frame_total_count,
7708                                      tvb, offset, length, ENC_BIG_ENDIAN);
7709             break;
7710
7711         case 434: /* mibObjectValueInteger */
7712             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_integer,
7713                                      tvb, offset, length, ENC_BIG_ENDIAN);
7714             break;
7715
7716         case 435: /* mibObjectValueOctetString */
7717             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_octetstring,
7718                                      tvb, offset, length, ENC_NA);
7719             break;
7720
7721         case 436: /* mibObjectValueOID */
7722             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_oid,
7723                                      tvb, offset, length, ENC_NA);
7724             break;
7725
7726         case 437: /* mibObjectValueBits */
7727             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_bits,
7728                                      tvb, offset, length, ENC_NA);
7729             break;
7730
7731         case 438: /* mibObjectValueIPAddress */
7732             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_ipaddress,
7733                                      tvb, offset, length, ENC_BIG_ENDIAN);
7734             break;
7735
7736         case 439: /* mibObjectValueCounter */
7737             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_counter,
7738                                      tvb, offset, length, ENC_BIG_ENDIAN);
7739             break;
7740
7741         case 440: /* mibObjectValueGauge */
7742             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_gauge,
7743                                      tvb, offset, length, ENC_BIG_ENDIAN);
7744             break;
7745
7746         case 441: /* mibObjectValueTimeTicks */
7747             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_timeticks,
7748                                      tvb, offset, length, ENC_BIG_ENDIAN);
7749             break;
7750
7751         case 442: /* mibObjectValueUnsigned */
7752             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_unsigned,
7753                                      tvb, offset, length, ENC_BIG_ENDIAN);
7754             break;
7755
7756         case 443: /* mibObjectValueTable */
7757             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_table,
7758                                      tvb, offset, length, ENC_NA);
7759             break;
7760
7761         case 444: /* mibObjectValueRow */
7762             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_value_row,
7763                                      tvb, offset, length, ENC_NA);
7764             break;
7765
7766         case 445: /* mibObjectIdentifier */
7767             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_identifier,
7768                                      tvb, offset, length, ENC_NA);
7769             break;
7770
7771         case 446: /* mibSubIdentifier */
7772             ti = proto_tree_add_item(pdutree, hf_cflow_mib_subidentifier,
7773                                      tvb, offset, length, ENC_BIG_ENDIAN);
7774             break;
7775
7776         case 447: /* mibIndexIndicator */
7777             ti = proto_tree_add_item(pdutree, hf_cflow_mib_index_indicator,
7778                                      tvb, offset, length, ENC_BIG_ENDIAN);
7779             break;
7780
7781         case 448: /* mibCaptureTimeSemantics */
7782             ti = proto_tree_add_item(pdutree, hf_cflow_mib_capture_time_semantics,
7783                                      tvb, offset, length, ENC_BIG_ENDIAN);
7784             break;
7785
7786         case 449: /* mibContextEngineID */
7787             ti = proto_tree_add_item(pdutree, hf_cflow_mib_context_engineid,
7788                                      tvb, offset, length, ENC_NA);
7789             break;
7790
7791         case 450: /* mibContextName */
7792             ti = proto_tree_add_item(pdutree, hf_cflow_mib_context_name,
7793                                      tvb, offset, length, ENC_UTF_8);
7794             break;
7795
7796         case 451: /* mibObjectName */
7797             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_name,
7798                                      tvb, offset, length, ENC_UTF_8);
7799             break;
7800
7801         case 452: /* mibObjectDescription */
7802             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_description,
7803                                      tvb, offset, length, ENC_UTF_8);
7804             break;
7805
7806         case 453: /* mibObjectSyntax */
7807             ti = proto_tree_add_item(pdutree, hf_cflow_mib_object_syntax,
7808                                      tvb, offset, length, ENC_UTF_8);
7809             break;
7810
7811         case 454: /* mibModuleName */
7812             ti = proto_tree_add_item(pdutree, hf_cflow_mib_module_name,
7813                                      tvb, offset, length, ENC_UTF_8);
7814             break;
7815
7816         case 455: /* mobileIMSI */
7817             ti = proto_tree_add_item(pdutree, hf_cflow_mobile_imsi,
7818                                      tvb, offset, length, ENC_UTF_8);
7819             break;
7820
7821         case 456: /* mobileMSISDN */
7822             ti = proto_tree_add_item(pdutree, hf_cflow_mobile_msisdn,
7823                                      tvb, offset, length, ENC_UTF_8);
7824             break;
7825
7826         case 457: /* httpStatusCode */
7827             ti = proto_tree_add_item(pdutree, hf_cflow_http_statuscode,
7828                                      tvb, offset, length, ENC_BIG_ENDIAN);
7829             break;
7830
7831         case 458: /* sourceTransportPortsLimit */
7832             ti = proto_tree_add_item(pdutree, hf_cflow_source_transport_ports_limit,
7833                                      tvb, offset, length, ENC_BIG_ENDIAN);
7834             break;
7835
7836         case 459: /* httpRequestMethod */
7837             ti = proto_tree_add_item(pdutree, hf_cflow_http_request_method,
7838                                      tvb, offset, length, ENC_UTF_8);
7839             break;
7840
7841         case 460: /* httpRequestHost */
7842             ti = proto_tree_add_item(pdutree, hf_cflow_http_request_host,
7843                                      tvb, offset, length, ENC_UTF_8);
7844             break;
7845
7846         case 461: /* httpRequestTarget */
7847             ti = proto_tree_add_item(pdutree, hf_cflow_http_request_target,
7848                                      tvb, offset, length, ENC_UTF_8);
7849             break;
7850
7851         case 462: /* httpMessageVersion */
7852             ti = proto_tree_add_item(pdutree, hf_cflow_http_message_version,
7853                                      tvb, offset, length, ENC_UTF_8);
7854             break;
7855
7856         case 463: /* natInstanceID */
7857             ti = proto_tree_add_item(pdutree, hf_cflow_nat_instanceid,
7858                                      tvb, offset, length, ENC_BIG_ENDIAN);
7859             break;
7860
7861         case 464: /* internalAddressRealm */
7862             ti = proto_tree_add_item(pdutree, hf_cflow_internal_address_realm,
7863                                      tvb, offset, length, ENC_NA);
7864             break;
7865
7866         case 465: /* externalAddressRealm */
7867             ti = proto_tree_add_item(pdutree, hf_cflow_external_address_realm,
7868                                      tvb, offset, length, ENC_NA);
7869             break;
7870
7871         case 466: /* natQuotaExceededEvent */
7872             ti = proto_tree_add_item(pdutree, hf_cflow_nat_quota_exceeded_event,
7873                                      tvb, offset, length, ENC_BIG_ENDIAN);
7874             break;
7875
7876         case 467: /* natThresholdEvent */
7877             ti = proto_tree_add_item(pdutree, hf_cflow_nat_threshold_event,
7878                                      tvb, offset, length, ENC_BIG_ENDIAN);
7879             break;
7880
7881         case 468: /* httpUserAgent */
7882             ti = proto_tree_add_item(pdutree, hf_cflow_http_user_agent,
7883                                      tvb, offset, length, ENC_UTF_8);
7884             break;
7885
7886         case 469: /* httpContentType */
7887             ti = proto_tree_add_item(pdutree, hf_cflow_http_content_type,
7888                                      tvb, offset, length, ENC_UTF_8);
7889             break;
7890
7891         case 470: /* httpReasonPhrase */
7892             ti = proto_tree_add_item(pdutree, hf_cflow_http_reason_phrase,
7893                                      tvb, offset, length, ENC_UTF_8);
7894             break;
7895
7896         case 471: /* maxSessionEntries */
7897             ti = proto_tree_add_item(pdutree, hf_cflow_max_session_entries,
7898                                      tvb, offset, length, ENC_BIG_ENDIAN);
7899             break;
7900
7901         case 472: /* maxBIBEntries */
7902             ti = proto_tree_add_item(pdutree, hf_cflow_max_bib_entries,
7903                                      tvb, offset, length, ENC_BIG_ENDIAN);
7904             break;
7905
7906         case 473: /* maxEntriesPerUser */
7907             ti = proto_tree_add_item(pdutree, hf_cflow_max_entries_per_user,
7908                                      tvb, offset, length, ENC_BIG_ENDIAN);
7909             break;
7910
7911         case 474: /* maxSubscribers */
7912             ti = proto_tree_add_item(pdutree, hf_cflow_max_subscribers,
7913                                      tvb, offset, length, ENC_BIG_ENDIAN);
7914             break;
7915
7916         case 475: /* maxFragmentsPendingReassembly */
7917             ti = proto_tree_add_item(pdutree, hf_cflow_max_fragments_pending_reassembly,
7918                                      tvb, offset, length, ENC_BIG_ENDIAN);
7919             break;
7920
7921         case 476: /* addressPoolHighThreshold */
7922             ti = proto_tree_add_item(pdutree, hf_cflow_addresspool_highthreshold,
7923                                      tvb, offset, length, ENC_BIG_ENDIAN);
7924             break;
7925
7926         case 477: /* addressPoolLowThreshold */
7927             ti = proto_tree_add_item(pdutree, hf_cflow_addresspool_lowthreshold,
7928                                      tvb, offset, length, ENC_BIG_ENDIAN);
7929             break;
7930
7931         case 478: /* addressPortMappingHighThreshold */
7932             ti = proto_tree_add_item(pdutree, hf_cflow_addressport_mapping_highthreshold,
7933                                      tvb, offset, length, ENC_BIG_ENDIAN);
7934             break;
7935
7936         case 479: /* addressPortMappingLowThreshold */
7937             ti = proto_tree_add_item(pdutree, hf_cflow_addressport_mapping_lowthreshold,
7938                                      tvb, offset, length, ENC_BIG_ENDIAN);
7939             break;
7940
7941         case 480: /* addressPortMappingPerUserHighThreshold */
7942             ti = proto_tree_add_item(pdutree, hf_cflow_addressport_mapping_per_user_highthreshold ,
7943                                      tvb, offset, length, ENC_BIG_ENDIAN);
7944             break;
7945
7946         case 481: /* globalAddressMappingHighThreshold */
7947             ti = proto_tree_add_item(pdutree, hf_cflow_global_addressmapping_highthreshold,
7948                                      tvb, offset, length, ENC_BIG_ENDIAN);
7949             break;
7950
7951         case 482: /* vpnIdentifier */
7952             ti = proto_tree_add_item(pdutree, hf_cflow_vpn_identifier ,
7953                                      tvb, offset, length, ENC_NA);
7954             break;
7955
7956         case 483: /* bgpCommunity */
7957             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_community ,
7958                                      tvb, offset, length, ENC_BIG_ENDIAN);
7959             break;
7960
7961         case 484: /* bgpSourceCommunityList */
7962             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_source_community_list ,
7963                                      tvb, offset, length, ENC_NA);
7964             break;
7965
7966         case 485: /* bgpDestinationCommunityList */
7967             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_destination_community_list ,
7968                                      tvb, offset, length, ENC_NA);
7969             break;
7970
7971         case 486: /* bgpExtendedCommunity */
7972             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_extended_community ,
7973                                      tvb, offset, length, ENC_NA);
7974             break;
7975
7976         case 487: /* bgpSourceExtendedCommunityList */
7977             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_source_extended_community_list ,
7978                                      tvb, offset, length, ENC_NA);
7979             break;
7980
7981         case 488: /* bgpDestinationExtendedCommunityList */
7982             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_destination_extended_community_list ,
7983                                      tvb, offset, length, ENC_NA);
7984             break;
7985
7986         case 489: /* bgpLargeCommunity */
7987             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_large_community ,
7988                                      tvb, offset, length, ENC_NA);
7989             break;
7990
7991         case 490: /* bgpSourceLargeCommunityList */
7992             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_source_large_community_list ,
7993                                      tvb, offset, length, ENC_NA);
7994             break;
7995
7996         case 491: /* bgpDestinationLargeCommunityList */
7997             ti = proto_tree_add_item(pdutree, hf_cflow_bgp_destination_large_community_list ,
7998                                      tvb, offset, length, ENC_NA);
7999             break;
8000         case 492:  /* srhFlagsIPv6 */
8001             ti = proto_tree_add_bitmask(pdutree, tvb, offset, hf_cflow_srh_flags_ipv6, ett_srhflagsipv6, srh_flags_ipv6, ENC_NA);
8002             break;
8003         case 493:  /* srhTagIPv6 */
8004             ti = proto_tree_add_item(pdutree, hf_cflow_srh_tag_ipv6,
8005                                      tvb, offset, length, ENC_BIG_ENDIAN);
8006             break;
8007         case 494:  /* srhSegmentIPv6 */
8008             ti = proto_tree_add_item(pdutree, hf_cflow_srh_segment_ipv6,
8009                                      tvb, offset, length, ENC_NA);
8010             break;
8011         case 495:  /* srhActiveSegmentIPv6 */
8012             ti = proto_tree_add_item(pdutree, hf_cflow_srh_active_segment_ipv6,
8013                                      tvb, offset, length, ENC_NA);
8014             break;
8015         case 496:  /* srhSegmentIPv6BasicList */
8016             ti = proto_tree_add_item(pdutree, hf_cflow_srh_segment_ipv6_basic_list,
8017                                      tvb, offset, length, ENC_NA);
8018             break;
8019         case 497:  /* srhSegmentIPv6ListSection */
8020             ti = proto_tree_add_item(pdutree, hf_cflow_srh_segment_ipv6_list_section,
8021                                      tvb, offset, length, ENC_NA);
8022             break;
8023         case 498:  /* srhSegmentsIPv6Left */
8024             ti = proto_tree_add_item(pdutree, hf_cflow_srh_segments_ipv6_left,
8025                                      tvb, offset, length, ENC_BIG_ENDIAN);
8026             break;
8027         case 499:  /* srhIPv6Section */
8028             ti = proto_tree_add_item(pdutree, hf_cflow_srh_ipv6_section,
8029                                      tvb, offset, length, ENC_NA);
8030             break;
8031         case 500:  /* srhIPv6ActiveSegmentType */
8032             ti = proto_tree_add_item(pdutree, hf_cflow_srh_ipv6_active_segment_type,
8033                                      tvb, offset, length, ENC_BIG_ENDIAN);
8034             break;
8035         case 501:  /* srhSegmentIPv6LocatorLength */
8036             ti = proto_tree_add_item(pdutree, hf_cflow_srh_segment_ipv6_locator_length,
8037                                      tvb, offset, length, ENC_BIG_ENDIAN);
8038             break;
8039         case 502:  /* srhSegmentIPv6EndpointBehavior */
8040             ti = proto_tree_add_item(pdutree, hf_cflow_srh_segment_ipv6_endpoint_behaviour,
8041                                      tvb, offset, length, ENC_NA);
8042             break;
8043         case 505:  /* gtpuFlags */
8044           ti = proto_tree_add_bitmask(pdutree, tvb, offset, hf_cflow_gtpu_flags, ett_gtpflags, gtpu_flags, ENC_NA);
8045           break;
8046         case 506:  /* gtpuMsgType */
8047           ti = proto_tree_add_item(pdutree, hf_cflow_gtpu_msg_type, tvb, offset, length, ENC_BIG_ENDIAN);
8048           break;
8049         case 507:  /* gtpuTEid */
8050           ti = proto_tree_add_item(pdutree, hf_cflow_gtpu_teid, tvb, offset, length, ENC_BIG_ENDIAN);
8051           break;
8052         case 508:  /* gtpuSequenceNum */
8053           ti = proto_tree_add_item(pdutree, hf_cflow_gtpu_seq_num, tvb, offset, length, ENC_BIG_ENDIAN);
8054           break;
8055         case 509:  /* gtpuQFI */
8056           ti = proto_tree_add_item(pdutree, hf_cflow_gtpu_qfi, tvb, offset, length, ENC_BIG_ENDIAN);
8057           break;
8058         case 510:  /* gtpuPduType */
8059           ti = proto_tree_add_item(pdutree, hf_cflow_gtpu_pdu_type, tvb, offset, length, ENC_BIG_ENDIAN);
8060           break;
8061 #if 0
8062         case 33625: /* nic_id */
8063             ti = proto_tree_add_item(pdutree, hf_cflow_nic_id,
8064                                      tvb, offset, length, ENC_BIG_ENDIAN);
8065             break;
8066 #endif
8067
8068         case 34000: /* cts_sgt_source_tag */
8069             ti = proto_tree_add_item(pdutree, hf_cflow_cts_sgt_source_tag,
8070                                      tvb, offset, length, ENC_BIG_ENDIAN);
8071             break;
8072
8073         case 34001: /* cts_sgt_destination_tag */
8074             ti = proto_tree_add_item(pdutree, hf_cflow_cts_sgt_destination_tag,
8075                                      tvb, offset, length, ENC_BIG_ENDIAN);
8076             break;
8077
8078         case 34002: /* cts_sgt_source_name */
8079             ti = proto_tree_add_item(pdutree, hf_cflow_cts_sgt_source_name,
8080                                      tvb, offset, length, ENC_ASCII);
8081             break;
8082
8083         case 34003: /* cts_sgt_destination_name */
8084             ti = proto_tree_add_item(pdutree, hf_cflow_cts_sgt_destination_name,
8085                                      tvb, offset, length, ENC_ASCII);
8086             break;
8087
8088         case 37000: /* packets_dropped */
8089             ti = proto_tree_add_item(pdutree, hf_cflow_packets_dropped,
8090                                      tvb, offset, length, ENC_BIG_ENDIAN);
8091             break;
8092         case 37003: /* byte_rate */
8093             ti = proto_tree_add_item(pdutree, hf_cflow_byte_rate,
8094                                      tvb, offset, length, ENC_BIG_ENDIAN);
8095             break;
8096         case 37004: /* application_media_bytes */
8097             ti = proto_tree_add_item(pdutree, hf_cflow_application_media_bytes,
8098                                      tvb, offset, length, ENC_BIG_ENDIAN);
8099             break;
8100         case 37006: /* application_media_byte_rate */
8101             ti = proto_tree_add_item(pdutree, hf_cflow_application_media_byte_rate,
8102                                      tvb, offset, length, ENC_BIG_ENDIAN);
8103             break;
8104         case 37007: /* application_media_packets */
8105             ti = proto_tree_add_item(pdutree, hf_cflow_application_media_packets,
8106                                      tvb, offset, length, ENC_BIG_ENDIAN);
8107             break;
8108         case 37009: /* application_media_packet_rate */
8109             ti = proto_tree_add_item(pdutree, hf_cflow_application_media_packet_rate,
8110                                      tvb, offset, length, ENC_BIG_ENDIAN);
8111             break;
8112         case 37011: /* application_media_event */
8113             ti = proto_tree_add_item(pdutree, hf_cflow_application_media_event,
8114                                      tvb, offset, length, ENC_BIG_ENDIAN);
8115             break;
8116
8117         case 37012: /* monitor_event */
8118             ti = proto_tree_add_item(pdutree, hf_cflow_monitor_event,
8119                                      tvb, offset, length, ENC_BIG_ENDIAN);
8120             break;
8121
8122         case 37013: /* timestamp_interval */
8123             /* XXX - what format is this in? */
8124             ti = proto_tree_add_item(pdutree, hf_cflow_timestamp_interval,
8125                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8126             break;
8127         case 37014: /* transport_packets_expected */
8128             ti = proto_tree_add_item(pdutree, hf_cflow_transport_packets_expected,
8129                                      tvb, offset, length, ENC_BIG_ENDIAN);
8130             break;
8131         case 37016: /* transport_round_trip_time */
8132             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF ) {
8133                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_round_trip_time_string,
8134                                          tvb, offset, length, ENC_BIG_ENDIAN);
8135             } else {
8136                 /* value is in microseconds, adjust to nanoseconds*/
8137                 ts.secs =0;
8138                 ts.nsecs= tvb_get_ntohl(tvb, offset) * 1000;
8139                 ti = proto_tree_add_time(pdutree, hf_cflow_transport_round_trip_time,
8140                                          tvb, offset, length, &ts);
8141             }
8142             break;
8143         case 37017: /* transport_event_packet_loss */
8144             ti = proto_tree_add_item(pdutree, hf_cflow_transport_event_packet_loss,
8145                                      tvb, offset, length, ENC_BIG_ENDIAN);
8146             break;
8147         case 37019: /* transport_packets_lost */
8148             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF ) {
8149                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_packets_lost_string,
8150                                          tvb, offset, length, ENC_BIG_ENDIAN);
8151             } else {
8152                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_packets_lost,
8153                                          tvb, offset, length, ENC_BIG_ENDIAN);
8154             }
8155             break;
8156         case 37021: /* transport_packets_lost_rate */
8157             if (tvb_get_ntohl(tvb, offset) == 0xFFFF ) {
8158                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_packets_lost_rate_string,
8159                                          tvb, offset, length, ENC_BIG_ENDIAN);
8160             } else {
8161                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_packets_lost_rate,
8162                                          tvb, offset, length, ENC_BIG_ENDIAN);
8163             }
8164             break;
8165         case 37022: /* transport_rtp_ssrc */
8166             ti = proto_tree_add_item(pdutree, hf_cflow_transport_rtp_ssrc,
8167                                      tvb, offset, length, ENC_BIG_ENDIAN);
8168             break;
8169         case 37023: /* transport_rtp_jitter_mean */
8170             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF ) {
8171                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_rtp_jitter_mean_string,
8172                                          tvb, offset, length, ENC_BIG_ENDIAN);
8173             } else {
8174                 /* value is in microseconds, adjust to nanoseconds*/
8175                 ts.secs =0;
8176                 ts.nsecs= tvb_get_ntohl(tvb, offset) * 1000;
8177
8178                 ti = proto_tree_add_time(pdutree, hf_cflow_transport_rtp_jitter_mean,
8179                                          tvb, offset, length, &ts);
8180             }
8181             break;
8182         case 37024: /* transport_rtp_jitter_min */
8183             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF ) {
8184                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_rtp_jitter_min_string,
8185                                          tvb, offset, length, ENC_BIG_ENDIAN);
8186             } else {
8187                 /* value is in microseconds, adjust to nanoseconds*/
8188                 ts.secs =0;
8189                 ts.nsecs= tvb_get_ntohl(tvb, offset) * 1000;
8190                 ti = proto_tree_add_time(pdutree, hf_cflow_transport_rtp_jitter_min,
8191                                          tvb, offset, length, &ts);
8192             }
8193             break;
8194         case 37025: /* transport_rtp_jitter_max */
8195             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF ) {
8196                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_rtp_jitter_max_string,
8197                                          tvb, offset, length, ENC_BIG_ENDIAN);
8198             } else {
8199                 /* value is in microseconds, adjust to nanoseconds*/
8200                 ts.secs =0;
8201                 ts.nsecs= tvb_get_ntohl(tvb, offset) * 1000;
8202                 ti = proto_tree_add_time(pdutree, hf_cflow_transport_rtp_jitter_max,
8203                                          tvb, offset, length, &ts);
8204             }
8205             break;
8206         case 37041: /* transport_payload_type */
8207             if (tvb_get_uint8(tvb, offset) == 0xFF) {
8208                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_rtp_payload_type_string,
8209                                          tvb, offset, length, ENC_BIG_ENDIAN);
8210             } else {
8211                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_rtp_payload_type,
8212                                          tvb, offset, length, ENC_BIG_ENDIAN);
8213             }
8214             break;
8215         case 37071: /* bytes_out_of_order */
8216             if (tvb_get_ntoh64(tvb, offset) == UINT64_C(0xFFFFFFFFFFFFFFFF)) {
8217                 /* need to add custom code to show "Not Measured"  */
8218                 proto_tree_add_expert_format(pdutree, NULL, &ei_transport_bytes_out_of_order,
8219                                              tvb, offset, 8,
8220                                              "Transport Bytes Out of Order: Not Measured (0x%"PRIx64")",
8221                                              tvb_get_ntoh64(tvb, offset));
8222                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_bytes_out_of_order,
8223                                          tvb, offset, length, ENC_BIG_ENDIAN);
8224             } else {
8225                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_bytes_out_of_order,
8226                                          tvb, offset, length, ENC_BIG_ENDIAN);
8227             }
8228             break;
8229         case 37074: /* packets_out_of_order */
8230             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF) {
8231                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_packets_out_of_order_string,
8232                                          tvb, offset, length, ENC_BIG_ENDIAN);
8233             } else {
8234                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_bytes_out_of_order,
8235                                          tvb, offset, length, ENC_BIG_ENDIAN);
8236             }
8237             break;
8238         case 37083: /* tcp_window_size_min */
8239             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF) {
8240                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_window_size_min_string,
8241                                          tvb, offset, length, ENC_BIG_ENDIAN);
8242             } else {
8243                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_window_size_min,
8244                                          tvb, offset, length, ENC_BIG_ENDIAN);
8245             }
8246             break;
8247
8248         case 37084: /* tcp_window_size_max */
8249             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF) {
8250                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_window_size_max_string,
8251                                          tvb, offset, length, ENC_BIG_ENDIAN);
8252             } else {
8253                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_window_size_max,
8254                                          tvb, offset, length, ENC_BIG_ENDIAN);
8255             }
8256             break;
8257
8258         case 37085: /* tcp_window_size_mean */
8259             if (tvb_get_ntohl(tvb, offset) == 0xFFFFFFFF) {
8260                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_window_size_mean_string,
8261                                          tvb, offset, length, ENC_BIG_ENDIAN);
8262             } else {
8263                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_window_size_mean,
8264                                          tvb, offset, length, ENC_BIG_ENDIAN);
8265             }
8266             break;
8267         case 37086: /* tcp_maximum_segment_size */
8268             if (tvb_get_ntohs(tvb, offset) == 0xFFFF) {
8269                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_maximum_segment_size_string,
8270                                          tvb, offset, length, ENC_BIG_ENDIAN);
8271             } else {
8272                 ti = proto_tree_add_item(pdutree, hf_cflow_transport_tcp_maximum_segment_size,
8273                                          tvb, offset, length, ENC_BIG_ENDIAN);
8274             }
8275             break;
8276             /* Ericsson SE NAT Logging */
8277         case 24628: /* natContextId */
8278             ti = proto_tree_add_item(pdutree, hf_cflow_nat_context_id,
8279                                      tvb, offset, length, ENC_BIG_ENDIAN);
8280             break;
8281         case 24629: /* natContextName */
8282             ti = proto_tree_add_item(pdutree, hf_cflow_nat_context_name,
8283                                      tvb, offset, length, ENC_UTF_8);
8284             break;
8285         case 24630: /* natAssignTime */
8286             ts.secs = tvb_get_ntohl(tvb, offset);
8287             ts.nsecs = 0;
8288             ti = proto_tree_add_time(pdutree, hf_cflow_nat_assign_time,
8289                                      tvb, offset, length, &ts);
8290             break;
8291         case 24631: /* natUnAssignTime */
8292             ts.secs = tvb_get_ntohl(tvb, offset);
8293             ts.nsecs = 0;
8294             ti = proto_tree_add_time(pdutree, hf_cflow_nat_unassign_time,
8295                                      tvb, offset, length, &ts);
8296             break;
8297         case 24632: /* natInternalAddr */
8298             ti = proto_tree_add_item(pdutree, hf_cflow_nat_int_addr,
8299                                      tvb, offset, length, ENC_BIG_ENDIAN);
8300             break;
8301         case 24633: /* natExternalAddr */
8302             ti = proto_tree_add_item(pdutree, hf_cflow_nat_ext_addr,
8303                                      tvb, offset, length, ENC_BIG_ENDIAN);
8304             break;
8305         case 24634: /* natExternalPortFirst */
8306             ti = proto_tree_add_item(pdutree, hf_cflow_nat_ext_port_first,
8307                                      tvb, offset, length, ENC_BIG_ENDIAN);
8308             break;
8309         case 24635: /* natExternalPortLast */
8310             ti = proto_tree_add_item(pdutree, hf_cflow_nat_ext_port_last,
8311                                      tvb, offset, length, ENC_BIG_ENDIAN);
8312             break;
8313
8314             /* Cisco ASA 5500 Series */
8315         case 33000: /* NF_F_INGRESS_ACL_ID */
8316             proto_tree_add_item(pdutree, hf_cflow_ingress_acl_id,
8317                                 tvb, offset, length, ENC_NA);
8318             break;
8319         case 33001: /* NF_F_EGRESS_ACL_ID */
8320             proto_tree_add_item(pdutree, hf_cflow_egress_acl_id,
8321                                 tvb, offset, length, ENC_NA);
8322             break;
8323         case 33002: /* NF_F_FW_EXT_EVENT */
8324             proto_tree_add_item(pdutree, hf_cflow_fw_ext_event,
8325                                 tvb, offset, length, ENC_BIG_ENDIAN);
8326             break;
8327         case 40000: /* NF_F_USERNAME[_MAX] */
8328             proto_tree_add_item(pdutree, hf_cflow_aaa_username,
8329                                 tvb, offset, length, ENC_ASCII);
8330             break;
8331
8332             /* CACE Technologies */
8333         case VENDOR_CACE << 16 | 0: /* caceLocalIPv4Address */
8334             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_ipv4_address,
8335                                      tvb, offset, length, ENC_BIG_ENDIAN);
8336             set_address_tvb(&local_addr, AT_IPv4, 4, tvb, offset);
8337             got_flags |= GOT_LOCAL_ADDR;
8338             break;
8339
8340         case VENDOR_CACE << 16 | 1: /* caceRemoteIPv4Address */
8341             ti = proto_tree_add_item(pdutree, hf_pie_cace_remote_ipv4_address,
8342                                      tvb, offset, length, ENC_BIG_ENDIAN);
8343             set_address_tvb(&remote_addr, AT_IPv4, 4, tvb, offset);
8344             got_flags |= GOT_REMOTE_ADDR;
8345             break;
8346
8347         case VENDOR_CACE << 16 | 2: /* caceLocalIPv6Address */
8348             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_ipv6_address,
8349                                      tvb, offset, length, ENC_NA);
8350             set_address_tvb(&local_addr, AT_IPv6, 16, tvb, offset);
8351             got_flags |= GOT_LOCAL_ADDR;
8352             break;
8353
8354         case VENDOR_CACE << 16 | 3: /* caceRemoteIPv6Address */
8355             ti = proto_tree_add_item(pdutree, hf_pie_cace_remote_ipv6_address,
8356                                      tvb, offset, length, ENC_NA);
8357             set_address_tvb(&remote_addr, AT_IPv6, 16, tvb, offset);
8358             got_flags |= GOT_REMOTE_ADDR;
8359             break;
8360
8361         case VENDOR_CACE << 16 | 4: /* caceLocalTransportPort */
8362             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_port,
8363                                      tvb, offset, length, ENC_BIG_ENDIAN);
8364             local_port = tvb_get_ntohs(tvb, offset);
8365             got_flags |= GOT_LOCAL_PORT;
8366             break;
8367
8368         case VENDOR_CACE << 16 | 5: /* caceRemoteTransportPort */
8369             ti = proto_tree_add_item(pdutree, hf_pie_cace_remote_port,
8370                                      tvb, offset, length, ENC_BIG_ENDIAN);
8371             remote_port = tvb_get_ntohs(tvb, offset);
8372             got_flags |= GOT_REMOTE_PORT;
8373             break;
8374
8375         case VENDOR_CACE << 16 | 6: /* caceLocalIPv4id */
8376             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_ipv4_id,
8377                                      tvb, offset, length, ENC_BIG_ENDIAN);
8378             /*ipv4_id = tvb_get_ntohs(tvb, offset);*/
8379             /*got_flags |= GOT_IPv4_ID;*/
8380             break;
8381
8382         case VENDOR_CACE << 16 | 7: /* caceLocalICMPid */
8383             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_icmp_id,
8384                                      tvb, offset, length, ENC_BIG_ENDIAN);
8385             /*icmp_id = tvb_get_ntohs(tvb, offset);*/
8386             /*got_flags |= GOT_ICMP_ID;*/
8387             break;
8388
8389         case VENDOR_CACE << 16 | 8: /* caceLocalProcessUserId */
8390             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_uid,
8391                                      tvb, offset, length, ENC_BIG_ENDIAN);
8392             uid = tvb_get_ntohl(tvb, offset);
8393             got_flags |= GOT_UID;
8394             break;
8395
8396         case VENDOR_CACE << 16 | 9: /* caceLocalProcessId */
8397             ti = proto_tree_add_item(pdutree, hf_pie_cace_local_pid,
8398                                      tvb, offset, length, ENC_BIG_ENDIAN);
8399             pid = tvb_get_ntohl(tvb, offset);
8400             got_flags |= GOT_PID;
8401             break;
8402
8403         case VENDOR_CACE << 16 | 10: /* caceLocalProcessUserName */
8404             uname_len = tvb_get_uint8(tvb, offset);
8405             uname_str = tvb_format_text(pinfo->pool, tvb, offset+1, uname_len);
8406             proto_tree_add_item(pdutree, hf_pie_cace_local_username_len,
8407                                 tvb, offset, 1, ENC_BIG_ENDIAN);
8408             ti = proto_tree_add_string(pdutree, hf_pie_cace_local_username,
8409                                        tvb, offset+1, uname_len, uname_str);
8410             length = uname_len + 1;
8411             got_flags |= GOT_USERNAME;
8412             break;
8413
8414         case VENDOR_CACE << 16 | 11: /* caceLocalProcessCommand */
8415             cmd_len = tvb_get_uint8(tvb, offset);
8416             cmd_str = tvb_format_text(pinfo->pool, tvb, offset+1, cmd_len);
8417             proto_tree_add_item(pdutree, hf_pie_cace_local_cmd_len,
8418                                 tvb, offset, 1, ENC_BIG_ENDIAN);
8419             ti = proto_tree_add_string(pdutree, hf_pie_cace_local_cmd,
8420                                        tvb, offset+1, cmd_len, cmd_str);
8421             length = cmd_len + 1;
8422             got_flags |= GOT_COMMAND;
8423             break;
8424
8425         case ((VENDOR_FASTIP << 16) | 0) : /* METER_VERSION */
8426             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_version,
8427                                      tvb, offset, length, ENC_ASCII);
8428             break;
8429         case ((VENDOR_FASTIP << 16) | 1) : /* METER_OS_SYSNAME */
8430             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_os_sysname,
8431                                      tvb, offset, length, ENC_ASCII);
8432             break;
8433         case ((VENDOR_FASTIP << 16) | 2) : /* METER_OS_NODENAME */
8434             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_os_nodename,
8435                                      tvb, offset, length, ENC_ASCII);
8436             break;
8437         case ((VENDOR_FASTIP << 16) | 3) : /* METER_OS_RELASE */
8438             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_os_release,
8439                                      tvb, offset, length, ENC_ASCII);
8440             break;
8441         case ((VENDOR_FASTIP << 16) | 4) : /* METER_OS_VERSION */
8442             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_os_version,
8443                                      tvb, offset, length, ENC_ASCII);
8444             break;
8445         case ((VENDOR_FASTIP << 16) | 5) : /* METER_OS_MACHINE */
8446             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_os_machine,
8447                                      tvb, offset, length, ENC_ASCII);
8448             break;
8449         case ((VENDOR_FASTIP << 16) | 6) : /* TCP_FLAGS */
8450             ti = proto_tree_add_item(pdutree, hf_pie_fastip_tcp_flags,
8451                                      tvb, offset, length, ENC_NA);
8452             break;
8453         case ((VENDOR_FASTIP << 16) | 23) : /* METER_OS_DISTRIBUTION */
8454             ti = proto_tree_add_item(pdutree, hf_pie_fastip_meter_os_distribution,
8455                                      tvb, offset, length, ENC_ASCII);
8456             break;
8457         case ((VENDOR_FASTIP << 16) | 13) : /* EPOCH_SECOND */
8458             ti = proto_tree_add_item(pdutree, hf_pie_fastip_epoch_second,
8459                                      tvb, offset, length, ENC_BIG_ENDIAN);
8460             break;
8461         case ((VENDOR_FASTIP << 16) | 14) : /* NIC_NAME */
8462             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_name,
8463                                      tvb, offset, length, ENC_ASCII);
8464             break;
8465         case ((VENDOR_FASTIP << 16) | 15) : /* NIC_ID */
8466             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_id,
8467                                      tvb, offset, length, ENC_BIG_ENDIAN);
8468             break;
8469         case ((VENDOR_FASTIP << 16) | 16) : /* NIC_MAC */
8470             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_mac,
8471                                      tvb, offset, length, ENC_NA);
8472             break;
8473         case ((VENDOR_FASTIP << 16) | 17) : /* NIC_IP */
8474             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_ip,
8475                                      tvb, offset, length, ENC_NA);
8476             break;
8477         case ((VENDOR_FASTIP << 16) | 200) : /* TCP_HANDSHAKE_RTT_USEC */
8478             ti = proto_tree_add_item(pdutree, hf_pie_fastip_tcp_handshake_rtt_usec,
8479                                      tvb, offset, length, ENC_BIG_ENDIAN);
8480             break;
8481         case ((VENDOR_FASTIP << 16) | 201) : /* APP_RTT_USEC */
8482             ti = proto_tree_add_item(pdutree, hf_pie_fastip_app_rtt_usec,
8483                                      tvb, offset, length, ENC_BIG_ENDIAN);
8484             break;
8485     /*
8486     { 18, "COLLISIONS"},
8487     { 19, "ERRORS"},
8488     */
8489         case ((VENDOR_FASTIP << 16) | 20) : /* NIC_DRIVER_NAME */
8490             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_driver_name,
8491                                      tvb, offset, length, ENC_ASCII);
8492             break;
8493         case ((VENDOR_FASTIP << 16) | 21) : /* NIC_DRIVER_VERSION */
8494             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_driver_version,
8495                                      tvb, offset, length, ENC_ASCII);
8496             break;
8497         case ((VENDOR_FASTIP << 16) | 22) : /* NIC_FIRMWARE_VERSION */
8498             ti = proto_tree_add_item(pdutree, hf_pie_fastip_nic_firmware_version,
8499                                      tvb, offset, length, ENC_ASCII);
8500             break;
8501
8502             /* START NTOP */
8503         case (NTOP_BASE + 80):           /* SRC_FRAGMENTS */
8504         case ((VENDOR_NTOP << 16) | 80): /* SRC_FRAGMENTS */
8505             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_fragments,
8506                                      tvb, offset, length, ENC_BIG_ENDIAN);
8507             break;
8508
8509         case (NTOP_BASE + 81):           /* DST_FRAGMENTS */
8510         case ((VENDOR_NTOP << 16) | 81): /* DST_FRAGMENTS */
8511             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_fragments,
8512                                      tvb, offset, length, ENC_BIG_ENDIAN);
8513             break;
8514
8515         case (NTOP_BASE + 82):           /* SRC_TO_DST_MAX_THROUGHPUT */
8516         case ((VENDOR_NTOP << 16) | 82): /* SRC_TO_DST_MAX_THROUGHPUT */
8517             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_to_dst_max_throughput,
8518                                      tvb, offset, length, ENC_BIG_ENDIAN);
8519             break;
8520
8521         case (NTOP_BASE + 83): /*           /\* SRC_TO_DST_MIN_THROUGHPUT *\/ */
8522         case ((VENDOR_NTOP << 16) | 83): /* SRC_TO_DST_MIN_THROUGHPUT */
8523             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_to_dst_min_throughput,
8524                                      tvb, offset, length, ENC_BIG_ENDIAN);
8525             break;
8526
8527         case (NTOP_BASE + 84):           /* SRC_TO_DST_AVG_THROUGHPUT */
8528         case ((VENDOR_NTOP << 16) | 84): /* SRC_TO_DST_AVG_THROUGHPUT */
8529             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_to_dst_avg_throughput,
8530                                      tvb, offset, length, ENC_BIG_ENDIAN);
8531             break;
8532
8533         case (NTOP_BASE + 85):           /* SRC_TO_SRC_MAX_THROUGHPUT */
8534         case ((VENDOR_NTOP << 16) | 85): /* SRC_TO_SRC_MAX_THROUGHPUT */
8535             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_to_src_max_throughput,
8536                                      tvb, offset, length, ENC_BIG_ENDIAN);
8537             break;
8538
8539         case (NTOP_BASE + 86):           /* SRC_TO_SRC_MIN_THROUGHPUT */
8540         case ((VENDOR_NTOP << 16) | 86): /* SRC_TO_SRC_MIN_THROUGHPUT */
8541             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_to_src_min_throughput,
8542                                      tvb, offset, length, ENC_BIG_ENDIAN);
8543             break;
8544
8545         case (NTOP_BASE + 87):           /* SRC_TO_SRC_AVG_THROUGHPUT */
8546         case ((VENDOR_NTOP << 16) | 87): /* SRC_TO_SRC_AVG_THROUGHPUT */
8547             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_to_src_avg_throughput,
8548                                      tvb, offset, length, ENC_BIG_ENDIAN);
8549             break;
8550
8551         case (NTOP_BASE + 88):           /* NUM_PKTS_UP_TO_128_BYTES */
8552         case ((VENDOR_NTOP << 16) | 88): /* NUM_PKTS_UP_TO_128_BYTES */
8553             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_up_to_128_bytes,
8554                                      tvb, offset, length, ENC_BIG_ENDIAN);
8555             break;
8556
8557         case (NTOP_BASE + 89):           /* NUM_PKTS_128_TO_256_BYTES */
8558         case ((VENDOR_NTOP << 16) | 89): /* NUM_PKTS_128_TO_256_BYTES */
8559             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_128_to_256_bytes,
8560                                      tvb, offset, length, ENC_BIG_ENDIAN);
8561             break;
8562
8563         case (NTOP_BASE + 90):           /* NUM_PKTS_256_TO_512_BYTES */
8564         case ((VENDOR_NTOP << 16) | 90): /* NUM_PKTS_256_TO_512_BYTES */
8565             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_256_to_512_bytes,
8566                                      tvb, offset, length, ENC_BIG_ENDIAN);
8567             break;
8568
8569         case (NTOP_BASE + 91):           /* NUM_PKTS_512_TO_1024_BYTES */
8570         case ((VENDOR_NTOP << 16) | 91): /* NUM_PKTS_512_TO_1024_BYTES */
8571             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_512_to_1024_bytes,
8572                                      tvb, offset, length, ENC_BIG_ENDIAN);
8573             break;
8574
8575         case (NTOP_BASE + 92):           /* NUM_PKTS_1024_TO_1514_BYTES */
8576         case ((VENDOR_NTOP << 16) | 92): /* NUM_PKTS_1024_TO_1514_BYTES */
8577             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_1024_to_1514_bytes,
8578                                      tvb, offset, length, ENC_BIG_ENDIAN);
8579             break;
8580
8581         case (NTOP_BASE + 93):           /* NUM_PKTS_OVER_1514_BYTES */
8582         case ((VENDOR_NTOP << 16) | 93): /* NUM_PKTS_OVER_1514_BYTES */
8583             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_over_1514_bytes,
8584                                      tvb, offset, length, ENC_BIG_ENDIAN);
8585             break;
8586
8587         case (NTOP_BASE + 98):           /* CUMULATIVE_ICMP_TYPE */
8588         case ((VENDOR_NTOP << 16) | 98): /* CUMULATIVE_ICMP_TYPE */
8589             /* Cumulative of all flow ICMP types */
8590             ti = proto_tree_add_item(pdutree, hf_pie_ntop_cumulative_icmp_type,
8591                                      tvb, offset, length, ENC_BIG_ENDIAN);
8592             break;
8593
8594         case (NTOP_BASE + 101):           /* SRC_IP_COUNTRY */
8595         case ((VENDOR_NTOP << 16) | 101): /* SRC_IP_COUNTRY */
8596             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_ip_country,
8597                                      tvb, offset, length, ENC_ASCII);
8598             break;
8599
8600         case (NTOP_BASE + 102):           /* SRC_IP_CITY */
8601         case ((VENDOR_NTOP << 16) | 102): /* SRC_IP_CITY */
8602             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_ip_city,
8603                                      tvb, offset, length, ENC_ASCII);
8604             break;
8605
8606         case (NTOP_BASE + 103):           /* DST_IP_COUNTRY */
8607         case ((VENDOR_NTOP << 16) | 103): /* DST_IP_COUNTRY */
8608             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_ip_country,
8609                                      tvb, offset, length, ENC_ASCII);
8610             break;
8611
8612         case (NTOP_BASE + 104):           /* DST_IP_CITY */
8613         case ((VENDOR_NTOP << 16) | 104): /* DST_IP_CITY */
8614             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_ip_city,
8615                                      tvb, offset, length, ENC_ASCII);
8616             break;
8617
8618         case (NTOP_BASE + 105):           /* FLOW_PROTO_PORT */
8619         case ((VENDOR_NTOP << 16) | 105): /* FLOW_PROTO_PORT */
8620             ti = proto_tree_add_item(pdutree, hf_pie_ntop_flow_proto_port,
8621                                      tvb, offset, length, ENC_BIG_ENDIAN);
8622             break;
8623
8624         case (NTOP_BASE + 106):           /* UPSTREAM_TUNNEL_ID */
8625         case ((VENDOR_NTOP << 16) | 106): /* UPSTREAM_TUNNEL_ID */
8626             ti = proto_tree_add_item(pdutree, hf_pie_ntop_upstream_tunnel_id,
8627                                      tvb, offset, length, ENC_BIG_ENDIAN);
8628             break;
8629
8630         case (NTOP_BASE + 107):           /* LONGEST_FLOW_PKT */
8631         case ((VENDOR_NTOP << 16) | 107): /* LONGEST_FLOW_PKT */
8632             ti = proto_tree_add_item(pdutree, hf_pie_ntop_longest_flow_pkt,
8633                                      tvb, offset, length, ENC_BIG_ENDIAN);
8634             break;
8635
8636         case (NTOP_BASE + 108):           /* SHORTEST_FLOW_PKT */
8637         case ((VENDOR_NTOP << 16) | 108): /* SHORTEST_FLOW_PKT */
8638             ti = proto_tree_add_item(pdutree, hf_pie_ntop_shortest_flow_pkt,
8639                                      tvb, offset, length, ENC_BIG_ENDIAN);
8640             break;
8641
8642         case (NTOP_BASE + 109):           /* RETRANSMITTED_IN_PKTS */
8643         case ((VENDOR_NTOP << 16) | 109): /* RETRANSMITTED_IN_PKTS */
8644             ti = proto_tree_add_item(pdutree, hf_pie_ntop_retransmitted_in_pkts,
8645                                      tvb, offset, length, ENC_BIG_ENDIAN);
8646             break;
8647
8648         case (NTOP_BASE + 110):           /* RETRANSMITTED_OUT_PKTS */
8649         case ((VENDOR_NTOP << 16) | 110): /* RETRANSMITTED_OUT_PKTS */
8650             ti = proto_tree_add_item(pdutree, hf_pie_ntop_retransmitted_out_pkts,
8651                                      tvb, offset, length, ENC_BIG_ENDIAN);
8652             break;
8653
8654         case (NTOP_BASE + 111):           /* OOORDER_IN_PKTS */
8655         case ((VENDOR_NTOP << 16) | 111): /* OOORDER_IN_PKTS */
8656             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ooorder_in_pkts,
8657                                      tvb, offset, length, ENC_BIG_ENDIAN);
8658             break;
8659
8660         case (NTOP_BASE + 112):           /* OOORDER_OUT_PKTS */
8661         case ((VENDOR_NTOP << 16) | 112): /* OOORDER_OUT_PKTS */
8662             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ooorder_out_pkts,
8663                                      tvb, offset, length, ENC_BIG_ENDIAN);
8664             break;
8665
8666         case (NTOP_BASE + 113):           /* UNTUNNELED_PROTOCOL */
8667         case ((VENDOR_NTOP << 16) | 113): /* UNTUNNELED_PROTOCOL */
8668             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_protocol,
8669                                      tvb, offset, length, ENC_BIG_ENDIAN);
8670             break;
8671
8672         case (NTOP_BASE + 114):           /* UNTUNNELED_IPV4_SRC_ADDR */
8673         case ((VENDOR_NTOP << 16) | 114): /* UNTUNNELED_IPV4_SRC_ADDR */
8674             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_ipv4_src_addr,
8675                                      tvb, offset, length, ENC_BIG_ENDIAN);
8676             break;
8677
8678         case (NTOP_BASE + 115):           /* UNTUNNELED_L4_SRC_PORT */
8679         case ((VENDOR_NTOP << 16) | 115): /* UNTUNNELED_L4_SRC_PORT */
8680             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_l4_src_port,
8681                                      tvb, offset, length, ENC_BIG_ENDIAN);
8682             break;
8683
8684         case (NTOP_BASE + 116):           /* UNTUNNELED_IPV4_DST_ADDR */
8685         case ((VENDOR_NTOP << 16) | 116): /* UNTUNNELED_IPV4_DST_ADDR */
8686             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_ipv4_dst_addr,
8687                                      tvb, offset, length, ENC_BIG_ENDIAN);
8688             break;
8689
8690         case (NTOP_BASE + 117):           /* UNTUNNELED_L4_DST_PORT */
8691         case ((VENDOR_NTOP << 16) | 117): /* UNTUNNELED_L4_DST_PORT */
8692             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_l4_dst_port,
8693                                      tvb, offset, length, ENC_BIG_ENDIAN);
8694             break;
8695
8696         case (NTOP_BASE + 118):           /* L7_PROTO */
8697         case ((VENDOR_NTOP << 16) | 118): /* L7_PROTO */
8698             ti = proto_tree_add_item(pdutree, hf_pie_ntop_l7_proto,
8699                                      tvb, offset, length, ENC_BIG_ENDIAN);
8700             break;
8701
8702         case (NTOP_BASE + 119):           /* L7_PROTO_NAME */
8703         case ((VENDOR_NTOP << 16) | 119): /* L7_PROTO_NAME */
8704             ti = proto_tree_add_item(pdutree, hf_pie_ntop_l7_proto_name,
8705                                      tvb, offset, length, ENC_ASCII);
8706             break;
8707
8708         case (NTOP_BASE + 120):           /* DOWNSTREAM_TUNNEL_ID */
8709         case ((VENDOR_NTOP << 16) | 120): /* DOWNSTREAM_TUNNEL_ID */
8710             ti = proto_tree_add_item(pdutree, hf_pie_ntop_downstram_tunnel_id,
8711                                      tvb, offset, length, ENC_BIG_ENDIAN);
8712             break;
8713
8714         case (NTOP_BASE + 121):           /* FLOW_USER_NAME */
8715         case ((VENDOR_NTOP << 16) | 121): /* FLOW_USER_NAME */
8716             ti = proto_tree_add_item(pdutree, hf_pie_ntop_flow_user_name,
8717                                      tvb, offset, length, ENC_ASCII);
8718             break;
8719
8720         case (NTOP_BASE + 122):           /* FLOW_SERVER_NAME */
8721         case ((VENDOR_NTOP << 16) | 122): /* FLOW_SERVER_NAME */
8722             ti = proto_tree_add_item(pdutree, hf_pie_ntop_flow_server_name,
8723                                      tvb, offset, length, ENC_ASCII);
8724             break;
8725
8726         case (NTOP_BASE + 123):           /* CLIENT_NW_LATENCY_MS */
8727         case ((VENDOR_NTOP << 16) | 123): /* CLIENT_NW_LATENCY_MS */
8728             ti = proto_tree_add_item(pdutree, hf_pie_ntop_client_nw_latency_ms,
8729                                      tvb, offset, length, ENC_BIG_ENDIAN);
8730             break;
8731
8732         case (NTOP_BASE + 124):           /* SERVER_NW_LATENCY_MS */
8733         case ((VENDOR_NTOP << 16) | 124): /* SERVER_NW_LATENCY_MS */
8734             ti = proto_tree_add_item(pdutree, hf_pie_ntop_server_nw_latency_ms,
8735                                      tvb, offset, length, ENC_BIG_ENDIAN);
8736             break;
8737
8738         case (NTOP_BASE + 125):           /* APPL_LATENCY_MS */
8739         case ((VENDOR_NTOP << 16) | 125): /* APPL_LATENCY_MS */
8740             ti = proto_tree_add_item(pdutree, hf_pie_ntop_appl_latency_ms,
8741                                      tvb, offset, length, ENC_BIG_ENDIAN);
8742             break;
8743
8744         case (NTOP_BASE + 126):           /* PLUGIN_NAME */
8745         case ((VENDOR_NTOP << 16) | 126): /* PLUGIN_NAME */
8746             ti = proto_tree_add_item(pdutree, hf_pie_ntop_plugin_name,
8747                                      tvb, offset, length, ENC_ASCII);
8748             break;
8749
8750         case (NTOP_BASE + 127):           /* RETRANSMITTED_IN_BYTES */
8751         case ((VENDOR_NTOP << 16) | 127): /* RETRANSMITTED_IN_BYTES */
8752             ti = proto_tree_add_item(pdutree, hf_pie_ntop_retransmitted_in_bytes,
8753                                      tvb, offset, length, ENC_BIG_ENDIAN);
8754             break;
8755
8756         case (NTOP_BASE + 128):           /* RETRANSMITTED_OUT_BYTES */
8757         case ((VENDOR_NTOP << 16) | 128): /* RETRANSMITTED_OUT_BYTES */
8758             ti = proto_tree_add_item(pdutree, hf_pie_ntop_retransmitted_out_bytes,
8759                                      tvb, offset, length, ENC_BIG_ENDIAN);
8760             break;
8761
8762         case (NTOP_BASE + 130):           /* SIP_CALL_ID */
8763         case ((VENDOR_NTOP << 16) | 130): /* SIP_CALL_ID */
8764             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_call_id,
8765                                      tvb, offset, length, ENC_ASCII);
8766             break;
8767
8768         case (NTOP_BASE + 131):           /* SIP_CALLING_PARTY */
8769         case ((VENDOR_NTOP << 16) | 131): /* SIP_CALLING_PARTY */
8770             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_calling_party,
8771                                      tvb, offset, length, ENC_ASCII);
8772             break;
8773
8774         case (NTOP_BASE + 132):           /* SIP_CALLED_PARTY */
8775         case ((VENDOR_NTOP << 16) | 132): /* SIP_CALLED_PARTY */
8776             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_called_party,
8777                                      tvb, offset, length, ENC_ASCII);
8778             break;
8779
8780         case (NTOP_BASE + 133):           /* SIP_RTP_CODECS */
8781         case ((VENDOR_NTOP << 16) | 133): /* SIP_RTP_CODECS */
8782             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_rtp_codecs,
8783                                      tvb, offset, length, ENC_ASCII);
8784             break;
8785
8786         case (NTOP_BASE + 134):           /* SIP_INVITE_TIME */
8787         case ((VENDOR_NTOP << 16) | 134): /* SIP_INVITE_TIME */
8788             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_invite_time,
8789                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8790             break;
8791
8792         case (NTOP_BASE + 135):           /* SIP_TRYING_TIME */
8793         case ((VENDOR_NTOP << 16) | 135): /* SIP_TRYING_TIME */
8794             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_trying_time,
8795                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8796             break;
8797
8798         case (NTOP_BASE + 136):           /* SIP_RINGING_TIME */
8799         case ((VENDOR_NTOP << 16) | 136): /* SIP_RINGING_TIME */
8800             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_ringing_time,
8801                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8802             break;
8803
8804         case (NTOP_BASE + 137):           /* SIP_INVITE_OK_TIME */
8805         case ((VENDOR_NTOP << 16) | 137): /* SIP_INVITE_OK_TIME */
8806             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_invite_ok_time,
8807                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8808             break;
8809
8810         case (NTOP_BASE + 138):           /* SIP_INVITE_FAILURE_TIME */
8811         case ((VENDOR_NTOP << 16) | 138): /* SIP_INVITE_FAILURE_TIME */
8812             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_invite_failure_time,
8813                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8814             break;
8815
8816         case (NTOP_BASE + 139):           /* SIP_BYE_TIME */
8817         case ((VENDOR_NTOP << 16) | 139): /* SIP_BYE_TIME */
8818             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_bye_time,
8819                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8820             break;
8821
8822         case (NTOP_BASE + 140):           /* SIP_BYE_OK_TIME */
8823         case ((VENDOR_NTOP << 16) | 140): /* SIP_BYE_OK_TIME */
8824             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_bye_ok_time,
8825                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8826             break;
8827
8828         case (NTOP_BASE + 141):           /* SIP_CANCEL_TIME */
8829         case ((VENDOR_NTOP << 16) | 141): /* SIP_CANCEL_TIME */
8830             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_cancel_time,
8831                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
8832             break;
8833
8834         case (NTOP_BASE + 142):           /* SIP_CANCEL_OK_TIME */
8835         case ((VENDOR_NTOP << 16) | 142): /* SIP_CANCEL_OK_TIME */
8836             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_cancel_ok_time,
8837                                      tvb, offset, length, ENC_BIG_ENDIAN);
8838             break;
8839
8840         case (NTOP_BASE + 143):           /* SIP_RTP_IPV4_SRC_ADDR */
8841         case ((VENDOR_NTOP << 16) | 143): /* SIP_RTP_IPV4_SRC_ADDR */
8842             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_rtp_ipv4_src_addr,
8843                                      tvb, offset, length, ENC_BIG_ENDIAN);
8844             break;
8845
8846         case (NTOP_BASE + 144):           /* SIP_RTP_L4_SRC_PORT */
8847         case ((VENDOR_NTOP << 16) | 144): /* SIP_RTP_L4_SRC_PORT */
8848             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_rtp_l4_src_port,
8849                                      tvb, offset, length, ENC_BIG_ENDIAN);
8850             break;
8851
8852         case (NTOP_BASE + 145):           /* SIP_RTP_IPV4_DST_ADDR */
8853         case ((VENDOR_NTOP << 16) | 145): /* SIP_RTP_IPV4_DST_ADDR */
8854             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_rtp_ipv4_dst_addr,
8855                                      tvb, offset, length, ENC_BIG_ENDIAN);
8856             break;
8857
8858         case (NTOP_BASE + 146):           /* SIP_RTP_L4_DST_PORT */
8859         case ((VENDOR_NTOP << 16) | 146): /* SIP_RTP_L4_DST_PORT */
8860             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_rtp_l4_dst_port,
8861                                      tvb, offset, length, ENC_BIG_ENDIAN);
8862             break;
8863
8864         case (NTOP_BASE + 147):           /* SIP_RESPONSE_CODE */
8865         case ((VENDOR_NTOP << 16) | 147): /* SIP_RESPONSE_CODE */
8866             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_response_code,
8867                                      tvb, offset, length, ENC_BIG_ENDIAN);
8868             break;
8869
8870         case (NTOP_BASE + 148):           /* SIP_REASON_CAUSE */
8871         case ((VENDOR_NTOP << 16) | 148): /* SIP_REASON_CAUSE */
8872             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_reason_cause,
8873                                      tvb, offset, length, ENC_BIG_ENDIAN);
8874             break;
8875
8876         case (NTOP_BASE + 150):           /* RTP_FIRST_SEQ */
8877         case ((VENDOR_NTOP << 16) | 150): /* RTP_FIRST_SEQ */
8878             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_first_seq,
8879                                      tvb, offset, length, ENC_BIG_ENDIAN);
8880             break;
8881
8882         case (NTOP_BASE + 151):           /* RTP_FIRST_TS */
8883         case ((VENDOR_NTOP << 16) | 151): /* RTP_FIRST_TS */
8884             /* XXX - is this an NTP timestamp? */
8885             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_first_ts,
8886                                      tvb, offset, length, ENC_BIG_ENDIAN);
8887             break;
8888
8889         case (NTOP_BASE + 152):           /* RTP_LAST_SEQ */
8890         case ((VENDOR_NTOP << 16) | 152): /* RTP_LAST_SEQ */
8891             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_last_seq,
8892                                      tvb, offset, length, ENC_BIG_ENDIAN);
8893             break;
8894
8895         case (NTOP_BASE + 153):           /* RTP_LAST_TS */
8896         case ((VENDOR_NTOP << 16) | 153): /* RTP_LAST_TS */
8897             /* XXX - is this an NTP timestamp? */
8898             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_last_ts,
8899                                      tvb, offset, length, ENC_BIG_ENDIAN);
8900             break;
8901
8902         case (NTOP_BASE + 154):           /* RTP_IN_JITTER */
8903         case ((VENDOR_NTOP << 16) | 154): /* RTP_IN_JITTER */
8904             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_jitter,
8905                                      tvb, offset, length, ENC_BIG_ENDIAN);
8906             break;
8907
8908         case (NTOP_BASE + 155):           /* RTP_OUT_JITTER */
8909         case ((VENDOR_NTOP << 16) | 155): /* RTP_OUT_JITTER */
8910             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_jitter,
8911                                      tvb, offset, length, ENC_BIG_ENDIAN);
8912             break;
8913
8914         case (NTOP_BASE + 156):           /* RTP_IN_PKT_LOST */
8915         case ((VENDOR_NTOP << 16) | 156): /* RTP_IN_PKT_LOST */
8916             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_pkt_lost,
8917                                      tvb, offset, length, ENC_BIG_ENDIAN);
8918             break;
8919
8920         case (NTOP_BASE + 157):           /* RTP_OUT_PKT_LOST */
8921         case ((VENDOR_NTOP << 16) | 157): /* RTP_OUT_PKT_LOST */
8922             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_pkt_lost,
8923                                      tvb, offset, length, ENC_BIG_ENDIAN);
8924             break;
8925
8926         case (NTOP_BASE + 158):           /* RTP_OUT_PAYLOAD_TYPE */
8927         case ((VENDOR_NTOP << 16) | 158): /* RTP_OUT_PAYLOAD_TYPE */
8928             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_payload_type,
8929                                      tvb, offset, length, ENC_BIG_ENDIAN);
8930             break;
8931
8932         case (NTOP_BASE + 159):           /* RTP_IN_MAX_DELTA */
8933         case ((VENDOR_NTOP << 16) | 159): /* RTP_IN_MAX_DELTA */
8934             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_max_delta,
8935                                      tvb, offset, length, ENC_BIG_ENDIAN);
8936             break;
8937
8938         case (NTOP_BASE + 160):           /* RTP_OUT_MAX_DELTA */
8939         case ((VENDOR_NTOP << 16) | 160): /* RTP_OUT_MAX_DELTA */
8940             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_max_delta,
8941                                      tvb, offset, length, ENC_BIG_ENDIAN);
8942             break;
8943
8944
8945         case (NTOP_BASE + 161):           /* RTP_IN_PAYLOAD_TYPE */
8946         case ((VENDOR_NTOP << 16) | 161): /* RTP_IN_PAYLOAD_TYPE */
8947             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_payload_type,
8948                                      tvb, offset, length, ENC_BIG_ENDIAN);
8949             break;
8950
8951         case (NTOP_BASE + 168):           /* SRC_PROC_PID */
8952         case ((VENDOR_NTOP << 16) | 168): /* SRC_PROC_PID */
8953             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_id,
8954                                      tvb, offset, length, ENC_BIG_ENDIAN);
8955             break;
8956
8957         case (NTOP_BASE + 169):           /* SRC_PROC_NAME */
8958         case ((VENDOR_NTOP << 16) | 169): /* SRC_PROC_NAME */
8959             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_name,
8960                                      tvb, offset, length, ENC_ASCII);
8961             break;
8962
8963         case (NTOP_BASE + 180):           /* HTTP_URL */
8964         case ((VENDOR_NTOP << 16) | 180): /* HTTP_URL */
8965             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_url,
8966                                      tvb, offset, length, ENC_ASCII);
8967             break;
8968
8969         case (NTOP_BASE + 181):           /* HTTP_RET_CODE */
8970         case ((VENDOR_NTOP << 16) | 181): /* HTTP_RET_CODE */
8971             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_ret_code,
8972                                      tvb, offset, length, ENC_BIG_ENDIAN);
8973             break;
8974
8975         case (NTOP_BASE + 182):           /* HTTP_REFERER */
8976         case ((VENDOR_NTOP << 16) | 182): /* HTTP_REFERER */
8977             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_referer,
8978                                      tvb, offset, length, ENC_ASCII);
8979             break;
8980
8981         case (NTOP_BASE + 183):           /* HTTP_UA */
8982         case ((VENDOR_NTOP << 16) | 183): /* HTTP_UA */
8983             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_ua,
8984                                      tvb, offset, length, ENC_ASCII);
8985             break;
8986
8987         case (NTOP_BASE + 184):           /* HTTP_MIME */
8988         case ((VENDOR_NTOP << 16) | 184): /* HTTP_MIME */
8989             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_mime,
8990                                      tvb, offset, length, ENC_ASCII);
8991             break;
8992
8993         case (NTOP_BASE + 185):           /* SMTP_MAIL_FROM */
8994         case ((VENDOR_NTOP << 16) | 185): /* SMTP_MAIL_FROM */
8995             ti = proto_tree_add_item(pdutree, hf_pie_ntop_smtp_mail_from,
8996                                      tvb, offset, length, ENC_ASCII);
8997             break;
8998
8999         case (NTOP_BASE + 186):           /* SMTP_RCPT_TO */
9000         case ((VENDOR_NTOP << 16) | 186): /* SMTP_RCPT_TO */
9001             ti = proto_tree_add_item(pdutree, hf_pie_ntop_smtp_rcpt_to,
9002                                      tvb, offset, length, ENC_ASCII);
9003             break;
9004
9005         case (NTOP_BASE + 187):           /* HTTP_HOST */
9006         case ((VENDOR_NTOP << 16) | 187): /* HTTP_HOST */
9007             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_host,
9008                                      tvb, offset, length, ENC_ASCII);
9009             break;
9010
9011         case (NTOP_BASE + 188):           /* SSL_SERVER_NAME */
9012         case ((VENDOR_NTOP << 16) | 188): /* SSL_SERVER_NAME */
9013             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ssl_server_name,
9014                                      tvb, offset, length, ENC_ASCII);
9015             break;
9016
9017         case (NTOP_BASE + 189):           /* BITTORRENT_HASH */
9018         case ((VENDOR_NTOP << 16) | 189): /* BITTORRENT_HASH */
9019             ti = proto_tree_add_item(pdutree, hf_pie_ntop_bittorrent_hash,
9020                                      tvb, offset, length, ENC_ASCII);
9021             break;
9022
9023         case (NTOP_BASE + 195):           /* MYSQL_SRV_VERSION */
9024         case ((VENDOR_NTOP << 16) | 195): /* MYSQL_SRV_VERSION */
9025             ti = proto_tree_add_item(pdutree, hf_pie_ntop_mysql_srv_version,
9026                                      tvb, offset, length, ENC_ASCII);
9027             break;
9028
9029         case (NTOP_BASE + 196):           /* MYSQL_USERNAME */
9030         case ((VENDOR_NTOP << 16) | 196): /* MYSQL_USERNAME */
9031             ti = proto_tree_add_item(pdutree, hf_pie_ntop_mysql_username,
9032                                      tvb, offset, length, ENC_ASCII);
9033             break;
9034
9035         case (NTOP_BASE + 197):           /* MYSQL_DB */
9036         case ((VENDOR_NTOP << 16) | 197): /* MYSQL_DB */
9037             ti = proto_tree_add_item(pdutree, hf_pie_ntop_mysql_db,
9038                                      tvb, offset, length, ENC_ASCII);
9039             break;
9040
9041         case (NTOP_BASE + 198):           /* MYSQL_QUERY */
9042         case ((VENDOR_NTOP << 16) | 198): /* MYSQL_QUERY */
9043             ti = proto_tree_add_item(pdutree, hf_pie_ntop_mysql_query,
9044                                      tvb, offset, length, ENC_ASCII);
9045             break;
9046
9047         case (NTOP_BASE + 199):           /* MYSQL_RESPONSE */
9048         case ((VENDOR_NTOP << 16) | 199): /* MYSQL_RESPONSE */
9049             ti = proto_tree_add_item(pdutree, hf_pie_ntop_mysql_response,
9050                                      tvb, offset, length, ENC_BIG_ENDIAN);
9051             break;
9052
9053         case (NTOP_BASE + 200):           /* ORACLE_USERNAME */
9054         case ((VENDOR_NTOP << 16) | 200): /* ORACLE_USERNAME */
9055             ti = proto_tree_add_item(pdutree, hf_pie_ntop_oracle_username,
9056                                      tvb, offset, length, ENC_ASCII);
9057             break;
9058
9059         case (NTOP_BASE + 201):           /* ORACLE_QUERY */
9060         case ((VENDOR_NTOP << 16) | 201): /* ORACLE_QUERY */
9061             ti = proto_tree_add_item(pdutree, hf_pie_ntop_oracle_query,
9062                                      tvb, offset, length, ENC_ASCII);
9063             break;
9064
9065         case (NTOP_BASE + 202):           /* ORACLE_RSP_CODE */
9066         case ((VENDOR_NTOP << 16) | 202): /* ORACLE_RSP_CODE */
9067             ti = proto_tree_add_item(pdutree, hf_pie_ntop_oracle_resp_code,
9068                                      tvb, offset, length, ENC_BIG_ENDIAN);
9069             break;
9070
9071         case (NTOP_BASE + 203):           /* ORACLE_RSP_STRING */
9072         case ((VENDOR_NTOP << 16) | 203): /* ORACLE_RSP_STRING */
9073             ti = proto_tree_add_item(pdutree, hf_pie_ntop_oracle_resp_string,
9074                                      tvb, offset, length, ENC_ASCII);
9075             break;
9076
9077         case (NTOP_BASE + 204):           /* ORACLE_QUERY_DURATION */
9078         case ((VENDOR_NTOP << 16) | 204): /* ORACLE_QUERY_DURATION */
9079             ti = proto_tree_add_item(pdutree, hf_pie_ntop_oracle_query_duration,
9080                                      tvb, offset, length, ENC_ASCII|ENC_NA);
9081             break;
9082
9083         case (NTOP_BASE + 205):           /* DNS_QUERY */
9084         case ((VENDOR_NTOP << 16) | 205): /* DNS_QUERY */
9085             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_query,
9086                                      tvb, offset, length, ENC_ASCII);
9087             break;
9088
9089         case (NTOP_BASE + 206):           /* DNS_QUERY_ID */
9090         case ((VENDOR_NTOP << 16) | 206): /* DNS_QUERY_ID */
9091             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_query_id,
9092                                      tvb, offset, length, ENC_BIG_ENDIAN);
9093             break;
9094
9095         case (NTOP_BASE + 207):           /* DNS_QUERY_TYPE */
9096         case ((VENDOR_NTOP << 16) | 207): /* DNS_QUERY_TYPE */
9097             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_query_type,
9098                                      tvb, offset, length, ENC_BIG_ENDIAN);
9099             break;
9100
9101         case (NTOP_BASE + 208):           /* DNS_RET_CODE */
9102         case ((VENDOR_NTOP << 16) | 208): /* DNS_RET_CODE */
9103             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_ret_code,
9104                                      tvb, offset, length, ENC_BIG_ENDIAN);
9105             break;
9106
9107         case (NTOP_BASE + 209):           /* DNS_NUM_ANSWERS */
9108         case ((VENDOR_NTOP << 16) | 209): /* DNS_NUM_ANSWERS */
9109             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_num_answers,
9110                                      tvb, offset, length, ENC_BIG_ENDIAN);
9111             break;
9112
9113         case (NTOP_BASE + 210):           /* POP_USER */
9114         case ((VENDOR_NTOP << 16) | 210): /* POP_USER */
9115             ti = proto_tree_add_item(pdutree, hf_pie_ntop_pop_user,
9116                                      tvb, offset, length, ENC_ASCII);
9117             break;
9118
9119         case (NTOP_BASE + 220):           /* GTPV1_REQ_MSG_TYPE */
9120         case ((VENDOR_NTOP << 16) | 220): /* GTPV1_REQ_MSG_TYPE */
9121             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_req_msg_type,
9122                                      tvb, offset, length, ENC_BIG_ENDIAN);
9123             break;
9124
9125         case (NTOP_BASE + 221):           /* GTPV1_RSP_MSG_TYPE */
9126         case ((VENDOR_NTOP << 16) | 221): /* GTPV1_RSP_MSG_TYPE */
9127             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_rsp_msg_type,
9128                                      tvb, offset, length, ENC_BIG_ENDIAN);
9129             break;
9130
9131         case (NTOP_BASE + 222):           /* GTPV1_C2S_TEID_DATA */
9132         case ((VENDOR_NTOP << 16) | 222): /* GTPV1_C2S_TEID_DATA */
9133             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_c2s_teid_data,
9134                                      tvb, offset, length, ENC_BIG_ENDIAN);
9135             break;
9136
9137         case (NTOP_BASE + 223):           /* GTPV1_C2S_TEID_CTRL */
9138         case ((VENDOR_NTOP << 16) | 223): /* GTPV1_C2S_TEID_CTRL */
9139             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_c2s_teid_ctrl,
9140                                      tvb, offset, length, ENC_BIG_ENDIAN);
9141             break;
9142
9143         case (NTOP_BASE + 224):           /* GTPV1_S2C_TEID_DATA */
9144         case ((VENDOR_NTOP << 16) | 224): /* GTPV1_S2C_TEID_DATA */
9145             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_s2c_teid_data,
9146                                      tvb, offset, length, ENC_BIG_ENDIAN);
9147             break;
9148
9149         case (NTOP_BASE + 225):           /* GTPV1_S2C_TEID_CTRL */
9150         case ((VENDOR_NTOP << 16) | 225): /* GTPV1_S2C_TEID_CTRL */
9151             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_s2c_teid_ctrl,
9152                                      tvb, offset, length, ENC_BIG_ENDIAN);
9153             break;
9154
9155         case (NTOP_BASE + 226):           /* GTPV1_END_USER_IP */
9156         case ((VENDOR_NTOP << 16) | 226): /* GTPV1_END_USER_IP */
9157             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_end_user_ip,
9158                                      tvb, offset, length, ENC_BIG_ENDIAN);
9159             break;
9160
9161         case (NTOP_BASE + 227):           /* GTPV1_END_USER_IMSI */
9162         case ((VENDOR_NTOP << 16) | 227): /* GTPV1_END_USER_IMSI */
9163             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_end_user_imsi,
9164                                      tvb, offset, length, ENC_ASCII);
9165             break;
9166
9167         case (NTOP_BASE + 228):           /* GTPV1_END_USER_MSISDN */
9168         case ((VENDOR_NTOP << 16) | 228): /* GTPV1_END_USER_MSISDN */
9169             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_end_user_msisdn,
9170                                      tvb, offset, length, ENC_ASCII);
9171             break;
9172
9173         case (NTOP_BASE + 229):           /* GTPV1_END_USER_IMEI */
9174         case ((VENDOR_NTOP << 16) | 229): /* GTPV1_END_USER_IMEI */
9175             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_end_user_imei,
9176                                      tvb, offset, length, ENC_ASCII);
9177             break;
9178
9179         case (NTOP_BASE + 230):           /* GTPV1_APN_NAME */
9180         case ((VENDOR_NTOP << 16) | 230): /* GTPV1_APN_NAME */
9181             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_apn_name,
9182                                      tvb, offset, length, ENC_ASCII);
9183             break;
9184
9185         case (NTOP_BASE + 231):           /* GTPV1_RAI_MCC */
9186         case ((VENDOR_NTOP << 16) | 231): /* GTPV1_RAI_MCC */
9187             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_rai_mcc,
9188                                      tvb, offset, length, ENC_BIG_ENDIAN);
9189             break;
9190
9191         case (NTOP_BASE + 232):           /* GTPV1_RAI_MNC */
9192         case ((VENDOR_NTOP << 16) | 232): /* GTPV1_RAI_MNC */
9193             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_rai_mnc,
9194                                      tvb, offset, length, ENC_BIG_ENDIAN);
9195             break;
9196
9197         case (NTOP_BASE + 233):           /* GTPV1_ULI_CELL_LAC */
9198         case ((VENDOR_NTOP << 16) | 233): /* GTPV1_ULI_CELL_LAC */
9199             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_uli_cell_lac,
9200                                      tvb, offset, length, ENC_BIG_ENDIAN);
9201             break;
9202
9203         case (NTOP_BASE + 234):           /* GTPV1_ULI_CELL_CI */
9204         case ((VENDOR_NTOP << 16) | 234): /* GTPV1_ULI_CELL_CI */
9205             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_uli_cell_ci,
9206                                      tvb, offset, length, ENC_BIG_ENDIAN);
9207             break;
9208
9209         case (NTOP_BASE + 235):           /* GTPV1_ULI_SAC */
9210         case ((VENDOR_NTOP << 16) | 235): /* GTPV1_ULI_SAC */
9211             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_uli_sac,
9212                                      tvb, offset, length, ENC_BIG_ENDIAN);
9213             break;
9214
9215         case (NTOP_BASE + 236):           /* GTPV1_RAT_TYPE */
9216         case ((VENDOR_NTOP << 16) | 236): /* GTPV1_RAT_TYPE */
9217             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_rai_type,
9218                                      tvb, offset, length, ENC_BIG_ENDIAN);
9219             break;
9220
9221         case (NTOP_BASE + 240):           /* RADIUS_REQ_MSG_TYPE */
9222         case ((VENDOR_NTOP << 16) | 240): /* RADIUS_REQ_MSG_TYPE */
9223             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_req_msg_type,
9224                                      tvb, offset, length, ENC_BIG_ENDIAN);
9225             break;
9226
9227         case (NTOP_BASE + 241):           /* RADIUS_RSP_MSG_TYPE */
9228         case ((VENDOR_NTOP << 16) | 241): /* RADIUS_RSP_MSG_TYPE */
9229             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_rsp_msg_type,
9230                                      tvb, offset, length, ENC_BIG_ENDIAN);
9231             break;
9232
9233         case (NTOP_BASE + 242):           /* RADIUS_USER_NAME */
9234         case ((VENDOR_NTOP << 16) | 242): /* RADIUS_USER_NAME */
9235             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_user_name,
9236                                      tvb, offset, length, ENC_ASCII);
9237             break;
9238
9239         case (NTOP_BASE + 243):           /* RADIUS_CALLING_STATION_ID */
9240         case ((VENDOR_NTOP << 16) | 243): /* RADIUS_CALLING_STATION_ID */
9241             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_calling_station_id,
9242                                      tvb, offset, length, ENC_ASCII);
9243             break;
9244
9245         case (NTOP_BASE + 244):           /* RADIUS_CALLED_STATION_ID */
9246         case ((VENDOR_NTOP << 16) | 244): /* RADIUS_CALLED_STATION_ID */
9247             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_called_station_id,
9248                                      tvb, offset, length, ENC_ASCII);
9249             break;
9250
9251         case (NTOP_BASE + 245):           /* RADIUS_NAS_IP_ADDR */
9252         case ((VENDOR_NTOP << 16) | 245): /* RADIUS_NAS_IP_ADDR */
9253             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_nas_ip_addr,
9254                                      tvb, offset, length, ENC_BIG_ENDIAN);
9255             break;
9256
9257         case (NTOP_BASE + 246):           /* RADIUS_NAS_IDENTIFIER */
9258         case ((VENDOR_NTOP << 16) | 246): /* RADIUS_NAS_IDENTIFIER */
9259             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_nas_identifier,
9260                                      tvb, offset, length, ENC_ASCII);
9261             break;
9262
9263         case (NTOP_BASE + 247):           /* RADIUS_USER_IMSI */
9264         case ((VENDOR_NTOP << 16) | 247): /* RADIUS_USER_IMSI */
9265             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_user_imsi,
9266                                      tvb, offset, length, ENC_ASCII);
9267             break;
9268
9269         case (NTOP_BASE + 248):           /* RADIUS_USER_IMEI */
9270         case ((VENDOR_NTOP << 16) | 248): /* RADIUS_USER_IMEI */
9271             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_user_imei,
9272                                      tvb, offset, length, ENC_ASCII);
9273             break;
9274
9275         case (NTOP_BASE + 249):           /* RADIUS_FRAMED_IP_ADDR */
9276         case ((VENDOR_NTOP << 16) | 249): /* RADIUS_FRAMED_IP_ADDR */
9277             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_framed_ip_addr,
9278                                      tvb, offset, length, ENC_BIG_ENDIAN);
9279             break;
9280
9281         case (NTOP_BASE + 250):           /* RADIUS_ACCT_SESSION_ID */
9282         case ((VENDOR_NTOP << 16) | 250): /* RADIUS_ACCT_SESSION_ID */
9283             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_acct_session_id,
9284                                      tvb, offset, length, ENC_ASCII);
9285             break;
9286
9287         case (NTOP_BASE + 251):           /* RADIUS_ACCT_STATUS_TYPE */
9288         case ((VENDOR_NTOP << 16) | 251): /* RADIUS_ACCT_STATUS_TYPE */
9289             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_acct_status_type,
9290                                      tvb, offset, length, ENC_ASCII);
9291             break;
9292
9293         case (NTOP_BASE + 252):           /* RADIUS_ACCT_IN_OCTETS */
9294         case ((VENDOR_NTOP << 16) | 252): /* RADIUS_ACCT_IN_OCTETS */
9295             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_acct_in_octets,
9296                                      tvb, offset, length, ENC_BIG_ENDIAN);
9297             break;
9298
9299         case (NTOP_BASE + 253):           /* RADIUS_ACCT_OUT_OCTETS */
9300         case ((VENDOR_NTOP << 16) | 253): /* RADIUS_ACCT_OUT_OCTETS */
9301             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_acct_out_octets,
9302                                      tvb, offset, length, ENC_BIG_ENDIAN);
9303             break;
9304
9305         case (NTOP_BASE + 254):           /* RADIUS_ACCT_IN_PKTS */
9306         case ((VENDOR_NTOP << 16) | 254): /* RADIUS_ACCT_IN_PKTS */
9307             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_acct_in_pkts,
9308                                      tvb, offset, length, ENC_BIG_ENDIAN);
9309             break;
9310
9311         case (NTOP_BASE + 255):           /* RADIUS_ACCT_OUT_PKTS */
9312         case ((VENDOR_NTOP << 16) | 255): /* RADIUS_ACCT_OUT_PKTS */
9313             ti = proto_tree_add_item(pdutree, hf_pie_ntop_radius_acct_out_pkts,
9314                                      tvb, offset, length, ENC_BIG_ENDIAN);
9315             break;
9316
9317         case (NTOP_BASE + 260):           /* IMAP_LOGIN */
9318         case ((VENDOR_NTOP << 16) | 260): /* IMAP_LOGIN */
9319             ti = proto_tree_add_item(pdutree, hf_pie_ntop_imap_login,
9320                                      tvb, offset, length, ENC_ASCII);
9321             break;
9322
9323         case (NTOP_BASE + 270):           /* GTPV2_REQ_MSG_TYPE */
9324         case ((VENDOR_NTOP << 16) | 270): /* GTPV2_REQ_MSG_TYPE */
9325             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_req_msg_type,
9326                                      tvb, offset, length, ENC_BIG_ENDIAN);
9327             break;
9328
9329         case (NTOP_BASE + 271):           /* GTPV2_RSP_MSG_TYPE */
9330         case ((VENDOR_NTOP << 16) | 271): /* GTPV2_RSP_MSG_TYPE */
9331             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_rsp_msg_type,
9332                                      tvb, offset, length, ENC_BIG_ENDIAN);
9333             break;
9334
9335         case (NTOP_BASE + 272):           /* GTPV2_C2S_S1U_GTPU_TEID */
9336         case ((VENDOR_NTOP << 16) | 272): /* GTPV2_C2S_S1U_GTPU_TEID */
9337             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s1u_gtpu_teid,
9338                                      tvb, offset, length, ENC_BIG_ENDIAN);
9339             break;
9340
9341         case (NTOP_BASE + 273):           /* GTPV2_C2S_S1U_GTPU_IP */
9342         case ((VENDOR_NTOP << 16) | 273): /* GTPV2_C2S_S1U_GTPU_IP */
9343             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s1u_gtpu_ip,
9344                                      tvb, offset, length, ENC_BIG_ENDIAN);
9345             break;
9346
9347         case (NTOP_BASE + 274):           /* GTPV2_S2C_S1U_GTPU_TEID */
9348         case ((VENDOR_NTOP << 16) | 274): /* GTPV2_S2C_S1U_GTPU_TEID */
9349             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s1u_gtpu_teid,
9350                                      tvb, offset, length, ENC_ASCII);
9351             break;
9352
9353         case (NTOP_BASE + 275):           /* GTPV2_S2C_S1U_GTPU_IP */
9354         case ((VENDOR_NTOP << 16) | 275): /* GTPV2_S2C_S1U_GTPU_IP */
9355             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s1u_gtpu_ip,
9356                                      tvb, offset, length, ENC_BIG_ENDIAN);
9357             break;
9358
9359         case (NTOP_BASE + 276):           /* GTPV2_END_USER_IMSI */
9360         case ((VENDOR_NTOP << 16) | 276): /* GTPV2_END_USER_IMSI */
9361             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_end_user_imsi,
9362                                      tvb, offset, length, ENC_ASCII);
9363             break;
9364
9365         case (NTOP_BASE + 277):           /* GTPV2_END_USER_MSISDN */
9366         case ((VENDOR_NTOP << 16) | 277): /* GTPV2_END_USER_MSISDN */
9367             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_and_user_msisdn,
9368                                      tvb, offset, length, ENC_ASCII);
9369             break;
9370
9371         case (NTOP_BASE + 278):           /* GTPV2_APN_NAME */
9372         case ((VENDOR_NTOP << 16) | 278): /* GTPV2_APN_NAME */
9373             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_apn_name,
9374                                      tvb, offset, length, ENC_ASCII);
9375             break;
9376
9377         case (NTOP_BASE + 279):           /* GTPV2_ULI_MCC */
9378         case ((VENDOR_NTOP << 16) | 279): /* GTPV2_ULI_MCC */
9379             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_uli_mcc,
9380                                      tvb, offset, length, ENC_BIG_ENDIAN);
9381             break;
9382
9383         case (NTOP_BASE + 280):           /* GTPV2_ULI_MNC */
9384         case ((VENDOR_NTOP << 16) | 280): /* GTPV2_ULI_MNC */
9385             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_uli_mnc,
9386                                      tvb, offset, length, ENC_BIG_ENDIAN);
9387             break;
9388
9389         case (NTOP_BASE + 281):           /* GTPV2_ULI_CELL_TAC */
9390         case ((VENDOR_NTOP << 16) | 281): /* GTPV2_ULI_CELL_TAC */
9391             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_uli_cell_tac,
9392                                      tvb, offset, length, ENC_BIG_ENDIAN);
9393             break;
9394
9395         case (NTOP_BASE + 282):           /* GTPV2_ULI_CELL_ID */
9396         case ((VENDOR_NTOP << 16) | 282): /* GTPV2_ULI_CELL_ID */
9397             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_uli_cell_id,
9398                                      tvb, offset, length, ENC_BIG_ENDIAN);
9399             break;
9400
9401         case (NTOP_BASE + 283):           /* GTPV2_RAT_TYPE */
9402         case ((VENDOR_NTOP << 16) | 283): /* GTPV2_RAT_TYPE */
9403             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_rat_type,
9404                                      tvb, offset, length, ENC_BIG_ENDIAN);
9405             break;
9406
9407         case (NTOP_BASE + 284):           /* GTPV2_PDN_IP */
9408         case ((VENDOR_NTOP << 16) | 284): /* GTPV2_PDN_IP */
9409             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_pdn_ip,
9410                                      tvb, offset, length, ENC_BIG_ENDIAN);
9411             break;
9412
9413         case (NTOP_BASE + 285):           /* GTPV2_END_USER_IMEI */
9414         case ((VENDOR_NTOP << 16) | 285): /* GTPV2_END_USER_IMEI */
9415             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_end_user_imei,
9416                                      tvb, offset, length, ENC_ASCII);
9417             break;
9418
9419         case (NTOP_BASE + 290):           /* SRC_AS_PATH_1 */
9420         case ((VENDOR_NTOP << 16) | 290): /* SRC_AS_PATH_1 */
9421             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_1,
9422                                      tvb, offset, length, ENC_BIG_ENDIAN);
9423             break;
9424
9425         case (NTOP_BASE + 291):           /* SRC_AS_PATH_2 */
9426         case ((VENDOR_NTOP << 16) | 291): /* SRC_AS_PATH_2 */
9427             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_2,
9428                                      tvb, offset, length, ENC_BIG_ENDIAN);
9429             break;
9430
9431         case (NTOP_BASE + 292):           /* SRC_AS_PATH_3 */
9432         case ((VENDOR_NTOP << 16) | 292): /* SRC_AS_PATH_3 */
9433             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_3,
9434                                      tvb, offset, length, ENC_BIG_ENDIAN);
9435             break;
9436
9437         case (NTOP_BASE + 293):           /* SRC_AS_PATH_4 */
9438         case ((VENDOR_NTOP << 16) | 293): /* SRC_AS_PATH_4 */
9439             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_4,
9440                                      tvb, offset, length, ENC_BIG_ENDIAN);
9441             break;
9442
9443         case (NTOP_BASE + 294):           /* SRC_AS_PATH_5 */
9444         case ((VENDOR_NTOP << 16) | 294): /* SRC_AS_PATH_5 */
9445             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_5,
9446                                      tvb, offset, length, ENC_BIG_ENDIAN);
9447             break;
9448
9449         case (NTOP_BASE + 295):           /* SRC_AS_PATH_6 */
9450         case ((VENDOR_NTOP << 16) | 295): /* SRC_AS_PATH_6 */
9451             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_6,
9452                                      tvb, offset, length, ENC_BIG_ENDIAN);
9453             break;
9454
9455         case (NTOP_BASE + 296):           /* SRC_AS_PATH_7 */
9456         case ((VENDOR_NTOP << 16) | 296): /* SRC_AS_PATH_7 */
9457             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_7,
9458                                      tvb, offset, length, ENC_BIG_ENDIAN);
9459             break;
9460
9461         case (NTOP_BASE + 297):           /* SRC_AS_PATH_8 */
9462         case ((VENDOR_NTOP << 16) | 297): /* SRC_AS_PATH_8 */
9463             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_8,
9464                                      tvb, offset, length, ENC_BIG_ENDIAN);
9465             break;
9466
9467         case (NTOP_BASE + 298):           /* SRC_AS_PATH_9 */
9468         case ((VENDOR_NTOP << 16) | 298): /* SRC_AS_PATH_9 */
9469             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_9,
9470                                      tvb, offset, length, ENC_BIG_ENDIAN);
9471             break;
9472
9473         case (NTOP_BASE + 299):           /* SRC_AS_PATH_10 */
9474         case ((VENDOR_NTOP << 16) | 299): /* SRC_AS_PATH_10 */
9475             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_path_10,
9476                                      tvb, offset, length, ENC_BIG_ENDIAN);
9477             break;
9478
9479         case (NTOP_BASE + 300):           /* DST_AS_PATH_1 */
9480         case ((VENDOR_NTOP << 16) | 300): /* DST_AS_PATH_1 */
9481             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_1,
9482                                      tvb, offset, length, ENC_BIG_ENDIAN);
9483             break;
9484
9485         case (NTOP_BASE + 301):           /* DST_AS_PATH_2 */
9486         case ((VENDOR_NTOP << 16) | 301): /* DST_AS_PATH_2 */
9487             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_2,
9488                                      tvb, offset, length, ENC_BIG_ENDIAN);
9489             break;
9490
9491         case (NTOP_BASE + 302):           /* DST_AS_PATH_3 */
9492         case ((VENDOR_NTOP << 16) | 302): /* DST_AS_PATH_3 */
9493             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_3,
9494                                      tvb, offset, length, ENC_BIG_ENDIAN);
9495             break;
9496
9497         case (NTOP_BASE + 303):           /* DST_AS_PATH_4 */
9498         case ((VENDOR_NTOP << 16) | 303): /* DST_AS_PATH_4 */
9499             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_4,
9500                                      tvb, offset, length, ENC_BIG_ENDIAN);
9501             break;
9502
9503         case (NTOP_BASE + 304):           /* DST_AS_PATH_5 */
9504         case ((VENDOR_NTOP << 16) | 304): /* DST_AS_PATH_5 */
9505             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_5,
9506                                      tvb, offset, length, ENC_BIG_ENDIAN);
9507             break;
9508
9509         case (NTOP_BASE + 305):           /* DST_AS_PATH_6 */
9510         case ((VENDOR_NTOP << 16) | 305): /* DST_AS_PATH_6 */
9511             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_6,
9512                                      tvb, offset, length, ENC_BIG_ENDIAN);
9513             break;
9514
9515         case (NTOP_BASE + 306):           /* DST_AS_PATH_7 */
9516         case ((VENDOR_NTOP << 16) | 306): /* DST_AS_PATH_7 */
9517             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_7,
9518                                      tvb, offset, length, ENC_BIG_ENDIAN);
9519             break;
9520
9521         case (NTOP_BASE + 307):           /* DST_AS_PATH_8 */
9522         case ((VENDOR_NTOP << 16) | 307): /* DST_AS_PATH_8 */
9523             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_8,
9524                                      tvb, offset, length, ENC_BIG_ENDIAN);
9525             break;
9526
9527         case (NTOP_BASE + 308):           /* DST_AS_PATH_9 */
9528         case ((VENDOR_NTOP << 16) | 308): /* DST_AS_PATH_9 */
9529             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_9,
9530                                      tvb, offset, length, ENC_BIG_ENDIAN);
9531             break;
9532
9533         case (NTOP_BASE + 309):           /* DST_AS_PATH_10 */
9534         case ((VENDOR_NTOP << 16) | 309): /* DST_AS_PATH_10 */
9535             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_path_10,
9536                                      tvb, offset, length, ENC_BIG_ENDIAN);
9537             break;
9538
9539         case (NTOP_BASE + 320):           /* MYSQL_APPL_LATENCY_USEC */
9540         case ((VENDOR_NTOP << 16) | 320): /* MYSQL_APPL_LATENCY_USEC */
9541             ti = proto_tree_add_item(pdutree, hf_pie_ntop_mysql_appl_latency_usec,
9542                                      tvb, offset, length, ENC_BIG_ENDIAN);
9543             break;
9544
9545         case (NTOP_BASE + 321):           /* GTPV0_REQ_MSG_TYPE */
9546         case ((VENDOR_NTOP << 16) | 321): /* GTPV0_REQ_MSG_TYPE */
9547             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_req_msg_type,
9548                                      tvb, offset, length, ENC_BIG_ENDIAN);
9549             break;
9550
9551         case (NTOP_BASE + 322):           /* GTPV0_RSP_MSG_TYPE */
9552         case ((VENDOR_NTOP << 16) | 322): /* GTPV0_RSP_MSG_TYPE */
9553             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_rsp_msg_type,
9554                                      tvb, offset, length, ENC_BIG_ENDIAN);
9555             break;
9556
9557         case (NTOP_BASE + 323):           /* GTPV0_TID */
9558         case ((VENDOR_NTOP << 16) | 323): /* GTPV0_TID */
9559             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_tid,
9560                                      tvb, offset, length, ENC_BIG_ENDIAN);
9561             break;
9562
9563         case (NTOP_BASE + 324):           /* GTPV0_END_USER_IP */
9564         case ((VENDOR_NTOP << 16) | 324): /* GTPV0_END_USER_IP */
9565             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_end_user_ip,
9566                                      tvb, offset, length, ENC_BIG_ENDIAN);
9567             break;
9568
9569         case (NTOP_BASE + 325):           /* GTPV0_END_USER_MSISDN */
9570         case ((VENDOR_NTOP << 16) | 325): /* GTPV0_END_USER_MSISDN */
9571             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_end_user_msisdn,
9572                                      tvb, offset, length, ENC_ASCII);
9573             break;
9574
9575         case (NTOP_BASE + 326):           /* GTPV0_APN_NAME */
9576         case ((VENDOR_NTOP << 16) | 326): /* GTPV0_APN_NAME */
9577             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_apn_name,
9578                                      tvb, offset, length, ENC_ASCII);
9579             break;
9580
9581         case (NTOP_BASE + 327):           /* GTPV0_RAI_MCC */
9582         case ((VENDOR_NTOP << 16) | 327): /* GTPV0_RAI_MCC */
9583             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_rai_mcc,
9584                                      tvb, offset, length, ENC_BIG_ENDIAN);
9585             break;
9586
9587         case (NTOP_BASE + 328):           /* GTPV0_RAI_MNC */
9588         case ((VENDOR_NTOP << 16) | 328): /* GTPV0_RAI_MNC */
9589             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_rai_mnc,
9590                                      tvb, offset, length, ENC_BIG_ENDIAN);
9591             break;
9592
9593         case (NTOP_BASE + 329):           /* GTPV0_RAI_CELL_LAC */
9594         case ((VENDOR_NTOP << 16) | 329): /* GTPV0_RAI_CELL_LAC */
9595             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_rai_cell_lac,
9596                                      tvb, offset, length, ENC_BIG_ENDIAN);
9597             break;
9598
9599         case (NTOP_BASE + 330):           /* GTPV0_RAI_CELL_RAC */
9600         case ((VENDOR_NTOP << 16) | 330): /* GTPV0_RAI_CELL_RAC */
9601             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_rai_cell_rac,
9602                                      tvb, offset, length, ENC_BIG_ENDIAN);
9603             break;
9604
9605         case (NTOP_BASE + 331):           /* GTPV0_RESPONSE_CAUSE */
9606         case ((VENDOR_NTOP << 16) | 331): /* GTPV0_RESPONSE_CAUSE */
9607             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv0_response_cause,
9608                                      tvb, offset, length, ENC_BIG_ENDIAN);
9609             break;
9610
9611         case (NTOP_BASE + 332):           /* GTPV1_RESPONSE_CAUSE */
9612         case ((VENDOR_NTOP << 16) | 332): /* GTPV1_RESPONSE_CAUSE */
9613             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_response_cause,
9614                                      tvb, offset, length, ENC_BIG_ENDIAN);
9615             break;
9616
9617         case (NTOP_BASE + 333):           /* GTPV2_RESPONSE_CAUSE */
9618         case ((VENDOR_NTOP << 16) | 333): /* GTPV2_RESPONSE_CAUSE */
9619             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_response_cause,
9620                                      tvb, offset, length, ENC_BIG_ENDIAN);
9621             break;
9622
9623         case (NTOP_BASE + 334):           /* NUM_PKTS_TTL_5_32 */
9624         case ((VENDOR_NTOP << 16) | 334): /* NUM_PKTS_TTL_5_32 */
9625             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_5_32,
9626                                      tvb, offset, length, ENC_BIG_ENDIAN);
9627             break;
9628
9629         case (NTOP_BASE + 335):           /* NUM_PKTS_TTL_32_64 */
9630         case ((VENDOR_NTOP << 16) | 335): /* NUM_PKTS_TTL_32_64 */
9631             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_32_64,
9632                                      tvb, offset, length, ENC_BIG_ENDIAN);
9633             break;
9634
9635         case (NTOP_BASE + 336):           /* NUM_PKTS_TTL_64_96 */
9636         case ((VENDOR_NTOP << 16) | 336): /* NUM_PKTS_TTL_64_96 */
9637             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_64_96,
9638                                      tvb, offset, length, ENC_BIG_ENDIAN);
9639             break;
9640
9641         case (NTOP_BASE + 337):           /* NUM_PKTS_TTL_96_128 */
9642         case ((VENDOR_NTOP << 16) | 337): /* NUM_PKTS_TTL_96_128 */
9643             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_96_128,
9644                                      tvb, offset, length, ENC_BIG_ENDIAN);
9645             break;
9646
9647         case (NTOP_BASE + 338):           /* NUM_PKTS_TTL_128_160 */
9648         case ((VENDOR_NTOP << 16) | 338): /* NUM_PKTS_TTL_128_160 */
9649             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_128_160,
9650                                      tvb, offset, length, ENC_BIG_ENDIAN);
9651             break;
9652
9653         case (NTOP_BASE + 339):           /* NUM_PKTS_TTL_160_192 */
9654         case ((VENDOR_NTOP << 16) | 339): /* NUM_PKTS_TTL_160_192 */
9655             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_160_192,
9656                                      tvb, offset, length, ENC_BIG_ENDIAN);
9657             break;
9658
9659         case (NTOP_BASE + 340):           /* NUM_PKTS_TTL_192_224 */
9660         case ((VENDOR_NTOP << 16) | 340): /* NUM_PKTS_TTL_192_224 */
9661             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_192_224,
9662                                      tvb, offset, length, ENC_BIG_ENDIAN);
9663             break;
9664
9665         case (NTOP_BASE + 341):           /* NUM_PKTS_TTL_224_255 */
9666         case ((VENDOR_NTOP << 16) | 341): /* NUM_PKTS_TTL_224_255 */
9667             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_224_255,
9668                                      tvb, offset, length, ENC_BIG_ENDIAN);
9669             break;
9670
9671         case (NTOP_BASE + 342):           /* GTPV1_RAI_LAC */
9672         case ((VENDOR_NTOP << 16) | 342): /* GTPV1_RAI_LAC */
9673             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_rai_lac,
9674                                      tvb, offset, length, ENC_BIG_ENDIAN);
9675             break;
9676
9677         case (NTOP_BASE + 343):           /* GTPV1_RAI_RAC */
9678         case ((VENDOR_NTOP << 16) | 343): /* GTPV1_RAI_RAC */
9679             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_rai_rac,
9680                                      tvb, offset, length, ENC_BIG_ENDIAN);
9681             break;
9682
9683         case (NTOP_BASE + 344):           /* GTPV1_ULI_MCC */
9684         case ((VENDOR_NTOP << 16) | 344): /* GTPV1_ULI_MCC */
9685             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_uli_mcc,
9686                                      tvb, offset, length, ENC_BIG_ENDIAN);
9687             break;
9688
9689         case (NTOP_BASE + 345):           /* GTPV1_ULI_MNC */
9690         case ((VENDOR_NTOP << 16) | 345): /* GTPV1_ULI_MNC */
9691             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv1_uli_mnc,
9692                                      tvb, offset, length, ENC_BIG_ENDIAN);
9693             break;
9694
9695         case (NTOP_BASE + 346):           /* NUM_PKTS_TTL_2_5 */
9696         case ((VENDOR_NTOP << 16) | 346): /* NUM_PKTS_TTL_2_5 */
9697             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_2_5,
9698                                      tvb, offset, length, ENC_BIG_ENDIAN);
9699             break;
9700
9701         case (NTOP_BASE + 347):           /* NUM_PKTS_TTL_EQ_1 */
9702         case ((VENDOR_NTOP << 16) | 347): /* NUM_PKTS_TTL_EQ_1 */
9703             ti = proto_tree_add_item(pdutree, hf_pie_ntop_num_pkts_ttl_eq_1,
9704                                      tvb, offset, length, ENC_BIG_ENDIAN);
9705             break;
9706
9707         case (NTOP_BASE + 348):           /* RTP_SIP_CALL_ID */
9708         case ((VENDOR_NTOP << 16) | 348): /* RTP_SIP_CALL_ID */
9709             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_sip_call_id,
9710                                      tvb, offset, length, ENC_ASCII);
9711             break;
9712
9713         case (NTOP_BASE + 349):           /* IN_SRC_OSI_SAP */
9714         case ((VENDOR_NTOP << 16) | 349): /* IN_SRC_OSI_SAP */
9715             ti = proto_tree_add_item(pdutree, hf_pie_ntop_in_src_osi_sap,
9716                                      tvb, offset, length, ENC_ASCII);
9717             break;
9718
9719         case (NTOP_BASE + 350):           /* OUT_DST_OSI_SAP */
9720         case ((VENDOR_NTOP << 16) | 350): /* OUT_DST_OSI_SAP */
9721             ti = proto_tree_add_item(pdutree, hf_pie_ntop_out_dst_osi_sap,
9722                                      tvb, offset, length, ENC_ASCII);
9723             break;
9724
9725         case (NTOP_BASE + 351):           /* WHOIS_DAS_DOMAIN */
9726         case ((VENDOR_NTOP << 16) | 351): /* WHOIS_DAS_DOMAIN */
9727             ti = proto_tree_add_item(pdutree, hf_pie_ntop_whois_das_domain,
9728                                      tvb, offset, length, ENC_ASCII);
9729             break;
9730
9731         case (NTOP_BASE + 352):           /* DNS_TTL_ANSWER */
9732         case ((VENDOR_NTOP << 16) | 352): /* DNS_TTL_ANSWER */
9733             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_ttl_answer,
9734                                      tvb, offset, length, ENC_BIG_ENDIAN);
9735             break;
9736
9737         case (NTOP_BASE + 353):           /* DHCP_CLIENT_MAC */
9738         case ((VENDOR_NTOP << 16) | 353): /* DHCP_CLIENT_MAC */
9739             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dhcp_client_mac,
9740                                      tvb, offset, length, ENC_NA);
9741             break;
9742
9743         case (NTOP_BASE + 354):           /* DHCP_CLIENT_IP */
9744         case ((VENDOR_NTOP << 16) | 354): /* DHCP_CLIENT_IP */
9745             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dhcp_client_ip,
9746                                      tvb, offset, length, ENC_BIG_ENDIAN);
9747             break;
9748
9749         case (NTOP_BASE + 355):           /* DHCP_CLIENT_NAME */
9750         case ((VENDOR_NTOP << 16) | 355): /* DHCP_CLIENT_NAME */
9751             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dhcp_client_name,
9752                                      tvb, offset, length, ENC_ASCII);
9753             break;
9754
9755         case (NTOP_BASE + 356):           /* FTP_LOGIN */
9756         case ((VENDOR_NTOP << 16) | 356): /* FTP_LOGIN */
9757             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ftp_login,
9758                                      tvb, offset, length, ENC_ASCII);
9759             break;
9760
9761         case (NTOP_BASE + 357):           /* FTP_PASSWORD */
9762         case ((VENDOR_NTOP << 16) | 357): /* FTP_PASSWORD */
9763             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ftp_password,
9764                                      tvb, offset, length, ENC_ASCII);
9765             break;
9766
9767         case (NTOP_BASE + 358):           /* FTP_COMMAND */
9768         case ((VENDOR_NTOP << 16) | 358): /* FTP_COMMAND */
9769             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ftp_command,
9770                                      tvb, offset, length, ENC_ASCII);
9771             break;
9772
9773         case (NTOP_BASE + 359):           /* FTP_COMMAND_RET_CODE */
9774         case ((VENDOR_NTOP << 16) | 359): /* FTP_COMMAND_RET_CODE */
9775             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ftp_command_ret_code,
9776                                      tvb, offset, length, ENC_BIG_ENDIAN);
9777             break;
9778
9779         case (NTOP_BASE + 360):           /* HTTP_METHOD */
9780         case ((VENDOR_NTOP << 16) | 360): /* HTTP_METHOD */
9781             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_method,
9782                                      tvb, offset, length, ENC_ASCII);
9783             break;
9784
9785         case (NTOP_BASE + 361):           /* HTTP_SITE */
9786         case ((VENDOR_NTOP << 16) | 361): /* HTTP_SITE */
9787             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_site,
9788                                      tvb, offset, length, ENC_ASCII);
9789             break;
9790
9791         case (NTOP_BASE + 362):           /* SIP_C_IP */
9792         case ((VENDOR_NTOP << 16) | 362): /* SIP_C_IP */
9793             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_c_ip,
9794                                      tvb, offset, length, ENC_ASCII);
9795             break;
9796
9797         case (NTOP_BASE + 363):           /* SIP_CALL_STATE */
9798         case ((VENDOR_NTOP << 16) | 363): /* SIP_CALL_STATE */
9799             ti = proto_tree_add_item(pdutree, hf_pie_ntop_sip_call_state,
9800                                      tvb, offset, length, ENC_ASCII);
9801             break;
9802
9803         case (NTOP_BASE + 370):           /* RTP_IN_MOS */
9804         case ((VENDOR_NTOP << 16) | 370): /* RTP_IN_MOS */
9805             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_mos,
9806                                      tvb, offset, length, ENC_BIG_ENDIAN);
9807             break;
9808
9809         case (NTOP_BASE + 371):           /* RTP_IN_R_FACTOR */
9810         case ((VENDOR_NTOP << 16) | 371): /* RTP_IN_R_FACTOR */
9811             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_r_factor,
9812                                      tvb, offset, length, ENC_BIG_ENDIAN);
9813             break;
9814
9815         case (NTOP_BASE + 372):           /* SRC_PROC_USER_NAME */
9816         case ((VENDOR_NTOP << 16) | 372): /* SRC_PROC_USER_NAME */
9817             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_user_name,
9818                                      tvb, offset, length, ENC_ASCII);
9819             break;
9820
9821         case (NTOP_BASE + 373):           /* SRC_FATHER_PROC_PID */
9822         case ((VENDOR_NTOP << 16) | 373): /* SRC_FATHER_PROC_PID */
9823             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_father_proc_pid,
9824                                      tvb, offset, length, ENC_BIG_ENDIAN);
9825             break;
9826
9827         case (NTOP_BASE + 374):           /* SRC_FATHER_PROC_NAME */
9828         case ((VENDOR_NTOP << 16) | 374): /* SRC_FATHER_PROC_NAME */
9829             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_father_proc_name,
9830                                      tvb, offset, length, ENC_ASCII);
9831             break;
9832
9833         case (NTOP_BASE + 375):           /* DST_PROC_PID */
9834         case ((VENDOR_NTOP << 16) | 375): /* DST_PROC_PID */
9835             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_pid,
9836                                      tvb, offset, length, ENC_BIG_ENDIAN);
9837             break;
9838
9839         case (NTOP_BASE + 376):           /* DST_PROC_NAME */
9840         case ((VENDOR_NTOP << 16) | 376): /* DST_PROC_NAME */
9841             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_name,
9842                                      tvb, offset, length, ENC_ASCII);
9843             break;
9844
9845         case (NTOP_BASE + 377):           /* DST_PROC_USER_NAME */
9846         case ((VENDOR_NTOP << 16) | 377): /* DST_PROC_USER_NAME */
9847             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_user_name,
9848                                      tvb, offset, length, ENC_ASCII);
9849             break;
9850
9851         case (NTOP_BASE + 378):           /* DST_FATHER_PROC_PID */
9852         case ((VENDOR_NTOP << 16) | 378): /* DST_FATHER_PROC_PID */
9853             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_father_proc_pid,
9854                                      tvb, offset, length, ENC_BIG_ENDIAN);
9855             break;
9856
9857         case (NTOP_BASE + 379):           /* DST_FATHER_PROC_NAME */
9858         case ((VENDOR_NTOP << 16) | 379): /* DST_FATHER_PROC_NAME */
9859             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_father_proc_name,
9860                                      tvb, offset, length, ENC_ASCII);
9861             break;
9862
9863         case (NTOP_BASE + 380):           /* RTP_RTT */
9864         case ((VENDOR_NTOP << 16) | 380): /* RTP_RTT */
9865             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_rtt,
9866                                      tvb, offset, length, ENC_BIG_ENDIAN);
9867             break;
9868
9869         case (NTOP_BASE + 381):           /* RTP_IN_TRANSIT */
9870         case ((VENDOR_NTOP << 16) | 381): /* RTP_IN_TRANSIT */
9871             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_transit,
9872                                      tvb, offset, length, ENC_BIG_ENDIAN);
9873             break;
9874
9875         case (NTOP_BASE + 382):           /* RTP_OUT_TRANSIT */
9876         case ((VENDOR_NTOP << 16) | 382): /* RTP_OUT_TRANSIT */
9877             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_transit,
9878                                      tvb, offset, length, ENC_BIG_ENDIAN);
9879             break;
9880
9881         case (NTOP_BASE + 383):           /* SRC_PROC_ACTUAL_MEMORY */
9882         case ((VENDOR_NTOP << 16) | 383): /* SRC_PROC_ACTUAL_MEMORY */
9883             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_actual_memory,
9884                                      tvb, offset, length, ENC_BIG_ENDIAN);
9885             break;
9886
9887         case (NTOP_BASE + 384):           /* SRC_PROC_PEAK_MEMORY */
9888         case ((VENDOR_NTOP << 16) | 384): /* SRC_PROC_PEAK_MEMORY */
9889             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_peak_memory,
9890                                      tvb, offset, length, ENC_BIG_ENDIAN);
9891             break;
9892
9893         case (NTOP_BASE + 385):           /* SRC_PROC_AVERAGE_CPU_LOAD */
9894         case ((VENDOR_NTOP << 16) | 385): /* SRC_PROC_AVERAGE_CPU_LOAD */
9895             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_average_cpu_load,
9896                                      tvb, offset, length, ENC_BIG_ENDIAN);
9897             break;
9898
9899         case (NTOP_BASE + 386):           /* SRC_PROC_NUM_PAGE_FAULTS */
9900         case ((VENDOR_NTOP << 16) | 386): /* SRC_PROC_NUM_PAGE_FAULTS */
9901             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_num_page_faults,
9902                                      tvb, offset, length, ENC_BIG_ENDIAN);
9903             break;
9904
9905         case (NTOP_BASE + 387):           /* DST_PROC_ACTUAL_MEMORY */
9906         case ((VENDOR_NTOP << 16) | 387): /* DST_PROC_ACTUAL_MEMORY */
9907             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_actual_memory,
9908                                      tvb, offset, length, ENC_BIG_ENDIAN);
9909             break;
9910
9911         case (NTOP_BASE + 388):           /* DST_PROC_PEAK_MEMORY */
9912         case ((VENDOR_NTOP << 16) | 388): /* DST_PROC_PEAK_MEMORY */
9913             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_peak_memory,
9914                                      tvb, offset, length, ENC_BIG_ENDIAN);
9915             break;
9916
9917         case (NTOP_BASE + 389):           /* DST_PROC_AVERAGE_CPU_LOAD */
9918         case ((VENDOR_NTOP << 16) | 389): /* DST_PROC_AVERAGE_CPU_LOAD */
9919             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_average_cpu_load,
9920                                      tvb, offset, length, ENC_BIG_ENDIAN);
9921             break;
9922
9923         case (NTOP_BASE + 390):           /* DST_PROC_NUM_PAGE_FAULTS */
9924         case ((VENDOR_NTOP << 16) | 390): /* DST_PROC_NUM_PAGE_FAULTS */
9925             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_num_page_faults,
9926                                      tvb, offset, length, ENC_BIG_ENDIAN);
9927             break;
9928
9929         case (NTOP_BASE + 391):           /* DURATION_IN */
9930         case ((VENDOR_NTOP << 16) | 391): /* DURATION_IN */
9931             ti = proto_tree_add_item(pdutree, hf_pie_ntop_duration_in,
9932                                      tvb, offset, length, ENC_BIG_ENDIAN);
9933             break;
9934
9935         case (NTOP_BASE + 392):           /* DURATION_OUT */
9936         case ((VENDOR_NTOP << 16) | 392): /* DURATION_OUT */
9937             ti = proto_tree_add_item(pdutree, hf_pie_ntop_duration_out,
9938                                      tvb, offset, length, ENC_BIG_ENDIAN);
9939             break;
9940
9941         case (NTOP_BASE + 393):           /* SRC_PROC_PCTG_IOWAIT */
9942         case ((VENDOR_NTOP << 16) | 393): /* SRC_PROC_PCTG_IOWAIT */
9943             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_pctg_iowait,
9944                                      tvb, offset, length, ENC_BIG_ENDIAN);
9945             break;
9946
9947         case (NTOP_BASE + 394):           /* DST_PROC_PCTG_IOWAIT */
9948         case ((VENDOR_NTOP << 16) | 394): /* DST_PROC_PCTG_IOWAIT */
9949             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_pctg_iowait,
9950                                      tvb, offset, length, ENC_BIG_ENDIAN);
9951             break;
9952
9953         case (NTOP_BASE + 395):           /* RTP_DTMF_TONES */
9954         case ((VENDOR_NTOP << 16) | 395): /* RTP_DTMF_TONES */
9955             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_dtmf_tones,
9956                                      tvb, offset, length, ENC_ASCII);
9957             break;
9958
9959         case (NTOP_BASE + 396):           /* UNTUNNELED_IPV6_SRC_ADDR */
9960         case ((VENDOR_NTOP << 16) | 396): /* UNTUNNELED_IPV6_SRC_ADDR */
9961             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_ipv6_src_addr,
9962                                      tvb, offset, length, ENC_NA);
9963             break;
9964
9965         case (NTOP_BASE + 397):           /* UNTUNNELED_IPV6_DST_ADDR */
9966         case ((VENDOR_NTOP << 16) | 397): /* UNTUNNELED_IPV6_DST_ADDR */
9967             ti = proto_tree_add_item(pdutree, hf_pie_ntop_untunneled_ipv6_dst_addr,
9968                                      tvb, offset, length, ENC_NA);
9969             break;
9970
9971         case (NTOP_BASE + 398):           /* DNS_RESPONSE */
9972         case ((VENDOR_NTOP << 16) | 398): /* DNS_RESPONSE */
9973             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dns_response,
9974                                      tvb, offset, length, ENC_ASCII);
9975             break;
9976
9977         case (NTOP_BASE + 399):           /* DIAMETER_REQ_MSG_TYPE */
9978         case ((VENDOR_NTOP << 16) | 399): /* DIAMETER_REQ_MSG_TYPE */
9979             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_req_msg_type,
9980                                      tvb, offset, length, ENC_BIG_ENDIAN);
9981             break;
9982
9983         case (NTOP_BASE + 400):           /* DIAMETER_RSP_MSG_TYPE */
9984         case ((VENDOR_NTOP << 16) | 400): /* DIAMETER_RSP_MSG_TYPE */
9985             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_rsp_msg_type,
9986                                      tvb, offset, length, ENC_BIG_ENDIAN);
9987             break;
9988
9989         case (NTOP_BASE + 401):           /* DIAMETER_REQ_ORIGIN_HOST */
9990         case ((VENDOR_NTOP << 16) | 401): /* DIAMETER_REQ_ORIGIN_HOST */
9991             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_req_origin_host,
9992                                      tvb, offset, length, ENC_ASCII);
9993             break;
9994
9995         case (NTOP_BASE + 402):           /* DIAMETER_RSP_ORIGIN_HOST */
9996         case ((VENDOR_NTOP << 16) | 402): /* DIAMETER_RSP_ORIGIN_HOST */
9997             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_rsp_origin_host,
9998                                      tvb, offset, length, ENC_ASCII);
9999             break;
10000
10001         case (NTOP_BASE + 403):           /* DIAMETER_REQ_USER_NAME */
10002         case ((VENDOR_NTOP << 16) | 403): /* DIAMETER_REQ_USER_NAME */
10003             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_req_user_name,
10004                                      tvb, offset, length, ENC_ASCII);
10005             break;
10006
10007         case (NTOP_BASE + 404):           /* DIAMETER_RSP_RESULT_CODE */
10008         case ((VENDOR_NTOP << 16) | 404): /* DIAMETER_RSP_RESULT_CODE */
10009             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_rsp_result_code,
10010                                      tvb, offset, length, ENC_BIG_ENDIAN);
10011             break;
10012
10013         case (NTOP_BASE + 405):           /* DIAMETER_EXP_RES_VENDOR_ID */
10014         case ((VENDOR_NTOP << 16) | 405): /* DIAMETER_EXP_RES_VENDOR_ID */
10015             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_exp_res_vendor_id,
10016                                      tvb, offset, length, ENC_BIG_ENDIAN);
10017             break;
10018
10019         case (NTOP_BASE + 406):           /* DIAMETER_EXP_RES_RESULT_CODE */
10020         case ((VENDOR_NTOP << 16) | 406): /* DIAMETER_EXP_RES_RESULT_CODE */
10021             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_exp_res_result_code,
10022                                      tvb, offset, length, ENC_BIG_ENDIAN);
10023             break;
10024
10025         case (NTOP_BASE + 407):           /* S1AP_ENB_UE_S1AP_ID */
10026         case ((VENDOR_NTOP << 16) | 407): /* S1AP_ENB_UE_S1AP_ID */
10027             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_enb_ue_s1ap_id,
10028                                      tvb, offset, length, ENC_BIG_ENDIAN);
10029             break;
10030
10031         case (NTOP_BASE + 408):           /* S1AP_MME_UE_S1AP_ID */
10032         case ((VENDOR_NTOP << 16) | 408): /* S1AP_MME_UE_S1AP_ID */
10033             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_mme_ue_s1ap_id,
10034                                      tvb, offset, length, ENC_BIG_ENDIAN);
10035             break;
10036
10037         case (NTOP_BASE + 409):           /* S1AP_MSG_EMM_TYPE_MME_TO_ENB */
10038         case ((VENDOR_NTOP << 16) | 409): /* S1AP_MSG_EMM_TYPE_MME_TO_ENB */
10039             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_msg_emm_type_mme_to_enb,
10040                                      tvb, offset, length, ENC_BIG_ENDIAN);
10041             break;
10042
10043         case (NTOP_BASE + 410):           /* S1AP_MSG_ESM_TYPE_MME_TO_ENB */
10044         case ((VENDOR_NTOP << 16) | 410): /* S1AP_MSG_ESM_TYPE_MME_TO_ENB */
10045             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_msg_esm_type_mme_to_enb,
10046                                      tvb, offset, length, ENC_BIG_ENDIAN);
10047             break;
10048
10049         case (NTOP_BASE + 411):           /* S1AP_MSG_EMM_TYPE_ENB_TO_MME */
10050         case ((VENDOR_NTOP << 16) | 411): /* S1AP_MSG_EMM_TYPE_ENB_TO_MME */
10051             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_msg_emm_type_enb_to_mme,
10052                                      tvb, offset, length, ENC_BIG_ENDIAN);
10053             break;
10054
10055         case (NTOP_BASE + 412):           /* S1AP_MSG_ESM_TYPE_ENB_TO_MME */
10056         case ((VENDOR_NTOP << 16) | 412): /* S1AP_MSG_ESM_TYPE_ENB_TO_MME */
10057             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_msg_esm_type_enb_to_mme,
10058                                      tvb, offset, length, ENC_BIG_ENDIAN);
10059             break;
10060
10061         case (NTOP_BASE + 413):           /* S1AP_CAUSE_ENB_TO_MME */
10062         case ((VENDOR_NTOP << 16) | 413): /* S1AP_CAUSE_ENB_TO_MME */
10063             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_cause_enb_to_mme,
10064                                      tvb, offset, length, ENC_BIG_ENDIAN);
10065             break;
10066
10067         case (NTOP_BASE + 414):           /* S1AP_DETAILED_CAUSE_ENB_TO_MME */
10068         case ((VENDOR_NTOP << 16) | 414): /* S1AP_DETAILED_CAUSE_ENB_TO_MME */
10069             ti = proto_tree_add_item(pdutree, hf_pie_ntop_s1ap_detailed_cause_enb_to_mme,
10070                                      tvb, offset, length, ENC_BIG_ENDIAN);
10071             break;
10072
10073         case (NTOP_BASE + 415):           /* TCP_WIN_MIN_IN */
10074         case ((VENDOR_NTOP << 16) | 415): /* TCP_WIN_MIN_IN */
10075             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_min_in,
10076                                      tvb, offset, length, ENC_BIG_ENDIAN);
10077             break;
10078
10079         case (NTOP_BASE + 416):           /* TCP_WIN_MAX_IN */
10080         case ((VENDOR_NTOP << 16) | 416): /* TCP_WIN_MAX_IN */
10081             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_max_in,
10082                                      tvb, offset, length, ENC_BIG_ENDIAN);
10083             break;
10084
10085         case (NTOP_BASE + 417):           /* TCP_WIN_MSS_IN */
10086         case ((VENDOR_NTOP << 16) | 417): /* TCP_WIN_MSS_IN */
10087             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_mss_in,
10088                                      tvb, offset, length, ENC_BIG_ENDIAN);
10089             break;
10090
10091         case (NTOP_BASE + 418):           /* TCP_WIN_SCALE_IN */
10092         case ((VENDOR_NTOP << 16) | 418): /* TCP_WIN_SCALE_IN */
10093             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_scale_in,
10094                                      tvb, offset, length, ENC_BIG_ENDIAN);
10095             break;
10096
10097         case (NTOP_BASE + 419):           /* TCP_WIN_MIN_OUT */
10098         case ((VENDOR_NTOP << 16) | 419): /* TCP_WIN_MIN_OUT */
10099             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_min_out,
10100                                      tvb, offset, length, ENC_BIG_ENDIAN);
10101             break;
10102
10103         case (NTOP_BASE + 420):           /* TCP_WIN_MAX_OUT */
10104         case ((VENDOR_NTOP << 16) | 420): /* TCP_WIN_MAX_OUT */
10105             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_max_out,
10106                                      tvb, offset, length, ENC_BIG_ENDIAN);
10107             break;
10108
10109         case (NTOP_BASE + 421):           /* TCP_WIN_MSS_OUT */
10110         case ((VENDOR_NTOP << 16) | 421): /* TCP_WIN_MSS_OUT */
10111             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_mss_out,
10112                                      tvb, offset, length, ENC_BIG_ENDIAN);
10113             break;
10114
10115         case (NTOP_BASE + 422):           /* TCP_WIN_SCALE_OUT */
10116         case ((VENDOR_NTOP << 16) | 422): /* TCP_WIN_SCALE_OUT */
10117             ti = proto_tree_add_item(pdutree, hf_pie_ntop_tcp_win_scale_out,
10118                                      tvb, offset, length, ENC_BIG_ENDIAN);
10119             break;
10120
10121         case (NTOP_BASE + 423):           /* DHCP_REMOTE_ID */
10122         case ((VENDOR_NTOP << 16) | 423): /* DHCP_REMOTE_ID */
10123             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dhcp_remote_id,
10124                                      tvb, offset, length, ENC_ASCII);
10125             break;
10126
10127         case (NTOP_BASE + 424):           /* DHCP_SUBSCRIBER_ID */
10128         case ((VENDOR_NTOP << 16) | 424): /* DHCP_SUBSCRIBER_ID */
10129             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dhcp_subscriber_id,
10130                                      tvb, offset, length, ENC_ASCII);
10131             break;
10132
10133         case (NTOP_BASE + 425):           /* SRC_PROC_UID */
10134         case ((VENDOR_NTOP << 16) | 425): /* SRC_PROC_UID */
10135             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_proc_uid,
10136                                      tvb, offset, length, ENC_BIG_ENDIAN);
10137             break;
10138
10139         case (NTOP_BASE + 426):           /* DST_PROC_UID */
10140         case ((VENDOR_NTOP << 16) | 426): /* DST_PROC_UID */
10141             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_proc_uid,
10142                                      tvb, offset, length, ENC_BIG_ENDIAN);
10143             break;
10144
10145         case (NTOP_BASE + 427):           /* APPLICATION_NAME */
10146         case ((VENDOR_NTOP << 16) | 427): /* APPLICATION_NAME */
10147             ti = proto_tree_add_item(pdutree, hf_pie_ntop_application_name,
10148                                      tvb, offset, length, ENC_ASCII);
10149             break;
10150
10151         case (NTOP_BASE + 428):           /* USER_NAME */
10152         case ((VENDOR_NTOP << 16) | 428): /* USER_NAME */
10153             ti = proto_tree_add_item(pdutree, hf_pie_ntop_user_name,
10154                                      tvb, offset, length, ENC_ASCII);
10155             break;
10156
10157         case (NTOP_BASE + 429):           /* DHCP_MESSAGE_TYPE */
10158         case ((VENDOR_NTOP << 16) | 429): /* DHCP_MESSAGE_TYPE */
10159             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dhcp_message_type,
10160                                      tvb, offset, length, ENC_ASCII);
10161             break;
10162
10163         case (NTOP_BASE + 430):           /* RTP_IN_PKT_DROP */
10164         case ((VENDOR_NTOP << 16) | 430): /* RTP_IN_PKT_DROP */
10165             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_in_pkt_drop,
10166                                      tvb, offset, length, ENC_BIG_ENDIAN);
10167             break;
10168
10169         case (NTOP_BASE + 431):           /* RTP_OUT_PKT_DROP */
10170         case ((VENDOR_NTOP << 16) | 431): /* RTP_OUT_PKT_DROP */
10171             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_pkt_drop,
10172                                      tvb, offset, length, ENC_BIG_ENDIAN);
10173             break;
10174
10175         case (NTOP_BASE + 432):           /* RTP_OUT_MOS */
10176         case ((VENDOR_NTOP << 16) | 432): /* RTP_OUT_MOS */
10177             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_mos,
10178                                      tvb, offset, length, ENC_BIG_ENDIAN);
10179             break;
10180
10181         case (NTOP_BASE + 433):           /* RTP_OUT_R_FACTOR */
10182         case ((VENDOR_NTOP << 16) | 433): /* RTP_OUT_R_FACTOR */
10183             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_out_r_factor,
10184                                      tvb, offset, length, ENC_BIG_ENDIAN);
10185             break;
10186
10187         case (NTOP_BASE + 434):           /* RTP_MOS */
10188         case ((VENDOR_NTOP << 16) | 434): /* RTP_MOS */
10189             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_mos,
10190                                      tvb, offset, length, ENC_BIG_ENDIAN);
10191             break;
10192
10193         case (NTOP_BASE + 435):           /* GTPV2_S5_S8_GTPC_TEID */
10194         case ((VENDOR_NTOP << 16) | 435): /* GTPV2_S5_S8_GTPC_TEID */
10195             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gptv2_s5_s8_gtpc_teid,
10196                                      tvb, offset, length, ENC_ASCII);
10197             break;
10198
10199         case (NTOP_BASE + 436):           /* RTP_R_FACTOR */
10200         case ((VENDOR_NTOP << 16) | 436): /* RTP_R_FACTOR */
10201             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_r_factor,
10202                                      tvb, offset, length, ENC_BIG_ENDIAN);
10203             break;
10204
10205         case (NTOP_BASE + 437):           /* RTP_SSRC */
10206         case ((VENDOR_NTOP << 16) | 437): /* RTP_SSRC */
10207             ti = proto_tree_add_item(pdutree, hf_pie_ntop_rtp_ssrc,
10208                                      tvb, offset, length, ENC_BIG_ENDIAN);
10209             break;
10210
10211         case (NTOP_BASE + 438):           /* PAYLOAD_HASH */
10212         case ((VENDOR_NTOP << 16) | 438): /* PAYLOAD_HASH */
10213             ti = proto_tree_add_item(pdutree, hf_pie_ntop_payload_hash,
10214                                      tvb, offset, length, ENC_BIG_ENDIAN);
10215             break;
10216
10217         case (NTOP_BASE + 439):           /* GTPV2_C2S_S5_S8_GTPU_TEID */
10218         case ((VENDOR_NTOP << 16) | 439): /* GTPV2_C2S_S5_S8_GTPU_TEID */
10219             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s5_s8_gtpu_teid,
10220                                      tvb, offset, length, ENC_BIG_ENDIAN);
10221             break;
10222
10223         case (NTOP_BASE + 440):           /* GTPV2_S2C_S5_S8_GTPU_TEID */
10224         case ((VENDOR_NTOP << 16) | 440): /* GTPV2_S2C_S5_S8_GTPU_TEID */
10225             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s5_s8_gtpu_teid,
10226                                      tvb, offset, length, ENC_BIG_ENDIAN);
10227             break;
10228
10229         case (NTOP_BASE + 441):           /* GTPV2_C2S_S5_S8_GTPU_IP */
10230         case ((VENDOR_NTOP << 16) | 441): /* GTPV2_C2S_S5_S8_GTPU_IP */
10231             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s5_s8_gtpu_ip,
10232                                      tvb, offset, length, ENC_BIG_ENDIAN);
10233             break;
10234
10235         case (NTOP_BASE + 442):           /* GTPV2_S2C_S5_S8_GTPU_IP */
10236         case ((VENDOR_NTOP << 16) | 442): /* GTPV2_S2C_S5_S8_GTPU_IP */
10237             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s5_s8_gtpu_ip,
10238                                      tvb, offset, length, ENC_BIG_ENDIAN);
10239             break;
10240
10241         case (NTOP_BASE + 443):           /* SRC_AS_MAP */
10242         case ((VENDOR_NTOP << 16) | 443): /* SRC_AS_MAP */
10243             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_as_map,
10244                                      tvb, offset, length, ENC_ASCII);
10245             break;
10246
10247         case (NTOP_BASE + 444):           /* DST_AS_MAP */
10248         case ((VENDOR_NTOP << 16) | 444): /* DST_AS_MAP */
10249             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_as_map,
10250                                      tvb, offset, length, ENC_ASCII);
10251             break;
10252
10253         case (NTOP_BASE + 445):           /* DIAMETER_HOP_BY_HOP_ID */
10254         case ((VENDOR_NTOP << 16) | 445): /* DIAMETER_HOP_BY_HOP_ID */
10255             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_hop_by_hop_id,
10256                                      tvb, offset, length, ENC_BIG_ENDIAN);
10257             break;
10258
10259         case (NTOP_BASE + 446):           /* UPSTREAM_SESSION_ID */
10260         case ((VENDOR_NTOP << 16) | 446): /* UPSTREAM_SESSION_ID */
10261             ti = proto_tree_add_item(pdutree, hf_pie_ntop_upstream_session_id,
10262                                      tvb, offset, length, ENC_BIG_ENDIAN);
10263             break;
10264
10265         case (NTOP_BASE + 447):           /* DOWNSTREAM_SESSION_ID */
10266         case ((VENDOR_NTOP << 16) | 447): /* DOWNSTREAM_SESSION_ID */
10267             ti = proto_tree_add_item(pdutree, hf_pie_ntop_downstream_session_id,
10268                                      tvb, offset, length, ENC_BIG_ENDIAN);
10269             break;
10270
10271         case (NTOP_BASE + 448):           /* SRC_IP_LONG */
10272         case ((VENDOR_NTOP << 16) | 448): /* SRC_IP_LONG */
10273             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_ip_long,
10274                                      tvb, offset, length, ENC_ASCII);
10275             break;
10276
10277         case (NTOP_BASE + 449):           /* SRC_IP_LAT */
10278         case ((VENDOR_NTOP << 16) | 449): /* SRC_IP_LAT */
10279             ti = proto_tree_add_item(pdutree, hf_pie_ntop_src_ip_lat,
10280                                      tvb, offset, length, ENC_ASCII);
10281             break;
10282
10283         case (NTOP_BASE + 450):           /* DST_IP_LONG */
10284         case ((VENDOR_NTOP << 16) | 450): /* DST_IP_LONG */
10285             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_ip_long,
10286                                      tvb, offset, length, ENC_ASCII);
10287             break;
10288
10289         case (NTOP_BASE + 451):           /* DST_IP_LAT */
10290         case ((VENDOR_NTOP << 16) | 451): /* DST_IP_LAT */
10291             ti = proto_tree_add_item(pdutree, hf_pie_ntop_dst_ip_lat,
10292                                      tvb, offset, length, ENC_ASCII);
10293             break;
10294
10295         case (NTOP_BASE + 452):           /* DIAMETER_CLR_CANCEL_TYPE */
10296         case ((VENDOR_NTOP << 16) | 452): /* DIAMETER_CLR_CANCEL_TYPE */
10297             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_clr_cancel_type,
10298                                      tvb, offset, length, ENC_BIG_ENDIAN);
10299             break;
10300
10301         case (NTOP_BASE + 453):           /* DIAMETER_CLR_FLAGS */
10302         case ((VENDOR_NTOP << 16) | 453): /* DIAMETER_CLR_FLAGS */
10303             ti = proto_tree_add_item(pdutree, hf_pie_ntop_diameter_clr_flags,
10304                                      tvb, offset, length, ENC_BIG_ENDIAN);
10305             break;
10306
10307         case (NTOP_BASE + 454):           /* GTPV2_C2S_S5_S8_GTPC_IP */
10308         case ((VENDOR_NTOP << 16) | 454): /* GTPV2_C2S_S5_S8_GTPC_IP */
10309             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s5_s8_gtpc_ip,
10310                                      tvb, offset, length, ENC_BIG_ENDIAN);
10311             break;
10312
10313         case (NTOP_BASE + 455):           /* GTPV2_S2C_S5_S8_GTPC_IP */
10314         case ((VENDOR_NTOP << 16) | 455): /* GTPV2_S2C_S5_S8_GTPC_IP */
10315             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s5_s8_gtpc_ip,
10316                                      tvb, offset, length, ENC_BIG_ENDIAN);
10317             break;
10318
10319         case (NTOP_BASE + 456):           /* GTPV2_C2S_S5_S8_SGW_GTPU_TEID */
10320         case ((VENDOR_NTOP << 16) | 456): /* GTPV2_C2S_S5_S8_SGW_GTPU_TEID */
10321             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid,
10322                                      tvb, offset, length, ENC_BIG_ENDIAN);
10323             break;
10324
10325         case (NTOP_BASE + 457):           /* GTPV2_S2C_S5_S8_SGW_GTPU_TEID */
10326         case ((VENDOR_NTOP << 16) | 457): /* GTPV2_S2C_S5_S8_SGW_GTPU_TEID */
10327             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid,
10328                                      tvb, offset, length, ENC_BIG_ENDIAN);
10329             break;
10330
10331         case (NTOP_BASE + 458):           /* GTPV2_C2S_S5_S8_SGW_GTPU_IP */
10332         case ((VENDOR_NTOP << 16) | 458): /* GTPV2_C2S_S5_S8_SGW_GTPU_IP */
10333             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip,
10334                                      tvb, offset, length, ENC_BIG_ENDIAN);
10335             break;
10336
10337         case (NTOP_BASE + 459):           /* GTPV2_S2C_S5_S8_SGW_GTPU_IP */
10338         case ((VENDOR_NTOP << 16) | 459): /* GTPV2_S2C_S5_S8_SGW_GTPU_IP */
10339             ti = proto_tree_add_item(pdutree, hf_pie_ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip,
10340                                      tvb, offset, length, ENC_BIG_ENDIAN);
10341             break;
10342
10343         case (NTOP_BASE + 460):           /* HTTP_X_FORWARDED_FOR */
10344         case ((VENDOR_NTOP << 16) | 460): /* HTTP_X_FORWARDED_FOR */
10345             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_x_forwarded_for,
10346                                      tvb, offset, length, ENC_ASCII);
10347             break;
10348
10349         case (NTOP_BASE + 461):           /* HTTP_VIA */
10350         case ((VENDOR_NTOP << 16) | 461): /* HTTP_VIA */
10351             ti = proto_tree_add_item(pdutree, hf_pie_ntop_http_via,
10352                                      tvb, offset, length, ENC_ASCII);
10353             break;
10354
10355         case (NTOP_BASE + 462):           /* SSDP_HOST */
10356         case ((VENDOR_NTOP << 16) | 462): /* SSDP_HOST */
10357             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ssdp_host,
10358                                      tvb, offset, length, ENC_ASCII);
10359             break;
10360
10361         case (NTOP_BASE + 463):           /* SSDP_USN */
10362         case ((VENDOR_NTOP << 16) | 463): /* SSDP_USN */
10363             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ssdp_usn,
10364                                      tvb, offset, length, ENC_ASCII);
10365             break;
10366
10367         case (NTOP_BASE + 464):           /* NETBIOS_QUERY_NAME */
10368         case ((VENDOR_NTOP << 16) | 464): /* NETBIOS_QUERY_NAME */
10369             ti = proto_tree_add_item(pdutree, hf_pie_ntop_netbios_query_name,
10370                                      tvb, offset, length, ENC_ASCII);
10371             break;
10372
10373         case (NTOP_BASE + 465):           /* NETBIOS_QUERY_TYPE */
10374         case ((VENDOR_NTOP << 16) | 465): /* NETBIOS_QUERY_TYPE */
10375             ti = proto_tree_add_item(pdutree, hf_pie_ntop_netbios_query_type,
10376                                      tvb, offset, length, ENC_ASCII);
10377             break;
10378
10379         case (NTOP_BASE + 466):           /* NETBIOS_RESPONSE */
10380         case ((VENDOR_NTOP << 16) | 466): /* NETBIOS_RESPONSE */
10381             ti = proto_tree_add_item(pdutree, hf_pie_ntop_netbios_response,
10382                                      tvb, offset, length, ENC_ASCII);
10383             break;
10384
10385         case (NTOP_BASE + 467):           /* NETBIOS_QUERY_OS */
10386         case ((VENDOR_NTOP << 16) | 467): /* NETBIOS_QUERY_OS */
10387             ti = proto_tree_add_item(pdutree, hf_pie_ntop_netbios_query_os,
10388                                      tvb, offset, length, ENC_ASCII);
10389             break;
10390
10391         case (NTOP_BASE + 468):           /* SSDP_SERVER */
10392         case ((VENDOR_NTOP << 16) | 468): /* SSDP_SERVER */
10393             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ssdp_server,
10394                                      tvb, offset, length, ENC_ASCII);
10395             break;
10396
10397         case (NTOP_BASE + 469):           /* SSDP_TYPE */
10398         case ((VENDOR_NTOP << 16) | 469): /* SSDP_TYPE */
10399             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ssdp_type,
10400                                      tvb, offset, length, ENC_ASCII);
10401             break;
10402
10403         case (NTOP_BASE + 470):           /* SSDP_METHOD */
10404         case ((VENDOR_NTOP << 16) | 470): /* SSDP_METHOD */
10405             ti = proto_tree_add_item(pdutree, hf_pie_ntop_ssdp_method,
10406                                      tvb, offset, length, ENC_ASCII);
10407             break;
10408
10409         case (NTOP_BASE + 471):           /* NPROBE_IPV4_ADDRESS */
10410         case ((VENDOR_NTOP << 16) | 471): /* NPROBE_IPV4_ADDRESS */
10411             ti = proto_tree_add_item(pdutree, hf_pie_ntop_nprobe_ipv4_address,
10412                                      tvb, offset, length, ENC_BIG_ENDIAN);
10413             break;
10414             /* END NTOP */
10415
10416             /* START Plixer International */
10417         case ((VENDOR_PLIXER << 16) | 100):    /* client_ip_v4 */
10418             ti = proto_tree_add_item(pdutree, hf_pie_plixer_client_ip_v4,
10419                                      tvb, offset, length, ENC_BIG_ENDIAN);
10420             break;
10421         case ((VENDOR_PLIXER << 16) | 101):    /* client_hostname */
10422             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10423             ti = proto_tree_add_string(pdutree, hf_pie_plixer_client_hostname,
10424                                        tvb, offset, length, gen_str);
10425             break;
10426         case ((VENDOR_PLIXER << 16) | 102):    /* partner_name */
10427             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10428             ti = proto_tree_add_string(pdutree, hf_pie_plixer_partner_name,
10429                                        tvb, offset, length, gen_str);
10430             break;
10431         case ((VENDOR_PLIXER << 16) | 103):    /* server_hostname */
10432             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10433             ti = proto_tree_add_string(pdutree, hf_pie_plixer_server_hostname,
10434                                        tvb, offset, length, gen_str);
10435             break;
10436         case ((VENDOR_PLIXER << 16) | 104):    /* server_ip_v4 */
10437             ti = proto_tree_add_item(pdutree, hf_pie_plixer_server_ip_v4,
10438                                      tvb, offset, length, ENC_BIG_ENDIAN);
10439             break;
10440         case ((VENDOR_PLIXER << 16) | 105):    /* recipient_address */
10441             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10442             ti = proto_tree_add_string(pdutree, hf_pie_plixer_recipient_address,
10443                                        tvb, offset, length, gen_str);
10444             break;
10445         case ((VENDOR_PLIXER << 16) | 106):    /* event_id */
10446             ti = proto_tree_add_item(pdutree, hf_pie_plixer_event_id,
10447                                      tvb, offset, length, ENC_BIG_ENDIAN);
10448             break;
10449         case ((VENDOR_PLIXER << 16) | 107):    /* msgid */
10450             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10451             ti = proto_tree_add_string(pdutree, hf_pie_plixer_msgid,
10452                                        tvb, offset, length, gen_str);
10453             break;
10454         case ((VENDOR_PLIXER << 16) | 108):    /* priority */
10455             ti = proto_tree_add_item(pdutree, hf_pie_plixer_priority,
10456                                      tvb, offset, length, ENC_BIG_ENDIAN);
10457             break;
10458         case ((VENDOR_PLIXER << 16) | 109):    /* recipient_report_status */
10459             ti = proto_tree_add_item(pdutree, hf_pie_plixer_recipient_report_status,
10460                                      tvb, offset, length, ENC_BIG_ENDIAN);
10461             break;
10462         case ((VENDOR_PLIXER << 16) | 110):    /* number_recipients */
10463             ti = proto_tree_add_item(pdutree, hf_pie_plixer_number_recipients,
10464                                      tvb, offset, length, ENC_BIG_ENDIAN);
10465             break;
10466         case ((VENDOR_PLIXER << 16) | 111):    /* origination_time */
10467             /* XXX - what format is this? */
10468             ti = proto_tree_add_item(pdutree, hf_pie_plixer_origination_time,
10469                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
10470             break;
10471         case ((VENDOR_PLIXER << 16) | 112):    /* encryption */
10472             ti = proto_tree_add_item(pdutree, hf_pie_plixer_encryption,
10473                                      tvb, offset, length, ENC_BIG_ENDIAN);
10474             break;
10475         case ((VENDOR_PLIXER << 16) | 113):    /* service_version */
10476             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10477             ti = proto_tree_add_string(pdutree, hf_pie_plixer_service_version,
10478                                        tvb, offset, length, gen_str);
10479             break;
10480         case ((VENDOR_PLIXER << 16) | 114):    /* linked_msgid */
10481             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10482             ti = proto_tree_add_string(pdutree, hf_pie_plixer_linked_msgid,
10483                                        tvb, offset, length, gen_str);
10484             break;
10485         case ((VENDOR_PLIXER << 16) | 115):    /* message_subject */
10486             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10487             ti = proto_tree_add_string(pdutree, hf_pie_plixer_message_subject,
10488                                        tvb, offset, length, gen_str);
10489             break;
10490         case ((VENDOR_PLIXER << 16) | 116):    /* sender_address */
10491             gen_str = tvb_format_text(pinfo->pool, tvb, offset, length);
10492             ti = proto_tree_add_string(pdutree, hf_pie_plixer_sender_address,
10493                                        tvb, offset, length, gen_str);
10494             break;
10495         case ((VENDOR_PLIXER << 16) | 117):    /* date_time */
10496             /* XXX - what format is this? */
10497             ti = proto_tree_add_item(pdutree, hf_pie_plixer_date_time,
10498                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
10499             break;
10500             /* END Plixer International */
10501
10502             /* START Ixia Communications */
10503         case ((VENDOR_IXIA << 16) | 110):
10504             ti = proto_tree_add_item(pdutree, hf_pie_ixia_l7_application_id,
10505                                      tvb, offset, length, ENC_BIG_ENDIAN);
10506             break;
10507         case ((VENDOR_IXIA << 16) | 111):
10508             {
10509             const uint8_t *string;
10510             ti = proto_tree_add_item_ret_string(pdutree, hf_pie_ixia_l7_application_name,
10511                                      tvb, offset, length, ENC_ASCII|ENC_NA, pinfo->pool, &string);
10512             proto_item_append_text(pdutree, " (%s)", string);
10513             }
10514
10515             break;
10516
10517         case ((VENDOR_IXIA << 16) | 120):
10518             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_country_code,
10519                                      tvb, offset, length, ENC_ASCII);
10520             break;
10521         case ((VENDOR_IXIA << 16) | 121):
10522             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_country_name,
10523                                      tvb, offset, length, ENC_ASCII);
10524             break;
10525         case ((VENDOR_IXIA << 16) | 122):
10526             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_region_code,
10527                                      tvb, offset, length, ENC_ASCII);
10528             break;
10529         case ((VENDOR_IXIA << 16) | 123):
10530             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_region_name,
10531                                      tvb, offset, length, ENC_ASCII);
10532             break;
10533         case ((VENDOR_IXIA << 16) | 125):
10534             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_city_name,
10535                                      tvb, offset, length, ENC_ASCII);
10536             break;
10537         case ((VENDOR_IXIA << 16) | 126):
10538             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_latitude,
10539                                      tvb, offset, length, ENC_BIG_ENDIAN);
10540             break;
10541         case ((VENDOR_IXIA << 16) | 127):
10542             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_ip_longitude,
10543                                      tvb, offset, length, ENC_BIG_ENDIAN);
10544             break;
10545
10546         case ((VENDOR_IXIA << 16) | 140):
10547             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_country_code,
10548                                      tvb, offset, length, ENC_ASCII);
10549             break;
10550         case ((VENDOR_IXIA << 16) | 141):
10551             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_country_name,
10552                                      tvb, offset, length, ENC_ASCII);
10553             break;
10554         case ((VENDOR_IXIA << 16) | 142):
10555             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_region_code,
10556                                      tvb, offset, length, ENC_ASCII);
10557             break;
10558         case ((VENDOR_IXIA << 16) | 143):
10559             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_region_name,
10560                                      tvb, offset, length, ENC_ASCII);
10561             break;
10562         case ((VENDOR_IXIA << 16) | 145):
10563             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_city_name,
10564                                      tvb, offset, length, ENC_ASCII);
10565             break;
10566         case ((VENDOR_IXIA << 16) | 146):
10567             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_latitude,
10568                                      tvb, offset, length, ENC_BIG_ENDIAN);
10569             break;
10570         case ((VENDOR_IXIA << 16) | 147):
10571             ti = proto_tree_add_item(pdutree, hf_pie_ixia_destination_ip_longitude,
10572                                      tvb, offset, length, ENC_BIG_ENDIAN);
10573             break;
10574         case ((VENDOR_IXIA << 16) | 160):
10575             ti = proto_tree_add_item(pdutree, hf_pie_ixia_os_device_id,
10576                                      tvb, offset, length, ENC_BIG_ENDIAN);
10577             break;
10578         case ((VENDOR_IXIA << 16) | 161):
10579             ti = proto_tree_add_item(pdutree, hf_pie_ixia_os_device_name,
10580                                      tvb, offset, length, ENC_ASCII);
10581             break;
10582         case ((VENDOR_IXIA << 16) | 162):
10583             ti = proto_tree_add_item(pdutree, hf_pie_ixia_browser_id,
10584                                      tvb, offset, length, ENC_BIG_ENDIAN);
10585             break;
10586         case ((VENDOR_IXIA << 16) | 163):
10587             ti = proto_tree_add_item(pdutree, hf_pie_ixia_browser_name,
10588                                      tvb, offset, length, ENC_ASCII);
10589             break;
10590         case ((VENDOR_IXIA << 16) | 176):
10591             ti = proto_tree_add_item(pdutree, hf_pie_ixia_reverse_octet_delta_count,
10592                                      tvb, offset, length, ENC_BIG_ENDIAN);
10593             break;
10594         case ((VENDOR_IXIA << 16) | 177):
10595             ti = proto_tree_add_item(pdutree, hf_pie_ixia_reverse_packet_delta_count,
10596                                      tvb, offset, length, ENC_BIG_ENDIAN);
10597             break;
10598         case ((VENDOR_IXIA << 16) | 178):
10599             ti = proto_tree_add_item(pdutree, hf_pie_ixia_conn_encryption_type,
10600                                      tvb, offset, length, ENC_ASCII);
10601             break;
10602         case ((VENDOR_IXIA << 16) | 179):
10603             ti = proto_tree_add_item(pdutree, hf_pie_ixia_encryption_cipher,
10604                                      tvb, offset, length, ENC_ASCII);
10605             break;
10606         case ((VENDOR_IXIA << 16) | 180):
10607             ti = proto_tree_add_item(pdutree, hf_pie_ixia_encryption_keylen,
10608                                      tvb, offset, length, ENC_BIG_ENDIAN);
10609             break;
10610         case ((VENDOR_IXIA << 16) | 181):
10611             ti = proto_tree_add_item(pdutree, hf_pie_ixia_imsi,
10612                                      tvb, offset, length, ENC_ASCII);
10613             break;
10614         case ((VENDOR_IXIA << 16) | 182):
10615             ti = proto_tree_add_item(pdutree, hf_pie_ixia_user_agent,
10616                                      tvb, offset, length, ENC_ASCII);
10617             break;
10618         case ((VENDOR_IXIA << 16) | 183):
10619             ti = proto_tree_add_item(pdutree, hf_pie_ixia_host_name,
10620                                      tvb, offset, length, ENC_ASCII);
10621             break;
10622         case ((VENDOR_IXIA << 16) | 184):
10623             ti = proto_tree_add_item(pdutree, hf_pie_ixia_uri,
10624                                      tvb, offset, length, ENC_ASCII);
10625             break;
10626         case ((VENDOR_IXIA << 16) | 185):
10627             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_txt,
10628                                      tvb, offset, length, ENC_ASCII);
10629             break;
10630         case ((VENDOR_IXIA << 16) | 186):
10631             ti = proto_tree_add_item(pdutree, hf_pie_ixia_source_as_name,
10632                                      tvb, offset, length, ENC_ASCII);
10633             break;
10634         case ((VENDOR_IXIA << 16) | 187):
10635             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dest_as_name,
10636                                      tvb, offset, length, ENC_ASCII);
10637             break;
10638         case ((VENDOR_IXIA << 16) | 188):
10639             ti = proto_tree_add_item(pdutree, hf_pie_ixia_transaction_latency,
10640                                      tvb, offset, length, ENC_BIG_ENDIAN);
10641             break;
10642         case ((VENDOR_IXIA << 16) | 189):
10643             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_query_names,
10644                                      tvb, offset, length, ENC_ASCII);
10645             break;
10646         case ((VENDOR_IXIA << 16) | 190):
10647             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_answer_names,
10648                                      tvb, offset, length, ENC_ASCII);
10649             break;
10650         case ((VENDOR_IXIA << 16) | 191):
10651             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_classes,
10652                                      tvb, offset, length, ENC_ASCII);
10653             break;
10654         case ((VENDOR_IXIA << 16) | 192):
10655             ti = proto_tree_add_item(pdutree, hf_pie_ixia_threat_type,
10656                                      tvb, offset, length, ENC_ASCII);
10657             break;
10658         case ((VENDOR_IXIA << 16) | 193):
10659             ti = proto_tree_add_item(pdutree, hf_pie_ixia_threat_ipv4,
10660                                      tvb, offset, length, ENC_BIG_ENDIAN);
10661             break;
10662         case ((VENDOR_IXIA << 16) | 194):
10663             ti = proto_tree_add_item(pdutree, hf_pie_ixia_threat_ipv6,
10664                                      tvb, offset, length, ENC_NA);
10665             break;
10666         case ((VENDOR_IXIA << 16) | 195):
10667             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_session,
10668                                      tvb, offset, length, ENC_NA);
10669             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10670             break;
10671         case ((VENDOR_IXIA << 16) | 196):
10672             ti = proto_tree_add_item(pdutree, hf_pie_ixia_request_time,
10673                                      tvb, offset, length, ENC_TIME_SECS);
10674             break;
10675         case ((VENDOR_IXIA << 16) | 197):
10676             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_records,
10677                                      tvb, offset, length, ENC_NA);
10678             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10679             break;
10680         case ((VENDOR_IXIA << 16) | 198):
10681             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_name,
10682                                      tvb, offset, length, ENC_ASCII);
10683             break;
10684         case ((VENDOR_IXIA << 16) | 199):
10685             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_ipv4,
10686                                      tvb, offset, length, ENC_BIG_ENDIAN);
10687             break;
10688         case ((VENDOR_IXIA << 16) | 200):
10689             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_ipv6,
10690                                      tvb, offset, length, ENC_NA);
10691             break;
10692         case ((VENDOR_IXIA << 16) | 201):
10693             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_sni,
10694                                      tvb, offset, length, ENC_ASCII);
10695             break;
10696         case ((VENDOR_IXIA << 16) | 202):
10697             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_client_id,
10698                                      tvb, offset, length, ENC_NA);
10699             break;
10700         case ((VENDOR_IXIA << 16) | 203):
10701             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_client_mac,
10702                                      tvb, offset, length, ENC_NA);
10703             break;
10704         case ((VENDOR_IXIA << 16) | 204):
10705             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_messages,
10706                                      tvb, offset, length, ENC_NA);
10707             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10708             break;
10709         case ((VENDOR_IXIA << 16) | 205):
10710             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_message_timestamp,
10711                                      tvb, offset, length, ENC_TIME_SECS_NSECS);
10712             break;
10713         case ((VENDOR_IXIA << 16) | 206):
10714             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_message_type,
10715                                      tvb, offset, length, ENC_BIG_ENDIAN);
10716             break;
10717         case ((VENDOR_IXIA << 16) | 207):
10718             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_lease_duration,
10719                                      tvb, offset, length, ENC_TIME_SECS);
10720             break;
10721         case ((VENDOR_IXIA << 16) | 208):
10722             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_servername,
10723                                      tvb, offset, length, ENC_ASCII);
10724             break;
10725         case ((VENDOR_IXIA << 16) | 209):
10726             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_events,
10727                                      tvb, offset, length, ENC_NA);
10728             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10729             break;
10730         case ((VENDOR_IXIA << 16) | 210):
10731             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_timestamp,
10732                                      tvb, offset, length, ENC_TIME_SECS_NSECS);
10733             break;
10734         case ((VENDOR_IXIA << 16) | 211):
10735             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_event_timestamp,
10736                                      tvb, offset, length, ENC_TIME_SECS_NSECS);
10737             break;
10738         case ((VENDOR_IXIA << 16) | 212):
10739             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_username,
10740                                      tvb, offset, length, ENC_ASCII);
10741             break;
10742         case ((VENDOR_IXIA << 16) | 213):
10743             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_nas_ipv4,
10744                                      tvb, offset, length, ENC_BIG_ENDIAN);
10745             break;
10746         case ((VENDOR_IXIA << 16) | 214):
10747             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_service_type,
10748                                      tvb, offset, length, ENC_BIG_ENDIAN);
10749             break;
10750         case ((VENDOR_IXIA << 16) | 215):
10751             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_framed_protocol,
10752                                      tvb, offset, length, ENC_BIG_ENDIAN);
10753             break;
10754         case ((VENDOR_IXIA << 16) | 216):
10755             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_filter_id,
10756                                      tvb, offset, length, ENC_NA|ENC_ASCII);
10757             break;
10758         case ((VENDOR_IXIA << 16) | 217):
10759             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_reply_message,
10760                                      tvb, offset, length, ENC_NA|ENC_ASCII);
10761             break;
10762         case ((VENDOR_IXIA << 16) | 218):
10763             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_called_station_id,
10764                                      tvb, offset, length, ENC_NA|ENC_ASCII);
10765             break;
10766         case ((VENDOR_IXIA << 16) | 219):
10767             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_connection,
10768                                      tvb, offset, length, ENC_ASCII);
10769             break;
10770         case ((VENDOR_IXIA << 16) | 220):
10771             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_accept,
10772                                      tvb, offset, length, ENC_ASCII);
10773             break;
10774         case ((VENDOR_IXIA << 16) | 221):
10775             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_accept_language,
10776                                      tvb, offset, length, ENC_ASCII);
10777             break;
10778         case ((VENDOR_IXIA << 16) | 222):
10779             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_accept_encoding,
10780                                      tvb, offset, length, ENC_ASCII);
10781             break;
10782         case ((VENDOR_IXIA << 16) | 223):
10783             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_reason,
10784                                      tvb, offset, length, ENC_ASCII);
10785             break;
10786         case ((VENDOR_IXIA << 16) | 224):
10787             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_server,
10788                                      tvb, offset, length, ENC_ASCII);
10789             break;
10790         case ((VENDOR_IXIA << 16) | 225):
10791             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_calling_station_id,
10792                                      tvb, offset, length, ENC_NA|ENC_ASCII);
10793             break;
10794         case ((VENDOR_IXIA << 16) | 226):
10795             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_content_length,
10796                                      tvb, offset, length, ENC_BIG_ENDIAN);
10797             break;
10798         case ((VENDOR_IXIA << 16) | 227):
10799             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_referer,
10800                                      tvb, offset, length, ENC_ASCII);
10801             break;
10802         case ((VENDOR_IXIA << 16) | 228):
10803             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_useragent_cpu,
10804                                      tvb, offset, length, ENC_ASCII);
10805             break;
10806         case ((VENDOR_IXIA << 16) | 229):
10807             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_messages,
10808                                      tvb, offset, length, ENC_NA);
10809             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10810             break;
10811         case ((VENDOR_IXIA << 16) | 230):
10812             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_id,
10813                                      tvb, offset, length, ENC_ASCII);
10814             break;
10815         case ((VENDOR_IXIA << 16) | 231):
10816             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_date,
10817                                      tvb, offset, length, ENC_ASCII);
10818             break;
10819         case ((VENDOR_IXIA << 16) | 232):
10820             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_subject,
10821                                      tvb, offset, length, ENC_ASCII);
10822             break;
10823         case ((VENDOR_IXIA << 16) | 233):
10824             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_to,
10825                                      tvb, offset, length, ENC_ASCII);
10826             break;
10827         case ((VENDOR_IXIA << 16) | 234):
10828             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_from,
10829                                      tvb, offset, length, ENC_ASCII);
10830             break;
10831         case ((VENDOR_IXIA << 16) | 235):
10832             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_cc,
10833                                      tvb, offset, length, ENC_ASCII);
10834             break;
10835         case ((VENDOR_IXIA << 16) | 236):
10836             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_bcc,
10837                                      tvb, offset, length, ENC_ASCII);
10838             break;
10839         case ((VENDOR_IXIA << 16) | 237):
10840             ti = proto_tree_add_item(pdutree, hf_pie_ixia_email_msg_attachments,
10841                                      tvb, offset, length, ENC_ASCII);
10842             break;
10843         case ((VENDOR_IXIA << 16) | 238):
10844             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert,
10845                                      tvb, offset, length, ENC_NA);
10846             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10847             break;
10848         case ((VENDOR_IXIA << 16) | 239):
10849             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_issuer,
10850                                      tvb, offset, length, ENC_NA);
10851             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10852             break;
10853         case ((VENDOR_IXIA << 16) | 240):
10854             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_issuer_attr,
10855                                      tvb, offset, length, ENC_ASCII);
10856             break;
10857         case ((VENDOR_IXIA << 16) | 241):
10858             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_issuer_val,
10859                                      tvb, offset, length, ENC_ASCII);
10860             break;
10861         case ((VENDOR_IXIA << 16) | 242):
10862             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_subject,
10863                                      tvb, offset, length, ENC_NA);
10864             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10865             break;
10866         case ((VENDOR_IXIA << 16) | 243):
10867             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_subject_attr,
10868                                      tvb, offset, length, ENC_ASCII);
10869             break;
10870         case ((VENDOR_IXIA << 16) | 244):
10871             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_subject_val,
10872                                      tvb, offset, length, ENC_ASCII);
10873             break;
10874         case ((VENDOR_IXIA << 16) | 245):
10875             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_vld_nt_bfr,
10876                                      tvb, offset, length, ENC_ASCII);
10877             break;
10878         case ((VENDOR_IXIA << 16) | 246):
10879             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_vld_nt_aftr,
10880                                      tvb, offset, length, ENC_ASCII);
10881             break;
10882         case ((VENDOR_IXIA << 16) | 247):
10883             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_srl_num,
10884                                      tvb, offset, length, ENC_ASCII);
10885             break;
10886         case ((VENDOR_IXIA << 16) | 248):
10887             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_sign_algo,
10888                                      tvb, offset, length, ENC_ASCII);
10889             break;
10890         case ((VENDOR_IXIA << 16) | 249):
10891             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_subj_pki_algo,
10892                                      tvb, offset, length, ENC_ASCII);
10893             break;
10894         case ((VENDOR_IXIA << 16) | 250):
10895             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_altnames,
10896                                      tvb, offset, length, ENC_NA);
10897             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10898             break;
10899         case ((VENDOR_IXIA << 16) | 251):
10900             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_altnames_attr,
10901                                      tvb, offset, length, ENC_ASCII);
10902             break;
10903         case ((VENDOR_IXIA << 16) | 252):
10904             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tls_srvr_cert_altnames_val,
10905                                      tvb, offset, length, ENC_ASCII);
10906             break;
10907         case ((VENDOR_IXIA << 16) | 253):
10908             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_packets,
10909                                      tvb, offset, length, ENC_NA);
10910             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10911             break;
10912         case ((VENDOR_IXIA << 16) | 254):
10913             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_transaction_id,
10914                                      tvb, offset, length, ENC_BIG_ENDIAN);
10915             break;
10916         case ((VENDOR_IXIA << 16) | 255):
10917             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_opcode,
10918                                      tvb, offset, length, ENC_BIG_ENDIAN);
10919             break;
10920         case ((VENDOR_IXIA << 16) | 256):
10921             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_request_type,
10922                                      tvb, offset, length, ENC_BIG_ENDIAN);
10923             break;
10924         case ((VENDOR_IXIA << 16) | 257):
10925             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_response_code,
10926                                      tvb, offset, length, ENC_BIG_ENDIAN);
10927             break;
10928         case ((VENDOR_IXIA << 16) | 258):
10929             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_record_ttl,
10930                                      tvb, offset, length, ENC_TIME_SECS);
10931             break;
10932         case ((VENDOR_IXIA << 16) | 259):
10933             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_raw_rdata,
10934                                      tvb, offset, length, ENC_ASCII);
10935             break;
10936         case ((VENDOR_IXIA << 16) | 260):
10937             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_response_type,
10938                                      tvb, offset, length, ENC_BIG_ENDIAN);
10939             break;
10940         case ((VENDOR_IXIA << 16) | 261):
10941             ti = proto_tree_add_item(pdutree, hf_pie_ixia_radius_framed_ip,
10942                                      tvb, offset, length, ENC_ASCII);
10943             break;
10944         case ((VENDOR_IXIA << 16) | 262):
10945             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_qdcount,
10946                                      tvb, offset, length, ENC_BIG_ENDIAN);
10947             break;
10948         case ((VENDOR_IXIA << 16) | 263):
10949             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_ancount,
10950                                      tvb, offset, length, ENC_BIG_ENDIAN);
10951             break;
10952         case ((VENDOR_IXIA << 16) | 264):
10953             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_nscount,
10954                                      tvb, offset, length, ENC_BIG_ENDIAN);
10955             break;
10956         case ((VENDOR_IXIA << 16) | 265):
10957             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_arcount,
10958                                      tvb, offset, length, ENC_BIG_ENDIAN);
10959             break;
10960         case ((VENDOR_IXIA << 16) | 266):
10961             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_auth_answer,
10962                                      tvb, offset, length, ENC_BIG_ENDIAN);
10963             break;
10964         case ((VENDOR_IXIA << 16) | 267):
10965             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_trucation,
10966                                      tvb, offset, length, ENC_BIG_ENDIAN);
10967             break;
10968         case ((VENDOR_IXIA << 16) | 268):
10969             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_recursion_desired,
10970                                      tvb, offset, length, ENC_BIG_ENDIAN);
10971             break;
10972         case ((VENDOR_IXIA << 16) | 269):
10973             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_recursion_avail,
10974                                      tvb, offset, length, ENC_BIG_ENDIAN);
10975             break;
10976         case ((VENDOR_IXIA << 16) | 270):
10977             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_rdata_len,
10978                                      tvb, offset, length, ENC_BIG_ENDIAN);
10979             break;
10980         case ((VENDOR_IXIA << 16) | 271):
10981             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_questions,
10982                                      tvb, offset, length, ENC_NA);
10983             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
10984             break;
10985         case ((VENDOR_IXIA << 16) | 272):
10986             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_query_type,
10987                                      tvb, offset, length, ENC_BIG_ENDIAN);
10988             break;
10989         case ((VENDOR_IXIA << 16) | 273):
10990             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_query_name,
10991                                      tvb, offset, length, ENC_ASCII);
10992             break;
10993         case ((VENDOR_IXIA << 16) | 274):
10994             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_section_type,
10995                                      tvb, offset, length, ENC_ASCII);
10996             break;
10997         case ((VENDOR_IXIA << 16) | 275):
10998             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_qr_flag,
10999                                      tvb, offset, length, ENC_BIG_ENDIAN);
11000             break;
11001         case ((VENDOR_IXIA << 16) | 276):
11002             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_canonical_name,
11003                                      tvb, offset, length, ENC_ASCII);
11004             break;
11005         case ((VENDOR_IXIA << 16) | 277):
11006             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dns_mx_domain,
11007                                      tvb, offset, length, ENC_ASCII);
11008             break;
11009         case ((VENDOR_IXIA << 16) | 278):
11010             ti = proto_tree_add_item(pdutree, hf_pie_ixia_dhcp_agent_circuit_id,
11011                                      tvb, offset, length, ENC_ASCII);
11012             break;
11013         case ((VENDOR_IXIA << 16) | 279):
11014             ti = proto_tree_add_item(pdutree, hf_pie_ixia_ja3_fingerprint_string,
11015                                      tvb, offset, length, ENC_ASCII);
11016             break;
11017         case ((VENDOR_IXIA << 16) | 280):
11018             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tcp_conn_setup_time,
11019                                      tvb, offset, length, ENC_BIG_ENDIAN);
11020             break;
11021         case ((VENDOR_IXIA << 16) | 281):
11022             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tcp_app_response_time,
11023                                      tvb, offset, length, ENC_BIG_ENDIAN);
11024             break;
11025         case ((VENDOR_IXIA << 16) | 282):
11026             ti = proto_tree_add_item(pdutree, hf_pie_ixia_tcp_retrans_pkt_count,
11027                                      tvb, offset, length, ENC_BIG_ENDIAN);
11028             break;
11029         case ((VENDOR_IXIA << 16) | 283):
11030             ti = proto_tree_add_item(pdutree, hf_pie_ixia_conn_avg_rtt,
11031                                      tvb, offset, length, ENC_BIG_ENDIAN);
11032             break;
11033         case ((VENDOR_IXIA << 16) | 284):
11034             ti = proto_tree_add_item(pdutree, hf_pie_ixia_udpAppResponseTime,
11035                                      tvb, offset, length, ENC_BIG_ENDIAN);
11036             break;
11037         case ((VENDOR_IXIA << 16) | 285):
11038             ti = proto_tree_add_item(pdutree, hf_pie_ixia_quicConnSetupTime,
11039                                      tvb, offset, length, ENC_BIG_ENDIAN);
11040             break;
11041         case ((VENDOR_IXIA << 16) | 286):
11042             ti = proto_tree_add_item(pdutree, hf_pie_ixia_quicConnRTT,
11043                                      tvb, offset, length, ENC_BIG_ENDIAN);
11044             break;
11045         case ((VENDOR_IXIA << 16) | 287):
11046             ti = proto_tree_add_item(pdutree, hf_pie_ixia_quicAppResponseTime,
11047                                      tvb, offset, length, ENC_BIG_ENDIAN);
11048             break;
11049         case ((VENDOR_IXIA << 16) | 288):
11050             ti = proto_tree_add_item(pdutree, hf_pie_ixia_matchedFilterName,
11051                                      tvb, offset, length, ENC_ASCII);
11052             break;
11053         case ((VENDOR_IXIA << 16) | 289):
11054             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_IMSI,
11055                                      tvb, offset, length, ENC_BIG_ENDIAN);
11056             break;
11057         case ((VENDOR_IXIA << 16) | 290):
11058             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_SAI_SAC,
11059                                      tvb, offset, length, ENC_BIG_ENDIAN);
11060             break;
11061         case ((VENDOR_IXIA << 16) | 291):
11062             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_RAI_RAC,
11063                                      tvb, offset, length, ENC_BIG_ENDIAN);
11064             break;
11065         case ((VENDOR_IXIA << 16) | 292):
11066             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_TAC,
11067                                      tvb, offset, length, ENC_BIG_ENDIAN);
11068             break;
11069         case ((VENDOR_IXIA << 16) | 293):
11070             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_ECGI_E_NODEB_ID,
11071                                      tvb, offset, length, ENC_BIG_ENDIAN);
11072             break;
11073         case ((VENDOR_IXIA << 16) | 294):
11074             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_CELL_ID,
11075                                      tvb, offset, length, ENC_BIG_ENDIAN);
11076             break;
11077         case ((VENDOR_IXIA << 16) | 295):
11078             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_LAC,
11079                                      tvb, offset, length, ENC_BIG_ENDIAN);
11080             break;
11081         case ((VENDOR_IXIA << 16) | 296):
11082             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_MCC,
11083                                      tvb, offset, length, ENC_BIG_ENDIAN);
11084             break;
11085         case ((VENDOR_IXIA << 16) | 297):
11086             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ULI_MNC,
11087                                      tvb, offset, length, ENC_BIG_ENDIAN);
11088             break;
11089         case ((VENDOR_IXIA << 16) | 298):
11090             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_MSISDN,
11091                                      tvb, offset, length, ENC_BIG_ENDIAN);
11092             break;
11093         case ((VENDOR_IXIA << 16) | 299):
11094             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_IMEI,
11095                                      tvb, offset, length, ENC_BIG_ENDIAN);
11096             break;
11097         case ((VENDOR_IXIA << 16) | 300):
11098             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_RAT_type,
11099                                      tvb, offset, length, ENC_BIG_ENDIAN);
11100             break;
11101         case ((VENDOR_IXIA << 16) | 301):
11102             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_ep_gen,
11103                                      tvb, offset, length, ENC_BIG_ENDIAN);
11104             break;
11105         case ((VENDOR_IXIA << 16) | 302):
11106             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_up_TEID,
11107                                      tvb, offset, length, ENC_BIG_ENDIAN);
11108             break;
11109         case ((VENDOR_IXIA << 16) | 303):
11110             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_down_TEID,
11111                                      tvb, offset, length, ENC_BIG_ENDIAN);
11112             break;
11113         case ((VENDOR_IXIA << 16) | 304):
11114             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_up_ipv4_addr,
11115                                      tvb, offset, length, ENC_BIG_ENDIAN);
11116             break;
11117         case ((VENDOR_IXIA << 16) | 305):
11118             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_down_ipv4_addr,
11119                                      tvb, offset, length, ENC_BIG_ENDIAN);
11120             break;
11121         case ((VENDOR_IXIA << 16) | 306):
11122             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_up_ipv6_addr,
11123                                      tvb, offset, length, ENC_NA);
11124             break;
11125         case ((VENDOR_IXIA << 16) | 307):
11126             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_down_ipv6_addr,
11127                                      tvb, offset, length, ENC_NA);
11128             break;
11129         case ((VENDOR_IXIA << 16) | 308):
11130             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_up_QCI_QFI,
11131                                      tvb, offset, length, ENC_BIG_ENDIAN);
11132             break;
11133         case ((VENDOR_IXIA << 16) | 309):
11134             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_down_QCI_QFI,
11135                                      tvb, offset, length, ENC_BIG_ENDIAN);
11136             break;
11137         case ((VENDOR_IXIA << 16) | 310):
11138             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_up_APN_DNN,
11139                                      tvb, offset, length, ENC_ASCII);
11140             break;
11141         case ((VENDOR_IXIA << 16) | 311):
11142             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_down_APN_DNN,
11143                                      tvb, offset, length, ENC_ASCII);
11144             break;
11145         case ((VENDOR_IXIA << 16) | 312):
11146             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_NSSAI_SD,
11147                                      tvb, offset, length, ENC_BIG_ENDIAN);
11148             break;
11149         case ((VENDOR_IXIA << 16) | 313):
11150             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_NSSAI_SST,
11151                                      tvb, offset, length, ENC_BIG_ENDIAN);
11152             break;
11153         case ((VENDOR_IXIA << 16) | 314):
11154             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_5QI_up,
11155                                      tvb, offset, length, ENC_BIG_ENDIAN);
11156             break;
11157         case ((VENDOR_IXIA << 16) | 315):
11158             ti = proto_tree_add_item(pdutree, hf_pie_ixia_gtp_5QI_down,
11159                                      tvb, offset, length, ENC_BIG_ENDIAN);
11160             break;
11161         case ((VENDOR_IXIA << 16) | 316):
11162             ti = proto_tree_add_item(pdutree, hf_pie_ixia_stun_response,
11163                                      tvb, offset, length, ENC_NA);
11164             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
11165             break;
11166         case ((VENDOR_IXIA << 16) | 317):
11167             ti = proto_tree_add_item(pdutree, hf_pie_ixia_stun_reflexive_ta_ipv6,
11168                                      tvb, offset, length, ENC_NA);
11169             break;
11170         case ((VENDOR_IXIA << 16) | 318):
11171             ti = proto_tree_add_item(pdutree, hf_pie_ixia_stun_reflexive_ta_ipv4,
11172                                      tvb, offset, length, ENC_NA);
11173             break;
11174         case ((VENDOR_IXIA << 16) | 319):
11175             ti = proto_tree_add_item(pdutree, hf_pie_ixia_stun_reflexive_ta_port,
11176                                      tvb, offset, length, ENC_BIG_ENDIAN);
11177             break;
11178         case ((VENDOR_IXIA << 16) | 320):
11179             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_alt_svc,
11180                                      tvb, offset, length, ENC_ASCII);
11181             break;
11182         case ((VENDOR_IXIA << 16) | 321):
11183             ti = proto_tree_add_item(pdutree, hf_pie_ixia_unidirectional,
11184                                      tvb, offset, length, ENC_BIG_ENDIAN);
11185             break;
11186         case ((VENDOR_IXIA << 16) | 322):
11187             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_tls_server_rand,
11188                                      tvb, offset, length, ENC_ASCII);
11189             break;
11190         case ((VENDOR_IXIA << 16) | 323):
11191             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_tls_session_id,
11192                                      tvb, offset, length, ENC_ASCII);
11193             break;
11194         case ((VENDOR_IXIA << 16) | 324):
11195             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_to,
11196                                      tvb, offset, length, ENC_ASCII);
11197             break;
11198         case ((VENDOR_IXIA << 16) | 325):
11199             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_from,
11200                                      tvb, offset, length, ENC_ASCII);
11201             break;
11202         case ((VENDOR_IXIA << 16) | 326):
11203             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_call_id,
11204                                      tvb, offset, length, ENC_ASCII);
11205             break;
11206         case ((VENDOR_IXIA << 16) | 327):
11207             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_content_type,
11208                                      tvb, offset, length, ENC_ASCII);
11209             break;
11210         case ((VENDOR_IXIA << 16) | 328):
11211             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_route,
11212                                      tvb, offset, length, ENC_ASCII);
11213             break;
11214         case ((VENDOR_IXIA << 16) | 329):
11215             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_geolocation,
11216                                      tvb, offset, length, ENC_ASCII);
11217             break;
11218         case ((VENDOR_IXIA << 16) | 330):
11219             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_message,
11220                                      tvb, offset, length, ENC_NA);
11221             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
11222             break;
11223         case ((VENDOR_IXIA << 16) | 331):
11224             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_command_code,
11225                                      tvb, offset, length, ENC_BIG_ENDIAN);
11226             break;
11227         case ((VENDOR_IXIA << 16) | 332):
11228             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_request,
11229                                      tvb, offset, length, ENC_BIG_ENDIAN);
11230             break;
11231         case ((VENDOR_IXIA << 16) | 333):
11232             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_response,
11233                                      tvb, offset, length, ENC_BIG_ENDIAN);
11234             break;
11235         case ((VENDOR_IXIA << 16) | 334):
11236             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_application_id,
11237                                      tvb, offset, length, ENC_BIG_ENDIAN);
11238             break;
11239         case ((VENDOR_IXIA << 16) | 335):
11240             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_origin_host,
11241                                      tvb, offset, length, ENC_ASCII);
11242             break;
11243         case ((VENDOR_IXIA << 16) | 336):
11244             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_origin_realm,
11245                                      tvb, offset, length, ENC_ASCII);
11246             break;
11247         case ((VENDOR_IXIA << 16) | 337):
11248             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_dest_host,
11249                                      tvb, offset, length, ENC_ASCII);
11250             break;
11251         case ((VENDOR_IXIA << 16) | 338):
11252             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_dest_realm,
11253                                      tvb, offset, length, ENC_ASCII);
11254             break;
11255         case ((VENDOR_IXIA << 16) | 339):
11256             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_user_name,
11257                                      tvb, offset, length, ENC_ASCII);
11258             break;
11259         case ((VENDOR_IXIA << 16) | 340):
11260             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_sc_address,
11261                                      tvb, offset, length, ENC_ASCII);
11262             break;
11263         case ((VENDOR_IXIA << 16) | 341):
11264             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_auth_vector_rand,
11265                                      tvb, offset, length, ENC_ASCII);
11266             break;
11267         case ((VENDOR_IXIA << 16) | 342):
11268             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_auth_vector_xres,
11269                                      tvb, offset, length, ENC_ASCII);
11270             break;
11271         case ((VENDOR_IXIA << 16) | 343):
11272             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_auth_vector_autn,
11273                                      tvb, offset, length, ENC_ASCII);
11274             break;
11275         case ((VENDOR_IXIA << 16) | 344):
11276             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_auth_vector_kasme,
11277                                      tvb, offset, length, ENC_ASCII);
11278             break;
11279         case ((VENDOR_IXIA << 16) | 345):
11280             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_sub_data_ambr_max_req_bw_ul,
11281                                      tvb, offset, length, ENC_BIG_ENDIAN);
11282             break;
11283         case ((VENDOR_IXIA << 16) | 346):
11284             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_sub_data_ambr_max_req_bw_dl,
11285                                      tvb, offset, length, ENC_BIG_ENDIAN);
11286             break;
11287         case ((VENDOR_IXIA << 16) | 347):
11288             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_apn_configuration_profile,
11289                                      tvb, offset, length, ENC_ASCII);
11290             break;
11291         case ((VENDOR_IXIA << 16) | 348):
11292             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_access_restriction_data_flags,
11293                                      tvb, offset, length, ENC_BIG_ENDIAN);
11294             break;
11295         case ((VENDOR_IXIA << 16) | 349):
11296             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_route_record,
11297                                      tvb, offset, length, ENC_ASCII);
11298             break;
11299         case ((VENDOR_IXIA << 16) | 350):
11300             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_framed_ip_address,
11301                                      tvb, offset, length, ENC_NA);
11302             break;
11303         case ((VENDOR_IXIA << 16) | 351):
11304             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_3gpp_user_location_info,
11305                                      tvb, offset, length, ENC_ASCII);
11306             break;
11307         case ((VENDOR_IXIA << 16) | 352):
11308             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_called_station_id,
11309                                      tvb, offset, length, ENC_ASCII);
11310             break;
11311         case ((VENDOR_IXIA << 16) | 353):
11312             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_class_identifier,
11313                                      tvb, offset, length, ENC_BIG_ENDIAN);
11314             break;
11315         case ((VENDOR_IXIA << 16) | 354):
11316             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_max_req_bw_dl,
11317                                      tvb, offset, length, ENC_BIG_ENDIAN);
11318             break;
11319         case ((VENDOR_IXIA << 16) | 355):
11320             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_max_req_bw_ul,
11321                                      tvb, offset, length, ENC_BIG_ENDIAN);
11322             break;
11323         case ((VENDOR_IXIA << 16) | 356):
11324             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_guaranteed_br_ul,
11325                                      tvb, offset, length, ENC_BIG_ENDIAN);
11326             break;
11327         case ((VENDOR_IXIA << 16) | 357):
11328             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_guaranteed_br_dl,
11329                                      tvb, offset, length, ENC_BIG_ENDIAN);
11330             break;
11331         case ((VENDOR_IXIA << 16) | 358):
11332             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_apn_agg_max_br_ul,
11333                                      tvb, offset, length, ENC_BIG_ENDIAN);
11334             break;
11335         case ((VENDOR_IXIA << 16) | 359):
11336             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_qos_apn_agg_max_br_dl,
11337                                      tvb, offset, length, ENC_BIG_ENDIAN);
11338             break;
11339         case ((VENDOR_IXIA << 16) | 360):
11340             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_integrity_key,
11341                                      tvb, offset, length, ENC_ASCII);
11342             break;
11343         case ((VENDOR_IXIA << 16) | 361):
11344             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_confidentiality_key,
11345                                      tvb, offset, length, ENC_ASCII);
11346             break;
11347         case ((VENDOR_IXIA << 16) | 362):
11348             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_result_code,
11349                                      tvb, offset, length, ENC_BIG_ENDIAN);
11350             break;
11351         case ((VENDOR_IXIA << 16) | 363):
11352             ti = proto_tree_add_item(pdutree, hf_pie_ixia_diameter_subscription_id_data,
11353                                      tvb, offset, length, ENC_ASCII);
11354             break;
11355         case ((VENDOR_IXIA << 16) | 364):
11356             ti = proto_tree_add_item(pdutree, hf_pie_ixia_session_fingerprint,
11357                                      tvb, offset, length, ENC_ASCII);
11358             break;
11359         case ((VENDOR_IXIA << 16) | 365):
11360             ti = proto_tree_add_item(pdutree, hf_pie_ixia_session_parse_errors,
11361                                      tvb, offset, length, ENC_BIG_ENDIAN);
11362             break;
11363         case ((VENDOR_IXIA << 16) | 366):
11364             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_headers,
11365                                      tvb, offset, length, ENC_NA);
11366             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
11367             break;
11368         case ((VENDOR_IXIA << 16) | 367):
11369             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_header_field,
11370                                      tvb, offset, length, ENC_ASCII);
11371             break;
11372         case ((VENDOR_IXIA << 16) | 368):
11373             ti = proto_tree_add_item(pdutree, hf_pie_ixia_http_header_value,
11374                                      tvb, offset, length, ENC_ASCII);
11375             break;
11376         case ((VENDOR_IXIA << 16) | 369):
11377             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_packets,
11378                                      tvb, offset, length, ENC_ASCII);
11379             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
11380             break;
11381         case ((VENDOR_IXIA << 16) | 370):
11382             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_headers,
11383                                      tvb, offset, length, ENC_ASCII);
11384             dissect_v10_pdu_subtemplate_list(tvb, pinfo, ti, offset, length, hdrinfo_p);
11385             break;
11386         case ((VENDOR_IXIA << 16) | 371):
11387             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_type,
11388                                      tvb, offset, length, ENC_ASCII);
11389             break;
11390         case ((VENDOR_IXIA << 16) | 372):
11391             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_header_field,
11392                                      tvb, offset, length, ENC_ASCII);
11393             break;
11394         case ((VENDOR_IXIA << 16) | 373):
11395             ti = proto_tree_add_item(pdutree, hf_pie_ixia_sip_header_value,
11396                                      tvb, offset, length, ENC_ASCII);
11397             break;
11398         case ((VENDOR_IXIA << 16) | 374):
11399             ti = proto_tree_add_item(pdutree, hf_pie_ixia_session_ip_scrambling_key_hash,
11400                                      tvb, offset, length, ENC_ASCII);
11401             break;
11402         case ((VENDOR_IXIA << 16) | 375):
11403             ti = proto_tree_add_item(pdutree, hf_pie_ixia_ja4a,
11404                                      tvb, offset, length, ENC_ASCII);
11405             break;
11406         case ((VENDOR_IXIA << 16) | 376):
11407             ti = proto_tree_add_item(pdutree, hf_pie_ixia_ja4b,
11408                                      tvb, offset, length, ENC_ASCII);
11409             break;
11410         case ((VENDOR_IXIA << 16) | 377):
11411             ti = proto_tree_add_item(pdutree, hf_pie_ixia_ja4c,
11412                                      tvb, offset, length, ENC_ASCII);
11413             break;
11414             /* END Ixia Communications */
11415
11416             /* START Netscaler Communications */
11417         case ((VENDOR_NETSCALER << 16) | 128):
11418             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_roundtriptime,
11419                                      tvb, offset, length, ENC_BIG_ENDIAN);
11420             break;
11421         case ((VENDOR_NETSCALER << 16) | 129):
11422             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_transactionid,
11423                                      tvb, offset, length, ENC_BIG_ENDIAN);
11424             break;
11425         case ((VENDOR_NETSCALER << 16) | 130):
11426             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httprequrl,
11427                                      tvb, offset, length, ENC_UTF_8);
11428             break;
11429         case ((VENDOR_NETSCALER << 16) | 131):
11430             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqcookie,
11431                                      tvb, offset, length, ENC_UTF_8);
11432             break;
11433         case ((VENDOR_NETSCALER << 16) | 132):
11434             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_flowflags,
11435                                      tvb, offset, length, ENC_BIG_ENDIAN);
11436             break;
11437         case ((VENDOR_NETSCALER << 16) | 133):
11438             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_connectionid,
11439                                      tvb, offset, length, ENC_BIG_ENDIAN);
11440             break;
11441         case ((VENDOR_NETSCALER << 16) | 134):
11442             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_syslogpriority,
11443                                      tvb, offset, length, ENC_BIG_ENDIAN);
11444             break;
11445         case ((VENDOR_NETSCALER << 16) | 135):
11446             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_syslogmessage,
11447                                      tvb, offset, length, ENC_UTF_8);
11448             break;
11449         case ((VENDOR_NETSCALER << 16) | 136):
11450             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_syslogtimestamp,
11451                                      tvb, offset, length, ENC_BIG_ENDIAN);
11452             break;
11453         case ((VENDOR_NETSCALER << 16) | 140):
11454             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqreferer,
11455                                      tvb, offset, length, ENC_UTF_8);
11456             break;
11457         case ((VENDOR_NETSCALER << 16) | 141):
11458             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqmethod,
11459                                      tvb, offset, length, ENC_UTF_8);
11460             break;
11461         case ((VENDOR_NETSCALER << 16) | 142):
11462             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqhost,
11463                                      tvb, offset, length, ENC_UTF_8);
11464             break;
11465         case ((VENDOR_NETSCALER << 16) | 143):
11466             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httprequseragent,
11467                                      tvb, offset, length, ENC_UTF_8);
11468             break;
11469         case ((VENDOR_NETSCALER << 16) | 144):
11470             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httprspstatus,
11471                                      tvb, offset, length, ENC_BIG_ENDIAN);
11472             break;
11473         case ((VENDOR_NETSCALER << 16) | 145):
11474             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httprsplen,
11475                                      tvb, offset, length, ENC_BIG_ENDIAN);
11476             break;
11477         case ((VENDOR_NETSCALER << 16) | 146):
11478             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_serverttfb,
11479                                      tvb, offset, length, ENC_BIG_ENDIAN);
11480             break;
11481         case ((VENDOR_NETSCALER << 16) | 147):
11482             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_serverttlb,
11483                                      tvb, offset, length, ENC_BIG_ENDIAN);
11484             break;
11485         case ((VENDOR_NETSCALER << 16) | 150):
11486             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_appnameincarnationnumber,
11487                                      tvb, offset, length, ENC_BIG_ENDIAN);
11488             break;
11489         case ((VENDOR_NETSCALER << 16) | 151):
11490             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_appnameappid,
11491                                      tvb, offset, length, ENC_BIG_ENDIAN);
11492             break;
11493         case ((VENDOR_NETSCALER << 16) | 152):
11494             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_appname,
11495                                      tvb, offset, length, ENC_UTF_8);
11496             break;
11497         case ((VENDOR_NETSCALER << 16) | 153):
11498             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqrcvfb,
11499                                      tvb, offset, length, ENC_BIG_ENDIAN);
11500             break;
11501         case ((VENDOR_NETSCALER << 16) | 156):
11502             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqforwfb,
11503                                      tvb, offset, length, ENC_BIG_ENDIAN);
11504             break;
11505         case ((VENDOR_NETSCALER << 16) | 157):
11506             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpresrcvfb,
11507                                      tvb, offset, length, ENC_BIG_ENDIAN);
11508             break;
11509         case ((VENDOR_NETSCALER << 16) | 158):
11510             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpresforwfb,
11511                                      tvb, offset, length, ENC_BIG_ENDIAN);
11512             break;
11513         case ((VENDOR_NETSCALER << 16) | 159):
11514             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqrcvlb,
11515                                      tvb, offset, length, ENC_BIG_ENDIAN);
11516             break;
11517         case ((VENDOR_NETSCALER << 16) | 160):
11518             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqforwlb,
11519                                      tvb, offset, length, ENC_BIG_ENDIAN);
11520             break;
11521         case ((VENDOR_NETSCALER << 16) | 161):
11522             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_mainpageid,
11523                                      tvb, offset, length, ENC_BIG_ENDIAN);
11524             break;
11525         case ((VENDOR_NETSCALER << 16) | 162):
11526             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_mainpagecoreid,
11527                                      tvb, offset, length, ENC_BIG_ENDIAN);
11528             break;
11529         case ((VENDOR_NETSCALER << 16) | 163):
11530             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpclientinteractionstarttime,
11531                                      tvb, offset, length, ENC_UTF_8);
11532             break;
11533         case ((VENDOR_NETSCALER << 16) | 164):
11534             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpclientrenderendtime,
11535                                      tvb, offset, length, ENC_UTF_8);
11536             break;
11537         case ((VENDOR_NETSCALER << 16) | 165):
11538             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpclientrenderstarttime,
11539                                      tvb, offset, length, ENC_UTF_8);
11540             break;
11541         case ((VENDOR_NETSCALER << 16) | 167):
11542             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_apptemplatename,
11543                                      tvb, offset, length, ENC_UTF_8);
11544             break;
11545         case ((VENDOR_NETSCALER << 16) | 168):
11546             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpclientinteractionendtime,
11547                                      tvb, offset, length, ENC_UTF_8);
11548             break;
11549         case ((VENDOR_NETSCALER << 16) | 169):
11550             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpresrcvlb,
11551                                      tvb, offset, length, ENC_BIG_ENDIAN);
11552             break;
11553         case ((VENDOR_NETSCALER << 16) | 170):
11554             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpresforwlb,
11555                                      tvb, offset, length, ENC_BIG_ENDIAN);
11556             break;
11557         case ((VENDOR_NETSCALER << 16) | 171):
11558             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_appunitnameappid,
11559                                      tvb, offset, length, ENC_BIG_ENDIAN);
11560             break;
11561         case ((VENDOR_NETSCALER << 16) | 172):
11562             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbloginflags,
11563                                      tvb, offset, length, ENC_BIG_ENDIAN);
11564             break;
11565         case ((VENDOR_NETSCALER << 16) | 173):
11566             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbreqtype,
11567                                      tvb, offset, length, ENC_BIG_ENDIAN);
11568             break;
11569         case ((VENDOR_NETSCALER << 16) | 174):
11570             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbprotocolname,
11571                                      tvb, offset, length, ENC_BIG_ENDIAN);
11572             break;
11573         case ((VENDOR_NETSCALER << 16) | 175):
11574             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbusername,
11575                                      tvb, offset, length, ENC_UTF_8);
11576             break;
11577         case ((VENDOR_NETSCALER << 16) | 176):
11578             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbdatabasename,
11579                                      tvb, offset, length, ENC_UTF_8);
11580             break;
11581         case ((VENDOR_NETSCALER << 16) | 177):
11582             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbclthostname,
11583                                      tvb, offset, length, ENC_UTF_8);
11584             break;
11585         case ((VENDOR_NETSCALER << 16) | 178):
11586             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbreqstring,
11587                                      tvb, offset, length, ENC_UTF_8);
11588             break;
11589         case ((VENDOR_NETSCALER << 16) | 179):
11590             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbrespstatusstring,
11591                                      tvb, offset, length, ENC_UTF_8);
11592             break;
11593         case ((VENDOR_NETSCALER << 16) | 180):
11594             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbrespstatus,
11595                                      tvb, offset, length, ENC_BIG_ENDIAN);
11596             break;
11597         case ((VENDOR_NETSCALER << 16) | 181):
11598             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_dbresplength,
11599                                      tvb, offset, length, ENC_BIG_ENDIAN);
11600             break;
11601         case ((VENDOR_NETSCALER << 16) | 182):
11602             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_clientrtt,
11603                                      tvb, offset, length, ENC_BIG_ENDIAN);
11604             break;
11605         case ((VENDOR_NETSCALER << 16) | 183):
11606             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpcontenttype,
11607                                      tvb, offset, length, ENC_UTF_8);
11608             break;
11609         case ((VENDOR_NETSCALER << 16) | 185):
11610             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqauthorization,
11611                                      tvb, offset, length, ENC_UTF_8);
11612             break;
11613         case ((VENDOR_NETSCALER << 16) | 186):
11614             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqvia,
11615                                      tvb, offset, length, ENC_UTF_8);
11616             break;
11617         case ((VENDOR_NETSCALER << 16) | 187):
11618             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreslocation,
11619                                      tvb, offset, length, ENC_UTF_8);
11620             break;
11621         case ((VENDOR_NETSCALER << 16) | 188):
11622             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpressetcookie,
11623                                      tvb, offset, length, ENC_UTF_8);
11624             break;
11625         case ((VENDOR_NETSCALER << 16) | 189):
11626             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpressetcookie2,
11627                                      tvb, offset, length, ENC_UTF_8);
11628             break;
11629         case ((VENDOR_NETSCALER << 16) | 190):
11630             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpreqxforwardedfor,
11631                                      tvb, offset, length, ENC_UTF_8);
11632             break;
11633         case ((VENDOR_NETSCALER << 16) | 192):
11634             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_connectionchainid,
11635                                      tvb, offset, length, ENC_NA);
11636             break;
11637         case ((VENDOR_NETSCALER << 16) | 193):
11638             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_connectionchainhopcount,
11639                                      tvb, offset, length, ENC_BIG_ENDIAN);
11640             break;
11641         case ((VENDOR_NETSCALER << 16) | 200):
11642             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionguid,
11643                                      tvb, offset, length, ENC_NA);
11644             break;
11645         case ((VENDOR_NETSCALER << 16) | 201):
11646             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientversion,
11647                                      tvb, offset, length, ENC_UTF_8);
11648             break;
11649         case ((VENDOR_NETSCALER << 16) | 202):
11650             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclienttype,
11651                                      tvb, offset, length, ENC_BIG_ENDIAN);
11652             break;
11653         case ((VENDOR_NETSCALER << 16) | 203):
11654             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientip,
11655                                      tvb, offset, 4, ENC_BIG_ENDIAN);
11656             break;
11657         case ((VENDOR_NETSCALER << 16) | 204):
11658             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclienthostname,
11659                                      tvb, offset, length, ENC_UTF_8);
11660             break;
11661         case ((VENDOR_NETSCALER << 16) | 205):
11662             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_aaausername,
11663                                      tvb, offset, length, ENC_UTF_8);
11664             break;
11665         case ((VENDOR_NETSCALER << 16) | 207):
11666             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icadomainname,
11667                                      tvb, offset, length, ENC_UTF_8);
11668             break;
11669         case ((VENDOR_NETSCALER << 16) | 208):
11670             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientlauncher,
11671                                      tvb, offset, length, ENC_BIG_ENDIAN);
11672             break;
11673         case ((VENDOR_NETSCALER << 16) | 209):
11674             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionsetuptime,
11675                                      tvb, offset, length, ENC_BIG_ENDIAN);
11676             break;
11677         case ((VENDOR_NETSCALER << 16) | 210):
11678             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaservername,
11679                                      tvb, offset, length, ENC_UTF_8);
11680             break;
11681         case ((VENDOR_NETSCALER << 16) | 214):
11682             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionreconnects,
11683                                      tvb, offset, length, ENC_BIG_ENDIAN);
11684             break;
11685         case ((VENDOR_NETSCALER << 16) | 215):
11686             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icartt,
11687                                      tvb, offset, length, ENC_BIG_ENDIAN);
11688             break;
11689         case ((VENDOR_NETSCALER << 16) | 216):
11690             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsiderxbytes,
11691                                      tvb, offset, length, ENC_BIG_ENDIAN);
11692             break;
11693         case ((VENDOR_NETSCALER << 16) | 217):
11694             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidetxbytes,
11695                                      tvb, offset, length, ENC_BIG_ENDIAN);
11696             break;
11697         case ((VENDOR_NETSCALER << 16) | 219):
11698             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidepacketsretransmit,
11699                                      tvb, offset, length, ENC_BIG_ENDIAN);
11700             break;
11701         case ((VENDOR_NETSCALER << 16) | 220):
11702             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidepacketsretransmit,
11703                                      tvb, offset, length, ENC_BIG_ENDIAN);
11704             break;
11705         case ((VENDOR_NETSCALER << 16) | 221):
11706             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidertt,
11707                                      tvb, offset, length, ENC_BIG_ENDIAN);
11708             break;
11709         case ((VENDOR_NETSCALER << 16) | 222):
11710             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidertt,
11711                                      tvb, offset, length, ENC_BIG_ENDIAN);
11712             break;
11713         case ((VENDOR_NETSCALER << 16) | 223):
11714             /*
11715              * XXX - this says "sec"; is it just seconds since the UN*X epoch,
11716              * i.e. should it be ENC_TIME_SECS?
11717              */
11718             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionupdatebeginsec,
11719                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
11720             break;
11721         case ((VENDOR_NETSCALER << 16) | 224):
11722             /*
11723              * XXX - this says "sec"; is it just seconds since the UN*X epoch,
11724              * i.e. should it be ENC_TIME_SECS?
11725              */
11726             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionupdateendsec,
11727                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
11728             break;
11729         case ((VENDOR_NETSCALER << 16) | 225):
11730             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid1,
11731                                      tvb, offset, length, ENC_BIG_ENDIAN);
11732             break;
11733         case ((VENDOR_NETSCALER << 16) | 226):
11734             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid1bytes,
11735                                      tvb, offset, length, ENC_BIG_ENDIAN);
11736             break;
11737         case ((VENDOR_NETSCALER << 16) | 227):
11738             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid2,
11739                                      tvb, offset, length, ENC_BIG_ENDIAN);
11740             break;
11741         case ((VENDOR_NETSCALER << 16) | 228):
11742             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid2bytes,
11743                                      tvb, offset, length, ENC_BIG_ENDIAN);
11744             break;
11745         case ((VENDOR_NETSCALER << 16) | 229):
11746             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid3,
11747                                      tvb, offset, length, ENC_BIG_ENDIAN);
11748             break;
11749         case ((VENDOR_NETSCALER << 16) | 230):
11750             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid3bytes,
11751                                      tvb, offset, length, ENC_BIG_ENDIAN);
11752             break;
11753         case ((VENDOR_NETSCALER << 16) | 231):
11754             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid4,
11755                                      tvb, offset, length, ENC_BIG_ENDIAN);
11756             break;
11757         case ((VENDOR_NETSCALER << 16) | 232):
11758             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid4bytes,
11759                                      tvb, offset, length, ENC_BIG_ENDIAN);
11760             break;
11761         case ((VENDOR_NETSCALER << 16) | 233):
11762             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid5,
11763                                      tvb, offset, length, ENC_BIG_ENDIAN);
11764             break;
11765         case ((VENDOR_NETSCALER << 16) | 234):
11766             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icachannelid5bytes,
11767                                      tvb, offset, length, ENC_BIG_ENDIAN);
11768             break;
11769         case ((VENDOR_NETSCALER << 16) | 235):
11770             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaconnectionpriority,
11771                                      tvb, offset, length, ENC_BIG_ENDIAN);
11772             break;
11773         case ((VENDOR_NETSCALER << 16) | 236):
11774             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_applicationstartupduration,
11775                                      tvb, offset, length, ENC_BIG_ENDIAN);
11776             break;
11777         case ((VENDOR_NETSCALER << 16) | 237):
11778             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icalaunchmechanism,
11779                                      tvb, offset, length, ENC_BIG_ENDIAN);
11780             break;
11781         case ((VENDOR_NETSCALER << 16) | 238):
11782             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaapplicationname,
11783                                      tvb, offset, length, ENC_UTF_8);
11784             break;
11785         case ((VENDOR_NETSCALER << 16) | 239):
11786             /* XXX - what format is this? */
11787             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_applicationstartuptime,
11788                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
11789             break;
11790         case ((VENDOR_NETSCALER << 16) | 240):
11791             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaapplicationterminationtype,
11792                                      tvb, offset, length, ENC_BIG_ENDIAN);
11793             break;
11794         case ((VENDOR_NETSCALER << 16) | 241):
11795             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaapplicationterminationtime,
11796                                      tvb, offset, length, ENC_BIG_ENDIAN);
11797             break;
11798         case ((VENDOR_NETSCALER << 16) | 242):
11799             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icasessionendtime,
11800                                      tvb, offset, length, ENC_BIG_ENDIAN);
11801             break;
11802         case ((VENDOR_NETSCALER << 16) | 243):
11803             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidejitter,
11804                                      tvb, offset, length, ENC_BIG_ENDIAN);
11805             break;
11806         case ((VENDOR_NETSCALER << 16) | 244):
11807             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidejitter,
11808                                      tvb, offset, length, ENC_BIG_ENDIAN);
11809             break;
11810         case ((VENDOR_NETSCALER << 16) | 245):
11811             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaappprocessid,
11812                                      tvb, offset, length, ENC_BIG_ENDIAN);
11813             break;
11814         case ((VENDOR_NETSCALER << 16) | 246):
11815             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaappmodulepath,
11816                                      tvb, offset, length, ENC_UTF_8);
11817             break;
11818         case ((VENDOR_NETSCALER << 16) | 247):
11819             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icadeviceserialno,
11820                                      tvb, offset, length, ENC_BIG_ENDIAN);
11821             break;
11822         case ((VENDOR_NETSCALER << 16) | 248):
11823             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_msiclientcookie,
11824                                      tvb, offset, length, ENC_NA);
11825             break;
11826         case ((VENDOR_NETSCALER << 16) | 249):
11827             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaflags,
11828                                      tvb, offset, length, ENC_BIG_ENDIAN);
11829             break;
11830         case ((VENDOR_NETSCALER << 16) | 250):
11831             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icausername,
11832                                      tvb, offset, length, ENC_UTF_8);
11833             break;
11834         case ((VENDOR_NETSCALER << 16) | 251):
11835             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_licensetype,
11836                                      tvb, offset, length, ENC_BIG_ENDIAN);
11837             break;
11838         case ((VENDOR_NETSCALER << 16) | 252):
11839             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_maxlicensecount,
11840                                      tvb, offset, length, ENC_BIG_ENDIAN);
11841             break;
11842         case ((VENDOR_NETSCALER << 16) | 253):
11843             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_currentlicenseconsumed,
11844                                      tvb, offset, length, ENC_BIG_ENDIAN);
11845             break;
11846         case ((VENDOR_NETSCALER << 16) | 254):
11847             /* XXX - what format is this? */
11848             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icanetworkupdatestarttime,
11849                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
11850             break;
11851         case ((VENDOR_NETSCALER << 16) | 255):
11852             /* XXX - what format is this? */
11853             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icanetworkupdateendtime,
11854                                      tvb, offset, length, ENC_TIME_SECS_NSECS|ENC_BIG_ENDIAN);
11855             break;
11856         case ((VENDOR_NETSCALER << 16) | 256):
11857             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidesrtt,
11858                                      tvb, offset, length, ENC_BIG_ENDIAN);
11859             break;
11860         case ((VENDOR_NETSCALER << 16) | 257):
11861             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidesrtt,
11862                                      tvb, offset, length, ENC_BIG_ENDIAN);
11863             break;
11864         case ((VENDOR_NETSCALER << 16) | 258):
11865             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidedelay,
11866                                      tvb, offset, length, ENC_BIG_ENDIAN);
11867             break;
11868         case ((VENDOR_NETSCALER << 16) | 259):
11869             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidedelay,
11870                                      tvb, offset, length, ENC_BIG_ENDIAN);
11871             break;
11872         case ((VENDOR_NETSCALER << 16) | 260):
11873             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icahostdelay,
11874                                      tvb, offset, length, ENC_BIG_ENDIAN);
11875             break;
11876         case ((VENDOR_NETSCALER << 16) | 261):
11877             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidewindowsize,
11878                                      tvb, offset, length, ENC_BIG_ENDIAN);
11879             break;
11880         case ((VENDOR_NETSCALER << 16) | 262):
11881             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidewindowsize,
11882                                      tvb, offset, length, ENC_BIG_ENDIAN);
11883             break;
11884         case ((VENDOR_NETSCALER << 16) | 263):
11885             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaclientsidertocount,
11886                                      tvb, offset, length, ENC_BIG_ENDIAN);
11887             break;
11888         case ((VENDOR_NETSCALER << 16) | 264):
11889             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_icaserversidertocount,
11890                                      tvb, offset, length, ENC_BIG_ENDIAN);
11891             break;
11892         case ((VENDOR_NETSCALER << 16) | 265):
11893             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_ical7clientlatency,
11894                                      tvb, offset, length, ENC_BIG_ENDIAN);
11895             break;
11896         case ((VENDOR_NETSCALER << 16) | 266):
11897             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_ical7serverlatency,
11898                                      tvb, offset, length, ENC_BIG_ENDIAN);
11899             break;
11900         case ((VENDOR_NETSCALER << 16) | 267):
11901             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_httpdomainname,
11902                                      tvb, offset, length, ENC_UTF_8);
11903             break;
11904         case ((VENDOR_NETSCALER << 16) | 268):
11905             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_cacheredirclientconnectioncoreid,
11906                                      tvb, offset, length, ENC_BIG_ENDIAN);
11907             break;
11908         case ((VENDOR_NETSCALER << 16) | 269):
11909             ti = proto_tree_add_item(pdutree, hf_pie_netscaler_cacheredirclientconnectiontransactionid,
11910                                      tvb, offset, length, ENC_BIG_ENDIAN);
11911             break;
11912             /* END Netscaler Communications */
11913
11914             /* START Barracuda Communications */
11915         case ((VENDOR_BARRACUDA << 16) | 1):
11916             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_timestamp,
11917                                      tvb, offset, length, ENC_TIME_SECS|ENC_BIG_ENDIAN);
11918             break;
11919         case ((VENDOR_BARRACUDA << 16) | 2):
11920             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_logop,
11921                                      tvb, offset, length, ENC_BIG_ENDIAN);
11922             break;
11923         case ((VENDOR_BARRACUDA << 16) | 3):
11924             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_traffictype,
11925                                      tvb, offset, length, ENC_BIG_ENDIAN);
11926             break;
11927         case ((VENDOR_BARRACUDA << 16) | 4):
11928             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_fwrule,
11929                                      tvb, offset, length, ENC_UTF_8);
11930             break;
11931         case ((VENDOR_BARRACUDA << 16) | 5):
11932             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_servicename,
11933                                      tvb, offset, length, ENC_UTF_8);
11934             break;
11935         case ((VENDOR_BARRACUDA << 16) | 6):
11936             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_reason,
11937                                      tvb, offset, length, ENC_BIG_ENDIAN);
11938             break;
11939         case ((VENDOR_BARRACUDA << 16) | 7):
11940             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_reasontext,
11941                                      tvb, offset, length, ENC_UTF_8);
11942             break;
11943         case ((VENDOR_BARRACUDA << 16) | 8):
11944             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_bindipv4address,
11945                                      tvb, offset, 4, ENC_BIG_ENDIAN);
11946             break;
11947         case ((VENDOR_BARRACUDA << 16) | 9):
11948             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_bindtransportport,
11949                                      tvb, offset, length, ENC_BIG_ENDIAN);
11950             break;
11951         case ((VENDOR_BARRACUDA << 16) | 10):
11952             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_connipv4address,
11953                                      tvb, offset, 4, ENC_BIG_ENDIAN);
11954             break;
11955         case ((VENDOR_BARRACUDA << 16) | 11):
11956             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_conntransportport,
11957                                      tvb, offset, length, ENC_BIG_ENDIAN);
11958             break;
11959         case ((VENDOR_BARRACUDA << 16) | 12):
11960             ti = proto_tree_add_item(pdutree, hf_pie_barracuda_auditcounter,
11961                                      tvb, offset, length, ENC_BIG_ENDIAN);
11962             break;
11963             /* END Barracuda Communications */
11964
11965             /* START Gigamon */
11966         case ((VENDOR_GIGAMON << 16) | 1):
11967             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_httprequrl,
11968                                      tvb, offset, length, ENC_UTF_8);
11969             break;
11970
11971         case ((VENDOR_GIGAMON << 16) | 2):
11972             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_httprspstatus,
11973                                      tvb, offset, length, ENC_BIG_ENDIAN);
11974             break;
11975
11976         case ((VENDOR_GIGAMON << 16) | 101):
11977             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificateissuercommonname,
11978                                      tvb, offset, length, ENC_UTF_8);
11979             break;
11980
11981         case ((VENDOR_GIGAMON << 16) | 102):
11982             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatesubjectcommonname,
11983                                      tvb, offset, length, ENC_UTF_8);
11984             break;
11985
11986         case ((VENDOR_GIGAMON << 16) | 103):
11987             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificateissuer,
11988                                      tvb, offset, length, ENC_UTF_8);
11989             break;
11990
11991         case ((VENDOR_GIGAMON << 16) | 104):
11992             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatesubject,
11993                                      tvb, offset, length, ENC_UTF_8);
11994             break;
11995
11996         case ((VENDOR_GIGAMON << 16) | 105):
11997             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatevalidnotbefore,
11998                                      tvb, offset, length, ENC_UTF_8);
11999             break;
12000
12001         case ((VENDOR_GIGAMON << 16) | 106):
12002             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatevalidnotafter,
12003                                      tvb, offset, length, ENC_UTF_8);
12004             break;
12005
12006         case ((VENDOR_GIGAMON << 16) | 107):
12007             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificateserialnumber,
12008                                      tvb, offset, length, ENC_NA);
12009             break;
12010
12011         case ((VENDOR_GIGAMON << 16) | 108):
12012             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatesignaturealgorithm,
12013                                      tvb, offset, length, ENC_NA);
12014             break;
12015
12016         case ((VENDOR_GIGAMON << 16) | 109):
12017             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatesubjectpubalgorithm,
12018                                      tvb, offset, length, ENC_NA);
12019             break;
12020
12021         case ((VENDOR_GIGAMON << 16) | 110):
12022             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatesubjectpubkeysize,
12023                                      tvb, offset, length, ENC_BIG_ENDIAN);
12024             break;
12025
12026         case ((VENDOR_GIGAMON << 16) | 111):
12027             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslcertificatesubjectaltname,
12028                                      tvb, offset, length, ENC_UTF_8);
12029             break;
12030
12031         case ((VENDOR_GIGAMON << 16) | 112):
12032             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslservernameindication,
12033                                      tvb, offset, length, ENC_UTF_8);
12034             break;
12035
12036         case ((VENDOR_GIGAMON << 16) | 113):
12037             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslserverversion,
12038                                      tvb, offset, length, ENC_BIG_ENDIAN);
12039             break;
12040
12041         case ((VENDOR_GIGAMON << 16) | 114):
12042             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslservercipher,
12043                                      tvb, offset, length, ENC_BIG_ENDIAN);
12044             break;
12045
12046         case ((VENDOR_GIGAMON << 16) | 115):
12047             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslservercompressionmethod,
12048                                      tvb, offset, length, ENC_BIG_ENDIAN);
12049             break;
12050
12051         case ((VENDOR_GIGAMON << 16) | 116):
12052             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_sslserversessionid,
12053                                      tvb, offset, length, ENC_NA);
12054             break;
12055
12056         case ((VENDOR_GIGAMON << 16) | 201):
12057             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsidentifier,
12058                                      tvb, offset, length, ENC_BIG_ENDIAN);
12059             break;
12060
12061         case ((VENDOR_GIGAMON << 16) | 202):
12062             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsopcode,
12063                                      tvb, offset, length, ENC_BIG_ENDIAN);
12064             break;
12065
12066         case ((VENDOR_GIGAMON << 16) | 203):
12067             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponsecode,
12068                                      tvb, offset, length, ENC_BIG_ENDIAN);
12069             break;
12070
12071         case ((VENDOR_GIGAMON << 16) | 204):
12072             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsqueryname,
12073                                      tvb, offset, length, ENC_UTF_8);
12074             break;
12075
12076         case ((VENDOR_GIGAMON << 16) | 205):
12077             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponsename,
12078                                      tvb, offset, length, ENC_UTF_8);
12079             break;
12080
12081         case ((VENDOR_GIGAMON << 16) | 206):
12082             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponsettl,
12083                                      tvb, offset, length, ENC_BIG_ENDIAN);
12084             break;
12085
12086         case ((VENDOR_GIGAMON << 16) | 207):
12087             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponseipv4address,
12088                                      tvb, offset, length, ENC_BIG_ENDIAN);
12089             break;
12090
12091         case ((VENDOR_GIGAMON << 16) | 208):
12092             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponseipv6address,
12093                                      tvb, offset, length, ENC_NA);
12094             break;
12095
12096         case ((VENDOR_GIGAMON << 16) | 209):
12097             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsbits,
12098                                      tvb, offset, length, ENC_UTF_8);
12099             break;
12100
12101         case ((VENDOR_GIGAMON << 16) | 210):
12102             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsqdcount,
12103                                      tvb, offset, length, ENC_BIG_ENDIAN);
12104             break;
12105
12106         case ((VENDOR_GIGAMON << 16) | 211):
12107             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsancount,
12108                                      tvb, offset, length, ENC_BIG_ENDIAN);
12109             break;
12110
12111         case ((VENDOR_GIGAMON << 16) | 212):
12112             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsnscount,
12113                                      tvb, offset, length, ENC_BIG_ENDIAN);
12114             break;
12115
12116         case ((VENDOR_GIGAMON << 16) | 213):
12117             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsarcount,
12118                                      tvb, offset, length, ENC_BIG_ENDIAN);
12119             break;
12120
12121         case ((VENDOR_GIGAMON << 16) | 214):
12122             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsquerytype,
12123                                      tvb, offset, length, ENC_BIG_ENDIAN);
12124             break;
12125
12126         case ((VENDOR_GIGAMON << 16) | 215):
12127             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsqueryclass,
12128                                      tvb, offset, length, ENC_BIG_ENDIAN);
12129             break;
12130
12131         case ((VENDOR_GIGAMON << 16) | 216):
12132             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponsetype,
12133                                      tvb, offset, length, ENC_BIG_ENDIAN);
12134             break;
12135
12136         case ((VENDOR_GIGAMON << 16) | 217):
12137             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponseclass,
12138                                      tvb, offset, length, ENC_BIG_ENDIAN);
12139             break;
12140
12141         case ((VENDOR_GIGAMON << 16) | 218):
12142             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponserdlength,
12143                                      tvb, offset, length, ENC_BIG_ENDIAN);
12144             break;
12145
12146         case ((VENDOR_GIGAMON << 16) | 219):
12147             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsresponserdata,
12148                                      tvb, offset, length, ENC_UTF_8);
12149             break;
12150
12151         case ((VENDOR_GIGAMON << 16) | 220):
12152             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsauthorityname,
12153                                      tvb, offset, length, ENC_UTF_8);
12154             break;
12155
12156         case ((VENDOR_GIGAMON << 16) | 221):
12157             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsauthoritytype,
12158                                      tvb, offset, length, ENC_BIG_ENDIAN);
12159             break;
12160
12161         case ((VENDOR_GIGAMON << 16) | 222):
12162             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsauthorityclass,
12163                                      tvb, offset, length, ENC_BIG_ENDIAN);
12164             break;
12165
12166         case ((VENDOR_GIGAMON << 16) | 223):
12167             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsauthorityttl,
12168                                      tvb, offset, length, ENC_BIG_ENDIAN);
12169             break;
12170
12171         case ((VENDOR_GIGAMON << 16) | 224):
12172             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsauthorityrdlength,
12173                                      tvb, offset, length, ENC_BIG_ENDIAN);
12174             break;
12175
12176         case ((VENDOR_GIGAMON << 16) | 225):
12177             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsauthorityrdata,
12178                                      tvb, offset, length, ENC_UTF_8);
12179             break;
12180
12181         case ((VENDOR_GIGAMON << 16) | 226):
12182             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsadditionalname,
12183                                      tvb, offset, length, ENC_UTF_8);
12184             break;
12185
12186         case ((VENDOR_GIGAMON << 16) | 227):
12187             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsadditionaltype,
12188                                      tvb, offset, length, ENC_BIG_ENDIAN);
12189             break;
12190
12191         case ((VENDOR_GIGAMON << 16) | 228):
12192             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsadditionalclass,
12193                                      tvb, offset, length, ENC_BIG_ENDIAN);
12194             break;
12195
12196         case ((VENDOR_GIGAMON << 16) | 229):
12197             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsadditionalttl,
12198                                      tvb, offset, length, ENC_BIG_ENDIAN);
12199             break;
12200
12201         case ((VENDOR_GIGAMON << 16) | 230):
12202             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsadditionalrdlength,
12203                                      tvb, offset, length, ENC_BIG_ENDIAN);
12204             break;
12205
12206         case ((VENDOR_GIGAMON << 16) | 231):
12207             ti = proto_tree_add_item(pdutree, hf_pie_gigamon_dnsadditionalrdata,
12208                                      tvb, offset, length, ENC_UTF_8);
12209             break;
12210
12211             /* END Gigamon */
12212
12213             /* Start Cisco Communications */
12214         case ((VENDOR_CISCO << 16) | 4251):
12215             ti = proto_tree_add_item(pdutree, hf_pie_cisco_transport_packets_lost_counter,
12216                                      tvb, offset, length, ENC_BIG_ENDIAN);
12217             break;
12218         case ((VENDOR_CISCO << 16) | 4254):
12219             ti = proto_tree_add_item(pdutree, hf_pie_cisco_transport_rtp_ssrc,
12220                                      tvb, offset, length, ENC_BIG_ENDIAN);
12221             break;
12222         case ((VENDOR_CISCO << 16) | 4257):
12223             ti = proto_tree_add_item(pdutree, hf_pie_cisco_transport_rtp_jitter_maximum,
12224                                      tvb, offset, length, ENC_BIG_ENDIAN);
12225             break;
12226         case ((VENDOR_CISCO << 16) | 4273):
12227             ti = proto_tree_add_item(pdutree, hf_pie_cisco_transport_rtp_payload_type,
12228                                      tvb, offset, length, ENC_BIG_ENDIAN);
12229             break;
12230         case ((VENDOR_CISCO << 16) | 4325):
12231             ti = proto_tree_add_item(pdutree, hf_pie_cisco_transport_rtp_jitter_mean_sum,
12232                                      tvb, offset, length, ENC_BIG_ENDIAN);
12233             break;
12234         case ((VENDOR_CISCO << 16) | 8233):
12235             ti = proto_tree_add_item(pdutree, hf_pie_cisco_c3pl_class_cce_id,
12236                                      tvb, offset, length, ENC_BIG_ENDIAN);
12237             break;
12238         case ((VENDOR_CISCO << 16) | 8234):
12239             ti = proto_tree_add_item(pdutree, hf_pie_cisco_c3pl_class_name,
12240                                      tvb, offset, length, ENC_UTF_8);
12241             break;
12242         case ((VENDOR_CISCO << 16) | 8235):
12243             ti = proto_tree_add_item(pdutree, hf_pie_cisco_c3pl_class_type,
12244                                      tvb, offset, length, ENC_NA);
12245             break;
12246         case ((VENDOR_CISCO << 16) | 8236):
12247             ti = proto_tree_add_item(pdutree, hf_pie_cisco_c3pl_policy_cce_id,
12248                                      tvb, offset, length, ENC_BIG_ENDIAN);
12249             break;
12250         case ((VENDOR_CISCO << 16) | 8237):
12251             ti = proto_tree_add_item(pdutree, hf_pie_cisco_c3pl_policy_name,
12252                                      tvb, offset, length, ENC_UTF_8);
12253             break;
12254         case ((VENDOR_CISCO << 16) | 8238):
12255             ti = proto_tree_add_item(pdutree, hf_pie_cisco_c3pl_policy_type,
12256                                      tvb, offset, length, ENC_NA);
12257             break;
12258         case ((VENDOR_CISCO << 16) | 9292):
12259             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_server_counter_responses,
12260                                      tvb, offset, length, ENC_BIG_ENDIAN);
12261             break;
12262         case ((VENDOR_CISCO << 16) | 9268):
12263             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_client_counter_packets_retransmitted,
12264                                      tvb, offset, length, ENC_BIG_ENDIAN);
12265             break;
12266         case ((VENDOR_CISCO << 16) | 9272):
12267             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_transaction_counter_complete,
12268                                      tvb, offset, length, ENC_BIG_ENDIAN);
12269             break;
12270         case ((VENDOR_CISCO << 16) | 9273):
12271             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_transaction_duration_sum,
12272                                      tvb, offset, length, ENC_BIG_ENDIAN);
12273             break;
12274         case ((VENDOR_CISCO << 16) | 9300):
12275             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_response_to_server_histogram_late,
12276                                      tvb, offset, length, ENC_BIG_ENDIAN);
12277             break;
12278         case ((VENDOR_CISCO << 16) | 9303):
12279             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_response_to_server_sum,
12280                                      tvb, offset, length, ENC_BIG_ENDIAN);
12281             break;
12282         case ((VENDOR_CISCO << 16) | 9306):
12283             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_application_sum,
12284                                      tvb, offset, length, ENC_BIG_ENDIAN);
12285             break;
12286         case ((VENDOR_CISCO << 16) | 9307):
12287             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_application_max,
12288                                      tvb, offset, length, ENC_BIG_ENDIAN);
12289             break;
12290         case ((VENDOR_CISCO << 16) | 9309):
12291             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_response_client_to_server_sum,
12292                                      tvb, offset, length, ENC_BIG_ENDIAN);
12293             break;
12294         case ((VENDOR_CISCO << 16) | 9313):
12295             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_network_client_to_server_sum,
12296                                      tvb, offset, length, ENC_BIG_ENDIAN);
12297             break;
12298         case ((VENDOR_CISCO << 16) | 9316):
12299             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_network_to_client_sum,
12300                                      tvb, offset, length, ENC_BIG_ENDIAN);
12301             break;
12302         case ((VENDOR_CISCO << 16) | 9319):
12303             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_delay_network_to_server_sum,
12304                                      tvb, offset, length, ENC_BIG_ENDIAN);
12305             break;
12306         case ((VENDOR_CISCO << 16) | 9252):
12307             ti = proto_tree_add_item(pdutree, hf_pie_cisco_services_waas_segment,
12308                                      tvb, offset, length, ENC_BIG_ENDIAN);
12309             break;
12310         case ((VENDOR_CISCO << 16) | 9253):
12311             ti = proto_tree_add_item(pdutree, hf_pie_cisco_services_waas_passthrough_reason,
12312                                      tvb, offset, length, ENC_BIG_ENDIAN);
12313             break;
12314         case ((VENDOR_CISCO << 16) | 9357):
12315             cti = proto_tree_add_item(pdutree, hf_pie_cisco_application_http_uri_statistics,
12316                                      tvb, offset, length - 3, ENC_UTF_8);
12317             string_tree = proto_item_add_subtree(cti, ett_str_len);
12318             proto_tree_add_item(string_tree, hf_pie_cisco_application_http_uri_statistics_count,
12319                                      tvb, offset + (length - 2), 2, ENC_BIG_ENDIAN);
12320             proto_tree_add_uint(string_tree, hf_string_len_short, tvb,
12321                                 gen_str_offset-vstr_len, 1, string_len_short);
12322             break;
12323         case ((VENDOR_CISCO << 16) | 12232):
12324             ti = proto_tree_add_item(pdutree, hf_pie_cisco_application_category_name,
12325                                      tvb, offset, length, ENC_UTF_8);
12326             break;
12327         case ((VENDOR_CISCO << 16) | 12233):
12328             ti = proto_tree_add_item(pdutree, hf_pie_cisco_application_sub_category_name,
12329                                      tvb, offset, length, ENC_UTF_8);
12330             break;
12331         case ((VENDOR_CISCO << 16) | 12234):
12332              ti = proto_tree_add_item(pdutree, hf_pie_cisco_application_group_name,
12333                                      tvb, offset, length, ENC_UTF_8);
12334             break;
12335         case ((VENDOR_CISCO << 16) | 12235):
12336             cti = proto_tree_add_item(pdutree, hf_pie_cisco_application_http_host,
12337                                      tvb, offset + 6 , length - 6, ENC_ASCII);
12338             string_tree = proto_item_add_subtree(cti, ett_str_len);
12339             proto_tree_add_item(string_tree, hf_pie_cisco_application_http_host_app_id,
12340                                      tvb, offset, 4, ENC_NA);
12341             proto_tree_add_item(string_tree, hf_pie_cisco_application_http_host_sub_app_id,
12342                                      tvb, offset + 4, 2, ENC_NA);
12343             proto_tree_add_uint(string_tree, hf_string_len_short, tvb,
12344                                 gen_str_offset-vstr_len, 1, string_len_short);
12345             break;
12346         case ((VENDOR_CISCO << 16) | 12236):
12347             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_client_ipv4_address,
12348                                      tvb, offset, length, ENC_NA);
12349             break;
12350         case ((VENDOR_CISCO << 16) | 12237):
12351             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_server_ipv4_address,
12352                                      tvb, offset, length, ENC_NA);
12353             break;
12354         case ((VENDOR_CISCO << 16) | 12240):
12355             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_client_transport_port,
12356                                      tvb, offset, length, ENC_BIG_ENDIAN);
12357             break;
12358         case ((VENDOR_CISCO << 16) | 12241):
12359             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_server_transport_port,
12360                                      tvb, offset, length, ENC_BIG_ENDIAN);
12361             break;
12362         case ((VENDOR_CISCO << 16) | 12242):
12363             ti = proto_tree_add_item(pdutree, hf_pie_cisco_connection_id,
12364                                      tvb, offset, length, ENC_BIG_ENDIAN);
12365             break;
12366         case ((VENDOR_CISCO << 16) | 12243):
12367             ti = proto_tree_add_item(pdutree, hf_pie_cisco_application_traffic_class,
12368                                      tvb, offset, length, ENC_NA);
12369             break;
12370         case ((VENDOR_CISCO << 16) | 12244):
12371             ti = proto_tree_add_item(pdutree, hf_pie_cisco_application_business_relevance,
12372                                      tvb, offset, length, ENC_NA);
12373             break;
12374             /* End Cisco */
12375
12376             /* START Niagara Networks */
12377         case ((VENDOR_NIAGARA_NETWORKS << 16) | 100):
12378             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslservernameindication,
12379                                      tvb, offset, length, ENC_UTF_8);
12380             break;
12381
12382         case ((VENDOR_NIAGARA_NETWORKS << 16) | 101):
12383             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslserverversion,
12384                                      tvb, offset, length, ENC_BIG_ENDIAN);
12385             break;
12386
12387         case ((VENDOR_NIAGARA_NETWORKS << 16) | 102):
12388             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslserverversiontext,
12389                                      tvb, offset, length, ENC_UTF_8);
12390             break;
12391
12392         case ((VENDOR_NIAGARA_NETWORKS << 16) | 103):
12393             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslservercipher,
12394                                      tvb, offset, length, ENC_BIG_ENDIAN);
12395             break;
12396
12397         case ((VENDOR_NIAGARA_NETWORKS << 16) | 104):
12398             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslserverciphertext,
12399                                      tvb, offset, length, ENC_UTF_8);
12400             break;
12401
12402         case ((VENDOR_NIAGARA_NETWORKS << 16) | 105):
12403             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslconnectionencryptiontype,
12404                                      tvb, offset, length, ENC_UTF_8);
12405             break;
12406
12407         case ((VENDOR_NIAGARA_NETWORKS << 16) | 106):
12408             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslservercompressionmethod,
12409                                      tvb, offset, length, ENC_ASCII);
12410             break;
12411
12412         case ((VENDOR_NIAGARA_NETWORKS << 16) | 107):
12413             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslserversessionid,
12414                                      tvb, offset, length, ENC_NA);
12415             break;
12416
12417         case ((VENDOR_NIAGARA_NETWORKS << 16) | 108):
12418             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificateissuer,
12419                                      tvb, offset, length, ENC_UTF_8);
12420             break;
12421
12422         case ((VENDOR_NIAGARA_NETWORKS << 16) | 109):
12423             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificateissuername,
12424                                      tvb, offset, length, ENC_UTF_8);
12425             break;
12426
12427         case ((VENDOR_NIAGARA_NETWORKS << 16) | 110):
12428             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubject,
12429                                      tvb, offset, length, ENC_UTF_8);
12430             break;
12431
12432         case ((VENDOR_NIAGARA_NETWORKS << 16) | 111):
12433             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubjectname,
12434                                      tvb, offset, length, ENC_UTF_8);
12435             break;
12436
12437         case ((VENDOR_NIAGARA_NETWORKS << 16) | 112):
12438             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatevalidnotbefore,
12439                                      tvb, offset, length, ENC_UTF_8);
12440             break;
12441
12442         case ((VENDOR_NIAGARA_NETWORKS << 16) | 113):
12443             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatevalidnotafter,
12444                                      tvb, offset, length, ENC_UTF_8);
12445             break;
12446
12447         case ((VENDOR_NIAGARA_NETWORKS << 16) | 114):
12448             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificateserialnumber,
12449                                      tvb, offset, length, ENC_UTF_8);
12450             break;
12451
12452         case ((VENDOR_NIAGARA_NETWORKS << 16) | 115):
12453             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesignaturealgorithm,
12454                                      tvb, offset, length, ENC_UTF_8);
12455             break;
12456
12457         case ((VENDOR_NIAGARA_NETWORKS << 16) | 116):
12458             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesignaturealgorithmtext,
12459                                      tvb, offset, length, ENC_UTF_8);
12460             break;
12461
12462         case ((VENDOR_NIAGARA_NETWORKS << 16) | 117):
12463             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubjectpublickeysize,
12464                                      tvb, offset, length, ENC_BIG_ENDIAN);
12465             break;
12466
12467         case ((VENDOR_NIAGARA_NETWORKS << 16) | 118):
12468             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubjectpublicalgorithm,
12469                                      tvb, offset, length, ENC_UTF_8);
12470             break;
12471
12472         case ((VENDOR_NIAGARA_NETWORKS << 16) | 119):
12473             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubjectpublicalgorithmtext,
12474                                      tvb, offset, length, ENC_UTF_8);
12475             break;
12476
12477         case ((VENDOR_NIAGARA_NETWORKS << 16) | 120):
12478             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubjectalgorithmtext,
12479                                      tvb, offset, length, ENC_UTF_8);
12480             break;
12481
12482         case ((VENDOR_NIAGARA_NETWORKS << 16) | 121):
12483             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesubjectalternativename,
12484                                      tvb, offset, length, ENC_UTF_8);
12485             break;
12486
12487         case ((VENDOR_NIAGARA_NETWORKS << 16) | 122):
12488             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_sslcertificatesha1,
12489                                      tvb, offset, length, ENC_NA);
12490             break;
12491
12492         case ((VENDOR_NIAGARA_NETWORKS << 16) | 200):
12493             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsidentifier,
12494                                      tvb, offset, length, ENC_BIG_ENDIAN);
12495             break;
12496
12497         case ((VENDOR_NIAGARA_NETWORKS << 16) | 201):
12498             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsopcode,
12499                                      tvb, offset, length, ENC_BIG_ENDIAN);
12500             break;
12501
12502         case ((VENDOR_NIAGARA_NETWORKS << 16) | 202):
12503             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponsecode,
12504                                      tvb, offset, length, ENC_BIG_ENDIAN);
12505             break;
12506
12507         case ((VENDOR_NIAGARA_NETWORKS << 16) | 203):
12508             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsqueryname,
12509                                      tvb, offset, length, ENC_UTF_8);
12510             break;
12511
12512         case ((VENDOR_NIAGARA_NETWORKS << 16) | 204):
12513             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponsename,
12514                                      tvb, offset, length, ENC_UTF_8);
12515             break;
12516
12517         case ((VENDOR_NIAGARA_NETWORKS << 16) | 205):
12518             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponsettl,
12519                                      tvb, offset, length, ENC_BIG_ENDIAN);
12520             break;
12521
12522         case ((VENDOR_NIAGARA_NETWORKS << 16) | 206):
12523             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponseipv4addr,
12524                                      tvb, offset, length, ENC_UTF_8);
12525             break;
12526
12527         case ((VENDOR_NIAGARA_NETWORKS << 16) | 207):
12528             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponseipv4addrtext,
12529                                      tvb, offset, length, ENC_UTF_8);
12530             break;
12531
12532         case ((VENDOR_NIAGARA_NETWORKS << 16) | 208):
12533             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponseipv6addr,
12534                                      tvb, offset, length, ENC_UTF_8);
12535             break;
12536
12537         case ((VENDOR_NIAGARA_NETWORKS << 16) | 209):
12538             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponseipv6addrtext,
12539                                      tvb, offset, length, ENC_UTF_8);
12540             break;
12541
12542         case ((VENDOR_NIAGARA_NETWORKS << 16) | 210):
12543             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsbits,
12544                                      tvb, offset, length, ENC_ASCII);
12545             break;
12546
12547         case ((VENDOR_NIAGARA_NETWORKS << 16) | 211):
12548             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsqdcount,
12549                                      tvb, offset, length, ENC_BIG_ENDIAN);
12550             break;
12551
12552         case ((VENDOR_NIAGARA_NETWORKS << 16) | 212):
12553             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsancount,
12554                                      tvb, offset, length, ENC_BIG_ENDIAN);
12555             break;
12556
12557         case ((VENDOR_NIAGARA_NETWORKS << 16) | 213):
12558             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsnscount,
12559                                      tvb, offset, length, ENC_BIG_ENDIAN);
12560             break;
12561
12562         case ((VENDOR_NIAGARA_NETWORKS << 16) | 214):
12563             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsarcount,
12564                                      tvb, offset, length, ENC_BIG_ENDIAN);
12565             break;
12566
12567         case ((VENDOR_NIAGARA_NETWORKS << 16) | 215):
12568             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsquerytype,
12569                                      tvb, offset, length, ENC_BIG_ENDIAN);
12570             break;
12571
12572         case ((VENDOR_NIAGARA_NETWORKS << 16) | 216):
12573             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsquerytypetext,
12574                                      tvb, offset, length, ENC_UTF_8);
12575             break;
12576
12577         case ((VENDOR_NIAGARA_NETWORKS << 16) | 217):
12578             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsqueryclass,
12579                                      tvb, offset, length, ENC_BIG_ENDIAN);
12580             break;
12581
12582         case ((VENDOR_NIAGARA_NETWORKS << 16) | 218):
12583             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsqueryclasstext,
12584                                      tvb, offset, length, ENC_UTF_8);
12585             break;
12586
12587         case ((VENDOR_NIAGARA_NETWORKS << 16) | 219):
12588             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponsetype,
12589                                      tvb, offset, length, ENC_BIG_ENDIAN);
12590             break;
12591
12592         case ((VENDOR_NIAGARA_NETWORKS << 16) | 220):
12593             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponsetypetext,
12594                                      tvb, offset, length, ENC_UTF_8);
12595             break;
12596
12597         case ((VENDOR_NIAGARA_NETWORKS << 16) | 221):
12598             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponseclass,
12599                                      tvb, offset, length, ENC_BIG_ENDIAN);
12600             break;
12601
12602         case ((VENDOR_NIAGARA_NETWORKS << 16) | 222):
12603             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponseclasstext,
12604                                      tvb, offset, length, ENC_UTF_8);
12605             break;
12606
12607         case ((VENDOR_NIAGARA_NETWORKS << 16) | 223):
12608             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponserdlength,
12609                                      tvb, offset, length, ENC_BIG_ENDIAN);
12610             break;
12611
12612         case ((VENDOR_NIAGARA_NETWORKS << 16) | 224):
12613             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsresponserdata,
12614                                      tvb, offset, length, ENC_ASCII);
12615             break;
12616
12617         case ((VENDOR_NIAGARA_NETWORKS << 16) | 225):
12618             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthorityname,
12619                                      tvb, offset, length, ENC_UTF_8);
12620             break;
12621
12622         case ((VENDOR_NIAGARA_NETWORKS << 16) | 226):
12623             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthoritytype,
12624                                      tvb, offset, length, ENC_BIG_ENDIAN);
12625             break;
12626
12627         case ((VENDOR_NIAGARA_NETWORKS << 16) | 227):
12628             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthoritytypetext,
12629                                      tvb, offset, length, ENC_UTF_8);
12630             break;
12631
12632         case ((VENDOR_NIAGARA_NETWORKS << 16) | 228):
12633             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthorityclass,
12634                                      tvb, offset, length, ENC_BIG_ENDIAN);
12635             break;
12636
12637         case ((VENDOR_NIAGARA_NETWORKS << 16) | 229):
12638             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthorityclasstext,
12639                                      tvb, offset, length, ENC_UTF_8);
12640             break;
12641
12642         case ((VENDOR_NIAGARA_NETWORKS << 16) | 230):
12643             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthorityttl,
12644                                      tvb, offset, length, ENC_BIG_ENDIAN);
12645             break;
12646
12647         case ((VENDOR_NIAGARA_NETWORKS << 16) | 231):
12648             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthorityrdlength,
12649                                      tvb, offset, length, ENC_BIG_ENDIAN);
12650             break;
12651
12652         case ((VENDOR_NIAGARA_NETWORKS << 16) | 232):
12653             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsauthorityrdata,
12654                                      tvb, offset, length, ENC_UTF_8);
12655             break;
12656
12657         case ((VENDOR_NIAGARA_NETWORKS << 16) | 233):
12658             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionalname,
12659                                      tvb, offset, length, ENC_UTF_8);
12660             break;
12661
12662         case ((VENDOR_NIAGARA_NETWORKS << 16) | 234):
12663             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionaltype,
12664                                      tvb, offset, length, ENC_BIG_ENDIAN);
12665             break;
12666
12667         case ((VENDOR_NIAGARA_NETWORKS << 16) | 235):
12668             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionaltypetext,
12669                                      tvb, offset, length, ENC_UTF_8);
12670             break;
12671
12672         case ((VENDOR_NIAGARA_NETWORKS << 16) | 236):
12673             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionalclass,
12674                                      tvb, offset, length, ENC_BIG_ENDIAN);
12675             break;
12676
12677         case ((VENDOR_NIAGARA_NETWORKS << 16) | 237):
12678             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionalclasstext,
12679                                      tvb, offset, length, ENC_UTF_8);
12680             break;
12681
12682         case ((VENDOR_NIAGARA_NETWORKS << 16) | 238):
12683             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionalttl,
12684                                      tvb, offset, length, ENC_BIG_ENDIAN);
12685             break;
12686
12687         case ((VENDOR_NIAGARA_NETWORKS << 16) | 239):
12688             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionalrdlength,
12689                                      tvb, offset, length, ENC_BIG_ENDIAN);
12690             break;
12691
12692         case ((VENDOR_NIAGARA_NETWORKS << 16) | 240):
12693             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_dnsadditionalrdata,
12694                                      tvb, offset, length, ENC_UTF_8);
12695             break;
12696
12697         case ((VENDOR_NIAGARA_NETWORKS << 16) | 300):
12698             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiuspackettypecode,
12699                                      tvb, offset, length, ENC_BIG_ENDIAN);
12700             break;
12701
12702         case ((VENDOR_NIAGARA_NETWORKS << 16) | 301):
12703             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiuspackettypecodetext,
12704                                      tvb, offset, length, ENC_UTF_8);
12705             break;
12706
12707         case ((VENDOR_NIAGARA_NETWORKS << 16) | 302):
12708             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiuspacketidentifier,
12709                                      tvb, offset, length, ENC_BIG_ENDIAN);
12710             break;
12711
12712         case ((VENDOR_NIAGARA_NETWORKS << 16) | 303):
12713             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusauthenticator,
12714                                      tvb, offset, length, ENC_NA);
12715             break;
12716
12717         case ((VENDOR_NIAGARA_NETWORKS << 16) | 304):
12718             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiususername,
12719                                      tvb, offset, length, ENC_ASCII);
12720             break;
12721
12722         case ((VENDOR_NIAGARA_NETWORKS << 16) | 305):
12723             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiuscallingstationid,
12724                                      tvb, offset, length, ENC_ASCII);
12725             break;
12726
12727         case ((VENDOR_NIAGARA_NETWORKS << 16) | 306):
12728             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiuscalledstationid,
12729                                      tvb, offset, length, ENC_ASCII);
12730             break;
12731
12732         case ((VENDOR_NIAGARA_NETWORKS << 16) | 307):
12733             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusnasipaddress,
12734                                      tvb, offset, length, ENC_BIG_ENDIAN);
12735             break;
12736
12737         case ((VENDOR_NIAGARA_NETWORKS << 16) | 308):
12738             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusnasipv6address,
12739                                      tvb, offset, length, ENC_NA);
12740             break;
12741
12742         case ((VENDOR_NIAGARA_NETWORKS << 16) | 309):
12743             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusnasidentifier,
12744                                      tvb, offset, length, ENC_ASCII);
12745             break;
12746
12747         case ((VENDOR_NIAGARA_NETWORKS << 16) | 310):
12748             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusframedipaddress,
12749                                      tvb, offset, length, ENC_BIG_ENDIAN);
12750             break;
12751
12752         case ((VENDOR_NIAGARA_NETWORKS << 16) | 311):
12753             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusframedipv6address,
12754                                      tvb, offset, length, ENC_NA);
12755             break;
12756
12757         case ((VENDOR_NIAGARA_NETWORKS << 16) | 312):
12758             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusacctsessionid,
12759                                      tvb, offset, length, ENC_ASCII);
12760             break;
12761
12762         case ((VENDOR_NIAGARA_NETWORKS << 16) | 313):
12763             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusacctstatustype,
12764                                      tvb, offset, length, ENC_ASCII);
12765             break;
12766
12767         case ((VENDOR_NIAGARA_NETWORKS << 16) | 314):
12768             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusacctinoctets,
12769                                      tvb, offset, length, ENC_BIG_ENDIAN);
12770             break;
12771
12772         case ((VENDOR_NIAGARA_NETWORKS << 16) | 315):
12773             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusacctoutoctets,
12774                                      tvb, offset, length, ENC_BIG_ENDIAN);
12775             break;
12776
12777         case ((VENDOR_NIAGARA_NETWORKS << 16) | 316):
12778             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusacctinpackets,
12779                                      tvb, offset, length, ENC_BIG_ENDIAN);
12780             break;
12781
12782         case ((VENDOR_NIAGARA_NETWORKS << 16) | 317):
12783             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusacctoutpackets,
12784                                      tvb, offset, length, ENC_BIG_ENDIAN);
12785             break;
12786
12787         case ((VENDOR_NIAGARA_NETWORKS << 16) | 318):
12788             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusvsavendorid,
12789                                      tvb, offset, length, ENC_BIG_ENDIAN);
12790             break;
12791
12792         case ((VENDOR_NIAGARA_NETWORKS << 16) | 319):
12793             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusvsaname,
12794                                      tvb, offset, length, ENC_UTF_8);
12795             break;
12796
12797         case ((VENDOR_NIAGARA_NETWORKS << 16) | 320):
12798             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusvsaid,
12799                                      tvb, offset, length, ENC_BIG_ENDIAN);
12800             break;
12801
12802         case ((VENDOR_NIAGARA_NETWORKS << 16) | 321):
12803             ti = proto_tree_add_item(pdutree, hf_pie_niagara_networks_radiusvsavalue,
12804                                      tvb, offset, length, ENC_NA);
12805             break;
12806
12807             /* END Niagara Networks */
12808
12809             /* START Juniper Networks */
12810         case ((VENDOR_JUNIPER << 16) | 137):   /* Juniper Resiliency */
12811            juniper_resilincy_tree  = proto_tree_add_subtree_format (pdutree, tvb, offset, length,
12812                                         ett_resiliency, NULL,
12813                                         "Observation Cloud Level Juniper Common Properties");
12814
12815             if (length == 2){
12816                 proto_tree_add_item_ret_uint (juniper_resilincy_tree, hf_pie_juniper_cpid_16bit,
12817                                                     tvb, offset, length, ENC_BIG_ENDIAN, &cpid);
12818                 proto_item_append_text (juniper_resilincy_tree, ": %s", val_to_str_ext_const(cpid, &v10_juniper_cpid_ext, " "));
12819
12820                 ti = proto_tree_add_item_ret_uint (juniper_resilincy_tree, hf_pie_juniper_cpdesc_16bit,
12821                                                     tvb, offset, length, ENC_BIG_ENDIAN, &cpdesc);
12822             }
12823             else if (length == 4){
12824                 proto_tree_add_item_ret_uint (juniper_resilincy_tree, hf_pie_juniper_cpid_32bit,
12825                                                     tvb, offset, length, ENC_BIG_ENDIAN, &cpid);
12826                 proto_item_append_text (juniper_resilincy_tree, ": %s", val_to_str_ext_const(cpid, &v10_juniper_cpid_ext, " "));
12827
12828                 ti = proto_tree_add_item_ret_uint (juniper_resilincy_tree, hf_pie_juniper_cpdesc_32bit,
12829                                                     tvb, offset, length, ENC_BIG_ENDIAN, &cpdesc);
12830             }
12831             if (cpid == 0x01){
12832                 int fwd_class, drop_pr;
12833                 fwd_class = (cpdesc << 2) & 0xF0;
12834                 drop_pr = (cpdesc << 2) & 0x0F;
12835                 proto_item_append_text (ti, " [Forwarding class: %d  Drop Priority: %x]", fwd_class, drop_pr);
12836             }
12837             break;
12838
12839             /* END Juniper Networks */
12840
12841         default:  /* Unknown Field ID */
12842             if ((hdrinfo_p->vspec == 9) || (pen == REVPEN)) {
12843                 if (length > 0) {
12844                     ti = proto_tree_add_bytes_format_value(pdutree, hf_cflow_unknown_field_type,
12845                                                            tvb, offset, length, NULL,
12846                                                            "Type %u: Value (hex bytes): %s",
12847                                                            masked_type,
12848                                                            tvb_bytes_to_str_punct(pinfo->pool, tvb, offset, length, ' '));
12849                 } else {
12850                     ti = proto_tree_add_bytes_format_value(pdutree, hf_cflow_unknown_field_type,
12851                                                            tvb, offset, length, NULL,
12852                                                            "Type %u",
12853                                                            masked_type);
12854                 }
12855             } else { /* v10 PEN */
12856                 if (length > 0) {
12857                     ti = proto_tree_add_bytes_format_value(pdutree, hf_ipfix_enterprise_private_entry,
12858                                                            tvb, offset, length, NULL,
12859                                                            "(%s) Type %u: Value (hex bytes): %s",
12860                                                            pen_str ? pen_str : "(null)",
12861                                                            masked_type,
12862                                                            tvb_bytes_to_str_punct(pinfo->pool, tvb, offset, length, ' '));
12863                 } else {
12864                     ti = proto_tree_add_bytes_format_value(pdutree, hf_ipfix_enterprise_private_entry,
12865                                                            tvb, offset, length, NULL,
12866                                                            "(%s) Type %u",
12867                                                            pen_str ? pen_str : "(null)",
12868                                                            masked_type);
12869                 }
12870             }
12871             break;
12872
12873         } /* switch (pen_type) */
12874
12875         if (ti && (vstr_len != 0)) {
12876             string_tree = proto_item_add_subtree(ti, ett_str_len);
12877             proto_tree_add_uint(string_tree, hf_string_len_short, tvb,
12878                                 gen_str_offset-vstr_len, 1, string_len_short);
12879             if (vstr_len == 3) {
12880                 proto_tree_add_uint(string_tree, hf_string_len_long, tvb,
12881                                     gen_str_offset-2, 2, string_len_long);
12882             }
12883         }
12884
12885         if (ti && (pen == REVPEN)) {
12886             /* XXX: why showing type ? type not shown if not reverse */
12887             proto_item_append_text(ti, " (Reverse Type %u %s)",
12888                                    masked_type,
12889                                    val_to_str_ext_const(masked_type, &v9_v10_template_types_ext, "Unknown"));
12890         }
12891
12892         offset += length;
12893     } /* for (i=0; i < count; i++) */
12894
12895     /* If only "start" or "end" time, show it here */
12896     /* XXX: length is actually 8 if millisec, microsec, nanosec time */
12897     for (i = 0; i < 2; i++) {
12898         for (j=0; j < (int)duration_type_max; j++) {
12899             if (!(offset_s[i][j] && offset_e[i][j])) {
12900                 if (offset_s[i][j]) {
12901                     if (msec_start[i][j]) {
12902                         proto_tree_add_time(pdutree, hf_cflow_timestart, tvb,
12903                                             offset_s[i][j], 4, &ts_start[i][j]);
12904                     } else {
12905                         proto_tree_add_time(pdutree, hf_cflow_abstimestart, tvb,
12906                                             offset_s[i][j], 4, &ts_start[i][j]);
12907                     }
12908                 }
12909                 if (offset_e[i][j]) {
12910                     if (msec_end[i][j]) {
12911                         proto_tree_add_time(pdutree, hf_cflow_timeend, tvb,
12912                                             offset_e[i][j], 4, &ts_end[i][j]);
12913                     } else {
12914                         proto_tree_add_time(pdutree, hf_cflow_abstimeend, tvb,
12915                                             offset_e[i][j], 4, &ts_end[i][j]);
12916                     }
12917                 }
12918             }
12919         }
12920     }
12921
12922     /* XXX - These IDs are currently hard-coded in procflow.py. */
12923     if (got_flags == GOT_TCP_UDP && (tmplt_p->tmplt_id == 256 || tmplt_p->tmplt_id == 258)) {
12924         add_tcp_process_info(pinfo->num, &local_addr, &remote_addr, local_port, remote_port, uid, pid, uname_str, cmd_str);
12925     }
12926     if (got_flags == GOT_TCP_UDP && (tmplt_p->tmplt_id == 257 || tmplt_p->tmplt_id == 259)) {
12927         add_udp_process_info(pinfo->num, &local_addr, &remote_addr, local_port, remote_port, uid, pid, uname_str, cmd_str);
12928     }
12929
12930     return (unsigned) (offset - orig_offset);
12931
12932 }
12933
12934 /* --- Dissect Template ---*/
12935 /* Template Fields Dissection */
12936 static int * const v9_template_type_hf_list[TF_NUM] = {
12937     &hf_cflow_template_scope_field_type,            /* scope */
12938     &hf_cflow_template_field_type};                 /* entry */
12939 static int * const v10_template_type_hf_list[TF_NUM_EXT] = {
12940     &hf_cflow_template_ipfix_field_type,            /* scope */
12941     &hf_cflow_template_ipfix_field_type,
12942     &hf_cflow_template_plixer_field_type,
12943     &hf_cflow_template_ntop_field_type,
12944     &hf_cflow_template_ixia_field_type,
12945     &hf_cflow_template_netscaler_field_type,
12946     &hf_cflow_template_barracuda_field_type,
12947     &hf_cflow_template_gigamon_field_type,
12948     &hf_cflow_template_cisco_field_type,
12949     &hf_cflow_template_niagara_networks_field_type,
12950     &hf_cflow_template_fastip_field_type,
12951     &hf_cflow_template_juniper_field_type,
12952     NULL};
12953
12954
12955 static value_string_ext *v9_template_type_vse_list[TF_NUM] = {
12956     &v9_scope_field_types_ext,                      /* scope */
12957     &v9_v10_template_types_ext };                   /* entry */
12958 static value_string_ext *v10_template_type_vse_list[TF_NUM_EXT] = {
12959     &v9_v10_template_types_ext,                     /* scope */
12960     &v9_v10_template_types_ext,                     /* entry */
12961     &v10_template_types_plixer_ext,
12962     &v10_template_types_ntop_ext,
12963     &v10_template_types_ixia_ext,
12964     &v10_template_types_netscaler_ext,
12965     &v10_template_types_barracuda_ext,
12966     &v10_template_types_gigamon_ext,
12967     &v10_template_types_cisco_ext,
12968     &v10_template_types_niagara_networks_ext,
12969     &v10_template_types_fastip_ext,
12970     &v10_template_types_juniper_ext,
12971     NULL};
12972
12973
12974
12975 static int
12976 dissect_v9_v10_template_fields(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tmplt_tree, int offset,
12977                                hdrinfo_t *hdrinfo_p,
12978                                v9_v10_tmplt_t *tmplt_p,
12979                                v9_v10_tmplt_fields_type_t fields_type)
12980 {
12981     int ver;
12982     int count;
12983     int i;
12984
12985     DISSECTOR_ASSERT((fields_type == TF_SCOPES) || (fields_type == TF_ENTRIES));
12986
12987     ver = hdrinfo_p->vspec;
12988     DISSECTOR_ASSERT((ver == 9) || (ver == 10));
12989
12990     count = tmplt_p->field_count[fields_type];
12991     for(i=0; i<count; i++) {
12992         uint16_t     type;
12993         uint16_t     length;
12994         uint32_t     pen;
12995         const char *pen_str;
12996         proto_tree  *field_tree;
12997         proto_item  *field_item;
12998         proto_item  *ti;
12999
13000         pen     = 0;
13001         pen_str = NULL;
13002         type    = tvb_get_ntohs(tvb, offset);
13003         length  = tvb_get_ntohs(tvb, offset+2); /* XXX: 0 length should not be allowed ? exception: "ScopeSystem" */
13004         if ((ver == 10) && (type & 0x8000)) {   /* IPFIX only */
13005             pen = tvb_get_ntohl(tvb, offset+4);
13006             pen_str = enterprises_lookup(pen, "(Unknown)");
13007         }
13008
13009         if (tmplt_p->fields_p[fields_type] != NULL) {
13010             tmplt_p->fields_p[fields_type][i].type    = type;
13011             tmplt_p->fields_p[fields_type][i].length  = length;
13012             tmplt_p->fields_p[fields_type][i].pen     = pen;
13013             tmplt_p->fields_p[fields_type][i].pen_str = pen_str;
13014             if (length != VARIABLE_LENGTH) { /* Don't include "variable length" in the total */
13015                 tmplt_p->length    += length;
13016             }
13017         }
13018
13019         field_tree = proto_tree_add_subtree_format(tmplt_tree, tvb, offset, 4+((pen_str!=NULL)?4:0),
13020                                                    ett_field, &field_item, "Field (%u/%u)", i+1, count);
13021         if (fields_type == TF_SCOPES) {
13022             proto_item_append_text(field_item, " [Scope]");
13023         }
13024
13025         if (ver == 9) { /* v9 */
13026             proto_tree_add_item(field_tree, *v9_template_type_hf_list[fields_type],
13027                                 tvb, offset, 2, ENC_BIG_ENDIAN);
13028             proto_item_append_text(field_item, ": %s",
13029                                    val_to_str_ext(type, v9_template_type_vse_list[fields_type], "Unknown(%d)"));
13030         } else { /* v10 */
13031             proto_tree_add_item(field_tree, hf_cflow_template_ipfix_pen_provided,
13032                                 tvb, offset, 2, ENC_BIG_ENDIAN);
13033             if ( !(type & 0x8000) || (pen == REVPEN)) {
13034                 proto_item *rp_ti;
13035                 rp_ti = proto_tree_add_item(field_tree, *v10_template_type_hf_list[fields_type],
13036                                             tvb, offset, 2, ENC_BIG_ENDIAN);
13037                 proto_item_append_text(field_item, ": %s",
13038                                        val_to_str_ext(type&0x7fff, v10_template_type_vse_list[fields_type], "Unknown(%d)"));
13039                 if (pen == REVPEN) {
13040                     proto_item_append_text(rp_ti, " [Reverse]");
13041                     proto_item_append_text(field_item, " [Reverse]");
13042                 }
13043             } else {
13044                 int fields_type_pen = pen_to_type_hf_list(pen);
13045                 if (fields_type_pen != TF_NO_VENDOR_INFO) {
13046                     proto_tree_add_item(field_tree, *v10_template_type_hf_list[fields_type_pen],
13047                                         tvb, offset, 2, ENC_BIG_ENDIAN);
13048                     proto_item_append_text(field_item, ": %s",
13049                                            val_to_str_ext(type&0x7fff, v10_template_type_vse_list[fields_type_pen], "Unknown(%d)"));
13050                 } else { /* Private Enterprise */
13051                     proto_item *pen_ti;
13052                     pen_ti = proto_tree_add_item(field_tree, hf_cflow_template_ipfix_field_type_enterprise,
13053                                                  tvb, offset, 2, ENC_BIG_ENDIAN);
13054                     proto_item_append_text(pen_ti, " [pen: %s]", pen_str);
13055                     proto_item_append_text(field_item, ": %3u [pen: %s]", type&0x7fff, pen_str);
13056                 }
13057             }
13058         }
13059
13060         offset += 2;
13061
13062         ti = proto_tree_add_item(field_tree, hf_cflow_template_field_length, tvb,
13063                                  offset, 2, ENC_BIG_ENDIAN);
13064         if (length == VARIABLE_LENGTH) {
13065             proto_item_append_text(ti, " [i.e.: \"Variable Length\"]");
13066         }
13067         offset += 2;
13068
13069         /* Private Enterprise Number (IPFIX only) */
13070         if ((ver == 10) && (type & 0x8000)) {
13071             proto_tree_add_uint_format_value(field_tree, hf_cflow_template_ipfix_field_pen, tvb, offset, 4,
13072                                              pen, "%s (%u)", pen_str, pen);
13073             offset += 4;
13074         }
13075     }
13076     return offset;
13077 }
13078
13079 /* Options Template Dissection */
13080 static int
13081 dissect_v9_v10_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int offset, int length,
13082                                 hdrinfo_t *hdrinfo_p, uint16_t flowset_id)
13083 {
13084     int remaining;
13085     proto_item_append_text(pdutree, " (Options Template): ");
13086     col_append_str(pinfo->cinfo, COL_INFO, " [Options-Template:");
13087
13088     remaining = length;
13089     while (remaining > 3) { /* allow for padding */
13090         v9_v10_tmplt_t *tmplt_p;
13091         v9_v10_tmplt_t  tmplt;
13092         proto_tree     *tmplt_tree;
13093         proto_item     *tmplt_item;
13094         proto_item     *ti;
13095         uint16_t        id;
13096         uint16_t        option_scope_field_count;
13097         uint16_t        option_field_count;
13098         int             orig_offset;
13099
13100         orig_offset = offset;
13101
13102         id = tvb_get_ntohs(tvb, offset);
13103         /* Show set flow-id in set root and Info column */
13104         col_append_fstr(pinfo->cinfo, COL_INFO,
13105                         "%s%u", (remaining<length) ? "," : "", id);
13106         proto_item_append_text(pdutree, "%s%u", (remaining<length) ? "," : "", id);
13107
13108         tmplt_tree = proto_tree_add_subtree_format(pdutree, tvb, offset, -1, ett_template, &tmplt_item, "Options Template (Id = %u)", id);
13109
13110         proto_tree_add_item(tmplt_tree, hf_cflow_template_id, tvb, offset, 2, ENC_BIG_ENDIAN);
13111         offset += 2;
13112
13113         if (flowset_id == FLOWSET_ID_V9_OPTIONS_TEMPLATE) { /* V9 */
13114             /* Note: v9: field_count = fields_byte_length/4 since each entry is 4 bytes */
13115             /* XXX: validate byte_length is a multiple of 4 ? */
13116             option_scope_field_count = tvb_get_ntohs(tvb, offset)/4;
13117             proto_tree_add_item(tmplt_tree,
13118                                 hf_cflow_option_scope_length,
13119                                 tvb, offset, 2, ENC_BIG_ENDIAN);
13120             offset += 2;
13121
13122             option_field_count = tvb_get_ntohs(tvb, offset)/4;
13123             ti = proto_tree_add_item(tmplt_tree,
13124                                      hf_cflow_option_length,
13125                                      tvb, offset, 2, ENC_BIG_ENDIAN);
13126             offset += 2;
13127         } else { /* IPFIX (V10) */
13128             uint16_t option_total_field_count;
13129
13130             option_total_field_count = tvb_get_ntohs(tvb, offset);
13131             proto_tree_add_item(tmplt_tree,
13132                                 hf_cflow_template_ipfix_total_field_count,
13133                                 tvb, offset, 2, ENC_BIG_ENDIAN);
13134             offset += 2;
13135
13136             option_scope_field_count = tvb_get_ntohs(tvb, offset);
13137             ti = proto_tree_add_item(tmplt_tree,
13138                                      hf_cflow_template_ipfix_scope_field_count,
13139                                      tvb, offset, 2, ENC_BIG_ENDIAN);
13140             offset += 2;
13141
13142             option_field_count = option_total_field_count - option_scope_field_count;
13143
13144             if (option_scope_field_count == 0) {
13145                 expert_add_info(pinfo, ti, &ei_cflow_template_ipfix_scope_field_count);
13146                 return 0;
13147             }
13148             if (option_scope_field_count > option_total_field_count) {
13149                 expert_add_info_format(pinfo, ti, &ei_cflow_template_ipfix_scope_field_count_too_many,
13150                                        "More scope fields (%u) than fields (%u)",
13151                                        option_scope_field_count, option_total_field_count);
13152                 return 0;
13153             }
13154         }
13155
13156         proto_item_append_text(tmplt_item,
13157                                " (Scope Count = %u; Data Count = %u)",
13158                                option_scope_field_count, option_field_count);
13159         proto_item_set_len(tmplt_item, 6 +4*(option_scope_field_count+option_field_count));
13160
13161         if (v9_tmplt_max_fields &&
13162             (option_field_count > v9_tmplt_max_fields)) {
13163             expert_add_info_format(pinfo, ti, &ei_cflow_options,
13164                                    "More options (%u) than we can handle."
13165                                    " Maximum value can be adjusted in the protocol preferences.",
13166                                    option_field_count);
13167         }
13168
13169         if (v9_tmplt_max_fields &&
13170             (option_scope_field_count > v9_tmplt_max_fields)) {
13171             expert_add_info_format(pinfo, ti, &ei_cflow_scopes,
13172                                    "More scopes (%u) than we can handle [template won't be used]."
13173                                    " Maximum value can be adjusted in the protocol preferences.",
13174                                    option_scope_field_count);
13175         }
13176
13177         memset(&tmplt, 0, sizeof(tmplt));
13178
13179         v9_v10_tmplt_build_key(&tmplt, pinfo, hdrinfo_p->src_id, id);
13180
13181         tmplt.field_count[TF_SCOPES]  = option_scope_field_count;
13182         tmplt.field_count[TF_ENTRIES] = option_field_count;
13183
13184         /* If an entry for this template already exists in the template table then after the     */
13185         /* 'do {} while' tmplt.fields_p[TF_SCOPES] and tmplt.fields_p[TF_ENTRIES] will be NULL   */
13186         /* (no memory will have been allocated) and thus this template will not be cached after  */
13187         /* dissection.                                                                           */
13188         /*  ToDo: expert warning if replacement (changed) and new template ignored.              */
13189         /*  XXX: Is an Options template with only scope fields allowed for V9 ??                 */
13190
13191         tmplt_p = (v9_v10_tmplt_t *)wmem_map_lookup(v9_v10_tmplt_table, &tmplt);
13192         if (!pinfo->fd->visited) { /* cache template info only during first pass */
13193             do {
13194                 if (v9_tmplt_max_fields &&
13195                      ((option_scope_field_count > v9_tmplt_max_fields)
13196                       || (option_field_count > v9_tmplt_max_fields)))  {
13197                     break; /* Don't cache this template */
13198                 }
13199                 if (tmplt_p != NULL) {
13200                     /* Entry for this template already exists; Can be dup or changed */
13201                     /* ToDo: Test for changed template ? If so: expert ?             */
13202                     break; /* Don't cache this template */
13203                 }
13204                 tmplt.fields_p[TF_SCOPES]  = (v9_v10_tmplt_entry_t *)wmem_alloc0(wmem_file_scope(), option_scope_field_count *sizeof(v9_v10_tmplt_entry_t));
13205                 tmplt.fields_p[TF_ENTRIES] = (v9_v10_tmplt_entry_t *)wmem_alloc0(wmem_file_scope(), option_field_count       *sizeof(v9_v10_tmplt_entry_t));
13206                 break;
13207             } while (false);
13208         }
13209
13210         offset = dissect_v9_v10_template_fields(tvb, pinfo, tmplt_tree, offset,
13211                                                 hdrinfo_p, &tmplt, TF_SCOPES);
13212
13213         offset = dissect_v9_v10_template_fields(tvb, pinfo, tmplt_tree, offset,
13214                                                 hdrinfo_p, &tmplt, TF_ENTRIES);
13215
13216         if ((tmplt_p == NULL) && (tmplt.fields_p[TF_SCOPES] || tmplt.fields_p[TF_ENTRIES])) {
13217             /* create permanent template copy for storage in template table */
13218             tmplt_p = (v9_v10_tmplt_t *)wmem_memdup(wmem_file_scope(), &tmplt, sizeof(tmplt));
13219             copy_address_wmem(wmem_file_scope(), &tmplt_p->src_addr, &pinfo->net_src);
13220             copy_address_wmem(wmem_file_scope(), &tmplt_p->dst_addr, &pinfo->net_dst);
13221             /* Remember when we saw this template */
13222             tmplt_p->template_frame_number = pinfo->num;
13223             /* Add completed entry into table */
13224             wmem_map_insert(v9_v10_tmplt_table, tmplt_p, tmplt_p);
13225         }
13226
13227         remaining -= offset - orig_offset;
13228     }
13229     if (remaining > 0)
13230         flow_process_textfield(pdutree, tvb, offset, remaining, hf_cflow_padding);
13231
13232     col_append_str(pinfo->cinfo, COL_INFO, "]");
13233
13234     return length;
13235 }
13236
13237 /* Data Template Dissection */
13238 static int
13239 dissect_v9_v10_data_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int offset, int length,
13240                              hdrinfo_t *hdrinfo_p, uint16_t flowset_id _U_)
13241 {
13242     int remaining;
13243
13244     conversation_t *conv = find_or_create_conversation(pinfo);
13245     wmem_map_t *netflow_sequence_analysis_domain_hash = (wmem_map_t *)conversation_get_proto_data(conv, proto_netflow);
13246     if (netflow_sequence_analysis_domain_hash == NULL) {
13247         netflow_sequence_analysis_domain_hash = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
13248         conversation_add_proto_data(conv, proto_netflow, netflow_sequence_analysis_domain_hash);
13249     }
13250
13251     proto_item_append_text(pdutree, " (Data Template): ");
13252     col_append_str(pinfo->cinfo, COL_INFO, " [Data-Template:");
13253
13254     remaining = length;
13255     while (remaining > 3) { /* allow for padding */
13256         v9_v10_tmplt_t *tmplt_p;
13257         v9_v10_tmplt_t  tmplt;
13258         proto_tree     *tmplt_tree;
13259         proto_item     *ti;
13260         uint16_t        id;
13261         uint16_t        count;
13262         int             orig_offset;
13263
13264         orig_offset = offset;
13265         id = tvb_get_ntohs(tvb, offset);
13266         /* Show set flow-id in set root and Info column */
13267         col_append_fstr(pinfo->cinfo, COL_INFO,
13268                         "%s%u", (remaining<length) ? "," : "", id);
13269         proto_item_append_text(pdutree, "%s%u", (remaining<length) ? "," : "", id);
13270
13271         count = tvb_get_ntohs(tvb, offset + 2);
13272
13273         tmplt_tree = proto_tree_add_subtree_format(pdutree, tvb, offset,
13274                                          4 + 4 * count /* hdrsiz + count*2*(sizeof uint16_t)*/,
13275                                          ett_template, NULL, "Template (Id = %u, Count = %u)", id, count);
13276
13277         proto_tree_add_item(tmplt_tree, hf_cflow_template_id, tvb,
13278                             offset, 2, ENC_BIG_ENDIAN);
13279         offset += 2;
13280
13281         ti = proto_tree_add_item(tmplt_tree, hf_cflow_template_field_count,
13282                                  tvb, offset, 2, ENC_BIG_ENDIAN);
13283         offset += 2;
13284
13285         if (v9_tmplt_max_fields && (count > v9_tmplt_max_fields)) {
13286             expert_add_info_format(pinfo, ti, &ei_cflow_entries,
13287                                    "More entries (%u) than we can handle [template won't be used]."
13288                                    " Maximum value can be adjusted in the protocol preferences.",
13289                                    count);
13290         }
13291
13292         memset(&tmplt, 0, sizeof(tmplt));
13293
13294         v9_v10_tmplt_build_key(&tmplt, pinfo, hdrinfo_p->src_id, id); /* lookup only ! */
13295
13296         tmplt.field_count[TF_ENTRIES]  = count;
13297
13298         /* If an entry for this hash already exists in the template table then after the           */
13299         /* 'do {} while' tmplt.fields_p[TF_ENTRIES] will be NULL (no memory will have been         */
13300         /*  been allocated) and thus this template will not be cached after dissection.            */
13301         /*  ToDo: expert warning if replacement (changed) and new template ignored.                */
13302
13303         tmplt_p = (v9_v10_tmplt_t *)wmem_map_lookup(v9_v10_tmplt_table, &tmplt);
13304         if (!pinfo->fd->visited) { /* cache template info only during first pass */
13305             do {
13306                 if ((count == 0) ||
13307                     (v9_tmplt_max_fields && (count > v9_tmplt_max_fields))) {
13308                     break; /* Don't cache this template */
13309                 }
13310                 if (tmplt_p != NULL) {
13311                     /* Entry for this template already exists; Can be dup or changed */
13312                     /* ToDo: Test for changed template ? If so: expert ?             */
13313                     break; /* Don't cache this template */
13314                 }
13315                 tmplt.fields_p[TF_ENTRIES] = (v9_v10_tmplt_entry_t *)wmem_alloc0(wmem_file_scope(), count * sizeof(v9_v10_tmplt_entry_t));
13316                 break;
13317             } while (false);
13318         }
13319         offset = dissect_v9_v10_template_fields(tvb, pinfo, tmplt_tree, offset,
13320                                                 hdrinfo_p, &tmplt, TF_ENTRIES);
13321
13322         if ((tmplt_p == NULL) && tmplt.fields_p[TF_ENTRIES]) {
13323             netflow_domain_state_t *domain_state;
13324
13325             /* create permanent template copy for storage in template table */
13326             tmplt_p = (v9_v10_tmplt_t *)wmem_memdup(wmem_file_scope(), &tmplt, sizeof(tmplt));
13327             copy_address_wmem(wmem_file_scope(), &tmplt_p->src_addr, &pinfo->net_src);
13328             copy_address_wmem(wmem_file_scope(), &tmplt_p->dst_addr, &pinfo->net_dst);
13329             /* Remember when we saw this template */
13330             tmplt_p->template_frame_number = pinfo->num;
13331             wmem_map_insert(v9_v10_tmplt_table, tmplt_p, tmplt_p);
13332
13333             /* Create if necessary observation domain entry (for use with sequence analysis) */
13334             domain_state = (netflow_domain_state_t *)wmem_map_lookup(netflow_sequence_analysis_domain_hash,
13335                                                                          GUINT_TO_POINTER(hdrinfo_p->src_id));
13336             if (domain_state == NULL) {
13337                 domain_state = wmem_new0(wmem_file_scope(), netflow_domain_state_t);
13338                 /* Store new domain in table */
13339                 wmem_map_insert(netflow_sequence_analysis_domain_hash, GUINT_TO_POINTER(hdrinfo_p->src_id), domain_state);
13340             }
13341         }
13342         remaining -= offset - orig_offset;
13343     }
13344     if (remaining > 0)
13345         flow_process_textfield(pdutree, tvb, offset, remaining, hf_cflow_padding);
13346
13347     col_append_str(pinfo->cinfo, COL_INFO, "]");
13348
13349     return length;
13350 }
13351
13352 /* build temporary key */
13353 /* Note: address at *(pinfo->net_???.data) is *not* copied */
13354 static v9_v10_tmplt_t *v9_v10_tmplt_build_key(v9_v10_tmplt_t *tmplt_p, packet_info *pinfo, uint32_t src_id, uint16_t tmplt_id)
13355 {
13356     set_address(&tmplt_p->src_addr, pinfo->net_src.type, pinfo->net_src.len, pinfo->net_src.data); /* lookup only! */
13357     tmplt_p->src_port  = pinfo->srcport;
13358     set_address(&tmplt_p->dst_addr, pinfo->net_dst.type, pinfo->net_dst.len, pinfo->net_dst.data); /* lookup only! */
13359     tmplt_p->dst_port  = pinfo->destport;
13360     tmplt_p->src_id    = src_id;
13361     tmplt_p->tmplt_id  = tmplt_id;
13362     return tmplt_p;
13363 }
13364
13365 static gboolean
13366 v9_v10_tmplt_table_equal(const void *k1, const void *k2)
13367 {
13368     const v9_v10_tmplt_t *ta = (const v9_v10_tmplt_t *)k1;
13369     const v9_v10_tmplt_t *tb = (const v9_v10_tmplt_t *)k2;
13370
13371     return (
13372         (cmp_address(&ta->src_addr, &tb->src_addr) == 0) &&
13373         (ta->src_port == tb->src_port)                   &&
13374         (cmp_address(&ta->dst_addr, &tb->dst_addr) == 0) &&
13375         (ta->dst_port == tb->dst_port)                   &&
13376         (ta->src_id   == tb->src_id)                     &&
13377         (ta->tmplt_id == tb->tmplt_id)
13378         );
13379 }
13380
13381 static unsigned
13382 v9_v10_tmplt_table_hash(const void *k)
13383 {
13384     const v9_v10_tmplt_t *tmplt_p = (const v9_v10_tmplt_t *)k;
13385     uint32_t              val;
13386
13387     val = tmplt_p->src_id + (tmplt_p->tmplt_id << 9) + tmplt_p->src_port + tmplt_p->dst_port;
13388
13389     val = add_address_to_hash(val, &tmplt_p->src_addr);
13390     val = add_address_to_hash(val, &tmplt_p->dst_addr);
13391
13392     return val;
13393 }
13394
13395 /*
13396  * dissect a version 1, 5, or 7 pdu and return the length of the pdu we
13397  * processed
13398  */
13399
13400 static int
13401 dissect_pdu(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *pdutree, int offset, hdrinfo_t *hdrinfo_p, uint32_t *flows_seen _U_)
13402 {
13403     int             startoffset = offset;
13404     uint32_t        srcaddr, dstaddr;
13405     uint8_t         mask;
13406     nstime_t        ts;
13407     uint8_t         ver;
13408
13409     memset(&ts, 0, sizeof(ts));
13410
13411     /*
13412      * memcpy so we can use the values later to calculate a prefix
13413      */
13414     srcaddr = tvb_get_ipv4(tvb, offset);
13415     proto_tree_add_ipv4(pdutree, hf_cflow_srcaddr, tvb, offset, 4, srcaddr);
13416     offset += 4;
13417
13418     dstaddr = tvb_get_ipv4(tvb, offset);
13419     proto_tree_add_ipv4(pdutree, hf_cflow_dstaddr, tvb, offset, 4, dstaddr);
13420     offset += 4;
13421
13422     proto_tree_add_item(pdutree, hf_cflow_nexthop, tvb, offset, 4, ENC_BIG_ENDIAN);
13423     offset += 4;
13424
13425     offset = flow_process_ints(pdutree, tvb, offset);
13426     offset = flow_process_sizecount(pdutree, tvb, offset);
13427     offset = flow_process_timeperiod(pdutree, tvb, offset);
13428     offset = flow_process_ports(pdutree, tvb, offset);
13429
13430     /*
13431      * and the similarities end here
13432      */
13433
13434     ver = hdrinfo_p->vspec;
13435
13436     if (ver == 1) {
13437         offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_padding);
13438
13439         proto_tree_add_item(pdutree, hf_cflow_prot, tvb, offset++, 1, ENC_BIG_ENDIAN);
13440
13441         proto_tree_add_item(pdutree, hf_cflow_tos, tvb, offset++, 1, ENC_BIG_ENDIAN);
13442
13443         proto_tree_add_item(pdutree, hf_cflow_tcpflags, tvb, offset++, 1, ENC_BIG_ENDIAN);
13444
13445         offset = flow_process_textfield(pdutree, tvb, offset, 3, hf_cflow_padding);
13446
13447         offset = flow_process_textfield(pdutree, tvb, offset, 4, hf_cflow_reserved);
13448     } else {
13449         if (ver == 5)
13450             offset = flow_process_textfield(pdutree, tvb, offset, 1, hf_cflow_padding);
13451         else {
13452             proto_tree_add_item(pdutree, hf_cflow_flags, tvb, offset++, 1, ENC_BIG_ENDIAN);
13453         }
13454
13455         proto_tree_add_item(pdutree, hf_cflow_tcpflags, tvb, offset++, 1, ENC_BIG_ENDIAN);
13456
13457         proto_tree_add_item(pdutree, hf_cflow_prot, tvb, offset++, 1, ENC_BIG_ENDIAN);
13458
13459         proto_tree_add_item(pdutree, hf_cflow_tos, tvb, offset++, 1, ENC_BIG_ENDIAN);
13460
13461         offset = flow_process_aspair(pdutree, tvb, offset);
13462
13463         mask = tvb_get_uint8(tvb, offset);
13464         proto_tree_add_uint_format_value(pdutree, hf_cflow_srcmask, tvb, offset++, 1,
13465                                          mask,
13466                                          "%u (prefix: %s/%u)",
13467                                          mask, getprefix(pinfo->pool, &srcaddr, mask),
13468                                          mask != 0 ? mask : 32);
13469
13470         mask = tvb_get_uint8(tvb, offset);
13471         proto_tree_add_uint_format_value(pdutree, hf_cflow_dstmask, tvb, offset++, 1,
13472                                          mask,
13473                                          "%u (prefix: %s/%u)",
13474                                          mask, getprefix(pinfo->pool, &dstaddr, mask),
13475                                          mask != 0 ? mask : 32);
13476
13477         offset = flow_process_textfield(pdutree, tvb, offset, 2, hf_cflow_padding);
13478
13479         if (ver == 7) {
13480             proto_tree_add_item(pdutree, hf_cflow_routersc, tvb, offset, 4, ENC_BIG_ENDIAN);
13481             offset += 4;
13482         }
13483     }
13484
13485     return (offset - startoffset);
13486 }
13487
13488 static const char    *
13489 getprefix(wmem_allocator_t *pool, const uint32_t *addr, unsigned prefix)
13490 {
13491     uint32_t gprefix;
13492     address prefix_addr;
13493
13494     if (prefix == 0) {
13495         gprefix = 0;
13496     } else if (prefix < 32) {
13497         gprefix = *addr & g_htonl((0xffffffff << (32 - prefix)));
13498     } else {
13499         gprefix = *addr;
13500     }
13501
13502     set_address(&prefix_addr, AT_IPv4, 4, &gprefix);
13503     return address_to_str(pool, &prefix_addr);
13504 }
13505
13506 void
13507 proto_register_netflow(void)
13508 {
13509     static hf_register_info hf[] = {
13510         /*
13511          * flow header
13512          */
13513         {&hf_cflow_version,
13514          {"Version", "cflow.version",
13515           FT_UINT16, BASE_DEC, NULL, 0x0,
13516           "NetFlow Version", HFILL}
13517         },
13518         {&hf_cflow_len,
13519          {"Length", "cflow.len",
13520           FT_UINT16, BASE_DEC, NULL, 0x0,
13521           "Length of PDUs", HFILL}
13522         },
13523         {&hf_cflow_count,
13524          {"Count", "cflow.count",
13525           FT_UINT16, BASE_DEC, NULL, 0x0,
13526           "Count of PDUs", HFILL}
13527         },
13528         {&hf_cflow_sysuptime,
13529          {"SysUptime", "cflow.sysuptime",
13530           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
13531           "Time since router booted (in seconds)", HFILL}
13532         },
13533         {&hf_cflow_exporttime,
13534          {"ExportTime", "cflow.exporttime",
13535           FT_UINT32, BASE_DEC, NULL, 0x0,
13536           "Time when the flow has been exported", HFILL}
13537         },
13538         {&hf_cflow_timestamp,
13539          {"Timestamp", "cflow.timestamp",
13540           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
13541           "Current seconds since epoch", HFILL}
13542         },
13543         {&hf_cflow_unix_secs,
13544          {"CurrentSecs", "cflow.unix_secs",
13545           FT_UINT32, BASE_DEC, NULL, 0x0,
13546           "Current seconds since epoch", HFILL}
13547         },
13548         {&hf_cflow_unix_nsecs,
13549          {"CurrentNSecs", "cflow.unix_nsecs",
13550           FT_UINT32, BASE_DEC, NULL, 0x0,
13551           "Residual nanoseconds since epoch", HFILL}
13552         },
13553         {&hf_cflow_samplingmode,
13554          {"SamplingMode", "cflow.samplingmode",
13555           FT_UINT16, BASE_DEC, VALS(v5_sampling_mode), 0xC000,
13556           "Sampling Mode of exporter", HFILL}
13557         },
13558         {&hf_cflow_samplerate,
13559          {"SampleRate", "cflow.samplerate",
13560           FT_UINT16, BASE_DEC, NULL, 0x3FFF,
13561           "Sample Frequency of exporter", HFILL}
13562         },
13563
13564         /*
13565          * end version-agnostic header
13566          * version-specific flow header
13567          */
13568         {&hf_cflow_sequence,
13569          {"FlowSequence", "cflow.sequence",
13570           FT_UINT32, BASE_DEC, NULL, 0x0,
13571           "Sequence number of flows seen", HFILL}
13572         },
13573         {&hf_cflow_engine_type,
13574          {"EngineType", "cflow.engine_type",
13575           FT_UINT8, BASE_DEC, VALS(engine_type), 0x0,
13576           "Flow switching engine type", HFILL}
13577         },
13578         {&hf_cflow_engine_id,
13579          {"EngineId", "cflow.engine_id",
13580           FT_UINT8, BASE_DEC, NULL, 0x0,
13581           "Slot number of switching engine", HFILL}
13582         },
13583         {&hf_cflow_source_id,
13584          {"SourceId", "cflow.source_id",
13585           FT_UINT32, BASE_DEC, NULL, 0x0,
13586           "Identifier for export device", HFILL}
13587         },
13588         {&hf_cflow_aggmethod,
13589          {"AggMethod", "cflow.aggmethod",
13590           FT_UINT8, BASE_DEC|BASE_EXT_STRING, &v8_agg_ext, 0x0,
13591           "CFlow V8 Aggregation Method", HFILL}
13592         },
13593         {&hf_cflow_aggversion,
13594          {"AggVersion", "cflow.aggversion",
13595           FT_UINT8, BASE_DEC, NULL, 0x0,
13596           "CFlow V8 Aggregation Version", HFILL}
13597         },
13598         /*
13599          * end version specific header storage
13600          */
13601         /*
13602          * Version 9
13603          */
13604         {&hf_cflow_flowset_id,
13605          {"FlowSet Id", "cflow.flowset_id",
13606           FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(rs_flowset_ids), 0x0,
13607           NULL, HFILL}
13608         },
13609         {&hf_cflow_flowset_length,
13610          {"FlowSet Length", "cflow.flowset_length",
13611           FT_UINT16, BASE_DEC, NULL, 0x0,
13612           "FlowSet Length in bytes", HFILL}
13613         },
13614         {&hf_cflow_template_id,
13615          {"Template Id", "cflow.template_id",
13616           FT_UINT16, BASE_DEC, NULL, 0x0,
13617           NULL, HFILL}
13618         },
13619         {&hf_cflow_template_field_count,
13620          {"Field Count", "cflow.template_field_count",
13621           FT_UINT16, BASE_DEC, NULL, 0x0,
13622           "Template field count", HFILL}
13623         },
13624         {&hf_cflow_template_field_type,
13625          {"Type", "cflow.template_field_type",
13626           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v9_v10_template_types_ext, 0x0,
13627           "Template field type", HFILL}
13628         },
13629         {&hf_cflow_template_field_length,
13630          {"Length", "cflow.template_field_length",
13631           FT_UINT16, BASE_DEC, NULL, 0x0,
13632           "Template field length", HFILL}
13633         },
13634         {&hf_cflow_subtemplate_id,
13635          {"SubTemplateList Id", "cflow.subtemplate_id",
13636           FT_UINT16, BASE_DEC, NULL, 0x0,
13637           "ID of the Template used to encode and decode"
13638           " the subTemplateList Content", HFILL}
13639         },
13640         {&hf_cflow_subtemplate_semantic,
13641          {"SubTemplateList Semantic", "cflow.subtemplate_semantic",
13642           FT_UINT8, BASE_DEC, NULL, 0x0,
13643           "Indicates the relationship among the different Data Records"
13644           " within this Structured Data Information Element", HFILL}
13645         },
13646
13647         /* options */
13648         {&hf_cflow_option_scope_length,
13649          {"Option Scope Length", "cflow.option_scope_length",
13650           FT_UINT16, BASE_DEC, NULL, 0x0,
13651           NULL, HFILL}
13652         },
13653         {&hf_cflow_option_length,
13654          {"Option Length", "cflow.option_length",
13655           FT_UINT16, BASE_DEC, NULL, 0x0,
13656           NULL, HFILL}
13657         },
13658         {&hf_cflow_template_scope_field_type,
13659          {"Scope Type", "cflow.scope_field_type",
13660           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v9_scope_field_types_ext, 0x0,
13661           "Scope field type", HFILL}
13662         },
13663         {&hf_cflow_icmp_type_code_ipv4,
13664          {"ICMP Type", "cflow.icmp_type_code_ipv4",
13665           FT_UINT16, BASE_HEX, NULL, 0x0,
13666           NULL, HFILL}
13667         },
13668         {&hf_cflow_igmp_type,
13669          {"IGMP Type", "cflow.igmp_type",
13670           FT_UINT8, BASE_DEC, NULL, 0x0,
13671           NULL, HFILL}
13672         },
13673         {&hf_cflow_sampling_interval,
13674          {"Sampling interval", "cflow.sampling_interval",
13675           FT_UINT32, BASE_DEC, NULL, 0x0,
13676           NULL, HFILL}
13677         },
13678         {&hf_cflow_sampling_algorithm,
13679          {"Sampling algorithm", "cflow.sampling_algorithm",
13680           FT_UINT8, BASE_DEC, VALS(ipfix_sampling_mode), 0x0,
13681           NULL, HFILL}
13682         },
13683         {&hf_cflow_flow_active_timeout,
13684          {"Flow active timeout", "cflow.flow_active_timeout",
13685           FT_UINT16, BASE_DEC, NULL, 0x0,
13686           NULL, HFILL}
13687         },
13688         {&hf_cflow_flow_inactive_timeout,
13689          {"Flow inactive timeout", "cflow.flow_inactive_timeout",
13690           FT_UINT16, BASE_DEC, NULL, 0x0,
13691           NULL, HFILL}
13692         },
13693
13694         /*
13695          * begin pdu content storage
13696          */
13697         {&hf_cflow_srcaddr,
13698          {"SrcAddr", "cflow.srcaddr",
13699           FT_IPv4, BASE_NONE, NULL, 0x0,
13700           "Flow Source Address (IPv4)", HFILL}
13701         },
13702         {&hf_cflow_srcaddr_v6,
13703          {"SrcAddr", "cflow.srcaddrv6",
13704           FT_IPv6, BASE_NONE, NULL, 0x0,
13705           "Flow Source Address (IPv6)", HFILL}
13706         },
13707         {&hf_cflow_srcnet,
13708          {"SrcNet", "cflow.srcnet",
13709           FT_IPv4, BASE_NONE, NULL, 0x0,
13710           "Flow Source Network", HFILL}
13711         },
13712         {&hf_cflow_dstaddr,
13713          {"DstAddr", "cflow.dstaddr",
13714           FT_IPv4, BASE_NONE, NULL, 0x0,
13715           "Flow Destination Address (IPv4)", HFILL}
13716         },
13717         {&hf_cflow_dstaddr_v6,
13718          {"DstAddr", "cflow.dstaddrv6",
13719           FT_IPv6, BASE_NONE, NULL, 0x0,
13720           "Flow Destination Address (IPv6)", HFILL}
13721         },
13722         {&hf_cflow_dstnet,
13723          {"DstNet", "cflow.dstnet",
13724           FT_IPv4, BASE_NONE, NULL, 0x0,
13725           "Flow Destination Network", HFILL}
13726         },
13727         {&hf_cflow_nexthop,
13728          {"NextHop", "cflow.nexthop",
13729           FT_IPv4, BASE_NONE, NULL, 0x0,
13730           "Router nexthop (IPv4)", HFILL}
13731         },
13732         {&hf_cflow_nexthop_v6,
13733          {"NextHop", "cflow.nexthopv6",
13734           FT_IPv6, BASE_NONE, NULL, 0x0,
13735           "Router nexthop (IPv6)", HFILL}
13736         },
13737         {&hf_cflow_bgpnexthop,
13738          {"BGPNextHop", "cflow.bgpnexthop",
13739           FT_IPv4, BASE_NONE, NULL, 0x0,
13740           "BGP Router Nexthop (IPv4)", HFILL}
13741         },
13742         {&hf_cflow_bgpnexthop_v6,
13743          {"BGPNextHop", "cflow.bgpnexthopv6",
13744           FT_IPv6, BASE_NONE, NULL, 0x0,
13745           "BGP Router Nexthop (IPv6)", HFILL}
13746         },
13747         {&hf_cflow_inputint,
13748          {"InputInt", "cflow.inputint",
13749           FT_UINT32, BASE_DEC, NULL, 0x0,
13750           "Flow Input Interface", HFILL}
13751         },
13752         {&hf_cflow_outputint,
13753          {"OutputInt", "cflow.outputint",
13754           FT_UINT32, BASE_DEC, NULL, 0x0,
13755           "Flow Output Interface", HFILL}
13756         },
13757         {&hf_cflow_flows,
13758          {"Flows", "cflow.flows",
13759           FT_UINT64, BASE_DEC, NULL, 0x0,
13760           "Flows Aggregated in PDU", HFILL}
13761         },
13762         {&hf_cflow_packets,
13763          {"Packets", "cflow.packets",
13764           FT_UINT64, BASE_DEC, NULL, 0x0,
13765           "Count of packets in flow", HFILL}
13766         },
13767         {&hf_cflow_octets,
13768          {"Octets", "cflow.octets",
13769           FT_UINT64, BASE_DEC, NULL, 0x0,
13770           "Count of bytes in flow", HFILL}
13771         },
13772         {&hf_cflow_length_min,
13773          {"MinLength", "cflow.length_min",
13774           FT_UINT64, BASE_DEC, NULL, 0x0,
13775           "Packet Length Min", HFILL}
13776         },
13777         {&hf_cflow_length_max,
13778          {"MaxLength", "cflow.length_max",
13779           FT_UINT64, BASE_DEC, NULL, 0x0,
13780           "Packet Length Max", HFILL}
13781         },
13782         {&hf_cflow_timedelta,
13783          {"Duration", "cflow.timedelta",
13784           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
13785           "Duration of flow sample (end - start) in seconds", HFILL}
13786         },
13787         {&hf_cflow_timestart,
13788          {"StartTime", "cflow.timestart",
13789           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
13790           "Uptime at start of flow", HFILL}
13791         },
13792         {&hf_cflow_timeend,
13793          {"EndTime", "cflow.timeend",
13794           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
13795           "Uptime at end of flow", HFILL}
13796         },
13797         /* TODO: allow transport lookup on these ports, assuming have already read protocol? */
13798         {&hf_cflow_srcport,
13799          {"SrcPort", "cflow.srcport",
13800           FT_UINT16, BASE_DEC, NULL, 0x0,
13801           "Flow Source Port", HFILL}
13802         },
13803         {&hf_cflow_dstport,
13804          {"DstPort", "cflow.dstport",
13805           FT_UINT16, BASE_DEC, NULL, 0x0,
13806           "Flow Destination Port", HFILL}
13807         },
13808         {&hf_cflow_prot,
13809          {"Protocol", "cflow.protocol",
13810           FT_UINT8, BASE_DEC | BASE_EXT_STRING, &ipproto_val_ext, 0x0,
13811           "IP Protocol", HFILL}
13812         },
13813         {&hf_cflow_tos,
13814          {"IP ToS", "cflow.tos",
13815           FT_UINT8, BASE_HEX, NULL, 0x0,
13816           "IP Type of Service", HFILL}
13817         },
13818         {&hf_cflow_marked_tos,
13819          {"Marked ToS", "cflow.marked_tos",
13820           FT_BYTES, BASE_NONE, NULL, 0x0,
13821           NULL, HFILL}
13822         },
13823         {&hf_cflow_flags,
13824          {"Export Flags", "cflow.flags",
13825           FT_UINT8, BASE_HEX, NULL, 0x0,
13826           "CFlow Flags", HFILL}
13827         },
13828         {&hf_cflow_tcpflags,
13829          {"TCP Flags", "cflow.tcpflags",
13830           FT_UINT8, BASE_HEX, NULL, 0x0,
13831           NULL, HFILL}
13832         },
13833         {&hf_cflow_tcpflags16,
13834          {"TCP Flags", "cflow.tcpflags",
13835           FT_UINT16, BASE_HEX, NULL, 0x0,
13836           NULL, HFILL}
13837         },
13838         {&hf_cflow_tcpflags_fin,
13839          {"FIN", "cflow.tcpflags.fin",
13840           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x01,
13841           NULL, HFILL}
13842         },
13843         {&hf_cflow_tcpflags_syn,
13844          {"SYN", "cflow.tcpflags.syn",
13845           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x02,
13846           NULL, HFILL}
13847         },
13848         {&hf_cflow_tcpflags_rst,
13849          {"RST", "cflow.tcpflags.rst",
13850           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x04,
13851           NULL, HFILL}
13852         },
13853         {&hf_cflow_tcpflags_psh,
13854          {"PSH", "cflow.tcpflags.psh",
13855           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x08,
13856           NULL, HFILL}
13857         },
13858         {&hf_cflow_tcpflags_ack,
13859          {"ACK", "cflow.tcpflags.ack",
13860           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x10,
13861           NULL, HFILL}
13862         },
13863         {&hf_cflow_tcpflags_urg,
13864          {"URG", "cflow.tcpflags.urg",
13865           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x20,
13866           NULL, HFILL}
13867         },
13868         {&hf_cflow_tcpflags_ece,
13869          {"ECN Echo", "cflow.tcpflags.ece",
13870           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x40,
13871           NULL, HFILL}
13872         },
13873         {&hf_cflow_tcpflags_cwr,
13874          {"CWR", "cflow.tcpflags.cwr",
13875           FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x80,
13876           NULL, HFILL}
13877         },
13878         {&hf_cflow_tcpflags16_fin,
13879          {"FIN", "cflow.tcpflags.fin",
13880           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0001,
13881           NULL, HFILL}
13882         },
13883         {&hf_cflow_tcpflags16_syn,
13884          {"SYN", "cflow.tcpflags.syn",
13885           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0002,
13886           NULL, HFILL}
13887         },
13888         {&hf_cflow_tcpflags16_rst,
13889          {"RST", "cflow.tcpflags.rst",
13890           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0004,
13891           NULL, HFILL}
13892         },
13893         {&hf_cflow_tcpflags16_psh,
13894          {"PSH", "cflow.tcpflags.psh",
13895           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0008,
13896           NULL, HFILL}
13897         },
13898         {&hf_cflow_tcpflags16_ack,
13899          {"ACK", "cflow.tcpflags.ack",
13900           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0010,
13901           NULL, HFILL}
13902         },
13903         {&hf_cflow_tcpflags16_urg,
13904          {"URG", "cflow.tcpflags.urg",
13905           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0020,
13906           NULL, HFILL}
13907         },
13908         {&hf_cflow_tcpflags16_ece,
13909          {"ECN Echo", "cflow.tcpflags.ece",
13910           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0040,
13911           NULL, HFILL}
13912         },
13913         {&hf_cflow_tcpflags16_cwr,
13914          {"CWR", "cflow.tcpflags.cwr",
13915           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0080,
13916           NULL, HFILL}
13917         },
13918         {&hf_cflow_tcpflags16_ns,
13919          {"ECN Nonce Sum", "cflow.tcpflags.ns",
13920           FT_BOOLEAN, 16, TFS(&tfs_used_notused), 0x0100,
13921           NULL, HFILL}
13922         },
13923         {&hf_cflow_tcpflags_reserved,
13924          {"Reserved", "cflow.tcpflags.reserved",
13925           FT_UINT8, BASE_HEX, NULL, 0xc0,
13926           NULL, HFILL}
13927         },
13928         {&hf_cflow_tcpflags16_reserved,
13929          {"Reserved", "cflow.tcpflags.reserved",
13930           FT_UINT16, BASE_HEX, NULL, 0x0e00,
13931           NULL, HFILL}
13932         },
13933         {&hf_cflow_tcpflags16_zero,
13934          {"Zero (Header Length)", "cflow.tcpflags.zero",
13935           FT_UINT16, BASE_HEX, NULL, 0xf000,
13936           NULL, HFILL}
13937         },
13938         {&hf_cflow_srcas,
13939          {"SrcAS", "cflow.srcas",
13940           FT_UINT32, BASE_DEC, NULL, 0x0,
13941           "Source AS", HFILL}
13942         },
13943         {&hf_cflow_dstas,
13944          {"DstAS", "cflow.dstas",
13945           FT_UINT32, BASE_DEC, NULL, 0x0,
13946           "Destination AS", HFILL}
13947         },
13948         {&hf_cflow_srcmask,
13949          {"SrcMask", "cflow.srcmask",
13950           FT_UINT8, BASE_DEC, NULL, 0x0,
13951           "Source Prefix Mask", HFILL}
13952         },
13953         {&hf_cflow_srcmask_v6,
13954          {"SrcMask", "cflow.srcmaskv6",
13955           FT_UINT8, BASE_DEC, NULL, 0x0,
13956           "IPv6 Source Prefix Mask", HFILL}
13957         },
13958         {&hf_cflow_dstmask,
13959          {"DstMask", "cflow.dstmask",
13960           FT_UINT8, BASE_DEC, NULL, 0x0,
13961           "Destination Prefix Mask", HFILL}
13962         },
13963         {&hf_cflow_dstmask_v6,
13964          {"DstMask", "cflow.dstmaskv6",
13965           FT_UINT8, BASE_DEC, NULL, 0x0,
13966           "IPv6 Destination Prefix Mask", HFILL}
13967         },
13968         {&hf_cflow_routersc,
13969          {"Router Shortcut", "cflow.routersc",
13970           FT_IPv4, BASE_NONE, NULL, 0x0,
13971           "Router shortcut by switch", HFILL}
13972         },
13973         {&hf_cflow_mulpackets,
13974          {"MulticastPackets", "cflow.mulpackets",
13975           FT_UINT64, BASE_DEC, NULL, 0x0,
13976           "Count of multicast packets", HFILL}
13977         },
13978         {&hf_cflow_muloctets,
13979          {"MulticastOctets", "cflow.muloctets",
13980           FT_UINT64, BASE_DEC, NULL, 0x0,
13981           "Count of multicast octets", HFILL}
13982         },
13983         {&hf_cflow_octets_exp,
13984          {"OctetsExp", "cflow.octetsexp",
13985           FT_UINT64, BASE_DEC, NULL, 0x0,
13986           "Octets exported", HFILL}
13987         },
13988         {&hf_cflow_packets_exp,
13989          {"PacketsExp", "cflow.packetsexp",
13990           FT_UINT64, BASE_DEC, NULL, 0x0,
13991           "Packets exported", HFILL}
13992         },
13993         {&hf_cflow_flows_exp,
13994          {"FlowsExp", "cflow.flowsexp",
13995           FT_UINT64, BASE_DEC, NULL, 0x0,
13996           "Flows exported", HFILL}
13997         },
13998         {&hf_cflow_ipv4_router_sc,
13999          {"ipv4RouterSc", "cflow.ipv4_router_sc",
14000           FT_IPv4, BASE_NONE, NULL, 0x0,
14001           "ipv4 Router Shortcut", HFILL}
14002         },
14003         {&hf_cflow_srcprefix,
14004          {"SrcPrefix", "cflow.srcprefix",
14005           FT_IPv4, BASE_NONE, NULL, 0x0,
14006           "Flow Source Prefix", HFILL}
14007         },
14008         {&hf_cflow_dstprefix,
14009          {"DstPrefix", "cflow.dstprefix",
14010           FT_IPv4, BASE_NONE, NULL, 0x0,
14011           "Flow Destination Prefix", HFILL}
14012         },
14013         {&hf_cflow_mpls_top_label_type,
14014          {"TopLabelType", "cflow.toplabeltype",
14015           FT_UINT8, BASE_DEC, VALS(special_mpls_top_label_type), 0x0,
14016           "Top MPLS label Type", HFILL}
14017         },
14018         {&hf_cflow_mpls_pe_addr,
14019          {"TopLabelAddr", "cflow.toplabeladdr",
14020           FT_IPv4, BASE_NONE, NULL, 0x0,
14021           "Top MPLS label PE address", HFILL}
14022         },
14023         {&hf_cflow_sampler_id,
14024          {"SamplerID", "cflow.sampler_id",
14025           FT_UINT8, BASE_DEC, NULL, 0x0,
14026           "Flow Sampler ID", HFILL}
14027         },
14028         {&hf_cflow_sampler_mode,
14029          {"SamplerMode", "cflow.sampler_mode",
14030           FT_UINT8, BASE_DEC, VALS(v9_sampler_mode), 0x0,
14031           "Flow Sampler Mode", HFILL}
14032         },
14033         {&hf_cflow_sampler_random_interval,
14034          {"SamplerRandomInterval", "cflow.sampler_random_interval",
14035           FT_UINT32, BASE_DEC, NULL, 0x0,
14036           "Flow Sampler Random Interval", HFILL}
14037         },
14038         {&hf_cflow_flow_class,
14039          {"FlowClass", "cflow.flow_class",
14040           FT_UINT8, BASE_DEC, NULL, 0x0,
14041           "Flow Class", HFILL}
14042         },
14043         {&hf_cflow_ttl_minimum,
14044          {"MinTTL", "cflow.ttl_min",
14045           FT_UINT8, BASE_DEC, NULL, 0x0,
14046           "TTL minimum", HFILL}
14047         },
14048         {&hf_cflow_ttl_maximum,
14049          {"MaxTTL", "cflow.ttl_max",
14050           FT_UINT8, BASE_DEC, NULL, 0x0,
14051           "TTL maximum", HFILL}
14052         },
14053         {&hf_cflow_frag_id,
14054          {"fragIdent", "cflow.frag_ident",
14055           FT_UINT32, BASE_DEC, NULL, 0x0,
14056           "Fragment Identifier", HFILL}
14057         },
14058         {&hf_cflow_ip_version,
14059          {"IPVersion", "cflow.ip_version",
14060           FT_UINT8, BASE_DEC, NULL, 0x0,
14061           "IP Version", HFILL}
14062         },
14063         {&hf_cflow_direction,
14064          {"Direction", "cflow.direction",
14065           FT_UINT8, BASE_DEC, VALS(v9_direction), 0x0,
14066           NULL, HFILL}
14067         },
14068         {&hf_cflow_if_name,
14069          {"IfName", "cflow.if_name",
14070           FT_STRING, BASE_NONE, NULL, 0x0,
14071           "SNMP Interface Name", HFILL}
14072         },
14073         {&hf_cflow_if_descr,
14074          {"IfDescr", "cflow.if_descr",
14075           FT_STRING, BASE_NONE, NULL, 0x0,
14076           "SNMP Interface Description", HFILL}
14077         },
14078         {&hf_cflow_sampler_name,
14079          {"SamplerName", "cflow.sampler_name",
14080           FT_STRING, BASE_NONE, NULL, 0x0,
14081           "Sampler Name", HFILL}
14082         },
14083         {&hf_cflow_forwarding_status,
14084          {"ForwardingStatus", "cflow.forwarding_status",
14085           FT_UINT8, BASE_DEC, VALS(v9_forwarding_status), 0xC0,
14086           "Forwarding Status", HFILL}
14087         },
14088         {&hf_cflow_forwarding_status_unknown_code,
14089          {"ForwardingStatusUnknown", "cflow.forwarding_status_unknown_code",
14090           FT_UINT8, BASE_DEC, VALS(v9_forwarding_status_unknown_code), 0x3F,
14091           NULL, HFILL}
14092         },
14093         {&hf_cflow_forwarding_status_forward_code,
14094          {"ForwardingStatusForwardCode", "cflow.forwarding_status_forward_code",
14095           FT_UINT8, BASE_DEC, VALS(v9_forwarding_status_forward_code), 0x3F,
14096           NULL, HFILL}
14097         },
14098         {&hf_cflow_forwarding_status_drop_code,
14099          {"ForwardingStatusDropCode", "cflow.forwarding_status_drop_code",
14100           FT_UINT8, BASE_DEC, VALS(v9_forwarding_status_drop_code), 0x3F,
14101           NULL, HFILL}
14102         },
14103         {&hf_cflow_forwarding_status_consume_code,
14104          {"ForwardingStatusConsumeCode", "cflow.forwarding_status_consume_code",
14105           FT_UINT8, BASE_DEC, VALS(v9_forwarding_status_consume_code), 0x3F,
14106           NULL, HFILL}
14107         },
14108         {&hf_cflow_nbar_appl_desc,
14109          {"ApplicationDesc", "cflow.appl_desc",
14110           FT_STRING, BASE_NONE, NULL, 0x0,
14111           "Application Desc (NBAR)", HFILL}
14112         },
14113         {&hf_cflow_nbar_appl_id_class_eng_id,
14114          {"Classification Engine ID", "cflow.appl_id.classification_engine_id",
14115           FT_UINT8, BASE_DEC, VALS(classification_engine_types), 0x0,
14116           "Application ID", HFILL}
14117         },
14118         {&hf_cflow_nbar_appl_id_selector_id,
14119          {"Selector ID", "cflow.appl_id.selector_id",
14120           FT_BYTES, BASE_NONE, NULL, 0x0,
14121           "Application ID", HFILL}
14122         },
14123         {&hf_cflow_nbar_appl_name,
14124          {"ApplicationName", "cflow.appl_name",
14125           FT_STRING, BASE_NONE, NULL, 0x0,
14126           "Application Name (NBAR)", HFILL}
14127         },
14128         {&hf_cflow_peer_srcas,
14129          {"PeerSrcAS", "cflow.peer_srcas",
14130           FT_UINT32, BASE_DEC, NULL, 0x0,
14131           "Peer Source AS", HFILL}
14132         },
14133         {&hf_cflow_peer_dstas,
14134          {"PeerDstAS", "cflow.peer_dstas",
14135           FT_UINT32, BASE_DEC, NULL, 0x0,
14136           "Peer Destination AS", HFILL}
14137         },
14138         {&hf_cflow_flow_exporter,
14139          {"FlowExporter", "cflow.flow_exporter",
14140           FT_UINT32, BASE_DEC, NULL, 0x0,
14141           NULL, HFILL}
14142         },
14143         {&hf_cflow_icmp_ipv4_type,
14144          {"IPv4 ICMP Type", "cflow.icmp_ipv4_type",
14145           FT_UINT8, BASE_DEC, NULL, 0x0,
14146           NULL, HFILL}
14147         },
14148         {&hf_cflow_icmp_ipv4_code,
14149          {"IPv4 ICMP Code", "cflow.icmp_ipv4_code",
14150           FT_UINT8, BASE_DEC, NULL, 0x0,
14151           NULL, HFILL}
14152         },
14153         {&hf_cflow_icmp_ipv6_type,
14154          {"IPv6 ICMP Type", "cflow.icmp_ipv6_type",
14155           FT_UINT8, BASE_DEC, NULL, 0x0,
14156           NULL, HFILL}
14157         },
14158         {&hf_cflow_icmp_ipv6_code,
14159          {"IPv6 ICMP Code", "cflow.icmp_ipv6_code",
14160           FT_UINT8, BASE_DEC, NULL, 0x0,
14161           NULL, HFILL}
14162         },
14163         {&hf_cflow_tcp_window_size,
14164          {"TCP Windows Size", "cflow.tcp_windows_size",
14165           FT_UINT16, BASE_DEC, NULL, 0x0,
14166           NULL, HFILL}
14167         },
14168         {&hf_cflow_ipv4_total_length,
14169          {"IPV4 Total Length", "cflow.ipv4_total_length",
14170           FT_UINT16, BASE_DEC, NULL, 0x0,
14171           NULL, HFILL}
14172         },
14173         {&hf_cflow_ip_ttl,
14174          {"IP TTL", "cflow.ip_ttl",
14175           FT_UINT8, BASE_DEC, NULL, 0x0,
14176           "IP time to live", HFILL}
14177         },
14178         {&hf_cflow_mpls_payload_length,
14179          {"mplsPayloadLength", "cflow.mpls_payload_length",
14180           FT_UINT32, BASE_DEC, NULL, 0x0,
14181           NULL, HFILL}
14182         },
14183         {&hf_cflow_ip_dscp,
14184          {"DSCP", "cflow.ip_dscp",
14185           FT_UINT8, BASE_DEC, NULL, 0x0,
14186           NULL, HFILL}
14187         },
14188         {&hf_cflow_delta_octets_squared,
14189          {"DeltaOctetsSquared", "cflow.delta_octets_squared",
14190           FT_UINT64, BASE_DEC, NULL, 0x0,
14191           NULL, HFILL}
14192         },
14193         {&hf_cflow_total_octets_squared,
14194          {"TotalOctetsSquared", "cflow.total_octets_squared",
14195           FT_UINT64, BASE_DEC, NULL, 0x0,
14196           NULL, HFILL}
14197         },
14198         {&hf_cflow_udp_length,
14199          {"UDP Length", "cflow.udp_length",
14200           FT_UINT16, BASE_DEC, NULL, 0x0,
14201           NULL, HFILL}
14202         },
14203         {&hf_cflow_is_multicast,
14204          {"IsMulticast", "cflow.is_multicast",
14205           FT_UINT8, BASE_HEX, NULL, 0x0,
14206           NULL, HFILL}
14207         },
14208         {&hf_cflow_ip_header_words,
14209          {"IPHeaderLen", "cflow.ip_header_words",
14210           FT_UINT8, BASE_DEC, NULL, 0x0,
14211           NULL, HFILL}
14212         },
14213         {&hf_cflow_option_map,
14214          {"OptionMap", "cflow.option_map",
14215           FT_BYTES, BASE_NONE, NULL, 0x0,
14216           NULL, HFILL}
14217         },
14218         {&hf_cflow_section_header,
14219          {"SectionHeader", "cflow.section_header",
14220           FT_BYTES, BASE_NONE, NULL, 0x0,
14221           "Header of Packet", HFILL}
14222         },
14223         {&hf_cflow_section_payload,
14224          {"SectionPayload", "cflow.section_payload",
14225           FT_BYTES, BASE_NONE, NULL, 0x0,
14226           "Payload of Packet", HFILL}
14227         },
14228         /* IPFIX Information Elements */
14229         {&hf_cflow_post_octets,
14230          {"Post Octets", "cflow.post_octets",
14231           FT_UINT64, BASE_DEC, NULL, 0x0,
14232           "Count of post bytes", HFILL}
14233         },
14234         {&hf_cflow_post_packets,
14235          {"Post Packets", "cflow.post_packets",
14236           FT_UINT64, BASE_DEC, NULL, 0x0,
14237           "Count of post packets", HFILL}
14238         },
14239         {&hf_cflow_ipv6_flowlabel,
14240          {"ipv6FlowLabel", "cflow.ipv6flowlabel",
14241           FT_UINT32, BASE_DEC, NULL, 0x0,
14242           "IPv6 Flow Label", HFILL}
14243         },
14244         {&hf_cflow_post_tos,
14245          {"Post IP ToS", "cflow.post_tos",
14246           FT_UINT8, BASE_HEX, NULL, 0x0,
14247           "Post IP Type of Service", HFILL}
14248         },
14249         {&hf_cflow_srcmac,
14250          {"Source Mac Address", "cflow.srcmac",
14251           FT_ETHER, BASE_NONE, NULL, 0x0,
14252           NULL, HFILL}
14253         },
14254         {&hf_cflow_post_dstmac,
14255          {"Post Destination Mac Address", "cflow.post_dstmac",
14256           FT_ETHER, BASE_NONE, NULL, 0x0,
14257           NULL, HFILL}
14258         },
14259         {&hf_cflow_vlanid,
14260          {"Vlan Id", "cflow.vlanid",
14261           FT_UINT16, BASE_DEC, NULL, 0x0,
14262           NULL, HFILL}
14263         },
14264         {&hf_cflow_post_vlanid,
14265          {"Post Vlan Id", "cflow.post_vlanid",
14266           FT_UINT16, BASE_DEC, NULL, 0x0,
14267           NULL, HFILL}
14268         },
14269         {&hf_cflow_ipv6_exthdr,
14270          {"IPv6 Extension Headers", "cflow.ipv6_exthdr",
14271           FT_UINT32, BASE_HEX, NULL, 0x0,
14272           NULL, HFILL}
14273         },
14274         {&hf_cflow_dstmac,
14275          {"Destination Mac Address", "cflow.dstmac",
14276           FT_ETHER, BASE_NONE, NULL, 0x0,
14277           NULL, HFILL}
14278         },
14279         {&hf_cflow_post_srcmac,
14280          {"Post Source Mac Address", "cflow.post_srcmac",
14281           FT_ETHER, BASE_NONE, NULL, 0x0,
14282           NULL, HFILL}
14283         },
14284         {&hf_cflow_permanent_packets,
14285          {"Permanent Packets", "cflow.permanent_packets",
14286           FT_UINT64, BASE_DEC, NULL, 0x0,
14287           "Running Count of packets for permanent flows", HFILL}
14288         },
14289         {&hf_cflow_permanent_octets,
14290          {"Permanent Octets", "cflow.permanent_octets",
14291           FT_UINT64, BASE_DEC, NULL, 0x0,
14292           "Running Count of bytes for permanent flows", HFILL}
14293         },
14294         {&hf_cflow_fragment_offset,
14295          {"Fragment Offset", "cflow.fragment_offset",
14296           FT_UINT16, BASE_DEC, NULL, 0x0,
14297           NULL, HFILL}
14298         },
14299         {&hf_cflow_mpls_vpn_rd,
14300          {"MPLS VPN RD", "cflow.mpls_vpn_rd",
14301           FT_BYTES, BASE_NONE, NULL, 0x0,
14302           "MPLS VPN Route Distinguisher", HFILL}
14303         },
14304         {&hf_cflow_mpls_top_label_prefix_length,
14305          {"MPLS Top Label Prefix Length", "cflow.mpls_top_label_prefix_length",
14306           FT_UINT8, BASE_DEC, NULL, 0x0,
14307           NULL, HFILL}
14308         },
14309         {&hf_cflow_src_traffic_index,
14310          {"Src Traffic Index", "cflow.src_traffic_index",
14311           FT_UINT32, BASE_DEC, NULL, 0x0,
14312           NULL, HFILL}
14313         },
14314         {&hf_cflow_dst_traffic_index,
14315          {"Dst Traffic Index", "cflow.dst_traffic_index",
14316           FT_UINT32, BASE_DEC, NULL, 0x0,
14317           NULL, HFILL}
14318         },
14319         {&hf_cflow_post_ip_diff_serv_code_point,
14320          {"Post Ip Diff Serv Code Point", "cflow.post_ip_diff_serv_code_point",
14321           FT_UINT8, BASE_DEC, NULL, 0x0,
14322           NULL, HFILL}
14323         },
14324         {&hf_cflow_multicast_replication_factor,
14325          {"Multicast Replication Factor", "cflow.multicast_replication_factor",
14326           FT_UINT32, BASE_DEC, NULL, 0x0,
14327           NULL, HFILL}
14328         },
14329         {&hf_cflow_classification_engine_id,
14330          {"Classification Engine Id", "cflow.classification_engine_id",
14331           FT_UINT8, BASE_DEC, NULL, 0x0,
14332           NULL, HFILL}
14333         },
14334         {&hf_cflow_exporter_addr,
14335          {"ExporterAddr", "cflow.exporter_addr",
14336           FT_IPv4, BASE_NONE, NULL, 0x0,
14337           "Flow Exporter Address", HFILL}
14338         },
14339         {&hf_cflow_exporter_addr_v6,
14340          {"ExporterAddr", "cflow.exporter_addr_v6",
14341           FT_IPv6, BASE_NONE, NULL, 0x0,
14342           "Flow Exporter Address", HFILL}
14343         },
14344         {&hf_cflow_drop_octets,
14345          {"Dropped Octets", "cflow.drop_octets",
14346           FT_UINT64, BASE_DEC, NULL, 0x0,
14347           "Count of dropped bytes", HFILL}
14348         },
14349         {&hf_cflow_drop_packets,
14350          {"Dropped Packets", "cflow.drop_packets",
14351           FT_UINT64, BASE_DEC, NULL, 0x0,
14352           "Count of dropped packets", HFILL}
14353         },
14354         {&hf_cflow_drop_total_octets,
14355          {"Dropped Total Octets", "cflow.drop_total_octets",
14356           FT_UINT64, BASE_DEC, NULL, 0x0,
14357           "Count of total dropped bytes", HFILL}
14358         },
14359         {&hf_cflow_drop_total_packets,
14360          {"Dropped Total Packets", "cflow.drop_total_packets",
14361           FT_UINT64, BASE_DEC, NULL, 0x0,
14362           "Count of total dropped packets", HFILL}
14363         },
14364         {&hf_cflow_flow_end_reason,
14365          {"Flow End Reason", "cflow.flow_end_reason",
14366           FT_UINT8, BASE_DEC, VALS(v9_flow_end_reason), 0x0,
14367           NULL, HFILL}
14368         },
14369         {&hf_cflow_common_properties_id,
14370          {"Common Properties Id", "cflow.common_properties_id",
14371           FT_UINT64, BASE_DEC, NULL, 0x0,
14372           NULL, HFILL}
14373         },
14374         {&hf_cflow_observation_point_id,
14375          {"Observation Point Id", "cflow.observation_point_id",
14376           FT_UINT64, BASE_DEC, NULL, 0x0,
14377           NULL, HFILL}
14378         },
14379         {&hf_cflow_mpls_pe_addr_v6,
14380          {"TopLabelAddr V6", "cflow.toplabeladdr_v6",
14381           FT_IPv6, BASE_NONE, NULL, 0x0,
14382           "Top MPLS label PE address IPv6", HFILL}
14383         },
14384         {&hf_cflow_port_id,
14385          {"Port Id", "cflow.port_id",
14386           FT_UINT32, BASE_DEC, NULL, 0x0,
14387           NULL, HFILL}
14388         },
14389         {&hf_cflow_mp_id,
14390          {"Metering Process Id", "cflow.mp_id",
14391           FT_UINT32, BASE_DEC, NULL, 0x0,
14392           NULL, HFILL}
14393         },
14394         {&hf_cflow_wlan_channel_id,
14395          {"Wireless LAN Channel Id", "cflow.wlan_channel_id",
14396           FT_UINT8, BASE_DEC, NULL, 0x0,
14397           NULL, HFILL}
14398         },
14399         {&hf_cflow_wlan_ssid,
14400          {"Wireless LAN SSId", "cflow.wlan_ssid",
14401           FT_STRING, BASE_NONE, NULL, 0x0,
14402           NULL, HFILL}
14403         },
14404         {&hf_cflow_flow_id,
14405          {"Flow Id", "cflow.flow_id",
14406           FT_UINT64, BASE_DEC, NULL, 0x0,
14407           NULL, HFILL}
14408         },
14409         {&hf_cflow_od_id,
14410          {"Observation Domain Id", "cflow.od_id",
14411           FT_UINT32, BASE_DEC, NULL, 0x0,
14412           "Identifier of an Observation Domain that is locally unique to an Exporting Process", HFILL}
14413         },
14414         {&hf_cflow_sys_init_time,
14415          {"System Init Time", "cflow.sys_init_time",
14416           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14417           NULL, HFILL}
14418         },
14419         {&hf_cflow_abstimestart,
14420          {"StartTime", "cflow.abstimestart",
14421           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14422           "Uptime at start of flow", HFILL}
14423         },
14424         {&hf_cflow_abstimeend,
14425          {"EndTime", "cflow.abstimeend",
14426           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14427           "Uptime at end of flow", HFILL}
14428         },
14429         {&hf_cflow_dstnet_v6,
14430          {"DstNet", "cflow.dstnetv6",
14431           FT_IPv6, BASE_NONE, NULL, 0x0,
14432           "Flow Destination Network (IPv6)", HFILL}
14433         },
14434         {&hf_cflow_srcnet_v6,
14435          {"SrcNet", "cflow.srcnetv6",
14436           FT_IPv6, BASE_NONE, NULL, 0x0,
14437           "Flow Source Network (IPv6)", HFILL}
14438         },
14439         {&hf_cflow_ignore_packets,
14440          {"Ignored Packets", "cflow.ignore_packets",
14441           FT_UINT64, BASE_DEC, NULL, 0x0,
14442           "Count of ignored packets", HFILL}
14443         },
14444         {&hf_cflow_ignore_octets,
14445          {"Ignored Octets", "cflow.ignore_octets",
14446           FT_UINT64, BASE_DEC, NULL, 0x0,
14447           "Count of ignored octets", HFILL}
14448         },
14449         {&hf_cflow_notsent_flows,
14450          {"Not Sent Flows", "cflow.notsent_flows",
14451           FT_UINT64, BASE_DEC, NULL, 0x0,
14452           "Count of not sent flows", HFILL}
14453         },
14454         {&hf_cflow_notsent_packets,
14455          {"Not Sent Packets", "cflow.notsent_packets",
14456           FT_UINT64, BASE_DEC, NULL, 0x0,
14457           "Count of not sent packets", HFILL}
14458         },
14459         {&hf_cflow_notsent_octets,
14460          {"Not Sent Octets", "cflow.notsent_octets",
14461           FT_UINT64, BASE_DEC, NULL, 0x0,
14462           "Count of not sent octets", HFILL}
14463         },
14464         {&hf_cflow_post_total_octets,
14465          {"Post Total Octets", "cflow.post_total_octets",
14466           FT_UINT64, BASE_DEC, NULL, 0x0,
14467           "Count of post total octets", HFILL}
14468         },
14469         {&hf_cflow_post_total_packets,
14470          {"Post Total Packets", "cflow.post_total_packets",
14471           FT_UINT64, BASE_DEC, NULL, 0x0,
14472           "Count of post total packets", HFILL}
14473         },
14474         {&hf_cflow_key,
14475          {"floKeyIndicator", "cflow.post_key",
14476           FT_BYTES, BASE_NONE, NULL, 0x0,
14477           "Flow Key Indicator", HFILL}
14478         },
14479         {&hf_cflow_post_total_mulpackets,
14480          {"Post Total Multicast Packets", "cflow.post_total_mulpackets",
14481           FT_UINT64, BASE_DEC, NULL, 0x0,
14482           "Count of post total multicast packets", HFILL}
14483         },
14484         {&hf_cflow_post_total_muloctets,
14485          {"Post Total Multicast Octets", "cflow.post_total_muloctets",
14486           FT_UINT64, BASE_DEC, NULL, 0x0,
14487           "Count of post total multicast octets", HFILL}
14488         },
14489         {&hf_cflow_tcp_seq_num,
14490          {"TCP Sequence Number", "cflow.tcp_seq_num",
14491           FT_UINT32, BASE_DEC, NULL, 0x0,
14492           NULL, HFILL}
14493         },
14494         {&hf_cflow_tcp_ack_num,
14495          {"TCP Acknowledgement Number", "cflow.tcp_ack_num",
14496           FT_UINT32, BASE_DEC, NULL, 0x0,
14497           NULL, HFILL}
14498         },
14499         {&hf_cflow_tcp_urg_ptr,
14500          {"TCP Urgent Pointer", "cflow.tcp_urg_ptr",
14501           FT_UINT16, BASE_DEC, NULL, 0x0,
14502           NULL, HFILL}
14503         },
14504         {&hf_cflow_tcp_header_length,
14505          {"TCP Header Length", "cflow.tcp_header_length",
14506           FT_UINT8, BASE_DEC, NULL, 0x0,
14507           NULL, HFILL}
14508         },
14509         {&hf_cflow_ip_header_length,
14510          {"IP Header Length", "cflow.ip_header_length",
14511           FT_UINT8, BASE_DEC, NULL, 0x0,
14512           NULL, HFILL}
14513         },
14514         {&hf_cflow_ipv6_payload_length,
14515          {"IPv6 Payload Length", "cflow.ipv6_payload_length",
14516           FT_UINT16, BASE_DEC, NULL, 0x0,
14517           NULL, HFILL}
14518         },
14519         {&hf_cflow_ipv6_next_hdr,
14520          {"IPv6 Next Header", "cflow.ipv6_next_hdr",
14521           FT_UINT8, BASE_DEC, NULL, 0x0,
14522           NULL, HFILL}
14523         },
14524         {&hf_cflow_ip_precedence,
14525          {"IP Precedence", "cflow.ip_precedence",
14526           FT_UINT8, BASE_DEC, NULL, 0x0,
14527           NULL, HFILL}
14528         },
14529         {&hf_cflow_ip_fragment_flags,
14530          {"IP Fragment Flags", "cflow.ip_fragment_flags",
14531           FT_UINT8, BASE_HEX, NULL, 0x0,
14532           NULL, HFILL}
14533         },
14534         {&hf_cflow_mpls_top_label_ttl,
14535          {"MPLS Top Label TTL", "cflow.mpls_top_label_ttl",
14536           FT_UINT8, BASE_DEC, NULL, 0x0,
14537           "MPLS top label time to live", HFILL}
14538         },
14539         {&hf_cflow_mpls_label_length,
14540          {"MPLS Label Stack Length", "cflow.mpls_label_length",
14541           FT_UINT32, BASE_DEC, NULL, 0x0,
14542           "The length of the MPLS label stac", HFILL}
14543         },
14544         {&hf_cflow_mpls_label_depth,
14545          {"MPLS Label Stack Depth", "cflow.mpls_label_depth",
14546           FT_UINT32, BASE_DEC, NULL, 0x0,
14547           "The number of labels in the MPLS label stack", HFILL}
14548         },
14549         {&hf_cflow_ip_payload_length,
14550          {"IP Payload Length", "cflow.ip_payload_length",
14551           FT_UINT32, BASE_DEC, NULL, 0x0,
14552           NULL, HFILL}
14553         },
14554         {&hf_cflow_mpls_top_label_exp,
14555          {"MPLS Top Label Exp", "cflow.mpls_top_label_exp",
14556           FT_UINT8, BASE_OCT, NULL, 0x0,
14557           NULL, HFILL}
14558         },
14559         {&hf_cflow_tcp_option_map,
14560          {"TCP OptionMap", "cflow.tcp_option_map",
14561           FT_BYTES, BASE_NONE, NULL, 0x0,
14562           "TCP Option Map", HFILL}
14563         },
14564         {&hf_cflow_collector_addr,
14565          {"CollectorAddr", "cflow.collector_addr",
14566           FT_IPv4, BASE_NONE, NULL, 0x0,
14567           "Flow Collector Address (IPv4)", HFILL}
14568         },
14569         {&hf_cflow_collector_addr_v6,
14570          {"CollectorAddr", "cflow.collector_addr_v6",
14571           FT_IPv6, BASE_NONE, NULL, 0x0,
14572           "Flow Collector Address (IPv6)", HFILL}
14573         },
14574         {&hf_cflow_export_interface,
14575          {"ExportInterface", "cflow.export_interface",
14576           FT_UINT32, BASE_DEC, NULL, 0x0,
14577           NULL, HFILL}
14578         },
14579         {&hf_cflow_export_protocol_version,
14580          {"ExportProtocolVersion", "cflow.export_protocol_version",
14581           FT_UINT8, BASE_DEC, NULL, 0x0,
14582           NULL, HFILL}
14583         },
14584         {&hf_cflow_export_prot,
14585          {"ExportTransportProtocol", "cflow.exporter_protocol",
14586           FT_UINT8, BASE_DEC, NULL, 0x0,
14587           "Transport Protocol used by the Exporting Process", HFILL}
14588         },
14589         {&hf_cflow_collector_port,
14590          {"CollectorPort", "cflow.collector_port",
14591           FT_UINT16, BASE_DEC, NULL, 0x0,
14592           "Flow Collector Port", HFILL}
14593         },
14594         {&hf_cflow_exporter_port,
14595          {"ExporterPort", "cflow.exporter_port",
14596           FT_UINT16, BASE_DEC, NULL, 0x0,
14597           "Flow Exporter Port", HFILL}
14598         },
14599         {&hf_cflow_total_tcp_syn,
14600          {"Total TCP syn", "cflow.total_tcp_syn",
14601           FT_UINT64, BASE_DEC, NULL, 0x0,
14602           "Count of total TCP syn", HFILL}
14603         },
14604         {&hf_cflow_total_tcp_fin,
14605          {"Total TCP fin", "cflow.total_tcp_fin",
14606           FT_UINT64, BASE_DEC, NULL, 0x0,
14607           "Count of total TCP fin", HFILL}
14608         },
14609         {&hf_cflow_total_tcp_rst,
14610          {"Total TCP rst", "cflow.total_tcp_rst",
14611           FT_UINT64, BASE_DEC, NULL, 0x0,
14612           "Count of total TCP rst", HFILL}
14613         },
14614         {&hf_cflow_total_tcp_psh,
14615          {"Total TCP psh", "cflow.total_tcp_psh",
14616           FT_UINT64, BASE_DEC, NULL, 0x0,
14617           "Count of total TCP psh", HFILL}
14618         },
14619         {&hf_cflow_total_tcp_ack,
14620          {"Total TCP ack", "cflow.total_tcp_ack",
14621           FT_UINT64, BASE_DEC, NULL, 0x0,
14622           "Count of total TCP ack", HFILL}
14623         },
14624         {&hf_cflow_total_tcp_urg,
14625          {"Total TCP urg", "cflow.total_tcp_urg",
14626           FT_UINT64, BASE_DEC, NULL, 0x0,
14627           "Count of total TCP urg", HFILL}
14628         },
14629         {&hf_cflow_ip_total_length,
14630          {"IP Total Length", "cflow.ip_total_length",
14631           FT_UINT64, BASE_DEC, NULL, 0x0,
14632           NULL, HFILL}
14633         },
14634         {&hf_cflow_post_natsource_ipv4_address,
14635          {"Post NAT Source IPv4 Address", "cflow.post_natsource_ipv4_address",
14636           FT_IPv4, BASE_NONE, NULL, 0x0,
14637           NULL, HFILL}
14638         },
14639         {&hf_cflow_post_natdestination_ipv4_address,
14640          {"Post NAT Destination IPv4 Address", "cflow.post_natdestination_ipv4_address",
14641           FT_IPv4, BASE_NONE, NULL, 0x0,
14642           NULL, HFILL}
14643         },
14644         {&hf_cflow_post_naptsource_transport_port,
14645          {"Post NAPT Source Transport Port", "cflow.post_naptsource_transport_port",
14646           FT_UINT16, BASE_DEC, NULL, 0x0,
14647           NULL, HFILL}
14648         },
14649         {&hf_cflow_post_naptdestination_transport_port,
14650          {"Post NAPT Destination Transport Port", "cflow.post_naptdestination_transport_port",
14651           FT_UINT16, BASE_DEC, NULL, 0x0,
14652           NULL, HFILL}
14653         },
14654         {&hf_cflow_nat_originating_address_realm,
14655          {"Nat Originating Address Realm", "cflow.nat_originating_address_realm",
14656           FT_UINT8, BASE_DEC, NULL, 0x0,
14657           NULL, HFILL}
14658         },
14659         {&hf_cflow_nat_event,
14660          {"Nat Event", "cflow.nat_event",
14661           FT_UINT8, BASE_DEC, VALS(special_nat_event_type), 0x0,
14662           NULL, HFILL}
14663         },
14664         {&hf_cflow_initiator_octets,
14665          {"Initiator Octets", "cflow.initiator_octets",
14666           FT_UINT64, BASE_DEC, NULL, 0x0,
14667           NULL, HFILL}
14668         },
14669         {&hf_cflow_responder_octets,
14670          {"Responder Octets", "cflow.responder_octets",
14671           FT_UINT64, BASE_DEC, NULL, 0x0,
14672           NULL, HFILL}
14673         },
14674         {&hf_cflow_firewall_event,
14675          {"Firewall Event", "cflow.firewall_event",
14676           FT_UINT8, BASE_DEC, VALS(v9_firewall_event), 0x0,
14677           NULL, HFILL}
14678         },
14679         {&hf_cflow_ingress_vrfid,
14680          {"Ingress VRFID", "cflow.ingress_vrfid",
14681           FT_UINT32, BASE_DEC, NULL, 0x0,
14682           NULL, HFILL}
14683         },
14684         {&hf_cflow_egress_vrfid,
14685          {"Egress VRFID", "cflow.egress_vrfid",
14686           FT_UINT32, BASE_DEC, NULL, 0x0,
14687           NULL, HFILL}
14688         },
14689         {&hf_cflow_vrfname,
14690          {"VRFname", "cflow.vrfname",
14691           FT_STRING, BASE_NONE, NULL, 0x0,
14692           NULL, HFILL}
14693         },
14694         {&hf_cflow_post_mpls_top_label_exp,
14695          {"Post MPLS Top Label Exp", "cflow.post_mpls_top_label_exp",
14696           FT_UINT8, BASE_DEC, NULL, 0x0,
14697           NULL, HFILL}
14698         },
14699         {&hf_cflow_tcp_window_scale,
14700          {"Tcp Window Scale", "cflow.tcp_window_scale",
14701           FT_UINT16, BASE_DEC, NULL, 0x0,
14702           NULL, HFILL}
14703         },
14704         {&hf_cflow_biflow_direction,
14705          {"Biflow Direction", "cflow.biflow_direction",
14706           FT_UINT8, BASE_DEC, VALS(v9_biflow_direction), 0x0,
14707           NULL, HFILL}
14708         },
14709         {&hf_cflow_ethernet_header_length,
14710          {"Ethernet Header Length", "cflow.ethernet_header_length",
14711           FT_UINT8, BASE_DEC, NULL, 0x0,
14712           NULL, HFILL}
14713         },
14714         {&hf_cflow_ethernet_payload_length,
14715          {"Ethernet Payload Length", "cflow.ethernet_payload_length",
14716           FT_UINT16, BASE_DEC, NULL, 0x0,
14717           NULL, HFILL}
14718         },
14719         {&hf_cflow_ethernet_total_length,
14720          {"Ethernet Total Length", "cflow.ethernet_total_length",
14721           FT_UINT16, BASE_DEC, NULL, 0x0,
14722           NULL, HFILL}
14723         },
14724         {&hf_cflow_dot1q_vlan_id,
14725          {"Dot1q Vlan Id", "cflow.dot1q_vlan_id",
14726           FT_UINT16, BASE_DEC, NULL, 0x0,
14727           NULL, HFILL}
14728         },
14729         {&hf_cflow_dot1q_priority,
14730          {"Dot1q Priority", "cflow.dot1q_priority",
14731           FT_UINT8, BASE_DEC, NULL, 0x0,
14732           NULL, HFILL}
14733         },
14734         {&hf_cflow_dot1q_customer_vlan_id,
14735          {"Dot1q Customer Vlan Id", "cflow.dot1q_customer_vlan_id",
14736           FT_UINT16, BASE_DEC, NULL, 0x0,
14737           NULL, HFILL}
14738         },
14739         {&hf_cflow_dot1q_customer_priority,
14740          {"Dot1q Customer Priority", "cflow.dot1q_customer_priority",
14741           FT_UINT8, BASE_DEC, NULL, 0x0,
14742           NULL, HFILL}
14743         },
14744         {&hf_cflow_metro_evc_id,
14745          {"Metro Evc Id", "cflow.metro_evc_id",
14746           FT_STRING, BASE_NONE, NULL, 0x0,
14747           NULL, HFILL}
14748         },
14749         {&hf_cflow_metro_evc_type,
14750          {"Metro Evc Type", "cflow.metro_evc_type",
14751           FT_UINT8, BASE_DEC, NULL, 0x0,
14752           NULL, HFILL}
14753         },
14754         {&hf_cflow_pseudo_wire_id,
14755          {"Pseudo Wire Id", "cflow.pseudo_wire_id",
14756           FT_UINT32, BASE_DEC, NULL, 0x0,
14757           NULL, HFILL}
14758         },
14759         {&hf_cflow_pseudo_wire_type,
14760          {"Pseudo Wire Type", "cflow.pseudo_wire_type",
14761           FT_UINT16, BASE_DEC, NULL, 0x0,
14762           NULL, HFILL}
14763         },
14764         {&hf_cflow_pseudo_wire_control_word,
14765          {"Pseudo Wire Control Word", "cflow.pseudo_wire_control_word",
14766           FT_UINT32, BASE_DEC, NULL, 0x0,
14767           NULL, HFILL}
14768         },
14769         {&hf_cflow_ingress_physical_interface,
14770          {"Ingress Physical Interface", "cflow.ingress_physical_interface",
14771           FT_UINT32, BASE_DEC, NULL, 0x0,
14772           NULL, HFILL}
14773         },
14774         {&hf_cflow_egress_physical_interface,
14775          {"Egress Physical Interface", "cflow.egress_physical_interface",
14776           FT_UINT32, BASE_DEC, NULL, 0x0,
14777           NULL, HFILL}
14778         },
14779         {&hf_cflow_post_dot1q_vlan_id,
14780          {"Post Dot1q Vlan Id", "cflow.post_dot1q_vlan_id",
14781           FT_UINT16, BASE_DEC, NULL, 0x0,
14782           NULL, HFILL}
14783         },
14784         {&hf_cflow_post_dot1q_customer_vlan_id,
14785          {"Post Dot1q Customer Vlan Id", "cflow.post_dot1q_customer_vlan_id",
14786           FT_UINT16, BASE_DEC, NULL, 0x0,
14787           NULL, HFILL}
14788         },
14789         {&hf_cflow_ethernet_type,
14790          {"Ethernet Type", "cflow.ethernet_type",
14791           FT_UINT16, BASE_DEC, NULL, 0x0,
14792           NULL, HFILL}
14793         },
14794         {&hf_cflow_post_ip_precedence,
14795          {"Post Ip Precedence", "cflow.post_ip_precedence",
14796           FT_UINT8, BASE_DEC, NULL, 0x0,
14797           NULL, HFILL}
14798         },
14799         {&hf_cflow_collection_time_milliseconds,
14800          {"Collection Time Milliseconds", "cflow.collection_time_milliseconds",
14801           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14802           NULL, HFILL}
14803         },
14804         {&hf_cflow_export_sctp_stream_id,
14805          {"Export Sctp Stream Id", "cflow.export_sctp_stream_id",
14806           FT_UINT16, BASE_DEC, NULL, 0x0,
14807           NULL, HFILL}
14808         },
14809         {&hf_cflow_max_export_seconds,
14810          {"Max Export Seconds", "cflow.max_export_seconds",
14811           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14812           NULL, HFILL}
14813         },
14814         {&hf_cflow_max_flow_end_seconds,
14815          {"Max Flow End Seconds", "cflow.max_flow_end_seconds",
14816           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14817           NULL, HFILL}
14818         },
14819         {&hf_cflow_message_md5_checksum,
14820          {"Message MD5 Checksum", "cflow.message_md5_checksum",
14821           FT_BYTES, BASE_NONE, NULL, 0x0,
14822           NULL, HFILL}
14823         },
14824         {&hf_cflow_message_scope,
14825          {"Message Scope", "cflow.message_scope",
14826           FT_UINT8, BASE_DEC, NULL, 0x0,
14827           NULL, HFILL}
14828         },
14829         {&hf_cflow_min_export_seconds,
14830          {"Min Export Seconds", "cflow.min_export_seconds",
14831           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14832           NULL, HFILL}
14833         },
14834         {&hf_cflow_min_flow_start_seconds,
14835          {"Min Flow Start Seconds", "cflow.min_flow_start_seconds",
14836           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14837           NULL, HFILL}
14838         },
14839         {&hf_cflow_opaque_octets,
14840          {"Opaque Octets", "cflow.opaque_octets",
14841           FT_BYTES, BASE_NONE, NULL, 0x0,
14842           NULL, HFILL}
14843         },
14844         {&hf_cflow_session_scope,
14845          {"Session Scope", "cflow.session_scope",
14846           FT_UINT8, BASE_DEC, NULL, 0x0,
14847           NULL, HFILL}
14848         },
14849         {&hf_cflow_max_flow_end_microseconds,
14850          {"Max Flow End Microseconds", "cflow.max_flow_end_microseconds",
14851           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
14852           NULL, HFILL}
14853         },
14854         {&hf_cflow_max_flow_end_milliseconds,
14855          {"Max Flow End Milliseconds", "cflow.max_flow_end_milliseconds",
14856           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14857           NULL, HFILL}
14858         },
14859         {&hf_cflow_max_flow_end_nanoseconds,
14860          {"Max Flow End Nanoseconds", "cflow.max_flow_end_nanoseconds",
14861           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
14862           NULL, HFILL}
14863         },
14864         {&hf_cflow_min_flow_start_microseconds,
14865          {"Min Flow Start Microseconds", "cflow.min_flow_start_microseconds",
14866           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
14867           NULL, HFILL}
14868         },
14869         {&hf_cflow_min_flow_start_milliseconds,
14870          {"Min Flow Start Milliseconds", "cflow.min_flow_start_milliseconds",
14871           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
14872           NULL, HFILL}
14873         },
14874         {&hf_cflow_min_flow_start_nanoseconds,
14875          {"Min Flow Start Nanoseconds", "cflow.min_flow_start_nanoseconds",
14876           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
14877           NULL, HFILL}
14878         },
14879         {&hf_cflow_collector_certificate,
14880          {"Collector Certificate", "cflow.collector_certificate",
14881           FT_BYTES, BASE_NONE, NULL, 0x0,
14882           NULL, HFILL}
14883         },
14884         {&hf_cflow_exporter_certificate,
14885          {"Exporter Certificate", "cflow.exporter_certificate",
14886           FT_BYTES, BASE_NONE, NULL, 0x0,
14887           NULL, HFILL}
14888         },
14889         {&hf_cflow_data_records_reliability,
14890          {"Data Records Reliability", "cflow.data_records_reliability",
14891           FT_BOOLEAN, BASE_NONE, NULL, 0x0,
14892           NULL, HFILL}
14893         },
14894         {&hf_cflow_observation_point_type,
14895          {"Observation Point Type", "cflow.observation_point_type",
14896           FT_UINT8, BASE_DEC, NULL, 0x0,
14897           NULL, HFILL}
14898         },
14899         {&hf_cflow_new_connection_delta_count,
14900          {"New Connection Delta Count", "cflow.new_connection_delta_count",
14901           FT_UINT32, BASE_DEC, NULL, 0x0,
14902           NULL, HFILL}
14903         },
14904         {&hf_cflow_connection_sum_duration_seconds,
14905          {"Connection Sum Duration Seconds", "cflow.connection_sum_duration_seconds",
14906           FT_UINT64, BASE_DEC, NULL, 0x0,
14907           NULL, HFILL}
14908         },
14909         {&hf_cflow_connection_transaction_id,
14910          {"Connection Transaction Id", "cflow.connection_transaction_id",
14911           FT_UINT64, BASE_DEC, NULL, 0x0,
14912           NULL, HFILL}
14913         },
14914         {&hf_cflow_post_nat_source_ipv6_address,
14915          {"Post NAT Source IPv6 Address", "cflow.post_nat_source_ipv6_address",
14916           FT_IPv6, BASE_NONE, NULL, 0x0,
14917           NULL, HFILL}
14918         },
14919         {&hf_cflow_post_nat_destination_ipv6_address,
14920          {"Post NAT Destination IPv6 Address", "cflow.post_nat_destination_ipv6_address",
14921           FT_IPv6, BASE_NONE, NULL, 0x0,
14922           NULL, HFILL}
14923         },
14924         {&hf_cflow_nat_pool_id,
14925          {"Nat Pool Id", "cflow.nat_pool_id",
14926           FT_UINT32, BASE_DEC, NULL, 0x0,
14927           NULL, HFILL}
14928         },
14929         {&hf_cflow_nat_pool_name,
14930          {"Nat Pool Name", "cflow.nat_pool_name",
14931           FT_STRING, BASE_NONE, NULL, 0x0,
14932           NULL, HFILL}
14933         },
14934         {&hf_cflow_anonymization_flags,
14935          {"Anonymization Flags", "cflow.anonymization_flags",
14936           FT_BYTES, BASE_NONE, NULL, 0x0,
14937           NULL, HFILL}
14938         },
14939         {&hf_cflow_anonymization_technique,
14940          {"Anonymization Technique", "cflow.anonymization_technique",
14941           FT_UINT16, BASE_DEC, NULL, 0x0,
14942           NULL, HFILL}
14943         },
14944         {&hf_cflow_information_element_index,
14945          {"Information Element Index", "cflow.information_element_index",
14946           FT_UINT16, BASE_DEC, NULL, 0x0,
14947           NULL, HFILL}
14948         },
14949         {&hf_cflow_p2p_technology,
14950          {"P2p Technology", "cflow.p2p_technology",
14951           FT_STRING, BASE_NONE, NULL, 0x0,
14952           NULL, HFILL}
14953         },
14954         {&hf_cflow_tunnel_technology,
14955          {"Tunnel Technology", "cflow.tunnel_technology",
14956           FT_STRING, BASE_NONE, NULL, 0x0,
14957           NULL, HFILL}
14958         },
14959         {&hf_cflow_encrypted_technology,
14960          {"Encrypted Technology", "cflow.encrypted_technology",
14961           FT_STRING, BASE_NONE, NULL, 0x0,
14962           NULL, HFILL}
14963         },
14964         {&hf_cflow_subtemplate_list,
14965          {"SubTemplate List", "cflow.subtemplate_list",
14966           FT_NONE, BASE_NONE, NULL, 0x0,
14967           NULL, HFILL}
14968         },
14969         {&hf_cflow_bgp_validity_state,
14970          {"Bgp Validity State", "cflow.bgp_validity_state",
14971           FT_UINT8, BASE_DEC, NULL, 0x0,
14972           NULL, HFILL}
14973         },
14974         {&hf_cflow_ipsec_spi,
14975          {"IPSec SPI", "cflow.ipsec_spi",
14976           FT_UINT32, BASE_DEC, NULL, 0x0,
14977           NULL, HFILL}
14978         },
14979         {&hf_cflow_gre_key,
14980          {"Gre Key", "cflow.gre_key",
14981           FT_UINT32, BASE_DEC, NULL, 0x0,
14982           NULL, HFILL}
14983         },
14984         {&hf_cflow_nat_type,
14985          {"Nat Type", "cflow.nat_type",
14986           FT_UINT8, BASE_DEC, NULL, 0x0,
14987           NULL, HFILL}
14988         },
14989         {&hf_cflow_initiator_packets,
14990          {"Initiator Packets", "cflow.initiator_packets",
14991           FT_UINT64, BASE_DEC, NULL, 0x0,
14992           NULL, HFILL}
14993         },
14994         {&hf_cflow_responder_packets,
14995          {"Responder Packets", "cflow.responder_packets",
14996           FT_UINT64, BASE_DEC, NULL, 0x0,
14997           NULL, HFILL}
14998         },
14999         {&hf_cflow_observation_domain_name,
15000          {"Observation Domain Name", "cflow.observation_domain_name",
15001           FT_STRING, BASE_NONE, NULL, 0x0,
15002           NULL, HFILL}
15003         },
15004         {&hf_cflow_selection_sequence_id,
15005          {"Selection Sequence Id", "cflow.selection_sequence_id",
15006           FT_UINT64, BASE_DEC, NULL, 0x0,
15007           NULL, HFILL}
15008         },
15009         {&hf_cflow_selector_id,
15010          {"Selector Id", "cflow.selector_id",
15011           FT_UINT64, BASE_DEC, NULL, 0x0,
15012           NULL, HFILL}
15013         },
15014         {&hf_cflow_information_element_id,
15015          {"Information Element Id", "cflow.information_element_id",
15016           FT_UINT16, BASE_DEC, NULL, 0x0,
15017           NULL, HFILL}
15018         },
15019         {&hf_cflow_selector_algorithm,
15020          {"Selector Algorithm", "cflow.selector_algorithm",
15021           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &selector_algorithm_ext, 0x0,
15022           NULL, HFILL}
15023         },
15024         {&hf_cflow_sampling_packet_interval,
15025          {"Sampling Packet Interval", "cflow.sampling_packet_interval",
15026           FT_UINT32, BASE_DEC, NULL, 0x0,
15027           NULL, HFILL}
15028         },
15029         {&hf_cflow_sampling_packet_space,
15030          {"Sampling Packet Space", "cflow.sampling_packet_space",
15031           FT_UINT32, BASE_DEC, NULL, 0x0,
15032           NULL, HFILL}
15033         },
15034         {&hf_cflow_sampling_time_interval,
15035          {"Sampling Time Interval", "cflow.sampling_time_interval",
15036           FT_UINT32, BASE_DEC, NULL, 0x0,
15037           NULL, HFILL}
15038         },
15039         {&hf_cflow_sampling_time_space,
15040          {"Sampling Time Space", "cflow.sampling_time_space",
15041           FT_UINT32, BASE_DEC, NULL, 0x0,
15042           NULL, HFILL}
15043         },
15044         {&hf_cflow_sampling_size,
15045          {"Sampling Size", "cflow.sampling_size",
15046           FT_UINT32, BASE_DEC, NULL, 0x0,
15047           NULL, HFILL}
15048         },
15049         {&hf_cflow_sampling_population,
15050          {"Sampling Population", "cflow.sampling_population",
15051           FT_UINT32, BASE_DEC, NULL, 0x0,
15052           NULL, HFILL}
15053         },
15054         {&hf_cflow_sampling_probability_float32,
15055          {"Sampling Probability", "cflow.sampling_probability",
15056           FT_FLOAT, BASE_NONE, NULL, 0x0,
15057           NULL, HFILL}
15058         },
15059         {&hf_cflow_sampling_probability_float64,
15060          {"Sampling Probability", "cflow.sampling_probability",
15061           FT_DOUBLE, BASE_NONE, NULL, 0x0,
15062           NULL, HFILL}
15063         },
15064         {&hf_cflow_data_link_frame_size,
15065          {"Data Link Frame Size", "cflow.data_link_frame_size",
15066           FT_UINT16, BASE_DEC, NULL, 0x0,
15067           NULL, HFILL}
15068         },
15069         {&hf_cflow_data_link_frame_section,
15070          {"Data Link Frame Section", "cflow.data_link_frame_section",
15071           FT_BYTES, BASE_NONE, NULL, 0x0,
15072           NULL, HFILL}
15073         },
15074         {&hf_cflow_mpls_label_stack_section,
15075          {"MPLS Label Stack Section", "cflow.mpls_label_stack_section",
15076           FT_BYTES, BASE_NONE, NULL, 0x0,
15077           NULL, HFILL}
15078         },
15079         {&hf_cflow_mpls_payload_packet_section,
15080          {"MPLS Payload Packet Section", "cflow.mpls_payload_packet_section",
15081           FT_BYTES, BASE_NONE, NULL, 0x0,
15082           NULL, HFILL}
15083         },
15084         {&hf_cflow_selector_id_total_pkts_observed,
15085          {"Selector Id Total Pkts Observed", "cflow.selector_id_total_pkts_observed",
15086           FT_UINT64, BASE_DEC, NULL, 0x0,
15087           NULL, HFILL}
15088         },
15089         {&hf_cflow_selector_id_total_pkts_selected,
15090          {"Selector Id Total Pkts Selected", "cflow.selector_id_total_pkts_selected",
15091           FT_UINT64, BASE_DEC, NULL, 0x0,
15092           NULL, HFILL}
15093         },
15094         {&hf_cflow_absolute_error_float32,
15095          {"Absolute Error", "cflow.absolute_error",
15096           FT_FLOAT, BASE_NONE, NULL, 0x0,
15097           NULL, HFILL}
15098         },
15099         {&hf_cflow_absolute_error_float64,
15100          {"Absolute Error", "cflow.absolute_error",
15101           FT_DOUBLE, BASE_NONE, NULL, 0x0,
15102           NULL, HFILL}
15103         },
15104         {&hf_cflow_relative_error_float32,
15105          {"Relative Error", "cflow.relative_error",
15106           FT_FLOAT, BASE_NONE, NULL, 0x0,
15107           NULL, HFILL}
15108         },
15109         {&hf_cflow_relative_error_float64,
15110          {"Relative Error", "cflow.relative_error",
15111           FT_DOUBLE, BASE_NONE, NULL, 0x0,
15112           NULL, HFILL}
15113         },
15114         {&hf_cflow_observation_time_seconds,
15115          {"Observation Time Seconds", "cflow.observation_time_seconds",
15116           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
15117           NULL, HFILL}
15118         },
15119         {&hf_cflow_observation_time_milliseconds,
15120          {"Observation Time Milliseconds", "cflow.observation_time_milliseconds",
15121           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
15122           NULL, HFILL}
15123         },
15124         {&hf_cflow_observation_time_microseconds,
15125          {"Observation Time Microseconds", "cflow.observation_time_microseconds",
15126           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
15127           NULL, HFILL}
15128         },
15129         {&hf_cflow_observation_time_nanoseconds,
15130          {"Observation Time Nanoseconds", "cflow.observation_time_nanoseconds",
15131           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
15132           NULL, HFILL}
15133         },
15134         {&hf_cflow_digest_hash_value,
15135          {"Digest Hash Value", "cflow.digest_hash_value",
15136           FT_UINT64, BASE_DEC, NULL, 0x0,
15137           NULL, HFILL}
15138         },
15139         {&hf_cflow_hash_ippayload_offset,
15140          {"Hash IPPayload Offset", "cflow.hash_ippayload_offset",
15141           FT_UINT64, BASE_DEC, NULL, 0x0,
15142           NULL, HFILL}
15143         },
15144         {&hf_cflow_hash_ippayload_size,
15145          {"Hash IPPayload Size", "cflow.hash_ippayload_size",
15146           FT_UINT64, BASE_DEC, NULL, 0x0,
15147           NULL, HFILL}
15148         },
15149         {&hf_cflow_hash_output_range_min,
15150          {"Hash Output Range Min", "cflow.hash_output_range_min",
15151           FT_UINT64, BASE_DEC, NULL, 0x0,
15152           NULL, HFILL}
15153         },
15154         {&hf_cflow_hash_output_range_max,
15155          {"Hash Output Range Max", "cflow.hash_output_range_max",
15156           FT_UINT64, BASE_DEC, NULL, 0x0,
15157           NULL, HFILL}
15158         },
15159         {&hf_cflow_hash_selected_range_min,
15160          {"Hash Selected Range Min", "cflow.hash_selected_range_min",
15161           FT_UINT64, BASE_DEC, NULL, 0x0,
15162           NULL, HFILL}
15163         },
15164         {&hf_cflow_hash_selected_range_max,
15165          {"Hash Selected Range Max", "cflow.hash_selected_range_max",
15166           FT_UINT64, BASE_DEC, NULL, 0x0,
15167           NULL, HFILL}
15168         },
15169         {&hf_cflow_hash_digest_output,
15170          {"Hash Digest Output", "cflow.hash_digest_output",
15171           FT_BOOLEAN, BASE_NONE, NULL, 0x0,
15172           NULL, HFILL}
15173         },
15174         {&hf_cflow_hash_initialiser_value,
15175          {"Hash Initialiser Value", "cflow.hash_initialiser_value",
15176           FT_UINT64, BASE_DEC, NULL, 0x0,
15177           NULL, HFILL}
15178         },
15179         {&hf_cflow_selector_name,
15180          {"Selector Name", "cflow.selector_name",
15181           FT_STRING, BASE_NONE, NULL, 0x0,
15182           NULL, HFILL}
15183         },
15184         {&hf_cflow_upper_cilimit_float32,
15185          {"Upper CILimit", "cflow.upper_cilimit",
15186           FT_FLOAT, BASE_NONE, NULL, 0x0,
15187           NULL, HFILL}
15188         },
15189         {&hf_cflow_upper_cilimit_float64,
15190          {"Upper CILimit", "cflow.upper_cilimit",
15191           FT_DOUBLE, BASE_NONE, NULL, 0x0,
15192           NULL, HFILL}
15193         },
15194         {&hf_cflow_lower_cilimit_float32,
15195          {"Lower CILimit", "cflow.lower_cilimit",
15196           FT_FLOAT, BASE_NONE, NULL, 0x0,
15197           NULL, HFILL}
15198         },
15199         {&hf_cflow_lower_cilimit_float64,
15200          {"Lower CILimit", "cflow.lower_cilimit",
15201           FT_DOUBLE, BASE_NONE, NULL, 0x0,
15202           NULL, HFILL}
15203         },
15204         {&hf_cflow_confidence_level_float32,
15205          {"Confidence Level", "cflow.confidence_level",
15206           FT_FLOAT, BASE_NONE, NULL, 0x0,
15207           NULL, HFILL}
15208         },
15209         {&hf_cflow_confidence_level_float64,
15210          {"Confidence Level", "cflow.confidence_level",
15211           FT_DOUBLE, BASE_NONE, NULL, 0x0,
15212           NULL, HFILL}
15213         },
15214         /* TODO: want to add a value_string, but where defined in RFCs? */
15215         {&hf_cflow_information_element_data_type,
15216          {"Information Element Data Type", "cflow.information_element_data_type",
15217           FT_UINT8, BASE_DEC, NULL, 0x0,
15218           NULL, HFILL}
15219         },
15220         {&hf_cflow_information_element_description,
15221          {"Information Element Description", "cflow.information_element_description",
15222           FT_STRING, BASE_NONE, NULL, 0x0,
15223           NULL, HFILL}
15224         },
15225         {&hf_cflow_information_element_name,
15226          {"Information Element Name", "cflow.information_element_name",
15227           FT_STRING, BASE_NONE, NULL, 0x0,
15228           NULL, HFILL}
15229         },
15230         {&hf_cflow_information_element_range_begin,
15231          {"Information Element Range Begin", "cflow.information_element_range_begin",
15232           FT_UINT64, BASE_DEC, NULL, 0x0,
15233           NULL, HFILL}
15234         },
15235         {&hf_cflow_information_element_range_end,
15236          {"Information Element Range End", "cflow.information_element_range_end",
15237           FT_UINT64, BASE_DEC, NULL, 0x0,
15238           NULL, HFILL}
15239         },
15240         {&hf_cflow_information_element_semantics,
15241          {"Information Element Semantics", "cflow.information_element_semantics",
15242           FT_UINT8, BASE_DEC, NULL, 0x0,
15243           NULL, HFILL}
15244         },
15245         {&hf_cflow_information_element_units,
15246          {"Information Element Units", "cflow.information_element_units",
15247           FT_UINT16, BASE_DEC, NULL, 0x0,
15248           NULL, HFILL}
15249         },
15250         {&hf_cflow_private_enterprise_number,
15251          {"Private Enterprise Number", "cflow.private_enterprise_number",
15252           FT_UINT32, BASE_DEC, NULL, 0x0,
15253           NULL, HFILL}
15254         },
15255
15256         {&hf_cflow_virtual_station_interface_id,
15257          {"Virtual Station Interface Id", "cflow.virtual_station_interface_id",
15258           FT_BYTES, BASE_NONE, NULL, 0x0,
15259           NULL, HFILL}
15260         },
15261         {&hf_cflow_virtual_station_interface_name,
15262           {"Virtual Station Interface Name", "cflow.virtual_station_interface_name",
15263            FT_STRING, BASE_NONE, NULL, 0x0,
15264            NULL, HFILL}
15265         },
15266         {&hf_cflow_virtual_station_uuid,
15267           {"Virtual Station Uuid", "cflow.virtual_station_uuid",
15268            FT_BYTES, BASE_NONE, NULL, 0x0,
15269            NULL, HFILL}
15270         },
15271         {&hf_cflow_virtual_station_name,
15272           {"Virtual Station Name", "cflow.virtual_station_name",
15273            FT_STRING, BASE_NONE, NULL, 0x0,
15274            NULL, HFILL}
15275         },
15276         {&hf_cflow_layer2_segment_id,
15277           {"Layer2 Segment Id", "cflow.layer2_segment_id",
15278            FT_UINT64, BASE_DEC, NULL, 0x0,
15279            NULL, HFILL}
15280         },
15281         {&hf_cflow_layer2_octet_delta_count,
15282           {"Layer2 Octet Delta Count", "cflow.layer2_octet_delta_count",
15283            FT_UINT64, BASE_DEC, NULL, 0x0,
15284            NULL, HFILL}
15285         },
15286         {&hf_cflow_layer2_octet_total_count,
15287           {"Layer2 Octet Total Count", "cflow.layer2_octet_total_count",
15288            FT_UINT64, BASE_DEC, NULL, 0x0,
15289            NULL, HFILL}
15290         },
15291         {&hf_cflow_ingress_unicast_packet_total_count,
15292           {"Ingress Unicast Packet Total Count", "cflow.ingress_unicast_packet_total_count",
15293            FT_UINT64, BASE_DEC, NULL, 0x0,
15294            NULL, HFILL}
15295         },
15296         {&hf_cflow_ingress_multicast_packet_total_count,
15297           {"Ingress Multicast Packet Total Count", "cflow.ingress_multicast_packet_total_count",
15298            FT_UINT64, BASE_DEC, NULL, 0x0,
15299            NULL, HFILL}
15300         },
15301         {&hf_cflow_ingress_broadcast_packet_total_count,
15302           {"Ingress Broadcast Packet Total Count", "cflow.ingress_broadcast_packet_total_count",
15303            FT_UINT64, BASE_DEC, NULL, 0x0,
15304            NULL, HFILL}
15305         },
15306         {&hf_cflow_egress_unicast_packet_total_count,
15307           {"Egress Unicast Packet Total Count", "cflow.egress_unicast_packet_total_count",
15308            FT_UINT64, BASE_DEC, NULL, 0x0,
15309            NULL, HFILL}
15310         },
15311         {&hf_cflow_egress_broadcast_packet_total_count,
15312           {"Egress Broadcast Packet Total Count", "cflow.egress_broadcast_packet_total_count",
15313            FT_UINT64, BASE_DEC, NULL, 0x0,
15314            NULL, HFILL}
15315         },
15316         {&hf_cflow_monitoring_interval_start_milliseconds,
15317           {"Monitoring Interval Start MilliSeconds", "cflow.monitoring_interval_start_milliseconds",
15318            FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
15319            NULL, HFILL}
15320         },
15321         {&hf_cflow_monitoring_interval_end_milliseconds,
15322           {"Monitoring Interval End MilliSeconds", "cflow.monitoring_interval_end_milliseconds",
15323            FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
15324            NULL, HFILL}
15325         },
15326         {&hf_cflow_port_range_start,
15327           {"Port Range Start", "cflow.port_range_start",
15328            FT_UINT16, BASE_DEC, NULL, 0x0,
15329            NULL, HFILL}
15330         },
15331         {&hf_cflow_port_range_end,
15332           {"Port Range End", "cflow.port_range_end",
15333            FT_UINT16, BASE_DEC, NULL, 0x0,
15334            NULL, HFILL}
15335         },
15336         {&hf_cflow_port_range_step_size,
15337           {"Port Range Step Size", "cflow.port_range_step_size",
15338            FT_UINT16, BASE_DEC, NULL, 0x0,
15339            NULL, HFILL}
15340         },
15341         {&hf_cflow_port_range_num_ports,
15342           {"Port Range Num Ports", "cflow.port_range_num_ports",
15343            FT_UINT16, BASE_DEC, NULL, 0x0,
15344            NULL, HFILL}
15345         },
15346         {&hf_cflow_sta_mac_address,
15347           {"Sta Mac Address", "cflow.sta_mac_address",
15348            FT_ETHER, BASE_NONE, NULL, 0x0,
15349            NULL, HFILL}
15350         },
15351         {&hf_cflow_sta_ipv4_address,
15352           {"Sta Ipv4 Address", "cflow.sta_ipv4_address",
15353            FT_IPv4, BASE_NONE, NULL, 0x0,
15354            NULL, HFILL}
15355         },
15356         {&hf_cflow_wtp_mac_address,
15357           {"Wtp Mac Address", "cflow.wtp_mac_address",
15358            FT_ETHER, BASE_NONE, NULL, 0x0,
15359            NULL, HFILL}
15360         },
15361         {&hf_cflow_ingress_interface_type,
15362           {"Ingress Interface Type", "cflow.ingress_interface_type",
15363            FT_UINT32, BASE_DEC, NULL, 0x0,
15364            NULL, HFILL}
15365         },
15366         {&hf_cflow_egress_interface_type,
15367           {"Egress Interface Type", "cflow.egress_interface_type",
15368            FT_UINT32, BASE_DEC, NULL, 0x0,
15369            NULL, HFILL}
15370         },
15371         {&hf_cflow_rtp_sequence_number,
15372           {"Rtp Sequence Number", "cflow.rtp_sequence_number",
15373            FT_UINT16, BASE_DEC, NULL, 0x0,
15374            NULL, HFILL}
15375         },
15376         {&hf_cflow_user_name,
15377           {"User Name", "cflow.user_name",
15378            FT_STRING, BASE_NONE, NULL, 0x0,
15379            NULL, HFILL}
15380         },
15381         {&hf_cflow_application_category_name,
15382           {"Application Category Name", "cflow.application_category_name",
15383            FT_STRING, BASE_NONE, NULL, 0x0,
15384            NULL, HFILL}
15385         },
15386         {&hf_cflow_application_sub_category_name,
15387           {"Application Sub Category Name", "cflow.application_sub_category_name",
15388            FT_STRING, BASE_NONE, NULL, 0x0,
15389            NULL, HFILL}
15390         },
15391         {&hf_cflow_application_group_name,
15392           {"Application Group Name", "cflow.application_group_name",
15393            FT_STRING, BASE_NONE, NULL, 0x0,
15394            NULL, HFILL}
15395         },
15396         {&hf_cflow_original_flows_present,
15397           {"Original Flows Present", "cflow.original_flows_present",
15398            FT_UINT64, BASE_DEC, NULL, 0x0,
15399            NULL, HFILL}
15400         },
15401         {&hf_cflow_original_flows_initiated,
15402           {"Original Flows Initiated", "cflow.original_flows_initiated",
15403            FT_UINT64, BASE_DEC, NULL, 0x0,
15404            NULL, HFILL}
15405         },
15406         {&hf_cflow_original_flows_completed,
15407           {"Original Flows Completed", "cflow.original_flows_completed",
15408            FT_UINT64, BASE_DEC, NULL, 0x0,
15409            NULL, HFILL}
15410         },
15411         {&hf_cflow_distinct_count_of_source_ip_address,
15412           {"Distinct Count Of Source Ip Address", "cflow.distinct_count_of_source_ip_address",
15413            FT_UINT64, BASE_DEC, NULL, 0x0,
15414            NULL, HFILL}
15415         },
15416         {&hf_cflow_distinct_count_of_destinationip_address,
15417           {"Distinct Count Of Destinationip Address", "cflow.distinct_count_of_destinationip_address",
15418            FT_UINT64, BASE_DEC, NULL, 0x0,
15419            NULL, HFILL}
15420         },
15421         {&hf_cflow_distinct_count_of_source_ipv4_address,
15422           {"Distinct Count Of Source Ipv4 Address", "cflow.distinct_count_of_source_ipv4_address",
15423            FT_UINT32, BASE_DEC, NULL, 0x0,
15424            NULL, HFILL}
15425         },
15426         {&hf_cflow_distinct_count_of_destination_ipv4_address,
15427           {"Distinct Count Of Destination Ipv4 Address", "cflow.distinct_count_of_destination_ipv4_address",
15428            FT_UINT32, BASE_DEC, NULL, 0x0,
15429            NULL, HFILL}
15430         },
15431         {&hf_cflow_distinct_count_of_source_ipv6_address,
15432           {"Distinct Count Of Source Ipv6 Address", "cflow.distinct_count_of_source_ipv6_address",
15433            FT_UINT64, BASE_DEC, NULL, 0x0,
15434            NULL, HFILL}
15435         },
15436         {&hf_cflow_distinct_count_of_destination_ipv6_address,
15437           {"Distinct Count Of Destination Ipv6 Address", "cflow.distinct_count_of_destination_ipv6_address",
15438            FT_UINT64, BASE_DEC, NULL, 0x0,
15439            NULL, HFILL}
15440         },
15441         {&hf_cflow_value_distribution_method,
15442           {"Value Distribution Method", "cflow.value_distribution_method",
15443            FT_UINT8, BASE_DEC, NULL, 0x0,
15444            NULL, HFILL}
15445         },
15446         {&hf_cflow_rfc3550_jitter_milliseconds,
15447           {"Rfc3550 Jitter Milliseconds", "cflow.rfc3550_jitter_milliseconds",
15448            FT_UINT32, BASE_DEC, NULL, 0x0,
15449            NULL, HFILL}
15450         },
15451         {&hf_cflow_rfc3550_jitter_microseconds,
15452           {"Rfc3550 Jitter Microseconds", "cflow.rfc3550_jitter_microseconds",
15453            FT_UINT32, BASE_DEC, NULL, 0x0,
15454            NULL, HFILL}
15455         },
15456         {&hf_cflow_rfc3550_jitter_nanoseconds,
15457           {"Rfc3550 Jitter Nanoseconds", "cflow.rfc3550_jitter_nanoseconds",
15458            FT_UINT32, BASE_DEC, NULL, 0x0,
15459            NULL, HFILL}
15460         },
15461         {&hf_cflow_dot1q_dei,
15462           {"Dot1q DEI", "cflow.dot1q_dei",
15463            FT_BOOLEAN, BASE_NONE, NULL, 0x0,
15464            NULL, HFILL}
15465         },
15466         {&hf_cflow_dot1q_customer_dei,
15467           {"Dot1q Customer DEI", "cflow.dot1q_customer_dei",
15468            FT_BOOLEAN, BASE_NONE, NULL, 0x0,
15469            NULL, HFILL}
15470         },
15471         {&hf_cflow_flow_selector_algorithm,
15472           {"Flow_Selector_Algorithm", "cflow.flow_selector_algorithm",
15473            FT_UINT16, BASE_DEC, NULL, 0x0,
15474            NULL, HFILL}
15475         },
15476         {&hf_cflow_flow_selected_octet_delta_count,
15477           {"Flow_Selected_Octet_Delta_Count", "cflow.flow_selected_octet_delta_count",
15478            FT_UINT64, BASE_DEC, NULL, 0x0,
15479            NULL, HFILL}
15480         },
15481         {&hf_cflow_flow_selected_packet_delta_count,
15482           {"Flow_Selected_Packet_Delta_Count", "cflow.flow_selected_packet_delta_count",
15483            FT_UINT64, BASE_DEC, NULL, 0x0,
15484            NULL, HFILL}
15485         },
15486         {&hf_cflow_flow_selected_flow_delta_count,
15487           {"Flow_Selected_Flow_Delta_Count", "cflow.flow_selected_flow_delta_count",
15488            FT_UINT64, BASE_DEC, NULL, 0x0,
15489            NULL, HFILL}
15490         },
15491         {&hf_cflow_selectorid_total_flows_observed,
15492           {"Selectorid_Total_Flows_Observed", "cflow.selectorid_total_flows_observed",
15493            FT_UINT64, BASE_DEC, NULL, 0x0,
15494            NULL, HFILL}
15495         },
15496         {&hf_cflow_selectorid_total_flows_selected,
15497           {"Selectorid_Total_Flows_Selected", "cflow.selectorid_total_flows_selected",
15498            FT_UINT64, BASE_DEC, NULL, 0x0,
15499            NULL, HFILL}
15500         },
15501         {&hf_cflow_sampling_flow_interval,
15502           {"Sampling_Flow_Interval", "cflow.sampling_flow_interval",
15503            FT_UINT64, BASE_DEC, NULL, 0x0,
15504            NULL, HFILL}
15505         },
15506         {&hf_cflow_sampling_flow_spacing,
15507           {"Sampling_Flow_Spacing", "cflow.sampling_flow_spacing",
15508            FT_UINT64, BASE_DEC, NULL, 0x0,
15509            NULL, HFILL}
15510         },
15511         {&hf_cflow_flow_sampling_time_interval,
15512           {"Flow_Sampling_Time_Interval", "cflow.flow_sampling_time_interval",
15513            FT_UINT64, BASE_DEC, NULL, 0x0,
15514            NULL, HFILL}
15515         },
15516         {&hf_cflow_flow_sampling_time_spacing,
15517           {"Flow_Sampling_Time_Spacing", "cflow.flow_sampling_time_spacing",
15518            FT_UINT64, BASE_DEC, NULL, 0x0,
15519            NULL, HFILL}
15520         },
15521         {&hf_cflow_hash_flow_domain,
15522           {"Hash_Flow_Domain", "cflow.hash_flow_domain",
15523            FT_UINT16, BASE_DEC, NULL, 0x0,
15524            NULL, HFILL}
15525         },
15526         {&hf_cflow_transport_octet_delta_count,
15527           {"Transport_Octet_Delta_Count", "cflow.transport_octet_delta_count",
15528            FT_UINT64, BASE_DEC, NULL, 0x0,
15529            NULL, HFILL}
15530         },
15531         {&hf_cflow_transport_packet_delta_count,
15532           {"Transport_Packet_Delta_Count", "cflow.transport_packet_delta_count",
15533            FT_UINT64, BASE_DEC, NULL, 0x0,
15534            NULL, HFILL}
15535         },
15536         {&hf_cflow_original_exporter_ipv4_address,
15537           {"Original_Exporter_Ipv4_Address", "cflow.original_exporter_ipv4_address",
15538           FT_IPv4, BASE_NONE, NULL, 0x0,
15539            NULL, HFILL}
15540         },
15541         {&hf_cflow_original_exporter_ipv6_address,
15542           {"Original_Exporter_Ipv6_Address", "cflow.original_exporter_ipv6_address",
15543            FT_IPv6, BASE_NONE, NULL, 0x0,
15544            NULL, HFILL}
15545         },
15546         {&hf_cflow_original_observation_domain_id,
15547           {"Original_Observation_Domain_Id", "cflow.original_observation_domain_id",
15548            FT_UINT32, BASE_DEC, NULL, 0x0,
15549            NULL, HFILL}
15550         },
15551         {&hf_cflow_intermediate_process_id,
15552           {"Intermediate_Process_Id", "cflow.intermediate_process_id",
15553            FT_UINT32, BASE_DEC, NULL, 0x0,
15554            NULL, HFILL}
15555         },
15556         {&hf_cflow_ignored_data_record_total_count,
15557           {"Ignored_Data_Record_Total_Count", "cflow.ignored_data_record_total_count",
15558            FT_UINT64, BASE_DEC, NULL, 0x0,
15559            NULL, HFILL}
15560         },
15561         {&hf_cflow_data_link_frame_type,
15562           {"Data_Link_Frame_Type", "cflow.data_link_frame_type",
15563            FT_UINT16, BASE_DEC, NULL, 0x0,
15564            NULL, HFILL}
15565         },
15566         {&hf_cflow_section_offset,
15567           {"Section_Offset", "cflow.section_offset",
15568            FT_UINT16, BASE_DEC, NULL, 0x0,
15569            NULL, HFILL}
15570         },
15571         {&hf_cflow_section_exported_octets,
15572           {"Section_Exported_Octets", "cflow.section_exported_octets",
15573            FT_UINT16, BASE_DEC, NULL, 0x0,
15574            NULL, HFILL}
15575         },
15576         {&hf_cflow_dot1q_service_instance_tag,
15577           {"Dot1q_Service_Instance_Tag", "cflow.dot1q_service_instance_tag",
15578            FT_BYTES, BASE_NONE, NULL, 0x0,
15579            NULL, HFILL}
15580         },
15581         {&hf_cflow_dot1q_service_instance_id,
15582           {"Dot1q_Service_Instance_Id", "cflow.dot1q_service_instance_id",
15583            FT_UINT32, BASE_DEC, NULL, 0x0,
15584            NULL, HFILL}
15585         },
15586         {&hf_cflow_dot1q_service_instance_priority,
15587           {"Dot1q_Service_Instance_Priority", "cflow.dot1q_service_instance_priority",
15588            FT_UINT8, BASE_DEC, NULL, 0x0,
15589            NULL, HFILL}
15590         },
15591         {&hf_cflow_dot1q_customer_source_mac_address,
15592           {"Dot1q_Customer_Source_Mac_Address", "cflow.dot1q_customer_source_mac_address",
15593            FT_ETHER, BASE_NONE, NULL, 0x0,
15594            NULL, HFILL}
15595         },
15596         {&hf_cflow_dot1q_customer_destination_mac_address,
15597           {"Dot1q_Customer_Destination_Mac_Address", "cflow.dot1q_customer_destination_mac_address",
15598            FT_ETHER, BASE_NONE, NULL, 0x0,
15599            NULL, HFILL}
15600         },
15601         {&hf_cflow_post_layer2_octet_delta_count,
15602           {"Post_Layer2_Octet_Delta_Count", "cflow.post_layer2_octet_delta_count",
15603            FT_UINT64, BASE_DEC, NULL, 0x0,
15604            NULL, HFILL}
15605         },
15606         {&hf_cflow_postm_cast_layer2_octet_delta_count,
15607           {"Postm_Cast_Layer2_Octet_Delta_Count", "cflow.postm_cast_layer2_octet_delta_count",
15608            FT_UINT64, BASE_DEC, NULL, 0x0,
15609            NULL, HFILL}
15610         },
15611         {&hf_cflow_post_layer2_octet_total_count,
15612           {"Post_Layer2_Octet_Total_Count", "cflow.post_layer2_octet_total_count",
15613            FT_UINT64, BASE_DEC, NULL, 0x0,
15614            NULL, HFILL}
15615         },
15616         {&hf_cflow_postm_cast_layer2_octet_total_count,
15617           {"Postm_Cast_Layer2_Octet_Total_Count", "cflow.postm_cast_layer2_octet_total_count",
15618            FT_UINT64, BASE_DEC, NULL, 0x0,
15619            NULL, HFILL}
15620         },
15621         {&hf_cflow_minimum_layer2_total_length,
15622           {"Minimum_Layer2_Total_Length", "cflow.minimum_layer2_total_length",
15623            FT_UINT64, BASE_DEC, NULL, 0x0,
15624            NULL, HFILL}
15625         },
15626         {&hf_cflow_maximum_layer2_total_length,
15627           {"Maximum_Layer2_Total_Length", "cflow.maximum_layer2_total_length",
15628            FT_UINT64, BASE_DEC, NULL, 0x0,
15629            NULL, HFILL}
15630         },
15631         {&hf_cflow_dropped_layer2_octet_delta_count,
15632           {"Dropped_Layer2_Octet_Delta_Count", "cflow.dropped_layer2_octet_delta_count",
15633            FT_UINT64, BASE_DEC, NULL, 0x0,
15634            NULL, HFILL}
15635         },
15636         {&hf_cflow_dropped_layer2_octet_total_count,
15637           {"Dropped_Layer2_Octet_Total_Count", "cflow.dropped_layer2_octet_total_count",
15638            FT_UINT64, BASE_DEC, NULL, 0x0,
15639            NULL, HFILL}
15640         },
15641         {&hf_cflow_ignored_layer2_octet_total_count,
15642           {"Ignored_Layer2_Octet_Total_Count", "cflow.ignored_layer2_octet_total_count",
15643            FT_UINT64, BASE_DEC, NULL, 0x0,
15644            NULL, HFILL}
15645         },
15646         {&hf_cflow_not_sent_layer2_octet_total_count,
15647           {"Not_Sent_Layer2_Octet_Total_Count", "cflow.not_sent_layer2_octet_total_count",
15648            FT_UINT64, BASE_DEC, NULL, 0x0,
15649            NULL, HFILL}
15650         },
15651         {&hf_cflow_layer2_octet_delta_sum_of_squares,
15652           {"Layer2_Octet_Delta_Sum_Of_Squares", "cflow.layer2_octet_delta_sum_of_squares",
15653            FT_UINT64, BASE_DEC, NULL, 0x0,
15654            NULL, HFILL}
15655         },
15656         {&hf_cflow_layer2_octet_total_sum_of_squares,
15657           {"Layer2_Octet_Total_Sum_Of_Squares", "cflow.layer2_octet_total_sum_of_squares",
15658            FT_UINT64, BASE_DEC, NULL, 0x0,
15659            NULL, HFILL}
15660         },
15661         {&hf_cflow_layer2_frame_delta_count,
15662           {"Layer2_Frame_Delta_Count", "cflow.layer2_frame_delta_count",
15663            FT_UINT64, BASE_DEC, NULL, 0x0,
15664            NULL, HFILL}
15665         },
15666         {&hf_cflow_layer2_frame_total_count,
15667           {"Layer2_Frame_Total_Count", "cflow.layer2_frame_total_count",
15668            FT_UINT64, BASE_DEC, NULL, 0x0,
15669            NULL, HFILL}
15670         },
15671         {&hf_cflow_pseudo_wire_destination_ipv4_address,
15672           {"Pseudo_Wire_Destination_Ipv4_Address", "cflow.pseudo_wire_destination_ipv4_address",
15673            FT_IPv4, BASE_NONE, NULL, 0x0,
15674            NULL, HFILL}
15675         },
15676         {&hf_cflow_ignored_layer2_frame_total_count,
15677           {"Ignored_Layer2_Frame_Total_Count", "cflow.ignored_layer2_frame_total_count",
15678            FT_UINT64, BASE_DEC, NULL, 0x0,
15679            NULL, HFILL}
15680         },
15681         {&hf_cflow_mib_object_value_integer,
15682           {"mibObject Value Integer", "cflow.mib_object_value_integer",
15683            FT_INT32, BASE_DEC, NULL, 0x0,
15684            NULL, HFILL}
15685         },
15686         {&hf_cflow_mib_object_value_octetstring,
15687           {"mibObject Octet String", "cflow.mib_object_octetstring",
15688            FT_BYTES, BASE_NONE, NULL, 0x0,
15689            NULL, HFILL}
15690         },
15691         {&hf_cflow_mib_object_value_oid,
15692           {"mibObject Value OID", "cflow.mib_object_value_oid",
15693            FT_BYTES, BASE_NONE, NULL, 0x0,
15694            NULL, HFILL}
15695         },
15696         {&hf_cflow_mib_object_value_bits,
15697           {"mibObject Value Bits", "cflow.mib_object_value_bits",
15698            FT_BYTES, BASE_NONE, NULL, 0x0,
15699            NULL, HFILL}
15700         },
15701         {&hf_cflow_mib_object_value_ipaddress,
15702           {"mibObject Value IP Address", "cflow.mib_object_value_ipaddress",
15703            FT_IPv4, BASE_NONE, NULL, 0x0,
15704            NULL, HFILL}
15705         },
15706         {&hf_cflow_mib_object_value_counter,
15707           {"mibObject Value Counter", "cflow.mib_object_value_counter",
15708            FT_UINT64, BASE_DEC, NULL, 0x0,
15709            NULL, HFILL}
15710         },
15711         {&hf_cflow_mib_object_value_gauge,
15712           {"mibObject Value Gauge", "cflow.mib_object_value_gauge",
15713            FT_UINT32, BASE_DEC, NULL, 0x0,
15714            NULL, HFILL}
15715         },
15716         {&hf_cflow_mib_object_value_timeticks,
15717           {"mibObject Value Timeticks", "cflow.mib_object_value_timeticks",
15718            FT_UINT32, BASE_DEC, NULL, 0x0,
15719            NULL, HFILL}
15720         },
15721         {&hf_cflow_mib_object_value_unsigned,
15722           {"mibObject Value Unsigned", "cflow.mib_object_value_unsigned",
15723            FT_UINT32, BASE_DEC, NULL, 0x0,
15724            NULL, HFILL}
15725         },
15726         {&hf_cflow_mib_object_value_table,
15727           {"mibObject Value Table", "cflow.mib_object_value_table",
15728            FT_BYTES, BASE_NONE, NULL, 0x0,
15729            NULL, HFILL}
15730         },
15731         {&hf_cflow_mib_object_value_row,
15732           {"mibObject Value Row", "cflow.mib_object_value_row",
15733            FT_BYTES, BASE_NONE, NULL, 0x0,
15734            NULL, HFILL}
15735         },
15736         {&hf_cflow_mib_object_identifier,
15737           {"mibObject Identifier", "cflow.mib_object_identifier",
15738            FT_BYTES, BASE_NONE, NULL, 0x0,
15739            NULL, HFILL}
15740         },
15741         {&hf_cflow_mib_subidentifier,
15742           {"mib SubIdentifier", "cflow.mib_subidentifier",
15743            FT_UINT32, BASE_DEC, NULL, 0x0,
15744            NULL, HFILL}
15745         },
15746         {&hf_cflow_mib_index_indicator,
15747           {"mib Index Indicator", "cflow.mib_index_indicator",
15748            FT_UINT64, BASE_HEX, NULL, 0x0,
15749            NULL, HFILL}
15750         },
15751         {&hf_cflow_mib_capture_time_semantics,
15752           {"mib Capture Time Semantics", "cflow.mib_capture_time_semantics",
15753            FT_UINT8, BASE_DEC, VALS(special_mib_capture_time_semantics), 0x0,
15754            NULL, HFILL}
15755         },
15756         {&hf_cflow_mib_context_engineid,
15757           {"mib Context EngineID", "cflow.mib_context_engineid",
15758            FT_BYTES, BASE_NONE, NULL, 0x0,
15759            NULL, HFILL}
15760         },
15761         {&hf_cflow_mib_context_name,
15762           {"mib Context Name", "cflow.mib_context_name",
15763            FT_STRING, BASE_NONE, NULL, 0x0,
15764            NULL, HFILL}
15765         },
15766         {&hf_cflow_mib_object_name,
15767           {"mib Object Name", "cflow.mib_object_name",
15768            FT_STRING, BASE_NONE, NULL, 0x0,
15769            NULL, HFILL}
15770         },
15771         {&hf_cflow_mib_object_description,
15772           {"mib Object Description", "cflow.mib_object_description",
15773            FT_STRING, BASE_NONE, NULL, 0x0,
15774            NULL, HFILL}
15775         },
15776         {&hf_cflow_mib_object_syntax,
15777           {"mib Object Syntax", "cflow.mib_object_syntax",
15778            FT_STRING, BASE_NONE, NULL, 0x0,
15779            NULL, HFILL}
15780         },
15781         {&hf_cflow_mib_module_name,
15782           {"mib Module Name", "cflow.mib_module_name",
15783            FT_STRING, BASE_NONE, NULL, 0x0,
15784            NULL, HFILL}
15785         },
15786         {&hf_cflow_mobile_imsi,
15787           {"mib Mobile IMSI", "cflow.mib_mobile_imsi",
15788            FT_STRING, BASE_NONE, NULL, 0x0,
15789            NULL, HFILL}
15790         },
15791         {&hf_cflow_mobile_msisdn,
15792           {"mib Mobile MSISDN", "cflow.mib_mobile_msisdn",
15793            FT_STRING, BASE_NONE, NULL, 0x0,
15794            NULL, HFILL}
15795         },
15796         {&hf_cflow_http_statuscode,
15797           {"HTTP Statuscode", "cflow.http_statuscode",
15798            FT_UINT16, BASE_DEC, NULL, 0x0,
15799            NULL, HFILL}
15800         },
15801         {&hf_cflow_source_transport_ports_limit,
15802           {"Source Transport Ports Limit", "cflow.source_transport_ports_limit",
15803            FT_UINT16, BASE_DEC, NULL, 0x0,
15804            NULL, HFILL}
15805         },
15806         {&hf_cflow_http_request_method,
15807           {"HTTP Request Method", "cflow.http_request_method",
15808            FT_STRING, BASE_NONE, NULL, 0x0,
15809            NULL, HFILL}
15810         },
15811         {&hf_cflow_http_request_host,
15812           {"HTTP Request Host", "cflow.http_request_host",
15813            FT_STRING, BASE_NONE, NULL, 0x0,
15814            NULL, HFILL}
15815         },
15816         {&hf_cflow_http_request_target,
15817           {"HTTP Request Target", "cflow.http_request_target",
15818            FT_STRING, BASE_NONE, NULL, 0x0,
15819            NULL, HFILL}
15820         },
15821         {&hf_cflow_http_message_version,
15822           {"HTTP Message Version", "cflow.http_message_version",
15823            FT_STRING, BASE_NONE, NULL, 0x0,
15824            NULL, HFILL}
15825         },
15826         {&hf_cflow_nat_instanceid,
15827           {"NAT Instance ID", "cflow.nat_instanceid",
15828            FT_UINT32, BASE_DEC, NULL, 0x0,
15829            NULL, HFILL}
15830         },
15831         {&hf_cflow_internal_address_realm,
15832           {"Internal Address Realm", "cflow.internal_address_realm",
15833            FT_BYTES, BASE_NONE, NULL, 0x0,
15834            NULL, HFILL}
15835         },
15836         {&hf_cflow_external_address_realm,
15837           {"External Address Realm", "cflow.external_address_realm",
15838            FT_BYTES, BASE_NONE, NULL, 0x0,
15839            NULL, HFILL}
15840         },
15841         {&hf_cflow_nat_quota_exceeded_event,
15842           {"NAT Quota Exceeded Event", "cflow.nat_quota_exceeded_event",
15843            FT_UINT32, BASE_DEC, VALS(special_nat_quota_exceeded_event), 0x0,
15844            NULL, HFILL}
15845         },
15846         {&hf_cflow_nat_threshold_event,
15847           {"NAT Threshold Event", "cflow.nat_threshold_event",
15848            FT_UINT32, BASE_DEC, VALS(special_nat_threshold_event), 0x0,
15849            NULL, HFILL}
15850         },
15851         {&hf_cflow_http_user_agent,
15852           {"HTTP User Agent", "cflow.http_user_agent",
15853            FT_STRING, BASE_NONE, NULL, 0x0,
15854            NULL, HFILL}
15855         },
15856         {&hf_cflow_http_content_type,
15857           {"HTTP Content Type", "cflow.http_content_type",
15858            FT_STRING, BASE_NONE, NULL, 0x0,
15859            NULL, HFILL}
15860         },
15861         {&hf_cflow_http_reason_phrase,
15862           {"HTTP Reason Phrase", "cflow.http_reason_phrase",
15863            FT_STRING, BASE_NONE, NULL, 0x0,
15864            NULL, HFILL}
15865         },
15866         {&hf_cflow_max_session_entries,
15867           {"Max Session Entries", "cflow.max_session_entries",
15868            FT_UINT32, BASE_DEC, NULL, 0x0,
15869            NULL, HFILL}
15870         },
15871         {&hf_cflow_max_bib_entries,
15872           {"Max BIB Entries", "cflow.max_bib_entries",
15873            FT_UINT32, BASE_DEC, NULL, 0x0,
15874            NULL, HFILL}
15875         },
15876         {&hf_cflow_max_entries_per_user,
15877           {"Max Entries Per User", "cflow.max_entries_per_user",
15878            FT_UINT32, BASE_DEC, NULL, 0x0,
15879            NULL, HFILL}
15880         },
15881         {&hf_cflow_max_subscribers,
15882           {"Max Subscribers", "cflow.max_subscribers",
15883            FT_UINT32, BASE_DEC, NULL, 0x0,
15884            NULL, HFILL}
15885         },
15886         {&hf_cflow_max_fragments_pending_reassembly,
15887           {"Max Fragments Pending Reassembly", "cflow.max_fragments_pending_reassembly",
15888            FT_UINT32, BASE_DEC, NULL, 0x0,
15889            NULL, HFILL}
15890         },
15891         {&hf_cflow_addresspool_highthreshold,
15892           {"Addresspool High Threshold", "cflow.addresspool_highthreshold",
15893            FT_UINT32, BASE_DEC, NULL, 0x0,
15894            NULL, HFILL}
15895         },
15896         {&hf_cflow_addresspool_lowthreshold,
15897           {"Addresspool Low Threshold", "cflow.addresspool_lowthreshold",
15898            FT_UINT32, BASE_DEC, NULL, 0x0,
15899            NULL, HFILL}
15900         },
15901         {&hf_cflow_addressport_mapping_highthreshold,
15902           {"Addressport Mapping High Threshold", "cflow.addressport_mapping_highthreshold",
15903            FT_UINT32, BASE_DEC, NULL, 0x0,
15904            NULL, HFILL}
15905         },
15906         {&hf_cflow_addressport_mapping_lowthreshold,
15907           {"Addressport Mapping Low Threshold", "cflow.addressport_mapping_lowthreshold",
15908            FT_UINT32, BASE_DEC, NULL, 0x0,
15909            NULL, HFILL}
15910         },
15911         {&hf_cflow_addressport_mapping_per_user_highthreshold,
15912           {"Addressport Mapping Per User High Threshold", "cflow.addressport_mapping_per_user_highthreshold",
15913            FT_UINT32, BASE_DEC, NULL, 0x0,
15914            NULL, HFILL}
15915         },
15916         {&hf_cflow_global_addressmapping_highthreshold,
15917           {"Global Address Mapping High Threshold", "cflow.global_addressmapping_highthreshold",
15918            FT_UINT32, BASE_DEC, NULL, 0x0,
15919            NULL, HFILL}
15920         },
15921         {&hf_cflow_vpn_identifier,
15922           {"VPN Identifier", "cflow.vpn_identifier",
15923            FT_BYTES, BASE_NONE, NULL, 0x0,
15924            NULL, HFILL}
15925         },
15926         {&hf_cflow_bgp_community,
15927           {"BGP Community", "cflow.bgp_community",
15928            FT_UINT32, BASE_DEC, NULL, 0x0,
15929            NULL, HFILL}
15930         },
15931         {&hf_cflow_bgp_source_community_list,
15932           {"BGP Source Community", "cflow.bgp_source_community",
15933            FT_BYTES, BASE_NONE, NULL, 0x0,
15934            NULL, HFILL}
15935         },
15936         {&hf_cflow_bgp_destination_community_list,
15937           {"BGP Destination Community", "cflow.bgp_destination_community",
15938            FT_BYTES, BASE_NONE, NULL, 0x0,
15939            NULL, HFILL}
15940         },
15941         {&hf_cflow_bgp_extended_community,
15942           {"BGP Extended Community", "cflow.bgp_extended_community",
15943            FT_BYTES, BASE_NONE, NULL, 0x0,
15944            NULL, HFILL}
15945         },
15946         {&hf_cflow_bgp_source_extended_community_list,
15947           {"BGP Source Extended Community", "cflow.bgp_source_extended_community",
15948            FT_BYTES, BASE_NONE, NULL, 0x0,
15949            NULL, HFILL}
15950         },
15951         {&hf_cflow_bgp_destination_extended_community_list,
15952           {"BGP Destination Extended Community", "cflow.bgp_destination_extended_community",
15953            FT_BYTES, BASE_NONE, NULL, 0x0,
15954            NULL, HFILL}
15955         },
15956         {&hf_cflow_bgp_large_community,
15957           {"BGP Large Community", "cflow.bgp_large_community",
15958            FT_BYTES, BASE_NONE, NULL, 0x0,
15959            NULL, HFILL}
15960         },
15961         {&hf_cflow_bgp_source_large_community_list,
15962           {"BGP Source Large Community", "cflow.bgp_source_large_community",
15963            FT_BYTES, BASE_NONE, NULL, 0x0,
15964            NULL, HFILL}
15965         },
15966         {&hf_cflow_bgp_destination_large_community_list,
15967           {"BGP Source Destination Community", "cflow.bgp_source_destination_community",
15968            FT_BYTES, BASE_NONE, NULL, 0x0,
15969            NULL, HFILL}
15970         },
15971
15972         { &hf_cflow_srh_flags_ipv6,
15973           {"Segment Routing Header IPv6 Flags", "cflow.srh_flags_ipv6",
15974            FT_UINT8, BASE_HEX, NULL, 0x0,
15975            NULL, HFILL}
15976         },
15977         { &hf_cflow_srh_flags_ipv6_oflag,
15978           {"OAM", "cflow.srh_flags_ipv6.oam",
15979            FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x04,
15980            NULL, HFILL}
15981         },
15982         { &hf_cflow_srh_flags_ipv6_reserved,
15983           {"Reserved", "cflow.srh_flags_ipv6.reserved",
15984            FT_BOOLEAN, 8, TFS(&tfs_used_notused), ~0x04,
15985            NULL, HFILL}
15986         },
15987         { &hf_cflow_srh_tag_ipv6,
15988           {"Segment Routing Header IPv6 Tag", "cflow.srh_tag_ipv6",
15989            FT_UINT16, BASE_HEX, NULL, 0x0,
15990            NULL, HFILL}
15991         },
15992         { &hf_cflow_srh_segment_ipv6,
15993           {"Segment Routing Header IPv6 Segment", "cflow.srh_segment_ipv6",
15994            FT_IPv6, BASE_NONE, NULL, 0x0,
15995            "Segment Address (IPv6)", HFILL}
15996         },
15997         { &hf_cflow_srh_active_segment_ipv6,
15998           {"Segment Routing Header Active Segment", "cflow.srh_active_segment_ipv6",
15999            FT_IPv6, BASE_NONE, NULL, 0x0,
16000            "Active Segment Address (IPv6)", HFILL}
16001         },
16002         { &hf_cflow_srh_segment_ipv6_basic_list,
16003           {"Segment Routing Header IPv6 Segment Basic List", "cflow.srh_segment_ipv6_basic_list",
16004            FT_BYTES, BASE_NONE, NULL, 0x0,
16005            NULL, HFILL}
16006         },
16007         { &hf_cflow_srh_segment_ipv6_list_section,
16008           {"Segment Routing Header IPv6 Segment List Section", "cflow.srh_segment_ipv6_list_section",
16009            FT_BYTES, BASE_NONE, NULL, 0x0,
16010            NULL, HFILL}
16011         },
16012         { &hf_cflow_srh_segments_ipv6_left,
16013           {"Segment Routing Header IPv6 Segments Left", "cflow.srh_segments_ipv6_left",
16014            FT_UINT8, BASE_HEX, NULL, 0x0,
16015            NULL, HFILL}
16016         },
16017         { &hf_cflow_srh_ipv6_section,
16018           {"Segment Routing Header IPv6 Section", "cflow.srh_ipv6_section",
16019            FT_BYTES, BASE_NONE, NULL, 0x0,
16020            NULL, HFILL}
16021         },
16022         { &hf_cflow_srh_ipv6_active_segment_type,
16023           {"Segment Routing Header IPv6 Active Segment Type", "cflow.srh_ipv6_active_segment_type",
16024            FT_UINT8, BASE_HEX, NULL, 0x0,
16025            NULL, HFILL}
16026         },
16027         { &hf_cflow_srh_segment_ipv6_locator_length,
16028           {"Segment Routing Header IPv6 Segment Locator Length", "cflow.srh_segment_ipv6_locator_length",
16029            FT_UINT8, BASE_HEX, NULL, 0x0,
16030            NULL, HFILL}
16031         },
16032         { &hf_cflow_srh_segment_ipv6_endpoint_behaviour,
16033           {"Segment Routing Header IPv6 Endpoint Behaviour", "cflow.srh_segment_ipv6_endpoint_behaviour",
16034            FT_BYTES, BASE_NONE, NULL, 0x0,
16035            NULL, HFILL}
16036         },
16037         { &hf_cflow_gtpu_flags,
16038           {"GTPU Flags", "cflow.gtpu.flags",
16039            FT_UINT8, BASE_HEX, NULL, 0x0,
16040            NULL, HFILL}
16041         },
16042         { &hf_gtpu_flags_version,
16043           {"Version", "cflow.gtpu.version",
16044            FT_UINT8, BASE_HEX_DEC, NULL, 0xE0,
16045            NULL, HFILL}
16046         },
16047         { &hf_gtpu_flags_pt,
16048           {"Protocol Type", "cflow.gtpu.pt",
16049            FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x10,
16050            NULL, HFILL}
16051         },
16052         { &hf_gtpu_flags_reserved,
16053           {"Reserved Bit", "cflow.gtpu.reserved",
16054            FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x8,
16055            NULL, HFILL}
16056         },
16057         { &hf_gtpu_flags_s,
16058           {"S Bit", "cflow.gtpu.s",
16059            FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x4,
16060            NULL, HFILL}
16061         },
16062         { &hf_gtpu_flags_n,
16063           {"N Bit", "cflow.gtpu.n",
16064            FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x2,
16065            NULL, HFILL}
16066         },
16067         { &hf_gtpu_flags_pn,
16068           {"PN Bit", "cflow.gtpu.pn",
16069            FT_BOOLEAN, 8, TFS(&tfs_used_notused), 0x1,
16070            NULL, HFILL}
16071         },
16072         { &hf_cflow_gtpu_msg_type,
16073           {"GTPU Message Type", "cflow.gtpu.msg_type",
16074            FT_UINT8, BASE_HEX_DEC, NULL, 0x0,
16075            NULL, HFILL}
16076         },
16077         { &hf_cflow_gtpu_teid,
16078           {"GTPU TEID", "cflow.gtpu.teid",
16079            FT_UINT32, BASE_HEX_DEC, NULL, 0x0,
16080            NULL, HFILL}
16081         },
16082         { &hf_cflow_gtpu_seq_num,
16083           {"GTPU Sequence Number", "cflow.gtpu.seq_num",
16084            FT_UINT16, BASE_HEX_DEC, NULL, 0x0,
16085            NULL, HFILL}
16086         },
16087         { &hf_cflow_gtpu_qfi,
16088           {"GTPU QFI", "cflow.gtpu_qfi",
16089            FT_UINT8, BASE_HEX_DEC, NULL, 0x0,
16090            NULL, HFILL}
16091         },
16092         { &hf_cflow_gtpu_pdu_type,
16093           {"GTPU PDU Type", "cflow.gtpu_pdu_type",
16094            FT_UINT8, BASE_HEX_DEC, NULL, 0x0,
16095            NULL, HFILL}
16096         },
16097         /*
16098          * end pdu content storage
16099          */
16100         {&hf_cflow_scope_system,
16101          {"ScopeSystem", "cflow.scope_system",
16102           FT_BYTES, BASE_NONE, NULL, 0x0,
16103           "Option Scope System", HFILL}
16104         },
16105         {&hf_cflow_scope_interface,
16106          {"ScopeInterface", "cflow.scope_interface",
16107           FT_UINT32, BASE_DEC, NULL, 0x0,
16108           "Option Scope Interface", HFILL}
16109         },
16110         {&hf_cflow_scope_linecard,
16111          {"ScopeLinecard", "cflow.scope_linecard",
16112           FT_UINT32, BASE_DEC, NULL, 0x0,
16113           "Option Scope Linecard", HFILL}
16114         },
16115         {&hf_cflow_scope_cache,
16116          {"ScopeCache", "cflow.scope_cache",
16117           FT_BYTES, BASE_NONE, NULL, 0x0,
16118           "Option Scope Cache", HFILL}
16119         },
16120         {&hf_cflow_scope_template,
16121          {"ScopeTemplate", "cflow.scope_template",
16122           FT_BYTES, BASE_NONE, NULL, 0x0,
16123           "Option Scope Template", HFILL}
16124         },
16125
16126         {&hf_cflow_padding,
16127          {"Padding", "cflow.padding",
16128           FT_BYTES, BASE_NONE, NULL, 0x0,
16129           NULL, HFILL}
16130         },
16131
16132         {&hf_cflow_reserved,
16133          {"Reserved", "cflow.reserved",
16134           FT_BYTES, BASE_NONE, NULL, 0x0,
16135           NULL, HFILL}
16136         },
16137
16138         {&hf_cflow_extra_packets,
16139          {"Extra packets", "cflow.extra_packets",
16140           FT_BYTES, BASE_NONE, NULL, 0x0,
16141           NULL, HFILL}
16142         },
16143
16144         /* IPFIX */
16145         {&hf_cflow_unknown_field_type,
16146          {"Unknown Field Type", "cflow.unknown_field_type",
16147           FT_BYTES, BASE_NONE, NULL, 0x0,
16148           NULL, HFILL}
16149         },
16150         {&hf_cflow_template_ipfix_total_field_count,
16151          {"Total Field Count", "cflow.template_ipfix_total_field_count",
16152           FT_UINT16, BASE_DEC, NULL, 0x0,
16153           "IPFIX Options Template Total Field Count", HFILL}
16154         },
16155         {&hf_cflow_template_ipfix_scope_field_count,
16156          {"Scope Field Count", "cflow.template_ipfix_scope_field_count",
16157           FT_UINT16, BASE_DEC, NULL, 0x0,
16158           "IPFIX Options Template Scope Field Count", HFILL}
16159         },
16160         {&hf_cflow_template_ipfix_pen_provided,
16161          {"Pen provided", "cflow.template_ipfix_pen_provided",
16162           FT_BOOLEAN, 16, TFS(&tfs_yes_no), 0x8000,
16163           "Is Template Enterprise Specific", HFILL}
16164         },
16165         {&hf_cflow_template_ipfix_field_type,
16166          {"Type", "cflow.template_ipfix_field_type",
16167           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v9_v10_template_types_ext, 0x7FFF,
16168           "Template field type", HFILL}
16169         },
16170         {&hf_cflow_template_plixer_field_type,
16171          {"Type", "cflow.template_plixer_field_type",
16172           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_plixer_ext, 0x7FFF,
16173           "Template field type", HFILL}
16174         },
16175         {&hf_cflow_template_ntop_field_type,
16176          {"Type", "cflow.template_ntop_field_type",
16177           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_ntop_ext, 0x7FFF,
16178           "Template field type", HFILL}
16179         },
16180         {&hf_cflow_template_ixia_field_type,
16181          {"Type", "cflow.template_ixia_field_type",
16182           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_ixia_ext, 0x7FFF,
16183           "Template field type", HFILL}
16184         },
16185         {&hf_cflow_template_netscaler_field_type,
16186          {"Type", "cflow.template_netscaler_field_type",
16187           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_netscaler_ext, 0x7FFF,
16188           "Template field type", HFILL}
16189         },
16190         {&hf_cflow_template_barracuda_field_type,
16191          {"Type", "cflow.template_barracuda_field_type",
16192           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_barracuda_ext, 0x7FFF,
16193           "Template field type", HFILL}
16194         },
16195         {&hf_cflow_template_gigamon_field_type,
16196          {"Type", "cflow.template_gigamon_field_type",
16197           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_gigamon_ext, 0x7FFF,
16198           "Template field type", HFILL}
16199         },
16200         {&hf_cflow_template_cisco_field_type,
16201          {"Type", "cflow.template_cisco_field_type",
16202           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_cisco_ext, 0x7FFF,
16203           "Template field type", HFILL}
16204         },
16205         {&hf_cflow_template_niagara_networks_field_type,
16206          {"Type", "cflow.template_niagara_networks_field_type",
16207           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_niagara_networks_ext, 0x7FFF,
16208           "Template field type", HFILL}
16209         },
16210         {&hf_cflow_template_fastip_field_type,
16211          {"Type", "cflow.template_fastip_field_type",
16212           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_fastip_ext, 0x7FFF,
16213           "Template field type", HFILL}
16214         },
16215         {&hf_cflow_template_juniper_field_type,
16216          {"Juniper Resiliency", "cflow.template_juniper_resiliency_type",
16217           FT_UINT16, BASE_DEC|BASE_EXT_STRING, &v10_template_types_juniper_ext, 0x7FFF,
16218           "Template field type", HFILL}
16219         },
16220         {&hf_cflow_template_ipfix_field_type_enterprise,
16221          {"Type", "cflow.template_ipfix_field_type_enterprise",
16222           FT_UINT16, BASE_DEC, NULL, 0x7FFF,
16223           "Template field type", HFILL}
16224         },
16225         {&hf_cflow_template_ipfix_field_pen,
16226          {"PEN",
16227           "cflow.template_ipfix_field_pen",
16228           FT_UINT32, BASE_DEC, NULL, 0x0,
16229           "IPFIX Private Enterprise Number", HFILL}
16230         },
16231         {&hf_cflow_cts_sgt_source_tag,
16232          {"Source SGT",
16233           "cflow.source_sgt_tag",
16234           FT_UINT16, BASE_DEC, NULL, 0x0,
16235           NULL, HFILL}
16236         },
16237         {&hf_cflow_cts_sgt_destination_tag,
16238          {"Destination SGT",
16239           "cflow.destination_sgt_tag",
16240           FT_UINT16, BASE_DEC, NULL, 0x0,
16241           NULL, HFILL}
16242         },
16243         {&hf_cflow_cts_sgt_source_name,
16244          {"Source SGT Name",
16245           "cflow.source_sgt_name",
16246           FT_STRING, BASE_NONE, NULL, 0x0,
16247           NULL, HFILL}
16248         },
16249         {&hf_cflow_cts_sgt_destination_name,
16250          {"Destination SGT Name",
16251           "cflow.destination_sgt_name",
16252           FT_STRING, BASE_NONE, NULL, 0x0,
16253           NULL, HFILL}
16254         },
16255         {&hf_cflow_packets_dropped,
16256          {"Packets Dropped",
16257           "cflow.packets_dropped",
16258           FT_UINT32, BASE_DEC, NULL, 0x0,
16259           NULL, HFILL}
16260         },
16261         {&hf_cflow_byte_rate,
16262          {"Byte Rate",
16263           "cflow.byte_rate",
16264           FT_UINT32, BASE_DEC, NULL, 0x0,
16265           NULL, HFILL}
16266         },
16267         {&hf_cflow_application_media_bytes,
16268          {"Media Bytes",
16269           "cflow.application_media_bytes",
16270           FT_UINT32, BASE_DEC, NULL, 0x0,
16271           NULL, HFILL}
16272         },
16273         {&hf_cflow_application_media_byte_rate,
16274          {"Media Byte Rate",
16275           "cflow.media_byte_rate",
16276           FT_UINT32, BASE_DEC, NULL, 0x0,
16277           NULL, HFILL}
16278         },
16279         {&hf_cflow_application_media_packets,
16280          {"Media Packets",
16281           "cflow.application_media_packets",
16282           FT_UINT32, BASE_DEC, NULL, 0x0,
16283           NULL, HFILL}
16284         },
16285         {&hf_cflow_application_media_packet_rate,
16286          {"Media Packet Rate",
16287           "cflow.media_packet_rate",
16288           FT_UINT32, BASE_DEC, NULL, 0x0,
16289           NULL, HFILL}
16290         },
16291         {&hf_cflow_application_media_event,
16292          {"Media Event",
16293           "cflow.application_media_event",
16294           FT_UINT8, BASE_DEC, NULL, 0x0,
16295           NULL, HFILL}
16296         },
16297         {&hf_cflow_monitor_event,
16298          {"Monitor Event",
16299           "cflow.monitor_event",
16300           FT_UINT8, BASE_DEC, NULL, 0x0,
16301           NULL, HFILL}
16302         },
16303         {&hf_cflow_timestamp_interval,
16304          {"Timestamp Interval",
16305           "cflow.timestamp_interval",
16306           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
16307           NULL, HFILL}
16308         },
16309         {&hf_cflow_transport_packets_expected,
16310          {"Transport Packets Expected",
16311           "cflow.transport_packets_expected",
16312           FT_UINT32, BASE_DEC, NULL, 0x0,
16313           NULL, HFILL}
16314         },
16315         {&hf_cflow_transport_round_trip_time_string,
16316          {"Transport Round-Trip-Time",
16317           "cflow.transport_rtt.string",
16318           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16319           NULL, HFILL}
16320         },
16321         {&hf_cflow_transport_round_trip_time,
16322          {"Transport Round-Trip-Time",
16323           "cflow.transport_rtt",
16324           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
16325           NULL, HFILL}
16326         },
16327         {&hf_cflow_transport_event_packet_loss,
16328          {"Transport Packet Loss Events",
16329           "cflow.transport_packet_loss_event",
16330           FT_UINT32, BASE_DEC, NULL, 0x0,
16331           NULL, HFILL}
16332         },
16333         {&hf_cflow_transport_packets_lost,
16334          {"Transport Packets Lost",
16335           "cflow.transport_packets_lost",
16336           FT_UINT32, BASE_DEC, NULL, 0x0,
16337           NULL, HFILL}
16338         },
16339         {&hf_cflow_transport_packets_lost_string,
16340          {"Transport Packets Lost",
16341           "cflow.transport_packets_lost",
16342           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16343           NULL, HFILL}
16344         },
16345         {&hf_cflow_transport_packets_lost_rate,
16346          {"Transport Packet Loss Rate",
16347           "cflow.transport_packet_loss_rate",
16348           FT_UINT32, BASE_DEC, NULL, 0x0,
16349           NULL, HFILL}
16350         },
16351         {&hf_cflow_transport_packets_lost_rate_string,
16352          {"Transport Packet Loss Rate",
16353           "cflow.transport_packet_loss_rate",
16354           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials) , 0x0,
16355           NULL, HFILL}
16356         },
16357         {&hf_cflow_transport_rtp_ssrc,
16358          {"RTP SSRC",
16359           "cflow.transport_rtp_ssrc",
16360           FT_UINT32, BASE_DEC, NULL, 0x0,
16361           NULL, HFILL}
16362         },
16363         {&hf_cflow_transport_rtp_jitter_mean,
16364          {"RTP Mean Jitter",
16365           "cflow.transport_jitter_mean",
16366           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
16367           NULL, HFILL}
16368         },
16369         {&hf_cflow_transport_rtp_jitter_mean_string,
16370          {"RTP Mean Jitter",
16371           "cflow.transport_jitter_mean.string",
16372           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16373           NULL, HFILL}
16374         },
16375         {&hf_cflow_transport_rtp_jitter_min,
16376          {"RTP Min Jitter",
16377           "cflow.transport_jitter_min",
16378           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
16379           NULL, HFILL}
16380         },
16381         {&hf_cflow_transport_rtp_jitter_min_string,
16382          {"RTP Min Jitter",
16383           "cflow.transport_jitter_min.string",
16384           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16385           NULL, HFILL}
16386         },
16387         {&hf_cflow_transport_rtp_jitter_max,
16388          {"RTP Max Jitter",
16389           "cflow.transport_jitter_max",
16390           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
16391           NULL, HFILL}
16392         },
16393         {&hf_cflow_transport_rtp_jitter_max_string,
16394          {"RTP Max Jitter",
16395           "cflow.transport_jitter_max.string",
16396           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16397           NULL, HFILL}
16398         },
16399
16400         {&hf_cflow_transport_rtp_payload_type,
16401          {"RTP Payload Type",
16402           "cflow.rtp_payload_type",
16403           FT_UINT8, BASE_DEC, NULL, 0x0,
16404           NULL, HFILL}
16405         },
16406         {&hf_cflow_transport_rtp_payload_type_string,
16407          {"RTP Payload Type",
16408           "cflow.rtp_payload_type",
16409           FT_UINT8, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16410           NULL, HFILL}
16411         },
16412         {&hf_cflow_transport_bytes_out_of_order,
16413          {"Transport Bytes Out of Order",
16414           "cflow.transport_bytes_out_of_ordera",
16415           FT_UINT64, BASE_DEC, NULL, 0x0,
16416           NULL, HFILL}
16417         },
16418 #if 0
16419         {&hf_cflow_transport_packets_out_of_order,
16420          {"Transport Packets Out of Order",
16421           "cflow.transport_packets_out_of_order",
16422           FT_UINT32, BASE_DEC, NULL, 0x0,
16423           NULL, HFILL}
16424         },
16425 #endif
16426         {&hf_cflow_transport_packets_out_of_order_string,
16427          {"Transport Packets Out of Order",
16428           "cflow.transport_packets_out_of_order",
16429           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16430           NULL, HFILL}
16431         },
16432        {&hf_cflow_transport_tcp_window_size_min,
16433          {"Transport TCP Window Size Min",
16434           "cflow.transport_tcp_window_size_min",
16435           FT_UINT32, BASE_DEC, NULL, 0x0,
16436           NULL, HFILL}
16437         },
16438        {&hf_cflow_transport_tcp_window_size_min_string,
16439          {"Transport TCP Window Size Min",
16440           "cflow.transport_tcp_window_size_min",
16441           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16442           NULL, HFILL}
16443         },
16444        {&hf_cflow_transport_tcp_window_size_max,
16445          {"Transport TCP Window Size Max",
16446           "cflow.transport_tcp_window_size_max",
16447           FT_UINT32, BASE_DEC, NULL, 0x0,
16448           NULL, HFILL}
16449         },
16450        {&hf_cflow_transport_tcp_window_size_max_string,
16451          {"Transport TCP Window Size Max",
16452           "cflow.transport_tcp_window_size_max",
16453           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16454           NULL, HFILL}
16455         },
16456        {&hf_cflow_transport_tcp_window_size_mean,
16457          {"Transport TCP Window Size Mean",
16458           "cflow.transport_tcp_window_size_mean",
16459           FT_UINT32, BASE_DEC, NULL, 0x0,
16460           NULL, HFILL}
16461         },
16462        {&hf_cflow_transport_tcp_window_size_mean_string,
16463          {"Transport TCP Window Size Mean",
16464           "cflow.transport_tcp_window_size_mean",
16465           FT_UINT32, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16466           NULL, HFILL}
16467         },
16468        {&hf_cflow_transport_tcp_maximum_segment_size,
16469          {"Transport TCP Maximum Segment Size",
16470           "cflow.transport_tcp_maximum_segment_size",
16471           FT_UINT16, BASE_DEC, NULL, 0x0,
16472           NULL, HFILL}
16473         },
16474        {&hf_cflow_transport_tcp_maximum_segment_size_string,
16475          {"Transport TCP Maximum Segment Size",
16476           "cflow.transport_tcp_maximum_segment_size",
16477           FT_UINT16, BASE_HEX, VALS(performance_monitor_specials), 0x0,
16478           NULL, HFILL}
16479         },
16480         /* Sequence analysis fields */
16481        {&hf_cflow_sequence_analysis_expected_sn,
16482          {"Expected Sequence Number",
16483           "cflow.sequence_analysis.expected_sn",
16484           FT_UINT32, BASE_DEC, NULL, 0x0,
16485           NULL, HFILL}
16486         },
16487        {&hf_cflow_sequence_analysis_previous_frame,
16488          {"Previous Frame in Sequence",
16489           "cflow.sequence_analysis.previous_frame",
16490           FT_FRAMENUM, BASE_NONE, NULL, 0x0,
16491           NULL, HFILL}
16492         },
16493
16494         /* Ericsson SE NAT Logging */
16495         {&hf_cflow_nat_context_id,
16496          {"NAT Context ID", "cflow.nat_context_id",
16497           FT_UINT32, BASE_DEC, NULL, 0x0,
16498           "Internal context ID", HFILL}
16499         },
16500         {&hf_cflow_nat_context_name,
16501          {"NAT Context Name", "cflow.nat_context_name",
16502           FT_STRING, BASE_NONE, NULL, 0x0,
16503           "Zero terminated context Name", HFILL}
16504         },
16505         {&hf_cflow_nat_assign_time,
16506          {"NAT Assign Time", "cflow.nat_assign_time",
16507           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
16508           "Seconds of UNIX timestamp for assign", HFILL}
16509         },
16510         {&hf_cflow_nat_unassign_time,
16511          {"NAT Unassign Time", "cflow.nat_unassign_time",
16512           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
16513           "Seconds of UNIX timestamp for unassign", HFILL}
16514         },
16515         {&hf_cflow_nat_int_addr,
16516          {"Internal IPv4 address", "cflow.nat_int_addr",
16517           FT_IPv4, BASE_NONE, NULL, 0x0,
16518           NULL, HFILL}
16519         },
16520         {&hf_cflow_nat_ext_addr,
16521          {"External IPv4 address", "cflow.nat_ext_addr",
16522           FT_IPv4, BASE_NONE, NULL, 0x0,
16523           NULL, HFILL}
16524         },
16525         {&hf_cflow_nat_ext_port_first,
16526          {"NAT port start", "cflow.nat_ext_port_first",
16527           FT_UINT16, BASE_DEC, NULL, 0x0,
16528           "External L4 port start", HFILL}
16529         },
16530         {&hf_cflow_nat_ext_port_last,
16531          {"NAT port end", "cflow.nat_ext_port_last",
16532           FT_UINT16, BASE_DEC, NULL, 0x0,
16533           "External L4 port end", HFILL}
16534         },
16535         /* Cisco ASA 5500 Series */
16536         {&hf_cflow_ingress_acl_id,
16537          {"Ingress ACL ID", "cflow.ingress_acl_id",
16538           FT_BYTES, BASE_NONE, NULL, 0x0,
16539           NULL, HFILL}
16540         },
16541         {&hf_cflow_egress_acl_id,
16542          {"Egress ACL ID", "cflow.egress_acl_id",
16543           FT_BYTES, BASE_NONE, NULL, 0x0,
16544           NULL, HFILL}
16545         },
16546         {&hf_cflow_fw_ext_event,
16547          {"Extended firewall event code", "cflow.fw_ext_event",
16548           FT_UINT16, BASE_DEC, VALS(v9_extended_firewall_event), 0x0,
16549           NULL, HFILL}
16550         },
16551         {&hf_cflow_aaa_username,
16552          {"AAA username", "cflow.aaa_username",
16553           FT_STRING, BASE_NONE, NULL, 0x0,
16554           NULL, HFILL}
16555         },
16556
16557         {&hf_ipfix_enterprise_private_entry,
16558          {"Enterprise Private entry", "cflow.enterprise_private_entry",
16559           FT_BYTES, BASE_NONE, NULL, 0x0,
16560           NULL, HFILL}
16561         },
16562         /* Private Information Elements */
16563
16564         /* CACE root (a hidden item to allow filtering) */
16565         {&hf_pie_cace,
16566          {"CACE", "cflow.pie.cace",
16567           FT_NONE, BASE_NONE, NULL, 0x0,
16568           NULL, HFILL}
16569         },
16570         /* CACE Technologies, 32622 / 0 */
16571         {&hf_pie_cace_local_ipv4_address,
16572          {"Local IPv4 Address", "cflow.pie.cace.localaddr4",
16573           FT_IPv4, BASE_NONE, NULL, 0x0,
16574           "Local IPv4 Address (caceLocalIPv4Address)", HFILL}
16575         },
16576         /* CACE Technologies, 32622 / 1 */
16577         {&hf_pie_cace_remote_ipv4_address,
16578          {"Remote IPv4 Address", "cflow.pie.cace.remoteaddr4",
16579           FT_IPv4, BASE_NONE, NULL, 0x0,
16580           "Remote IPv4 Address (caceRemoteIPv4Address)", HFILL}
16581         },
16582         /* CACE Technologies, 32622 / 2 */
16583         {&hf_pie_cace_local_ipv6_address,
16584          {"Local IPv6 Address", "cflow.pie.cace.localaddr6",
16585           FT_IPv6, BASE_NONE, NULL, 0x0,
16586           "Local IPv6 Address (caceLocalIPv6Address)", HFILL}
16587         },
16588         /* CACE Technologies, 32622 / 3 */
16589         {&hf_pie_cace_remote_ipv6_address,
16590          {"Remote IPv6 Address", "cflow.pie.cace.remoteaddr6",
16591           FT_IPv6, BASE_NONE, NULL, 0x0,
16592           "Remote IPv6 Address (caceRemoteIPv6Address)", HFILL}
16593         },
16594         /* CACE Technologies, 32622 / 4 */
16595         {&hf_pie_cace_local_port,
16596          {"Local Port", "cflow.pie.cace.localport",
16597           FT_UINT16, BASE_DEC, NULL, 0x0,
16598           "Local Transport Port (caceLocalTransportPort)", HFILL}
16599         },
16600         /* CACE Technologies, 32622 / 5 */
16601         {&hf_pie_cace_remote_port,
16602          {"Remote Port", "cflow.pie.cace.remoteport",
16603           FT_UINT16, BASE_DEC, NULL, 0x0,
16604           "Remote Transport Port (caceRemoteTransportPort)", HFILL}
16605         },
16606         /* CACE Technologies, 32622 / 6 */
16607         {&hf_pie_cace_local_ipv4_id,
16608          {"Local IPv4 ID", "cflow.pie.cace.localip4id",
16609           FT_UINT16, BASE_DEC, NULL, 0x0,
16610           "The IPv4 identification header field from a locally-originated packet (caceLocalIPv4id)", HFILL}
16611         },
16612         /* CACE Technologies, 32622 / 7 */
16613         {&hf_pie_cace_local_icmp_id,
16614          {"Local ICMP ID", "cflow.pie.cace.localicmpid",
16615           FT_UINT16, BASE_DEC, NULL, 0x0,
16616           "The ICMP identification header field from a locally-originated ICMPv4 or ICMPv6 echo request (caceLocalICMPid)", HFILL}
16617         },
16618         /* CACE Technologies, 32622 / 8 */
16619         {&hf_pie_cace_local_uid,
16620          {"Local User ID", "cflow.pie.cace.localuid",
16621           FT_UINT32, BASE_DEC, NULL, 0x0,
16622           "Local User ID (caceLocalProcessUserId)", HFILL}
16623         },
16624         /* CACE Technologies, 32622 / 9 */
16625         {&hf_pie_cace_local_pid,
16626          {"Local Process ID", "cflow.pie.cace.localpid",
16627           FT_UINT32, BASE_DEC, NULL, 0x0,
16628           "Local Process ID (caceLocalProcessId)", HFILL}
16629         },
16630         /* CACE Technologies, 32622 / 10 */
16631         {&hf_pie_cace_local_username_len,
16632          {"Local Username Length", "cflow.pie.cace.localusernamelen",
16633           FT_UINT8, BASE_DEC, NULL, 0x0,
16634           "Local User Name Length (caceLocalProcessUserName)", HFILL}
16635         },
16636         /* CACE Technologies, 32622 / 10 */
16637         {&hf_pie_cace_local_username,
16638          {"Local User Name", "cflow.pie.cace.localusername",
16639           FT_STRING, BASE_NONE, NULL, 0x0,
16640           "Local User Name (caceLocalProcessUserName)", HFILL}
16641         },
16642         /* CACE Technologies, 32622 / 11 */
16643         {&hf_pie_cace_local_cmd_len,
16644          {"Local Command Length", "cflow.pie.cace.localcmdlen",
16645           FT_UINT8, BASE_DEC, NULL, 0x0,
16646           "Local Command Length (caceLocalProcessCommand)", HFILL}
16647         },
16648         /* CACE Technologies, 32622 / 11 */
16649         {&hf_pie_cace_local_cmd,
16650          {"Local Command", "cflow.pie.cace.localcmd",
16651           FT_STRING, BASE_NONE, NULL, 0x0,
16652           "Local Command (caceLocalProcessCommand)", HFILL}
16653         },
16654
16655         /* ntop root (a hidden item to allow filtering) */
16656         {&hf_pie_ntop,
16657          {"Ntop", "cflow.pie.ntop",
16658           FT_NONE, BASE_NONE, NULL, 0x0,
16659           NULL, HFILL}
16660         },
16661         {&hf_pie_fastip_meter_version,
16662          {"Meter Version", "cflow.pie.fastip.meter_version",
16663           FT_STRING, BASE_NONE, NULL, 0x0,
16664           NULL, HFILL}
16665         },
16666         {&hf_pie_fastip_meter_os_sysname,
16667          {"Meter OS System Name", "cflow.pie.fastip.meter_os_sysname",
16668           FT_STRING, BASE_NONE, NULL, 0x0,
16669           NULL, HFILL}
16670         },
16671         {&hf_pie_fastip_meter_os_nodename,
16672          {"Meter OS Node Name", "cflow.pie.fastip.meter_os_nodename",
16673           FT_STRING, BASE_NONE, NULL, 0x0,
16674           NULL, HFILL}
16675         },
16676         {&hf_pie_fastip_meter_os_release,
16677          {"Meter OS Release", "cflow.pie.fastip.meter_os_release",
16678           FT_STRING, BASE_NONE, NULL, 0x0,
16679           NULL, HFILL}
16680         },
16681         {&hf_pie_fastip_meter_os_version,
16682          {"Meter OS Version", "cflow.pie.fastip.meter_os_version",
16683           FT_STRING, BASE_NONE, NULL, 0x0,
16684           NULL, HFILL}
16685         },
16686         {&hf_pie_fastip_meter_os_machine,
16687          {"Meter OS Machine", "cflow.pie.fastip.meter_os_machine",
16688           FT_STRING, BASE_NONE, NULL, 0x0,
16689           NULL, HFILL}
16690         },
16691         {&hf_pie_fastip_epoch_second,
16692          {"Epoch Second", "cflow.pie.fastip.epoch_second",
16693           FT_UINT32, BASE_DEC, NULL, 0x0,
16694           NULL, HFILL}
16695         },
16696         {&hf_pie_fastip_nic_name,
16697          {"NIC Name", "cflow.pie.fastip.nic_name",
16698           FT_STRING, BASE_NONE, NULL, 0x0,
16699           NULL, HFILL}
16700         },
16701         {&hf_pie_fastip_nic_id,
16702          {"NIC ID", "cflow.pie.fastip.nic_id",
16703           FT_UINT16, BASE_DEC, NULL, 0x0,
16704           NULL, HFILL}
16705         },
16706         {&hf_pie_fastip_nic_mac,
16707          {"NIC MAC", "cflow.pie.fastip.nic_mac",
16708           FT_ETHER, BASE_NONE, NULL, 0x0,
16709           NULL, HFILL}
16710         },
16711         {&hf_pie_fastip_nic_ip,
16712          {"NIC IP", "cflow.pie.fastip.nic_ip",
16713           FT_IPv4, BASE_NONE, NULL, 0x0,
16714           NULL, HFILL}
16715         },
16716         /*
16717         {&hf_pie_fastip_collisions
16718         {&hf_pie_fastip_errors
16719         */
16720         {&hf_pie_fastip_nic_driver_name,
16721          {"NIC Driver Name", "cflow.pie.fastip.nic_driver_name",
16722           FT_STRING, BASE_NONE, NULL, 0x0,
16723           NULL, HFILL}
16724         },
16725         {&hf_pie_fastip_nic_driver_version,
16726          {"NIC Driver Version", "cflow.pie.fastip.nic_driver_version",
16727           FT_STRING, BASE_NONE, NULL, 0x0,
16728           NULL, HFILL}
16729         },
16730         {&hf_pie_fastip_nic_firmware_version,
16731          {"NIC Firmware Version", "cflow.pie.fastip.nic_firmware_version",
16732           FT_STRING, BASE_NONE, NULL, 0x0,
16733           NULL, HFILL}
16734         },
16735         {&hf_pie_fastip_meter_os_distribution,
16736          {"Meter OS Distribution", "cflow.pie.fastip.meter_os_distribution",
16737           FT_STRING, BASE_NONE, NULL, 0x0,
16738           NULL, HFILL}
16739         },
16740         /*
16741         {&hf_pie_fastip_bond_interface_mode
16742         {&hf_pie_fastip_bond_interface_physical_nic_count
16743         {&hf_pie_fastip_bond_interface_id
16744         */
16745         {&hf_pie_fastip_tcp_handshake_rtt_usec,
16746          {"TCP Handshake RTT uSec", "cflow.pie.fastip.tcp_handshake_rtt_usec",
16747           FT_UINT32, BASE_DEC, NULL, 0x0,
16748           NULL, HFILL}
16749         },
16750         {&hf_pie_fastip_app_rtt_usec,
16751          {"App RTT uSec", "cflow.pie.fastip.app_rtt_usec",
16752           FT_UINT32, BASE_DEC, NULL, 0x0,
16753           NULL, HFILL}
16754         },
16755         {&hf_pie_fastip_tcp_flags,
16756          {"TCP Flags", "cflow.pie.fastip.tcp_flags",
16757           FT_UINT8, BASE_HEX, NULL, 0x0,
16758           NULL, HFILL}
16759         },
16760         /* ntop, 35632 / 80 */
16761         {&hf_pie_ntop_src_fragments,
16762          {"Num fragmented packets src->dst", "cflow.pie.ntop.src_fragments",
16763           FT_UINT16, BASE_DEC, NULL, 0x0,
16764           NULL, HFILL}
16765         },
16766         /* ntop, 35632 / 81 */
16767         {&hf_pie_ntop_dst_fragments,
16768          {"Num fragmented packets dst->src", "cflow.pie.ntop.dst_fragments",
16769           FT_UINT16, BASE_DEC, NULL, 0x0,
16770           NULL, HFILL}
16771         },
16772         /* ntop, 35632 / 82 */
16773         {&hf_pie_ntop_src_to_dst_max_throughput,
16774          {"Src to dst max throughput", "cflow.pie.ntop.src_to_dst_max_throughput",
16775           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0,
16776           NULL, HFILL}
16777         },
16778         /* ntop, 35632 / 83 */
16779         {&hf_pie_ntop_src_to_dst_min_throughput,
16780          {"Src to dst min throughput", "cflow.pie.ntop.src_to_dst_min_throughput",
16781           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0,
16782           NULL, HFILL}
16783         },
16784         /* ntop, 35632 / 84 */
16785         {&hf_pie_ntop_src_to_dst_avg_throughput,
16786          {"Src to dst average throughput", "cflow.pie.ntop.src_to_dst_avg_throughput",
16787           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0,
16788           NULL, HFILL}
16789         },
16790         /* ntop, 35632 / 85 */
16791         {&hf_pie_ntop_dst_to_src_max_throughput,
16792          {"Dst to src max throughput", "cflow.pie.ntop.dst_to_src_max_throughput",
16793           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0,
16794           NULL, HFILL}
16795         },
16796         /* ntop, 35632 / 86 */
16797         {&hf_pie_ntop_dst_to_src_min_throughput,
16798          {"Dst to src min throughput", "cflow.pie.ntop.dst_to_src_min_throughput",
16799           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, NULL, 0x0,
16800           NULL, HFILL}
16801         },
16802         /* ntop, 35632 / 87 */
16803         {&hf_pie_ntop_dst_to_src_avg_throughput,
16804          {"Dst to src average throughput", "cflow.pie.ntop.dst_to_src_avg_throughput",
16805           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_bit_sec), 0x0,
16806           NULL, HFILL}
16807         },
16808         /* ntop, 35632 / 88 */
16809         {&hf_pie_ntop_num_pkts_up_to_128_bytes,
16810          {"# packets whose IP size <= 128", "cflow.pie.ntop.num_pkts_up_to_128_bytes",
16811           FT_UINT32, BASE_DEC, NULL, 0x0,
16812           NULL, HFILL}
16813         },
16814         /* ntop, 35632 / 89 */
16815         {&hf_pie_ntop_num_pkts_128_to_256_bytes,
16816          {"# packets whose IP size > 128 and <= 256", "cflow.pie.ntop.num_pkts_128_to_256_bytes",
16817           FT_UINT32, BASE_DEC, NULL, 0x0,
16818           NULL, HFILL}
16819         },
16820         /* ntop, 35632 / 90 */
16821         {&hf_pie_ntop_num_pkts_256_to_512_bytes,
16822          {"# packets whose IP size > 256 and < 512", "cflow.pie.ntop.num_pkts_256_to_512_bytes",
16823           FT_UINT32, BASE_DEC, NULL, 0x0,
16824           NULL, HFILL}
16825         },
16826         /* ntop, 35632 / 91 */
16827         {&hf_pie_ntop_num_pkts_512_to_1024_bytes,
16828          {"# packets whose IP size > 512 and < 1024", "cflow.pie.ntop.num_pkts_512_to_1024_bytes",
16829           FT_UINT32, BASE_DEC, NULL, 0x0,
16830           NULL, HFILL}
16831         },
16832         /* ntop, 35632 / 92 */
16833         {&hf_pie_ntop_num_pkts_1024_to_1514_bytes,
16834          {"# packets whose IP size > 1024 and <= 1514", "cflow.pie.ntop.num_pkts_1024_to_1514_bytes",
16835           FT_UINT32, BASE_DEC, NULL, 0x0,
16836           NULL, HFILL}
16837         },
16838         /* ntop, 35632 / 93 */
16839         {&hf_pie_ntop_num_pkts_over_1514_bytes,
16840          {"# packets whose IP size > 1514", "cflow.pie.ntop.num_pkts_over_1514_bytes",
16841           FT_UINT32, BASE_DEC, NULL, 0x0,
16842           NULL, HFILL}
16843         },
16844         /* ntop, 35632 / 98 */
16845         {&hf_pie_ntop_cumulative_icmp_type,
16846          {"Cumulative OR of ICMP type packets", "cflow.pie.ntop.cumulative_icmp_type",
16847           FT_UINT16, BASE_DEC, NULL, 0x0,
16848           NULL, HFILL}
16849         },
16850         /* ntop, 35632 / 101 */
16851         {&hf_pie_ntop_src_ip_country,
16852          {"Country where the src IP is located", "cflow.pie.ntop.src_ip_country",
16853           FT_STRING, BASE_NONE, NULL, 0x0,
16854           NULL, HFILL}
16855         },
16856         /* ntop, 35632 / 102 */
16857         {&hf_pie_ntop_src_ip_city,
16858          {"City where the src IP is located", "cflow.pie.ntop.src_ip_city",
16859           FT_STRING, BASE_NONE, NULL, 0x0,
16860           NULL, HFILL}
16861         },
16862         /* ntop, 35632 / 103 */
16863         {&hf_pie_ntop_dst_ip_country,
16864          {"Country where the dst IP is located", "cflow.pie.ntop.dst_ip_country",
16865           FT_STRING, BASE_NONE, NULL, 0x0,
16866           NULL, HFILL}
16867         },
16868         /* ntop, 35632 / 104 */
16869         {&hf_pie_ntop_dst_ip_city,
16870          {"City where the dst IP is located", "cflow.pie.ntop.dst_ip_city",
16871           FT_STRING, BASE_NONE, NULL, 0x0,
16872           NULL, HFILL}
16873         },
16874         /* ntop, 35632 / 105 */
16875         {&hf_pie_ntop_flow_proto_port,
16876          {"L7 port that identifies the flow protocol", "cflow.pie.ntop.flow_proto_port",
16877           FT_UINT16, BASE_DEC|BASE_SPECIAL_VALS, VALS(cflow_unknown_value), 0x0,
16878           NULL, HFILL}
16879         },
16880         /* ntop, 35632 / 106 */
16881         {&hf_pie_ntop_upstream_tunnel_id,
16882          {"Upstream tunnel identifier (e.g. GTP TEID, VXLAN VNI) or 0 if unknown", "cflow.pie.ntop.tunnel_id",
16883           FT_UINT32, BASE_DEC, NULL, 0x0,
16884           NULL, HFILL}
16885         },
16886         /* ntop, 35632 / 107 */
16887         {&hf_pie_ntop_longest_flow_pkt,
16888          {"Longest packet (bytes) of the flow", "cflow.pie.ntop.longest_flow_pkt",
16889           FT_UINT16, BASE_DEC, NULL, 0x0,
16890           NULL, HFILL}
16891         },
16892         /* ntop, 35632 / 108 */
16893         {&hf_pie_ntop_shortest_flow_pkt,
16894          {"Shortest packet (bytes) of the flow", "cflow.pie.ntop.shortest_flow_pkt",
16895           FT_UINT16, BASE_DEC, NULL, 0x0,
16896           NULL, HFILL}
16897         },
16898         /* ntop, 35632 / 109 */
16899         {&hf_pie_ntop_retransmitted_in_pkts,
16900          {"Number of retransmitted TCP flow packets (src->dst)", "cflow.pie.ntop.retransmitted_in_pkts",
16901           FT_UINT32, BASE_DEC, NULL, 0x0,
16902           NULL, HFILL}
16903         },
16904         /* ntop, 35632 / 110 */
16905         {&hf_pie_ntop_retransmitted_out_pkts,
16906          {"Number of retransmitted TCP flow packets (dst->src)", "cflow.pie.ntop.retransmitted_out_pkts",
16907           FT_UINT32, BASE_DEC, NULL, 0x0,
16908           NULL, HFILL}
16909         },
16910         /* ntop, 35632 / 111 */
16911         {&hf_pie_ntop_ooorder_in_pkts,
16912          {"Number of out of order TCP flow packets (dst->src)", "cflow.pie.ntop.ooorder_in_pkts",
16913           FT_UINT32, BASE_DEC, NULL, 0x0,
16914           NULL, HFILL}
16915         },
16916         /* ntop, 35632 / 112 */
16917         {&hf_pie_ntop_ooorder_out_pkts,
16918          {"Number of out of order TCP flow packets (src->dst)", "cflow.pie.ntop.ooorder_out_pkts",
16919           FT_UINT32, BASE_DEC, NULL, 0x0,
16920           NULL, HFILL}
16921         },
16922         /* ntop, 35632 / 113 */
16923         {&hf_pie_ntop_untunneled_protocol,
16924          {"Untunneled IP protocol byte", "cflow.pie.ntop.untunneled_protocol",
16925           FT_UINT8, BASE_DEC, NULL, 0x0,
16926           NULL, HFILL}
16927         },
16928         /* ntop, 35632 / 114 */
16929         {&hf_pie_ntop_untunneled_ipv4_src_addr,
16930          {"Untunneled IPv4 source address", "cflow.pie.ntop.untunneled_ipv4_src_addr",
16931           FT_IPv4, BASE_NONE, NULL, 0x0,
16932           NULL, HFILL}
16933         },
16934         /* ntop, 35632 / 115 */
16935         {&hf_pie_ntop_untunneled_l4_src_port,
16936          {"Untunneled IPv4 source port", "cflow.pie.ntop.untunneled_l4_src_port",
16937           FT_UINT16, BASE_DEC, NULL, 0x0,
16938           NULL, HFILL}
16939         },
16940         /* ntop, 35632 / 116 */
16941         {&hf_pie_ntop_untunneled_ipv4_dst_addr,
16942          {"Untunneled IPv4 destination address", "cflow.pie.ntop.untunneled_ipv4_dst_addr",
16943           FT_IPv4, BASE_NONE, NULL, 0x0,
16944           NULL, HFILL}
16945         },
16946         /* ntop, 35632 / 117 */
16947         {&hf_pie_ntop_untunneled_l4_dst_port,
16948          {"Untunneled IPv4 destination port", "cflow.pie.ntop.untunneled_l4_dst_port",
16949           FT_UINT16, BASE_DEC, NULL, 0x0,
16950           NULL, HFILL}
16951         },
16952
16953         /* ntop, 35632 / 118 */
16954         {&hf_pie_ntop_l7_proto,
16955          {"Layer 7 protocol (numeric)", "cflow.pie.ntop.l7_proto",
16956           FT_UINT16, BASE_DEC, NULL, 0x0,
16957           NULL, HFILL}
16958         },
16959         /* ntop, 35632 / 119 */
16960         {&hf_pie_ntop_l7_proto_name,
16961          {"Layer 7 protocol name", "cflow.pie.ntop.l7_proto_name",
16962           FT_STRING, BASE_NONE, NULL, 0x0,
16963           NULL, HFILL}
16964         },
16965         /* ntop, 35632 / 120 */
16966         {&hf_pie_ntop_downstram_tunnel_id,
16967          {"Downstream tunnel identifier (e.g. GTP TEID, VXLAN VNI) or 0 if unknown", "cflow.pie.ntop.downstram_tunnel_id",
16968           FT_UINT32, BASE_DEC, NULL, 0x0,
16969           NULL, HFILL}
16970         },
16971         /* ntop, 35632 / 121 */
16972         {&hf_pie_ntop_flow_user_name,
16973          {"Flow username of the tunnel (if known)", "cflow.pie.ntop.flow_user_name",
16974           FT_STRING, BASE_NONE, NULL, 0x0,
16975           NULL, HFILL}
16976         },
16977         /* ntop, 35632 / 122 */
16978         {&hf_pie_ntop_flow_server_name,
16979          {"Flow server name (if known)", "cflow.pie.ntop.flow_server_name",
16980           FT_STRING, BASE_NONE, NULL, 0x0,
16981           NULL, HFILL}
16982         },
16983         /* ntop, 35632 / 123 */
16984         {&hf_pie_ntop_client_nw_latency_ms,
16985          {"Network RTT/2 client <-> nprobe", "cflow.pie.ntop.client_nw_latency_ms",
16986           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
16987           NULL, HFILL}
16988         },
16989         /* ntop, 35632 / 124 */
16990         {&hf_pie_ntop_server_nw_latency_ms,
16991          {"Network RTT/2 nprobe <-> server", "cflow.pie.server_nw_latency_ms",
16992           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
16993           NULL, HFILL}
16994         },
16995         /* ntop, 35632 / 125 */
16996         {&hf_pie_ntop_appl_latency_ms,
16997          {"Application latency", "cflow.pie.ntop.appl_latency_ms",
16998           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
16999           "Server response time", HFILL}
17000         },
17001         /* ntop, 35632 / 126 */
17002         {&hf_pie_ntop_plugin_name,
17003          {"Plugin name used by this flow (if any)", "cflow.pie.ntop.plugin_name",
17004           FT_STRING, BASE_NONE, NULL, 0x0,
17005           NULL, HFILL}
17006         },
17007         /* ntop, 35632 / 127 */
17008         {&hf_pie_ntop_retransmitted_in_bytes,
17009          {"Number of retransmitted TCP flow (src->dst)", "cflow.pie.ntop.retransmitted_in_bytes",
17010           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
17011           NULL, HFILL}
17012         },
17013         /* ntop, 35632 / 128 */
17014         {&hf_pie_ntop_retransmitted_out_bytes,
17015          {"Number of retransmitted TCP flow (dst->src)", "cflow.pie.ntop.retransmitted_out_bytes",
17016           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
17017           NULL, HFILL}
17018         },
17019         /* ntop, 35632 / 130 */
17020         {&hf_pie_ntop_sip_call_id,
17021          {"SIP call-id", "cflow.pie.ntop.sip_call_id",
17022           FT_STRING, BASE_NONE, NULL, 0x0,
17023           NULL, HFILL}
17024         },
17025         /* ntop, 35632 / 131 */
17026         {&hf_pie_ntop_sip_calling_party,
17027          {"SIP Call initiator", "cflow.pie.ntop.sip_calling_party",
17028           FT_STRING, BASE_NONE, NULL, 0x0,
17029           NULL, HFILL}
17030         },
17031         /* ntop, 35632 / 132 */
17032         {&hf_pie_ntop_sip_called_party,
17033          {"SIP Called party", "cflow.pie.ntop.sip_called_party",
17034           FT_STRING, BASE_NONE, NULL, 0x0,
17035           NULL, HFILL}
17036         },
17037         /* ntop, 35632 / 133 */
17038         {&hf_pie_ntop_sip_rtp_codecs,
17039          {"SIP RTP codecs", "cflow.pie.ntop.sip_rtp_codecs",
17040           FT_STRING, BASE_NONE, NULL, 0x0,
17041           NULL, HFILL}
17042         },
17043         /* ntop, 35632 / 134 */
17044         {&hf_pie_ntop_sip_invite_time,
17045          {"SIP time (epoch) of INVITE", "cflow.pie.ntop.sip_invite_time",
17046           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17047           NULL, HFILL}
17048         },
17049         /* ntop, 35632 / 135 */
17050         {&hf_pie_ntop_sip_trying_time,
17051          {"SIP time (epoch) of Trying", "cflow.pie.ntop.sip_trying_time",
17052           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17053           NULL, HFILL}
17054         },
17055         /* ntop, 35632 / 136 */
17056         {&hf_pie_ntop_sip_ringing_time,
17057          {"SIP time (epoch) of RINGING", "cflow.pie.ntop.sip_ringing_time",
17058           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17059           NULL, HFILL}
17060         },
17061         /* ntop, 35632 / 137 */
17062         {&hf_pie_ntop_sip_invite_ok_time,
17063          {"SIP time (epoch) of INVITE OK", "cflow.pie.ntop.sip_ok_time",
17064           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17065           NULL, HFILL}
17066         },
17067         /* ntop, 35632 / 138 */
17068         {&hf_pie_ntop_sip_invite_failure_time,
17069          {"SIP time (epoch) of INVITE FAILURE", "cflow.pie.ntop.sip_invite_failure_time",
17070           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17071           NULL, HFILL}
17072         },
17073         /* ntop, 35632 / 139 */
17074         {&hf_pie_ntop_sip_bye_time,
17075          {"SIP time (epoch) of BYE", "cflow.pie.ntop.sip_bye_time",
17076           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17077           NULL, HFILL}
17078         },
17079         /* ntop, 35632 / 140 */
17080         {&hf_pie_ntop_sip_bye_ok_time,
17081          {"SIP time (epoch) of BYE OK", "cflow.pie.ntop.sip_bye_ok_time",
17082           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17083           NULL, HFILL}
17084         },
17085         /* ntop, 35632 / 141 */
17086         {&hf_pie_ntop_sip_cancel_time,
17087          {"SIP time (epoch) of CANCEL", "cflow.pie.ntop.sip_cancel_time",
17088           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17089           NULL, HFILL}
17090         },
17091         /* ntop, 35632 / 142 */
17092         {&hf_pie_ntop_sip_cancel_ok_time,
17093          {"SIP time (epoch) of CANCEL OK", "cflow.pie.ntop.sip_cancel_ok_time",
17094           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
17095           NULL, HFILL}
17096         },
17097         /* ntop, 35632 / 143 */
17098         {&hf_pie_ntop_sip_rtp_ipv4_src_addr,
17099          {"SIP RTP stream source IP", "cflow.pie.ntop.sip_rtp_ipv4_src_addr",
17100           FT_IPv4, BASE_NONE, NULL, 0x0,
17101           NULL, HFILL}
17102         },
17103         /* ntop, 35632 / 144 */
17104         {&hf_pie_ntop_sip_rtp_l4_src_port,
17105          {"SIP RTP stream source port", "cflow.pie.ntop.sip_rtp_l4_src_port",
17106           FT_UINT16, BASE_DEC, NULL, 0x0,
17107           NULL, HFILL}
17108         },
17109         /* ntop, 35632 / 145 */
17110         {&hf_pie_ntop_sip_rtp_ipv4_dst_addr,
17111          {"SIP RTP stream dest IP", "cflow.pie.ntop.sip_rtp_ipv4_dst_addr",
17112           FT_IPv4, BASE_NONE, NULL, 0x0,
17113           NULL, HFILL}
17114         },
17115         /* ntop, 35632 / 146 */
17116         {&hf_pie_ntop_sip_rtp_l4_dst_port,
17117          {"SIP RTP stream dest port", "cflow.pie.ntop.sip_rtp_l4_dst_port",
17118           FT_UINT16, BASE_DEC, NULL, 0x0,
17119           NULL, HFILL}
17120         },
17121         /* ntop, 35632 / 147 */
17122         {&hf_pie_ntop_sip_response_code,
17123          {"SIP failure response code", "cflow.pie.ntop.sip_response_code",
17124           FT_UINT32, BASE_DEC, NULL, 0x0,
17125           NULL, HFILL}
17126         },
17127         /* ntop, 35632 / 148 */
17128         {&hf_pie_ntop_sip_reason_cause,
17129          {"SIP Cancel/Bye/Failure reason cause", "cflow.pie.ntop.sip_reason_cause",
17130           FT_UINT32, BASE_DEC, NULL, 0x0,
17131           NULL, HFILL}
17132         },
17133         /* ntop, 35632 / 150 */
17134         {&hf_pie_ntop_rtp_first_seq,
17135          {"First flow RTP Seq Number", "cflow.pie.ntop.rtp_first_seq",
17136           FT_UINT32, BASE_DEC, NULL, 0x0,
17137           NULL, HFILL}
17138         },
17139         /* ntop, 35632 / 151 */
17140         {&hf_pie_ntop_rtp_first_ts,
17141          {"First flow RTP timestamp", "cflow.pie.ntop.rtp_first_ts",
17142           FT_UINT32, BASE_DEC, NULL, 0x0,
17143           NULL, HFILL}
17144         },
17145         /* ntop, 35632 / 152 */
17146         {&hf_pie_ntop_rtp_last_seq,
17147          {"Last flow RTP Seq Number", "cflow.pie.ntop.rtp_last_seq",
17148           FT_UINT32, BASE_DEC, NULL, 0x0,
17149           NULL, HFILL}
17150         },
17151         /* ntop, 35632 / 153 */
17152         {&hf_pie_ntop_rtp_last_ts,
17153          {"Last flow RTP timestamp", "cflow.pie.ntop.rtp_last_ts",
17154           FT_UINT32, BASE_DEC, NULL, 0x0,
17155           NULL, HFILL}
17156         },
17157         /* ntop, 35632 / 154 */
17158         {&hf_pie_ntop_rtp_in_jitter,
17159          {"RTP jitter (ms * 1000)", "cflow.pie.ntop.rtp_in_jitter",
17160           FT_UINT32, BASE_DEC, NULL, 0x0,
17161           NULL, HFILL}
17162         },
17163         /* ntop, 35632 / 155 */
17164         {&hf_pie_ntop_rtp_out_jitter,
17165          {"RTP jitter (ms * 1000)", "cflow.pie.ntop.rtp_out_jitter",
17166           FT_UINT32, BASE_DEC, NULL, 0x0,
17167           NULL, HFILL}
17168         },
17169         /* ntop, 35632 / 156 */
17170         {&hf_pie_ntop_rtp_in_pkt_lost,
17171          {"Packet lost in stream (src->dst)", "cflow.pie.ntop.rtp_in_pkt_lost",
17172           FT_UINT32, BASE_DEC, NULL, 0x0,
17173           NULL, HFILL}
17174         },
17175         /* ntop, 35632 / 157 */
17176         {&hf_pie_ntop_rtp_out_pkt_lost,
17177          {"Packet lost in stream (dst->src)", "cflow.pie.ntop.rtp_out_pkt_lost",
17178           FT_UINT32, BASE_DEC, NULL, 0x0,
17179           NULL, HFILL}
17180         },
17181         /* ntop, 35632 / 158 */
17182         {&hf_pie_ntop_rtp_out_payload_type,
17183          {"RTP payload type", "cflow.pie.ntop.rtp_out_payload_type",
17184           FT_UINT8, BASE_DEC, NULL, 0x0,
17185           NULL, HFILL}
17186         },
17187         /* ntop, 35632 / 159 */
17188         {&hf_pie_ntop_rtp_in_max_delta,
17189          {"Max delta (ms*100) between consecutive pkts (src->dst)", "cflow.pie.ntop.rtp_in_max_delta",
17190           FT_UINT32, BASE_DEC, NULL, 0x0,
17191           NULL, HFILL}
17192         },
17193         /* ntop, 35632 / 160 */
17194         {&hf_pie_ntop_rtp_out_max_delta,
17195          {"Max delta (ms*100) between consecutive pkts (dst->src)", "cflow.pie.ntop.rtp_out_max_delta",
17196           FT_UINT32, BASE_DEC, NULL, 0x0,
17197           NULL, HFILL}
17198         },
17199         /* ntop, 35632 / 161 */
17200         {&hf_pie_ntop_rtp_in_payload_type,
17201          {"RTP payload type", "cflow.pie.ntop.rtp_in_payload_type",
17202           FT_UINT8, BASE_DEC, NULL, 0x0,
17203           NULL, HFILL}
17204         },
17205         /* ntop, 35632 / 168 */
17206         {&hf_pie_ntop_src_proc_id,
17207          {"Src process PID", "cflow.pie.ntop.src_proc_id",
17208           FT_UINT32, BASE_DEC, NULL, 0x0,
17209           NULL, HFILL}
17210         },
17211         /* ntop, 35632 / 169 */
17212         {&hf_pie_ntop_src_proc_name,
17213          {"Src process name", "cflow.pie.ntop.src_proc_name",
17214           FT_STRING, BASE_NONE, NULL, 0x0,
17215           NULL, HFILL}
17216         },
17217         /* ntop, 35632 / 180 */
17218         {&hf_pie_ntop_http_url,
17219          {"HTTP URL (IXIA URI)", "cflow.pie.ntop.http_url",
17220           FT_STRING, BASE_NONE, NULL, 0x0,
17221           NULL, HFILL}
17222         },
17223         /* ntop, 35632 / 181 */
17224         {&hf_pie_ntop_http_ret_code,
17225          {"HTTP return code", "cflow.pie.ntop.http_ret_code",
17226           FT_UINT16, BASE_DEC, NULL, 0x0,
17227           "Return code of HTTP (e.g. 200, 304...)", HFILL}
17228         },
17229         /* ntop, 35632 / 182 */
17230         {&hf_pie_ntop_http_referer,
17231          {"HTTP Referer", "cflow.pie.ntop.http_referer",
17232           FT_STRING, BASE_NONE, NULL, 0x0,
17233           NULL, HFILL}
17234         },
17235         /* ntop, 35632 / 183 */
17236         {&hf_pie_ntop_http_ua,
17237          {"HTTP User Agent", "cflow.pie.ntop.http_ua",
17238           FT_STRING, BASE_NONE, NULL, 0x0,
17239           NULL, HFILL}
17240         },
17241         /* ntop, 35632 / 184 */
17242         {&hf_pie_ntop_http_mime,
17243          {"HTTP Mime Type", "cflow.pie.ntop.http_mime",
17244           FT_STRING, BASE_NONE, NULL, 0x0,
17245           NULL, HFILL}
17246         },
17247         /* ntop, 35632 / 185 */
17248         {&hf_pie_ntop_smtp_mail_from,
17249          {"Mail sender", "cflow.pie.ntop.smtp_mail_from",
17250           FT_STRING, BASE_NONE, NULL, 0x0,
17251           NULL, HFILL}
17252         },
17253         /* ntop, 35632 / 186 */
17254         {&hf_pie_ntop_smtp_rcpt_to,
17255          {"Mail recipient", "cflow.pie.ntop.smtp_rcpt_to",
17256           FT_STRING, BASE_NONE, NULL, 0x0,
17257           NULL, HFILL}
17258         },
17259         /* ntop, 35632 / 187 */
17260         {&hf_pie_ntop_http_host,
17261          {"HTTP Host Name (IXIA Host Name)", "cflow.pie.ntop.http_host",
17262           FT_STRING, BASE_NONE, NULL, 0x0,
17263           NULL, HFILL}
17264         },
17265         /* ntop, 35632 / 188 */
17266         {&hf_pie_ntop_ssl_server_name,
17267          {"SSL server name", "cflow.pie.ntop.ssl_server_name",
17268           FT_STRING, BASE_NONE, NULL, 0x0,
17269           NULL, HFILL}
17270         },
17271         /* ntop, 35632 / 189 */
17272         {&hf_pie_ntop_bittorrent_hash,
17273          {"BITTORRENT hash", "cflow.pie.ntop.bittorrent_hash",
17274           FT_STRING, BASE_NONE, NULL, 0x0,
17275           NULL, HFILL}
17276         },
17277         /* ntop, 35632 / 195 */
17278         {&hf_pie_ntop_mysql_srv_version,
17279          {"MySQL server version", "cflow.pie.ntop.mysql_server_version",
17280           FT_STRING, BASE_NONE, NULL, 0x0,
17281           NULL, HFILL}
17282         },
17283         /* ntop, 35632 / 196 */
17284         {&hf_pie_ntop_mysql_username,
17285          {"MySQL username", "cflow.pie.ntop.mysql_username",
17286           FT_STRING, BASE_NONE, NULL, 0x0,
17287           NULL, HFILL}
17288         },
17289         /* ntop, 35632 / 197 */
17290         {&hf_pie_ntop_mysql_db,
17291          {"MySQL database in use", "cflow.pie.ntop.mysql_db",
17292           FT_STRING, BASE_NONE, NULL, 0x0,
17293           NULL, HFILL}
17294         },
17295         /* ntop, 35632 / 198 */
17296         {&hf_pie_ntop_mysql_query,
17297          {"MySQL Query", "cflow.pie.ntop.mysql_query",
17298           FT_STRING, BASE_NONE, NULL, 0x0,
17299           NULL, HFILL}
17300         },
17301         /* ntop, 35632 / 199 */
17302         {&hf_pie_ntop_mysql_response,
17303          {"MySQL server response", "cflow.pie.ntop.mysql_response",
17304           FT_UINT16, BASE_DEC, NULL, 0x0,
17305           NULL, HFILL}
17306         },
17307         /* ntop, 35632 / 200 */
17308         {&hf_pie_ntop_oracle_username,
17309          {"Oracle Username", "cflow.pie.ntop.oracle_username",
17310           FT_STRING, BASE_NONE, NULL, 0x0,
17311           NULL, HFILL}
17312         },
17313         /* ntop, 35632 / 201 */
17314         {&hf_pie_ntop_oracle_query,
17315          {"Oracle Query", "cflow.pie.ntop.oracle_query",
17316           FT_STRING, BASE_NONE, NULL, 0x0,
17317           NULL, HFILL}
17318         },
17319         /* ntop, 35632 / 202 */
17320         {&hf_pie_ntop_oracle_resp_code,
17321          {"Oracle Response Code", "cflow.pie.ntop.oracle_resp_code",
17322           FT_UINT16, BASE_DEC, NULL, 0x0,
17323           NULL, HFILL}
17324         },
17325         /* ntop, 35632 / 203 */
17326         {&hf_pie_ntop_oracle_resp_string,
17327          {"Oracle Response String", "cflow.pie.ntop.oracle_resp_string",
17328           FT_STRING, BASE_NONE, NULL, 0x0,
17329           NULL, HFILL}
17330         },
17331         /* ntop, 35632 / 204 */
17332         {&hf_pie_ntop_oracle_query_duration,
17333          {"Oracle Query Duration (msec)", "cflow.pie.ntop.oracle_query_duration",
17334           FT_UINT32, BASE_DEC, NULL, 0x0,
17335           NULL, HFILL}
17336         },
17337         /* ntop, 35632 / 205 */
17338         {&hf_pie_ntop_dns_query,
17339          {"DNS query", "cflow.pie.ntop.dns_query",
17340           FT_STRING, BASE_NONE, NULL, 0x0,
17341           NULL, HFILL}
17342         },
17343         /* ntop, 35632 / 206 */
17344         {&hf_pie_ntop_dns_query_id,
17345          {"DNS query transaction Id", "cflow.pie.ntop.dns_query_id",
17346           FT_UINT16, BASE_DEC, NULL, 0x0,
17347           NULL, HFILL}
17348         },
17349         /* ntop, 35632 / 207 */
17350         {&hf_pie_ntop_dns_query_type,
17351          {"DNS query type", "cflow.pie.ntop.dns_query_type",
17352           FT_UINT8, BASE_DEC, NULL, 0x0,
17353           "(e.g. 1=A, 2=NS..)", HFILL}
17354         },
17355         /* ntop, 35632 / 208 */
17356         {&hf_pie_ntop_dns_ret_code,
17357          {"DNS return code", "cflow.pie.ntop.dns_ret_code",
17358           FT_UINT8, BASE_DEC, NULL, 0x0,
17359           "(e.g. 0=no error)", HFILL}
17360         },
17361         /* ntop, 35632 / 209 */
17362         {&hf_pie_ntop_dns_num_answers,
17363          {"DNS # of returned answers", "cflow.pie.ntop.dns_num_answers",
17364           FT_UINT8, BASE_DEC, NULL, 0x0,
17365           NULL, HFILL}
17366         },
17367         /* ntop, 35632 / 210 */
17368         {&hf_pie_ntop_pop_user,
17369          {"POP3 user login", "cflow.pie.ntop.pop_user",
17370           FT_STRING, BASE_NONE, NULL, 0x0,
17371           NULL, HFILL}
17372         },
17373         /* ntop, 35632 / 220 */
17374         {&hf_pie_ntop_gtpv1_req_msg_type,
17375          {"GTPv1 Request Msg Type", "cflow.pie.ntop.gtpv1_req_msg_typ",
17376           FT_UINT8, BASE_DEC, NULL, 0x0,
17377           NULL, HFILL}
17378         },
17379         /* ntop, 35632 / 221 */
17380         {&hf_pie_ntop_gtpv1_rsp_msg_type,
17381          {"GTPv1 Response Msg Type", "cflow.pie.ntop.gtpv1_rsp_msg_type",
17382           FT_UINT8, BASE_DEC, NULL, 0x0,
17383           NULL, HFILL}
17384         },
17385         /* ntop, 35632 / 222 */
17386         {&hf_pie_ntop_gtpv1_c2s_teid_data,
17387          {"GTPv1 Client->Server TunnelId Data", "cflow.pie.ntop.gtpv1_c2s_teid_data",
17388           FT_UINT32, BASE_DEC, NULL, 0x0,
17389           NULL, HFILL}
17390         },
17391         /* ntop, 35632 / 223 */
17392         {&hf_pie_ntop_gtpv1_c2s_teid_ctrl,
17393          {"GTPv1 Client->Server TunnelId Control", "cflow.pie.ntop.gtpv1_c2s_teid_ctrl",
17394           FT_UINT32, BASE_DEC, NULL, 0x0,
17395           NULL, HFILL}
17396         },
17397         /* ntop, 35632 / 224 */
17398         {&hf_pie_ntop_gtpv1_s2c_teid_data,
17399          {"GTPv1 Server->Client TunnelId Data", "cflow.pie.ntop.gtpv1_s2c_teid_data",
17400           FT_UINT32, BASE_DEC, NULL, 0x0,
17401           NULL, HFILL}
17402         },
17403         /* ntop, 35632 / 225 */
17404         {&hf_pie_ntop_gtpv1_s2c_teid_ctrl,
17405          {"GTPv1 Server->Client TunnelId Control", "cflow.pie.ntop.gtpv1_s2c_teid_ctrl",
17406           FT_UINT32, BASE_DEC, NULL, 0x0,
17407           NULL, HFILL}
17408         },
17409         /* ntop, 35632 / 226 */
17410         {&hf_pie_ntop_gtpv1_end_user_ip,
17411          {"GTPv1 End User IP Address", "cflow.pie.ntop.gtpv1_end_user_ip",
17412           FT_IPv4, BASE_NONE, NULL, 0x0,
17413           NULL, HFILL}
17414         },
17415         /* ntop, 35632 / 227 */
17416         {&hf_pie_ntop_gtpv1_end_user_imsi,
17417          {"GTPv1 End User IMSI", "cflow.pie.ntop.gtpv1_end_user_imsi",
17418           FT_STRING, BASE_NONE, NULL, 0x0,
17419           NULL, HFILL}
17420         },
17421         /* ntop, 35632 / 228 */
17422         {&hf_pie_ntop_gtpv1_end_user_msisdn,
17423          {"GTPv1 End User MSISDN", "cflow.pie.ntop.gtpv1_end_user_msisdn",
17424           FT_STRING, BASE_NONE, NULL, 0x0,
17425           NULL, HFILL}
17426         },
17427         /* ntop, 35632 / 229 */
17428         {&hf_pie_ntop_gtpv1_end_user_imei,
17429          {"GTPv1 End User IMEI", "cflow.pie.ntop.gtpv1_end_user_imei",
17430           FT_STRING, BASE_NONE, NULL, 0x0,
17431           NULL, HFILL}
17432         },
17433         /* ntop, 35632 / 230 */
17434         {&hf_pie_ntop_gtpv1_apn_name,
17435          {"GTPv1 APN Name", "cflow.pie.ntop.gtpv1_apn_name",
17436           FT_STRING, BASE_NONE, NULL, 0x0,
17437           NULL, HFILL}
17438         },
17439         /* ntop, 35632 / 231 */
17440         {&hf_pie_ntop_gtpv1_rai_mcc,
17441          {"GTPv1 RAI Mobile Country Code", "cflow.pie.ntop.gtpv1_rai_mcc",
17442           FT_UINT16, BASE_DEC, NULL, 0x0,
17443           NULL, HFILL}
17444         },
17445         /* ntop, 35632 / 232 */
17446         {&hf_pie_ntop_gtpv1_rai_mnc,
17447          {"GTPv1 RAI Mobile Network Code", "cflow.pie.ntop.gtpv1_rai_mnc",
17448           FT_UINT16, BASE_DEC, NULL, 0x0,
17449           NULL, HFILL}
17450         },
17451         /* ntop, 35632 / 233 */
17452         {&hf_pie_ntop_gtpv1_uli_cell_lac,
17453          {"GTPv1 ULI Cell Location Area Code", "cflow.pie.ntop.gtpv1_uli_cell_lac",
17454           FT_UINT16, BASE_DEC, NULL, 0x0,
17455           NULL, HFILL}
17456         },
17457         /* ntop, 35632 / 234 */
17458         {&hf_pie_ntop_gtpv1_uli_cell_ci,
17459          {"GTPv1 ULI Cell CI", "cflow.pie.ntop.gtpv1_uli_cell_ci",
17460           FT_UINT16, BASE_DEC, NULL, 0x0,
17461           NULL, HFILL}
17462         },
17463         /* ntop, 35632 / 235 */
17464         {&hf_pie_ntop_gtpv1_uli_sac,
17465          {"GTPv1 ULI SAC", "cflow.pie.ntop.gtpv1_uli_sac",
17466           FT_UINT16, BASE_DEC, NULL, 0x0,
17467           NULL, HFILL}
17468         },
17469         /* ntop, 35632 / 236 */
17470         {&hf_pie_ntop_gtpv1_rai_type,
17471          {"GTPv1 RAT Type", "cflow.pie.ntop.gtpv1_rai_type",
17472           FT_UINT8, BASE_DEC, NULL, 0x0,
17473           NULL, HFILL}
17474         },
17475         /* ntop, 35632 / 240 */
17476         {&hf_pie_ntop_radius_req_msg_type,
17477          {"RADIUS Request Msg Type", "cflow.pie.ntop.radius_req_msg_type",
17478           FT_UINT8, BASE_DEC, NULL, 0x0,
17479           NULL, HFILL}
17480         },
17481         /* ntop, 35632 / 241 */
17482         {&hf_pie_ntop_radius_rsp_msg_type,
17483          {"RADIUS Response Msg Type", "cflow.pie.ntop.radius_rsp_msg_type",
17484           FT_UINT8, BASE_DEC, NULL, 0x0,
17485           NULL, HFILL}
17486         },
17487         /* ntop, 35632 / 242 */
17488         {&hf_pie_ntop_radius_user_name,
17489          {"RADIUS User Name (Access Only)", "cflow.pie.ntop.radius_user_name",
17490           FT_STRING, BASE_NONE, NULL, 0x0,
17491           NULL, HFILL}
17492         },
17493         /* ntop, 35632 / 243 */
17494         {&hf_pie_ntop_radius_calling_station_id,
17495          {"RADIUS Calling Station Id", "cflow.pie.ntop.radius_calling_station_id",
17496           FT_STRING, BASE_NONE, NULL, 0x0,
17497           NULL, HFILL}
17498         },
17499         /* ntop, 35632 / 244 */
17500         {&hf_pie_ntop_radius_called_station_id,
17501          {"RADIUS Called Station Id", "cflow.pie.ntop.radius_called_station_id",
17502           FT_STRING, BASE_NONE, NULL, 0x0,
17503           NULL, HFILL}
17504         },
17505         /* ntop, 35632 / 245 */
17506         {&hf_pie_ntop_radius_nas_ip_addr,
17507          {"RADIUS NAS IP Address", "cflow.pie.ntop.radius_nas_ip_addr",
17508           FT_IPv4, BASE_NONE, NULL, 0x0,
17509           NULL, HFILL}
17510         },
17511         /* ntop, 35632 / 246 */
17512         {&hf_pie_ntop_radius_nas_identifier,
17513          {"RADIUS NAS Identifier", "cflow.pie.ntop.radius_nas_identifier",
17514           FT_STRING, BASE_NONE, NULL, 0x0,
17515           NULL, HFILL}
17516         },
17517         /* ntop, 35632 / 247 */
17518         {&hf_pie_ntop_radius_user_imsi,
17519          {"RADIUS User IMSI (Extension)", "cflow.pie.ntop.radius_user_imsi",
17520           FT_STRING, BASE_NONE, NULL, 0x0,
17521           NULL, HFILL}
17522         },
17523         /* ntop, 35632 / 248 */
17524         {&hf_pie_ntop_radius_user_imei,
17525          {"RADIUS User MSISDN (Extension)", "cflow.pie.ntop.radius_user_imei",
17526           FT_STRING, BASE_NONE, NULL, 0x0,
17527           NULL, HFILL}
17528         },
17529         /* ntop, 35632 / 249 */
17530         {&hf_pie_ntop_radius_framed_ip_addr,
17531          {"RADIUS Framed IP", "cflow.pie.ntop.radius_framed_ip_addr",
17532           FT_IPv4, BASE_NONE, NULL, 0x0,
17533           NULL, HFILL}
17534         },
17535         /* ntop, 35632 / 250 */
17536         {&hf_pie_ntop_radius_acct_session_id,
17537          {"RADIUS Accounting Session Name", "cflow.pie.ntop.radius_acct_session_id",
17538           FT_STRING, BASE_NONE, NULL, 0x0,
17539           NULL, HFILL}
17540         },
17541         /* ntop, 35632 / 251 */
17542         {&hf_pie_ntop_radius_acct_status_type,
17543          {"RADIUS Accounting Status Type", "cflow.pie.ntop.radius_acct_status_type",
17544           FT_STRING, BASE_NONE, NULL, 0x0,
17545           NULL, HFILL}
17546         },
17547         /* ntop, 35632 / 252 */
17548         {&hf_pie_ntop_radius_acct_in_octets,
17549          {"RADIUS Accounting Input Octets", "cflow.pie.ntop.radius_acct_in_octets",
17550           FT_UINT32, BASE_DEC, NULL, 0x0,
17551           NULL, HFILL}
17552         },
17553         /* ntop, 35632 / 253 */
17554         {&hf_pie_ntop_radius_acct_out_octets,
17555          {"RADIUS Accounting Output Octets", "cflow.pie.ntop.radius_acct_out_octets",
17556           FT_UINT32, BASE_DEC, NULL, 0x0,
17557           NULL, HFILL}
17558         },
17559         /* ntop, 35632 / 254 */
17560         {&hf_pie_ntop_radius_acct_in_pkts,
17561          {"RADIUS Accounting Input Packets", "cflow.pie.ntop.radius_acct_in_pkts",
17562           FT_UINT32, BASE_DEC, NULL, 0x0,
17563           NULL, HFILL}
17564         },
17565         /* ntop, 35632 / 255 */
17566         {&hf_pie_ntop_radius_acct_out_pkts,
17567          {"RADIUS Accounting Output Packets", "cflow.pie.ntop.radius_acct_out_pkts",
17568           FT_UINT32, BASE_DEC, NULL, 0x0,
17569           NULL, HFILL}
17570         },
17571         /* ntop, 35632 / 260 */
17572         {&hf_pie_ntop_imap_login,
17573          {"Mail sender", "cflow.pie.ntop.imap_login",
17574           FT_STRING, BASE_NONE, NULL, 0x0,
17575           NULL, HFILL}
17576         },
17577         /* ntop, 35632 / 270 */
17578         {&hf_pie_ntop_gtpv2_req_msg_type,
17579          {"GTPv2 Request Msg Type", "cflow.pie.ntop.gtpv2_req_msg_type",
17580           FT_UINT8, BASE_DEC, NULL, 0x0,
17581           NULL, HFILL}
17582         },
17583         /* ntop, 35632 / 271 */
17584         {&hf_pie_ntop_gtpv2_rsp_msg_type,
17585          {"GTPv2 Response Msg Type", "cflow.pie.ntop.gtpv2_rsp_msg_type",
17586           FT_UINT8, BASE_DEC, NULL, 0x0,
17587           NULL, HFILL}
17588         },
17589         /* ntop, 35632 / 272 */
17590         {&hf_pie_ntop_gtpv2_c2s_s1u_gtpu_teid,
17591          {"GTPv2 Client->Svr S1U GTPU TEID", "cflow.pie.ntop.gtpv2_c2s_s1u_gtpu_teid",
17592           FT_UINT32, BASE_DEC, NULL, 0x0,
17593           NULL, HFILL}
17594         },
17595         /* ntop, 35632 / 273 */
17596         {&hf_pie_ntop_gtpv2_c2s_s1u_gtpu_ip,
17597          {"GTPv2 Client->Svr S1U GTPU IP", "cflow.pie.ntop.gtpv2_c2s_s1u_gtpu_ip",
17598           FT_IPv4, BASE_NONE, NULL, 0x0,
17599           NULL, HFILL}
17600         },
17601         /* ntop, 35632 / 274 */
17602         {&hf_pie_ntop_gtpv2_s2c_s1u_gtpu_teid,
17603          {"GTPv2 Srv->Client S1U GTPU TEID", "cflow.pie.ntop.gtpv2_s2c_s1u_gtpu_teid",
17604           FT_STRING, BASE_NONE, NULL, 0x0,
17605           NULL, HFILL}
17606         },
17607         /* ntop, 35632 / 275 */
17608         {&hf_pie_ntop_gtpv2_s2c_s1u_gtpu_ip,
17609          {"GTPv2 Srv->Client S1U GTPU IP", "cflow.pie.ntop.gtpv2_s2c_s1u_gtpu_ip",
17610           FT_IPv4, BASE_NONE, NULL, 0x0,
17611           NULL, HFILL}
17612         },
17613         /* ntop, 35632 / 276 */
17614         {&hf_pie_ntop_gtpv2_end_user_imsi,
17615          {"GTPv2 End User IMSI", "cflow.pie.ntop.gtpv2_end_user_imsi",
17616           FT_STRING, BASE_NONE, NULL, 0x0,
17617           NULL, HFILL}
17618         },
17619         /* ntop, 35632 / 277 */
17620         {&hf_pie_ntop_gtpv2_and_user_msisdn,
17621          {"GTPv2 End User MSISDN", "cflow.pie.ntop.gtpv2_and_user_msisdn",
17622           FT_STRING, BASE_NONE, NULL, 0x0,
17623           NULL, HFILL}
17624         },
17625         /* ntop, 35632 / 278 */
17626         {&hf_pie_ntop_gtpv2_apn_name,
17627          {"GTPv2 APN Name", "cflow.pie.ntop.gtpv2_apn_name",
17628           FT_STRING, BASE_NONE, NULL, 0x0,
17629           NULL, HFILL}
17630         },
17631         /* ntop, 35632 / 279 */
17632         {&hf_pie_ntop_gtpv2_uli_mcc,
17633          {"GTPv2 Mobile Country Code", "cflow.pie.ntop.gtpv2_uli_mcc",
17634           FT_UINT16, BASE_DEC, NULL, 0x0,
17635           NULL, HFILL}
17636         },
17637         /* ntop, 35632 / 280 */
17638         {&hf_pie_ntop_gtpv2_uli_mnc,
17639          {"GTPv2 Mobile Network Code", "cflow.pie.ntop.gtpv2_uli_mnc",
17640           FT_UINT16, BASE_DEC, NULL, 0x0,
17641           NULL, HFILL}
17642         },
17643         /* ntop, 35632 / 281 */
17644         {&hf_pie_ntop_gtpv2_uli_cell_tac,
17645          {"GTPv2 Tracking Area Code", "cflow.pie.ntop.gtpv2_uli_cell_tac",
17646           FT_UINT16, BASE_DEC, NULL, 0x0,
17647           NULL, HFILL}
17648         },
17649         /* ntop, 35632 / 282 */
17650         {&hf_pie_ntop_gtpv2_uli_cell_id,
17651          {"GTPv2 Cell Identifier", "cflow.pie.ntop.gtpv2_uli_cell_id",
17652           FT_UINT32, BASE_DEC, NULL, 0x0,
17653           NULL, HFILL}
17654         },
17655         /* ntop, 35632 / 283 */
17656         {&hf_pie_ntop_gtpv2_rat_type,
17657          {"GTPv2 RAT Type", "cflow.pie.ntop.gtpv2_rat_type",
17658           FT_UINT8, BASE_DEC, NULL, 0x0,
17659           NULL, HFILL}
17660         },
17661         /* ntop, 35632 / 284 */
17662         {&hf_pie_ntop_gtpv2_pdn_ip,
17663          {"GTPV2 PDN IP Address", "cflow.pie.ntop.gtpv2_pdn_ip",
17664           FT_UINT32, BASE_DEC, NULL, 0x0,
17665           NULL, HFILL}
17666         },
17667         /* ntop, 35632 / 285 */
17668         {&hf_pie_ntop_gtpv2_end_user_imei,
17669          {"GTPv2 End User IMEI", "cflow.pie.ntop.gtpv2_end_user_imei",
17670           FT_STRING, BASE_NONE, NULL, 0x0,
17671           NULL, HFILL}
17672         },
17673         /* ntop, 35632 / 290 */
17674         {&hf_pie_ntop_src_as_path_1,
17675          {"Src AS path position 1", "cflow.pie.ntop.src_as_path_1",
17676           FT_UINT32, BASE_DEC, NULL, 0x0,
17677           NULL, HFILL}
17678         },
17679         /* ntop, 35632 / 291 */
17680         {&hf_pie_ntop_src_as_path_2,
17681          {"Src AS path position 2", "cflow.pie.ntop.src_as_path_2",
17682           FT_UINT32, BASE_DEC, NULL, 0x0,
17683           NULL, HFILL}
17684         },
17685         /* ntop, 35632 / 292 */
17686         {&hf_pie_ntop_src_as_path_3,
17687          {"Src AS path position 3", "cflow.pie.ntop.src_as_path_3",
17688           FT_UINT32, BASE_DEC, NULL, 0x0,
17689           NULL, HFILL}
17690         },
17691         /* ntop, 35632 / 293 */
17692         {&hf_pie_ntop_src_as_path_4,
17693          {"Src AS path position 4", "cflow.pie.ntop.src_as_path_4",
17694           FT_UINT32, BASE_DEC, NULL, 0x0,
17695           NULL, HFILL}
17696         },
17697         /* ntop, 35632 / 294 */
17698         {&hf_pie_ntop_src_as_path_5,
17699          {"Src AS path position 5", "cflow.pie.ntop.src_as_path_5",
17700           FT_UINT32, BASE_DEC, NULL, 0x0,
17701           NULL, HFILL}
17702         },
17703         /* ntop, 35632 / 295 */
17704         {&hf_pie_ntop_src_as_path_6,
17705          {"Src AS path position 6", "cflow.pie.ntop.src_as_path_6",
17706           FT_UINT32, BASE_DEC, NULL, 0x0,
17707           NULL, HFILL}
17708         },
17709         /* ntop, 35632 / 296 */
17710         {&hf_pie_ntop_src_as_path_7,
17711          {"Src AS path position 7", "cflow.pie.ntop.src_as_path_7",
17712           FT_UINT32, BASE_DEC, NULL, 0x0,
17713           NULL, HFILL}
17714         },
17715         /* ntop, 35632 / 297 */
17716         {&hf_pie_ntop_src_as_path_8,
17717          {"Src AS path position 8", "cflow.pie.ntop.src_as_path_8",
17718           FT_UINT32, BASE_DEC, NULL, 0x0,
17719           NULL, HFILL}
17720         },
17721         /* ntop, 35632 / 298 */
17722         {&hf_pie_ntop_src_as_path_9,
17723          {"Src AS path position 9", "cflow.pie.ntop.src_as_path_9",
17724           FT_UINT32, BASE_DEC, NULL, 0x0,
17725           NULL, HFILL}
17726         },
17727         /* ntop, 35632 / 299 */
17728         {&hf_pie_ntop_src_as_path_10,
17729          {"Src AS path position 10", "cflow.pie.ntop.src_as_path_10",
17730           FT_UINT32, BASE_DEC, NULL, 0x0,
17731           NULL, HFILL}
17732         },
17733         /* ntop, 35632 / 300 */
17734         {&hf_pie_ntop_dst_as_path_1,
17735          {"Dest AS path position 1", "cflow.pie.ntop.dst_as_path_1",
17736           FT_UINT32, BASE_DEC, NULL, 0x0,
17737           NULL, HFILL}
17738         },
17739         /* ntop, 35632 / 301 */
17740         {&hf_pie_ntop_dst_as_path_2,
17741          {"Dest AS path position 2", "cflow.pie.ntop.dst_as_path_2",
17742           FT_UINT32, BASE_DEC, NULL, 0x0,
17743           NULL, HFILL}
17744         },
17745         /* ntop, 35632 / 302 */
17746         {&hf_pie_ntop_dst_as_path_3,
17747          {"Dest AS path position 3", "cflow.pie.ntop.dst_as_path_3",
17748           FT_UINT32, BASE_DEC, NULL, 0x0,
17749           NULL, HFILL}
17750         },
17751         /* ntop, 35632 / 303 */
17752         {&hf_pie_ntop_dst_as_path_4,
17753          {"Dest AS path position 4", "cflow.pie.ntop.dst_as_path_4",
17754           FT_UINT32, BASE_DEC, NULL, 0x0,
17755           NULL, HFILL}
17756         },
17757         /* ntop, 35632 / 304 */
17758         {&hf_pie_ntop_dst_as_path_5,
17759          {"Dest AS path position 5", "cflow.pie.ntop.dst_as_path_5",
17760           FT_UINT32, BASE_DEC, NULL, 0x0,
17761           NULL, HFILL}
17762         },
17763         /* ntop, 35632 / 305 */
17764         {&hf_pie_ntop_dst_as_path_6,
17765          {"Dest AS path position 6", "cflow.pie.ntop.dst_as_path_6",
17766           FT_UINT32, BASE_DEC, NULL, 0x0,
17767           NULL, HFILL}
17768         },
17769         /* ntop, 35632 / 306 */
17770         {&hf_pie_ntop_dst_as_path_7,
17771          {"Dest AS path position 7", "cflow.pie.ntop.dst_as_path_7",
17772           FT_UINT32, BASE_DEC, NULL, 0x0,
17773           NULL, HFILL}
17774         },
17775         /* ntop, 35632 / 307 */
17776         {&hf_pie_ntop_dst_as_path_8,
17777          {"Dest AS path position 8", "cflow.pie.ntop.dst_as_path_8",
17778           FT_UINT32, BASE_DEC, NULL, 0x0,
17779           NULL, HFILL}
17780         },
17781         /* ntop, 35632 / 308 */
17782         {&hf_pie_ntop_dst_as_path_9,
17783          {"Dest AS path position 9", "cflow.pie.ntop.dst_as_path_9",
17784           FT_UINT32, BASE_DEC, NULL, 0x0,
17785           NULL, HFILL}
17786         },
17787         /* ntop, 35632 / 309 */
17788         {&hf_pie_ntop_dst_as_path_10,
17789          {"Dest AS path position 10", "cflow.pie.ntop.dst_as_path_10",
17790           FT_UINT32, BASE_DEC, NULL, 0x0,
17791           NULL, HFILL}
17792         },
17793         /* ntop, 35632 / 320 */
17794         {&hf_pie_ntop_mysql_appl_latency_usec,
17795          {"MySQL request->response latency (usec)", "cflow.pie.ntop.mysql_appl_latency_usec",
17796           FT_UINT32, BASE_DEC, NULL, 0x0,
17797           NULL, HFILL}
17798         },
17799         /* ntop, 35632 / 321 */
17800         {&hf_pie_ntop_gtpv0_req_msg_type,
17801          {"GTPv0 Request Msg Type", "cflow.pie.ntop.gtpv0_req_msg_type",
17802           FT_UINT8, BASE_DEC, NULL, 0x0,
17803           NULL, HFILL}
17804         },
17805         /* ntop, 35632 / 322 */
17806         {&hf_pie_ntop_gtpv0_rsp_msg_type,
17807          {"GTPv0 Response Msg Type", "cflow.pie.ntop.gtpv0_rsp_msg_type",
17808           FT_UINT8, BASE_DEC, NULL, 0x0,
17809           NULL, HFILL}
17810         },
17811         /* ntop, 35632 / 323 */
17812         {&hf_pie_ntop_gtpv0_tid,
17813          {"GTPv0 Tunnel Identifier", "cflow.pie.ntop.gtpv0_tid",
17814           FT_UINT64, BASE_DEC, NULL, 0x0,
17815           NULL, HFILL}
17816         },
17817         /* ntop, 35632 / 324 */
17818         {&hf_pie_ntop_gtpv0_end_user_ip,
17819          {"GTPv0 End User IP Address", "cflow.pie.ntop.gtpv0_end_user_ip",
17820           FT_IPv4, BASE_NONE, NULL, 0x0,
17821           NULL, HFILL}
17822         },
17823         /* ntop, 35632 / 325 */
17824         {&hf_pie_ntop_gtpv0_end_user_msisdn,
17825          {"GTPv0 End User MSISDN", "cflow.pie.ntop.gtpv0_end_user_msisdn",
17826           FT_STRING, BASE_NONE, NULL, 0x0,
17827           NULL, HFILL}
17828         },
17829         /* ntop, 35632 / 326 */
17830         {&hf_pie_ntop_gtpv0_apn_name,
17831          {"GTPv0 APN Name", "cflow.pie.ntop.gtpv0_apn_name",
17832           FT_STRING, BASE_NONE, NULL, 0x0,
17833           NULL, HFILL}
17834         },
17835         /* ntop, 35632 / 327 */
17836         {&hf_pie_ntop_gtpv0_rai_mcc,
17837          {"GTPv0 Mobile Country Code", "cflow.pie.ntop.gtpv0_rai_mcc",
17838           FT_UINT16, BASE_DEC, NULL, 0x0,
17839           NULL, HFILL}
17840         },
17841         /* ntop, 35632 / 328 */
17842         {&hf_pie_ntop_gtpv0_rai_mnc,
17843          {"GTPv0 Mobile Network Code", "cflow.pie.ntop.gtpv0_rai_mnc",
17844           FT_UINT16, BASE_DEC, NULL, 0x0,
17845           NULL, HFILL}
17846         },
17847         /* ntop, 35632 / 329 */
17848         {&hf_pie_ntop_gtpv0_rai_cell_lac,
17849          {"GTPv0 Cell Location Area Code", "cflow.pie.ntop.gtpv0_rai_cell_lac",
17850           FT_UINT16, BASE_DEC, NULL, 0x0,
17851           NULL, HFILL}
17852         },
17853         /* ntop, 35632 / 330 */
17854         {&hf_pie_ntop_gtpv0_rai_cell_rac,
17855          {"GTPv0 Cell Routing Area Code", "cflow.pie.ntop.gtpv0_rai_cell_rac",
17856           FT_UINT16, BASE_DEC, NULL, 0x0,
17857           NULL, HFILL}
17858         },
17859         /* ntop, 35632 / 331 */
17860         {&hf_pie_ntop_gtpv0_response_cause,
17861          {"GTPv0 Cause of Operation", "cflow.pie.ntop.gtpv0_response_cause",
17862           FT_UINT8, BASE_DEC, NULL, 0x0,
17863           NULL, HFILL}
17864         },
17865         /* ntop, 35632 / 332 */
17866         {&hf_pie_ntop_gtpv1_response_cause,
17867          {"GTPv1 Cause of Operation", "cflow.pie.ntop.gtpv1_response_cause",
17868           FT_UINT8, BASE_DEC, NULL, 0x0,
17869           NULL, HFILL}
17870         },
17871         /* ntop, 35632 / 333 */
17872         {&hf_pie_ntop_gtpv2_response_cause,
17873          {"GTPv2 Cause of Operation", "cflow.pie.ntop.gtpv2_response_cause",
17874           FT_UINT8, BASE_DEC, NULL, 0x0,
17875           NULL, HFILL}
17876         },
17877         /* ntop, 35632 / 334 */
17878         {&hf_pie_ntop_num_pkts_ttl_5_32,
17879          {"# packets with TTL > 5 and TTL <= 32", "cflow.pie.ntop.num_pkts_ttl_5_32",
17880           FT_UINT32, BASE_DEC, NULL, 0x0,
17881           NULL, HFILL}
17882         },
17883         /* ntop, 35632 / 335 */
17884         {&hf_pie_ntop_num_pkts_ttl_32_64,
17885          {"# packets with TTL > 32 and <= 64", "cflow.pie.ntop.num_pkts_ttl_32_64",
17886           FT_UINT32, BASE_DEC, NULL, 0x0,
17887           NULL, HFILL}
17888         },
17889         /* ntop, 35632 / 336 */
17890         {&hf_pie_ntop_num_pkts_ttl_64_96,
17891          {"# packets with TTL > 64 and <= 96", "cflow.pie.ntop.num_pkts_ttl_64_96",
17892           FT_UINT32, BASE_DEC, NULL, 0x0,
17893           NULL, HFILL}
17894         },
17895         /* ntop, 35632 / 337 */
17896         {&hf_pie_ntop_num_pkts_ttl_96_128,
17897          {"# packets with TTL > 96 and <= 128", "cflow.pie.ntop.num_pkts_ttl_96_128",
17898           FT_UINT32, BASE_DEC, NULL, 0x0,
17899           NULL, HFILL}
17900         },
17901         /* ntop, 35632 / 338 */
17902         {&hf_pie_ntop_num_pkts_ttl_128_160,
17903          {"# packets with TTL > 128 and <= 160", "cflow.pie.ntop.num_pkts_ttl_128_160",
17904           FT_UINT32, BASE_DEC, NULL, 0x0,
17905           NULL, HFILL}
17906         },
17907         /* ntop, 35632 / 339 */
17908         {&hf_pie_ntop_num_pkts_ttl_160_192,
17909          {"# packets with TTL > 160 and <= 192", "cflow.pie.ntop.num_pkts_ttl_160_192",
17910           FT_UINT32, BASE_DEC, NULL, 0x0,
17911           NULL, HFILL}
17912         },
17913         /* ntop, 35632 / 340 */
17914         {&hf_pie_ntop_num_pkts_ttl_192_224,
17915          {"# packets with TTL > 192 and <= 224", "cflow.pie.ntop.num_pkts_ttl_192_224",
17916           FT_UINT32, BASE_DEC, NULL, 0x0,
17917           NULL, HFILL}
17918         },
17919         /* ntop, 35632 / 341 */
17920         {&hf_pie_ntop_num_pkts_ttl_224_255,
17921          {"# packets with TTL > 224 and <= 255", "cflow.pie.ntop.num_pkts_ttl_224_255",
17922           FT_UINT32, BASE_DEC, NULL, 0x0,
17923           NULL, HFILL}
17924         },
17925         /* ntop, 35632 / 342 */
17926         {&hf_pie_ntop_gtpv1_rai_lac,
17927          {"GTPv1 RAI Location Area Code", "cflow.pie.ntop.gtpv1_rai_lac",
17928           FT_UINT16, BASE_DEC, NULL, 0x0,
17929           NULL, HFILL}
17930         },
17931         /* ntop, 35632 / 343 */
17932         {&hf_pie_ntop_gtpv1_rai_rac,
17933          {"GTPv1 RAI Routing Area Code", "cflow.pie.ntop.gtpv1_rai_rac",
17934           FT_UINT8, BASE_DEC, NULL, 0x0,
17935           NULL, HFILL}
17936         },
17937         /* ntop, 35632 / 344 */
17938         {&hf_pie_ntop_gtpv1_uli_mcc,
17939          {"GTPv1 ULI Mobile Country Code", "cflow.pie.ntop.gtpv1_uli_mcc",
17940           FT_UINT16, BASE_DEC, NULL, 0x0,
17941           NULL, HFILL}
17942         },
17943         /* ntop, 35632 / 345 */
17944         {&hf_pie_ntop_gtpv1_uli_mnc,
17945          {"GTPv1 ULI Mobile Network Code", "cflow.pie.ntop.gtpv1_uli_mnc",
17946           FT_UINT32, BASE_DEC, NULL, 0x0,
17947           NULL, HFILL}
17948         },
17949         /* ntop, 35632 / 346 */
17950         {&hf_pie_ntop_num_pkts_ttl_2_5,
17951          {"# packets with TTL > 1 and TTL <= 5", "cflow.pie.ntop.num_pkts_ttl_2_5",
17952           FT_UINT32, BASE_DEC, NULL, 0x0,
17953           NULL, HFILL}
17954         },
17955         /* ntop, 35632 / 347 */
17956         {&hf_pie_ntop_num_pkts_ttl_eq_1,
17957          {"# packets with TTL = 1", "cflow.pie.ntop.num_pkts_ttl_eq_1",
17958           FT_UINT32, BASE_DEC, NULL, 0x0,
17959           NULL, HFILL}
17960         },
17961         /* ntop, 35632 / 348 */
17962         {&hf_pie_ntop_rtp_sip_call_id,
17963          {"SIP call-id corresponding to this RTP stream", "cflow.pie.ntop.rtp_sip_call_id",
17964           FT_STRING, BASE_NONE, NULL, 0x0,
17965           NULL, HFILL}
17966         },
17967         /* ntop, 35632 / 349 */
17968         {&hf_pie_ntop_in_src_osi_sap,
17969          {"OSI Source SAP (OSI Traffic Only)", "cflow.pie.ntop.in_src_osi_sap",
17970           FT_STRING, BASE_NONE, NULL, 0x0,
17971           NULL, HFILL}
17972         },
17973         /* ntop, 35632 / 350 */
17974         {&hf_pie_ntop_out_dst_osi_sap,
17975          {"OSI Destination SAP (OSI Traffic Only)", "cflow.pie.ntop.out_dst_osi_sap",
17976           FT_STRING, BASE_NONE, NULL, 0x0,
17977           NULL, HFILL}
17978         },
17979         /* ntop, 35632 / 351 */
17980         {&hf_pie_ntop_whois_das_domain,
17981          {"Whois/DAS Domain name", "cflow.pie.ntop.whois_das_domain",
17982           FT_STRING, BASE_NONE, NULL, 0x0,
17983           NULL, HFILL}
17984         },
17985         /* ntop, 35632 / 352 */
17986         {&hf_pie_ntop_dns_ttl_answer,
17987          {"TTL of the first A record (if any)", "cflow.pie.ntop.dns_ttl_answer",
17988           FT_UINT32, BASE_DEC, NULL, 0x0,
17989           NULL, HFILL}
17990         },
17991         /* ntop, 35632 / 353 */
17992         {&hf_pie_ntop_dhcp_client_mac,
17993          {"MAC of the DHCP client", "cflow.pie.ntop.dhcp_client_mac",
17994           FT_ETHER, BASE_NONE, NULL, 0x0,
17995           NULL, HFILL}
17996         },
17997         /* ntop, 35632 / 354 */
17998         {&hf_pie_ntop_dhcp_client_ip,
17999          {"DHCP assigned client IPv4 address", "cflow.pie.ntop.dhcp_client_ip",
18000           FT_IPv4, BASE_NONE, NULL, 0x0,
18001           NULL, HFILL}
18002         },
18003         /* ntop, 35632 / 355 */
18004         {&hf_pie_ntop_dhcp_client_name,
18005          {"DHCP client name", "cflow.pie.ntop.dhcp_clien_name",
18006           FT_STRING, BASE_NONE, NULL, 0x0,
18007           NULL, HFILL}
18008         },
18009         /* ntop, 35632 / 356 */
18010         {&hf_pie_ntop_ftp_login,
18011          {"FTP client login", "cflow.pie.ntop.ftp_login",
18012           FT_STRING, BASE_NONE, NULL, 0x0,
18013           NULL, HFILL}
18014         },
18015         /* ntop, 35632 / 357 */
18016         {&hf_pie_ntop_ftp_password,
18017          {"FTP client password", "cflow.pie.ntop.ftp_password",
18018           FT_STRING, BASE_NONE, NULL, 0x0,
18019           NULL, HFILL}
18020         },
18021         /* ntop, 35632 / 358 */
18022         {&hf_pie_ntop_ftp_command,
18023          {"FTP client command", "cflow.pie.ntop.ftp_command",
18024           FT_STRING, BASE_NONE, NULL, 0x0,
18025           NULL, HFILL}
18026         },
18027         /* ntop, 35632 / 359 */
18028         {&hf_pie_ntop_ftp_command_ret_code,
18029          {"FTP client command return code", "cflow.pie.ntop.ftp_command_ret_code",
18030           FT_UINT16, BASE_DEC, NULL, 0x0,
18031           NULL, HFILL}
18032         },
18033         /* ntop, 35632 / 360 */
18034         {&hf_pie_ntop_http_method,
18035          {"HTTP METHOD", "cflow.pie.ntop.http_method",
18036           FT_STRING, BASE_NONE, NULL, 0x0,
18037           NULL, HFILL}
18038         },
18039         /* ntop, 35632 / 361 */
18040         {&hf_pie_ntop_http_site,
18041          {"HTTP server without host name", "cflow.pie.ntop.http_site",
18042           FT_STRING, BASE_NONE, NULL, 0x0,
18043           NULL, HFILL}
18044         },
18045         /* ntop, 35632 / 362 */
18046         {&hf_pie_ntop_sip_c_ip,
18047          {"SIP C IP addresses", "cflow.pie.ntop.sip_c_ip",
18048           FT_STRING, BASE_NONE, NULL, 0x0,
18049           NULL, HFILL}
18050         },
18051         /* ntop, 35632 / 363 */
18052         {&hf_pie_ntop_sip_call_state,
18053          {"SIP Call State", "cflow.pie.ntop.sip_call_state",
18054           FT_STRING, BASE_NONE, NULL, 0x0,
18055           NULL, HFILL}
18056         },
18057         /* ntop, 35632 / 370 */
18058         {&hf_pie_ntop_rtp_in_mos,
18059          {"RTP pseudo-MOS (value * 100) (src->dst)", "cflow.pie.ntop.rtp_in_mos",
18060           FT_UINT32, BASE_DEC, NULL, 0x0,
18061           NULL, HFILL}
18062         },
18063         /* ntop, 35632 / 371 */
18064         {&hf_pie_ntop_rtp_in_r_factor,
18065          {"RTP pseudo-R_FACTOR (value * 100) (src->dst)", "cflow.pie.ntop.rtp_in_r_factor",
18066           FT_UINT32, BASE_DEC, NULL, 0x0,
18067           NULL, HFILL}
18068         },
18069         /* ntop, 35632 / 372 */
18070         {&hf_pie_ntop_src_proc_user_name,
18071          {"Src process user name", "cflow.pie.ntop.src_proc_user_name",
18072           FT_STRING, BASE_NONE, NULL, 0x0,
18073           NULL, HFILL}
18074         },
18075         /* ntop, 35632 / 373 */
18076         {&hf_pie_ntop_src_father_proc_pid,
18077          {"Src father process PID", "cflow.pie.ntop.src_father_proc_pid",
18078           FT_UINT32, BASE_DEC, NULL, 0x0,
18079           NULL, HFILL}
18080         },
18081         /* ntop, 35632 / 374 */
18082         {&hf_pie_ntop_src_father_proc_name,
18083          {"Src father process name", "cflow.pie.ntop.src_father_proc_name",
18084           FT_STRING, BASE_NONE, NULL, 0x0,
18085           NULL, HFILL}
18086         },
18087         /* ntop, 35632 / 375 */
18088         {&hf_pie_ntop_dst_proc_pid,
18089          {"Dst process PID", "cflow.pie.ntop.dst_proc_pid",
18090           FT_UINT32, BASE_DEC, NULL, 0x0,
18091           NULL, HFILL}
18092         },
18093         /* ntop, 35632 / 376 */
18094         {&hf_pie_ntop_dst_proc_name,
18095          {"Dst process name", "cflow.pie.ntop.dst_proc_name",
18096           FT_STRING, BASE_NONE, NULL, 0x0,
18097           NULL, HFILL}
18098         },
18099         /* ntop, 35632 / 377 */
18100         {&hf_pie_ntop_dst_proc_user_name,
18101          {"Dst process user name", "cflow.pie.ntop.dst_proc_user_name",
18102           FT_STRING, BASE_NONE, NULL, 0x0,
18103           NULL, HFILL}
18104         },
18105         /* ntop, 35632 / 378 */
18106         {&hf_pie_ntop_dst_father_proc_pid,
18107          {"Dst father process PID", "cflow.pie.ntop.dst_father_proc_pid",
18108           FT_UINT32, BASE_DEC, NULL, 0x0,
18109           NULL, HFILL}
18110         },
18111         /* ntop, 35632 / 379 */
18112         {&hf_pie_ntop_dst_father_proc_name,
18113          {"Dst father process name", "cflow.pie.ntop.dst_father_proc_name",
18114           FT_STRING, BASE_NONE, NULL, 0x0,
18115           NULL, HFILL}
18116         },
18117         /* ntop, 35632 / 380 */
18118         {&hf_pie_ntop_rtp_rtt,
18119          {"RTP Round Trip Time", "cflow.pie.ntop.rtp_rtt",
18120           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
18121           NULL, HFILL}
18122         },
18123         /* ntop, 35632 / 381 */
18124         {&hf_pie_ntop_rtp_in_transit,
18125          {"RTP Transit (value * 100) (src->dst)", "cflow.pie.ntop.rtp_in_transit",
18126           FT_UINT32, BASE_DEC, NULL, 0x0,
18127           NULL, HFILL}
18128         },
18129         /* ntop, 35632 / 382 */
18130         {&hf_pie_ntop_rtp_out_transit,
18131          {"RTP Transit (value * 100) (dst->src)", "cflow.pie.ntop.rtp_out_transit",
18132           FT_UINT32, BASE_DEC, NULL, 0x0,
18133           NULL, HFILL}
18134         },
18135         /* ntop, 35632 / 383 */
18136         {&hf_pie_ntop_src_proc_actual_memory,
18137          {"Src process actual memory", "cflow.pie.ntop.src_proc_actual_memory",
18138           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
18139           NULL, HFILL}
18140         },
18141         /* ntop, 35632 / 384 */
18142         {&hf_pie_ntop_src_proc_peak_memory,
18143          {"Src process peak memory", "cflow.pie.ntop.src_proc_peak_memory",
18144           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
18145           NULL, HFILL}
18146         },
18147         /* ntop, 35632 / 385 */
18148         {&hf_pie_ntop_src_proc_average_cpu_load,
18149          {"Src process avg load (% * 100)", "cflow.pie.ntop.src_proc_average_cpu_load",
18150           FT_UINT32, BASE_DEC, NULL, 0x0,
18151           NULL, HFILL}
18152         },
18153         /* ntop, 35632 / 386 */
18154         {&hf_pie_ntop_src_proc_num_page_faults,
18155          {"Src process num pagefaults", "cflow.pie.ntop.src_proc_num_page_faults",
18156           FT_UINT32, BASE_DEC, NULL, 0x0,
18157           NULL, HFILL}
18158         },
18159         /* ntop, 35632 / 387 */
18160         {&hf_pie_ntop_dst_proc_actual_memory,
18161          {"Dst process actual memory", "cflow.pie.ntop.dst_proc_actual_memory",
18162           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
18163           NULL, HFILL}
18164         },
18165         /* ntop, 35632 / 388 */
18166         {&hf_pie_ntop_dst_proc_peak_memory,
18167          {"Dst process peak memory", "cflow.pie.ntop.dst_proc_peak_memory",
18168           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
18169           NULL, HFILL}
18170         },
18171         /* ntop, 35632 / 389 */
18172         {&hf_pie_ntop_dst_proc_average_cpu_load,
18173          {"Dst process avg load (% * 100)", "cflow.pie.ntop.dst_proc_average_cpu_load",
18174           FT_UINT32, BASE_DEC, NULL, 0x0,
18175           NULL, HFILL}
18176         },
18177         /* ntop, 35632 / 390 */
18178         {&hf_pie_ntop_dst_proc_num_page_faults,
18179          {"Dst process num pagefaults", "cflow.pie.ntop.dst_proc_num_page_faults",
18180           FT_UINT32, BASE_DEC, NULL, 0x0,
18181           NULL, HFILL}
18182         },
18183         /* ntop, 35632 / 391 */
18184         {&hf_pie_ntop_duration_in,
18185          {"Client to Server stream duration", "cflow.pie.ntop.duration_in",
18186           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
18187           NULL, HFILL}
18188         },
18189         /* ntop, 35632 / 392 */
18190         {&hf_pie_ntop_duration_out,
18191          {"Client to Server stream duration", "cflow.pie.ntop.duration_out",
18192           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
18193           NULL, HFILL}
18194         },
18195         /* ntop, 35632 / 393 */
18196         {&hf_pie_ntop_src_proc_pctg_iowait,
18197          {"Src process iowait time % (% * 100)", "cflow.pie.ntop.src_proc_pctg_iowait",
18198           FT_UINT32, BASE_DEC, NULL, 0x0,
18199           NULL, HFILL}
18200         },
18201         /* ntop, 35632 / 394 */
18202         {&hf_pie_ntop_dst_proc_pctg_iowait,
18203          {"Dst process iowait time % (% * 100)", "cflow.pie.ntop.dst_proc_pctg_iowait",
18204           FT_UINT32, BASE_DEC, NULL, 0x0,
18205           NULL, HFILL}
18206         },
18207         /* ntop, 35632 / 395 */
18208         {&hf_pie_ntop_rtp_dtmf_tones,
18209          {"DTMF tones sent (if any) during the call", "cflow.pie.ntop.rtp_dtmf_tones",
18210           FT_STRING, BASE_NONE, NULL, 0x0,
18211           NULL, HFILL}
18212         },
18213         /* ntop, 35632 / 396 */
18214         {&hf_pie_ntop_untunneled_ipv6_src_addr,
18215          {"Untunneled IPv6 source address", "cflow.pie.ntop.untunneled_ipv6_src_addr",
18216           FT_IPv6, BASE_NONE, NULL, 0x0,
18217           NULL, HFILL}
18218         },
18219         /* ntop, 35632 / 397 */
18220         {&hf_pie_ntop_untunneled_ipv6_dst_addr,
18221          {"Untunneled IPv6 destination address", "cflow.pie.ntop.untunneled_ipv6_dst_addr",
18222           FT_IPv6, BASE_NONE, NULL, 0x0,
18223           NULL, HFILL}
18224         },
18225         /* ntop, 35632 / 398 */
18226         {&hf_pie_ntop_dns_response,
18227          {"DNS response(s)", "cflow.pie.ntop.dns_response",
18228           FT_STRING, BASE_NONE, NULL, 0x0,
18229           NULL, HFILL}
18230         },
18231         /* ntop, 35632 / 399 */
18232         {&hf_pie_ntop_diameter_req_msg_type,
18233          {"DIAMETER Request Msg Type", "cflow.pie.ntop.diameter_req_msg_type",
18234           FT_UINT32, BASE_DEC, NULL, 0x0,
18235           NULL, HFILL}
18236         },
18237         /* ntop, 35632 / 400 */
18238         {&hf_pie_ntop_diameter_rsp_msg_type,
18239          {"DIAMETER Response Msg Type", "cflow.pie.ntop.diameter_rsp_msg_type",
18240           FT_UINT32, BASE_DEC, NULL, 0x0,
18241           NULL, HFILL}
18242         },
18243         /* ntop, 35632 / 401 */
18244         {&hf_pie_ntop_diameter_req_origin_host,
18245          {"DIAMETER Origin Host Request", "cflow.pie.ntop.diameter_req_origin_host",
18246           FT_STRING, BASE_NONE, NULL, 0x0,
18247           NULL, HFILL}
18248         },
18249         /* ntop, 35632 / 402 */
18250         {&hf_pie_ntop_diameter_rsp_origin_host,
18251          {"DIAMETER Origin Host Response", "cflow.pie.ntop.diameter_rsp_origin_host",
18252           FT_STRING, BASE_NONE, NULL, 0x0,
18253           NULL, HFILL}
18254         },
18255         /* ntop, 35632 / 403 */
18256         {&hf_pie_ntop_diameter_req_user_name,
18257          {"DIAMETER Request User Name", "cflow.pie.ntop.diameter_req_user_name",
18258           FT_STRING, BASE_NONE, NULL, 0x0,
18259           NULL, HFILL}
18260         },
18261         /* ntop, 35632 / 404 */
18262         {&hf_pie_ntop_diameter_rsp_result_code,
18263          {"DIAMETER Response Result Code", "cflow.pie.ntop.diameter_rsp_result_code",
18264           FT_UINT32, BASE_DEC, NULL, 0x0,
18265           NULL, HFILL}
18266         },
18267         /* ntop, 35632 / 405 */
18268         {&hf_pie_ntop_diameter_exp_res_vendor_id,
18269          {"DIAMETER Response Experimental Result Vendor Id", "cflow.pie.ntop.diameter_exp_res_vendor_id",
18270           FT_UINT32, BASE_DEC, NULL, 0x0,
18271           NULL, HFILL}
18272         },
18273         /* ntop, 35632 / 406 */
18274         {&hf_pie_ntop_diameter_exp_res_result_code,
18275          {"DIAMETER Response Experimental Result Code", "cflow.pie.ntop.diameter_exp_res_result_code",
18276           FT_UINT32, BASE_DEC, NULL, 0x0,
18277           NULL, HFILL}
18278         },
18279         /* ntop, 35632 / 407 */
18280         {&hf_pie_ntop_s1ap_enb_ue_s1ap_id,
18281          {"S1AP ENB Identifier", "cflow.pie.ntop.s1ap_enb_ue_s1ap_id",
18282           FT_UINT32, BASE_DEC, NULL, 0x0,
18283           NULL, HFILL}
18284         },
18285         /* ntop, 35632 / 408 */
18286         {&hf_pie_ntop_s1ap_mme_ue_s1ap_id,
18287          {"S1AP MME Identifier", "cflow.pie.ntop.s1ap_mme_ue_s1ap_id",
18288           FT_UINT32, BASE_DEC, NULL, 0x0,
18289           NULL, HFILL}
18290         },
18291         /* ntop, 35632 / 409 */
18292         {&hf_pie_ntop_s1ap_msg_emm_type_mme_to_enb,
18293          {"S1AP EMM Message Type from MME to ENB", "cflow.pie.ntop.s1ap_msg_emm_type_mme_to_enb",
18294           FT_UINT8, BASE_DEC, NULL, 0x0,
18295           NULL, HFILL}
18296         },
18297         /* ntop, 35632 / 410 */
18298         {&hf_pie_ntop_s1ap_msg_esm_type_mme_to_enb,
18299          {"S1AP ESM Message Type from MME to ENB", "cflow.pie.ntop.s1ap_msg_esm_type_mme_to_enb",
18300           FT_UINT8, BASE_DEC, NULL, 0x0,
18301           NULL, HFILL}
18302         },
18303         /* ntop, 35632 / 411 */
18304         {&hf_pie_ntop_s1ap_msg_emm_type_enb_to_mme,
18305          {"S1AP EMM Message Type from ENB to MME", "cflow.pie.ntop.s1ap_msg_emm_type_enb_to_mme",
18306           FT_UINT8, BASE_DEC, NULL, 0x0,
18307           NULL, HFILL}
18308         },
18309         /* ntop, 35632 / 412 */
18310         {&hf_pie_ntop_s1ap_msg_esm_type_enb_to_mme,
18311          {"S1AP ESM Message Type from ENB to MME", "cflow.pie.ntop.s1ap_msg_esm_type_enb_to_mme",
18312           FT_UINT8, BASE_DEC, NULL, 0x0,
18313           NULL, HFILL}
18314         },
18315         /* ntop, 35632 / 413 */
18316         {&hf_pie_ntop_s1ap_cause_enb_to_mme,
18317          {"S1AP Cause from ENB to MME", "cflow.pie.ntop.s1ap_cause_enb_to_mme",
18318           FT_UINT8, BASE_DEC, NULL, 0x0,
18319           NULL, HFILL}
18320         },
18321         /* ntop, 35632 / 414 */
18322         {&hf_pie_ntop_s1ap_detailed_cause_enb_to_mme,
18323          {"S1AP Detailed Cause from ENB to MME", "cflow.pie.ntop.s1ap_detailed_cause_enb_to_mme",
18324           FT_UINT8, BASE_DEC, NULL, 0x0,
18325           NULL, HFILL}
18326         },
18327         /* ntop, 35632 / 415 */
18328         {&hf_pie_ntop_tcp_win_min_in,
18329          {"Min TCP Window (src->dst)", "cflow.pie.ntop.tcp_win_min_in",
18330           FT_UINT16, BASE_DEC, NULL, 0x0,
18331           NULL, HFILL}
18332         },
18333         /* ntop, 35632 / 416 */
18334         {&hf_pie_ntop_tcp_win_max_in,
18335          {"Max TCP Window (src->dst)", "cflow.pie.ntop.tcp_win_max_in",
18336           FT_UINT16, BASE_DEC, NULL, 0x0,
18337           NULL, HFILL}
18338         },
18339         /* ntop, 35632 / 417 */
18340         {&hf_pie_ntop_tcp_win_mss_in,
18341          {"TCP Max Segment Size (src->dst)", "cflow.pie.ntop.tcp_win_mss_in",
18342           FT_UINT16, BASE_DEC, NULL, 0x0,
18343           NULL, HFILL}
18344         },
18345         /* ntop, 35632 / 418 */
18346         {&hf_pie_ntop_tcp_win_scale_in,
18347          {"TCP Window Scale (src->dst)", "cflow.pie.ntop.tcp_win_scale_in",
18348           FT_UINT8, BASE_DEC, NULL, 0x0,
18349           NULL, HFILL}
18350         },
18351         /* ntop, 35632 / 419 */
18352         {&hf_pie_ntop_tcp_win_min_out,
18353          {"Min TCP Window (dst->src)", "cflow.pie.ntop.tcp_win_min_out",
18354           FT_UINT16, BASE_DEC, NULL, 0x0,
18355           NULL, HFILL}
18356         },
18357         /* ntop, 35632 / 420 */
18358         {&hf_pie_ntop_tcp_win_max_out,
18359          {"Max TCP Window (dst->src)", "cflow.pie.ntop.tcp_win_max_out",
18360           FT_UINT16, BASE_DEC, NULL, 0x0,
18361           NULL, HFILL}
18362         },
18363         /* ntop, 35632 / 421 */
18364         {&hf_pie_ntop_tcp_win_mss_out,
18365          {"TCP Max Segment Size (dst->src)", "cflow.pie.ntop.tcp_win_mss_out",
18366           FT_UINT16, BASE_DEC, NULL, 0x0,
18367           NULL, HFILL}
18368         },
18369         /* ntop, 35632 / 422 */
18370         {&hf_pie_ntop_tcp_win_scale_out,
18371          {"TCP Window Scale (dst->src)", "cflow.pie.ntop.tcp_win_scale_out",
18372           FT_UINT8, BASE_DEC, NULL, 0x0,
18373           NULL, HFILL}
18374         },
18375         /* ntop, 35632 / 423 */
18376         {&hf_pie_ntop_dhcp_remote_id,
18377          {"DHCP agent remote Id", "cflow.pie.ntop.dhcp_remote_id",
18378           FT_STRING, BASE_NONE, NULL, 0x0,
18379           NULL, HFILL}
18380         },
18381         /* ntop, 35632 / 424 */
18382         {&hf_pie_ntop_dhcp_subscriber_id,
18383          {"DHCP subscribed Id", "cflow.pie.ntop.dhcp_subscriber_id",
18384           FT_STRING, BASE_NONE, NULL, 0x0,
18385           NULL, HFILL}
18386         },
18387         /* ntop, 35632 / 425 */
18388         {&hf_pie_ntop_src_proc_uid,
18389          {"Src process UID", "cflow.pie.ntop.src_proc_uid",
18390           FT_UINT32, BASE_DEC, NULL, 0x0,
18391           NULL, HFILL}
18392         },
18393         /* ntop, 35632 / 426 */
18394         {&hf_pie_ntop_dst_proc_uid,
18395          {"Dst process UID", "cflow.pie.ntop.dst_proc_uid",
18396           FT_UINT32, BASE_DEC, NULL, 0x0,
18397           NULL, HFILL}
18398         },
18399         /* ntop, 35632 / 427 */
18400         {&hf_pie_ntop_application_name,
18401          {"Palo Alto App-Id", "cflow.pie.ntop.application_name",
18402           FT_STRING, BASE_NONE, NULL, 0x0,
18403           NULL, HFILL}
18404         },
18405         /* ntop, 35632 / 428 */
18406         {&hf_pie_ntop_user_name,
18407          {"Palo Alto User-Id", "cflow.pie.ntop.user_name",
18408           FT_STRING, BASE_NONE, NULL, 0x0,
18409           NULL, HFILL}
18410         },
18411         /* ntop, 35632 / 429 */
18412         {&hf_pie_ntop_dhcp_message_type,
18413          {"DHCP message type", "cflow.pie.ntop.dhcp_message_type",
18414           FT_STRING, BASE_NONE, NULL, 0x0,
18415           NULL, HFILL}
18416         },
18417         /* ntop, 35632 / 430 */
18418         {&hf_pie_ntop_rtp_in_pkt_drop,
18419          {"Packet discarded by Jitter Buffer (src->dst)", "cflow.pie.ntop.rtp_in_pkt_drop",
18420           FT_UINT32, BASE_DEC, NULL, 0x0,
18421           NULL, HFILL}
18422         },
18423         /* ntop, 35632 / 431 */
18424         {&hf_pie_ntop_rtp_out_pkt_drop,
18425          {"Packet discarded by Jitter Buffer (dst->src)", "cflow.pie.ntop.rtp_out_pkt_drop",
18426           FT_UINT32, BASE_DEC, NULL, 0x0,
18427           NULL, HFILL}
18428         },
18429         /* ntop, 35632 / 432 */
18430         {&hf_pie_ntop_rtp_out_mos,
18431          {"RTP pseudo-MOS (value * 100) (dst->src)", "cflow.pie.ntop.rtp_out_mos",
18432           FT_UINT32, BASE_DEC, NULL, 0x0,
18433           NULL, HFILL}
18434         },
18435         /* ntop, 35632 / 433 */
18436         {&hf_pie_ntop_rtp_out_r_factor,
18437          {"RTP pseudo-R_FACTOR (value * 100) (dst->src)", "cflow.pie.ntop.rtp_out_r_factor",
18438           FT_UINT32, BASE_DEC, NULL, 0x0,
18439           NULL, HFILL}
18440         },
18441         /* ntop, 35632 / 434 */
18442         {&hf_pie_ntop_rtp_mos,
18443          {"RTP pseudo-MOS (value * 100) (average both directions)", "cflow.pie.ntop.rtp_mos",
18444           FT_UINT32, BASE_DEC, NULL, 0x0,
18445           NULL, HFILL}
18446         },
18447         /* ntop, 35632 / 435 */
18448         {&hf_pie_ntop_gptv2_s5_s8_gtpc_teid,
18449          {"GTPv2 S5/S8 SGW GTPC TEIDs", "cflow.pie.ntop.gptv2_s5_s8_gtpc_teid",
18450           FT_STRING, BASE_NONE, NULL, 0x0,
18451           NULL, HFILL}
18452         },
18453         /* ntop, 35632 / 436 */
18454         {&hf_pie_ntop_rtp_r_factor,
18455          {"RTP pseudo-R_FACTOR (value * 100) (average both directions)", "cflow.pie.ntop.rtp_r_factor",
18456           FT_UINT32, BASE_DEC, NULL, 0x0,
18457           NULL, HFILL}
18458         },
18459         /* ntop, 35632 / 437 */
18460         {&hf_pie_ntop_rtp_ssrc,
18461          {"RTP Sync Source ID", "cflow.pie.ntop.rtp_ssrc",
18462           FT_UINT32, BASE_DEC, NULL, 0x0,
18463           NULL, HFILL}
18464         },
18465         /* ntop, 35632 / 438 */
18466         {&hf_pie_ntop_payload_hash,
18467          {"Initial flow payload hash", "cflow.pie.ntop.payload_hash",
18468           FT_UINT32, BASE_DEC, NULL, 0x0,
18469           NULL, HFILL}
18470         },
18471         /* ntop, 35632 / 439 */
18472         {&hf_pie_ntop_gtpv2_c2s_s5_s8_gtpu_teid,
18473          {"GTPv2 Client->Srv S5/S8 PGW GTPU TEID", "cflow.pie.ntop.gtpv2_c2s_s5_s8_gtpu_teid",
18474           FT_UINT32, BASE_DEC, NULL, 0x0,
18475           NULL, HFILL}
18476         },
18477         /* ntop, 35632 / 440 */
18478         {&hf_pie_ntop_gtpv2_s2c_s5_s8_gtpu_teid,
18479          {"GTPv2 Srv->Client S5/S8 PGW GTPU TEID", "cflow.pie.ntop.gtpv2_s2c_s5_s8_gtpu_teid",
18480           FT_UINT32, BASE_DEC, NULL, 0x0,
18481           NULL, HFILL}
18482         },
18483         /* ntop, 35632 / 441 */
18484         {&hf_pie_ntop_gtpv2_c2s_s5_s8_gtpu_ip,
18485          {"GTPv2 Client->Srv S5/S8 PGW GTPU IP", "cflow.pie.ntop.gtpv2_c2s_s5_s8_gtpu_ip",
18486           FT_IPv4, BASE_NONE, NULL, 0x0,
18487           NULL, HFILL}
18488         },
18489         /* ntop, 35632 / 442 */
18490         {&hf_pie_ntop_gtpv2_s2c_s5_s8_gtpu_ip,
18491          {"GTPv2 Srv->Client S5/S8 PGW GTPU IP", "cflow.pie.ntop.gtpv2_s2c_s5_s8_gtpu_ip",
18492           FT_IPv4, BASE_NONE, NULL, 0x0,
18493           NULL, HFILL}
18494         },
18495         /* ntop, 35632 / 443 */
18496         {&hf_pie_ntop_src_as_map,
18497          {"Organization name for SRC_AS", "cflow.pie.ntop.src_as_map",
18498           FT_STRING, BASE_NONE, NULL, 0x0,
18499           NULL, HFILL}
18500         },
18501         /* ntop, 35632 / 444 */
18502         {&hf_pie_ntop_dst_as_map,
18503          {"Organization name for DST_AS", "cflow.pie.ntop.dst_as_map",
18504           FT_STRING, BASE_NONE, NULL, 0x0,
18505           NULL, HFILL}
18506         },
18507         /* ntop, 35632 / 445 */
18508         {&hf_pie_ntop_diameter_hop_by_hop_id,
18509          {"DIAMETER Hop by Hop Identifier", "cflow.pie.ntop.diameter_hop_by_hop_id",
18510           FT_UINT32, BASE_DEC, NULL, 0x0,
18511           NULL, HFILL}
18512         },
18513         /* ntop, 35632 / 446 */
18514         {&hf_pie_ntop_upstream_session_id,
18515          {"Upstream session identifier (e.g. L2TP) or 0 if unknown", "cflow.pie.ntop.upstream_session_id",
18516           FT_UINT16, BASE_DEC, NULL, 0x0,
18517           NULL, HFILL}
18518         },
18519         /* ntop, 35632 / 447 */
18520         {&hf_pie_ntop_downstream_session_id,
18521          {"Downstream session identifier (e.g. L2TP) or 0 if unknown", "cflow.pie.ntop.downstream_session_id",
18522           FT_UINT32, BASE_DEC, NULL, 0x0,
18523           NULL, HFILL}
18524         },
18525         /* ntop, 35632 / 448 */
18526         {&hf_pie_ntop_src_ip_long,
18527          {"Longitude where the src IP is located", "cflow.pie.ntop.src_ip_long",
18528           FT_STRING, BASE_NONE, NULL, 0x0,
18529           NULL, HFILL}
18530         },
18531         /* ntop, 35632 / 449 */
18532         {&hf_pie_ntop_src_ip_lat,
18533          {"Latitude where the src IP is located", "cflow.pie.ntop.src_ip_lat",
18534           FT_STRING, BASE_NONE, NULL, 0x0,
18535           NULL, HFILL}
18536         },
18537         /* ntop, 35632 / 450 */
18538         {&hf_pie_ntop_dst_ip_long,
18539          {"Longitude where the dst IP is located", "cflow.pie.ntop.dst_ip_long",
18540           FT_STRING, BASE_NONE, NULL, 0x0,
18541           NULL, HFILL}
18542         },
18543         /* ntop, 35632 / 451 */
18544         {&hf_pie_ntop_dst_ip_lat,
18545          {"Latitude where the dst IP is located", "cflow.pie.ntop.dst_ip_lat",
18546           FT_STRING, BASE_NONE, NULL, 0x0,
18547           NULL, HFILL}
18548         },
18549         /* ntop, 35632 / 452 */
18550         {&hf_pie_ntop_diameter_clr_cancel_type,
18551          {"DIAMETER Cancellation Type", "cflow.pie.ntop.diameter_clr_cancel_type",
18552           FT_UINT32, BASE_DEC, NULL, 0x0,
18553           NULL, HFILL}
18554         },
18555         /* ntop, 35632 / 453 */
18556         {&hf_pie_ntop_diameter_clr_flags,
18557          {"DIAMETER CLR Flags", "cflow.pie.ntop.diameter_clr_flags",
18558           FT_UINT32, BASE_DEC, NULL, 0x0,
18559           NULL, HFILL}
18560         },
18561         /* ntop, 35632 / 454 */
18562         {&hf_pie_ntop_gtpv2_c2s_s5_s8_gtpc_ip,
18563          {"GTPv2 Client->Svr S5/S8 GTPC IP", "cflow.pie.ntop.gtpv2_c2s_s5_s8_gtpc_ip",
18564           FT_IPv4, BASE_NONE, NULL, 0x0,
18565           NULL, HFILL}
18566         },
18567         /* ntop, 35632 / 455 */
18568         {&hf_pie_ntop_gtpv2_s2c_s5_s8_gtpc_ip,
18569          {"GTPv2 Svr->Client S5/S8 GTPC IP", "cflow.pie.ntop.gtpv2_s2c_s5_s8_gtpc_ip",
18570           FT_IPv4, BASE_NONE, NULL, 0x0,
18571           NULL, HFILL}
18572         },
18573         /* ntop, 35632 / 456 */
18574         {&hf_pie_ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid,
18575          {"GTPv2 Client->Srv S5/S8 SGW GTPU TEID", "cflow.pie.ntop.gtpv2_c2s_s5_s8_sgw_gtpu_teid",
18576           FT_UINT32, BASE_DEC, NULL, 0x0,
18577           NULL, HFILL}
18578         },
18579         /* ntop, 35632 / 457 */
18580         {&hf_pie_ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid,
18581          {"GTPv2 Srv->Client S5/S8 SGW GTPU TEID", "cflow.pie.ntop.gtpv2_s2c_s5_s8_sgw_gtpu_teid",
18582           FT_UINT32, BASE_DEC, NULL, 0x0,
18583           NULL, HFILL}
18584         },
18585         /* ntop, 35632 / 458 */
18586         {&hf_pie_ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip,
18587          {"GTPv2 Client->Srv S5/S8 SGW GTPU IP", "cflow.pie.ntop.gtpv2_c2s_s5_s8_sgw_gtpu_ip",
18588           FT_IPv4, BASE_NONE, NULL, 0x0,
18589           NULL, HFILL}
18590         },
18591         /* ntop, 35632 / 459 */
18592         {&hf_pie_ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip,
18593          {"GTPv2 Srv->Client S5/S8 SGW GTPU IP", "cflow.pie.ntop.gtpv2_s2c_s5_s8_sgw_gtpu_ip",
18594           FT_IPv4, BASE_NONE, NULL, 0x0,
18595           NULL, HFILL}
18596         },
18597         /* ntop, 35632 / 460 */
18598         {&hf_pie_ntop_http_x_forwarded_for,
18599          {"HTTP X-Forwarded-For", "cflow.pie.ntop.http_x_forwarded_for",
18600           FT_STRING, BASE_NONE, NULL, 0x0,
18601           NULL, HFILL}
18602         },
18603         /* ntop, 35632 / 461 */
18604         {&hf_pie_ntop_http_via,
18605          {"HTTP Via", "cflow.pie.ntop.http_via",
18606           FT_STRING, BASE_NONE, NULL, 0x0,
18607           NULL, HFILL}
18608         },
18609         /* ntop, 35632 / 462 */
18610         {&hf_pie_ntop_ssdp_host,
18611          {"SSDP Host", "cflow.pie.ntop.ssdp_host",
18612           FT_STRING, BASE_NONE, NULL, 0x0,
18613           NULL, HFILL}
18614         },
18615         /* ntop, 35632 / 463 */
18616         {&hf_pie_ntop_ssdp_usn,
18617          {"SSDP USN", "cflow.pie.ntop.ssdp_usn",
18618           FT_STRING, BASE_NONE, NULL, 0x0,
18619           NULL, HFILL}
18620         },
18621         /* ntop, 35632 / 464 */
18622         {&hf_pie_ntop_netbios_query_name,
18623          {"NETBIOS Query Name", "cflow.pie.ntop.netbios_query_name",
18624           FT_STRING, BASE_NONE, NULL, 0x0,
18625           NULL, HFILL}
18626         },
18627         /* ntop, 35632 / 465 */
18628         {&hf_pie_ntop_netbios_query_type,
18629          {"NETBIOS Query Type", "cflow.pie.ntop.netbios_query_type",
18630           FT_STRING, BASE_NONE, NULL, 0x0,
18631           NULL, HFILL}
18632         },
18633         /* ntop, 35632 / 466 */
18634         {&hf_pie_ntop_netbios_response,
18635          {"NETBIOS Query Response", "cflow.pie.ntop.netbios_response",
18636           FT_STRING, BASE_NONE, NULL, 0x0,
18637           NULL, HFILL}
18638         },
18639         /* ntop, 35632 / 467 */
18640         {&hf_pie_ntop_netbios_query_os,
18641          {"NETBIOS Query OS", "cflow.pie.ntop.netbios_query_os",
18642           FT_STRING, BASE_NONE, NULL, 0x0,
18643           NULL, HFILL}
18644         },
18645         /* ntop, 35632 / 468 */
18646         {&hf_pie_ntop_ssdp_server,
18647          {"SSDP Server", "cflow.pie.ntop.ssdp_server",
18648           FT_STRING, BASE_NONE, NULL, 0x0,
18649           NULL, HFILL}
18650         },
18651         /* ntop, 35632 / 469 */
18652         {&hf_pie_ntop_ssdp_type,
18653          {"SSDP Type", "cflow.pie.ntop.ssdp_type",
18654           FT_STRING, BASE_NONE, NULL, 0x0,
18655           NULL, HFILL}
18656         },
18657         /* ntop, 35632 / 470 */
18658         {&hf_pie_ntop_ssdp_method,
18659          {"SSDP Method", "cflow.pie.ntop.ssdp_method",
18660           FT_STRING, BASE_NONE, NULL, 0x0,
18661           NULL, HFILL}
18662         },
18663         /* ntop, 35632 / 471 */
18664         {&hf_pie_ntop_nprobe_ipv4_address,
18665          {"IPv4 address of the host were nProbe runs", "cflow.pie.ntop.nprobe_ipv4_address",
18666           FT_IPv4, BASE_NONE, NULL, 0x0,
18667           NULL, HFILL}
18668         },
18669
18670         /* Plixer root (a hidden item to allow filtering) */
18671         {&hf_pie_plixer,
18672          {"Plixer", "cflow.pie.plixer",
18673           FT_NONE, BASE_NONE, NULL, 0x0,
18674           NULL, HFILL}
18675         },
18676         /* plixer, 13745 / 100 */
18677         {&hf_pie_plixer_client_ip_v4,
18678          {"client_ip_v4", "cflow.pie.plixer.client.ip_v4",
18679           FT_IPv4, BASE_NONE, NULL, 0x0,
18680           NULL, HFILL}
18681         },
18682         {&hf_pie_plixer_client_hostname,
18683          /* plixer, 13745 / 101 */
18684          {"client_hostname", "cflow.pie.plixer.client_hostname",
18685           FT_STRING, BASE_NONE, NULL, 0x0,
18686           NULL, HFILL}
18687         },
18688         /* plixer, 13745 / 102 */
18689         {&hf_pie_plixer_partner_name,
18690          {"Partner_name", "cflow.pie.plixer.partner_name",
18691           FT_STRING, BASE_NONE, NULL, 0x0,
18692           NULL, HFILL}
18693         },
18694         /* plixer, 13745 / 103 */
18695         {&hf_pie_plixer_server_hostname,
18696          {"Server_hostname", "cflow.pie.plixer.server_hostname",
18697           FT_STRING, BASE_NONE, NULL, 0x0,
18698           NULL, HFILL}
18699         },
18700         /* plixer, 13745 / 104 */
18701         {&hf_pie_plixer_server_ip_v4,
18702          {"Server_ip_v4", "cflow.pie.plixer.server_ip_v4",
18703           FT_IPv4, BASE_NONE, NULL, 0x0,
18704           NULL, HFILL}
18705         },
18706         /* plixer, 13745 / 105 */
18707         {&hf_pie_plixer_recipient_address,
18708          {"Recipient_address", "cflow.pie.plixer.recipient_address",
18709           FT_STRING, BASE_NONE, NULL, 0x0,
18710           NULL, HFILL}
18711         },
18712         /* plixer, 13745 / 106 */
18713         {&hf_pie_plixer_event_id,
18714          {"Event_id", "cflow.pie.plixer.event_id",
18715           FT_UINT32, BASE_DEC, NULL, 0x0,
18716           NULL, HFILL}
18717         },
18718         /* plixer, 13745 / 107 */
18719         {&hf_pie_plixer_msgid,
18720          {"Msgid", "cflow.pie.plixer.msgid",
18721           FT_STRING, BASE_NONE, NULL, 0x0,
18722           NULL, HFILL}
18723         },
18724         /* plixer, 13745 / 108 */
18725         {&hf_pie_plixer_priority,
18726          {"Priority", "cflow.pie.plixer_priority",
18727           FT_UINT32, BASE_DEC, NULL, 0x0,
18728           NULL, HFILL}
18729         },
18730         /* plixer, 13745 / 109 */
18731         {&hf_pie_plixer_recipient_report_status,
18732          {"Recipient_report_status", "cflow.pie.plixer.recipient_report_status",
18733           FT_UINT32, BASE_DEC, NULL, 0x0,
18734           NULL, HFILL}
18735         },
18736         /* plixer, 13745 / 110 */
18737         {&hf_pie_plixer_number_recipients,
18738          {"Number_recipients", "cflow.pie.plixer.number_recipients",
18739           FT_UINT32, BASE_DEC, NULL, 0x0,
18740           NULL, HFILL}
18741         },
18742         /* plixer, 13745 / 111 */
18743         {&hf_pie_plixer_origination_time,
18744          {"Origination_time", "cflow.pie.plixer.origination_time",
18745           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
18746           NULL, HFILL}
18747         },
18748         /* plixer, 13745 / 112 */
18749         {&hf_pie_plixer_encryption,
18750          {"Encryption", "cflow.pie.plixer.encryption",
18751           FT_UINT32, BASE_DEC, NULL, 0x0,
18752           NULL, HFILL}
18753         },
18754         /* plixer, 13745 / 113 */
18755         {&hf_pie_plixer_service_version,
18756          {"Service_version", "cflow.pie.plixer.service_version",
18757           FT_STRING, BASE_NONE, NULL, 0x0,
18758           NULL, HFILL}
18759         },
18760         /* plixer, 13745 / 114 */
18761         {&hf_pie_plixer_linked_msgid,
18762          {"Linked_msgid", "cflow.pie.plixer.linked_msgid",
18763           FT_STRING, BASE_NONE, NULL, 0x0,
18764           NULL, HFILL}
18765         },
18766         /* plixer, 13745 / 115 */
18767         {&hf_pie_plixer_message_subject,
18768          {"Message_subject", "cflow.pie.plixer.message_subject",
18769           FT_STRING, BASE_NONE, NULL, 0x0,
18770           NULL, HFILL}
18771         },
18772         /* plixer, 13745 / 116 */
18773         {&hf_pie_plixer_sender_address,
18774          {"Sender_address", "cflow.pie.plixer.sender_address",
18775           FT_STRING, BASE_NONE, NULL, 0x0,
18776           NULL, HFILL}
18777         },
18778         /* plixer, 13745 / 117 */
18779         {&hf_pie_plixer_date_time,
18780          {"Date_time", "cflow.pie.plixer.date_time",
18781           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
18782           NULL, HFILL}
18783         },
18784
18785         /* Ixia root (a hidden item to allow filtering) */
18786         {&hf_pie_ixia,
18787          {"Ixia", "cflow.pie.ixia",
18788           FT_NONE, BASE_NONE, NULL, 0x0,
18789           NULL, HFILL}
18790         },
18791         /* ixia, 3054 / 110 */
18792         {&hf_pie_ixia_l7_application_id,
18793          {"L7 Application ID", "cflow.pie.ixia.l7-application-id",
18794           FT_UINT32, BASE_DEC, NULL, 0x0,
18795           "Application Identification number. Dynamically detected, so unique to each exporter", HFILL}
18796         },
18797         /* ixia, 3054 / 111 */
18798         {&hf_pie_ixia_l7_application_name,
18799          {"L7 Application Name", "cflow.pie.ixia.l7-application-name",
18800           FT_STRING, BASE_NONE, NULL, 0x0,
18801           NULL, HFILL}
18802         },
18803
18804         /* ixia, 3054 / 120 */
18805         {&hf_pie_ixia_source_ip_country_code,
18806          {"Source IP Country Code", "cflow.pie.ixia.source-ip-country-code",
18807           FT_STRING, BASE_NONE, NULL, 0x0,
18808           "2 letter country code for the source IP address", HFILL}
18809         },
18810         /* ixia, 3054 / 121 */
18811         {&hf_pie_ixia_source_ip_country_name,
18812          {"Source IP Country Name", "cflow.pie.ixia.source-ip-country-name",
18813           FT_STRING, BASE_NONE, NULL, 0x0,
18814           "Country name for the source IP address", HFILL}
18815         },
18816         /* ixia, 3054 / 122 */
18817         {&hf_pie_ixia_source_ip_region_code,
18818          {"Source IP Region Code", "cflow.pie.ixia.source-ip-region-code",
18819           FT_STRING, BASE_NONE, NULL, 0x0,
18820           "2 letter region code for the source IP address", HFILL}
18821         },
18822         /* ixia, 3054 / 123 */
18823         {&hf_pie_ixia_source_ip_region_name,
18824          {"Source IP Region Name", "cflow.pie.ixia.source-ip-region-name",
18825           FT_STRING, BASE_NONE, NULL, 0x0,
18826           "Region name for the source IP address", HFILL}
18827         },
18828         /* ixia, 3054 / 125 */
18829         {&hf_pie_ixia_source_ip_city_name,
18830          {"Source IP City Name", "cflow.pie.ixia.source-ip-city-name",
18831           FT_STRING, BASE_NONE, NULL, 0x0,
18832           "City name for the source IP address", HFILL}
18833         },
18834         /* ixia, 3054 / 126 */
18835         {&hf_pie_ixia_source_ip_latitude,
18836          {"Source IP Latitude", "cflow.pie.ixia.source-ip-latitude",
18837           FT_FLOAT, BASE_NONE, NULL, 0x0,
18838           "Latitude for the source IP address", HFILL}
18839         },
18840         /* ixia, 3054 / 127 */
18841         {&hf_pie_ixia_source_ip_longitude,
18842          {"Source IP Longitude", "cflow.pie.ixia.source-ip-longitude",
18843           FT_FLOAT, BASE_NONE, NULL, 0x0,
18844           "Longitude for the source IP address", HFILL}
18845         },
18846
18847         /* ixia, 3054 / 140 */
18848         {&hf_pie_ixia_destination_ip_country_code,
18849          {"Destination IP Country Code", "cflow.pie.ixia.destination-ip-country-code",
18850           FT_STRING, BASE_NONE, NULL, 0x0,
18851           "2 letter region code for the destination IP address", HFILL}
18852         },
18853         /* ixia, 3054 / 141 */
18854         {&hf_pie_ixia_destination_ip_country_name,
18855          {"Destination IP Country Name", "cflow.pie.ixia.destination-ip-country-name",
18856           FT_STRING, BASE_NONE, NULL, 0x0,
18857           "Country name for the destination IP address", HFILL}
18858         },
18859         /* ixia, 3054 / 142 */
18860         {&hf_pie_ixia_destination_ip_region_code,
18861          {"Destination IP Region Code", "cflow.pie.ixia.destination-ip-region-code",
18862           FT_STRING, BASE_NONE, NULL, 0x0,
18863           "2 letter region code for the destination IP address", HFILL}
18864         },
18865         /* ixia, 3054 / 143 */
18866         {&hf_pie_ixia_destination_ip_region_name,
18867          {"Destination IP Region Name", "cflow.pie.ixia.destination-ip-region-name",
18868           FT_STRING, BASE_NONE, NULL, 0x0,
18869           "Region name for the destination IP address", HFILL}
18870         },
18871         /* ixia, 3054 / 145 */
18872         {&hf_pie_ixia_destination_ip_city_name,
18873          {"Destination IP City Name", "cflow.pie.ixia.destination-ip-city-name",
18874           FT_STRING, BASE_NONE, NULL, 0x0,
18875           "City name for the destination IP address", HFILL}
18876         },
18877         /* ixia, 3054 / 146 */
18878         {&hf_pie_ixia_destination_ip_latitude,
18879          {"Destination IP Latitude", "cflow.pie.ixia.destination-ip-latitude",
18880           FT_FLOAT, BASE_NONE, NULL, 0x0,
18881           "Latitude for the destination IP address", HFILL}
18882         },
18883         /* ixia, 3054 / 147 */
18884         {&hf_pie_ixia_destination_ip_longitude,
18885          {"Destination IP Longitude", "cflow.pie.ixia.destination-ip-longitude",
18886           FT_FLOAT, BASE_NONE, NULL, 0x0,
18887           "Longitude for the destination IP address", HFILL}
18888         },
18889
18890         /* ixia, 3054 / 160 */
18891         {&hf_pie_ixia_os_device_id,
18892          {"OS Device ID", "cflow.pie.ixia.os-device-id",
18893           FT_UINT8, BASE_DEC, NULL, 0x0,
18894           "Unique ID for each OS", HFILL}
18895         },
18896         /* ixia, 3054 / 161 */
18897         {&hf_pie_ixia_os_device_name,
18898          {"OS Device Name", "cflow.pie.ixia.os-device-name",
18899           FT_STRING, BASE_NONE, NULL, 0x0,
18900           "String containing OS name", HFILL}
18901         },
18902         /* ixia, 3054 / 162 */
18903         {&hf_pie_ixia_browser_id,
18904          {"Browser ID", "cflow.pie.ixia.browser-id",
18905           FT_UINT8, BASE_DEC, NULL, 0x0,
18906           "Unique ID for each browser type", HFILL}
18907         },
18908         /* ixia, 3054 / 163 */
18909         {&hf_pie_ixia_browser_name,
18910          {"Browser Name", "cflow.pie.ixia.browser-name",
18911           FT_STRING, BASE_NONE, NULL, 0x0,
18912           "Unique Name for each browser type", HFILL}
18913         },
18914
18915         /* ixia, 3054 / 176 */
18916         {&hf_pie_ixia_reverse_octet_delta_count,
18917          {"Reverse octet delta count", "cflow.pie.ixia.reverse-octet-delta-count",
18918           FT_UINT64, BASE_DEC, NULL, 0x0,
18919           "In bi-directional flows, byte count for the server back to client", HFILL}
18920         },
18921         /* ixia, 3054 / 177 */
18922         {&hf_pie_ixia_reverse_packet_delta_count,
18923          {"Reverse octet packet count", "cflow.pie.ixia.reverse-packet-delta-count",
18924           FT_UINT64, BASE_DEC, NULL, 0x0,
18925           "In bi-directional flows, packet count for the server back to client", HFILL}
18926         },
18927
18928         /* ixia, 3054 / 178 */
18929         {&hf_pie_ixia_conn_encryption_type,
18930          {"Connection Encryption Type", "cflow.pie.ixia.conn-encryption-type",
18931           FT_STRING, BASE_NONE, NULL, 0x0,
18932           "Whether the connection is encrypted", HFILL}
18933         },
18934
18935         /* ixia, 3054 / 179 */
18936         {&hf_pie_ixia_encryption_cipher,
18937          {"Encryption Cipher", "cflow.pie.ixia.encryption-cipher",
18938           FT_STRING, BASE_NONE, NULL, 0x0,
18939           "Cipher used in the encryption", HFILL}
18940         },
18941
18942         /* ixia, 3054 / 180 */
18943         {&hf_pie_ixia_encryption_keylen,
18944          {"Encryption Key Length", "cflow.pie.ixia.encryption-keylen",
18945           FT_UINT16, BASE_DEC|BASE_UNIT_STRING, UNS(&units_byte_bytes), 0x0,
18946           "Length of the encryption key in bytes", HFILL}
18947         },
18948
18949         /* ixia, 3054 / 181 */
18950         {&hf_pie_ixia_imsi,
18951          {"IMSI", "cflow.pie.ixia.imsi",
18952           FT_STRING, BASE_NONE, NULL, 0x0,
18953           "IMSI associated with a GTP tunneled flow", HFILL}
18954         },
18955
18956         /* ixia, 3054 / 182 */
18957         {&hf_pie_ixia_user_agent,
18958          {"HTTP User Agent", "cflow.pie.ixia.http-user-agent",
18959           FT_STRING, BASE_NONE, NULL, 0x0,
18960           "User-Agent string in HTTP requests", HFILL}
18961         },
18962
18963         /* ixia, 3054 / 183 */
18964         {&hf_pie_ixia_host_name,
18965          {"Host Name", "cflow.pie.ixia.hostname",
18966           FT_STRING, BASE_NONE, NULL, 0x0,
18967           "HTTP Hostname", HFILL}
18968         },
18969
18970         /* ixia, 3054 / 184 */
18971         {&hf_pie_ixia_uri,
18972          {"HTTP URI", "cflow.pie.ixia.http-uri",
18973           FT_STRING, BASE_NONE, NULL, 0x0,
18974           "URI in HTTP requests", HFILL}
18975         },
18976
18977         /* ixia, 3054 / 185 */
18978         {&hf_pie_ixia_dns_txt,
18979          {"DNS TXT", "cflow.pie.ixia.dns-txt",
18980           FT_STRING, BASE_NONE, NULL, 0x0,
18981           "TXT record in DNS query", HFILL}
18982         },
18983
18984         /* ixia, 3054 / 186 */
18985         {&hf_pie_ixia_source_as_name,
18986          {"Source AS Name", "cflow.pie.ixia.src-as-name",
18987           FT_STRING, BASE_NONE, NULL, 0x0,
18988           NULL, HFILL}
18989         },
18990
18991         /* ixia, 3054 / 187 */
18992         {&hf_pie_ixia_dest_as_name,
18993          {"Destination AS Name", "cflow.pie.ixia.dest-as-name",
18994           FT_STRING, BASE_NONE, NULL, 0x0,
18995           NULL, HFILL}
18996         },
18997
18998         /* ixia, 3054 / 188 */
18999         {&hf_pie_ixia_transaction_latency,
19000          {"Transaction Latency (us)", "cflow.pie.ixia.transact-latency-us",
19001           FT_UINT32, BASE_DEC, NULL, 0x0,
19002           NULL, HFILL}
19003         },
19004
19005         /* ixia, 3054 / 189 */
19006         {&hf_pie_ixia_dns_query_names,
19007          {"DNS Query Names", "cflow.pie.ixia.dns-query-names",
19008           FT_STRING, BASE_NONE, NULL, 0x0,
19009           "Names in the Query section of a DNS message (comma separated list)", HFILL}
19010         },
19011
19012         /* ixia, 3054 / 190 */
19013         {&hf_pie_ixia_dns_answer_names,
19014          {"DNS Answer Names", "cflow.pie.ixia.dns-answer-names",
19015           FT_STRING, BASE_NONE, NULL, 0x0,
19016           "Names in the Answer section of a DNS message (comma separated list)", HFILL}
19017         },
19018
19019         /* ixia, 3054 / 191 */
19020         {&hf_pie_ixia_dns_classes,
19021          {"DNS Classes", "cflow.pie.ixia.dns-classes",
19022           FT_STRING, BASE_NONE, NULL, 0x0,
19023           "Class types appearing in a DNS message (comma separated list)", HFILL}
19024         },
19025
19026         /* ixia, 3054 / 192 */
19027         {&hf_pie_ixia_threat_type,
19028          {"Threat Type", "cflow.pie.ixia.threat-type",
19029           FT_STRING, BASE_NONE, NULL, 0x0,
19030           "Potential threat type associated with the source/destination IP", HFILL}
19031         },
19032
19033         /* ixia, 3054 / 193 */
19034         {&hf_pie_ixia_threat_ipv4,
19035          {"Threat IPv4", "cflow.pie.ixia.threat-ipv4",
19036           FT_IPv4, BASE_NONE, NULL, 0x0,
19037           "The source/destination IP associated with any threat", HFILL}
19038         },
19039
19040         /* ixia, 3054 / 194 */
19041         {&hf_pie_ixia_threat_ipv6,
19042          {"Threat IPv6", "cflow.pie.ixia.threat-ipv6",
19043           FT_IPv6, BASE_NONE, NULL, 0x0,
19044           "The source/destination IP associated with any threat", HFILL}
19045         },
19046
19047         /* ixia, 3054 / 195 */
19048         {&hf_pie_ixia_http_session,
19049          {"HTTP Sessions", "cflow.pie.ixia.http-session",
19050           FT_NONE, BASE_NONE, NULL, 0x0,
19051           "List of HTTP Sessions", HFILL}
19052         },
19053
19054         /* ixia, 3054 / 196 */
19055         {&hf_pie_ixia_request_time,
19056          {"Request Time (s)", "cflow.pie.ixia.request-time",
19057           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
19058           "HTTP Request time (in seconds)", HFILL}
19059         },
19060
19061         /* ixia, 3054 / 197 */
19062         {&hf_pie_ixia_dns_records,
19063          {"DNS Records", "cflow.pie.ixia.dns-records",
19064           FT_NONE, BASE_NONE, NULL, 0x0,
19065           "List of DNS Records", HFILL}
19066         },
19067
19068         /* ixia, 3054 / 198 */
19069         {&hf_pie_ixia_dns_name,
19070          {"DNS Name", "cflow.pie.ixia.dns-name",
19071           FT_STRING, BASE_NONE, NULL, 0x0,
19072           "Name in DNS Records", HFILL}
19073         },
19074
19075         /* ixia, 3054 / 199 */
19076         {&hf_pie_ixia_dns_ipv4,
19077          {"DNS Rdata IPv4", "cflow.pie.ixia.dns-ipv4",
19078           FT_IPv4, BASE_NONE, NULL, 0x0,
19079           "IPv4 from DNS A Record rdata", HFILL}
19080         },
19081
19082         /* ixia, 3054 / 200 */
19083         {&hf_pie_ixia_dns_ipv6,
19084          {"DNS Rdata IPv6", "cflow.pie.ixia.dns-ipv6",
19085           FT_IPv6, BASE_NONE, NULL, 0x0,
19086           "IPv6 from DNS AAAA Record rdata", HFILL}
19087         },
19088
19089         /* ixia, 3054 / 201 */
19090         {&hf_pie_ixia_tls_sni,
19091          {"TLS SNI", "cflow.pie.ixia.tls-sni",
19092           FT_STRING, BASE_NONE, NULL, 0x0,
19093           "TLS Extension Server Name Indication", HFILL}
19094         },
19095
19096         /* ixia, 3054 / 202 */
19097         {&hf_pie_ixia_dhcp_client_id,
19098          {"DHCP Client Id", "cflow.pie.ixia.dhcp-client-id",
19099           FT_BYTES, BASE_NONE, NULL, 0x0,
19100           "DHCP Client Id (Option 61)", HFILL}
19101         },
19102
19103         /* ixia, 3054 / 203 */
19104         {&hf_pie_ixia_dhcp_client_mac,
19105          {"DHCP Client MAC", "cflow.pie.ixia.dhcp-client-mac",
19106           FT_ETHER, BASE_NONE, NULL, 0x0,
19107           "DHCP header client MAC address", HFILL}
19108         },
19109
19110         /* ixia, 3054 / 204 */
19111         {&hf_pie_ixia_dhcp_messages,
19112          {"DHCP Messages", "cflow.pie.ixia.dhcp-messages",
19113           FT_NONE, BASE_NONE, NULL, 0x0,
19114           "List of DHCP messages", HFILL}
19115         },
19116
19117         /* ixia, 3054 / 205 */
19118         {&hf_pie_ixia_dhcp_message_timestamp,
19119          {"DHCP Message Timestamp", "cflow.pie.ixia.dhcp-msg-timestamp",
19120           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
19121           "DHCP message receive timestamp", HFILL}
19122         },
19123
19124         /* ixia, 3054 / 206 */
19125         {&hf_pie_ixia_dhcp_message_type,
19126          {"DHCP Message Type", "cflow.pie.ixia.dhcp-msg-type",
19127           FT_UINT8, BASE_DEC, NULL, 0x0,
19128           "DHCP Message Type (Option 53)", HFILL}
19129         },
19130
19131         /* ixia, 3054 / 207 */
19132         {&hf_pie_ixia_dhcp_lease_duration,
19133          {"DHCP Lease Duration", "cflow.pie.ixia.dhcp-lease-duration",
19134           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
19135           "DHCP Lease Duration (Option 51)", HFILL}
19136         },
19137
19138         /* ixia, 3054 / 208 */
19139         {&hf_pie_ixia_dhcp_servername,
19140          {"DHCP Servername", "cflow.pie.ixia.dhcp-servername",
19141           FT_STRING, BASE_NONE, NULL, 0x0,
19142           "DHCP header Servername", HFILL}
19143         },
19144
19145         /* ixia, 3054 / 209 */
19146         {&hf_pie_ixia_radius_events,
19147          {"RADIUS Messages", "cflow.pie.ixia.radius-events",
19148           FT_NONE, BASE_NONE, NULL, 0x0,
19149           "List of RADIUS Events", HFILL}
19150         },
19151
19152         /* ixia, 3054 / 210 */
19153         {&hf_pie_ixia_radius_timestamp,
19154          {"RADIUS Message Rx Timestamp", "cflow.pie.ixia.radius-timestamp",
19155           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
19156           "RADIUS message receive timestamp", HFILL}
19157         },
19158
19159         /* ixia, 3054 / 211 */
19160         {&hf_pie_ixia_radius_event_timestamp,
19161          {"RADIUS Event Timestamp", "cflow.pie.ixia.radius-event-timestamp",
19162           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
19163           "RADIUS event timestamp (Attr 55)", HFILL}
19164         },
19165
19166         /* ixia, 3054 / 212 */
19167         {&hf_pie_ixia_radius_username,
19168          {"RADIUS Username", "cflow.pie.ixia.radius-username",
19169           FT_STRING, BASE_NONE, NULL, 0x0,
19170           "RADIUS Username (Attr 1)", HFILL}
19171         },
19172
19173         /* ixia, 3054 / 213 */
19174         {&hf_pie_ixia_radius_nas_ipv4,
19175          {"RADIUS NAS IPv4", "cflow.pie.ixia.radius-nas-ipv4",
19176           FT_IPv4, BASE_NONE, NULL, 0x0,
19177           "RADIUS NAS IP (Attr 4)", HFILL}
19178         },
19179
19180         /* ixia, 3054 / 214 */
19181         {&hf_pie_ixia_radius_service_type,
19182          {"RADIUS Service Type", "cflow.pie.ixia.radius-service-type",
19183           FT_UINT32, BASE_DEC, NULL, 0x0,
19184           "RADIUS Service Type (Attr 6)", HFILL}
19185         },
19186
19187         /* ixia, 3054 / 215 */
19188         {&hf_pie_ixia_radius_framed_protocol,
19189          {"RADIUS Framed Protocol", "cflow.pie.ixia.radius-framed-protocol",
19190           FT_UINT32, BASE_DEC, NULL, 0x0,
19191           "RADIUS Framed Protocol (Attr 7)", HFILL}
19192         },
19193
19194         /* ixia, 3054 / 216 */
19195         {&hf_pie_ixia_radius_filter_id,
19196          {"RADIUS Filter ID", "cflow.pie.ixia.radius-filter-id",
19197           FT_STRING, BASE_NONE, NULL, 0x0,
19198           "RADIUS Filter ID (Attr 11)", HFILL}
19199         },
19200
19201         /* ixia, 3054 / 217 */
19202         {&hf_pie_ixia_radius_reply_message,
19203          {"RADIUS Reply Message", "cflow.pie.ixia.radius-reply-msg",
19204           FT_STRING, BASE_NONE, NULL, 0x0,
19205           "RADIUS Reply Message (Attr 18)", HFILL}
19206         },
19207
19208         /* ixia, 3054 / 218 */
19209         {&hf_pie_ixia_radius_called_station_id,
19210          {"RADIUS Called Station ID", "cflow.pie.ixia.radius-called-station",
19211           FT_STRING, BASE_NONE, NULL, 0x0,
19212           "RADIUS Called Station ID (Attr 30)", HFILL}
19213         },
19214
19215         /* ixia, 3054 / 219 */
19216         {&hf_pie_ixia_http_connection,
19217          {"HTTP Connection", "cflow.pie.ixia.http-connection",
19218           FT_STRING, BASE_NONE, NULL, 0x0,
19219           "HTTP Connection header value", HFILL}
19220         },
19221
19222         /* ixia, 3054 / 220 */
19223         {&hf_pie_ixia_http_accept,
19224          {"HTTP Accept", "cflow.pie.ixia.http-accept",
19225           FT_STRING, BASE_NONE, NULL, 0x0,
19226           "HTTP Accept header value", HFILL}
19227         },
19228
19229         /* ixia, 3054 / 221 */
19230         {&hf_pie_ixia_http_accept_language,
19231          {"HTTP Accept-Language", "cflow.pie.ixia.http-accept-language",
19232           FT_STRING, BASE_NONE, NULL, 0x0,
19233           "HTTP Accept-Language header value", HFILL}
19234         },
19235
19236         /* ixia, 3054 / 222 */
19237         {&hf_pie_ixia_http_accept_encoding,
19238          {"HTTP Accept-Encoding", "cflow.pie.ixia.http-accept-encoding",
19239           FT_STRING, BASE_NONE, NULL, 0x0,
19240           "HTTP Accept-Encoding header value", HFILL}
19241         },
19242
19243         /* ixia, 3054 / 223 */
19244         {&hf_pie_ixia_http_reason,
19245          {"HTTP Reason", "cflow.pie.ixia.http-reason",
19246           FT_STRING, BASE_NONE, NULL, 0x0,
19247           "HTTP Status Reason", HFILL}
19248         },
19249
19250             /* ixia, 3054 / 224 */
19251         {&hf_pie_ixia_http_server,
19252          {"HTTP Server", "cflow.pie.ixia.http-server",
19253           FT_STRING, BASE_NONE, NULL, 0x0,
19254           "HTTP Server header value", HFILL}
19255         },
19256
19257         /* ixia, 3054 / 218 */
19258         {&hf_pie_ixia_radius_calling_station_id,
19259          {"RADIUS Calling Station ID", "cflow.pie.ixia.radius-calling-station",
19260           FT_STRING, BASE_NONE, NULL, 0x0,
19261           "RADIUS Calling Station ID (Attr 31)", HFILL}
19262         },
19263
19264         /* ixia, 3054 / 226 */
19265         {&hf_pie_ixia_http_content_length,
19266          {"HTTP Content Length", "cflow.pie.ixia.http-content-length",
19267           FT_UINT32, BASE_DEC, NULL, 0x0,
19268           "HTTP Content Length header value", HFILL}
19269         },
19270
19271         /* ixia, 3054 / 227 */
19272         {&hf_pie_ixia_http_referer,
19273          {"HTTP Referer", "cflow.pie.ixia.http-referer",
19274           FT_STRING, BASE_NONE, NULL, 0x0,
19275           "HTTP Referer header value", HFILL}
19276         },
19277
19278         /* ixia, 3054 / 228 */
19279         {&hf_pie_ixia_http_useragent_cpu,
19280          {"HTTP UA-CPU", "cflow.pie.ixia.http-ua-cpu",
19281           FT_STRING, BASE_NONE, NULL, 0x0,
19282           "HTTP UA-CPU header value", HFILL}
19283         },
19284
19285         /* ixia, 3054 / 229 */
19286         {&hf_pie_ixia_email_messages,
19287          {"Email Messages", "cflow.pie.ixia.email-messages",
19288           FT_NONE, BASE_NONE, NULL, 0x0,
19289           "List of Email messages", HFILL}
19290         },
19291
19292         /* ixia, 3054 / 230 */
19293         {&hf_pie_ixia_email_msg_id,
19294          {"Email Msg ID", "cflow.pie.ixia.email-msg-id",
19295           FT_STRING, BASE_NONE, NULL, 0x0,
19296           "Email Message ID", HFILL}
19297         },
19298
19299         /* ixia, 3054 / 231 */
19300         {&hf_pie_ixia_email_msg_date,
19301          {"Email Msg Date", "cflow.pie.ixia.email-msg-date",
19302           FT_STRING, BASE_NONE, NULL, 0x0,
19303           "Email Message Date", HFILL}
19304         },
19305
19306         /* ixia, 3054 / 232 */
19307         {&hf_pie_ixia_email_msg_subject,
19308          {"Email Msg Subject", "cflow.pie.ixia.email-msg-subject",
19309           FT_STRING, BASE_NONE, NULL, 0x0,
19310           "Email Message Subject", HFILL}
19311         },
19312
19313         /* ixia, 3054 / 233 */
19314         {&hf_pie_ixia_email_msg_to,
19315          {"Email Msg To", "cflow.pie.ixia.email-msg-to",
19316           FT_STRING, BASE_NONE, NULL, 0x0,
19317           "Email Message To", HFILL}
19318         },
19319
19320         /* ixia, 3054 / 234 */
19321         {&hf_pie_ixia_email_msg_from,
19322          {"Email Msg From", "cflow.pie.ixia.email-msg-from",
19323           FT_STRING, BASE_NONE, NULL, 0x0,
19324           "Email Message From", HFILL}
19325         },
19326
19327         /* ixia, 3054 / 235 */
19328         {&hf_pie_ixia_email_msg_cc,
19329          {"Email Msg CC", "cflow.pie.ixia.email-msg-cc",
19330           FT_STRING, BASE_NONE, NULL, 0x0,
19331           "Email Message CC", HFILL}
19332         },
19333
19334         /* ixia, 3054 / 236 */
19335         {&hf_pie_ixia_email_msg_bcc,
19336          {"Email Msg BCC", "cflow.pie.ixia.email-msg-bcc",
19337           FT_STRING, BASE_NONE, NULL, 0x0,
19338           "Email Message BCC", HFILL}
19339         },
19340
19341         /* ixia, 3054 / 237 */
19342         {&hf_pie_ixia_email_msg_attachments,
19343          {"Email Msg Attachments", "cflow.pie.ixia.email-msg-attachments",
19344           FT_STRING, BASE_NONE, NULL, 0x0,
19345           "Email Message attachments", HFILL}
19346         },
19347
19348         /* ixia, 3054 / 238 */
19349         {&hf_pie_ixia_tls_srvr_cert,
19350          {"TLS Server Cert", "cflow.pie.ixia.tls-server-cert",
19351           FT_NONE, BASE_NONE, NULL, 0x0,
19352           "TLS Server Certificates", HFILL}
19353         },
19354
19355         /* ixia, 3054 / 239 */
19356         {&hf_pie_ixia_tls_srvr_cert_issuer,
19357          {"TLS Server Cert Issuer", "cflow.pie.ixia.tls-server-cert-issuer",
19358           FT_NONE, BASE_NONE, NULL, 0x0,
19359           "TLS Server Certificates Issuer", HFILL}
19360         },
19361
19362         /* ixia, 3054 / 240 */
19363         {&hf_pie_ixia_tls_srvr_cert_issuer_attr,
19364          {"TLS Server Cert Issuer Attr", "cflow.pie.ixia.tls-server-cert-issuer.attr",
19365           FT_STRING, BASE_NONE, NULL, 0x0,
19366           "TLS Server Certificates Issuer Attribute", HFILL}
19367         },
19368
19369         /* ixia, 3054 / 241 */
19370         {&hf_pie_ixia_tls_srvr_cert_issuer_val,
19371          {"TLS Server Cert Issuer Value", "cflow.pie.ixia.tls-server-cert-issuer.val",
19372           FT_STRING, BASE_NONE, NULL, 0x0,
19373           "TLS Server Certificates Issuer Value", HFILL}
19374         },
19375
19376         /* ixia, 3054 / 242 */
19377         {&hf_pie_ixia_tls_srvr_cert_subject,
19378          {"TLS Server Cert Subject", "cflow.pie.ixia.tls-server-cert-subject",
19379           FT_NONE, BASE_NONE, NULL, 0x0,
19380           "TLS Server Certificates Subject", HFILL}
19381         },
19382
19383         /* ixia, 3054 / 243 */
19384         {&hf_pie_ixia_tls_srvr_cert_subject_attr,
19385          {"TLS Server Cert Subject Attr", "cflow.pie.ixia.tls-server-cert-subject.attr",
19386           FT_STRING, BASE_NONE, NULL, 0x0,
19387           "TLS Server Certificates Subject Attribute", HFILL}
19388         },
19389
19390         /* ixia, 3054 / 244 */
19391         {&hf_pie_ixia_tls_srvr_cert_subject_val,
19392          {"TLS Server Cert Subject Value", "cflow.pie.ixia.tls-server-cert-subject.val",
19393           FT_STRING, BASE_NONE, NULL, 0x0,
19394           "TLS Server Certificates Subject Value", HFILL}
19395         },
19396
19397         /* ixia, 3054 / 245 */
19398         {&hf_pie_ixia_tls_srvr_cert_vld_nt_bfr,
19399          {"TLS Server Cert Valid Not Before", "cflow.pie.ixia.tls-server-cert-vld-notbefore",
19400           FT_STRING, BASE_NONE, NULL, 0x0,
19401           "TLS Server Certificates Valid Not Before", HFILL}
19402         },
19403
19404         /* ixia, 3054 / 246 */
19405         {&hf_pie_ixia_tls_srvr_cert_vld_nt_aftr,
19406          {"TLS Server Cert Valid Not After", "cflow.pie.ixia.tls-server-cert-vld-notafter",
19407           FT_STRING, BASE_NONE, NULL, 0x0,
19408           "TLS Server Certificates Valid Not After", HFILL}
19409         },
19410
19411         /* ixia, 3054 / 247 */
19412         {&hf_pie_ixia_tls_srvr_cert_srl_num,
19413          {"TLS Server Cert Serial Number", "cflow.pie.ixia.tls-server-cert-srlnum",
19414           FT_STRING, BASE_NONE, NULL, 0x0,
19415           "TLS Server Certificates Serial Number", HFILL}
19416         },
19417
19418         /* ixia, 3054 / 248 */
19419         {&hf_pie_ixia_tls_srvr_cert_sign_algo,
19420          {"TLS Server Cert Sign Algo", "cflow.pie.ixia.tls-server-cert-sign-algo",
19421           FT_STRING, BASE_NONE, NULL, 0x0,
19422           "TLS Server Certificates Signature Algorithm", HFILL}
19423         },
19424
19425         /* ixia, 3054 / 249 */
19426         {&hf_pie_ixia_tls_srvr_cert_subj_pki_algo,
19427          {"TLS Server Cert Subject PKI Algo", "cflow.pie.ixia.tls-server-cert-sub-pki-algo",
19428           FT_STRING, BASE_NONE, NULL, 0x0,
19429           "TLS Server Certificates Subject PKI Algorithm", HFILL}
19430         },
19431
19432         /* ixia, 3054 / 250 */
19433         {&hf_pie_ixia_tls_srvr_cert_altnames,
19434          {"TLS Server Cert AltNames", "cflow.pie.ixia.tls-server-cert-altnames",
19435           FT_NONE, BASE_NONE, NULL, 0x0,
19436           "TLS Server Certificates AltNames", HFILL}
19437         },
19438
19439         /* ixia, 3054 / 251 */
19440         {&hf_pie_ixia_tls_srvr_cert_altnames_attr,
19441          {"TLS Server Cert AltNames Attr", "cflow.pie.ixia.tls-server-cert-altnames.attr",
19442           FT_STRING, BASE_NONE, NULL, 0x0,
19443           "TLS Server Certificates AltNames Attribute", HFILL}
19444         },
19445
19446         /* ixia, 3054 / 252 */
19447         {&hf_pie_ixia_tls_srvr_cert_altnames_val,
19448          {"TLS Server Cert AltNames Value", "cflow.pie.ixia.tls-server-cert-altnames.val",
19449           FT_STRING, BASE_NONE, NULL, 0x0,
19450           "TLS Server Certificates AltNames Value", HFILL}
19451         },
19452
19453         /* ixia, 3054 / 253 */
19454         {&hf_pie_ixia_dns_packets,
19455          {"DNS Messages", "cflow.pie.ixia.dns-messages",
19456           FT_NONE, BASE_NONE, NULL, 0x0,
19457           "List of DNS Messages", HFILL}
19458         },
19459
19460         /* ixia, 3054 / 254 */
19461         {&hf_pie_ixia_dns_transaction_id,
19462          {"DNS Transaction Id", "cflow.pie.ixia.dns-transaction-id",
19463           FT_UINT16, BASE_HEX, NULL, 0x0,
19464           "DNS Transaction Identifier", HFILL}
19465         },
19466
19467         /* ixia, 3054 / 255 */
19468         {&hf_pie_ixia_dns_opcode,
19469          {"DNS Msg Opcode", "cflow.pie.ixia.dns-msg-opcode",
19470           FT_UINT8, BASE_DEC, NULL, 0x0,
19471           "DNS Message Operation Code", HFILL}
19472         },
19473
19474         /* ixia, 3054 / 256 */
19475         {&hf_pie_ixia_dns_request_type,
19476          {"DNS Query Type", "cflow.pie.ixia.dns-query-type",
19477           FT_UINT16, BASE_DEC, NULL, 0x0,
19478           "DNS Query Request Type", HFILL}
19479         },
19480
19481         /* ixia, 3054 / 257 */
19482         {&hf_pie_ixia_dns_response_code,
19483          {"DNS Msg Rcode", "cflow.pie.ixia.dns-msg-rcode",
19484           FT_UINT8, BASE_DEC, NULL, 0x0,
19485           "DNS Message Rcode", HFILL}
19486         },
19487
19488         /* ixia, 3054 / 258 */
19489         {&hf_pie_ixia_dns_record_ttl,
19490          {"DNS Rec TTL", "cflow.pie.ixia.dns-rec-ttl",
19491           FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
19492           "DNS Record Time to Live (seconds)", HFILL}
19493         },
19494
19495         /* ixia, 3054 / 259 */
19496         {&hf_pie_ixia_dns_raw_rdata,
19497          {"DNS Rec Raw rdata", "cflow.pie.ixia.dns-rec-raw-rdata",
19498           FT_STRING, BASE_NONE, NULL, 0x0,
19499           "DNS Record Raw Rdata", HFILL}
19500         },
19501
19502         /* ixia, 3054 / 260 */
19503         {&hf_pie_ixia_dns_response_type,
19504          {"DNS Record Type", "cflow.pie.ixia.dns-rec-type",
19505           FT_UINT16, BASE_DEC, NULL, 0x0,
19506           "DNS Response Record Type", HFILL}
19507         },
19508
19509         /* ixia, 3054 / 261 */
19510         {&hf_pie_ixia_radius_framed_ip,
19511          {"RADIUS Framed IP", "cflow.pie.ixia.radius-framedip",
19512           FT_STRING, BASE_NONE, NULL, 0x0,
19513           "RADIUS Framed IP (Attr 8/168)", HFILL}
19514         },
19515
19516         /* ixia, 3054 / 262 */
19517         {&hf_pie_ixia_dns_qdcount,
19518          {"DNS HDR Question Count", "cflow.pie.ixia.dns-hdr-qdcount",
19519           FT_UINT16, BASE_DEC, NULL, 0x0,
19520           "DNS Header Question Count", HFILL}
19521         },
19522
19523         /* ixia, 3054 / 263 */
19524         {&hf_pie_ixia_dns_ancount,
19525          {"DNS HDR Answer Count", "cflow.pie.ixia.dns-hdr-ancount",
19526           FT_UINT16, BASE_DEC, NULL, 0x0,
19527           "DNS Header Answer Count", HFILL}
19528         },
19529
19530         /* ixia, 3054 / 264 */
19531         {&hf_pie_ixia_dns_nscount,
19532          {"DNS HDR Auth NS Count", "cflow.pie.ixia.dns-hdr-nscount",
19533           FT_UINT16, BASE_DEC, NULL, 0x0,
19534           "DNS Header Auth NS Count", HFILL}
19535         },
19536
19537         /* ixia, 3054 / 265 */
19538         {&hf_pie_ixia_dns_arcount,
19539          {"DNS HDR Additional Count", "cflow.pie.ixia.dns-hdr-arcount",
19540           FT_UINT16, BASE_DEC, NULL, 0x0,
19541           "DNS Header Additional Count", HFILL}
19542         },
19543
19544         /* ixia, 3054 / 266 */
19545         {&hf_pie_ixia_dns_auth_answer,
19546          {"DNS HDR Flag Authoritative Answer", "cflow.pie.ixia.dns-hdr-auth-ans",
19547           FT_UINT8, BASE_DEC, NULL, 0x0,
19548           "DNS Header Flag Authoritative Answer", HFILL}
19549         },
19550
19551         /* ixia, 3054 / 267 */
19552         {&hf_pie_ixia_dns_trucation,
19553          {"DNS HDR Flag Truncated", "cflow.pie.ixia.dns-hdr-truncated",
19554           FT_UINT8, BASE_DEC, NULL, 0x0,
19555           "DNS Header Flag Truncated", HFILL}
19556         },
19557
19558         /* ixia, 3054 / 268 */
19559         {&hf_pie_ixia_dns_recursion_desired,
19560          {"DNS HDR Flag Recursion Desired", "cflow.pie.ixia.dns-hdr-rd",
19561           FT_UINT8, BASE_DEC, NULL, 0x0,
19562           "DNS Header Flag Recursion Desired", HFILL}
19563         },
19564
19565         /* ixia, 3054 / 269 */
19566         {&hf_pie_ixia_dns_recursion_avail,
19567          {"DNS HDR Flag Recursion Available", "cflow.pie.ixia.dns-hdr-ra",
19568           FT_UINT8, BASE_DEC, NULL, 0x0,
19569           "DNS Header Flag Recursion Available", HFILL}
19570         },
19571
19572         /* ixia, 3054 / 270 */
19573         {&hf_pie_ixia_dns_rdata_len,
19574          {"DNS RData Len", "cflow.pie.ixia.dns-rdata-len",
19575           FT_UINT16, BASE_DEC, NULL, 0x0,
19576           "DNS RData Length", HFILL}
19577         },
19578
19579         /* ixia, 3054 / 271 */
19580         {&hf_pie_ixia_dns_questions,
19581          {"DNS Questions", "cflow.pie.ixia.dns-questions",
19582           FT_NONE, BASE_NONE, NULL, 0x0,
19583           "List of Questions in a DNS Message", HFILL}
19584         },
19585
19586         /* ixia, 3054 / 272 */
19587         {&hf_pie_ixia_dns_query_type,
19588          {"DNS Query Type", "cflow.pie.ixia.dns-qtype",
19589           FT_UINT16, BASE_DEC, NULL, 0x0,
19590           "DNS Question Qtype", HFILL}
19591         },
19592
19593         /* ixia, 3054 / 273 */
19594         {&hf_pie_ixia_dns_query_name,
19595          {"DNS Query Name", "cflow.pie.ixia.dns-qname",
19596           FT_STRING, BASE_NONE, NULL, 0x0,
19597           "DNS Question Qname", HFILL}
19598         },
19599
19600         /* ixia, 3054 / 274 */
19601         {&hf_pie_ixia_dns_section_type,
19602          {"DNS Msg Section Type", "cflow.pie.ixia.dns-section-type",
19603           FT_UINT8, BASE_DEC, VALS(v10_ixia_dns_section_type), 0x0,
19604           "DNS Message Section Type {0:Answer 1:Authoritative NS 2:Additional}", HFILL}
19605         },
19606
19607         /* ixia, 3054 / 275 */
19608         {&hf_pie_ixia_dns_qr_flag,
19609          {"DNS HDR Flag QR", "cflow.pie.ixia.dns-hdr-qr",
19610           FT_UINT8, BASE_DEC, VALS(v10_ixia_req_res_flag), 0x0,
19611           "DNS Header Flag QR {0:Query, 1:Response}", HFILL}
19612         },
19613
19614         /* ixia, 3054 / 276 */
19615         {&hf_pie_ixia_dns_canonical_name,
19616          {"DNS Cname", "cflow.pie.ixia.dns-cname",
19617           FT_STRING, BASE_NONE, NULL, 0x0,
19618           "DNS Canonical Name", HFILL}
19619         },
19620
19621         /* ixia, 3054 / 277 */
19622         {&hf_pie_ixia_dns_mx_domain,
19623          {"DNS MX Domain", "cflow.pie.ixia.dns-mx-domain",
19624           FT_STRING, BASE_NONE, NULL, 0x0,
19625           "DNS Mail Exchange Domain", HFILL}
19626         },
19627
19628         /* ixia, 3054 / 278 */
19629         {&hf_pie_ixia_dhcp_agent_circuit_id,
19630          {"DHCP Agent Circuit ID", "cflow.pie.ixia.dhcp-agent-circuitid",
19631           FT_STRING, BASE_NONE, NULL, 0x0,
19632           "DHCP Agent Circuit ID (Option 82 Sub 1)", HFILL}
19633         },
19634
19635         /* ixia, 3054 / 279 */
19636         {&hf_pie_ixia_ja3_fingerprint_string,
19637          {"JA3 Fingerprint", "cflow.pie.ixia.ja3-fingerprint",
19638           FT_STRING, BASE_NONE, NULL, 0x0,
19639           "JA3 Fingerprint String", HFILL}
19640         },
19641
19642         /* ixia, 3054 / 280 */
19643         {&hf_pie_ixia_tcp_conn_setup_time,
19644          {"TCP Conn Setup Time (us)", "cflow.pie.ixia.tcp-conn-setup-time",
19645           FT_UINT32, BASE_DEC, NULL, 0x0,
19646           "TCP Connection Setup Time (us)", HFILL}
19647         },
19648
19649         /* ixia, 3054 / 281 */
19650         {&hf_pie_ixia_tcp_app_response_time,
19651          {"TCP App Response Time", "cflow.pie.ixia.tcp-app-response-time",
19652           FT_UINT32, BASE_DEC, NULL, 0x0,
19653           "TCP Application Response Time (us)", HFILL}
19654         },
19655
19656         /* ixia, 3054 / 282 */
19657         {&hf_pie_ixia_tcp_retrans_pkt_count,
19658          {"TCP Retransmitted Pkt Count", "cflow.pie.ixia.tcp-retrans-pkt-count",
19659           FT_UINT32, BASE_DEC, NULL, 0x0,
19660           "TCP Count of Retransmitted Packets", HFILL}
19661         },
19662
19663         /* ixia, 3054 / 283 */
19664         {&hf_pie_ixia_conn_avg_rtt,
19665          {"Connection Average RTT (us)", "cflow.pie.ixia.conn-avg-rtt",
19666           FT_UINT32, BASE_DEC, NULL, 0x0,
19667           "Connection Average Round Trip Time (us)", HFILL}
19668         },
19669
19670          /* ixia, 3054 / 284 */
19671         {&hf_pie_ixia_udpAppResponseTime,
19672          {"UDP Average Application Response Time (us)", "cflow.pie.ixia.udpAppResponseTime",
19673          FT_UINT32, BASE_DEC, NULL, 0x0,
19674          NULL, HFILL}
19675         },
19676
19677         /* ixia, 3054 / 285 */
19678         {&hf_pie_ixia_quicConnSetupTime,
19679          {"Time to complete a QUIC Handshake (us)", "cflow.pie.ixia.quicConnectionSetupTime",
19680          FT_UINT32, BASE_DEC, NULL, 0x0,
19681          "QUIC Handshake Completion Time", HFILL}
19682         },
19683
19684         /* ixia, 3054 / 286 */
19685         {&hf_pie_ixia_quicConnRTT,
19686          {"QUIC Network RTT (us)", "cflow.pie.ixia.quicConnectionRTT",
19687          FT_UINT32, BASE_DEC, NULL, 0x0,
19688          "QUIC Network Round Trip Time", HFILL}
19689         },
19690
19691         /* ixia, 3054 / 287 */
19692         {&hf_pie_ixia_quicAppResponseTime,
19693          {"QUIC RTT for application packets (us)", "cflow.pie.ixia.quicAppResponseTime",
19694          FT_UINT32, BASE_DEC, NULL, 0x0,
19695          "QUIC Round Trip Time for Application Packets", HFILL}
19696         },
19697
19698         /* ixia, 3054 / 288 */
19699         {&hf_pie_ixia_matchedFilterName,
19700          {"Matched Filter Name", "cflow.pie.ixia.matchedFilterName",
19701           FT_STRING, BASE_NONE, NULL, 0x0,
19702           "The Name of the Matched Filter", HFILL}
19703         },
19704
19705         /* ixia, 3054 / 289 */
19706         {&hf_pie_ixia_gtp_IMSI,
19707          {"GTP IMSI", "cflow.pie.ixia.gtp-IMSI",
19708           FT_UINT64, BASE_DEC, NULL, 0x0,
19709           "Mobile Session GTP IMSI", HFILL}
19710         },
19711
19712         /* ixia, 3054 / 290 */
19713         {&hf_pie_ixia_gtp_ULI_SAI_SAC,
19714          {"GTP ULI SAI SAC", "cflow.pie.ixia.gtpULI-SAI-SAC",
19715           FT_UINT16, BASE_DEC, NULL, 0x0,
19716           "Mobile Session GTP ULI SAI SAC", HFILL}
19717         },
19718
19719         /* ixia, 3054 / 291 */
19720         {&hf_pie_ixia_gtp_ULI_RAI_RAC,
19721          {"GTP ULI RAI RAC", "cflow.pie.ixia.gtpULI-RAI-RAC",
19722           FT_UINT16, BASE_DEC, NULL, 0x0,
19723           "Mobile Session GTP ULI RAI RAC", HFILL}
19724         },
19725
19726         /* ixia, 3054 / 292 */
19727         {&hf_pie_ixia_gtp_ULI_TAC,
19728          {"GTP ULI TAI TAC", "cflow.pie.ixia.gtpULI-TAC",
19729           FT_UINT16, BASE_DEC, NULL, 0x0,
19730           "Mobile Session GTP ULI TAC", HFILL}
19731         },
19732
19733         /* ixia, 3054 / 293 */
19734         {&hf_pie_ixia_gtp_ULI_ECGI_E_NODEB_ID,
19735          {"GTP ULI ECGI E NODEB ID", "cflow.pie.ixia.gtpULI-ECGI-E-NODEB-ID",
19736           FT_UINT32, BASE_DEC, NULL, 0x0,
19737           "Mobile Session GTP ULI ECGI E NODEB ID", HFILL}
19738         },
19739
19740         /* ixia, 3054 / 294 */
19741         {&hf_pie_ixia_gtp_ULI_CELL_ID,
19742          {"GTP CGI CELL ID", "cflow.pie.ixia.gtpULI-CELL-ID",
19743           FT_UINT32, BASE_DEC, NULL, 0x0,
19744           "Mobile Session GTP CELL ID", HFILL}
19745         },
19746
19747         /* ixia, 3054 / 295 */
19748         {&hf_pie_ixia_gtp_ULI_LAC,
19749          {"GTP CGI LAC", "cflow.pie.ixia.gtpULI-LAC",
19750           FT_UINT16, BASE_DEC, NULL, 0x0,
19751           "Mobile Session GTP LAC", HFILL}
19752         },
19753
19754         /* ixia, 3054 / 296 */
19755         {&hf_pie_ixia_gtp_ULI_MCC,
19756          {"GTP ULI MCC", "cflow.pie.ixia.gtpULI-MCC",
19757           FT_UINT16, BASE_DEC, NULL, 0x0,
19758           "Mobile Session GTP ULI MCC", HFILL}
19759         },
19760
19761         /* ixia, 3054 / 297 */
19762         {&hf_pie_ixia_gtp_ULI_MNC,
19763          {"GTP ULI MNC", "cflow.pie.ixia.gtpULI-MNC",
19764           FT_UINT16, BASE_DEC, NULL, 0x0,
19765           "Mobile Session GTP ULI MNC", HFILL}
19766         },
19767
19768         /* ixia, 3054 / 298 */
19769         {&hf_pie_ixia_gtp_MSISDN,
19770          {"GTP MSISDN", "cflow.pie.ixia.gtp-MSISDN",
19771           FT_UINT64, BASE_DEC, NULL, 0x0,
19772           "Mobile Session GTP MSISDN", HFILL}
19773         },
19774
19775         /* ixia, 3054 / 299 */
19776         {&hf_pie_ixia_gtp_IMEI,
19777          {"GTP IMEI", "cflow.pie.ixia.gtp-IMEI",
19778           FT_UINT64, BASE_DEC, NULL, 0x0,
19779           "Mobile Session GTP IMEI", HFILL}
19780         },
19781
19782         /* ixia, 3054 / 300 */
19783         {&hf_pie_ixia_gtp_RAT_type,
19784          {"GTP RAT Type", "cflow.pie.ixia.gtp-RAT-type",
19785           FT_UINT8, BASE_DEC, NULL, 0x0,
19786           "Mobile Session Radio Access Technology Type", HFILL}
19787         },
19788
19789         /* ixia, 3054 / 301 */
19790         {&hf_pie_ixia_gtp_ep_gen,
19791          {"GTP Endpoint Generation", "cflow.pie.ixia.gtp-ep-gen",
19792           FT_UINT8, BASE_DEC, NULL, 0x0,
19793           "Mobile Session Endpoint GSM Generation", HFILL}
19794         },
19795
19796         /* ixia, 3054 / 302 */
19797         {&hf_pie_ixia_gtp_up_TEID,
19798          {"GTP Uplink TEID", "cflow.pie.ixia.gtp-uplink-TEID",
19799           FT_UINT32, BASE_DEC, NULL, 0x0,
19800           "Mobile Session Uplink Tunnel Endpoint ID", HFILL}
19801         },
19802
19803         /* ixia, 3054 / 303 */
19804         {&hf_pie_ixia_gtp_down_TEID,
19805          {"GTP Downlink TEID", "cflow.pie.ixia.gtp-downlink-TEID",
19806           FT_UINT32, BASE_DEC, NULL, 0x0,
19807           "Mobile Session Downlink Tunnel Endpoint ID", HFILL}
19808         },
19809
19810         /* ixia, 3054 / 304 */
19811         {&hf_pie_ixia_gtp_up_ipv4_addr,
19812          {"GTP Uplink Tunnel IPv4 Address", "cflow.pie.ixia.gtp-uplink-tun-ipv4",
19813           FT_IPv4, BASE_NONE, NULL, 0x0,
19814           "Mobile Session Uplink Tunnel IPv4 Address", HFILL}
19815         },
19816
19817         /* ixia, 3054 / 305 */
19818         {&hf_pie_ixia_gtp_down_ipv4_addr,
19819          {"GTP Downlink Tunnel IPv4 Address", "cflow.pie.ixia.gtp-downlink-tun-ipv4",
19820           FT_IPv4, BASE_NONE, NULL, 0x0,
19821           "Mobile Session Downlink Tunnel IPv4 Address", HFILL}
19822         },
19823
19824         /* ixia, 3054 / 306 */
19825         {&hf_pie_ixia_gtp_up_ipv6_addr,
19826          {"GTP Uplink Tunnel IPv6 Address", "cflow.pie.ixia.gtp-uplink-tun-ipv6",
19827           FT_IPv6, BASE_NONE, NULL, 0x0,
19828           "Mobile Session Uplink Tunnel IPv6 Address", HFILL}
19829         },
19830
19831         /* ixia, 3054 / 307 */
19832         {&hf_pie_ixia_gtp_down_ipv6_addr,
19833          {"GTP Downlink Tunnel IPv6 Address", "cflow.pie.ixia.gtp-downlink-tun-ipv6",
19834           FT_IPv6, BASE_NONE, NULL, 0x0,
19835           "Mobile Session Downlink Tunnel IPv6 Address", HFILL}
19836         },
19837
19838         /* ixia, 3054 / 308 */
19839         {&hf_pie_ixia_gtp_up_QCI_QFI,
19840          {"GTP Uplink QCI/QFI", "cflow.pie.ixia.gtp-uplink-QCI-QFI",
19841           FT_UINT8, BASE_DEC, NULL, 0x0,
19842           "Mobile Session Uplink QCI or QFI", HFILL}
19843         },
19844
19845         /* ixia, 3054 / 309 */
19846         {&hf_pie_ixia_gtp_down_QCI_QFI,
19847          {"GTP Downlink QCI/QFI", "cflow.pie.ixia.gtp-downlink-QCI-QFI",
19848           FT_UINT8, BASE_DEC, NULL, 0x0,
19849           "Mobile Session Downlink QCI or QFI", HFILL}
19850         },
19851
19852         /* ixia, 3054 / 310 */
19853         {&hf_pie_ixia_gtp_up_APN_DNN,
19854          {"GTP Uplink APN/DNN", "cflow.pie.ixia.gtp-uplink-APN-DNN",
19855           FT_STRING, BASE_NONE, NULL, 0x0,
19856           "Mobile Session Uplink Access Point Name or Data Network Name", HFILL}
19857         },
19858
19859         /* ixia, 3054 / 311 */
19860         {&hf_pie_ixia_gtp_down_APN_DNN,
19861          {"GTP Downlink APN/DNN", "cflow.pie.ixia.gtp-downlink-APN-DNN",
19862           FT_STRING, BASE_NONE, NULL, 0x0,
19863           "Mobile Session Downlink Access Point Name or Data Network Name", HFILL}
19864         },
19865
19866         /* ixia, 3054 / 312 */
19867         {&hf_pie_ixia_gtp_NSSAI_SD,
19868          {"GTP NSSAI SD", "cflow.pie.ixia.gtp-NSSAI-SD",
19869           FT_UINT32, BASE_DEC, NULL, 0x0,
19870           "Mobile Session NSSAI Service Differentiator", HFILL}
19871         },
19872
19873         /* ixia, 3054 / 313 */
19874         {&hf_pie_ixia_gtp_NSSAI_SST,
19875          {"GTP NSSAI SST", "cflow.pie.ixia.gtp-NSSAI-SST",
19876           FT_UINT8, BASE_DEC, NULL, 0x0,
19877           "Mobile Session NSSAI Slice/Service Type", HFILL}
19878         },
19879
19880         /* ixia, 3054 / 314 */
19881         {&hf_pie_ixia_gtp_5QI_up,
19882          {"GTP Uplink 5QI", "cflow.pie.ixia.gtp-5QI-up",
19883           FT_UINT8, BASE_DEC, NULL, 0x0,
19884           "Mobile Session Uplink 5G QoS Identifier", HFILL}
19885         },
19886
19887         /* ixia, 3054 / 315 */
19888         {&hf_pie_ixia_gtp_5QI_down,
19889          {"GTP Downlink 5QI", "cflow.pie.ixia.gtp-5QI-down",
19890           FT_UINT8, BASE_DEC, NULL, 0x0,
19891           "Mobile Session Downlink 5G QoS Identifier", HFILL}
19892         },
19893
19894         /* ixia, 3054 / 316 */
19895         {&hf_pie_ixia_stun_response,
19896          {"STUN Response", "cflow.pie.ixia.stun-response",
19897           FT_NONE, BASE_NONE, NULL, 0x0,
19898           "List of STUN responses", HFILL}
19899         },
19900
19901         /* ixia, 3054 / 317 */
19902         {&hf_pie_ixia_stun_reflexive_ta_ipv6,
19903          {"STUN IPv6 Address", "cflow.pie.ixia.stun-reflexive-ta-ipv6",
19904           FT_IPv6, BASE_NONE, NULL, 0x0,
19905           "STUN Reflexive Transport IPv6 Address", HFILL}
19906         },
19907
19908         /* ixia, 3054 / 318 */
19909         {&hf_pie_ixia_stun_reflexive_ta_ipv4,
19910          {"STUN IPv4 Address", "cflow.pie.ixia.stun-reflexive-ta-ipv4",
19911           FT_IPv4, BASE_NONE, NULL, 0x0,
19912           "STUN Reflexive Transport IPv4 Address", HFILL}
19913         },
19914
19915         /* ixia, 3054 / 319 */
19916         {&hf_pie_ixia_stun_reflexive_ta_port,
19917          {"STUN Port", "cflow.pie.ixia.stun-reflexive-ta-port",
19918           FT_UINT16, BASE_DEC, NULL, 0x0,
19919           "STUN Reflexive Transport Address Port", HFILL}
19920         },
19921
19922         /* ixia, 3054 / 320 */
19923         {&hf_pie_ixia_http_alt_svc,
19924          {"HTTP Alt-svc", "cflow.pie.ixia.http-alt-svc",
19925           FT_STRING, BASE_NONE, NULL, 0x0,
19926           "HTTP Alternative Service", HFILL}
19927         },
19928
19929         /* ixia, 3054 / 321 */
19930         {&hf_pie_ixia_unidirectional,
19931          {"Unidirectional flow", "cflow.pie.ixia.flow-is-unidirectional",
19932           FT_UINT8, BASE_DEC, NULL, 0x0,
19933           "Flow is unidirectional - 1:True, 0:False", HFILL}
19934         },
19935
19936         /* ixia, 3054 / 322 */
19937         {&hf_pie_ixia_http_tls_server_rand,
19938          {"TLS Server Random", "cflow.pie.ixia.tls-server-rand",
19939           FT_BYTES, BASE_NONE, NULL, 0x0,
19940           "SSL/TLS Server Random", HFILL}
19941         },
19942
19943         /* ixia, 3054 / 323 */
19944         {&hf_pie_ixia_http_tls_session_id,
19945          {"TLS Session ID", "cflow.pie.ixia.tls-session-id",
19946           FT_BYTES, BASE_NONE, NULL, 0x0,
19947           "SSL/TLS Session ID", HFILL}
19948         },
19949
19950         /* ixia, 3054 / 324 */
19951         {&hf_pie_ixia_sip_to,
19952          {"SIP To", "cflow.pie.ixia.sip-to",
19953           FT_STRING, BASE_NONE, NULL, 0x0,
19954           "SIP Header To", HFILL}
19955         },
19956
19957         /* ixia, 3054 / 325 */
19958         {&hf_pie_ixia_sip_from,
19959          {"SIP From", "cflow.pie.ixia.sip-from",
19960           FT_STRING, BASE_NONE, NULL, 0x0,
19961           "SIP Header From", HFILL}
19962         },
19963
19964         /* ixia, 3054 / 326 */
19965         {&hf_pie_ixia_sip_call_id,
19966          {"SIP Call ID", "cflow.pie.ixia.sip-call-id",
19967           FT_STRING, BASE_NONE, NULL, 0x0,
19968           "SIP Header Call-ID", HFILL}
19969         },
19970
19971         /* ixia, 3054 / 327 */
19972         {&hf_pie_ixia_sip_content_type,
19973          {"SIP Content Type", "cflow.pie.ixia.sip-content-type",
19974           FT_STRING, BASE_NONE, NULL, 0x0,
19975           "SIP Header Content-Type", HFILL}
19976         },
19977
19978         /* ixia, 3054 / 328 */
19979         {&hf_pie_ixia_sip_route,
19980          {"SIP Route", "cflow.pie.ixia.sip-route",
19981           FT_STRING, BASE_NONE, NULL, 0x0,
19982           "SIP Header Route", HFILL}
19983         },
19984
19985         /* ixia, 3054 / 329 */
19986         {&hf_pie_ixia_sip_geolocation,
19987          {"SIP Geolocation", "cflow.pie.ixia.sip-geolocation",
19988           FT_STRING, BASE_NONE, NULL, 0x0,
19989           "SIP Header Geolocation", HFILL}
19990         },
19991
19992         /* ixia, 3054 / 330 */
19993         {&hf_pie_ixia_diameter_message,
19994          {"Diameter Message", "cflow.pie.ixia.diameter-message",
19995           FT_NONE, BASE_NONE, NULL, 0x0,
19996           "List of Diameter Messages", HFILL}
19997         },
19998
19999         /* ixia, 3054 / 331 */
20000         {&hf_pie_ixia_diameter_command_code,
20001          {"Command Code", "cflow.pie.ixia.diameter-command-code",
20002           FT_UINT32, BASE_DEC, NULL, 0x0,
20003           "Diameter Command Code", HFILL}
20004         },
20005
20006         /* ixia, 3054 / 332 */
20007         {&hf_pie_ixia_diameter_request,
20008          {"Request", "cflow.pie.ixia.diameter-request",
20009           FT_UINT8, BASE_DEC, NULL, 0x0,
20010           "Diameter Request", HFILL}
20011         },
20012
20013         /* ixia, 3054 / 333 */
20014         {&hf_pie_ixia_diameter_response,
20015         {"Response", "cflow.pie.ixia.diameter-response",
20016          FT_UINT8, BASE_DEC, NULL, 0x0,
20017          "Diameter Response", HFILL}
20018         },
20019
20020          /* ixia, 3054 / 334 */
20021         {&hf_pie_ixia_diameter_application_id,
20022          {"Application ID", "cflow.pie.ixia.diameter-application-id",
20023           FT_UINT32, BASE_DEC, NULL, 0x0,
20024           "Diameter Application ID", HFILL}
20025         },
20026
20027         /* ixia, 3054 / 335 */
20028         {&hf_pie_ixia_diameter_origin_host,
20029          {"Origin Host", "cflow.pie.ixia.diameter-origin-host",
20030           FT_STRING, BASE_NONE, NULL, 0x0,
20031           "Diameter Origin Host", HFILL}
20032         },
20033
20034         /* ixia, 3054 / 336 */
20035         {&hf_pie_ixia_diameter_origin_realm,
20036          {"Origin Realm", "cflow.pie.ixia.diameter-origin-realm",
20037           FT_STRING, BASE_NONE, NULL, 0x0,
20038           "Diameter Origin Realm", HFILL}
20039         },
20040
20041         /* ixia, 3054 / 337 */
20042         {&hf_pie_ixia_diameter_dest_host,
20043          {"Destination Host", "cflow.pie.ixia.diameter-dest-host",
20044           FT_STRING, BASE_NONE, NULL, 0x0,
20045           "Diameter Destination Host", HFILL}
20046         },
20047
20048         /* ixia, 3054 / 338 */
20049         {&hf_pie_ixia_diameter_dest_realm,
20050          {"Destination Realm", "cflow.pie.ixia.diameter-dest-realm",
20051           FT_STRING, BASE_NONE, NULL, 0x0,
20052           "Diameter Destination Realm", HFILL}
20053         },
20054
20055         /* ixia, 3054 / 339 */
20056         {&hf_pie_ixia_diameter_user_name,
20057          {"User Name", "cflow.pie.ixia.diameter-user-name",
20058           FT_STRING, BASE_NONE, NULL, 0x0,
20059           "Diameter User Name", HFILL}
20060         },
20061
20062         /* ixia, 3054 / 340 */
20063         {&hf_pie_ixia_diameter_sc_address,
20064          {"SC Address", "cflow.pie.ixia.diameter-sc-address",
20065           FT_BYTES, BASE_NONE, NULL, 0x0,
20066           "Diameter SC Address", HFILL}
20067         },
20068
20069         /* ixia, 3054 / 341 */
20070         {&hf_pie_ixia_diameter_auth_vector_rand,
20071          {"Auth Vector RAND", "cflow.pie.ixia.diameter-auth-vector-rand",
20072           FT_BYTES, BASE_NONE, NULL, 0x0,
20073           "Diameter Authentication Vector RAND", HFILL}
20074         },
20075
20076         /* ixia, 3054 / 342 */
20077         {&hf_pie_ixia_diameter_auth_vector_xres,
20078          {"Auth Vector XRES", "cflow.pie.ixia.diameter-auth-vector-xres",
20079           FT_BYTES, BASE_NONE, NULL, 0x0,
20080           "Diameter Authentication Vector XRES", HFILL}
20081         },
20082
20083         /* ixia, 3054 / 343 */
20084         {&hf_pie_ixia_diameter_auth_vector_autn,
20085          {"Auth Vector AUTN", "cflow.pie.ixia.diameter-auth-vector-autn",
20086           FT_BYTES, BASE_NONE, NULL, 0x0,
20087           "Diameter Authentication Vector AUTN", HFILL}
20088         },
20089
20090         /* ixia, 3054 / 344 */
20091         {&hf_pie_ixia_diameter_auth_vector_kasme,
20092          {"Auth Vector KASME", "cflow.pie.ixia.diameter-auth-vector-kasme",
20093           FT_BYTES, BASE_NONE, NULL, 0x0,
20094           "Diameter Authentication Vector KASME", HFILL}
20095         },
20096
20097         /* ixia, 3054 / 345 */
20098         {&hf_pie_ixia_diameter_sub_data_ambr_max_req_bw_ul,
20099          {"Subscription Data AMBR Max Requested Bandwidth Upload",
20100           "cflow.pie.ixia.diameter-sub-data-ambr-max-req-bw-ul",
20101           FT_UINT32, BASE_DEC, NULL, 0x0,
20102           "Diameter Subscription Data AMBR Max Requested Bandwidth Upload",
20103           HFILL}
20104         },
20105
20106         /* ixia, 3054 / 346 */
20107         {&hf_pie_ixia_diameter_sub_data_ambr_max_req_bw_dl,
20108          {"Subscription Data AMBR Max Requested Bandwidth Download",
20109           "cflow.pie.ixia.diameter-sub-data-ambr-max-req-bw-dl",
20110           FT_UINT32, BASE_DEC, NULL, 0x0,
20111           "Diameter Subscription Data AMBR Max Requested Bandwidth Download",
20112           HFILL}
20113         },
20114
20115         /* ixia, 3054 / 347 */
20116         {&hf_pie_ixia_diameter_apn_configuration_profile,
20117          {"APN Configuration Profile",
20118           "cflow.pie.ixia.diameter-apn-configuration-profile",
20119           FT_BYTES, BASE_NONE, NULL, 0x0,
20120           "Diameter APN Configuration Profile", HFILL}
20121         },
20122
20123         /* ixia, 3054 / 348 */
20124         {&hf_pie_ixia_diameter_access_restriction_data_flags,
20125          {"Access Restriction Data Flags",
20126           "cflow.pie.ixia.diameter-access-restriction-data-flags",
20127           FT_UINT32, BASE_HEX, NULL, 0x0,
20128           "Diameter Access Restriction Data Flags", HFILL}
20129         },
20130
20131         /* ixia, 3054 / 349 */
20132         {&hf_pie_ixia_diameter_route_record,
20133          {"Route Record", "cflow.pie.ixia.diameter-route-record",
20134           FT_STRING, BASE_NONE, NULL, 0x0,
20135           "Diameter Route Record", HFILL}
20136         },
20137
20138         /* ixia, 3054 / 350 */
20139         {&hf_pie_ixia_diameter_framed_ip_address,
20140          {"Framed IP Address", "cflow.pie.ixia.diameter-framed-ip-address",
20141           FT_IPv4, BASE_NONE, NULL, 0x0,
20142           "Diameter Framed IP Address", HFILL}
20143         },
20144
20145         /* ixia, 3054 / 351 */
20146         {&hf_pie_ixia_diameter_3gpp_user_location_info,
20147          {"3GPP ULI", "cflow.pie.ixia.diameter-3gpp-user-location-info",
20148           FT_BYTES, BASE_NONE, NULL, 0x0,
20149           "Diameter 3GPP User Location Info", HFILL}
20150         },
20151
20152         /* ixia, 3054 / 352 */
20153         {&hf_pie_ixia_diameter_called_station_id,
20154          {"Called Station ID", "cflow.pie.ixia.diameter-called-station-id",
20155           FT_STRING, BASE_NONE, NULL, 0x0,
20156           "Diameter Called Station ID", HFILL}
20157         },
20158
20159         /* ixia, 3054 / 353 */
20160         {&hf_pie_ixia_diameter_qos_class_identifier,
20161          {"QoS Class Identifier", "cflow.pie.ixia.diameter-qos-class-identifier",
20162           FT_UINT32, BASE_HEX, NULL, 0x0,
20163           "Diameter QoS Class Identifier", HFILL}
20164         },
20165
20166         /* ixia, 3054 / 354 */
20167         {&hf_pie_ixia_diameter_qos_max_req_bw_dl,
20168          {"QoS Maximum Requested Bandwidth Download",
20169           "cflow.pie.ixia.diameter-qos-max-req-bw-dl",
20170           FT_UINT32, BASE_DEC, NULL, 0x0,
20171           "Diameter QoS Maximum Requested Bandwidth Download", HFILL}
20172         },
20173
20174         /* ixia, 3054 / 355 */
20175         {&hf_pie_ixia_diameter_qos_max_req_bw_ul,
20176          {"QoS Maximum Requested Bandwidth Upload",
20177           "cflow.pie.ixia.diameter-qos-max-req-bw-ul",
20178           FT_UINT32, BASE_DEC, NULL, 0x0,
20179           "Diameter QoS Maximum Requested Bandwidth Upload", HFILL}
20180         },
20181
20182         /* ixia, 3054 / 356 */
20183         {&hf_pie_ixia_diameter_qos_guaranteed_br_ul,
20184          {"QoS Guaranteed Bitrate Upload",
20185           "cflow.pie.ixia.diameter-qos-guaranteed-br-ul",
20186           FT_UINT32, BASE_DEC, NULL, 0x0,
20187           "Diameter Guaranteed Bitrate Upload", HFILL}
20188         },
20189
20190         /* ixia, 3054 / 357 */
20191         {&hf_pie_ixia_diameter_qos_guaranteed_br_dl,
20192          {"QoS Guaranteed Bitrate Download",
20193           "cflow.pie.ixia.diameter-qos-guaranteed-br-dl",
20194           FT_UINT32, BASE_DEC, NULL, 0x0,
20195           "Diameter QoS Guaranteed Bitrate Upload", HFILL}
20196         },
20197
20198         /* ixia, 3054 / 358 */
20199         {&hf_pie_ixia_diameter_qos_apn_agg_max_br_ul,
20200          {"QoS APN AMBR Upload", "cflow.pie.ixia.diameter-qos-apn-agg-max-br-ul",
20201           FT_UINT32, BASE_DEC, NULL, 0x0,
20202           "Diameter QoS APN Aggregated Maximum Bitrate Upload", HFILL}
20203         },
20204
20205         /* ixia, 3054 / 359 */
20206         {&hf_pie_ixia_diameter_qos_apn_agg_max_br_dl,
20207          {"QoS APN AMBR Download", "cflow.pie.ixia.diameter-qos-apn-agg-max-br-dl",
20208           FT_UINT32, BASE_DEC, NULL, 0x0,
20209           "Diameter QoS APN Aggregated Maximum Bitrate Download", HFILL}
20210         },
20211
20212         /* ixia, 3054 / 360 */
20213         {&hf_pie_ixia_diameter_integrity_key,
20214          {"Integrity Key", "cflow.pie.ixia.diameter-integrity-key",
20215           FT_BYTES, BASE_NONE, NULL, 0x0,
20216           "Diameter Integrity Key", HFILL}
20217         },
20218
20219         /* ixia, 3054 / 361 */
20220         {&hf_pie_ixia_diameter_confidentiality_key,
20221          {"Confidentiality Key", "cflow.pie.ixia.diameter-confidentiality-key",
20222           FT_BYTES, BASE_NONE, NULL, 0x0,
20223           "Diameter Confidentiality Key", HFILL}
20224         },
20225
20226         /* ixia, 3054 / 362 */
20227         {&hf_pie_ixia_diameter_result_code,
20228          {"Result Code", "cflow.pie.ixia.diameter-result-code",
20229           FT_UINT32, BASE_HEX, NULL, 0x0,
20230           "Diameter Result Code", HFILL}
20231         },
20232
20233         /* ixia, 3054 / 363 */
20234         {&hf_pie_ixia_diameter_subscription_id_data,
20235          {"Subscription ID Data", "cflow.pie.ixia.diameter-subscription-id-data",
20236           FT_STRING, BASE_NONE, NULL, 0x0,
20237           "Diameter Subscription ID Data", HFILL}
20238         },
20239
20240         /* ixia, 3054 / 364 */
20241         {&hf_pie_ixia_session_fingerprint,
20242          {"Fingerprint", "cflow.pie.ixia.session-fingerprint",
20243           FT_BYTES, BASE_NONE, NULL, 0x0,
20244           "Session Fingerprint", HFILL}
20245         },
20246
20247         /* ixia, 3054 / 365 */
20248         {&hf_pie_ixia_session_parse_errors,
20249          {"Parse Errors", "cflow.pie.ixia.session-parse-errors",
20250           FT_UINT32, BASE_DEC, NULL, 0x0,
20251           "Session Parse Errors Count", HFILL}
20252         },
20253
20254         /* ixia, 3054 / 366 */
20255         {&hf_pie_ixia_http_headers,
20256          {"HTTP Headers", "cflow.pie.ixia.http-headers",
20257           FT_NONE, BASE_NONE, NULL, 0x0,
20258           "List of HTTP Headers", HFILL}
20259         },
20260
20261         /* ixia, 3054 / 367 */
20262         {&hf_pie_ixia_http_header_field,
20263          {"HTTP Header Field", "cflow.pie.ixia.http-header-field",
20264           FT_STRING, BASE_NONE, NULL, 0x0,
20265           "Field name of HTTP header", HFILL}
20266         },
20267
20268         /* ixia, 3054 / 368 */
20269         {&hf_pie_ixia_http_header_value,
20270          {"HTTP Header Value", "cflow.pie.ixia.http-header-value",
20271           FT_STRING, BASE_NONE, NULL, 0x0,
20272           "Value for HTTP header", HFILL}
20273         },
20274
20275         /* ixia, 3054 / 369 */
20276         {&hf_pie_ixia_sip_packets,
20277          {"SIP Packets", "cflow.pie.ixia.sip-packets",
20278           FT_STRING, BASE_NONE, NULL, 0x0,
20279           "List of SIP packets", HFILL}
20280         },
20281
20282         /* ixia, 3054 / 370 */
20283         {&hf_pie_ixia_sip_headers,
20284          {"SIP Headers", "cflow.pie.ixia.sip-headers",
20285           FT_NONE, BASE_NONE, NULL, 0x0,
20286           "List of SIP headers", HFILL}
20287         },
20288
20289         /* ixia, 3054 / 371 */
20290         {&hf_pie_ixia_sip_type,
20291          {"SIP Type", "cflow.pie.ixia.sip-type",
20292           FT_STRING, BASE_NONE, NULL, 0x0,
20293           "Type of SIP packet", HFILL}
20294         },
20295
20296         /* ixia, 3054 / 372 */
20297         {&hf_pie_ixia_sip_header_field,
20298          {"SIP Header Field", "cflow.pie.ixia.sip-header-field",
20299           FT_STRING, BASE_NONE, NULL, 0x0,
20300           "Name of SIP header", HFILL}
20301         },
20302
20303         /* ixia, 3054 / 373 */
20304         {&hf_pie_ixia_sip_header_value,
20305          {"SIP Header Value", "cflow.pie.ixia.sip-header-value",
20306           FT_STRING, BASE_NONE, NULL, 0x0,
20307           "Value of SIP header", HFILL}
20308         },
20309
20310         /* ixia, 3054 / 374 */
20311         {&hf_pie_ixia_session_ip_scrambling_key_hash,
20312          {"IP Scrambling Key Hash", "cflow.pie.ixia.session-ip-scrambling-key-hash",
20313           FT_STRING, BASE_NONE, NULL, 0x0,
20314           "Session IP Scrambling Key Hash", HFILL}
20315         },
20316
20317         /* ixia, 3054 / 375 */
20318         {&hf_pie_ixia_ja4a,
20319          {"JA4 Fingerprint Part A", "cflow.pie.ixia.ja4a",
20320           FT_STRING, BASE_NONE, NULL, 0x0,
20321           "First Part of a JA4 Fingerprint", HFILL}
20322         },
20323
20324         /* ixia, 3054 / 376 */
20325         {&hf_pie_ixia_ja4b,
20326          {"JA4 Fingerprint Part B", "cflow.pie.ixia.ja4b",
20327           FT_STRING, BASE_NONE, NULL, 0x0,
20328           "Second Part of a JA4 Fingerprint", HFILL}
20329         },
20330
20331         /* ixia, 3054 / 377 */
20332         {&hf_pie_ixia_ja4c,
20333          {"JA4 Fingerprint Part C", "cflow.pie.ixia.ja4c",
20334           FT_STRING, BASE_NONE, NULL, 0x0,
20335           "Third Part of a JA4 Fingerprint", HFILL}
20336         },
20337
20338         /* Netscaler root (a hidden item to allow filtering) */
20339         {&hf_pie_netscaler,
20340          {"Netscaler", "cflow.pie.netscaler",
20341           FT_NONE, BASE_NONE, NULL, 0x0,
20342           NULL, HFILL}
20343         },
20344         /* netscaler, 5951 / 128 */
20345         {&hf_pie_netscaler_roundtriptime,
20346          {"Round Trip Time", "cflow.pie.netscaler.round-trip-time",
20347           FT_UINT32, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
20348           "TCP RTT of the flow in milliseconds", HFILL}
20349         },
20350         /* netscaler, 5951 / 129 */
20351         {&hf_pie_netscaler_transactionid,
20352          {"Transaction ID", "cflow.pie.netscaler.transaction-id",
20353           FT_UINT32, BASE_HEX_DEC, NULL, 0x0,
20354           "Four flows of a transaction between client and server (client-to-NS, NS-to-Server, Server-to-NS, NS-to-Client)", HFILL}
20355         },
20356         /* netscaler, 5951 / 130 */
20357         {&hf_pie_netscaler_httprequrl,
20358          {"HTTP Request Url", "cflow.pie.netscaler.http-req-url",
20359           FT_STRING, BASE_NONE, NULL, 0x0,
20360           NULL, HFILL}
20361         },
20362         /* netscaler, 5951 / 131 */
20363         {&hf_pie_netscaler_httpreqcookie,
20364          {"HTTP Request Cookie", "cflow.pie.netscaler.http-req-cookie",
20365           FT_STRING, BASE_NONE, NULL, 0x0,
20366           NULL, HFILL}
20367         },
20368         /* netscaler, 5951 / 132 */
20369         {&hf_pie_netscaler_flowflags,
20370          {"Flow Flags", "cflow.pie.netscaler.flow-flags",
20371           FT_UINT64, BASE_HEX, NULL, 0x0,
20372           "Application Layer Flags", HFILL}
20373         },
20374         /* netscaler, 5951 / 133 */
20375         {&hf_pie_netscaler_connectionid,
20376          {"Connection ID", "cflow.pie.netscaler.connection-id",
20377           FT_UINT32, BASE_HEX_DEC, NULL, 0x0,
20378           "Two flows of a TCP connection", HFILL}
20379         },
20380         /* netscaler, 5951 / 134 */
20381         {&hf_pie_netscaler_syslogpriority,
20382          {"Syslog Priority", "cflow.pie.netscaler.syslog-priority",
20383           FT_UINT8, BASE_DEC, NULL, 0x0,
20384           "Priority of the syslog message", HFILL}
20385         },
20386         /* netscaler, 5951 / 135 */
20387         {&hf_pie_netscaler_syslogmessage,
20388          {"Syslog Message", "cflow.pie.netscaler.syslog-message",
20389           FT_STRING, BASE_NONE, NULL, 0x0,
20390           NULL, HFILL}
20391         },
20392         /* netscaler, 5951 / 136 */
20393         {&hf_pie_netscaler_syslogtimestamp,
20394          {"Syslog Timestamp", "cflow.pie.netscaler.syslog-timestamp",
20395           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_milliseconds), 0x0,
20396           NULL, HFILL}
20397         },
20398         /* netscaler, 5951 / 140 */
20399         {&hf_pie_netscaler_httpreqreferer,
20400          {"HTTP Request Referer", "cflow.pie.netscaler.http-req-referer",
20401           FT_STRING, BASE_NONE, NULL, 0x0,
20402           NULL, HFILL}
20403         },
20404         /* netscaler, 5951 / 141 */
20405         {&hf_pie_netscaler_httpreqmethod,
20406          {"HTTP Request Method", "cflow.pie.netscaler.http-req-method",
20407           FT_STRING, BASE_NONE, NULL, 0x0,
20408           NULL, HFILL}
20409         },
20410         /* netscaler, 5951 / 142 */
20411         {&hf_pie_netscaler_httpreqhost,
20412          {"HTTP Request Host", "cflow.pie.netscaler.http-req-host",
20413           FT_STRING, BASE_NONE, NULL, 0x0,
20414           NULL, HFILL}
20415         },
20416         /* netscaler, 5951 / 143 */
20417         {&hf_pie_netscaler_httprequseragent,
20418          {"HTTP Request UserAgent", "cflow.pie.netscaler.http-req-useragent",
20419           FT_STRING, BASE_NONE, NULL, 0x0,
20420           NULL, HFILL}
20421         },
20422         /* netscaler, 5951 / 144 */
20423         {&hf_pie_netscaler_httprspstatus,
20424          {"HTTP Response Status", "cflow.pie.netscaler.http-rsp-status",
20425           FT_UINT16, BASE_DEC, NULL, 0x0,
20426           NULL, HFILL}
20427         },
20428         /* netscaler, 5951 / 145 */
20429         {&hf_pie_netscaler_httprsplen,
20430          {"HTTP Response Length", "cflow.pie.netscaler.http-rsp-len",
20431           FT_UINT64, BASE_DEC, NULL, 0x0,
20432           NULL, HFILL}
20433         },
20434         /* netscaler, 5951 / 146 */
20435         {&hf_pie_netscaler_serverttfb,
20436          {"Server TTFB", "cflow.pie.netscaler.server-ttfb",
20437           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20438           "Time till First Byte (microseconds)", HFILL}
20439         },
20440         /* netscaler, 5951 / 147 */
20441         {&hf_pie_netscaler_serverttlb,
20442          {"Server TTLB", "cflow.pie.netscaler.server-ttlb",
20443           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20444           "Time till Last Byte (microseconds)", HFILL}
20445         },
20446         /* netscaler, 5951 / 150 */
20447         {&hf_pie_netscaler_appnameincarnationnumber,
20448          {"AppName Incarnation Number", "cflow.pie.netscaler.appname-incarnation-number",
20449           FT_UINT32, BASE_DEC, NULL, 0x0,
20450           NULL, HFILL}
20451         },
20452         /* netscaler, 5951 / 151 */
20453         {&hf_pie_netscaler_appnameappid,
20454          {"AppName App ID", "cflow.pie.netscaler.appname-app-id",
20455           FT_UINT32, BASE_DEC, NULL, 0x0,
20456           NULL, HFILL}
20457         },
20458         /* netscaler, 5951 / 152 */
20459         {&hf_pie_netscaler_appname,
20460          {"AppName", "cflow.pie.netscaler.appname",
20461           FT_STRING, BASE_NONE, NULL, 0x0,
20462           NULL, HFILL}
20463         },
20464         /* netscaler, 5951 / 153 */
20465         {&hf_pie_netscaler_httpreqrcvfb,
20466          {"HTTP Request Received FB", "cflow.pie.netscaler.http-req-rcv-fb",
20467           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20468           "Timestamp of first byte received from client (microseconds)", HFILL}
20469         },
20470         /* netscaler, 5951 / 156 */
20471         {&hf_pie_netscaler_httpreqforwfb,
20472          {"HTTP Request Forwarded FB", "cflow.pie.netscaler.http-req-forw-fb",
20473           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20474           "Timestamp of first byte forwarded to server (microseconds)", HFILL}
20475         },
20476         /* netscaler, 5951 / 157 */
20477         {&hf_pie_netscaler_httpresrcvfb,
20478          {"HTTP Response Received FB", "cflow.pie.netscaler.http-res-rcv-fb",
20479           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20480           "Timestamp of first byte received from server (microseconds)", HFILL}
20481         },
20482         /* netscaler, 5951 / 158 */
20483         {&hf_pie_netscaler_httpresforwfb,
20484          {"HTTP Response Forwarded FB", "cflow.pie.netscaler.http-res-forw-fb",
20485           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20486           "Timestamp of first byte forwarded to client (microseconds)", HFILL}
20487         },
20488         /* netscaler, 5951 / 159 */
20489         {&hf_pie_netscaler_httpreqrcvlb,
20490          {"HTTP Request Received LB", "cflow.pie.netscaler.http-req-rcv-lb",
20491           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20492           "Timestamp of last byte received from client (microseconds)", HFILL}
20493         },
20494         /* netscaler, 5951 / 160 */
20495         {&hf_pie_netscaler_httpreqforwlb,
20496          {"HTTP Request Forwarded LB", "cflow.pie.netscaler.http-req-forw-lb",
20497           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20498           "Timestamp of last byte forwarded to server (microseconds)", HFILL}
20499         },
20500         /* netscaler, 5951 / 161 */
20501         {&hf_pie_netscaler_mainpageid,
20502          {"Main Page Id", "cflow.pie.netscaler.mainpage-id",
20503           FT_UINT32, BASE_DEC, NULL, 0x0,
20504           NULL, HFILL}
20505         },
20506         /* netscaler, 5951 / 162 */
20507         {&hf_pie_netscaler_mainpagecoreid,
20508          {"Main Page Core Id", "cflow.pie.netscaler.mainpage-core-id",
20509           FT_UINT32, BASE_DEC, NULL, 0x0,
20510           NULL, HFILL}
20511         },
20512         /* netscaler, 5951 / 163 */
20513         {&hf_pie_netscaler_httpclientinteractionstarttime,
20514          {"HTTP Client Interaction Start Time", "cflow.pie.netscaler.http-client-interaction-starttime",
20515           FT_STRING, BASE_NONE, NULL, 0x0,
20516           "Timestamp when the page starts loading", HFILL}
20517         },
20518         /* netscaler, 5951 / 164 */
20519         {&hf_pie_netscaler_httpclientrenderendtime,
20520          {"HTTP Client Render End Time", "cflow.pie.netscaler.http-client-render-endtime",
20521           FT_STRING, BASE_NONE, NULL, 0x0,
20522           "Timestamp when the page completely renders", HFILL}
20523         },
20524         /* netscaler, 5951 / 165 */
20525         {&hf_pie_netscaler_httpclientrenderstarttime,
20526          {"HTTP Client Render Start Time", "cflow.pie.netscaler.http-client-render-starttime",
20527           FT_STRING, BASE_NONE, NULL, 0x0,
20528           "Timestamp when page rendering begins", HFILL}
20529         },
20530         /* netscaler, 5951 / 167 */
20531         {&hf_pie_netscaler_apptemplatename,
20532          {"App Template Name", "cflow.pie.netscaler.app-template-name",
20533           FT_STRING, BASE_NONE, NULL, 0x0,
20534           NULL, HFILL}
20535         },
20536         /* netscaler, 5951 / 168 */
20537         {&hf_pie_netscaler_httpclientinteractionendtime,
20538          {"HTTP Client Interaction End Time", "cflow.pie.netscaler.http-client-interaction-endtime",
20539           FT_STRING, BASE_NONE, NULL, 0x0,
20540           NULL, HFILL}
20541         },
20542         /* netscaler, 5951 / 169 */
20543         {&hf_pie_netscaler_httpresrcvlb,
20544          {"HTTP Response Received LB", "cflow.pie.netscaler.http-res-rcv-lb",
20545           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20546           "Timestamp of last byte received from server (microseconds)", HFILL}
20547         },
20548         /* netscaler, 5951 / 170 */
20549         {&hf_pie_netscaler_httpresforwlb,
20550          {"HTTP Response Forwarded LB", "cflow.pie.netscaler.http-res-forw-lb",
20551           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_microseconds), 0x0,
20552           "Timestamp of last byte of forwarded to client (microseconds)", HFILL}
20553         },
20554         /* netscaler, 5951 / 171 */
20555         {&hf_pie_netscaler_appunitnameappid,
20556          {"AppUnit Name App Id", "cflow.pie.netscaler.app-unit-name-appid",
20557           FT_UINT32, BASE_DEC, NULL, 0x0,
20558           NULL, HFILL}
20559         },
20560         /* netscaler, 5951 / 172 */
20561         {&hf_pie_netscaler_dbloginflags,
20562          {"DB Login Flags", "cflow.pie.netscaler.db-login-flags",
20563           FT_UINT32, BASE_HEX, NULL, 0x0,
20564           NULL, HFILL}
20565         },
20566         /* netscaler, 5951 / 173 */
20567         {&hf_pie_netscaler_dbreqtype,
20568          {"DB Request Type", "cflow.pie.netscaler.db-req-type",
20569           FT_UINT8, BASE_DEC, NULL, 0x0,
20570           "Type of database request", HFILL}
20571         },
20572         /* netscaler, 5951 / 174 */
20573         {&hf_pie_netscaler_dbprotocolname,
20574          {"DB Protocol Name", "cflow.pie.netscaler.db-protocol-name",
20575           FT_UINT8, BASE_DEC, NULL, 0x0,
20576           "Database protocol", HFILL}
20577         },
20578         /* netscaler, 5951 / 175 */
20579         {&hf_pie_netscaler_dbusername,
20580          {"DB User Name", "cflow.pie.netscaler.db-user-name",
20581           FT_STRING, BASE_NONE, NULL, 0x0,
20582           NULL, HFILL}
20583         },
20584         /* netscaler, 5951 / 176 */
20585         {&hf_pie_netscaler_dbdatabasename,
20586          {"DB Database Name", "cflow.pie.netscaler.db-database-name",
20587           FT_STRING, BASE_NONE, NULL, 0x0,
20588           NULL, HFILL}
20589         },
20590         /* netscaler, 5951 / 177 */
20591         {&hf_pie_netscaler_dbclthostname,
20592          {"DB Client Host Name", "cflow.pie.netscaler.db-clt-hostname",
20593           FT_STRING, BASE_NONE, NULL, 0x0,
20594           NULL, HFILL}
20595         },
20596         /* netscaler, 5951 / 178 */
20597         {&hf_pie_netscaler_dbreqstring,
20598          {"DB Request String", "cflow.pie.netscaler.db-req-string",
20599           FT_STRING, BASE_NONE, NULL, 0x0,
20600           NULL, HFILL}
20601         },
20602         /* netscaler, 5951 / 179 */
20603         {&hf_pie_netscaler_dbrespstatusstring,
20604          {"DB Response Status String", "cflow.pie.netscaler.db-resp-status-string",
20605           FT_STRING, BASE_NONE, NULL, 0x0,
20606           "Database response status", HFILL}
20607         },
20608         /* netscaler, 5951 / 180 */
20609         {&hf_pie_netscaler_dbrespstatus,
20610          {"DB Response Status", "cflow.pie.netscaler.db-resp-status",
20611           FT_UINT64, BASE_DEC, NULL, 0x0,
20612           NULL, HFILL}
20613         },
20614         /* netscaler, 5951 / 181 */
20615         {&hf_pie_netscaler_dbresplength,
20616          {"DB Response Length", "cflow.pie.netscaler.db-resp-length",
20617           FT_UINT64, BASE_DEC, NULL, 0x0,
20618           NULL, HFILL}
20619         },
20620         /* netscaler, 5951 / 182 */
20621         {&hf_pie_netscaler_clientrtt,
20622          {"Client RTT", "cflow.pie.netscaler.client-rtt",
20623           FT_UINT32, BASE_DEC, NULL, 0x0,
20624           "RTT of the client", HFILL}
20625         },
20626         /* netscaler, 5951 / 183 */
20627         {&hf_pie_netscaler_httpcontenttype,
20628          {"HTTP Content-Type", "cflow.pie.netscaler.http-contenttype",
20629           FT_STRING, BASE_NONE, NULL, 0x0,
20630           NULL, HFILL}
20631         },
20632         /* netscaler, 5951 / 185 */
20633         {&hf_pie_netscaler_httpreqauthorization,
20634          {"HTTP Request Authorization", "cflow.pie.netscaler.http-req-authorization",
20635           FT_STRING, BASE_NONE, NULL, 0x0,
20636           NULL, HFILL}
20637         },
20638         /* netscaler, 5951 / 186 */
20639         {&hf_pie_netscaler_httpreqvia,
20640          {"HTTP Request Via", "cflow.pie.netscaler.http-req-via",
20641           FT_STRING, BASE_NONE, NULL, 0x0,
20642           NULL, HFILL}
20643         },
20644         /* netscaler, 5951 / 187 */
20645         {&hf_pie_netscaler_httpreslocation,
20646          {"HTTP Response Location", "cflow.pie.netscaler.http-res-location",
20647           FT_STRING, BASE_NONE, NULL, 0x0,
20648           NULL, HFILL}
20649         },
20650         /* netscaler, 5951 / 188 */
20651         {&hf_pie_netscaler_httpressetcookie,
20652          {"HTTP Response Set-Cookie", "cflow.pie.netscaler.http-res-setcookie",
20653           FT_STRING, BASE_NONE, NULL, 0x0,
20654           NULL, HFILL}
20655         },
20656         /* netscaler, 5951 / 189 */
20657         {&hf_pie_netscaler_httpressetcookie2,
20658          {"HTTP Response Set-Cookie2", "cflow.pie.netscaler.http-res-setcookie2",
20659           FT_STRING, BASE_NONE, NULL, 0x0,
20660           NULL, HFILL}
20661         },
20662         /* netscaler, 5951 / 190 */
20663         {&hf_pie_netscaler_httpreqxforwardedfor,
20664          {"HTTP Request X-Forwarded-For", "cflow.pie.netscaler.http-reqx-forwardedfor",
20665           FT_STRING, BASE_NONE, NULL, 0x0,
20666           NULL, HFILL}
20667         },
20668         /* netscaler, 5951 / 192 */
20669         {&hf_pie_netscaler_connectionchainid,
20670          {"Connection Chain ID", "cflow.pie.netscaler.connection-chain-id",
20671           FT_BYTES, BASE_NONE, NULL, 0x0,
20672           NULL, HFILL}
20673         },
20674         /* netscaler, 5951 / 193 */
20675         {&hf_pie_netscaler_connectionchainhopcount,
20676          {"Connection Chain Hop Count", "cflow.pie.netscaler.connection-chain-hop-count",
20677           FT_UINT8, BASE_DEC, NULL, 0x0,
20678           NULL, HFILL}
20679         },
20680         /* netscaler, 5951 / 200 */
20681         {&hf_pie_netscaler_icasessionguid,
20682          {"ICA Session GUID", "cflow.pie.netscaler.ica-session-guid",
20683           FT_GUID, BASE_NONE, NULL, 0x0,
20684           NULL, HFILL}
20685         },
20686         /* netscaler, 5951 / 201 */
20687         {&hf_pie_netscaler_icaclientversion,
20688          {"ICA Client Version", "cflow.pie.netscaler.ica-client-version",
20689           FT_STRING, BASE_NONE, NULL, 0x0,
20690           "Version of the ICA client", HFILL}
20691         },
20692         /* netscaler, 5951 / 202 */
20693         {&hf_pie_netscaler_icaclienttype,
20694          {"ICA Client Type", "cflow.pie.netscaler.ica-client-type",
20695           FT_UINT16, BASE_DEC, NULL, 0x0,
20696           NULL, HFILL}
20697         },
20698         /* netscaler, 5951 / 203 */
20699         {&hf_pie_netscaler_icaclientip,
20700          {"ICA Client IP", "cflow.pie.netscaler.ica-client-ip",
20701           FT_IPv4, BASE_NONE, NULL, 0x0,
20702           NULL, HFILL}
20703         },
20704         /* netscaler, 5951 / 204 */
20705         {&hf_pie_netscaler_icaclienthostname,
20706          {"ICA Client Host Name", "cflow.pie.netscaler.ica-client-hostname",
20707           FT_STRING, BASE_NONE, NULL, 0x0,
20708           NULL, HFILL}
20709         },
20710         /* netscaler, 5951 / 205 */
20711         {&hf_pie_netscaler_aaausername,
20712          {"AAA Username", "cflow.pie.netscaler.aaa-username",
20713           FT_STRING, BASE_NONE, NULL, 0x0,
20714           NULL, HFILL}
20715         },
20716         /* netscaler, 5951 / 207 */
20717         {&hf_pie_netscaler_icadomainname,
20718          {"ICA Domain Name", "cflow.pie.netscaler.ica-domain-name",
20719           FT_STRING, BASE_NONE, NULL, 0x0,
20720           NULL, HFILL}
20721         },
20722         /* netscaler, 5951 / 208 */
20723         {&hf_pie_netscaler_icaclientlauncher,
20724          {"ICA Client Launcher", "cflow.pie.netscaler.ica-client-launcher",
20725           FT_UINT16, BASE_DEC, NULL, 0x0,
20726           NULL, HFILL}
20727         },
20728         /* netscaler, 5951 / 209 */
20729         {&hf_pie_netscaler_icasessionsetuptime,
20730          {"ICA Session Setup Time", "cflow.pie.netscaler.ica-session-setuptime",
20731           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_seconds), 0x0,
20732           NULL, HFILL}
20733         },
20734         /* netscaler, 5951 / 210 */
20735         {&hf_pie_netscaler_icaservername,
20736          {"ICA Server Name", "cflow.pie.netscaler.ica-servername",
20737           FT_STRING, BASE_NONE, NULL, 0x0,
20738           NULL, HFILL}
20739         },
20740         /* netscaler, 5951 / 214 */
20741         {&hf_pie_netscaler_icasessionreconnects,
20742          {"ICA Session Reconnects", "cflow.pie.netscaler.ica-session-reconnects",
20743           FT_UINT8, BASE_DEC, NULL, 0x0,
20744           NULL, HFILL}
20745         },
20746         /* netscaler, 5951 / 215 */
20747         {&hf_pie_netscaler_icartt,
20748          {"ICA RTT", "cflow.pie.netscaler.ica-rtt",
20749           FT_UINT32, BASE_DEC, NULL, 0x0,
20750           NULL, HFILL}
20751         },
20752         /* netscaler, 5951 / 216 */
20753         {&hf_pie_netscaler_icaclientsiderxbytes,
20754          {"ICA Clientside RX Bytes", "cflow.pie.netscaler.ica-client-side-rxbytes",
20755           FT_UINT32, BASE_DEC, NULL, 0x0,
20756           NULL, HFILL}
20757         },
20758         /* netscaler, 5951 / 217 */
20759         {&hf_pie_netscaler_icaclientsidetxbytes,
20760          {"ICA Clientside TX Bytes", "cflow.pie.netscaler.ica-client-side-txbytes",
20761           FT_UINT32, BASE_DEC, NULL, 0x0,
20762           NULL, HFILL}
20763         },
20764         /* netscaler, 5951 / 219 */
20765         {&hf_pie_netscaler_icaclientsidepacketsretransmit,
20766          {"ICA Clientside Packets Retransmit", "cflow.pie.netscaler.ica-clientside-packets-retransmit",
20767           FT_UINT16, BASE_DEC, NULL, 0x0,
20768           NULL, HFILL}
20769         },
20770         /* netscaler, 5951 / 220 */
20771         {&hf_pie_netscaler_icaserversidepacketsretransmit,
20772          {"ICA Serverside Packets Retransmit", "cflow.pie.netscaler.ica-serverside-packets-retransmit",
20773           FT_UINT16, BASE_DEC, NULL, 0x0,
20774           NULL, HFILL}
20775         },
20776         /* netscaler, 5951 / 221 */
20777         {&hf_pie_netscaler_icaclientsidertt,
20778          {"ICA Clientside RTT", "cflow.pie.netscaler.ica-clientside-rtt",
20779           FT_UINT32, BASE_DEC, NULL, 0x0,
20780           NULL, HFILL}
20781         },
20782         /* netscaler, 5951 / 222 */
20783         {&hf_pie_netscaler_icaserversidertt,
20784          {"ICA Serverside RTT", "cflow.pie.netscaler.ica-serverside-rtt",
20785           FT_UINT32, BASE_DEC, NULL, 0x0,
20786           NULL, HFILL}
20787         },
20788         /* netscaler, 5951 / 223 */
20789         {&hf_pie_netscaler_icasessionupdatebeginsec,
20790          {"ICA Session Update Begin Sec", "cflow.pie.netscaler.ica-session-update-begin-sec",
20791           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
20792           NULL, HFILL}
20793         },
20794         /* netscaler, 5951 / 224 */
20795         {&hf_pie_netscaler_icasessionupdateendsec,
20796          {"ICA Session Update End Sec", "cflow.pie.netscaler.ica-session-update-end-sec",
20797           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
20798           NULL, HFILL}
20799         },
20800         /* netscaler, 5951 / 225 */
20801         {&hf_pie_netscaler_icachannelid1,
20802          {"ICA Channel Id1", "cflow.pie.netscaler.ica-channel-id1",
20803           FT_UINT32, BASE_HEX, NULL, 0x0,
20804           NULL, HFILL}
20805         },
20806         /* netscaler, 5951 / 226 */
20807         {&hf_pie_netscaler_icachannelid1bytes,
20808          {"ICA Channel Id1 Bytes", "cflow.pie.netscaler.ica-channel-id1-bytes",
20809           FT_UINT32, BASE_DEC, NULL, 0x0,
20810           NULL, HFILL}
20811         },
20812         /* netscaler, 5951 / 227 */
20813         {&hf_pie_netscaler_icachannelid2,
20814          {"ICA Channel Id2", "cflow.pie.netscaler.ica-channel-id2",
20815           FT_UINT32, BASE_HEX, NULL, 0x0,
20816           NULL, HFILL}
20817         },
20818         /* netscaler, 5951 / 228 */
20819         {&hf_pie_netscaler_icachannelid2bytes,
20820          {"ICA Channel Id2 Bytes", "cflow.pie.netscaler.ica-channel-id2-bytes",
20821           FT_UINT32, BASE_DEC, NULL, 0x0,
20822           NULL, HFILL}
20823         },
20824         /* netscaler, 5951 / 229 */
20825         {&hf_pie_netscaler_icachannelid3,
20826          {"ICA Channel Id3", "cflow.pie.netscaler.ica-channel-id3",
20827           FT_UINT32, BASE_HEX, NULL, 0x0,
20828           NULL, HFILL}
20829         },
20830         /* netscaler, 5951 / 230 */
20831         {&hf_pie_netscaler_icachannelid3bytes,
20832          {"ICA Channel Id3 Bytes", "cflow.pie.netscaler.ica-channel-id3-bytes",
20833           FT_UINT32, BASE_DEC, NULL, 0x0,
20834           NULL, HFILL}
20835         },
20836         /* netscaler, 5951 / 231 */
20837         {&hf_pie_netscaler_icachannelid4,
20838          {"ICA Channel Id4", "cflow.pie.netscaler.ica-channel-id4",
20839           FT_UINT32, BASE_HEX, NULL, 0x0,
20840           NULL, HFILL}
20841         },
20842         /* netscaler, 5951 / 232 */
20843         {&hf_pie_netscaler_icachannelid4bytes,
20844          {"ICA Channel Id4 Bytes", "cflow.pie.netscaler.ica-channel-id4-bytes",
20845           FT_UINT32, BASE_DEC, NULL, 0x0,
20846           NULL, HFILL}
20847         },
20848         /* netscaler, 5951 / 233 */
20849         {&hf_pie_netscaler_icachannelid5,
20850          {"ICA Channel Id5", "cflow.pie.netscaler.ica-channel-id5",
20851           FT_UINT32, BASE_HEX, NULL, 0x0,
20852           NULL, HFILL}
20853         },
20854         /* netscaler, 5951 / 234 */
20855         {&hf_pie_netscaler_icachannelid5bytes,
20856          {"ICA Channel Id5 Bytes", "cflow.pie.netscaler.ica-channel-id5-bytes",
20857           FT_UINT32, BASE_DEC, NULL, 0x0,
20858           NULL, HFILL}
20859         },
20860         /* netscaler, 5951 / 235 */
20861         {&hf_pie_netscaler_icaconnectionpriority,
20862          {"ICA Connection Priority", "cflow.pie.netscaler.ica-connection-priority",
20863           FT_UINT16, BASE_DEC, NULL, 0x0,
20864           NULL, HFILL}
20865         },
20866         /* netscaler, 5951 / 236 */
20867         {&hf_pie_netscaler_applicationstartupduration,
20868          {"Application Startup Duration", "cflow.pie.netscaler.application-startup-duration",
20869           FT_UINT32, BASE_DEC, NULL, 0x0,
20870           NULL, HFILL}
20871         },
20872         /* netscaler, 5951 / 237 */
20873         {&hf_pie_netscaler_icalaunchmechanism,
20874          {"ICA Launch Mechanism", "cflow.pie.netscaler.ica-launch-mechanism",
20875           FT_UINT16, BASE_HEX, NULL, 0x0,
20876           NULL, HFILL}
20877         },
20878         /* netscaler, 5951 / 238 */
20879         {&hf_pie_netscaler_icaapplicationname,
20880          {"ICA Application Name", "cflow.pie.netscaler.ica-application-name",
20881           FT_STRING, BASE_NONE, NULL, 0x0,
20882           NULL, HFILL}
20883         },
20884         /* netscaler, 5951 / 239 */
20885         {&hf_pie_netscaler_applicationstartuptime,
20886          {"Application Startup Time", "cflow.pie.netscaler.application-startup-time",
20887           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
20888           NULL, HFILL}
20889         },
20890         /* netscaler, 5951 / 240 */
20891         {&hf_pie_netscaler_icaapplicationterminationtype,
20892          {"ICA Application Termination Type", "cflow.pie.netscaler.ica-application-termination-type",
20893           FT_UINT16, BASE_HEX, NULL, 0x0,
20894           NULL, HFILL}
20895         },
20896         /* netscaler, 5951 / 241 */
20897         {&hf_pie_netscaler_icaapplicationterminationtime,
20898          {"ICA Application Termination Time", "cflow.pie.netscaler.ica-application-termination-time",
20899           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_seconds), 0x0,
20900           NULL, HFILL}
20901         },
20902         /* netscaler, 5951 / 242 */
20903         {&hf_pie_netscaler_icasessionendtime,
20904          {"ICA Session End Time", "cflow.pie.netscaler.ica-session-end-time",
20905           FT_UINT64, BASE_DEC|BASE_UNIT_STRING, UNS(&units_seconds), 0x0,
20906           NULL, HFILL}
20907         },
20908         /* netscaler, 5951 / 243 */
20909         {&hf_pie_netscaler_icaclientsidejitter,
20910          {"ICA Clientside Jitter", "cflow.pie.netscaler.ica-clientside-jitter",
20911           FT_UINT32, BASE_DEC, NULL, 0x0,
20912           NULL, HFILL}
20913         },
20914         /* netscaler, 5951 / 244 */
20915         {&hf_pie_netscaler_icaserversidejitter,
20916          {"ICA Serverside Jitter", "cflow.pie.netscaler.ica-serverside-jitter",
20917           FT_UINT32, BASE_DEC, NULL, 0x0,
20918           NULL, HFILL}
20919         },
20920         /* netscaler, 5951 / 245 */
20921         {&hf_pie_netscaler_icaappprocessid,
20922          {"ICA App Process ID", "cflow.pie.netscaler.ica-app-processid",
20923           FT_UINT32, BASE_DEC_HEX, NULL, 0x0,
20924           NULL, HFILL}
20925         },
20926         /* netscaler, 5951 / 246 */
20927         {&hf_pie_netscaler_icaappmodulepath,
20928          {"ICA AppModule Path", "cflow.pie.netscaler.ica-appmodule-path",
20929           FT_STRING, BASE_NONE, NULL, 0x0,
20930           NULL, HFILL}
20931         },
20932         /* netscaler, 5951 / 247 */
20933         {&hf_pie_netscaler_icadeviceserialno,
20934          {"ICA Device Serial No", "cflow.pie.netscaler.ica-device-serial-no",
20935           FT_UINT32, BASE_DEC, NULL, 0x0,
20936           NULL, HFILL}
20937         },
20938         /* netscaler, 5951 / 248 */
20939         {&hf_pie_netscaler_msiclientcookie,
20940          {"Msi Client Cookie", "cflow.pie.netscaler.msi-client-cookie",
20941           FT_BYTES, BASE_NONE, NULL, 0x0,
20942           NULL, HFILL}
20943         },
20944         /* netscaler, 5951 / 249 */
20945         {&hf_pie_netscaler_icaflags,
20946          {"ICA Flags", "cflow.pie.netscaler.ica-flags",
20947           FT_UINT64, BASE_HEX, NULL, 0x0,
20948           NULL, HFILL}
20949         },
20950         /* netscaler, 5951 / 250 */
20951         {&hf_pie_netscaler_icausername,
20952          {"ICA Username", "cflow.pie.netscaler.icau-sername",
20953           FT_STRING, BASE_NONE, NULL, 0x0,
20954           NULL, HFILL}
20955         },
20956         /* netscaler, 5951 / 251 */
20957         {&hf_pie_netscaler_licensetype,
20958          {"License Type", "cflow.pie.netscaler.license-type",
20959           FT_UINT8, BASE_DEC, NULL, 0x0,
20960           NULL, HFILL}
20961         },
20962         /* netscaler, 5951 / 252 */
20963         {&hf_pie_netscaler_maxlicensecount,
20964          {"Max License Count", "cflow.pie.netscaler.max-license-count",
20965           FT_UINT64, BASE_DEC, NULL, 0x0,
20966           NULL, HFILL}
20967         },
20968         /* netscaler, 5951 / 253 */
20969         {&hf_pie_netscaler_currentlicenseconsumed,
20970          {"Current License Consumed", "cflow.pie.netscaler.current-license-consumed",
20971           FT_UINT64, BASE_DEC, NULL, 0x0,
20972           NULL, HFILL}
20973         },
20974         /* netscaler, 5951 / 254 */
20975         {&hf_pie_netscaler_icanetworkupdatestarttime,
20976          {"ICA Network Update Start Time", "cflow.pie.netscaler.ica-network-update-start-time",
20977           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
20978           NULL, HFILL}
20979         },
20980         /* netscaler, 5951 / 255 */
20981         {&hf_pie_netscaler_icanetworkupdateendtime,
20982          {"ICA Network Update End Time", "cflow.pie.netscaler.ica-network-update-end-time",
20983           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
20984           NULL, HFILL}
20985         },
20986         /* netscaler, 5951 / 256 */
20987         {&hf_pie_netscaler_icaclientsidesrtt,
20988          {"ICA Clientside SRTT", "cflow.pie.netscaler.ica-clientside-srtt",
20989           FT_UINT32, BASE_DEC, NULL, 0x0,
20990           "ICA Clientside smoothed RTT", HFILL}
20991         },
20992         /* netscaler, 5951 / 257 */
20993         {&hf_pie_netscaler_icaserversidesrtt,
20994          {"ICA Serverside SRTT", "cflow.pie.netscaler.ica-serverside-srtt",
20995           FT_UINT32, BASE_DEC, NULL, 0x0,
20996           "ICA Serverside smoothed RTT", HFILL}
20997         },
20998         /* netscaler, 5951 / 258 */
20999         {&hf_pie_netscaler_icaclientsidedelay,
21000          {"ICA Clientside Delay", "cflow.pie.netscaler.ica-clientsi-dedelay",
21001           FT_UINT32, BASE_DEC, NULL, 0x0,
21002           NULL, HFILL}
21003         },
21004         /* netscaler, 5951 / 259 */
21005         {&hf_pie_netscaler_icaserversidedelay,
21006          {"ICA Serverside Delay", "cflow.pie.netscaler.ica-serversi-dedelay",
21007           FT_UINT32, BASE_DEC, NULL, 0x0,
21008           NULL, HFILL}
21009         },
21010         /* netscaler, 5951 / 260 */
21011         {&hf_pie_netscaler_icahostdelay,
21012          {"ICA Host Delay", "cflow.pie.netscaler.ica-host-delay",
21013           FT_UINT32, BASE_DEC, NULL, 0x0,
21014           NULL, HFILL}
21015         },
21016         /* netscaler, 5951 / 261 */
21017         {&hf_pie_netscaler_icaclientsidewindowsize,
21018          {"ICA Clientside WindowSize", "cflow.pie.netscaler.ica-clientside-windowsize",
21019           FT_UINT16, BASE_DEC, NULL, 0x0,
21020           NULL, HFILL}
21021         },
21022         /* netscaler, 5951 / 262 */
21023         {&hf_pie_netscaler_icaserversidewindowsize,
21024          {"ICA Serverside WindowSize", "cflow.pie.netscaler.ica-serverside-windowsize",
21025           FT_UINT16, BASE_DEC, NULL, 0x0,
21026           NULL, HFILL}
21027         },
21028         /* netscaler, 5951 / 263 */
21029         {&hf_pie_netscaler_icaclientsidertocount,
21030          {"ICA Clientside RTO Count", "cflow.pie.netscaler.ica-clientside-rto-count",
21031           FT_UINT16, BASE_DEC, NULL, 0x0,
21032           "ICA Clientside retrans timeout occurred Count", HFILL}
21033         },
21034         /* netscaler, 5951 / 264 */
21035         {&hf_pie_netscaler_icaserversidertocount,
21036          {"ICA Serverside RTO Count", "cflow.pie.netscaler.ica-serverside-rto-count",
21037           FT_UINT16, BASE_DEC, NULL, 0x0,
21038           "ICA Serverside retrans timeout occurred Count", HFILL}
21039         },
21040         /* netscaler, 5951 / 265 */
21041         {&hf_pie_netscaler_ical7clientlatency,
21042          {"ICA L7 Client Latency", "cflow.pie.netscaler.ica-l7-client-latency",
21043           FT_UINT32, BASE_DEC, NULL, 0x0,
21044           NULL, HFILL}
21045         },
21046         /* netscaler, 5951 / 266 */
21047         {&hf_pie_netscaler_ical7serverlatency,
21048          {"ICA L7 Server Latency", "cflow.pie.netscaler.ica-l7-server-latency",
21049           FT_UINT32, BASE_DEC, NULL, 0x0,
21050           NULL, HFILL}
21051         },
21052         /* netscaler, 5951 / 267 */
21053         {&hf_pie_netscaler_httpdomainname,
21054          {"HTTP Domain Name", "cflow.pie.netscaler.http-domain-name",
21055           FT_STRING, BASE_NONE, NULL, 0x0,
21056           NULL, HFILL}
21057         },
21058         /* netscaler, 5951 / 268 */
21059         {&hf_pie_netscaler_cacheredirclientconnectioncoreid,
21060          {"CacheRedir Client Connection Core ID", "cflow.pie.netscaler.cacheredir-client-connection-coreid",
21061           FT_UINT32, BASE_HEX, NULL, 0x0,
21062           NULL, HFILL}
21063         },
21064         /* netscaler, 5951 / 269 */
21065         {&hf_pie_netscaler_cacheredirclientconnectiontransactionid,
21066          {"CacheRedir Client Connection Transaction ID", "cflow.pie.netscaler.cacheredir-client-connectiontransactionid",
21067           FT_UINT32, BASE_HEX, NULL, 0x0,
21068           NULL, HFILL}
21069         },
21070
21071         /* Barracuda root (a hidden item to allow filtering) */
21072         {&hf_pie_barracuda,
21073          {"Barracuda", "cflow.pie.barracuda",
21074           FT_NONE, BASE_NONE, NULL, 0x0,
21075           NULL, HFILL}
21076         },
21077         /* Barracuda, 10704 / 1 */
21078         {&hf_pie_barracuda_timestamp,
21079          {"Timestamp", "cflow.pie.barracuda.timestamp",
21080           FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0,
21081           "Seconds since epoch", HFILL}
21082         },
21083         /* Barracuda, 10704 / 2 */
21084         {&hf_pie_barracuda_logop,
21085          {"LogOp", "cflow.pie.barracuda.logop",
21086           FT_UINT8, BASE_DEC, VALS(v10_barracuda_logop), 0x0,
21087           NULL, HFILL}
21088         },
21089         /* Barracuda, 10704 / 3 */
21090         {&hf_pie_barracuda_traffictype,
21091          {"Traffic Type", "cflow.pie.barracuda.traffictype",
21092           FT_UINT8, BASE_DEC, VALS(v10_barracuda_traffictype), 0x0,
21093           NULL, HFILL}
21094         },
21095         /* Barracuda, 10704 / 4 */
21096         {&hf_pie_barracuda_fwrule,
21097          {"FW Rule", "cflow.pie.barracuda.fwrule",
21098           FT_STRING, BASE_NONE, NULL, 0x0,
21099           "Name of FW Rule", HFILL}
21100         },
21101         /* Barracuda, 10704 / 5 */
21102         {&hf_pie_barracuda_servicename,
21103          {"Service Name", "cflow.pie.barracuda.servicename",
21104           FT_STRING, BASE_NONE, NULL, 0x0,
21105           NULL, HFILL}
21106         },
21107         /* Barracuda, 10704 / 6 */
21108         {&hf_pie_barracuda_reason,
21109          {"Reason", "cflow.pie.barracuda.reason",
21110           FT_UINT32, BASE_DEC, NULL, 0x0,
21111           NULL, HFILL}
21112         },
21113         /* Barracuda, 10704 / 7 */
21114         {&hf_pie_barracuda_reasontext,
21115          {"Reason Text", "cflow.pie.barracuda.reasontext",
21116           FT_STRING, BASE_NONE, NULL, 0x0,
21117           NULL, HFILL}
21118         },
21119         /* Barracuda, 10704 / 8 */
21120         {&hf_pie_barracuda_bindipv4address,
21121          {"Bind IPv4 Address", "cflow.pie.barracuda.bindipv4address",
21122           FT_IPv4, BASE_NONE, NULL, 0x0,
21123           NULL, HFILL}
21124         },
21125         /* Barracuda, 10704 / 9 */
21126         {&hf_pie_barracuda_bindtransportport,
21127          {"Bind Transport Port", "cflow.pie.barracuda.bindtransportport",
21128           FT_UINT16, BASE_DEC, NULL, 0x0,
21129           NULL, HFILL}
21130         },
21131         /* Barracuda, 10704 / 10 */
21132         {&hf_pie_barracuda_connipv4address,
21133          {"Conn IPv4 Address", "cflow.pie.barracuda.connipv4address",
21134           FT_IPv4, BASE_NONE, NULL, 0x0,
21135           NULL, HFILL}
21136         },
21137         /* Barracuda, 10704 / 11 */
21138         {&hf_pie_barracuda_conntransportport,
21139          {"Conn Transport Port", "cflow.pie.barracuda.conntransportport",
21140           FT_UINT16, BASE_DEC, NULL, 0x0,
21141           NULL, HFILL}
21142         },
21143         /* Barracuda, 10704 / 12 */
21144         {&hf_pie_barracuda_auditcounter,
21145          {"Audit Counter", "cflow.pie.barracuda.auditcounter",
21146           FT_UINT32, BASE_DEC, NULL, 0x0,
21147           "Internal Data Counter", HFILL}
21148         },
21149
21150         /* Gigamon root (a hidden item to allow filtering) */
21151         {&hf_pie_gigamon,
21152          {"Gigamon", "cflow.pie.gigamon",
21153           FT_NONE, BASE_NONE, NULL, 0x0,
21154           NULL, HFILL}
21155         },
21156         /* gigamon, 26866 / 1 */
21157         {&hf_pie_gigamon_httprequrl,
21158          {"HttpReqUrl", "cflow.pie.gigamon.httprequrl",
21159           FT_STRING, BASE_NONE, NULL, 0x0,
21160           NULL, HFILL}
21161         },
21162         /* gigamon, 26866 / 2 */
21163         {&hf_pie_gigamon_httprspstatus,
21164          {"HttpRspStatus", "cflow.pie.gigamon.httprspstatus",
21165           FT_UINT16, BASE_DEC, NULL, 0x0,
21166           NULL, HFILL}
21167         },
21168         /* gigamon, 26866 / 101 */
21169         {&hf_pie_gigamon_sslcertificateissuercommonname,
21170          {"SslCertificateIssuerCommonName", "cflow.pie.gigamon.sslcertificateissuercommonname",
21171           FT_STRING, BASE_NONE, NULL, 0x0,
21172           NULL, HFILL}
21173         },
21174         /* gigamon, 26866 / 102 */
21175         {&hf_pie_gigamon_sslcertificatesubjectcommonname,
21176          {"SslCertificateSubjectCommonName", "cflow.pie.gigamon.sslcertificatesubjectcommonname",
21177           FT_STRING, BASE_NONE, NULL, 0x0,
21178           NULL, HFILL}
21179         },
21180         /* gigamon, 26866 / 103 */
21181         {&hf_pie_gigamon_sslcertificateissuer,
21182          {"SslCertificateIssuer", "cflow.pie.gigamon.sslcertificateissuer",
21183           FT_STRING, BASE_NONE, NULL, 0x0,
21184           NULL, HFILL}
21185         },
21186         /* gigamon, 26866 / 104 */
21187         {&hf_pie_gigamon_sslcertificatesubject,
21188          {"SslCertificateSubject", "cflow.pie.gigamon.sslcertificatesubject",
21189           FT_STRING, BASE_NONE, NULL, 0x0,
21190           NULL, HFILL}
21191         },
21192         /* gigamon, 26866 / 105 */
21193         {&hf_pie_gigamon_sslcertificatevalidnotbefore,
21194          {"SslCertificateValidNotBefore", "cflow.pie.gigamon.sslcertificatevalidnotbefore",
21195           FT_STRING, BASE_NONE, NULL, 0x0,
21196           NULL, HFILL}
21197         },
21198         /* gigamon, 26866 / 106 */
21199         {&hf_pie_gigamon_sslcertificatevalidnotafter,
21200          {"SslCertificateValidNotAfter", "cflow.pie.gigamon.sslcertificatevalidnotafter",
21201           FT_STRING, BASE_NONE, NULL, 0x0,
21202           NULL, HFILL}
21203         },
21204         /* gigamon, 26866 / 107 */
21205         {&hf_pie_gigamon_sslcertificateserialnumber,
21206          {"SslCertificateSerialNumber", "cflow.pie.gigamon.sslcertificateserialnumber",
21207           FT_BYTES, BASE_NONE, NULL, 0x0,
21208           NULL, HFILL}
21209         },
21210         /* gigamon, 26866 / 108 */
21211         {&hf_pie_gigamon_sslcertificatesignaturealgorithm,
21212          {"SslCertificateSignatureAlgorithm", "cflow.pie.gigamon.sslcertificatesignaturealgorithm",
21213           FT_BYTES, BASE_NONE, NULL, 0x0,
21214           NULL, HFILL}
21215         },
21216         /* gigamon, 26866 / 109 */
21217         {&hf_pie_gigamon_sslcertificatesubjectpubalgorithm,
21218          {"SslCertificateSubjectPubAlgorithm", "cflow.pie.gigamon.sslcertificatesubjectpubalgorithm",
21219           FT_BYTES, BASE_NONE, NULL, 0x0,
21220           NULL, HFILL}
21221         },
21222
21223         /* gigamon, 26866 / 110 */
21224         {&hf_pie_gigamon_sslcertificatesubjectpubkeysize,
21225          {"SslCertificateSubjectPubKeySize", "cflow.pie.gigamon.sslcertificatesubjectpubkeysize",
21226           FT_UINT16, BASE_DEC, NULL, 0x0,
21227           NULL, HFILL}
21228         },
21229         /* gigamon, 26866 / 111 */
21230         {&hf_pie_gigamon_sslcertificatesubjectaltname,
21231          {"SslCertificateSubjectAltName", "cflow.pie.gigamon.sslcertificatesubjectaltname",
21232           FT_STRING, BASE_NONE, NULL, 0x0,
21233           NULL, HFILL}
21234         },
21235         /* gigamon, 26866 / 112 */
21236         {&hf_pie_gigamon_sslservernameindication,
21237          {"SslServerNameIndication", "cflow.pie.gigamon.sslservernameindication",
21238           FT_STRING, BASE_NONE, NULL, 0x0,
21239           NULL, HFILL}
21240         },
21241         /* gigamon, 26866 / 113 */
21242         {&hf_pie_gigamon_sslserverversion,
21243          {"SslServerVersion", "cflow.pie.gigamon.sslserverversion",
21244           FT_UINT16, BASE_DEC, NULL, 0x0,
21245           NULL, HFILL}
21246         },
21247         /* gigamon, 26866 / 114 */
21248         {&hf_pie_gigamon_sslservercipher,
21249          {"SslServerCipher", "cflow.pie.gigamon.sslservercipher",
21250           FT_UINT16, BASE_DEC, NULL, 0x0,
21251           NULL, HFILL}
21252         },
21253         /* gigamon, 26866 / 115 */
21254         {&hf_pie_gigamon_sslservercompressionmethod,
21255          {"SslServerCompressionMethod", "cflow.pie.gigamon.sslservercompressionmethod",
21256           FT_UINT8, BASE_DEC, NULL, 0x0,
21257           NULL, HFILL}
21258         },
21259         /* gigamon, 26866 / 116 */
21260         {&hf_pie_gigamon_sslserversessionid,
21261          {"SslServerSessionId", "cflow.pie.gigamon.sslserversessionid",
21262           FT_BYTES, BASE_NONE, NULL, 0x0,
21263           NULL, HFILL}
21264         },
21265         /* gigamon, 26866 / 201 */
21266         {&hf_pie_gigamon_dnsidentifier,
21267          {"DnsIdentifier", "cflow.pie.gigamon.dnsidentifier",
21268           FT_UINT16, BASE_DEC, NULL, 0x0,
21269           NULL, HFILL}
21270         },
21271         /* gigamon, 26866 / 202 */
21272         {&hf_pie_gigamon_dnsopcode,
21273          {"DnsOpCode", "cflow.pie.gigamon.dnsopcode",
21274           FT_UINT8, BASE_DEC, NULL, 0x0,
21275           NULL, HFILL}
21276         },
21277         /* gigamon, 26866 / 203 */
21278         {&hf_pie_gigamon_dnsresponsecode,
21279          {"DnsResponseCode", "cflow.pie.gigamon.dnsresponsecode",
21280           FT_UINT8, BASE_DEC, NULL, 0x0,
21281           NULL, HFILL}
21282         },
21283         /* gigamon, 26866 / 204 */
21284         {&hf_pie_gigamon_dnsqueryname,
21285          {"DnsQueryName", "cflow.pie.gigamon.dnsqueryname",
21286           FT_STRING, BASE_NONE, NULL, 0x0,
21287           NULL, HFILL}
21288         },
21289         /* gigamon, 26866 / 205 */
21290         {&hf_pie_gigamon_dnsresponsename,
21291          {"DnsResponseName", "cflow.pie.gigamon.dnsresponsename",
21292           FT_STRING, BASE_NONE, NULL, 0x0,
21293           NULL, HFILL}
21294         },
21295         /* gigamon, 26866 / 206 */
21296         {&hf_pie_gigamon_dnsresponsettl,
21297          {"DnsResponseTTL", "cflow.pie.gigamon.dnsresponsettl",
21298           FT_UINT32, BASE_DEC, NULL, 0x0,
21299           NULL, HFILL}
21300         },
21301         /* gigamon, 26866 / 207 */
21302         {&hf_pie_gigamon_dnsresponseipv4address,
21303          {"DnsResponseIPv4Address", "cflow.pie.gigamon.dnsresponseipv4address",
21304           FT_IPv4, BASE_NONE, NULL, 0x0,
21305           NULL, HFILL}
21306         },
21307         /* gigamon, 26866 / 208 */
21308         {&hf_pie_gigamon_dnsresponseipv6address,
21309          {"DnsResponseIPv6Address", "cflow.pie.gigamon.dnsresponseipv6address",
21310           FT_IPv6, BASE_NONE, NULL, 0x0,
21311           NULL, HFILL}
21312         },
21313         /* gigamon, 26866 / 209 */
21314         {&hf_pie_gigamon_dnsbits,
21315          {"DnsBits", "cflow.pie.gigamon.dnsbits",
21316           FT_STRING, BASE_NONE, NULL, 0x0,
21317           NULL, HFILL}
21318         },
21319         /* gigamon, 26866 / 210 */
21320         {&hf_pie_gigamon_dnsqdcount,
21321          {"DnsQdCount", "cflow.pie.gigamon.dnsqdcount",
21322           FT_UINT16, BASE_DEC, NULL, 0x0,
21323           NULL, HFILL}
21324         },
21325         /* gigamon, 26866 / 211 */
21326         {&hf_pie_gigamon_dnsancount,
21327          {"DnsAnCount", "cflow.pie.gigamon.dnsancount",
21328           FT_UINT16, BASE_DEC, NULL, 0x0,
21329           NULL, HFILL}
21330         },
21331         /* gigamon, 26866 / 212 */
21332         {&hf_pie_gigamon_dnsnscount,
21333          {"DnsNsCount", "cflow.pie.gigamon.dnsnscount",
21334           FT_UINT16, BASE_DEC, NULL, 0x0,
21335           NULL, HFILL}
21336         },
21337         /* gigamon, 26866 / 213 */
21338         {&hf_pie_gigamon_dnsarcount,
21339          {"DnsArCount", "cflow.pie.gigamon.dnsarcount",
21340           FT_UINT16, BASE_DEC, NULL, 0x0,
21341           NULL, HFILL}
21342         },
21343         /* gigamon, 26866 / 214 */
21344         {&hf_pie_gigamon_dnsquerytype,
21345          {"DnsQueryType", "cflow.pie.gigamon.dnsquerytype",
21346           FT_UINT16, BASE_DEC, NULL, 0x0,
21347           NULL, HFILL}
21348         },
21349         /* gigamon, 26866 / 215 */
21350         {&hf_pie_gigamon_dnsqueryclass,
21351          {"DnsQueryClass", "cflow.pie.gigamon.dnsqueryclass",
21352           FT_UINT16, BASE_DEC, NULL, 0x0,
21353           NULL, HFILL}
21354         },
21355         /* gigamon, 26866 / 216 */
21356         {&hf_pie_gigamon_dnsresponsetype,
21357          {"DnsResponseType", "cflow.pie.gigamon.dnsresponsetype",
21358           FT_UINT16, BASE_DEC, NULL, 0x0,
21359           NULL, HFILL}
21360         },
21361         /* gigamon, 26866 / 217 */
21362         {&hf_pie_gigamon_dnsresponseclass,
21363          {"DnsResponseClass", "cflow.pie.gigamon.dnsresponseclass",
21364           FT_UINT16, BASE_DEC, NULL, 0x0,
21365           NULL, HFILL}
21366         },
21367         /* gigamon, 26866 / 218 */
21368         {&hf_pie_gigamon_dnsresponserdlength,
21369          {"DnsResponseRdLength", "cflow.pie.gigamon.dnsresponserdlength",
21370           FT_UINT16, BASE_DEC, NULL, 0x0,
21371           NULL, HFILL}
21372         },
21373         /* gigamon, 26866 / 219 */
21374         {&hf_pie_gigamon_dnsresponserdata,
21375          {"DnsResponseRdata", "cflow.pie.gigamon.dnsresponserdata",
21376           FT_STRING, BASE_NONE, NULL, 0x0,
21377           NULL, HFILL}
21378         },
21379         /* gigamon, 26866 / 220 */
21380         {&hf_pie_gigamon_dnsauthorityname,
21381          {"DnsAuthorityName", "cflow.pie.gigamon.dnsauthorityname",
21382           FT_STRING, BASE_NONE, NULL, 0x0,
21383           NULL, HFILL}
21384         },
21385         /* gigamon, 26866 / 221 */
21386         {&hf_pie_gigamon_dnsauthoritytype,
21387          {"DnsAuthorityType", "cflow.pie.gigamon.dnsauthoritytype",
21388           FT_UINT16, BASE_DEC, NULL, 0x0,
21389           NULL, HFILL}
21390         },
21391         /* gigamon, 26866 / 222 */
21392         {&hf_pie_gigamon_dnsauthorityclass,
21393          {"DnsAuthorityClass", "cflow.pie.gigamon.dnsauthorityclass",
21394           FT_UINT16, BASE_DEC, NULL, 0x0,
21395           NULL, HFILL}
21396         },
21397         /* gigamon, 26866 / 223 */
21398         {&hf_pie_gigamon_dnsauthorityttl,
21399          {"DnsAuthorityTTL", "cflow.pie.gigamon.dnsauthorityttl",
21400           FT_UINT32, BASE_DEC, NULL, 0x0,
21401           NULL, HFILL}
21402         },
21403         /* gigamon, 26866 / 224 */
21404         {&hf_pie_gigamon_dnsauthorityrdlength,
21405          {"DnsAuthorityRdLength", "cflow.pie.gigamon.dnsauthorityrdlength",
21406           FT_UINT16, BASE_DEC, NULL, 0x0,
21407           NULL, HFILL}
21408         },
21409         /* gigamon, 26866 / 225 */
21410         {&hf_pie_gigamon_dnsauthorityrdata,
21411          {"DnsAuthorityRdata", "cflow.pie.gigamon.dnsauthorityrdata",
21412           FT_STRING, BASE_NONE, NULL, 0x0,
21413           NULL, HFILL}
21414         },
21415         /* gigamon, 26866 / 226 */
21416         {&hf_pie_gigamon_dnsadditionalname,
21417          {"DnsAdditionalName", "cflow.pie.gigamon.dnsadditionalname",
21418           FT_STRING, BASE_NONE, NULL, 0x0,
21419           NULL, HFILL}
21420         },
21421         /* gigamon, 26866 / 227 */
21422         {&hf_pie_gigamon_dnsadditionaltype,
21423          {"DnsAdditionalType", "cflow.pie.gigamon.dnsadditionaltype",
21424           FT_UINT16, BASE_DEC, NULL, 0x0,
21425           NULL, HFILL}
21426         },
21427         /* gigamon, 26866 / 228 */
21428         {&hf_pie_gigamon_dnsadditionalclass,
21429          {"DnsAdditionalClass", "cflow.pie.gigamon.dnsadditionalclass",
21430           FT_UINT16, BASE_DEC, NULL, 0x0,
21431           NULL, HFILL}
21432         },
21433         /* gigamon, 26866 / 229 */
21434         {&hf_pie_gigamon_dnsadditionalttl,
21435          {"DnsAdditionalTTL", "cflow.pie.gigamon.dnsadditionalttl",
21436           FT_UINT32, BASE_DEC, NULL, 0x0,
21437           NULL, HFILL}
21438         },
21439         /* gigamon, 26866 / 230 */
21440         {&hf_pie_gigamon_dnsadditionalrdlength,
21441          {"DnsAdditionalRdLength", "cflow.pie.gigamon.dnsadditionalrdlength",
21442           FT_UINT16, BASE_DEC, NULL, 0x0,
21443           NULL, HFILL}
21444         },
21445         /* gigamon, 26866 / 231 */
21446         {&hf_pie_gigamon_dnsadditionalrdata,
21447          {"DnsAdditionalRdata", "cflow.pie.gigamon.dnsadditionalrdata",
21448           FT_STRING, BASE_NONE, NULL, 0x0,
21449           NULL, HFILL}
21450         },
21451         /* Niagara Networks root (a hidden item to allow filtering) */
21452         {&hf_pie_niagara_networks,
21453          {"NiagaraNetworks", "cflow.pie.niagaranetworks",
21454           FT_NONE, BASE_NONE, NULL, 0x0,
21455           NULL, HFILL}
21456         },
21457         /* Niagara Networks, 47729 / 100 */
21458         {&hf_pie_niagara_networks_sslservernameindication,
21459          {"SslServerNameIndication", "cflow.pie.niagaranetworks.sslservernameindication",
21460           FT_STRING, BASE_NONE, NULL, 0x0,
21461           NULL, HFILL}
21462         },
21463         /* Niagara Networks, 47729 / 101 */
21464         {&hf_pie_niagara_networks_sslserverversion,
21465          {"SslServerVersion", "cflow.pie.niagaranetworks.sslserverversion",
21466           FT_UINT16, BASE_HEX, NULL, 0x0,
21467           NULL, HFILL}
21468         },
21469         /* Niagara Networks, 47729 / 102 */
21470         {&hf_pie_niagara_networks_sslserverversiontext,
21471          {"SslServerVersionText", "cflow.pie.niagaranetworks.sslserverversiontext",
21472           FT_STRING, BASE_NONE, NULL, 0x0,
21473           NULL, HFILL}
21474         },
21475         /* Niagara Networks, 47729 / 103 */
21476         {&hf_pie_niagara_networks_sslservercipher,
21477          {"SslServerCipher", "cflow.pie.niagaranetworks.sslservercipher",
21478           FT_UINT16, BASE_HEX, NULL, 0x0,
21479           NULL, HFILL}
21480         },
21481         /* Niagara Networks, 47729 / 104 */
21482         {&hf_pie_niagara_networks_sslserverciphertext,
21483          {"SslServerCipherText", "cflow.pie.niagaranetworks.sslserverciphertext",
21484           FT_STRING, BASE_NONE, NULL, 0x0,
21485           NULL, HFILL}
21486         },
21487         /* Niagara Networks, 47729 / 105 */
21488         {&hf_pie_niagara_networks_sslconnectionencryptiontype,
21489          {"SslConnectionEncryptionType", "cflow.pie.niagaranetworks.sslconnectionencryptiontype",
21490           FT_STRING, BASE_NONE, NULL, 0x0,
21491           NULL, HFILL}
21492         },
21493         /* Niagara Networks, 47729 / 106 */
21494         {&hf_pie_niagara_networks_sslservercompressionmethod,
21495          {"SslServerCompressionMethod", "cflow.pie.niagaranetworks.sslservercompressionmethod",
21496           FT_STRING, BASE_NONE, NULL, 0x0,
21497           NULL, HFILL}
21498         },
21499         /* Niagara Networks, 47729 / 107 */
21500         {&hf_pie_niagara_networks_sslserversessionid,
21501          {"SslServerSessionId", "cflow.pie.niagaranetworks.sslserversessionid",
21502           FT_BYTES, BASE_NONE, NULL, 0x0,
21503           NULL, HFILL}
21504         },
21505         /* Niagara Networks, 47729 / 108 */
21506         {&hf_pie_niagara_networks_sslcertificateissuer,
21507          {"SslCertificateIssuer", "cflow.pie.niagaranetworks.sslcertificateissuer",
21508           FT_STRING, BASE_NONE, NULL, 0x0,
21509           NULL, HFILL}
21510         },
21511         /* Niagara Networks, 47729 / 109 */
21512         {&hf_pie_niagara_networks_sslcertificateissuername,
21513          {"SslCertificateIssuerName", "cflow.pie.niagaranetworks.sslcertificateissuername",
21514           FT_STRING, BASE_NONE, NULL, 0x0,
21515           NULL, HFILL}
21516         },
21517         /* Niagara Networks, 47729 / 110 */
21518         {&hf_pie_niagara_networks_sslcertificatesubject,
21519          {"SslCertificateSubject", "cflow.pie.niagaranetworks.sslcertificatesubject",
21520           FT_STRING, BASE_NONE, NULL, 0x0,
21521           NULL, HFILL}
21522         },
21523         /* Niagara Networks, 47729 / 111 */
21524         {&hf_pie_niagara_networks_sslcertificatesubjectname,
21525          {"SslCertificateSubjectName", "cflow.pie.niagaranetworks.sslcertificatesubjectname",
21526           FT_STRING, BASE_NONE, NULL, 0x0,
21527           NULL, HFILL}
21528         },
21529         /* Niagara Networks, 47729 / 112 */
21530         {&hf_pie_niagara_networks_sslcertificatevalidnotbefore,
21531          {"SslCertificateValidNotBefore", "cflow.pie.niagaranetworks.sslcertificatevalidnotbefore",
21532           FT_STRING, BASE_NONE, NULL, 0x0,
21533           NULL, HFILL}
21534         },
21535         /* Niagara Networks, 47729 / 113 */
21536         {&hf_pie_niagara_networks_sslcertificatevalidnotafter,
21537          {"SslCertificateValidNotAfter", "cflow.pie.niagaranetworks.sslcertificatevalidnotafter",
21538           FT_STRING, BASE_NONE, NULL, 0x0,
21539           NULL, HFILL}
21540         },
21541         /* Niagara Networks, 47729 / 114 */
21542         {&hf_pie_niagara_networks_sslcertificateserialnumber,
21543          {"SslCertificateSerialNumber", "cflow.pie.niagaranetworks.sslcertificateserialnumber",
21544           FT_STRING, BASE_NONE, NULL, 0x0,
21545           NULL, HFILL}
21546         },
21547         /* Niagara Networks, 47729 / 115 */
21548         {&hf_pie_niagara_networks_sslcertificatesignaturealgorithm,
21549          {"SslCertificateSignatureAlgorithm", "cflow.pie.niagaranetworks.sslcertificatesignaturealgorithm",
21550           FT_STRING, BASE_NONE, NULL, 0x0,
21551           NULL, HFILL}
21552         },
21553         /* Niagara Networks, 47729 / 116 */
21554         {&hf_pie_niagara_networks_sslcertificatesignaturealgorithmtext,
21555          {"SslCertificateSignatureAlgorithmText", "cflow.pie.niagaranetworks.sslcertificatesignaturealgorithmtext",
21556           FT_STRING, BASE_NONE, NULL, 0x0,
21557           NULL, HFILL}
21558         },
21559         /* Niagara Networks, 47729 / 117 */
21560         {&hf_pie_niagara_networks_sslcertificatesubjectpublickeysize,
21561          {"SslCertificateSubjectPublicKeySize", "cflow.pie.niagaranetworks.sslcertificatesubjectpublickeysize",
21562           FT_UINT16, BASE_DEC, NULL, 0x0,
21563           NULL, HFILL}
21564         },
21565         /* Niagara Networks, 47729 / 118 */
21566         {&hf_pie_niagara_networks_sslcertificatesubjectpublicalgorithm,
21567          {"SslCertificateSubjectPublicAlgorithm", "cflow.pie.niagaranetworks.sslcertificatesubjectpublicalgorithm",
21568           FT_STRING, BASE_NONE, NULL, 0x0,
21569           NULL, HFILL}
21570         },
21571         /* Niagara Networks, 47729 / 119 */
21572         {&hf_pie_niagara_networks_sslcertificatesubjectpublicalgorithmtext,
21573          {"SslCertificateSubjectPublicAlgorithmText", "cflow.pie.niagaranetworks.sslcertificatesubjectpublicalgorithmtext",
21574           FT_STRING, BASE_NONE, NULL, 0x0,
21575           NULL, HFILL}
21576         },
21577         /* Niagara Networks, 47729 / 120 */
21578         {&hf_pie_niagara_networks_sslcertificatesubjectalgorithmtext,
21579          {"SslCertificateSubjectAlgorithmText", "cflow.pie.niagaranetworks.sslcertificatesubjectalgorithmtext",
21580           FT_STRING, BASE_NONE, NULL, 0x0,
21581           NULL, HFILL}
21582         },
21583         /* Niagara Networks, 47729 / 121 */
21584         {&hf_pie_niagara_networks_sslcertificatesubjectalternativename,
21585          {"SslCertificateSubjectAlternativeName", "cflow.pie.niagaranetworks.sslcertificatesubjectalternativename",
21586           FT_STRING, BASE_NONE, NULL, 0x0,
21587           NULL, HFILL}
21588         },
21589         /* Niagara Networks, 47729 / 122 */
21590         {&hf_pie_niagara_networks_sslcertificatesha1,
21591          {"SslCertificateSha1", "cflow.pie.niagaranetworks.sslcertificatesha1",
21592           FT_BYTES, BASE_NONE, NULL, 0x0,
21593           NULL, HFILL}
21594         },
21595         /* Niagara Networks, 47729 / 200 */
21596         {&hf_pie_niagara_networks_dnsidentifier,
21597          {"DnsIdentifier", "cflow.pie.niagaranetworks.dnsidentifier",
21598           FT_UINT16, BASE_HEX, NULL, 0x0,
21599           NULL, HFILL}
21600         },
21601         /* Niagara Networks, 47729 / 201 */
21602         {&hf_pie_niagara_networks_dnsopcode,
21603          {"DnsOpCode", "cflow.pie.niagaranetworks.dnsopcode",
21604           FT_UINT8, BASE_DEC, NULL, 0x0,
21605           NULL, HFILL}
21606         },
21607         /* Niagara Networks, 47729 / 202 */
21608         {&hf_pie_niagara_networks_dnsresponsecode,
21609          {"DnsResponseCode", "cflow.pie.niagaranetworks.dnsresponsecode",
21610           FT_UINT8, BASE_DEC, NULL, 0x0,
21611           NULL, HFILL}
21612         },
21613         /* Niagara Networks, 47729 / 203 */
21614         {&hf_pie_niagara_networks_dnsqueryname,
21615          {"DnsQueryName", "cflow.pie.niagaranetworks.dnsqueryname",
21616           FT_STRING, BASE_NONE, NULL, 0x0,
21617           NULL, HFILL}
21618         },
21619         /* Niagara Networks, 47729 / 204 */
21620         {&hf_pie_niagara_networks_dnsresponsename,
21621          {"DnsResponseName", "cflow.pie.niagaranetworks.dnsresponsename",
21622           FT_STRING, BASE_NONE, NULL, 0x0,
21623           NULL, HFILL}
21624         },
21625         /* Niagara Networks, 47729 / 205 */
21626         {&hf_pie_niagara_networks_dnsresponsettl,
21627          {"DnsResponseTTL", "cflow.pie.niagaranetworks.dnsresponsettl",
21628           FT_UINT32, BASE_DEC, NULL, 0x0,
21629           NULL, HFILL}
21630         },
21631         /* Niagara Networks, 47729 / 206 */
21632         {&hf_pie_niagara_networks_dnsresponseipv4addr,
21633          {"DnsResponseIPv4Addr", "cflow.pie.niagaranetworks.dnsresponseipv4addr",
21634           FT_STRING, BASE_NONE, NULL, 0x0,
21635           NULL, HFILL}
21636         },
21637         /* Niagara Networks, 47729 / 207 */
21638         {&hf_pie_niagara_networks_dnsresponseipv4addrtext,
21639          {"DnsResponseIPv4AddrText", "cflow.pie.niagaranetworks.dnsresponseipv4addrtext",
21640           FT_STRING, BASE_NONE, NULL, 0x0,
21641           NULL, HFILL}
21642         },
21643         /* Niagara Networks, 47729 / 208 */
21644         {&hf_pie_niagara_networks_dnsresponseipv6addr,
21645          {"DnsResponseIPv6Addr", "cflow.pie.niagaranetworks.dnsresponseipv6addr",
21646           FT_STRING, BASE_NONE, NULL, 0x0,
21647           NULL, HFILL}
21648         },
21649         /* Niagara Networks, 47729 / 209 */
21650         {&hf_pie_niagara_networks_dnsresponseipv6addrtext,
21651          {"DnsResponseIPv6AddrText", "cflow.pie.niagaranetworks.dnsresponseipv6addrtext",
21652           FT_STRING, BASE_NONE, NULL, 0x0,
21653           NULL, HFILL}
21654         },
21655         /* Niagara Networks, 47729 / 210 */
21656         {&hf_pie_niagara_networks_dnsbits,
21657          {"DnsBits", "cflow.pie.niagaranetworks.dnsbits",
21658           FT_STRING, BASE_NONE, NULL, 0x0,
21659           NULL, HFILL}
21660         },
21661         /* Niagara Networks, 47729 / 211 */
21662         {&hf_pie_niagara_networks_dnsqdcount,
21663          {"DnsQDCount", "cflow.pie.niagaranetworks.dnsqdcount",
21664           FT_UINT16, BASE_DEC, NULL, 0x0,
21665           NULL, HFILL}
21666         },
21667         /* Niagara Networks, 47729 / 212 */
21668         {&hf_pie_niagara_networks_dnsancount,
21669          {"DnsANCount", "cflow.pie.niagaranetworks.dnsancount",
21670           FT_UINT16, BASE_DEC, NULL, 0x0,
21671           NULL, HFILL}
21672         },
21673         /* Niagara Networks, 47729 / 213 */
21674         {&hf_pie_niagara_networks_dnsnscount,
21675          {"DnsNSCount", "cflow.pie.niagaranetworks.dnsnscount",
21676           FT_UINT16, BASE_DEC, NULL, 0x0,
21677           NULL, HFILL}
21678         },
21679         /* Niagara Networks, 47729 / 214 */
21680         {&hf_pie_niagara_networks_dnsarcount,
21681          {"DnsARCount", "cflow.pie.niagaranetworks.dnsarcount",
21682           FT_UINT16, BASE_DEC, NULL, 0x0,
21683           NULL, HFILL}
21684         },
21685         /* Niagara Networks, 47729 / 215 */
21686         {&hf_pie_niagara_networks_dnsquerytype,
21687          {"DnsQueryType", "cflow.pie.niagaranetworks.dnsquerytype",
21688           FT_UINT16, BASE_DEC, NULL, 0x0,
21689           NULL, HFILL}
21690         },
21691         /* Niagara Networks, 47729 / 216 */
21692         {&hf_pie_niagara_networks_dnsquerytypetext,
21693          {"DnsQueryTypeText", "cflow.pie.niagaranetworks.dnsquerytypetext",
21694           FT_STRING, BASE_NONE, NULL, 0x0,
21695           NULL, HFILL}
21696         },
21697         /* Niagara Networks, 47729 / 217 */
21698         {&hf_pie_niagara_networks_dnsqueryclass,
21699          {"DnsQueryClass", "cflow.pie.niagaranetworks.dnsqueryclass",
21700           FT_UINT16, BASE_DEC, NULL, 0x0,
21701           NULL, HFILL}
21702         },
21703         /* Niagara Networks, 47729 / 218 */
21704         {&hf_pie_niagara_networks_dnsqueryclasstext,
21705          {"DnsQueryClassText", "cflow.pie.niagaranetworks.dnsqueryclasstext",
21706           FT_STRING, BASE_NONE, NULL, 0x0,
21707           NULL, HFILL}
21708         },
21709         /* Niagara Networks, 47729 / 219 */
21710         {&hf_pie_niagara_networks_dnsresponsetype,
21711          {"DnsResponseType", "cflow.pie.niagaranetworks.dnsresponsetype",
21712           FT_UINT16, BASE_DEC, NULL, 0x0,
21713           NULL, HFILL}
21714         },
21715         /* Niagara Networks, 47729 / 220 */
21716         {&hf_pie_niagara_networks_dnsresponsetypetext,
21717          {"DnsResponseTypeText", "cflow.pie.niagaranetworks.dnsresponsetypetext",
21718           FT_STRING, BASE_NONE, NULL, 0x0,
21719           NULL, HFILL}
21720         },
21721         /* Niagara Networks, 47729 / 221 */
21722         {&hf_pie_niagara_networks_dnsresponseclass,
21723          {"DnsResponseClass", "cflow.pie.niagaranetworks.dnsresponseclass",
21724           FT_UINT16, BASE_DEC, NULL, 0x0,
21725           NULL, HFILL}
21726         },
21727         /* Niagara Networks, 47729 / 222 */
21728         {&hf_pie_niagara_networks_dnsresponseclasstext,
21729          {"DnsResponseClassText", "cflow.pie.niagaranetworks.dnsresponseclasstext",
21730           FT_STRING, BASE_NONE, NULL, 0x0,
21731           NULL, HFILL}
21732         },
21733         /* Niagara Networks, 47729 / 223 */
21734         {&hf_pie_niagara_networks_dnsresponserdlength,
21735          {"DnsResponseRDLength", "cflow.pie.niagaranetworks.dnsresponserdlength",
21736           FT_UINT16, BASE_DEC, NULL, 0x0,
21737           NULL, HFILL}
21738         },
21739         /* Niagara Networks, 47729 / 224 */
21740         {&hf_pie_niagara_networks_dnsresponserdata,
21741          {"DnsResponseRData", "cflow.pie.niagaranetworks.dnsresponserdata",
21742           FT_STRING, BASE_NONE, NULL, 0x0,
21743           NULL, HFILL}
21744         },
21745         /* Niagara Networks, 47729 / 225 */
21746         {&hf_pie_niagara_networks_dnsauthorityname,
21747          {"DnsAuthorityName", "cflow.pie.niagaranetworks.dnsauthorityname",
21748           FT_STRING, BASE_NONE, NULL, 0x0,
21749           NULL, HFILL}
21750         },
21751         /* Niagara Networks, 47729 / 226 */
21752         {&hf_pie_niagara_networks_dnsauthoritytype,
21753          {"DnsAuthorityType", "cflow.pie.niagaranetworks.dnsauthoritytype",
21754           FT_UINT16, BASE_DEC, NULL, 0x0,
21755           NULL, HFILL}
21756         },
21757         /* Niagara Networks, 47729 / 227 */
21758         {&hf_pie_niagara_networks_dnsauthoritytypetext,
21759          {"DnsAuthorityTypeText", "cflow.pie.niagaranetworks.dnsauthoritytypetext",
21760           FT_STRING, BASE_NONE, NULL, 0x0,
21761           NULL, HFILL}
21762         },
21763         /* Niagara Networks, 47729 / 228 */
21764         {&hf_pie_niagara_networks_dnsauthorityclass,
21765          {"DnsAuthorityClass", "cflow.pie.niagaranetworks.dnsauthorityclass",
21766           FT_UINT16, BASE_DEC, NULL, 0x0,
21767           NULL, HFILL}
21768         },
21769         /* Niagara Networks, 47729 / 229 */
21770         {&hf_pie_niagara_networks_dnsauthorityclasstext,
21771          {"DnsAuthorityClassText", "cflow.pie.niagaranetworks.dnsauthorityclasstext",
21772           FT_STRING, BASE_NONE, NULL, 0x0,
21773           NULL, HFILL}
21774         },
21775         /* Niagara Networks, 47729 / 230 */
21776         {&hf_pie_niagara_networks_dnsauthorityttl,
21777          {"DnsAuthorityTTL", "cflow.pie.niagaranetworks.dnsauthorityttl",
21778           FT_UINT32, BASE_DEC, NULL, 0x0,
21779           NULL, HFILL}
21780         },
21781         /* Niagara Networks, 47729 / 231 */
21782         {&hf_pie_niagara_networks_dnsauthorityrdlength,
21783          {"DnsAuthorityRDLength", "cflow.pie.niagaranetworks.dnsauthorityrdlength",
21784           FT_UINT16, BASE_DEC, NULL, 0x0,
21785           NULL, HFILL}
21786         },
21787         /* Niagara Networks, 47729 / 232 */
21788         {&hf_pie_niagara_networks_dnsauthorityrdata,
21789          {"DnsAuthorityRData", "cflow.pie.niagaranetworks.dnsauthorityrdata",
21790           FT_STRING, BASE_NONE, NULL, 0x0,
21791           NULL, HFILL}
21792         },
21793         /* Niagara Networks, 47729 / 233 */
21794         {&hf_pie_niagara_networks_dnsadditionalname,
21795          {"DnsAdditionalName", "cflow.pie.niagaranetworks.dnsadditionalname",
21796           FT_STRING, BASE_NONE, NULL, 0x0,
21797           NULL, HFILL}
21798         },
21799         /* Niagara Networks, 47729 / 234 */
21800         {&hf_pie_niagara_networks_dnsadditionaltype,
21801          {"DnsAdditionalType", "cflow.pie.niagaranetworks.dnsadditionaltype",
21802           FT_UINT16, BASE_DEC, NULL, 0x0,
21803           NULL, HFILL}
21804         },
21805         /* Niagara Networks, 47729 / 235 */
21806         {&hf_pie_niagara_networks_dnsadditionaltypetext,
21807          {"DnsAdditionalTypeText", "cflow.pie.niagaranetworks.dnsadditionaltypetext",
21808           FT_STRING, BASE_NONE, NULL, 0x0,
21809           NULL, HFILL}
21810         },
21811         /* Niagara Networks, 47729 / 236 */
21812         {&hf_pie_niagara_networks_dnsadditionalclass,
21813          {"DnsAdditionalClass", "cflow.pie.niagaranetworks.dnsadditionalclass",
21814           FT_UINT16, BASE_DEC, NULL, 0x0,
21815           NULL, HFILL}
21816         },
21817         /* Niagara Networks, 47729 / 237 */
21818         {&hf_pie_niagara_networks_dnsadditionalclasstext,
21819          {"DnsAdditionalClassText", "cflow.pie.niagaranetworks.dnsadditionalclasstext",
21820           FT_STRING, BASE_NONE, NULL, 0x0,
21821           NULL, HFILL}
21822         },
21823         /* Niagara Networks, 47729 / 238 */
21824         {&hf_pie_niagara_networks_dnsadditionalttl,
21825          {"DnsAdditionalTTL", "cflow.pie.niagaranetworks.dnsadditionalttl",
21826           FT_UINT32, BASE_DEC, NULL, 0x0,
21827           NULL, HFILL}
21828         },
21829         /* Niagara Networks, 47729 / 239 */
21830         {&hf_pie_niagara_networks_dnsadditionalrdlength,
21831          {"DnsAdditionalRDLength", "cflow.pie.niagaranetworks.dnsadditionalrdlength",
21832           FT_UINT16, BASE_DEC, NULL, 0x0,
21833           NULL, HFILL}
21834         },
21835         /* Niagara Networks, 47729 / 240 */
21836         {&hf_pie_niagara_networks_dnsadditionalrdata,
21837          {"DnsAdditionalRData", "cflow.pie.niagaranetworks.dnsadditionalrdata",
21838           FT_STRING, BASE_NONE, NULL, 0x0,
21839           NULL, HFILL}
21840         },
21841         /* Niagara Networks, 47729 / 300 */
21842         {&hf_pie_niagara_networks_radiuspackettypecode,
21843          {"RadiusPacketTypeCode", "cflow.pie.niagaranetworks.radiuspackettypecode",
21844           FT_UINT8, BASE_DEC, NULL, 0x0,
21845           NULL, HFILL}
21846         },
21847         /* Niagara Networks, 47729 / 301 */
21848         {&hf_pie_niagara_networks_radiuspackettypecodetext,
21849          {"RadiusPacketTypeCodeText", "cflow.pie.niagaranetworks.radiuspackettypecodetext",
21850           FT_STRING, BASE_NONE, NULL, 0x0,
21851           NULL, HFILL}
21852         },
21853         /* Niagara Networks, 47729 / 302 */
21854         {&hf_pie_niagara_networks_radiuspacketidentifier,
21855          {"RadiusPacketIdentifier", "cflow.pie.niagaranetworks.radiuspacketidentifier",
21856           FT_UINT8, BASE_HEX, NULL, 0x0,
21857           NULL, HFILL}
21858         },
21859         /* Niagara Networks, 47729 / 303 */
21860         {&hf_pie_niagara_networks_radiusauthenticator,
21861          {"RadiusAuthenticator", "cflow.pie.niagaranetworks.radiusauthenticator",
21862           FT_BYTES, BASE_NONE, NULL, 0x0,
21863           NULL, HFILL}
21864         },
21865         /* Niagara Networks, 47729 / 304 */
21866         {&hf_pie_niagara_networks_radiususername,
21867          {"RadiusUserName", "cflow.pie.niagaranetworks.radiususername",
21868           FT_STRING, BASE_NONE, NULL, 0x0,
21869           NULL, HFILL}
21870         },
21871         /* Niagara Networks, 47729 / 305 */
21872         {&hf_pie_niagara_networks_radiuscallingstationid,
21873          {"RadiusCallingStationId", "cflow.pie.niagaranetworks.radiuscallingstationid",
21874           FT_STRING, BASE_NONE, NULL, 0x0,
21875           NULL, HFILL}
21876         },
21877         /* Niagara Networks, 47729 / 306 */
21878         {&hf_pie_niagara_networks_radiuscalledstationid,
21879          {"RadiusCalledStationId", "cflow.pie.niagaranetworks.radiuscalledstationid",
21880           FT_STRING, BASE_NONE, NULL, 0x0,
21881           NULL, HFILL}
21882         },
21883         /* Niagara Networks, 47729 / 307 */
21884         {&hf_pie_niagara_networks_radiusnasipaddress,
21885          {"RadiusNasIpAddress", "cflow.pie.niagaranetworks.radiusnasipaddress",
21886           FT_IPv4, BASE_NONE, NULL, 0x0,
21887           NULL, HFILL}
21888         },
21889         /* Niagara Networks, 47729 / 308 */
21890         {&hf_pie_niagara_networks_radiusnasipv6address,
21891          {"RadiusNasIpv6Address", "cflow.pie.niagaranetworks.radiusnasipv6address",
21892           FT_IPv6, BASE_NONE, NULL, 0x0,
21893           NULL, HFILL}
21894         },
21895         /* Niagara Networks, 47729 / 309 */
21896         {&hf_pie_niagara_networks_radiusnasidentifier,
21897          {"RadiusNasIdentifier", "cflow.pie.niagaranetworks.radiusnasidentifier",
21898           FT_STRING, BASE_NONE, NULL, 0x0,
21899           NULL, HFILL}
21900         },
21901         /* Niagara Networks, 47729 / 310 */
21902         {&hf_pie_niagara_networks_radiusframedipaddress,
21903          {"RadiusFramedIpAddress", "cflow.pie.niagaranetworks.radiusframedipaddress",
21904           FT_IPv4, BASE_NONE, NULL, 0x0,
21905           NULL, HFILL}
21906         },
21907         /* Niagara Networks, 47729 / 311 */
21908         {&hf_pie_niagara_networks_radiusframedipv6address,
21909          {"RadiusFramedIpv6Address", "cflow.pie.niagaranetworks.radiusframedipv6address",
21910           FT_IPv6, BASE_NONE, NULL, 0x0,
21911           NULL, HFILL}
21912         },
21913         /* Niagara Networks, 47729 / 312 */
21914         {&hf_pie_niagara_networks_radiusacctsessionid,
21915          {"RadiusAcctSessionId", "cflow.pie.niagaranetworks.radiusacctsessionid",
21916           FT_STRING, BASE_NONE, NULL, 0x0,
21917           NULL, HFILL}
21918         },
21919         /* Niagara Networks, 47729 / 313 */
21920         {&hf_pie_niagara_networks_radiusacctstatustype,
21921          {"RadiusAcctStatusType", "cflow.pie.niagaranetworks.radiusacctstatustype",
21922           FT_STRING, BASE_NONE, NULL, 0x0,
21923           NULL, HFILL}
21924         },
21925         /* Niagara Networks, 47729 / 314 */
21926         {&hf_pie_niagara_networks_radiusacctinoctets,
21927          {"RadiusAcctInOctets", "cflow.pie.niagaranetworks.radiusacctinoctets",
21928           FT_UINT32, BASE_DEC, NULL, 0x0,
21929           NULL, HFILL}
21930         },
21931         /* Niagara Networks, 47729 / 315 */
21932         {&hf_pie_niagara_networks_radiusacctoutoctets,
21933          {"RadiusAcctOutOctets", "cflow.pie.niagaranetworks.radiusacctoutoctets",
21934           FT_UINT32, BASE_DEC, NULL, 0x0,
21935           NULL, HFILL}
21936         },
21937         /* Niagara Networks, 47729 / 316 */
21938         {&hf_pie_niagara_networks_radiusacctinpackets,
21939          {"RadiusAcctInPackets", "cflow.pie.niagaranetworks.radiusacctinpackets",
21940           FT_UINT32, BASE_DEC, NULL, 0x0,
21941           NULL, HFILL}
21942         },
21943         /* Niagara Networks, 47729 / 317 */
21944         {&hf_pie_niagara_networks_radiusacctoutpackets,
21945          {"RadiusAcctOutPackets", "cflow.pie.niagaranetworks.radiusacctoutpackets",
21946           FT_UINT32, BASE_DEC, NULL, 0x0,
21947           NULL, HFILL}
21948         },
21949         /* Niagara Networks, 47729 / 318 */
21950         {&hf_pie_niagara_networks_radiusvsavendorid,
21951          {"RadiusVsaVendorId", "cflow.pie.niagaranetworks.radiusvsavendorid",
21952           FT_UINT32, BASE_DEC, NULL, 0x0,
21953           NULL, HFILL}
21954         },
21955         /* Niagara Networks, 47729 / 319 */
21956         {&hf_pie_niagara_networks_radiusvsaname,
21957          {"RadiusVsaName", "cflow.pie.niagaranetworks.radiusvsaname",
21958           FT_STRING, BASE_NONE, NULL, 0x0,
21959           NULL, HFILL}
21960         },
21961         /* Niagara Networks, 47729 / 320 */
21962         {&hf_pie_niagara_networks_radiusvsaid,
21963          {"RadiusVsaId", "cflow.pie.niagaranetworks.radiusvsaid",
21964           FT_UINT8, BASE_DEC, NULL, 0x0,
21965           NULL, HFILL}
21966         },
21967         /* Niagara Networks, 47729 / 321 */
21968         {&hf_pie_niagara_networks_radiusvsavalue,
21969          {"RadiusVsaValue", "cflow.pie.niagaranetworks.radiusvsavalue",
21970           FT_BYTES, BASE_NONE, NULL, 0x0,
21971           NULL, HFILL}
21972         },
21973
21974         /* Cisco root (a hidden item to allow filtering) */
21975         {&hf_pie_cisco,
21976          {"Cisco", "cflow.pie.cisco",
21977           FT_NONE, BASE_NONE, NULL, 0x0,
21978           NULL, HFILL}
21979         },
21980         /* Cisco, 9 / 4251 */
21981         {&hf_pie_cisco_transport_packets_lost_counter,
21982          {"Transport Packets Lost Counter", "cflow.pie.cisco.transport_packets_lost_counter",
21983           FT_UINT32, BASE_DEC, NULL, 0x0,
21984           NULL, HFILL}
21985         },
21986         /* Cisco, 9 / 4254 */
21987         {&hf_pie_cisco_transport_rtp_ssrc,
21988          {"Transport RTP SSRC", "cflow.pie.cisco.transport_rtp_ssrc",
21989           FT_UINT32, BASE_DEC, NULL, 0x0,
21990           NULL, HFILL}
21991         },
21992         /* Cisco, 9 / 4257 */
21993         {&hf_pie_cisco_transport_rtp_jitter_maximum,
21994          {"Transport RTP Jitter Maximum", "cflow.pie.cisco.transport_rtp_jitter_maximum",
21995           FT_UINT32, BASE_DEC, NULL, 0x0,
21996           NULL, HFILL}
21997         },
21998         /* Cisco, 9 / 4273 */
21999         {&hf_pie_cisco_transport_rtp_payload_type,
22000          {"Transport RTP Payload-type", "cflow.pie.cisco.transport_rtp_payload_type",
22001           FT_UINT8, BASE_HEX, NULL, 0x0,
22002           NULL, HFILL}
22003         },
22004         /* Cisco, 9 / 4325 */
22005         {&hf_pie_cisco_transport_rtp_jitter_mean_sum,
22006          {"Transport RTP Jitter Mean Sum", "cflow.pie.cisco.transport_rtp_jitter_mean_sum",
22007           FT_UINT64, BASE_HEX, NULL, 0x0,
22008           NULL, HFILL}
22009         },
22010         /* Cisco, 9 / 8233 */
22011         {&hf_pie_cisco_c3pl_class_cce_id,
22012          {"C3PL Class Cce-id", "cflow.pie.cisco.c3pl_class_cce_id",
22013           FT_UINT32, BASE_DEC, NULL, 0x0,
22014           NULL, HFILL}
22015         },
22016         /* Cisco, 9 / 8234 */
22017         {&hf_pie_cisco_c3pl_class_name,
22018          {"C3PL Class Name", "cflow.pie.cisco.c3pl_class_name",
22019           FT_STRING, BASE_NONE, NULL, 0x0,
22020           NULL, HFILL}
22021         },
22022         /* Cisco, 9 / 8235 */
22023         {&hf_pie_cisco_c3pl_class_type,
22024          {"C3PL Class Type", "cflow.pie.cisco.c3pl_class_type",
22025           FT_BYTES, BASE_NONE, NULL, 0x0,
22026           NULL, HFILL}
22027         },
22028         /* Cisco, 9 / 8236 */
22029         {&hf_pie_cisco_c3pl_policy_cce_id,
22030          {"C3PL Policy Cce-id", "cflow.pie.cisco.c3pl_policy_cce_id",
22031           FT_UINT32, BASE_DEC, NULL, 0x0,
22032           NULL, HFILL}
22033         },
22034         /* Cisco, 9 / 8237 */
22035         {&hf_pie_cisco_c3pl_policy_name,
22036          {"C3PL Policy Name", "cflow.pie.cisco.c3pl_policy_name",
22037           FT_STRING, BASE_NONE, NULL, 0x0,
22038           NULL, HFILL}
22039         },
22040         /* Cisco, 9 / 8238 */
22041         {&hf_pie_cisco_c3pl_policy_type,
22042          {"C3PL Policy Type", "cflow.pie.cisco.c3pl_policy_type",
22043           FT_BYTES, BASE_NONE, NULL, 0x0,
22044           NULL, HFILL}
22045         },
22046         /* Cisco, 9 / 9292 */
22047         {&hf_pie_cisco_connection_server_counter_responses,
22048          {"Connection Server Counter Responses", "cflow.pie.ciso.connection_server_counter_responses",
22049           FT_UINT32, BASE_DEC, NULL, 0x0,
22050           NULL, HFILL}
22051         },
22052         /* Cisco, 9 / 9268 */
22053         {&hf_pie_cisco_connection_client_counter_packets_retransmitted,
22054          {"Connection Client Counter Packets Retransmitted", "cflow.pie.ciso.connection_client_counter_packets_retransmitted",
22055           FT_UINT32, BASE_DEC, NULL, 0x0,
22056           NULL, HFILL}
22057         },
22058         /* Cisco, 9 / 9272 */
22059         {&hf_pie_cisco_connection_transaction_counter_complete,
22060          {"Connection Transaction Counter Complete", "cflow.pie.ciso.connection_transaction_counter_complete",
22061           FT_UINT32, BASE_DEC, NULL, 0x0,
22062           NULL, HFILL}
22063         },
22064         /* Cisco, 9 / 9273 */
22065         {&hf_pie_cisco_connection_transaction_duration_sum,
22066          {"Connection Transaction Duration Sum", "cflow.pie.cisco.connection_transaction_duration_sum",
22067           FT_UINT32, BASE_DEC, NULL, 0x0,
22068           "connection transaction duration sum (ms)", HFILL}
22069         },
22070         /* Cisco, 9 / 9300 */
22071         {&hf_pie_cisco_connection_delay_response_to_server_histogram_late,
22072          {"Connection Delay Response to-Server Histogram Late", "cflow.pie.ciso.connection_delay_response_to_server_histogram_late",
22073           FT_UINT32, BASE_DEC, NULL, 0x0,
22074           NULL, HFILL}
22075         },
22076         /* Cisco, 9 / 9303 */
22077         {&hf_pie_cisco_connection_delay_response_to_server_sum,
22078          {"Connection Delay Response to-Server Sum", "cflow.pie.cisco.connection_delay_response_to_server_sum",
22079           FT_UINT32, BASE_DEC, NULL, 0x0,
22080           "Connection delay response to-server time sum (ms)", HFILL}
22081         },
22082         /* Cisco, 9 / 9306 */
22083         {&hf_pie_cisco_connection_delay_application_sum,
22084          {"Connection Delay Application Sum", "cflow.pie.cisco.connection_delay_application_sum",
22085           FT_UINT32, BASE_DEC, NULL, 0x0,
22086           "connection delay application sum (ms)", HFILL}
22087         },
22088         /* Cisco, 9 / 9307 */
22089         {&hf_pie_cisco_connection_delay_application_max,
22090          {"Connection Delay Application Max", "cflow.pie.cisco.connection_delay_application_max",
22091           FT_UINT32, BASE_DEC, NULL, 0x0,
22092           "connection delay application max (ms)", HFILL}
22093         },
22094         /* Cisco, 9 / 9309 */
22095         {&hf_pie_cisco_connection_delay_response_client_to_server_sum,
22096          {"Connection Delay Response Client-to-Server Sum", "cflow.pie.cisco.connection_delay_response_client-to_server_sum",
22097           FT_UINT32, BASE_DEC, NULL, 0x0,
22098           "connection delay response client-to-server sum (ms)", HFILL}
22099         },
22100         /* Cisco, 9 / 9313 */
22101         {&hf_pie_cisco_connection_delay_network_client_to_server_sum,
22102          {"Connection Delay Network Client-to-Server Sum", "cflow.pie.cisco.connection_delay_network_client-to_server_sum",
22103           FT_UINT32, BASE_DEC, NULL, 0x0,
22104           "connection delay network client-to-server sum (ms)", HFILL}
22105         },
22106         /* Cisco, 9 / 9316 */
22107         {&hf_pie_cisco_connection_delay_network_to_client_sum,
22108          {"Connection Delay Network to-Client Sum", "cflow.pie.cisco.connection_delay_network_to-client_sum",
22109           FT_UINT32, BASE_DEC, NULL, 0x0,
22110           "connection delay network to-client sum (ms)", HFILL}
22111         },
22112         /* Cisco, 9 / 9319 */
22113         {&hf_pie_cisco_connection_delay_network_to_server_sum,
22114          {"Connection Delay Network to-Server Sum", "cflow.pie.cisco.connection_delay_network_to_server_sum",
22115           FT_UINT32, BASE_DEC, NULL, 0x0,
22116           "connection delay network to-server sum (ms)", HFILL}
22117         },
22118         /* Cisco, 9 / 9252 */
22119         {&hf_pie_cisco_services_waas_segment,
22120          {"Services WAAS Segment", "cflow.pie.cisco.services_waas_segment",
22121           FT_UINT8, BASE_DEC, VALS(v10_cisco_waas_segment), 0x0,
22122           NULL, HFILL}
22123         },
22124         /* Cisco, 9 / 9253 */
22125         {&hf_pie_cisco_services_waas_passthrough_reason,
22126          {"Services WAAS Passthrough-reason", "cflow.pie.cisco.services_waas_passthrough-reason",
22127           FT_UINT8, BASE_DEC, VALS(v10_cisco_waas_passthrough_reason), 0x0,
22128           NULL, HFILL}
22129         },
22130         /* Cisco, 9 / 9357 */
22131         {&hf_pie_cisco_application_http_uri_statistics,
22132          {"Application HTTP URI Statistics", "cflow.pie.cisco.application_http_uri_statistics",
22133           FT_STRING, BASE_NONE, NULL, 0x0,
22134           NULL, HFILL}
22135         },
22136         /* Cisco, 9 / 9357 */
22137         {&hf_pie_cisco_application_http_uri_statistics_count,
22138          {"Count", "cflow.pie.cisco.application_http_uri_statistics_count",
22139           FT_UINT16, BASE_DEC, NULL, 0x0,
22140           NULL, HFILL}
22141         },
22142         /* Cisco, 9 / 12232 */
22143         {&hf_pie_cisco_application_category_name,
22144          {"Application Category Name", "cflow.pie.cisco.application_category_name",
22145           FT_STRING, BASE_NONE, NULL, 0x0,
22146           NULL, HFILL}
22147         },
22148         /* Cisco, 9 / 12233 */
22149         {&hf_pie_cisco_application_sub_category_name,
22150          {"Application Sub Category Name", "cflow.pie.cisco.application_sub_category_name",
22151           FT_STRING, BASE_NONE, NULL, 0x0,
22152           NULL, HFILL}
22153         },
22154         /* Cisco, 9 / 12234 */
22155         {&hf_pie_cisco_application_group_name,
22156          {"Application Group Name", "cflow.pie.cisco.application_group_name",
22157           FT_STRING, BASE_NONE, NULL, 0x0,
22158           NULL, HFILL}
22159         },
22160         /* Cisco, 9 / 12235 */
22161         {&hf_pie_cisco_application_http_host,
22162          {"Application HTTP Host", "cflow.pie.cisco.application_http_host",
22163           FT_STRING, BASE_NONE, NULL, 0x0,
22164           NULL, HFILL}
22165         },
22166         /* Cisco, 9 / 12235 */
22167         {&hf_pie_cisco_application_http_host_app_id,
22168          {"NBAR App ID", "cflow.pie.cisco.application_http_host_app_id",
22169           FT_BYTES, BASE_NONE, NULL, 0x0,
22170           NULL, HFILL}
22171         },
22172         /* Cisco, 9 / 12235 */
22173         {&hf_pie_cisco_application_http_host_sub_app_id,
22174          {"Sub App ID", "cflow.pie.cisco.application_http_host_sub_app_id",
22175           FT_BYTES, BASE_NONE, NULL, 0x0,
22176           NULL, HFILL}
22177         },
22178         /* Cisco, 9 / 12236 */
22179         {&hf_pie_cisco_connection_client_ipv4_address,
22180          {"Connection Client IPv4 Address", "cflow.pie.cisco.connection_client_ipv4_address",
22181           FT_IPv4, BASE_NONE, NULL, 0x0,
22182           NULL, HFILL}
22183         },
22184         /* Cisco, 9 / 12237 */
22185         {&hf_pie_cisco_connection_server_ipv4_address,
22186          {"Connection Server IPv4 Address", "cflow.pie.cisco.connection_server_ipv4_address",
22187           FT_IPv4, BASE_NONE, NULL, 0x0,
22188           NULL, HFILL}
22189         },
22190         /* Cisco, 9 / 12240 */
22191         {&hf_pie_cisco_connection_client_transport_port,
22192          {"Connection Client Transport Port", "cflow.pie.cisco.connection_client_transport_port",
22193           FT_UINT16, BASE_DEC, NULL, 0x0,
22194           NULL, HFILL}
22195         },
22196         /* Cisco, 9 / 12241 */
22197         {&hf_pie_cisco_connection_server_transport_port,
22198          {"Connection Server Transport Port", "cflow.pie.cisco.connection_server_transport_port",
22199           FT_UINT16, BASE_DEC, NULL, 0x0,
22200           NULL, HFILL}
22201         },
22202         /* Cisco, 9 / 12242 */
22203         {&hf_pie_cisco_connection_id,
22204          {"Connection Id", "cflow.pie.cisco.connection_id",
22205           FT_UINT32, BASE_DEC, NULL, 0x0,
22206           NULL, HFILL}
22207         },
22208         /* Cisco, 9 / 12243 */
22209         {&hf_pie_cisco_application_traffic_class,
22210          {"Application Traffic-class", "cflow.pie.cisco.application_traffic_class",
22211           FT_BYTES, BASE_NONE, NULL, 0x0,
22212           NULL, HFILL}
22213         },
22214         /* Cisco, 9 / 12244 */
22215         {&hf_pie_cisco_application_business_relevance,
22216          {"Application Business-relevance", "cflow.pie.cisco.application_business-relevance",
22217           FT_BYTES, BASE_NONE, NULL, 0x0,
22218           NULL, HFILL}
22219         },
22220
22221         /* Juniper Networks root (a hidden item to allow filtering) */
22222         {&hf_pie_juniper,
22223          {"JuniperNetworks", "cflow.pie.juniper",
22224           FT_NONE, BASE_NONE, NULL, 0x0,
22225           NULL, HFILL}
22226         },
22227        /* Juniper Networks, 2636 / 137 */
22228         {&hf_pie_juniper_cpid_16bit,
22229          {"Juniper CPID Type", "cflow.pie.juniper.resiliency.cpid",
22230           FT_UINT16, BASE_HEX, VALS(v10_juniper_cpid), 0xFC00,
22231           NULL, HFILL}
22232         },
22233        /* Juniper Networks, 2636 / 137 */
22234         {&hf_pie_juniper_cpdesc_16bit,
22235          {"Juniper CPID Value", "cflow.pie.juniper.resiliency.cpdesc",
22236           FT_UINT16, BASE_DEC, NULL, 0x03FF,
22237           NULL, HFILL}
22238         },
22239        /* Juniper Networks, 2636 / 137 */
22240         {&hf_pie_juniper_cpid_32bit,
22241          {"Juniper CPID Type", "cflow.pie.juniper.resiliency.cpid",
22242           FT_UINT32, BASE_HEX, VALS(v10_juniper_cpid), 0xFC000000,
22243           NULL, HFILL}
22244         },
22245        /* Juniper Networks, 2636 / 137 */
22246         {&hf_pie_juniper_cpdesc_32bit,
22247          {"Juniper CPID Value", "cflow.pie.juniper.resiliency.cpdesc",
22248           FT_UINT32, BASE_DEC, NULL, 0x03FFFFFF,
22249           NULL, HFILL}
22250         },
22251
22252
22253         {&hf_string_len_short,
22254          {"String_len_short", "cflow.string_len_short",
22255           FT_UINT8, BASE_DEC, NULL, 0x0,
22256           NULL, HFILL}
22257         },
22258         {&hf_string_len_long,
22259          {"String_len_short", "cflow.string_len_long",
22260           FT_UINT8, BASE_DEC, NULL, 0x0,
22261           NULL, HFILL}
22262         },
22263         {&hf_cflow_mpls_label,
22264          {"MPLS label", "cflow.mpls_label",
22265           FT_UINT24, BASE_DEC, NULL, 0xFFFFF0,
22266           NULL, HFILL}
22267         },
22268         {&hf_cflow_mpls_exp,
22269          {"MPLS experimental bits", "cflow.mpls_exp",
22270           FT_UINT8, BASE_DEC, NULL, 0x0E,
22271           NULL, HFILL}
22272         },
22273         {&hf_cflow_mpls_bos,
22274          {"MPLS Bottom of Stack", "cflow.mpls_bos",
22275           FT_BOOLEAN, 8, TFS(&mpls_bos_tfs), 0x01,
22276           NULL, HFILL}
22277         },
22278
22279         { &hf_template_frame,
22280          { "Template Frame", "cflow.template_frame",
22281           FT_FRAMENUM, BASE_NONE, 0, 0x0,
22282           NULL, HFILL}
22283         },
22284     };
22285
22286     static int     *ett[] = {
22287         &ett_netflow,
22288         &ett_unixtime,
22289         &ett_flow,
22290         &ett_flowtime,
22291         &ett_str_len,
22292         &ett_template,
22293         &ett_field,
22294         &ett_dataflowset,
22295         &ett_fwdstat,
22296         &ett_mpls_label,
22297         &ett_tcpflags,
22298         &ett_subtemplate_list,
22299         &ett_resiliency,
22300         &ett_data_link_frame_sec,
22301         &ett_srhflagsipv6,
22302         &ett_gtpflags
22303     };
22304
22305     static ei_register_info ei[] = {
22306         { &ei_cflow_flowset_length,
22307           { "cflow.flowset_length.invalid", PI_MALFORMED, PI_WARN,
22308             "Flow length invalid", EXPFILL }},
22309         { &ei_cflow_no_flow_information,
22310           { "cflow.no_flow_information", PI_MALFORMED, PI_WARN,
22311             "No flow information", EXPFILL }},
22312         { &ei_cflow_template_ipfix_scope_field_count,
22313           { "cflow.template_ipfix_scope_field_count.none", PI_MALFORMED, PI_WARN,
22314             "No scope fields", EXPFILL }},
22315         { &ei_cflow_template_ipfix_scope_field_count_too_many,
22316           { "cflow.template_ipfix_scope_field_count.too_many", PI_MALFORMED, PI_WARN,
22317             "More IPFIX scopes than can be handled", EXPFILL }},
22318         { &ei_cflow_options,
22319           { "cflow.options.too_many", PI_UNDECODED, PI_WARN,
22320             "More options than can be handled", EXPFILL }},
22321         { &ei_cflow_scopes,
22322           { "cflow.scopes.too_many", PI_UNDECODED, PI_WARN,
22323             "More scopes than can be handled", EXPFILL }},
22324         { &ei_cflow_entries,
22325           { "cflow.entries.too_many", PI_UNDECODED, PI_WARN,
22326             "More entries than can be handled", EXPFILL }},
22327         { &ei_cflow_mpls_label_bad_length,
22328           { "cflow.mpls_label.bad_length", PI_UNDECODED, PI_WARN,
22329             "MPLS-Label bad length", EXPFILL }},
22330         { &ei_cflow_flowsets_impossible,
22331           { "cflow.flowsets.impossible", PI_MALFORMED, PI_WARN,
22332             "FlowSets impossible", EXPFILL }},
22333         { &ei_cflow_no_template_found,
22334           { "cflow.no_template_found", PI_MALFORMED, PI_WARN,
22335             "No template found", EXPFILL }},
22336         { &ei_transport_bytes_out_of_order,
22337           { "cflow.transport_bytes.out-of-order", PI_MALFORMED, PI_WARN,
22338             "Transport Bytes Out of Order", EXPFILL}},
22339         { &ei_unexpected_sequence_number,
22340           { "cflow.unexpected_sequence_number", PI_SEQUENCE, PI_WARN,
22341             "Unexpected flow sequence for domain ID", EXPFILL}},
22342         { &ei_cflow_subtemplate_bad_length,
22343           { "cflow.subtemplate_bad_length", PI_UNDECODED, PI_WARN,
22344             "SubTemplateList bad length", EXPFILL}},
22345     };
22346
22347     module_t *netflow_module;
22348     expert_module_t* expert_netflow;
22349
22350     proto_netflow = proto_register_protocol("Cisco NetFlow/IPFIX", "CFLOW", "cflow");
22351     netflow_handle = register_dissector("netflow", dissect_netflow, proto_netflow);
22352     netflow_tcp_handle = register_dissector("netflow_tcp", dissect_tcp_netflow, proto_netflow);
22353
22354     register_dissector("cflow", dissect_netflow, proto_netflow);
22355
22356     proto_register_field_array(proto_netflow, hf, array_length(hf));
22357     proto_register_subtree_array(ett, array_length(ett));
22358     expert_netflow = expert_register_protocol(proto_netflow);
22359     expert_register_field_array(expert_netflow, ei, array_length(ei));
22360
22361     /* Register our configuration options for NetFlow */
22362     netflow_module = prefs_register_protocol(proto_netflow, proto_reg_handoff_netflow);
22363
22364     /* Set default Netflow port(s) */
22365     range_convert_str(wmem_epan_scope(), &global_netflow_ports, NETFLOW_UDP_PORTS, MAX_UDP_PORT);
22366     range_convert_str(wmem_epan_scope(), &global_ipfix_ports,  IPFIX_UDP_PORTS,   MAX_UDP_PORT);
22367
22368     prefs_register_obsolete_preference(netflow_module, "udp.port");
22369
22370     prefs_register_range_preference(netflow_module, "netflow.ports",
22371                                     "NetFlow UDP Port(s)",
22372                                     "Set the port(s) for NetFlow messages"
22373                                     " (default: " NETFLOW_UDP_PORTS ")",
22374                                     &global_netflow_ports, MAX_UDP_PORT);
22375
22376     prefs_register_range_preference(netflow_module, "ipfix.ports",
22377                                     "IPFIX UDP/TCP/SCTP Port(s)",
22378                                     "Set the port(s) for IPFIX messages"
22379                                     " (default: " IPFIX_UDP_PORTS ")",
22380                                     &global_ipfix_ports, MAX_UDP_PORT);
22381
22382     prefs_register_uint_preference(netflow_module, "max_template_fields",
22383                                    "Maximum number of fields allowed in a template",
22384                                    "Set the number of fields allowed in a template.  "
22385                                    "Use 0 (zero) for unlimited.  "
22386                                    " (default: " G_STRINGIFY(V9_TMPLT_MAX_FIELDS_DEF) ")",
22387                                    10, &v9_tmplt_max_fields);
22388
22389     prefs_register_bool_preference(netflow_module, "desegment", "Reassemble Netflow v10 messages spanning multiple TCP segments.", "Whether the Netflow/Ipfix dissector should reassemble messages spanning multiple TCP segments.  To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.", &netflow_preference_desegment);
22390
22391     prefs_register_bool_preference(netflow_module, "tcpflags_1byte_cwr",
22392                                    "TCP flags: Decode first two bits of 1 byte TCP flags",
22393                                    "Whether the first two bits of 1 byte TCP flags should be decoded as CWR and ECE or reserved.",
22394                                    &netflow_preference_tcpflags_1byte_cwr);
22395
22396     v9_v10_tmplt_table = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), v9_v10_tmplt_table_hash, v9_v10_tmplt_table_equal);
22397 }
22398
22399 static unsigned
22400 get_netflow_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)
22401 {
22402     unsigned int    ver;
22403     uint16_t        plen;
22404
22405     ver = tvb_get_ntohs(tvb, offset);
22406     if (ver == 10) {
22407         plen = tvb_get_ntohs(tvb, offset+2);
22408     } else {
22409         plen = tvb_reported_length(tvb);
22410     }
22411
22412   return plen;
22413 }
22414
22415 static int
22416 dissect_tcp_netflow(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
22417 {
22418   tcp_dissect_pdus(tvb, pinfo, tree, netflow_preference_desegment, 4, get_netflow_pdu_len,
22419                    dissect_netflow, data);
22420   return tvb_reported_length(tvb);
22421 }
22422
22423 /*
22424  * protocol/port association
22425  */
22426 static void
22427 ipfix_delete_callback(uint32_t port, void *ptr _U_)
22428 {
22429     if ( port ) {
22430         dissector_delete_uint("udp.port",  port, netflow_handle);
22431         dissector_delete_uint("sctp.port", port, netflow_handle);
22432     }
22433 }
22434
22435 static void
22436 ipfix_add_callback(uint32_t port, void *ptr _U_)
22437 {
22438     if ( port ) {
22439         dissector_add_uint("udp.port",  port, netflow_handle);
22440         dissector_add_uint("sctp.port", port, netflow_handle);
22441     }
22442 }
22443
22444 void
22445 proto_reg_handoff_netflow(void)
22446 {
22447     static bool      netflow_prefs_initialized = false;
22448     static range_t  *netflow_ports;
22449     static range_t  *ipfix_ports;
22450
22451     if (!netflow_prefs_initialized) {
22452         /* Find eth_handle used for IE315*/
22453         eth_handle = find_dissector ("eth_withoutfcs");
22454
22455         netflow_prefs_initialized = true;
22456         dissector_add_uint("wtap_encap", WTAP_ENCAP_RAW_IPFIX, netflow_handle);
22457         dissector_add_uint_range_with_preference("tcp.port", IPFIX_UDP_PORTS, netflow_tcp_handle);
22458     } else {
22459         dissector_delete_uint_range("udp.port", netflow_ports, netflow_handle);
22460         wmem_free(wmem_epan_scope(), netflow_ports);
22461         range_foreach(ipfix_ports, ipfix_delete_callback, NULL);
22462         wmem_free(wmem_epan_scope(), ipfix_ports);
22463     }
22464
22465     netflow_ports = range_copy(wmem_epan_scope(), global_netflow_ports);
22466     ipfix_ports = range_copy(wmem_epan_scope(), global_ipfix_ports);
22467
22468     dissector_add_uint_range("udp.port", netflow_ports, netflow_handle);
22469     range_foreach(ipfix_ports, ipfix_add_callback, NULL);
22470 }
22471
22472 /*
22473  * Editor modelines
22474  *
22475  * Local Variables:
22476  * c-basic-offset: 4
22477  * tab-width: 8
22478  * indent-tabs-mode: nil
22479  * End:
22480  *
22481  * ex: set shiftwidth=4 tabstop=8 expandtab:
22482  * :indentSize=4:tabSize=8:noTabs=true:
22483  */