idnits 2.17.1 draft-ietf-ipfix-rfc5815bis-03.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 1 instance of lines with non-RFC6890-compliant IPv4 addresses in the document. If these are example addresses, they should be changed. -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 26, 2012) is 4413 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'ThisRFC' is mentioned on line 2783, but not defined ** Obsolete normative reference: RFC 4133 (Obsoleted by RFC 6933) ** Obsolete normative reference: RFC 5101 (Obsoleted by RFC 7011) ** Obsolete normative reference: RFC 5102 (Obsoleted by RFC 7012) ** Obsolete normative reference: RFC 5226 (Obsoleted by RFC 8126) ** Obsolete normative reference: RFC 5815 (Obsoleted by RFC 6615) Summary: 5 errors (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 IPFIX Working Group T. Dietz, Ed. 3 Internet-Draft NEC Europe, Ltd. 4 Intended status: Standards Track A. Kobayashi 5 Expires: September 27, 2012 NTT PF Labs. 6 B. Claise 7 Cisco Systems, Inc. 8 G. Muenz 9 Technische Universitaet Muenchen 10 March 26, 2012 12 Definitions of Managed Objects for IP Flow Information Export 13 draft-ietf-ipfix-rfc5815bis-03.txt 15 Abstract 17 This document defines managed objects for IP Flow Information eXport 18 (IPFIX). These objects provide information for monitoring IPFIX 19 Exporters and IPFIX Collectors including the basic configuration 20 information. 22 Status of this Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on September 27, 2012. 39 Copyright Notice 41 Copyright (c) 2012 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 57 2. IPFIX Documents Overview . . . . . . . . . . . . . . . . . . . 4 58 3. The Internet-Standard Management Framework . . . . . . . . . . 5 59 4. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6 60 5. Structure of the IPFIX MIB . . . . . . . . . . . . . . . . . . 7 61 5.1. The Transport Session Table . . . . . . . . . . . . . . . 7 62 5.2. The Template Table . . . . . . . . . . . . . . . . . . . . 9 63 5.3. The Template Definition Table . . . . . . . . . . . . . . 11 64 5.4. The Export Table . . . . . . . . . . . . . . . . . . . . . 12 65 5.5. The Metering Process Table . . . . . . . . . . . . . . . . 15 66 5.6. The Observation Point Table . . . . . . . . . . . . . . . 16 67 5.7. The Selection Process Table . . . . . . . . . . . . . . . 17 68 5.8. The Statistical Tables . . . . . . . . . . . . . . . . . . 17 69 5.8.1. The Transport Session Statistical Table . . . . . . . 18 70 5.8.2. The Template Statistical Table . . . . . . . . . . . . 18 71 5.8.3. The Metering Process Statistical Table . . . . . . . . 18 72 5.8.4. The Selection Process Statistical Table . . . . . . . 18 73 6. Structure of the IPFIX SELECTOR MIB . . . . . . . . . . . . . 19 74 6.1. The Selector Functions . . . . . . . . . . . . . . . . . . 19 75 7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 22 76 7.1. Relationship to the ENTITY MIB and Interface MIB . . . . . 22 77 7.2. MIB Modules Required for IMPORTS . . . . . . . . . . . . . 22 78 8. MIB Definitions . . . . . . . . . . . . . . . . . . . . . . . 23 79 8.1. IPFIX MIB Definition . . . . . . . . . . . . . . . . . . . 23 80 8.2. IPFIX SELECTOR MIB Definition . . . . . . . . . . . . . . 58 81 9. Security Considerations . . . . . . . . . . . . . . . . . . . 63 82 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 65 83 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 66 84 12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 67 85 12.1. Normative References . . . . . . . . . . . . . . . . . . . 67 86 12.2. Informative References . . . . . . . . . . . . . . . . . . 68 87 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 69 89 1. Introduction 91 This document defines two MIB modules for monitoring IP Flow 92 Information eXport (IPFIX) Devices including Exporters and 93 Collectors. While most of the objects defined by the IPFIX MIB 94 module must be implemented, some objects may be implemented 95 corresponding to the functionality implemented in the equipment. 96 Since the IPFIX architecture [RFC5470] foresees the possibility of 97 using Filtering and/or Sampling functions to reduce the data volume, 98 this document also provides the IPFIX SELECTOR MIB module, which 99 contains the standardized selection methods and is controlled by 100 IANA. The full configuration of the IPFIX Metering Process is out of 101 the scope of these MIB modules. 103 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 104 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 105 "OPTIONAL" in this document are to be interpreted as described in RFC 106 2119 [RFC2119]. 108 2. IPFIX Documents Overview 110 The IPFIX protocol provides network administrators with access to IP 111 Flow information. The architecture for the export of measured IP 112 Flow information out of an IPFIX Exporting Process to a Collecting 113 Process is defined in [RFC5470], per the requirements defined in 114 [RFC3917]. The protocol document [RFC5101] specifies how IPFIX Data 115 Records and Templates are carried via a congestion-aware transport 116 protocol from IPFIX Exporting Processes to IPFIX Collecting 117 Processes. IPFIX has a formal description of IPFIX Information 118 Elements, their name, type and additional semantic information, as 119 specified in [RFC5102]. Finally, [RFC5472] describes what type of 120 applications can use the IPFIX protocol and how they can use the 121 information provided. It furthermore shows how the IPFIX framework 122 relates to other architectures and frameworks. 124 It is assumed that Flow metering, export, and collection is performed 125 according to the IPFIX architecture defined in [RFC5470]. The 126 monitored configuration parameters of the export and collection of 127 Flow Templates and Data Records is modeled according to [RFC5101]. 128 Packet selection methods that may be optionally used by the IPFIX 129 Metering Process are not considered in this MIB module. They are 130 defined in the Packet Sampling (PSAMP) framework [RFC5474] and 131 Sampling techniques [RFC5475] documents. Nevertheless, the basis for 132 defining Sampling and Filtering functions is given with the IPFIX 133 SELECTOR MIB module. Since the PSAMP export protocol [RFC5476] is 134 based on the IPFIX protocol, the Sampling and Filtering functions can 135 be added to the IPFIX SELECTOR MIB module as needed. 137 3. The Internet-Standard Management Framework 139 For a detailed overview of the documents that describe the current 140 Internet-Standard Management Framework, please refer to section 7 of 141 RFC 3410 [RFC3410]. 143 Managed objects are accessed via a virtual information store, termed 144 the Management Information Base or MIB. MIB objects are generally 145 accessed through the Simple Network Management Protocol (SNMP). 146 Objects in the MIB are defined using the mechanisms defined in the 147 Structure of Management Information (SMI). This memo specifies MIB 148 modules that are compliant to the SMIv2, which is described in STD 149 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 150 2580 [RFC2580]. 152 4. Terminology 154 The definitions of the basic terms like IP Traffic Flow, Exporting 155 Process, Collecting Process, Observation Points, etc. can be found in 156 the IPFIX protocol document [RFC5101]. 158 5. Structure of the IPFIX MIB 160 The IPFIX MIB module consists of seven main tables, the Transport 161 Session table, the Template table and the corresponding Template 162 Definition table, the Export table, the Metering Process table, the 163 Observation Point table, and the Selection Process table. Since the 164 IPFIX architecture [RFC5470] foresees the possibility of using 165 Filtering and/or Sampling functions to reduce the data volume, the 166 MIB module provides the basic objects for these functions with the 167 Selection Process table. The IPFIX SELECTOR MIB module defined in 168 the next section provides the standard Filtering and Sampling 169 functions that can be referenced in the ipfixSelectionProcessTable. 171 All remaining objects contain statistical values for the different 172 tables contained in the MIB module. 174 The following subsections describe all tables in the IPFIX MIB 175 module. 177 5.1. The Transport Session Table 179 The Transport Session is the basis of the MIB module. The Transport 180 Session table (ipfixTransportSessionTable) contains all Transport 181 Sessions between Exporter and Collector. The table specifies the 182 transport layer protocol of the Transport Session and, depending on 183 that protocol, further parameters for the Transport Session. In the 184 case of UDP and TCP, these are the source and destination address as 185 well as the source and destination port. For Stream Control 186 Transmission Protocol (SCTP), the table contains the SCTP Assoc Id, 187 which is the index for the SCTP association in the SCTP MIB module 188 [RFC3873]. The mode of operation of the device, i.e., if the 189 Transport Session is used for collecting or exporting is given in the 190 ipfixTransportSessionDeviceMode object. Further on, it contains the 191 configured refresh parameters for Templates and Options Templates 192 that are used across unreliable connections as UDP. Finally, the 193 IPFIX version that is exported or collected by this Transport Session 194 and a status of the Transport Session is given in the table. 196 To illustrate the use of the above tables, let us assume the 197 following scenario: we have an Exporter on IP address 192.0.2.22 and 198 a Collector on IP address 192.0.2.37. The Exporter uses TCP to 199 export Templates and Data Records. The same Exporter also exports, 200 with UDP, to a Collector with the IP address of 192.0.2.44. This 201 would lead to the following Transport Session table on the Exporter: 203 ipfixTransportSessionTable (1) 204 | 205 +- ipfixTransportSessionEntry (1) 206 | 207 +- index (5) (ipfixTransportSessionIndex) 208 | +- ipfixTransportSessionIndex (1) = 5 209 | +- ipfixTransportSessionProtocol (2) = 6 (TCP) 210 | +- ipfixTransportSessionSourceAddressType (3) = 1 (ipv4) 211 | +- ipfixTransportSessionSourceAddress (4) = 192.0.2.22 212 | +- ipfixTransportSessionDestinationAddressType (5) = 1 (ipv4) 213 | +- ipfixTransportSessionDestinationAddress (6) = 192.0.2.37 214 | +- ipfixTransportSessionSourcePort (7) = 7653 215 | +- ipfixTransportSessionDestinationPort (8) = 4739 216 | +- ipfixTransportSessionSctpAssocId (9) = 0 217 | +- ipfixTransportSessionDeviceMode (10) = exporting(1) 218 | +- ipfixTransportSessionTemplateRefreshTimeout (11) = 0 219 | +- ipfixTransportSessionOptionTemplateRefreshTimeout (12) = 0 220 | +- ipfixTransportSessionTemplateRefreshPacket (13) = 0 221 | +- ipfixTransportSessionOptionTemplateRefreshPacket (14) = 0 222 | +- ipfixTransportSessionIpfixVersion (15) = 10 223 | +- ipfixTransportSessionStatus (16) = 2 (active) 224 . 225 . 226 . 227 +- index (11) (ipfixTransportSessionIndex) 228 +- ipfixTransportSessionIndex (1) = 11 229 +- ipfixTransportSessionProtocol (2) = 17 (UDP) 230 +- ipfixTransportSessionSourceAddressType (3) = 1 (ipv4) 231 +- ipfixTransportSessionSourceAddress (4) = 192.0.2.22 232 +- ipfixTransportSessionDestinationAddressType (5) = 1 (ipv4) 233 +- ipfixTransportSessionDestinationAddress (6) = 192.0.2.44 234 +- ipfixTransportSessionSourcePort (7) = 14287 235 +- ipfixTransportSessionDestinationPort (8) = 4739 236 +- ipfixTransportSessionSctpAssocId (9) = 0 237 +- ipfixTransportSessionDeviceMode (10) = exporting(1) 238 +- ipfixTransportSessionTemplateRefreshTimeout (11) = 100 239 +- ipfixTransportSessionOptionTemplateRefreshTimeout (12) 240 | = 100 241 +- ipfixTransportSessionTemplateRefreshPacket (13) = 10 242 +- ipfixTransportSessionOptionTemplateRefreshPacket (14) = 10 243 +- ipfixTransportSessionIpfixVersion (15) = 10 244 +- ipfixTransportSessionStatus (16) = 2 (active) 246 The values in brackets are the OID numbers. The Collectors would 247 then have the same entry except that the index would most likely 248 differ and the ipfixTransportSessionDeviceMode would be 249 collecting(2). 251 5.2. The Template Table 253 The Template table lists all Templates (including Options Templates) 254 that are sent (by an Exporter) or received (by a Collector). The 255 (Options) Templates are unique per Observation Domain and per 256 Transport Session. Note that the Transport Session also gives the 257 device mode, i.e. Exporter or Collector. Thus, the table is indexed 258 by: 260 o the Transport Session Index (ipfixTransportSessionIndex) 262 o and the Observation Domain Id (ipfixTemplateObservationDomainId). 264 It contains the Set Id and an access time denoting the time when the 265 (Options) Template was last sent or received. 267 To resume the above example, the Exporter may want to export a 268 Template and an Options Template for each Transport Session defined 269 above. This leads to the following Template table defining Template 270 and Options Template: 272 ipfixTemplateTable (3) 273 | 274 +- ipfixTemplateEntry (1) 275 | 276 +- index (5) (ipfixTransportSessionIndex) 277 | +- index (3) (ipfixTemplateObservationDomainId) 278 | + index (257) (ipfixTemplateId) 279 | | +- ipfixTemplateObservationDomainId (1) = 3 280 | | +- ipfixTemplateId (2) = 257 281 | | +- ipfixTemplateSetId (3) = 2 282 | | +- ipfixTemplateAccessTime (4) 283 | | = 2008-7-1,12:49:11.2,+2:0 284 | | 285 | + index (264) (ipfixTemplateId) 286 | +- ipfixTemplateObservationDomainId (1) = 3 287 | +- ipfixTemplateId (2) = 264 288 | +- ipfixTemplateSetId (3) = 3 289 | +- ipfixTemplateAccessTime (4) 290 . = 2008-7-1,12:47:04.8,+2:0 291 . 292 . 293 . 294 +- index (11) (ipfixTransportSessionIndex) 295 +- index (3) (ipfixTemplateObservationDomainId) 296 + index (273) (ipfixTemplateId) 297 | +- ipfixTemplateObservationDomainId (1) = 3 298 | +- ipfixTemplateId (2) = 273 299 | +- ipfixTemplateSetId (3) = 2 300 | +- ipfixTemplateAccessTime (4) 301 | = 2008-7-1,12:49:11.2,+2:0 302 | 303 + index (289) (ipfixTemplateId) 304 +- ipfixTemplateObservationDomainId (1) = 3 305 +- ipfixTemplateId (2) = 289 306 +- ipfixTemplateSetId (3) = 3 307 +- ipfixTemplateAccessTime (4) 308 = 2008-7-1,12:47:04.8,+2:0 310 We assume that the Transport Session that is stored with index 5 in 311 the Transport Session table of the Exporter is stored with index 17 312 in the Transport Session table of the (corresponding) Collector. 313 Then, the Template table would look as follows: 315 ipfixTemplateTable (3) 316 | 317 +- ipfixTemplateEntry (1) 318 | 319 +- index (17) (ipfixTransportSessionIndex) 320 +- index (3) (ipfixTemplateObservationDomainId) 321 + index (257) (ipfixTemplateId) 322 | +- ipfixTemplateObservationDomainId (1) = 3 323 | +- ipfixTemplateId (2) = 257 324 | +- ipfixTemplateSetId (3) = 2 325 | +- ipfixTemplateAccessTime (4) 326 | = 2008-7-1,12:49:11.8,+2:0 327 | 328 + index (264) (ipfixTemplateId) 329 +- ipfixTemplateObservationDomainId (1) = 3 330 +- ipfixTemplateId (2) = 264 331 +- ipfixTemplateSetId (3) = 3 332 +- ipfixTemplateAccessTime (4) 333 = 2008-7-1,12:47:05.3,+2:0 335 The table on the second Collector would be analogous to the one shown 336 above. 338 5.3. The Template Definition Table 340 The Template Definition table lists all the Information Elements 341 contained in a Template or Options Template. Therefore, it has the 342 same indexes as the corresponding Template table plus the Template 343 Id. Its own index denotes the order of the Information Element 344 inside the Template. Besides the Information Element Id and the 345 length of the encoded value, the table contains the enterprise number 346 for enterprise-specific Information Elements and flags for each 347 Information Element. The flags indicate if the Information Element 348 is used for scoping or as a Flow Key. 350 To resume the above example again, the Exporter is configured to 351 export the octets received and dropped at the Observation Point since 352 the last export of these values. In addition, it exports the start 353 and end time of the Flow relative to the timestamp contained in the 354 IPFIX header. This leads to the following Template Definition table 355 on the Exporter: 357 ipfixTemplateDefinitionTable (4) 358 | 359 +- ipfixTemplateDefinitionEntry (1) 360 | 361 +- index (5) (ipfixTransportSessionIndex) 362 +- index (3) (ipfixTemplateObservationDomainId) 363 + index (257) (ipfixTemplateId) 364 +- index (1) (ipfixTemplateDefinitionIndex) 365 | +- ipfixTemplateDefinitionIndex (1) = 1 366 | +- ipfixTemplateDefinitionIeId (2) = 158 367 | | (flowStartDeltaMicroseconds) 368 | +- ipfixTemplateDefinitionIeLength (3) = 4 369 | +- ipfixTemplateDefinitionEnterprise (4) = 0 370 | +- ipfixTemplateDefinitionFlags (5) = 0 371 | 372 +- index (2) (ipfixTemplateDefinitionIndex) 373 | +- ipfixTemplateDefinitionIndex (1) = 2 374 | +- ipfixTemplateDefinitionIeId (2) = 159 375 | | (flowEndDeltaMicroseconds) 376 | +- ipfixTemplateDefinitionIeLength (3) = 4 377 | +- ipfixTemplateDefinitionEnterprise (4) = 0 378 | +- ipfixTemplateDefinitionFlags (5) = 0 379 | 380 +- index (3) (ipfixTemplateDefinitionIndex) 381 | +- ipfixTemplateDefinitionIndex (1) = 3 382 | +- ipfixTemplateDefinitionIeId (2) = 1 383 | | (octetDeltaCount) 384 | +- ipfixTemplateDefinitionIeLength (3) = 8 385 | +- ipfixTemplateDefinitionEnterprise (4) = 0 386 | +- ipfixTemplateDefinitionFlags (5) = 0 387 | 388 +- index (4) (ipfixTemplateDefinitionIndex) 389 +- ipfixTemplateDefinitionIndex (1) = 4 390 +- ipfixTemplateDefinitionIeId (2) = 132 391 | (droppedOctetDeltaCount) 392 +- ipfixTemplateDefinitionIeLength (3) = 8 393 +- ipfixTemplateDefinitionEnterprise (4) = 0 394 +- ipfixTemplateDefinitionFlags (5) = 0 396 The corresponding table entry on the Collector is the same except 397 that it would have another ipfixTransportSessionIndex, e.g., 17 as in 398 the previous example. 400 5.4. The Export Table 402 On Exporters, the Export table (ipfixExportTable) can be used to 403 support features like failover, load-balancing, duplicate export to 404 several Collectors, etc. The table has three indexes that link an 405 entry with: 407 o the Metering Process table (ipfixMeteringProcessCacheId, see 408 below) 410 o and the Transport Session table (ipfixTransportSessionIndex). 412 Those entries with the same ipfixExportIndex and the same 413 ipfixMeteringProcessCacheId define a Transport Session group. The 414 member type for each group member describes its functionality. All 415 Transport Sessions referenced in this table MUST have the 416 ipfixTransportSessionDeviceMode exporting(1). 418 If the Exporter does not use Transport Session grouping, then each 419 ipfixExportIndex contains a single ipfixMeteringProcessCacheId, and 420 thus a singe Transport Session (ipfixTransportSessionIndex) and this 421 session MUST have the member type primary(1). 423 For failover, a Transport Session group can contain one Transport 424 Session with member type "primary" and several Transport Sessions 425 with type secondary(2). Entries with other member types are not 426 allowed for that type of group. For load-balancing or parallel 427 export, all Transport Sessions in the group MUST have the same member 428 type, either loadBalancing(4) or parallel(3). 430 The algorithms used for failover or load-balancing are out of the 431 scope of this document. 433 To continue the example, we assume that the Exporter uses the two 434 connections shown in the examples above as one primary Transport 435 Session protected by a secondary Transport Session. The Exporter 436 then has the following entries in the ipfixExportTable: 438 ipfixExportTable (5) 439 | 440 +- ipfixExportEntry (1) 441 | 442 +- index (7) (ipfixExportIndex) 443 | +- index (9) (ipfixMeteringProcessCacheId) 444 | | +- index (5) (ipfixTransportSessionIndex) 445 | | +- ipfixExportIndex (1) = 7 446 | | +- ipfixExportMemberType (2) = 1 (primary) 447 | | 448 | +- index (11) (ipfixTransportSessionIndex) 449 | +- ipfixExportIndex (1) = 7 450 | +- ipfixExportMemberType (2) = 2 (secondary) 451 | 452 +- index (8) (ipfixExportIndex) 453 +- index (9) (ipfixMeteringProcessCacheId) 454 +- index (5) (ipfixTransportSessionIndex) 455 | +- ipfixExportIndex (1) = 8 456 | +- ipfixExportMemberType (2) = 2 (secondary) 457 +- index (11) (ipfixTransportSessionIndex) 458 +- ipfixExportIndex (1) = 8 459 +- ipfixExportMemberType (2) = 1 (primary) 461 The example shows that the Exporter uses the Metering Process Cache 462 9, explained below, to export IPFIX Data Records for the Transport 463 Sessions 5 and 11. The Templates 257 and 264 defined above are 464 exported within Transport Session 5 as primary, while the secondary 465 Transport Session is 11. The Templates 273 and 289 are exported 466 within Transport Session 11 as primary, while the secondary Transport 467 Session is 5. 469 Here are the steps required by a manager in order to understand what 470 is/are the backups (if any) for Template Records exported from a 471 specific Exporter to a specific Collector: 473 1. Lookup the Collector IP address in the 474 ipfixTransportSessionDestinationAddress object (in the 475 ipfixTransportSessionTable). 477 2. From the same row, double check the Exporter IP address in the 478 ipfixTransportSessionSourceAddress object. 480 3. From the same row, write down the ipfixTransportSessionIndex 481 value. 483 4. Use that ipfixTransportSessionIndex value in the 484 ipfixTemplateTable, and look up the pairs of 485 (ipfixTemplateObservationDomainId, ipfixTemplateId). For there, 486 the manager deduces the Template Record(s) (ipfixTemplateId), 487 exported from the Observation Domain(s) 488 (ipfixTemplateObservationDomainId) on the tracked Exporter 489 (ipfixTransportSessionSourceAddress) to the tracked Collector 490 (ipfixTransportSessionDestinationAddress). 492 5. Reusing the same ipfixTransportSessionIndex in ipfixExportTable, 493 lookup the table for a value of ipfixExportMemberType equals to 494 "primary". Note that they could be multiple entries for which 495 the ipfixExportMemberType equals to "primary" in the 496 ipfixExportTable, so multiple iterations might be required until 497 the correct value of ipfixTransportSessionIndex is found. 499 6. From the same row, write down the ipfixExportIndex value. 501 7. In the ipfixExportTable, under the same three indexes values 502 (ipfixExportIndex, ipfixMeteringProcessCacheId, and 503 ipfixTransportSessionIndex), lookup the entries for which 504 ipfixExportMemberType is different than "primary". Write down 505 the associated ipfixTransportSessionIndex value. 507 8. From the ipfixTransportSessionTable, look up the Transport 508 Session details for this ipfixTransportSessionIndex value. For 509 example, the secondary Collector IP address and port 510 (ipfixTransportSessionDestinationAddress and 511 ipfixTransportSessionSourcePort). 513 5.5. The Metering Process Table 515 The Metering Process, as defined in [RFC5101], consists of a set of 516 functions. Maintaining the Flow Records is one of them. This 517 function is responsible for passing the Flow Records to the Exporting 518 Process and also for detecting Flow expiration. The Flow Records 519 that are maintained by the Metering Process can be grouped by the 520 Observation Points at which they are observed. The instance that 521 maintains such a group of Flow Records is a kind of cache. For this 522 reason, the Metering Process table (ipfixMeteringProcessTable) is 523 indexed by cache Ids (ipfixMeteringProcessCacheId). Each cache can 524 be maintained by a separate instance of the Metering Process. To 525 specify the Observation Point(s) where the Flow Records are gathered, 526 the ipfixMeteringProcessObservationPointGroupRef may contain an 527 ipfixObservationPointGroupId from the Observation Point table 528 (ipfixObservationPointTable) described in the next section. If an 529 Observation Point is not specified for the Flow Records, the 530 ipfixMeteringProcessObservationPointGroupRef MUST be zero(0). The 531 timeouts (ipfixMeteringProcessCacheActiveTimeout and 532 ipfixMeteringProcessCacheInactiveTimeout) specify when Flows are 533 expired. 535 ipfixMeteringProcessTable (6) 536 | 537 +- ipfixMeteringProcessEntry (1) 538 | 539 +- index (9) (ipfixMeteringProcessCacheId) 540 +- ipfixMeteringProcessCacheId (1) = 9 541 +- ipfixMeteringProcessObservationPointGroupRef (2) = 17 542 +- ipfixMeteringProcessCacheActiveTimeout (3) = 100 543 +- ipfixMeteringProcessCacheInactiveTimeout (4) = 100 545 5.6. The Observation Point Table 547 The Observation Point table (ipfixObservationPointTable) groups 548 Observation Points with the ipfixObservationPointGroupId. Each entry 549 contains the Observation Domain Id in which the Observation Point is 550 located and a reference to the ENTITY MIB module [RFC4133] or the 551 Interface MIB module [RFC2863]. The objects in the ENTITY MIB module 552 referenced by ipfixObservationPointPhysicalEntity or Interface MIB 553 module referenced by ipfixObservationPointPhysicalInterface denote 554 the Observation Point. At least one reference for the objects 555 ipfixObservationPointPhysicalEntity or 556 ipfixObservationPointPhysicalInterface MUST exist for a valid 557 Observation Point entry. If a reference to the Observation Point is 558 given in both object ipfixObservationPointPhysicalEntity and 559 ipfixObservationPointPhysicalInterface, then both MUST point to the 560 same physical interface. However, if one of two references 561 (ipfixObservationPointPhysicalEntity or 562 ipfixObservationPointPhysicalInterface) can not be given, its 563 reference MUST be 0. In addition, a direction can be given to render 564 more specifically which Flow to monitor. 566 ipfixObservationPointTable (7) 567 | 568 +- ipfixObservationPointEntry (1) 569 | 570 +- index (17) (ipfixObservationPointGroupId) 571 +- index (1) (ipfixObservationPointIndex) 572 | +- ipfixObservationPointGroupId (1) = 17 573 | +- ipfixObservationPointIndex (2) = 1 574 | +- ipfixObservationPointObservationDomainId (3) = 3 575 | +- ipfixObservationPointPhysicalEntity (4) = 6 576 | +- ipfixObservationPointPhysicalInterface(5) = 0 577 | +- ipfixObservationPointPhysicalEntityDirection (6) 578 = 3 (both) 579 | 580 +- index (2) (ipfixObservationPointIndex) 581 +- ipfixObservationPointGroupId (1) = 17 582 +- ipfixObservationPointIndex (2) = 2 583 +- ipfixObservationPointObservationDomainId (3) = 3 584 +- ipfixObservationPointPhysicalEntity (4) = 0 585 +- ipfixObservationPointPhysicalInterface (5) = 0 586 +- ipfixObservationPointPhysicalEntityDirection (6) 587 = 1 (ingress) 589 5.7. The Selection Process Table 591 This table supports the usage of Filtering and Sampling functions, as 592 described in [RFC5470]. It contains lists of functions per Metering 593 Process cache (ipfixMeteringProcessCacheId). The selection process 594 index ipfixSelectionProcessIndex forms groups of selection methods 595 that are applied to an observed packet stream. The selection process 596 selector index (ipfixSelectionProcessSelectorIndex) indicates the 597 order in which the functions are applied to the packets observed at 598 the Observation Points associated with the Metering Process cache. 599 The selection methods are applied in increasing order, i.e., 600 selection methods with a lower ipfixSelectionProcessSelectorIndex are 601 applied first. The functions are referred by object identifiers 602 pointing to the function with its parameters. If the selection 603 method does not use parameters, then it MUST point to the root of the 604 function subtree (see also Section 6). If the function uses 605 parameters, then it MUST point to an entry in the parameter table of 606 the selection method. If no Filtering or Sampling function is used 607 for a Metering Process, then an entry for the Metering Process SHOULD 608 be created pointing to the Select All function (ipfixFuncSelectAll). 610 5.8. The Statistical Tables 612 For the ipfixTransportSessionTable, the ipfixTemplateTable, the 613 ipfixMeteringProcessTable, and the ipfixSelectionProcessTable 614 statistical tables are defined that augment those tables. All the 615 statistical tables contain a discontinuity object that holds a 616 timestamp that denotes the time when a discontinuity event occurred 617 to notify the management system that the counters contained in those 618 tables might not be continuous anymore. 620 5.8.1. The Transport Session Statistical Table 622 The Transport Session Statistical table 623 (ipfixTransportSessionStatsTable) augments the 624 ipfixTransportSessionTable with statistical values. It contains the 625 rate (in bytes per second) with which it receives or sends out IPFIX 626 Messages, the number of bytes, packets, messages, Records, Templates 627 and Options Templates received or sent and the number of messages 628 that were discarded. 630 5.8.2. The Template Statistical Table 632 This table contains a statistical value for each Template. It 633 augments the Template table (ipfixTemplateTable) and specifies the 634 number of Data Records exported or collected for the Template. 636 5.8.3. The Metering Process Statistical Table 638 This table augments the Metering Process table 639 (ipfixMeteringProcessTable). It contains the statistical values for 640 the exported Data Records and the number of unused cache entries. 642 5.8.4. The Selection Process Statistical Table 644 This table augments the Selection Process table 645 (ipfixSelectionProcessTable) and introduces two generic statistical 646 values, the number of packets observed and the number of packets 647 dropped by the selection method. 649 6. Structure of the IPFIX SELECTOR MIB 651 The IPFIX SELECTOR MIB module defined in this section provides the 652 standard Filtering and Sampling functions that can be referenced in 653 the ipfixSelectionProcessTable. All standard Filtering and Sampling 654 functions MUST be registered in the subtree under object 655 ipfixSelectorFunctions (iso.org.dod.internet.mgmt.mib- 656 2.ipfixSelectorMIB, or as numbers 1.3.6.1.2.1.194). The toplevel 657 OIDs in the subtree under object ipfixSelectorFunctions MUST be 658 registered in a subregistry maintained by IANA at 659 http://www.iana.org/assignments/smi-numbers. The first entry in this 660 subtree is the Select All function (ipfixFuncSelectAll) defined in 661 this document as {ipfixSelectorFunctions 1}. 663 Further selector functions MUST be registered at IANA and are subject 664 to Expert Review [RFC5226], i.e., review by one of a group of experts 665 designated by an IETF Area Director. The group of experts MUST check 666 the requested MIB objects for completeness and accuracy of the 667 description. Requests for MIB objects that duplicate the 668 functionality of existing objects SHOULD be declined. The smallest 669 available OID SHOULD be assigned to a new MIB objects. The 670 specification of new MIB objects SHOULD follow the structure 671 specified in the Section Section 6.1 and MUST be published using a 672 well-established and persistent publication medium. The experts will 673 initially be drawn from the Working Group Chairs and document editors 674 of the IPFIX and PSAMP Working Groups. 676 6.1. The Selector Functions 678 The following figure shows what the MIB tree usually should look 679 like. It already contains the ipfixFuncSelectAll. The subtree in 680 ipfixFuncF2 gives the basic structure that all selection methods 681 SHOULD follow. 683 ipfixSelectorFunctions 684 | 685 +- ipfixFuncSelectAll 686 | | 687 | +- ipfixFuncSelectAllAvail (is the function available?) 688 | 689 +- ipfixFuncF2 690 | | 691 | +- ipfixFuncF2Avail (is the function F2 available?) 692 | | 693 | +- ipfixFuncF2Parameters (a table with parameters) 694 ... 695 | 696 +- ipfixFuncFn... 698 The selection method SHOULD be designed as a MIB subtree introduced 699 by an object with the name ipfixFunc appended by a function name. 700 The objects in this subtree SHOULD be prefixed by this name. If the 701 function is named Fx, then we would start a subtree with an OID named 702 ipfixFuncFx. This subtree should contain an object ipfixFuncFxAvail 703 that has the type TruthValue. If a selection method takes 704 parameters, the MIB should contain a table named 705 ipfixFuncFxParameters, which should contain all the parameters that 706 the selection method specifies. An entry in this table will be 707 referenced by the IPFIX MIB module if the selection method with the 708 parameters is used. 710 To illustrate the structure defined above, the following contains an 711 example of a function MyFunc that holds three integer parameters 712 Param1, Param2, and Param3. In the example, there are currently two 713 instances of the parameters set defined with indexes 1 and 4. 715 ipfixSelectorFunctions (1) 716 | 717 +- ipfixFuncMyFunc (?) 718 | 719 +- ipfixFuncMyFuncAvail (1) = true 720 +- ipfixFuncMyFuncParameters (2) 721 | 722 +- ipfixFuncMyFuncParametersEntry (1) 723 | 724 +- index (1) (ipfixFuncMyFuncParametersIndex) 725 | +- ipfixFuncMyFuncParam1 (1) = 47 726 | +- ipfixFuncMyFuncParam2 (2) = -128 727 | +- ipfixFuncMyFuncParam3 (3) = 19 728 | 729 +- index(4) (ipfixFuncMyFuncParametersIndex) 730 +- ipfixFuncMyFuncParam1 (1) = 19 731 +- ipfixFuncMyFuncParam2 (2) = -1 732 +- ipfixFuncMyFuncParam3 (3) = 728 734 If the function defined above is referenced in the IPFIX MIB module, 735 the ipfixSelectionProcessTable would look as follows: 737 ipfixSelectionProcessTable (8) 738 | 739 +- ipfixSelectionProcessEntry (1) 740 | 741 +- index (9) (ipfixMeteringProcessCacheId) 742 +- index (1) (ipfixSelectionProcessIndex) 743 +- index (1) (ipfixSelectionProcessSelectorIndex) 744 | +- ipfixSelectionProcessSelectorFunction (3) 745 | = ipfixSelectorFunctions.?.2.1.4 746 +- index (2) (ipfixSelectionProcessSelectorIndex) 747 +- ipfixSelectionProcessSelectorFunction (3) 748 = ipfixSelectorFunctions.?.2.1.1 750 This means that for the ipfixMeteringProcessCacheId(9), a Selection 751 Process with index 1 is created that applies two times the same 752 function but with different parameter sets. First, the function 753 MyFunc is applied with the parameters of the set with index 4 and the 754 with the parameters of the set with index 1. 756 7. Relationship to Other MIB Modules 758 Besides the usual imports from the SNMP Standards [RFC2578], 759 [RFC2579], and [RFC2580], the IPFIX MIB module references the ENTITY 760 MIB module [RFC4133] and the Interface MIB module [RFC2863]. 762 7.1. Relationship to the ENTITY MIB and Interface MIB 764 The Observation Point table (ipfixObservationPointTable) contains a 765 reference to the ENTITY MIB module [RFC4133] 766 (ipfixObservationPointPhysicalEntity) or the Interface MIB module 767 [RFC2863] (ipfixObservationPointPhysicalInterface). If the 768 implementors of the IPFIX MIB module want to specify the physical 769 entity where Flows are observed, then they SHOULD also implement the 770 ENTITY MIB and/or the Interface MIB module. The implementation of 771 the ENTITY MIB and/or Interface MIB module is OPTIONAL. If one of 772 them is not implemented, then all values of the respective column 773 ipfixObservationPointPhysicalEntity or 774 ipfixObservationPointPhysicalInterface in the Observation Point table 775 are zero and the values of the 776 ipfixObservationPointPhysicalEntityDirection columns are unknown(0), 777 if none of them are defined. 779 7.2. MIB Modules Required for IMPORTS 781 The IPFIX MIB module requires the modules SNMPv2-SMI [RFC2578], 782 SNMPv2-TC [RFC2579], and SNMPv2-CONF [RFC2580]. Further on, it 783 imports the textual conventions InetAddressType and InetAddress from 784 the INET ADDRESS MIB module [RFC4001]. 786 The IPFIX SELECTOR MIB module also requires the modules SNMPv2-SMI 787 [RFC2578], SNMPv2-TC [RFC2579], and SNMPv2-CONF [RFC2580]. 789 8. MIB Definitions 791 This section contains the definitions of the IPFIX-MIB module and the 792 IPFIX-SELECTOR-MIB module. There are different mandatory groups 793 defined for Collector and Exporter implementations. The statistical 794 objects are made OPTIONAL. 796 8.1. IPFIX MIB Definition 798 IPFIX-MIB DEFINITIONS ::= BEGIN 800 IMPORTS 801 MODULE-IDENTITY, OBJECT-TYPE, mib-2, Unsigned32, Counter64, 802 Gauge32 803 FROM SNMPv2-SMI -- RFC2578 804 TimeStamp, DateAndTime 805 FROM SNMPv2-TC -- RFC2579 806 MODULE-COMPLIANCE, OBJECT-GROUP 807 FROM SNMPv2-CONF -- RFC2580 808 InterfaceIndexOrZero 809 FROM IF-MIB -- RFC2863 810 InetAddressType, InetAddress, InetPortNumber 811 FROM INET-ADDRESS-MIB -- RFC4001 812 PhysicalIndexOrZero 813 FROM ENTITY-MIB; -- RFC4133 815 ipfixMIB MODULE-IDENTITY 816 LAST-UPDATED "201203220000Z" -- 22 March 2012 817 ORGANIZATION "IETF IPFIX Working Group" 818 CONTACT-INFO 819 "WG charter: 820 http://www.ietf.org/html.charters/ipfix-charter.html 822 Mailing Lists: 823 General Discussion: ipfix@ietf.org 824 To Subscribe: http://www1.ietf.org/mailman/listinfo/ipfix 825 Archive: 826 http://www1.ietf.org/mail-archive/web/ipfix/current/index.html 828 Editor: 829 Thomas Dietz 830 NEC Europe Ltd. 831 NEC Laboratories Europe 832 Network Research Division 833 Kurfuersten-Anlage 36 834 69115 Heidelberg 835 Germany 836 Phone: +49 6221 4342-128 837 Email: Thomas.Dietz@nw.neclab.eu 839 Atsushi Kobayashi 840 NTT Information Sharing Platform Laboratories 841 3-9-11 Midori-cho 842 Musashino-shi 843 180-8585 844 Japan 845 Phone: +81-422-59-3978 846 Email: akoba@nttv6.net 848 Benoit Claise 849 Cisco Systems, Inc. 850 De Kleetlaan 6a b1 851 Diegem 1831 852 Belgium 853 Phone: +32 2 704 5622 854 Email: bclaise@cisco.com 856 Gerhard Muenz 857 Technische Universitaet Muenchen 858 Department of Informatics 859 Chair for Network Architectures and Services (I8) 860 Boltzmannstr. 3 861 85748 Garching 862 Germany 863 Email: muenz@net.in.tum.de 864 DESCRIPTION 865 "The IPFIX MIB defines managed objects for IP Flow 866 Information eXport. These objects provide information about 867 managed nodes supporting the IPFIX protocol, 868 for Exporters as well as for Collectors. 870 Copyright (c) 2012 IETF Trust and the persons identified as 871 authors of the code. All rights reserved. 873 Redistribution and use in source and binary forms, with or 874 without modification, is permitted pursuant to, and subject 875 to the license terms contained in, the Simplified BSD 876 License set forth in Section 4.c of the IETF Trust's 877 Legal Provisions Relating to IETF Documents 878 (http://trustee.ietf.org/license-info)." 880 -- Note for RFC Editor: substitute [ThisRFC] with the newly 881 -- assigned number in the following sections. 883 -- Revision history 884 REVISION "201203220000Z" -- 22 March 2012 885 DESCRIPTION 886 "Fixed errata from RFC 5815. Published as RFC [ThisRFC]." 888 REVISION "201004190000Z" -- 19 April 2010 889 DESCRIPTION 890 "Initial version, published as RFC 5815." 892 ::= { mib-2 193 } 894 --****************************************************************** 895 -- Top Level Structure of the MIB 896 --****************************************************************** 898 ipfixObjects OBJECT IDENTIFIER ::= { ipfixMIB 1 } 899 ipfixConformance OBJECT IDENTIFIER ::= { ipfixMIB 2 } 901 ipfixMainObjects OBJECT IDENTIFIER ::= { ipfixObjects 1 } 902 ipfixStatistics OBJECT IDENTIFIER ::= { ipfixObjects 2 } 904 --================================================================== 905 -- 1.1: Objects used by all IPFIX implementations 906 --================================================================== 907 -------------------------------------------------------------------- 908 -- 1.1.1: Transport Session Table 909 -------------------------------------------------------------------- 910 ipfixTransportSessionTable OBJECT-TYPE 911 SYNTAX SEQUENCE OF IpfixTransportSessionEntry 912 MAX-ACCESS not-accessible 913 STATUS current 914 DESCRIPTION 915 "This table lists the currently established Transport 916 Sessions between an Exporting Process and a Collecting 917 Process." 918 ::= { ipfixMainObjects 1 } 920 ipfixTransportSessionEntry OBJECT-TYPE 921 SYNTAX IpfixTransportSessionEntry 922 MAX-ACCESS not-accessible 923 STATUS current 924 DESCRIPTION 925 "Defines an entry in the ipfixTransportSessionTable." 926 INDEX { ipfixTransportSessionIndex } 927 ::= { ipfixTransportSessionTable 1 } 929 IpfixTransportSessionEntry ::= 930 SEQUENCE { 931 ipfixTransportSessionIndex Unsigned32, 932 ipfixTransportSessionProtocol Unsigned32, 933 ipfixTransportSessionSourceAddressType InetAddressType, 934 ipfixTransportSessionSourceAddress InetAddress, 935 ipfixTransportSessionDestinationAddressType InetAddressType, 936 ipfixTransportSessionDestinationAddress InetAddress, 937 ipfixTransportSessionSourcePort InetPortNumber, 938 ipfixTransportSessionDestinationPort InetPortNumber, 939 ipfixTransportSessionSctpAssocId Unsigned32, 940 ipfixTransportSessionDeviceMode INTEGER, 941 ipfixTransportSessionTemplateRefreshTimeout Unsigned32, 942 ipfixTransportSessionOptionsTemplateRefreshTimeout Unsigned32, 943 ipfixTransportSessionTemplateRefreshPacket Unsigned32, 944 ipfixTransportSessionOptionsTemplateRefreshPacket Unsigned32, 945 ipfixTransportSessionIpfixVersion Unsigned32, 946 ipfixTransportSessionStatus INTEGER 947 } 949 ipfixTransportSessionIndex OBJECT-TYPE 950 SYNTAX Unsigned32 (1..4294967295) 951 MAX-ACCESS not-accessible 952 STATUS current 953 DESCRIPTION 954 "Locally arbitrary, but unique identifier of an entry in 955 the ipfixTransportSessionTable. The value is expected to 956 remain constant from a re-initialization of the entity's 957 network management agent to the next re-initialization." 958 ::= { ipfixTransportSessionEntry 1 } 960 ipfixTransportSessionProtocol OBJECT-TYPE 961 SYNTAX Unsigned32 (1..255) 962 MAX-ACCESS read-only 963 STATUS current 964 DESCRIPTION 965 "The transport protocol used for receiving or transmitting 966 IPFIX Messages. Protocol numbers are assigned by IANA. A 967 current list of all assignments is available from 968 ." 970 REFERENCE 971 "RFC 5101, Specification of the IP Flow 972 Information Export (IPFIX) Protocol for the Exchange of IP 973 Traffic Flow Information, Section 10." 974 ::= { ipfixTransportSessionEntry 2 } 976 ipfixTransportSessionSourceAddressType OBJECT-TYPE 977 SYNTAX InetAddressType { unknown(0), ipv4(1), ipv6 (2) } 978 MAX-ACCESS read-only 979 STATUS current 980 DESCRIPTION 981 "The type of address used for the source address, 982 as specified in RFC 4001. The InetAddressType supported 983 values are ipv4(1) and ipv6(2). This object is used with 984 protocols specified in ipfixTransportSessionProtocol) like 985 TCP (6) and UDP (17) that have the notion of addresses. 986 SCTP (132) should use the ipfixTransportSessionSctpAssocId 987 instead. If SCTP (132) or any other protocol without the 988 notion of addresses is used, the object MUST be set to 989 unknown(0)." 990 ::= { ipfixTransportSessionEntry 3 } 992 ipfixTransportSessionSourceAddress OBJECT-TYPE 993 SYNTAX InetAddress 994 MAX-ACCESS read-only 995 STATUS current 996 DESCRIPTION 997 "The source address of the Exporter of the IPFIX Transport 998 Session. This value is interpreted according to the value of 999 ipfixTransportSessionAddressType as specified in RFC 4001. 1000 This object is used with protocols (specified in 1001 ipfixTransportSessionProtocol) like TCP (6) and UDP (17) that 1002 have the notion of addresses. SCTP (132) should use the 1003 ipfixTransportSessionSctpAssocId instead. If SCTP (132) or 1004 any other protocol without the notion of addresses is used, 1005 the object MUST be set to a zero-length string." 1006 ::= { ipfixTransportSessionEntry 4 } 1008 ipfixTransportSessionDestinationAddressType OBJECT-TYPE 1009 SYNTAX InetAddressType { unknown(0), ipv4(1), ipv6 (2) } 1010 MAX-ACCESS read-only 1011 STATUS current 1012 DESCRIPTION 1013 "The type of address used for the destination address, 1014 as specified in RFC 4001. The InetAddressType supported 1015 values are ipv4(1) and ipv6(2). This object is used with 1016 protocols (specified in ipfixTransportSessionProtocol) like 1017 TCP (6) and UDP (17) that have the notion of addresses. 1018 SCTP (132) should use the ipfixTransportSessionSctpAssocId 1019 instead. If SCTP (132) or any other protocol without the 1020 notion of addresses is used, the object MUST be set to 1021 unknown(0)." 1022 ::= { ipfixTransportSessionEntry 5 } 1024 ipfixTransportSessionDestinationAddress OBJECT-TYPE 1025 SYNTAX InetAddress 1026 MAX-ACCESS read-only 1027 STATUS current 1028 DESCRIPTION 1029 "The destination address of the Collector of the IPFIX 1030 Transport Session. This value is interpreted according to 1031 the value of ipfixTransportSessionAddressType, as specified 1032 in RFC 4001. This object is used with protocols 1033 (specified in ipfixTransportSessionProtocol) like TCP (6) 1034 and UDP (17) that have the notion of addresses. SCTP (132) 1035 should use the ipfixTransportSessionSctpAssocId instead. 1036 If SCTP (132) or any other protocol without the notion of 1037 addresses is used, the object MUST be set to a zero-length 1038 string" 1039 ::= { ipfixTransportSessionEntry 6 } 1041 ipfixTransportSessionSourcePort OBJECT-TYPE 1042 SYNTAX InetPortNumber 1043 MAX-ACCESS read-only 1044 STATUS current 1045 DESCRIPTION 1046 "The transport protocol port number of the Exporter. 1047 This object is used with protocols (specified in 1048 ipfixTransportSessionProtocol) like TCP (6) 1049 and UDP (17) that have the notion of ports. SCTP (132) 1050 should copy the value of sctpAssocLocalPort if the 1051 Transport Session is in collecting mode or 1052 sctpAssocRemPort if the Transport Session is in 1053 exporting mode. The association is referenced 1054 by the ipfixTransportSessionSctpAssocId. 1055 If any other protocol without the notion of 1056 ports is used, the object MUST be set to zero." 1057 ::= { ipfixTransportSessionEntry 7 } 1059 ipfixTransportSessionDestinationPort OBJECT-TYPE 1060 SYNTAX InetPortNumber 1061 MAX-ACCESS read-only 1062 STATUS current 1063 DESCRIPTION 1064 "The transport protocol port number of the Collector. The 1065 default value is 4739 for all currently defined transport 1066 protocol types. This object is used with protocols 1067 (specified in ipfixTransportSessionProtocol) like TCP (6) 1068 and UDP (17) that have the notion of ports. SCTP (132) 1069 should copy the value of sctpAssocRemPort if the 1070 Transport Session is in collecting mode or 1071 sctpAssocLocalPort if the Transport Session is in 1072 exporting mode. The association is referenced 1073 by the ipfixTransportSessionSctpAssocId. 1074 If any other protocol without the notion of 1075 ports is used, the object MUST be set to zero." 1077 ::= { ipfixTransportSessionEntry 8 } 1079 ipfixTransportSessionSctpAssocId OBJECT-TYPE 1080 SYNTAX Unsigned32 1081 MAX-ACCESS read-only 1082 STATUS current 1083 DESCRIPTION 1084 "The association id used for the SCTP session between the 1085 Exporter and the Collector of the IPFIX Transport Session. 1086 It is equal to the sctpAssocId entry in the sctpAssocTable 1087 defined in the SCTP MIB. This object is only valid if 1088 ipfixTransportSessionProtocol has the value 132 (SCTP). In 1089 all other cases, the value MUST be zero." 1090 REFERENCE 1091 "RFC 3873, Stream Control Transmission Protocol (SCTP) 1092 Management Information Base (MIB)." 1093 ::= { ipfixTransportSessionEntry 9 } 1095 ipfixTransportSessionDeviceMode OBJECT-TYPE 1096 SYNTAX INTEGER { 1097 exporting(1), 1098 collecting(2) 1099 } 1100 MAX-ACCESS read-only 1101 STATUS current 1102 DESCRIPTION 1103 "The mode of operation of the device for the given Transport 1104 Session. This object can have the following values: 1106 exporting(1) 1107 This value MUST be used if the Transport Session is 1108 used for exporting Records to other IPFIX Devices, 1109 i.e., this device acts as Exporter. 1111 collecting(2) 1112 This value MUST be used if the Transport Session is 1113 used for collecting Records from other IPFIX Devices, 1114 i.e., this device acts as Collector." 1115 ::= { ipfixTransportSessionEntry 10 } 1117 ipfixTransportSessionTemplateRefreshTimeout OBJECT-TYPE 1118 SYNTAX Unsigned32 1119 UNITS "seconds" 1120 MAX-ACCESS read-only 1121 STATUS current 1123 DESCRIPTION 1124 "On Exporters, this object contains the time in seconds 1125 after which IPFIX Templates are resent by the 1126 Exporter. 1128 On Collectors, this object contains the lifetime in seconds 1129 after which a Template becomes invalid when it is not 1130 received again within this lifetime. 1132 This object is only valid if ipfixTransportSessionProtocol 1133 has the value 17 (UDP). In all other cases, the value MUST 1134 be zero." 1135 REFERENCE 1136 "RFC 5101, Specification of the IP Flow Information Export 1137 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1138 Information, Sections 10.3.6 and 10.3.7." 1139 ::= { ipfixTransportSessionEntry 11 } 1141 ipfixTransportSessionOptionsTemplateRefreshTimeout OBJECT-TYPE 1142 SYNTAX Unsigned32 1143 UNITS "seconds" 1144 MAX-ACCESS read-only 1145 STATUS current 1146 DESCRIPTION 1147 "On Exporters, this object contains the time in seconds 1148 after which IPFIX Options Templates are resent by the 1149 Exporter. 1151 On Collectors, this object contains the lifetime in seconds 1152 after which an Options Template becomes invalid when it is 1153 not received again within this lifetime. 1155 This object is only valid if ipfixTransportSessionProtocol 1156 has the value 17 (UDP). In all other cases the value MUST 1157 be zero." 1158 REFERENCE 1159 "RFC 5101, Specification of the IP Flow Information Export 1160 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1161 Information, Sections 10.3.6 and 10.3.7." 1162 ::= { ipfixTransportSessionEntry 12 } 1164 ipfixTransportSessionTemplateRefreshPacket OBJECT-TYPE 1165 SYNTAX Unsigned32 1166 UNITS "packets" 1167 MAX-ACCESS read-only 1168 STATUS current 1170 DESCRIPTION 1171 "On Exporters, this object contains the number of exported 1172 IPFIX Messages after which IPFIX Templates are resent 1173 by the Exporter. 1175 On Collectors, this object contains the lifetime in number 1176 of exported IPFIX Messages after which a Template becomes 1177 invalid when it is not received again within this lifetime. 1179 This object is only valid if ipfixTransportSessionProtocol 1180 has the value 17 (UDP). In all other cases the value MUST 1181 be zero." 1182 REFERENCE 1183 "RFC 5101, Specification of the IP Flow Information Export 1184 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1185 Information, Sections 10.3.6 and 10.3.7." 1186 ::= { ipfixTransportSessionEntry 13 } 1188 ipfixTransportSessionOptionsTemplateRefreshPacket OBJECT-TYPE 1189 SYNTAX Unsigned32 1190 UNITS "packets" 1191 MAX-ACCESS read-only 1192 STATUS current 1193 DESCRIPTION 1194 "On Exporters, this object contains the number of exported 1195 IPFIX Messages after which IPFIX Options Templates are 1196 resent by the Exporter. 1198 On Collectors, this object contains the lifetime in number 1199 of exported IPFIX Messages after which an Options Template 1200 becomes invalid when it is not received again within this 1201 lifetime. 1203 This object is only valid if ipfixTransportSessionProtocol 1204 has the value 17 (UDP). In all other cases the value MUST 1205 be zero." 1206 REFERENCE 1207 "RFC 5101, Specification of the IP Flow Information Export 1208 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1209 Information, Sections 10.3.6 and 10.3.7." 1210 ::= { ipfixTransportSessionEntry 14 } 1212 ipfixTransportSessionIpfixVersion OBJECT-TYPE 1213 SYNTAX Unsigned32 (0..65535) 1214 MAX-ACCESS read-only 1215 STATUS current 1217 DESCRIPTION 1218 "On Exporters the object contains the version number of the 1219 IPFIX protocol that the Exporter uses to export its data in 1220 this Transport Session. 1222 On Collectors the object contains the version number of the 1223 IPFIX protocol it receives for this Transport Session. 1225 If IPFIX Messages of different IPFIX protocol versions are 1226 transmitted or received in this Transport Session, this 1227 object contains the maximum version number." 1228 REFERENCE 1229 "RFC 5101, Specification of the IP Flow Information Export 1230 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1231 Information, Section 3.1." 1232 ::= { ipfixTransportSessionEntry 15 } 1234 ipfixTransportSessionStatus OBJECT-TYPE 1235 SYNTAX INTEGER { 1236 unknown(0), 1237 inactive(1), 1238 active(2) 1239 } 1240 MAX-ACCESS read-only 1241 STATUS current 1242 DESCRIPTION 1243 "The status of a Transport Session. This object can have the 1244 following values: 1246 unknown(0) 1247 This value MUST be used if the status of the 1248 Transport Session cannot be detected by the equipment. 1249 This value should be avoided as far as possible. 1251 inactive(1) 1252 This value MUST be used for Transport Sessions that 1253 are specified in the system but are not currently active. 1254 The value can be used, e.g., for Transport Sessions that 1255 are backup (secondary) sessions in a Transport Session 1256 group. 1258 active(2) 1259 This value MUST be used for Transport Sessions that are 1260 currently active and transmitting or receiving data." 1261 ::= { ipfixTransportSessionEntry 16 } 1263 -------------------------------------------------------------------- 1264 -- 1.1.2: Template Table 1265 -------------------------------------------------------------------- 1266 ipfixTemplateTable OBJECT-TYPE 1267 SYNTAX SEQUENCE OF IpfixTemplateEntry 1268 MAX-ACCESS not-accessible 1269 STATUS current 1270 DESCRIPTION 1271 "This table lists the Templates and Options Templates that 1272 are transmitted by the Exporting Process or received by the 1273 Collecting Process. 1275 The table contains the Templates and Options Templates that 1276 are received or used for exporting data for a given 1277 Transport Session group and Observation Domain. 1279 Withdrawn or invalidated (Options) Template MUST be removed 1280 from this table." 1281 ::= { ipfixMainObjects 2 } 1283 ipfixTemplateEntry OBJECT-TYPE 1284 SYNTAX IpfixTemplateEntry 1285 MAX-ACCESS not-accessible 1286 STATUS current 1287 DESCRIPTION 1288 "Defines an entry in the ipfixTemplateTable." 1289 INDEX { 1290 ipfixTransportSessionIndex, 1291 ipfixTemplateObservationDomainId, 1292 ipfixTemplateId 1293 } 1294 ::= { ipfixTemplateTable 1 } 1296 IpfixTemplateEntry ::= 1297 SEQUENCE { 1298 ipfixTemplateObservationDomainId Unsigned32, 1299 ipfixTemplateId Unsigned32, 1300 ipfixTemplateSetId Unsigned32, 1301 ipfixTemplateAccessTime DateAndTime 1302 } 1304 ipfixTemplateObservationDomainId OBJECT-TYPE 1305 SYNTAX Unsigned32 (0..4294967295) 1306 MAX-ACCESS not-accessible 1307 STATUS current 1308 DESCRIPTION 1309 "The Id of the Observation Domain for which this Template 1310 is defined. This value is used when sending IPFIX Messages. 1312 The special value of 0 indicates that the Data Records 1313 exported with this (Option Template) cannot be applied to a 1314 single Observation Domain." 1315 REFERENCE 1316 "RFC 5101, Specification of the IP Flow Information Export 1317 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1318 Information, Section 3.1." 1319 ::= { ipfixTemplateEntry 1 } 1321 ipfixTemplateId OBJECT-TYPE 1322 SYNTAX Unsigned32 (256..65535) 1323 MAX-ACCESS not-accessible 1324 STATUS current 1325 DESCRIPTION 1326 "This number indicates the Template Id in the IPFIX 1327 Message. Values from 0 to 255 are not allowed for Template 1328 Ids." 1329 REFERENCE 1330 "RFC 5101, Specification of the IP Flow Information Export 1331 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1332 Information, Section 3.4.1." 1333 ::= { ipfixTemplateEntry 2 } 1335 ipfixTemplateSetId OBJECT-TYPE 1336 SYNTAX Unsigned32 (1..65535) 1337 MAX-ACCESS read-only 1338 STATUS current 1339 DESCRIPTION 1340 "This number indicates the Set Id of the Template. This 1341 object allows to easily retrieve the Template type. 1343 Currently, there are two values defined. The value 2 is 1344 used for Sets containing Template definitions. The value 3 1345 is used for Sets containing Options Template definitions." 1346 REFERENCE 1347 "RFC 5101, Specification of the IP Flow Information Export 1348 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1349 Information, Section 3.3.2." 1350 ::= { ipfixTemplateEntry 3 } 1352 ipfixTemplateAccessTime OBJECT-TYPE 1353 SYNTAX DateAndTime 1354 MAX-ACCESS read-only 1355 STATUS current 1356 DESCRIPTION 1357 "If the Transport Session is in exporting mode 1358 (ipfixTransportSessionDeviceMode) the time when this 1359 (Options) Template was last sent to the Collector(s). 1361 In the specific case of UDP as transport protocol, this 1362 time is used to know when a retransmission of the 1363 (Options) Template is needed. 1365 If it is in collecting mode, this object contains the 1366 time when this (Options) Template was last received from 1367 the Exporter. In the specific case of UDP as transport 1368 protocol, this time is used to know when this (Options) 1369 Template times out and thus is no longer valid." 1370 ::= { ipfixTemplateEntry 4 } 1372 -------------------------------------------------------------------- 1373 -- 1.1.3: Exported Template Definition Table 1374 -------------------------------------------------------------------- 1375 ipfixTemplateDefinitionTable OBJECT-TYPE 1376 SYNTAX SEQUENCE OF IpfixTemplateDefinitionEntry 1377 MAX-ACCESS not-accessible 1378 STATUS current 1379 DESCRIPTION 1380 "On Exporters, this table lists the (Options) Template fields 1381 of which a (Options) Template is defined. It defines the 1382 (Options) Template given in the ipfixTemplateId specified in 1383 the ipfixTemplateTable. 1385 On Collectors, this table lists the (Options) Template fields 1386 of which a (Options) Template is defined. It defines the 1387 (Options) Template given in the ipfixTemplateId specified in 1388 the ipfixTemplateTable." 1389 ::= { ipfixMainObjects 3 } 1391 ipfixTemplateDefinitionEntry OBJECT-TYPE 1392 SYNTAX IpfixTemplateDefinitionEntry 1393 MAX-ACCESS not-accessible 1394 STATUS current 1395 DESCRIPTION 1396 "Defines an entry in the ipfixTemplateDefinitionTable." 1398 INDEX { 1399 ipfixTransportSessionIndex, 1400 ipfixTemplateObservationDomainId, 1401 ipfixTemplateId, 1402 ipfixTemplateDefinitionIndex 1403 } 1404 ::= { ipfixTemplateDefinitionTable 1 } 1406 IpfixTemplateDefinitionEntry ::= 1407 SEQUENCE { 1408 ipfixTemplateDefinitionIndex Unsigned32, 1409 ipfixTemplateDefinitionIeId Unsigned32, 1410 ipfixTemplateDefinitionIeLength Unsigned32, 1411 ipfixTemplateDefinitionEnterpriseNumber Unsigned32, 1412 ipfixTemplateDefinitionFlags BITS 1413 } 1415 ipfixTemplateDefinitionIndex OBJECT-TYPE 1416 SYNTAX Unsigned32 (1..65535) 1417 MAX-ACCESS not-accessible 1418 STATUS current 1419 DESCRIPTION 1420 "The ipfixTemplateDefinitionIndex specifies the order in 1421 which the Information Elements are used in the (Options) 1422 Template Record. 1424 Since a Template Record can contain a maximum of 65535 1425 Information Elements, the index is limited to this value." 1426 REFERENCE 1427 "RFC 5101, Specification of the IP Flow Information Export 1428 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1429 Information, Sections 3.4.1 and 3.4.2." 1430 ::= { ipfixTemplateDefinitionEntry 1 } 1432 ipfixTemplateDefinitionIeId OBJECT-TYPE 1433 SYNTAX Unsigned32 (1..65535) 1434 MAX-ACCESS read-only 1435 STATUS current 1436 DESCRIPTION 1437 "This indicates the Information Element Id at position 1438 ipfixTemplateDefinitionIndex in the (Options) Template 1439 ipfixTemplateId. This implicitly specifies the data type 1440 of the Information Element. The elements are registered 1441 at IANA. A current list of assignments can be found at 1442 " 1444 REFERENCE 1445 "RFC 5101, Specification of the IP Flow Information Export 1446 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1447 Information, Section 3.2. 1449 RFC 5102, Information Model for IP Flow Information Export." 1450 ::= { ipfixTemplateDefinitionEntry 2 } 1452 ipfixTemplateDefinitionIeLength OBJECT-TYPE 1453 SYNTAX Unsigned32 (0..65535) 1454 MAX-ACCESS read-only 1455 STATUS current 1456 DESCRIPTION 1457 "This indicates the length of the Information Element Id at 1458 position ipfixTemplateDefinitionIndex in the (Options) 1459 Template ipfixTemplateId." 1460 REFERENCE 1461 "RFC 5101, Specification of the IP Flow Information Export 1462 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1463 Information, Section 3.2. 1465 RFC 5102, Information Model for IP Flow Information Export." 1466 ::= { ipfixTemplateDefinitionEntry 3 } 1468 ipfixTemplateDefinitionEnterpriseNumber OBJECT-TYPE 1469 SYNTAX Unsigned32 1470 MAX-ACCESS read-only 1471 STATUS current 1472 DESCRIPTION 1473 "IANA enterprise number of the authority defining the 1474 Information Element identifier in this Template Record. 1475 Enterprise numbers are assigned by IANA. A current list of 1476 all assignments is available from 1477 . 1479 This object must be zero(0) for all standard Information 1480 Elements registered with IANA. A current list of these 1481 elements is available from 1482 ." 1483 REFERENCE 1484 "RFC 5101, Specification of the IP Flow Information Export 1485 (IPFIX) Protocol for the Exchange of IP Traffic Flow 1486 Information, Section 3.2. 1488 RFC 5102, Information Model for IP Flow Information Export." 1489 ::= { ipfixTemplateDefinitionEntry 4 } 1491 ipfixTemplateDefinitionFlags OBJECT-TYPE 1492 SYNTAX BITS { 1493 scope(0), 1494 flowKey(1) 1495 } 1496 MAX-ACCESS read-only 1497 STATUS current 1498 DESCRIPTION 1499 "This bitmask indicates special attributes for the 1500 Information Element: 1502 scope(0) 1503 This Information Element is used for scope. 1505 flowKey(1) 1506 This Information Element is a Flow Key. 1508 Thus, we get the following values for an Information Element: 1510 If neither bit scope(0) nor bit flowKey(1) are set 1511 The Information Element is neither used for scoping nor 1512 as Flow Key. 1513 If only bit scope(0) is set 1514 The Information Element is used for scoping. 1515 If only bit flowKey(1) is set 1516 The Information Element is used as Flow Key. 1518 Both bit scope(0) and flowKey(1) MUST NOT be set at the same 1519 time. This combination is not allowed." 1520 REFERENCE 1521 "RFC 5101, Specification of the IP Flow Information 1522 Export (IPFIX) Protocol for the Exchange of IP Traffic Flow 1523 Information, Sections 2 and 3.4.2.1. 1525 RFC 5102, Information Model for IP Flow Information Export." 1526 ::= { ipfixTemplateDefinitionEntry 5 } 1528 -------------------------------------------------------------------- 1529 -- 1.1.4: Export Table 1530 -------------------------------------------------------------------- 1531 ipfixExportTable OBJECT-TYPE 1532 SYNTAX SEQUENCE OF IpfixExportEntry 1533 MAX-ACCESS not-accessible 1534 STATUS current 1535 DESCRIPTION 1536 "This table lists all exports of an IPFIX device. 1538 On Exporters, this table contains all exports grouped by 1539 Transport Session, Observation Domain Id, Template Id, and 1540 Metering Process represented by the 1541 ipfixMeteringProcessCacheId. Thanks to the ipfixExportIndex, 1542 the exports can group one or more Transport Sessions to 1543 achieve a special functionality like failover management, 1544 load-balancing, etc. The entries with the same 1545 ipfixExportIndex, ipfixObservationDomainId, 1546 and ipfixMeteringProcessCacheId define a Transport 1547 Session group. If the Exporter does not use Transport 1548 Session grouping, then each ipfixExportIndex contains a 1549 single ipfixMeteringProcessCacheId and thus a singe 1550 Transport Session, and this session MUST have the member 1551 type primary(1). Transport Sessions referenced in this 1552 table MUST have the ipfixTransportSessionDeviceMode 1553 exporting(1). 1555 On Collectors, this table is not needed." 1556 ::= { ipfixMainObjects 4 } 1558 ipfixExportEntry OBJECT-TYPE 1559 SYNTAX IpfixExportEntry 1560 MAX-ACCESS not-accessible 1561 STATUS current 1562 DESCRIPTION 1563 "Defines an entry in the ipfixExportTable." 1564 INDEX { 1565 ipfixExportIndex, 1566 ipfixMeteringProcessCacheId, 1567 ipfixTransportSessionIndex 1568 } 1569 ::= { ipfixExportTable 1 } 1571 IpfixExportEntry ::= 1572 SEQUENCE { 1573 ipfixExportIndex Unsigned32, 1574 ipfixExportMemberType INTEGER 1575 } 1577 ipfixExportIndex OBJECT-TYPE 1578 SYNTAX Unsigned32 (1..4294967295) 1579 MAX-ACCESS not-accessible 1580 STATUS current 1581 DESCRIPTION 1582 "Locally arbitrary, but unique identifier of an entry in 1583 the ipfixExportTable. The value is expected 1584 to remain constant from a re-initialization of the entity's 1585 network management agent to the next re-initialization. 1587 A common ipfixExportIndex between two entries from this 1588 table expresses that there is a relationship between the 1589 Transport Sessions in ipfixTransportSessionIndex. The type 1590 of relationship is expressed by the value of 1591 ipfixExportMemberType." 1592 ::= { ipfixExportEntry 1 } 1594 ipfixExportMemberType OBJECT-TYPE 1595 SYNTAX INTEGER { 1596 unknown(0), 1597 primary(1), 1598 secondary(2), 1599 parallel(3), 1600 loadBalancing(4) 1601 } 1602 MAX-ACCESS read-only 1603 STATUS current 1604 DESCRIPTION 1605 "The type of a member Transport Session in a Transport 1606 Session group (identified by the value of ipfixExportIndex, 1607 ipfixObservationDomainId, and ipfixMeteringProcessCacheId). 1608 The following values are valid: 1610 unknown(0) 1611 This value MUST be used if the status of the group 1612 membership cannot be detected by the equipment. This 1613 value should be avoided as far as possible. 1615 primary(1) 1616 This value is used for a group member that is used as 1617 the primary target of an Exporter. Other group members 1618 (with the same ipfixExportIndex and 1619 ipfixMeteringProcessCacheId) MUST NOT have the value 1620 primary(1) but MUST have the value secondary(2). 1621 This value MUST also be specified if the Exporter does 1622 not support Transport Session grouping. In this case, 1623 the group contains only one Transport Session. 1625 secondary(2) 1626 This value is used for a group member that is used as a 1627 secondary target of an Exporter. The Exporter will use 1628 one of the targets specified as secondary(2) within the 1629 same Transport Session group when the primary target is 1630 not reachable. 1632 parallel(3) 1633 This value is used for a group member that is used for 1634 duplicate exporting, i.e., all group members identified 1635 by the ipfixExportIndex are exporting the same Records 1636 in parallel. This implies that all group members MUST 1637 have the same membertype parallel(3). 1639 loadBalancing(4) 1640 This value is used for a group member that is used 1641 as one target for load-balancing. This means that a 1642 Record is sent to one of the group members in this 1643 group identified by ipfixExportIndex. 1644 This implies that all group members MUST have the same 1645 membertype loadBalancing(4)." 1646 ::= { ipfixExportEntry 2 } 1648 -------------------------------------------------------------------- 1649 -- 1.1.5: Metering Process Table 1650 -------------------------------------------------------------------- 1651 ipfixMeteringProcessTable OBJECT-TYPE 1652 SYNTAX SEQUENCE OF IpfixMeteringProcessEntry 1653 MAX-ACCESS not-accessible 1654 STATUS current 1655 DESCRIPTION 1656 "This table lists so-called caches used at the Metering 1657 Process to store the metering data of Flows observed at 1658 the Observation Points given in the 1659 ipfixObservationPointGroupReference. The table lists the 1660 timeouts that specify when the cached metering data is 1661 expired. 1663 On Collectors, the table is not needed." 1664 ::= { ipfixMainObjects 5 } 1666 ipfixMeteringProcessEntry OBJECT-TYPE 1667 SYNTAX IpfixMeteringProcessEntry 1668 MAX-ACCESS not-accessible 1669 STATUS current 1670 DESCRIPTION 1671 "Defines an entry in the ipfixMeteringProcessTable." 1672 INDEX { ipfixMeteringProcessCacheId } 1673 ::= { ipfixMeteringProcessTable 1 } 1675 IpfixMeteringProcessEntry ::= 1676 SEQUENCE { 1677 ipfixMeteringProcessCacheId Unsigned32, 1678 ipfixMeteringProcessObservationPointGroupRef Unsigned32, 1679 ipfixMeteringProcessCacheActiveTimeout Unsigned32, 1680 ipfixMeteringProcessCacheInactiveTimeout Unsigned32 1681 } 1683 ipfixMeteringProcessCacheId OBJECT-TYPE 1684 SYNTAX Unsigned32 (1..4294967295) 1685 MAX-ACCESS not-accessible 1686 STATUS current 1687 DESCRIPTION 1688 "Locally arbitrary, but unique identifier of an entry in the 1689 ipfixMeteringProcessTable. The value is expected to remain 1690 constant from a re-initialization of the entity's network 1691 management agent to the next re-initialization." 1692 ::= { ipfixMeteringProcessEntry 1 } 1694 ipfixMeteringProcessObservationPointGroupRef OBJECT-TYPE 1695 SYNTAX Unsigned32 1696 MAX-ACCESS read-only 1697 STATUS current 1698 DESCRIPTION 1699 "The Observation Point Group Id that links this table entry 1700 to the ipfixObservationPointTable. The matching 1701 ipfixObservationPointGroupId in that table gives the 1702 Observation Points used in that cache. If the Observation 1703 Points are unknown, the 1704 ipfixMeteringProcessObservationPointGroupRef MUST be zero." 1705 ::= { ipfixMeteringProcessEntry 2 } 1707 ipfixMeteringProcessCacheActiveTimeout OBJECT-TYPE 1708 SYNTAX Unsigned32 1709 UNITS "seconds" 1710 MAX-ACCESS read-only 1711 STATUS current 1712 DESCRIPTION 1713 "On the Exporter, this object contains the time after which a 1714 Flow is expired (and a Data Record for the template is sent) 1715 even though packets matching this Flow are still received by 1716 the Metering Process. If this value is 0, the Flow is not 1717 prematurely expired." 1718 REFERENCE 1719 "RFC 5470, Architecture for IP Flow Information Export, 1720 Section 5.1.1, item 3." 1721 ::= { ipfixMeteringProcessEntry 3 } 1723 ipfixMeteringProcessCacheInactiveTimeout OBJECT-TYPE 1724 SYNTAX Unsigned32 1725 UNITS "seconds" 1726 MAX-ACCESS read-only 1727 STATUS current 1728 DESCRIPTION 1729 "On the Exporter. this object contains the time after which a 1730 Flow is expired (and a Data Record for the template is sent) 1731 when no packets matching this Flow are received by the 1732 Metering Process for the given number of seconds. If this 1733 value is zero, the Flow is expired immediately, i.e., a Data 1734 Record is sent for every packet received by the Metering 1735 Process." 1736 REFERENCE 1737 "RFC 5470, Architecture for IP Flow Information Export, 1738 Section 5.1.1, item 1" 1739 ::= { ipfixMeteringProcessEntry 4 } 1741 -------------------------------------------------------------------- 1742 -- 1.1.6: Observation Point Table 1743 -------------------------------------------------------------------- 1744 ipfixObservationPointTable OBJECT-TYPE 1745 SYNTAX SEQUENCE OF IpfixObservationPointEntry 1746 MAX-ACCESS not-accessible 1747 STATUS current 1748 DESCRIPTION 1749 "This table lists the Observation Points used within an 1750 Exporter by the Metering Process. The index 1751 ipfixObservationPointGroupId groups Observation Points 1752 and is referenced in the Metering Process table. 1754 On Collectors this table is not needed." 1755 ::= { ipfixMainObjects 6 } 1757 ipfixObservationPointEntry OBJECT-TYPE 1758 SYNTAX IpfixObservationPointEntry 1759 MAX-ACCESS not-accessible 1760 STATUS current 1761 DESCRIPTION 1762 "Defines an entry in the ipfixObservationPointTable." 1763 INDEX { 1764 ipfixObservationPointGroupId, 1765 ipfixObservationPointIndex 1766 } 1767 ::= { ipfixObservationPointTable 1 } 1769 IpfixObservationPointEntry ::= 1770 SEQUENCE { 1771 ipfixObservationPointGroupId Unsigned32, 1772 ipfixObservationPointIndex Unsigned32, 1773 ipfixObservationPointObservationDomainId Unsigned32, 1774 ipfixObservationPointPhysicalEntity PhysicalIndexOrZero, 1775 ipfixObservationPointPhysicalInterface InterfaceIndexOrZero, 1776 ipfixObservationPointPhysicalEntityDirection INTEGER 1777 } 1779 ipfixObservationPointGroupId OBJECT-TYPE 1780 SYNTAX Unsigned32 (1..4294967295) 1781 MAX-ACCESS not-accessible 1782 STATUS current 1783 DESCRIPTION 1784 "Locally arbitrary, but unique identifier of an entry in the 1785 ipfixObservationPointTable. The value is expected to remain 1786 constant from a re-initialization of the entity's network 1787 management agent to the next re-initialization. 1789 This index represents a group of Observation Points. 1791 The special value of 0 MUST NOT be used within this table 1792 but is reserved for the usage in the 1793 ipfixMeteringProcessTable. An index of 0 for the 1794 ipfixObservationPointGroupReference index in that table 1795 indicates that an Observation Point is unknown or 1796 unspecified for a Metering Process cache." 1797 ::= { ipfixObservationPointEntry 1 } 1799 ipfixObservationPointIndex OBJECT-TYPE 1800 SYNTAX Unsigned32 (1..4294967295) 1801 MAX-ACCESS not-accessible 1802 STATUS current 1803 DESCRIPTION 1804 "Locally arbitrary, but unique identifier of an entry in the 1805 ipfixObservationPointTable. The value is expected to remain 1806 constant from a re-initialization of the entity's network 1807 management agent to the next re-initialization. 1809 This index represents a single Observation Point in an 1810 Observation Point group." 1811 ::= { ipfixObservationPointEntry 2 } 1813 ipfixObservationPointObservationDomainId OBJECT-TYPE 1814 SYNTAX Unsigned32 1815 MAX-ACCESS read-only 1816 STATUS current 1818 DESCRIPTION 1819 "The Id of the Observation Domain in which this 1820 Observation Point is included. 1822 The special value of 0 indicates that the Observation 1823 Points within this group cannot be applied to a single 1824 Observation Domain." 1825 REFERENCE 1826 "RFC 5101, Specification of the IP Flow Information Export 1827 (IPFIX) Protocol for the Exchange of IP 1828 Traffic Flow Information, Section 3.1." 1829 ::= { ipfixObservationPointEntry 3 } 1831 ipfixObservationPointPhysicalEntity OBJECT-TYPE 1832 SYNTAX PhysicalIndexOrZero 1833 MAX-ACCESS read-only 1834 STATUS current 1835 DESCRIPTION 1836 "This object contains the index of a physical entity in 1837 the ENTITY MIB. This physical entity is the given 1838 Observation Point. If such a physical entity cannot be 1839 specified or is not known, then the object is zero." 1840 ::= { ipfixObservationPointEntry 4 } 1842 ipfixObservationPointPhysicalInterface OBJECT-TYPE 1843 SYNTAX InterfaceIndexOrZero 1844 MAX-ACCESS read-only 1845 STATUS current 1846 DESCRIPTION 1847 "This object contains the index of a physical interface in 1848 the IF MIB. This physical interface is the given 1849 Observation Point. If such a physical interface cannot be 1850 specified or is not known, then the object is zero. 1852 This object MAY be used stand alone or in addition to 1853 ipfixObservationPointPhysicalEntity. If 1854 ipfixObservationPointPhysicalEntity is not zero, this object 1855 MUST point to the same physical interface that is 1856 referenced in ipfixObservationPointPhysicalEntity. 1857 Otherwise, it may reference any interface in the IF MIB." 1858 ::= { ipfixObservationPointEntry 5 } 1860 ipfixObservationPointPhysicalEntityDirection OBJECT-TYPE 1861 SYNTAX INTEGER { 1862 unknown(0), 1863 ingress(1), 1864 egress(2), 1865 both(3) 1866 } 1867 MAX-ACCESS read-only 1868 STATUS current 1869 DESCRIPTION 1870 "The direction of the Flow that is monitored on the given 1871 physical entity. The following values are valid: 1873 unknown(0) 1874 This value MUST be used if a direction is not 1875 known for the given physical entity. 1877 ingress(1) 1878 This value is used for monitoring incoming Flows on the 1879 given physical entity. 1881 egress(2) 1882 This value is used for monitoring outgoing Flows on the 1883 given physical entity. 1885 both(3) 1886 This value is used for monitoring incoming and outgoing 1887 Flows on the given physical entity." 1888 ::= { ipfixObservationPointEntry 6 } 1890 -------------------------------------------------------------------- 1891 -- 1.1.7: Selection Process Table 1892 -------------------------------------------------------------------- 1893 ipfixSelectionProcessTable OBJECT-TYPE 1894 SYNTAX SEQUENCE OF IpfixSelectionProcessEntry 1895 MAX-ACCESS not-accessible 1896 STATUS current 1897 DESCRIPTION 1898 "This table contains Selector Functions connected to a 1899 Metering Process by the index ipfixMeteringProcessCacheId. 1900 The Selector Functions are grouped into Selection Processes 1901 by the ipfixSelectionProcessIndex. The Selector Functions 1902 are applied within the Selection Process to the packets 1903 observed for the given Metering Process cache in increasing 1904 order implied by the ipfixSelectionProcessSelectorIndex. 1905 This means Selector Functions with lower 1906 ipfixSelectionProcessSelectorIndex are applied first. The 1907 remaining packets are accounted for in Flow Records. 1909 Since IPFIX does not define any Selector Function (except 1910 selecting every packet), this is a placeholder for future 1911 use and a guideline for implementing enterprise-specific 1912 Selector Function objects. 1914 The following object tree should visualize how the 1915 Selector Function objects should be implemented: 1917 ipfixSelectorFunctions 1918 | 1919 +- ipfixFuncSelectAll 1920 | | 1921 | +- ipfixFuncSelectAllAvail (is the function available?) 1922 | 1923 +- ipfixFuncF2 1924 | | 1925 | +- ipfixFuncF2Avail (is the function F2 available?) 1926 | | 1927 | +- ipfixFuncF2Parameters (a table with parameters) 1928 ... 1929 | 1930 +- ipfixFuncFn... 1932 If a Selector Function takes parameters, the MIB should 1933 contain a table with an entry for each set of parameters 1934 used at the Exporter." 1935 ::= { ipfixMainObjects 7 } 1937 ipfixSelectionProcessEntry OBJECT-TYPE 1938 SYNTAX IpfixSelectionProcessEntry 1939 MAX-ACCESS not-accessible 1940 STATUS current 1941 DESCRIPTION 1942 "Defines an entry in the ipfixSelectionProcessTable." 1944 INDEX { 1945 ipfixMeteringProcessCacheId, 1946 ipfixSelectionProcessIndex, 1947 ipfixSelectionProcessSelectorIndex 1948 } 1949 ::= { ipfixSelectionProcessTable 1 } 1951 IpfixSelectionProcessEntry ::= SEQUENCE { 1952 ipfixSelectionProcessIndex Unsigned32, 1953 ipfixSelectionProcessSelectorIndex Unsigned32, 1954 ipfixSelectionProcessSelectorFunction OBJECT IDENTIFIER 1955 } 1957 ipfixSelectionProcessIndex OBJECT-TYPE 1958 SYNTAX Unsigned32 (1..4294967295) 1959 MAX-ACCESS not-accessible 1960 STATUS current 1961 DESCRIPTION 1962 "Locally arbitrary, but unique identifier of an entry in the 1963 ipfixSelectionProcessTable. The value is expected to remain 1964 constant from a re-initialization of the entity's network 1965 management agent to the next re-initialization." 1966 ::= { ipfixSelectionProcessEntry 1 } 1968 ipfixSelectionProcessSelectorIndex OBJECT-TYPE 1969 SYNTAX Unsigned32 (1..4294967295) 1970 MAX-ACCESS not-accessible 1971 STATUS current 1972 DESCRIPTION 1973 "Index specifying the order in which the referenced 1974 ipfixSelectionProcessSelectorFunctions are applied to the 1975 observed packet stream within the given Selection Process 1976 (identified by the ipfixSelectionProcessIndex). The 1977 Selector Functions are applied in increasing order, i.e., 1978 Selector Functions with lower index are applied first." 1979 ::= { ipfixSelectionProcessEntry 2 } 1981 ipfixSelectionProcessSelectorFunction OBJECT-TYPE 1982 SYNTAX OBJECT IDENTIFIER 1983 MAX-ACCESS read-only 1984 STATUS current 1985 DESCRIPTION 1986 "The pointer to the Selector Function used at position 1987 ipfixSelectionProcessSelectorIndex in the list of Selector 1988 Functions for the Metering Process cache specified by the 1989 index ipfixMeteringProcessCacheId and for the given 1990 Selection Process (identified by the 1991 ipfixSelectionProcessIndex). 1993 This usually points to an object in the IPFIX SELECTOR MIB. 1994 If the Selector Function does not take parameters, then it 1995 MUST point to the root of the function subtree. If the 1996 function takes parameters, then it MUST point to an entry 1997 in the parameter table of the Selector Function." 1998 ::= { ipfixSelectionProcessEntry 3 } 2000 -------------------------------------------------------------------- 2001 -- 1.2.1: Transport Session Statistics Table 2002 -------------------------------------------------------------------- 2003 ipfixTransportSessionStatsTable OBJECT-TYPE 2004 SYNTAX SEQUENCE OF IpfixTransportSessionStatsEntry 2005 MAX-ACCESS not-accessible 2006 STATUS current 2007 DESCRIPTION 2008 "This table lists Transport Sessions statistics between 2009 Exporting Processes and Collecting Processes." 2010 ::= { ipfixStatistics 1 } 2012 ipfixTransportSessionStatsEntry OBJECT-TYPE 2013 SYNTAX IpfixTransportSessionStatsEntry 2014 MAX-ACCESS not-accessible 2015 STATUS current 2016 DESCRIPTION 2017 "Defines an entry in the ipfixTransportSessionStatsTable." 2018 AUGMENTS { ipfixTransportSessionEntry } 2019 ::= { ipfixTransportSessionStatsTable 1 } 2021 IpfixTransportSessionStatsEntry ::= 2022 SEQUENCE { 2023 ipfixTransportSessionRate Gauge32, 2024 ipfixTransportSessionPackets Counter64, 2025 ipfixTransportSessionBytes Counter64, 2026 ipfixTransportSessionMessages Counter64, 2027 ipfixTransportSessionDiscardedMessages Counter64, 2028 ipfixTransportSessionRecords Counter64, 2029 ipfixTransportSessionTemplates Counter64, 2030 ipfixTransportSessionOptionsTemplates Counter64, 2031 ipfixTransportSessionDiscontinuityTime TimeStamp 2032 } 2034 ipfixTransportSessionRate OBJECT-TYPE 2035 SYNTAX Gauge32 2036 UNITS "bytes/second" 2037 MAX-ACCESS read-only 2038 STATUS current 2039 DESCRIPTION 2040 "The number of bytes per second received by the 2041 Collector or transmitted by the Exporter. A 2042 value of zero (0) means that no packets were sent or 2043 received, yet. This object is updated every second." 2044 ::= { ipfixTransportSessionStatsEntry 1 } 2046 ipfixTransportSessionPackets OBJECT-TYPE 2047 SYNTAX Counter64 2048 UNITS "packets" 2049 MAX-ACCESS read-only 2050 STATUS current 2051 DESCRIPTION 2052 "The number of packets received by the Collector 2053 or transmitted by the Exporter. 2054 Discontinuities in the value of this counter can occur at 2055 re-initialization of the management system and at other 2056 times as indicated by the value of 2057 ipfixTransportSessionDiscontinuityTime." 2058 ::= { ipfixTransportSessionStatsEntry 2 } 2060 ipfixTransportSessionBytes OBJECT-TYPE 2061 SYNTAX Counter64 2062 UNITS "bytes" 2063 MAX-ACCESS read-only 2064 STATUS current 2065 DESCRIPTION 2066 "The number of bytes received by the Collector 2067 or transmitted by the Exporter. 2068 Discontinuities in the value of this counter can occur at 2069 re-initialization of the management system and at other 2070 times as indicated by the value of 2071 ipfixTransportSessionDiscontinuityTime." 2072 ::= { ipfixTransportSessionStatsEntry 3 } 2074 ipfixTransportSessionMessages OBJECT-TYPE 2075 SYNTAX Counter64 2076 MAX-ACCESS read-only 2077 STATUS current 2078 DESCRIPTION 2079 "The number of IPFIX Messages received by the 2080 Collector or transmitted by the Exporter. 2081 Discontinuities in the value of this counter can occur at 2082 re-initialization of the management system and at other 2083 times as indicated by the value of 2084 ipfixTransportSessionDiscontinuityTime." 2085 ::= { ipfixTransportSessionStatsEntry 4 } 2087 ipfixTransportSessionDiscardedMessages OBJECT-TYPE 2088 SYNTAX Counter64 2089 MAX-ACCESS read-only 2090 STATUS current 2092 DESCRIPTION 2093 "The number of received IPFIX Message that are malformed, 2094 cannot be decoded, are received in the wrong order, or are 2095 missing according to the sequence number. 2097 If used at the Exporter, the number of messages that could 2098 not be sent due to, e.g., internal buffer overflows, network 2099 congestion, or routing issues. 2100 Discontinuities in the value of this counter can occur at 2101 re-initialization of the management system and at other 2102 times as indicated by the value of 2103 ipfixTransportSessionDiscontinuityTime." 2104 ::= { ipfixTransportSessionStatsEntry 5 } 2106 ipfixTransportSessionRecords OBJECT-TYPE 2107 SYNTAX Counter64 2108 MAX-ACCESS read-only 2109 STATUS current 2110 DESCRIPTION 2111 "The number of Data Records received by the Collector or 2112 transmitted by the Exporter. 2113 Discontinuities in the value of this counter can occur at 2114 re-initialization of the management system and at other 2115 times as indicated by the value of 2116 ipfixTransportSessionDiscontinuityTime." 2117 ::= { ipfixTransportSessionStatsEntry 6 } 2119 ipfixTransportSessionTemplates OBJECT-TYPE 2120 SYNTAX Counter64 2121 MAX-ACCESS read-only 2122 STATUS current 2123 DESCRIPTION 2124 "The number of Templates received or transmitted. 2125 Discontinuities in the value of this counter can occur at 2126 re-initialization of the management system and at other 2127 times as indicated by the value of 2128 ipfixTransportSessionDiscontinuityTime." 2129 ::= { ipfixTransportSessionStatsEntry 7 } 2131 ipfixTransportSessionOptionsTemplates OBJECT-TYPE 2132 SYNTAX Counter64 2133 MAX-ACCESS read-only 2134 STATUS current 2136 DESCRIPTION 2137 "The number of Options Templates received or transmitted. 2138 Discontinuities in the value of this counter can occur at 2139 re-initialization of the management system and at other 2140 times as indicated by the value of 2141 ipfixTransportSessionDiscontinuityTime." 2142 ::= { ipfixTransportSessionStatsEntry 8 } 2144 ipfixTransportSessionDiscontinuityTime OBJECT-TYPE 2145 SYNTAX TimeStamp 2146 MAX-ACCESS read-only 2147 STATUS current 2148 DESCRIPTION 2149 "The value of sysUpTime at the most recent occasion at which 2150 one or more of the Transport Session counters suffered a 2151 discontinuity. 2152 A value of zero indicates no such discontinuity has 2153 occurred since the last re-initialization of the local 2154 management subsystem." 2155 ::= { ipfixTransportSessionStatsEntry 9 } 2157 -------------------------------------------------------------------- 2158 -- 1.2.2: Template Statistics Table 2159 -------------------------------------------------------------------- 2160 ipfixTemplateStatsTable OBJECT-TYPE 2161 SYNTAX SEQUENCE OF IpfixTemplateStatsEntry 2162 MAX-ACCESS not-accessible 2163 STATUS current 2164 DESCRIPTION 2165 "This table lists statistics objects per Template." 2166 ::= { ipfixStatistics 2 } 2168 ipfixTemplateStatsEntry OBJECT-TYPE 2169 SYNTAX IpfixTemplateStatsEntry 2170 MAX-ACCESS not-accessible 2171 STATUS current 2172 DESCRIPTION 2173 "Defines an entry in the ipfixTemplateStatsTable." 2174 AUGMENTS { ipfixTemplateEntry } 2175 ::= { ipfixTemplateStatsTable 1 } 2177 IpfixTemplateStatsEntry ::= 2178 SEQUENCE { 2179 ipfixTemplateDataRecords Counter64, 2180 ipfixTemplateDiscontinuityTime TimeStamp 2181 } 2183 ipfixTemplateDataRecords OBJECT-TYPE 2184 SYNTAX Counter64 2185 MAX-ACCESS read-only 2186 STATUS current 2187 DESCRIPTION 2188 "The number of Data Records that are transmitted or received 2189 per Template. 2190 Discontinuities in the value of this counter can occur at 2191 re-initialization of the management system, and at other 2192 times as indicated by the value of 2193 ipfixTemplateDiscontinuityTime." 2194 ::= { ipfixTemplateStatsEntry 1 } 2196 ipfixTemplateDiscontinuityTime OBJECT-TYPE 2197 SYNTAX TimeStamp 2198 MAX-ACCESS read-only 2199 STATUS current 2200 DESCRIPTION 2201 "The value of sysUpTime at the most recent occasion at which 2202 the Template counter suffered a discontinuity. 2203 A value of zero indicates no such discontinuity has 2204 occurred since the last re-initialization of the local 2205 management subsystem." 2206 ::= { ipfixTemplateStatsEntry 2 } 2208 -------------------------------------------------------------------- 2209 -- 1.2.3: Metering Process Statistics Table 2210 -------------------------------------------------------------------- 2211 ipfixMeteringProcessStatsTable OBJECT-TYPE 2212 SYNTAX SEQUENCE OF IpfixMeteringProcessStatsEntry 2213 MAX-ACCESS not-accessible 2214 STATUS current 2215 DESCRIPTION 2216 "This table lists statistic objects that have data per 2217 Metering Process cache. 2219 On Collectors, this table is not needed." 2220 ::= { ipfixStatistics 3 } 2222 ipfixMeteringProcessStatsEntry OBJECT-TYPE 2223 SYNTAX IpfixMeteringProcessStatsEntry 2224 MAX-ACCESS not-accessible 2225 STATUS current 2226 DESCRIPTION 2227 "Defines an entry in the ipfixMeteringProcessStatsTable." 2228 AUGMENTS { ipfixMeteringProcessEntry } 2229 ::= { ipfixMeteringProcessStatsTable 1 } 2231 IpfixMeteringProcessStatsEntry ::= 2232 SEQUENCE { 2233 ipfixMeteringProcessCacheActiveFlows Gauge32, 2234 ipfixMeteringProcessCacheUnusedCacheEntries Gauge32, 2235 ipfixMeteringProcessCacheDataRecords Counter64, 2236 ipfixMeteringProcessCacheDiscontinuityTime TimeStamp 2237 } 2239 ipfixMeteringProcessCacheActiveFlows OBJECT-TYPE 2240 SYNTAX Gauge32 2241 MAX-ACCESS read-only 2242 STATUS current 2243 DESCRIPTION 2244 "The number of Flows currently active at this cache." 2245 ::= { ipfixMeteringProcessStatsEntry 1 } 2247 ipfixMeteringProcessCacheUnusedCacheEntries OBJECT-TYPE 2248 SYNTAX Gauge32 2249 MAX-ACCESS read-only 2250 STATUS current 2251 DESCRIPTION 2252 "The number of unused cache entries." 2253 ::= { ipfixMeteringProcessStatsEntry 2 } 2255 ipfixMeteringProcessCacheDataRecords OBJECT-TYPE 2256 SYNTAX Counter64 2257 MAX-ACCESS read-only 2258 STATUS current 2259 DESCRIPTION 2260 "The number of Data Records generated. 2261 Discontinuities in the value of this counter can occur at 2262 re-initialization of the management system and at other 2263 times as indicated by the value of 2264 ipfixTemplateDiscontinuityTime." 2265 ::= { ipfixMeteringProcessStatsEntry 3 } 2267 ipfixMeteringProcessCacheDiscontinuityTime OBJECT-TYPE 2268 SYNTAX TimeStamp 2269 MAX-ACCESS read-only 2270 STATUS current 2271 DESCRIPTION 2272 "The value of sysUpTime at the most recent occasion at which 2273 the Metering Process counter suffered a discontinuity. 2274 A value of zero indicates no such discontinuity has 2275 occurred since the last re-initialization of the local 2276 management subsystem." 2277 ::= { ipfixMeteringProcessStatsEntry 4 } 2279 -------------------------------------------------------------------- 2280 -- 1.2.4: Selection Process Statistics Table 2281 -------------------------------------------------------------------- 2282 ipfixSelectionProcessStatsTable OBJECT-TYPE 2283 SYNTAX SEQUENCE OF IpfixSelectionProcessStatsEntry 2284 MAX-ACCESS not-accessible 2285 STATUS current 2286 DESCRIPTION 2287 "This table contains statistics for the Selector Functions 2288 connected to Metering Process by the index 2289 ipfixMeteringProcessCacheId. 2291 The indexes MUST match an entry in the 2292 ipfixSelectionProcessTable." 2293 ::= { ipfixStatistics 4 } 2295 ipfixSelectionProcessStatsEntry OBJECT-TYPE 2296 SYNTAX IpfixSelectionProcessStatsEntry 2297 MAX-ACCESS not-accessible 2298 STATUS current 2299 DESCRIPTION 2300 "Defines an entry in the ipfixSelectionProcessStatsTable." 2301 AUGMENTS { ipfixSelectionProcessEntry } 2302 ::= { ipfixSelectionProcessStatsTable 1 } 2304 IpfixSelectionProcessStatsEntry ::= SEQUENCE { 2305 ipfixSelectionProcessStatsPacketsObserved Counter64, 2306 ipfixSelectionProcessStatsPacketsDropped Counter64, 2307 ipfixSelectionProcessStatsDiscontinuityTime TimeStamp 2308 } 2310 ipfixSelectionProcessStatsPacketsObserved OBJECT-TYPE 2311 SYNTAX Counter64 2312 MAX-ACCESS read-only 2313 STATUS current 2315 DESCRIPTION 2316 "The number of packets observed at the entry point of the 2317 function. The entry point may be the Observation Point or 2318 the exit point of another Selector Function. 2319 Discontinuities in the value of this counter can occur at 2320 re-initialization of the management system and at other 2321 times as indicated by the value of 2322 ipfixSelectionProcessStatsDiscontinuityTime." 2323 ::= { ipfixSelectionProcessStatsEntry 1 } 2325 ipfixSelectionProcessStatsPacketsDropped OBJECT-TYPE 2326 SYNTAX Counter64 2327 MAX-ACCESS read-only 2328 STATUS current 2329 DESCRIPTION 2330 "The number of packets dropped while selecting packets. 2331 Discontinuities in the value of this counter can occur at 2332 re-initialization of the management system and at other 2333 times as indicated by the value of 2334 ipfixSelectionProcessStatsDiscontinuityTime." 2335 ::= { ipfixSelectionProcessStatsEntry 2 } 2337 ipfixSelectionProcessStatsDiscontinuityTime OBJECT-TYPE 2338 SYNTAX TimeStamp 2339 MAX-ACCESS read-only 2340 STATUS current 2341 DESCRIPTION 2342 "The value of sysUpTime at the most recent occasion at which 2343 one or more of the Selector counters suffered a 2344 discontinuity. 2345 A value of zero indicates no such discontinuity has 2346 occurred since the last re-initialization of the local 2347 management subsystem." 2348 ::= { ipfixSelectionProcessStatsEntry 3 } 2350 --================================================================== 2351 -- 2: Conformance Information 2352 --================================================================== 2353 ipfixCompliances OBJECT IDENTIFIER ::= { ipfixConformance 1 } 2354 ipfixGroups OBJECT IDENTIFIER ::= { ipfixConformance 2 } 2356 -------------------------------------------------------------------- 2357 -- 2.1: Compliance Statements 2358 -------------------------------------------------------------------- 2359 ipfixCollectorCompliance MODULE-COMPLIANCE 2360 STATUS current 2361 DESCRIPTION 2362 "An implementation that builds an IPFIX Collector 2363 that complies to this module MUST implement the objects 2364 defined in the mandatory group ipfixCommonGroup. 2366 The implementation of all objects in the other groups is 2367 optional and depends on the corresponding functionality 2368 implemented in the equipment. 2370 An implementation that is compliant to this MIB module 2371 is limited to use only the values TCP (6), UDP (17), and 2372 SCTP (132) in the ipfixTransportSessionProtocol object 2373 because these are the only protocol currently specified 2374 for usage within IPFIX (see RFC 5101)." 2375 MODULE -- this module 2376 MANDATORY-GROUPS { 2377 ipfixCommonGroup 2378 } 2380 GROUP ipfixCommonStatsGroup 2381 DESCRIPTION 2382 "These objects should be implemented if the statistics 2383 function is implemented in the equipment." 2384 ::= { ipfixCompliances 1 } 2386 ipfixExporterCompliance MODULE-COMPLIANCE 2387 STATUS current 2388 DESCRIPTION 2389 "An implementation that builds an IPFIX Exporter that 2390 complies to this module MUST implement the objects defined 2391 in the mandatory group ipfixCommonGroup. The implementation 2392 of all other objects depends on the implementation of the 2393 corresponding functionality in the equipment." 2394 MODULE -- this module 2396 MANDATORY-GROUPS { 2397 ipfixCommonGroup, 2398 ipfixExporterGroup 2399 } 2401 GROUP ipfixCommonStatsGroup 2402 DESCRIPTION 2403 "These objects should be implemented if the statistics 2404 function is implemented in the equipment." 2406 GROUP ipfixExporterStatsGroup 2407 DESCRIPTION 2408 "These objects MUST be implemented if statistical functions 2409 are implemented on the equipment." 2410 ::= { ipfixCompliances 2 } 2412 -------------------------------------------------------------------- 2413 -- 2.2: MIB Grouping 2414 -------------------------------------------------------------------- 2415 ipfixCommonGroup OBJECT-GROUP 2416 OBJECTS { 2417 ipfixTransportSessionProtocol, 2418 ipfixTransportSessionSourceAddressType, 2419 ipfixTransportSessionSourceAddress, 2420 ipfixTransportSessionDestinationAddressType, 2421 ipfixTransportSessionDestinationAddress, 2422 ipfixTransportSessionSourcePort, 2423 ipfixTransportSessionDestinationPort, 2424 ipfixTransportSessionSctpAssocId, 2425 ipfixTransportSessionDeviceMode, 2426 ipfixTransportSessionTemplateRefreshTimeout, 2427 ipfixTransportSessionOptionsTemplateRefreshTimeout, 2428 ipfixTransportSessionTemplateRefreshPacket, 2429 ipfixTransportSessionOptionsTemplateRefreshPacket, 2430 ipfixTransportSessionIpfixVersion, 2431 ipfixTransportSessionStatus, 2433 ipfixTemplateSetId, 2434 ipfixTemplateAccessTime, 2436 ipfixTemplateDefinitionIeId, 2437 ipfixTemplateDefinitionIeLength, 2438 ipfixTemplateDefinitionEnterpriseNumber, 2439 ipfixTemplateDefinitionFlags 2440 } 2441 STATUS current 2443 DESCRIPTION 2444 "The main IPFIX objects." 2445 ::= { ipfixGroups 1 } 2447 ipfixCommonStatsGroup OBJECT-GROUP 2448 OBJECTS { 2449 ipfixTransportSessionRate, 2450 ipfixTransportSessionPackets, 2451 ipfixTransportSessionBytes, 2452 ipfixTransportSessionMessages, 2453 ipfixTransportSessionDiscardedMessages, 2454 ipfixTransportSessionRecords, 2455 ipfixTransportSessionTemplates, 2456 ipfixTransportSessionOptionsTemplates, 2457 ipfixTransportSessionDiscontinuityTime, 2459 ipfixTemplateDataRecords, 2460 ipfixTemplateDiscontinuityTime 2461 } 2462 STATUS current 2463 DESCRIPTION 2464 "Common statistical objects." 2465 ::= { ipfixGroups 2 } 2467 ipfixExporterGroup OBJECT-GROUP 2468 OBJECTS { 2469 ipfixExportMemberType, 2471 ipfixMeteringProcessObservationPointGroupRef, 2472 ipfixMeteringProcessCacheActiveTimeout, 2473 ipfixMeteringProcessCacheInactiveTimeout, 2475 ipfixObservationPointObservationDomainId, 2476 ipfixObservationPointPhysicalEntity, 2477 ipfixObservationPointPhysicalInterface, 2478 ipfixObservationPointPhysicalEntityDirection, 2480 ipfixSelectionProcessSelectorFunction 2481 } 2482 STATUS current 2483 DESCRIPTION 2484 "The main objects for Exporters." 2485 ::= { ipfixGroups 3 } 2487 ipfixExporterStatsGroup OBJECT-GROUP 2488 OBJECTS { 2489 ipfixMeteringProcessCacheActiveFlows, 2490 ipfixMeteringProcessCacheUnusedCacheEntries, 2491 ipfixMeteringProcessCacheDataRecords, 2492 ipfixMeteringProcessCacheDiscontinuityTime, 2494 ipfixSelectionProcessStatsPacketsObserved, 2495 ipfixSelectionProcessStatsPacketsDropped, 2496 ipfixSelectionProcessStatsDiscontinuityTime 2497 } 2498 STATUS current 2499 DESCRIPTION 2500 "The statistical objects for Exporters." 2501 ::= { ipfixGroups 4 } 2503 END 2505 8.2. IPFIX SELECTOR MIB Definition 2507 IPFIX-SELECTOR-MIB DEFINITIONS ::= BEGIN 2509 IMPORTS 2510 MODULE-IDENTITY, OBJECT-TYPE, mib-2 2511 FROM SNMPv2-SMI -- RFC2578 2512 TruthValue 2513 FROM SNMPv2-TC -- RFC2579 2514 MODULE-COMPLIANCE, OBJECT-GROUP 2515 FROM SNMPv2-CONF; -- RFC2580 2517 ipfixSelectorMIB MODULE-IDENTITY 2518 LAST-UPDATED "201203220000Z" -- 22 March 2012 2519 ORGANIZATION "IETF IPFIX Working Group" 2520 CONTACT-INFO 2521 "WG charter: 2522 http://www.ietf.org/html.charters/ipfix-charter.html 2524 Mailing Lists: 2525 General Discussion: ipfix@ietf.org 2526 To Subscribe: http://www1.ietf.org/mailman/listinfo/ipfix 2527 Archive: 2528 http://www1.ietf.org/mail-archive/web/ipfix/current/index.html 2530 Editor: 2531 Thomas Dietz 2532 NEC Europe Ltd. 2533 NEC Laboratories Europe 2534 Network Research Division 2535 Kurfuersten-Anlage 36 2536 69115 Heidelberg 2537 Germany 2538 Phone: +49 6221 4342-128 2539 Email: Thomas.Dietz@nw.neclab.eu 2541 Atsushi Kobayashi 2542 NTT Information Sharing Platform Laboratories 2543 3-9-11 Midori-cho 2544 Musashino-shi 2545 180-8585 2546 Japan 2547 Phone: +81-422-59-3978 2548 Email: akoba@nttv6.net 2550 Benoit Claise 2551 Cisco Systems, Inc. 2552 De Kleetlaan 6a b1 2553 Diegem 1831 2554 Belgium 2555 Phone: +32 2 704 5622 2556 Email: bclaise@cisco.com 2558 Gerhard Muenz 2559 Technische Universitaet Muenchen 2560 Department of Informatics 2561 Chair for Network Architectures and Services (I8) 2562 Boltzmannstr. 3 2563 85748 Garching 2564 Germany 2565 Email: muenz@net.in.tum.de 2566 DESCRIPTION 2567 "The IPFIX SELECTOR MIB module defined in this section 2568 provides the standard Filtering and Sampling functions that 2569 can be referenced in the ipfixSelectionProcessTable. All 2570 standard Filtering and Sampling functions MUST be registered 2571 in the subtree under object ipfixSelectorFunctions 2572 (1.3.6.1.2.1.194.1.1). The toplevel OIDs in the subtree 2573 under object ipfixSelectorFunctions MUST be registered in a 2574 subregistry maintained by IANA at 2575 http://www.iana.org/assignments/smi-numbers. 2577 New selector functions MUST be registered at IANA and are 2578 subject to Expert Review RFC 5226, i.e., review by one of a 2579 group of experts designated by an IETF Area Director. The 2580 group of experts MUST check the requested MIB objects for 2581 completeness and accuracy of the description. Requests for 2582 MIB objects that duplicate the functionality of existing 2583 objects SHOULD be declined. The smallest available OID 2584 SHOULD be assigned to a new MIB objects. The specification 2585 of new MIB objects SHOULD follow the structure specified in 2586 RFC [ThisRFC] and MUST be published using a well- 2587 established and persistent publication medium. The experts 2588 will initially be drawn from the Working Group Chairs and 2589 document editors of the IPFIX and PSAMP Working Groups. 2591 Copyright (c) 2012 IETF Trust and the persons identified as 2592 authors of the code. All rights reserved. 2594 Redistribution and use in source and binary forms, with or 2595 without modification, is permitted pursuant to, and subject 2596 to the license terms contained in, the Simplified BSD 2597 License set forth in Section 4.c of the IETF Trust's 2598 Legal Provisions Relating to IETF Documents 2599 (http://trustee.ietf.org/license-info)." 2601 -- Revision history 2603 REVISION "201203220000Z" -- 22 March 2012 2604 DESCRIPTION 2605 "Update to MIB description to reflect updated registration 2606 of new Sampling and Filtering Functions. Published as RFC 2607 [ThisRFC]." 2609 REVISION "201003150000Z" -- 15 March 2010 2610 DESCRIPTION 2611 "Initial version, published as RFC 5815." 2613 ::= { mib-2 194 } 2615 -- Note for RFC Editor: substitute [ThisRFC] with the newly 2616 -- assigned number in the previous sections. 2618 --****************************************************************** 2619 -- Top Level Structure of the MIB 2620 --****************************************************************** 2622 ipfixSelectorObjects OBJECT IDENTIFIER 2623 ::= { ipfixSelectorMIB 1 } 2624 ipfixSelectorConformance OBJECT IDENTIFIER 2625 ::= { ipfixSelectorMIB 2 } 2627 --================================================================== 2628 -- 1: Objects used by all IPFIX implementations 2629 --================================================================== 2630 -------------------------------------------------------------------- 2631 -- 1.1: Packet Selector Functions for IPFIX 2632 -------------------------------------------------------------------- 2633 ipfixSelectorFunctions OBJECT IDENTIFIER 2634 ::= { ipfixSelectorObjects 1 } 2636 -------------------------------------------------------------------- 2637 -- 1.1.1: Function 1: Selecting All Packets 2638 -------------------------------------------------------------------- 2639 ipfixFuncSelectAll OBJECT IDENTIFIER 2640 ::= { ipfixSelectorFunctions 1 } 2642 ipfixFuncSelectAllAvail OBJECT-TYPE 2643 SYNTAX TruthValue 2644 MAX-ACCESS read-only 2645 STATUS current 2646 DESCRIPTION 2647 "This object indicates the availability of the trivial 2648 function of selecting all packets. This function is always 2649 available." 2650 ::= { ipfixFuncSelectAll 1 } 2652 --================================================================== 2653 -- 2: Conformance Information 2654 --================================================================== 2655 ipfixSelectorCompliances OBJECT IDENTIFIER 2656 ::= { ipfixSelectorConformance 1 } 2657 ipfixSelectorGroups OBJECT IDENTIFIER 2658 ::= { ipfixSelectorConformance 2 } 2660 -------------------------------------------------------------------- 2661 -- 2.1: Compliance Statements 2662 -------------------------------------------------------------------- 2663 ipfixSelectorBasicCompliance MODULE-COMPLIANCE 2664 STATUS current 2665 DESCRIPTION 2666 "An implementation that builds an IPFIX Exporter that 2667 complies to this module MUST implement the objects defined 2668 in the mandatory group ipfixBasicGroup. The implementation 2669 of all other objects depends on the implementation of the 2670 corresponding functionality in the equipment." 2671 MODULE -- this module 2672 MANDATORY-GROUPS { 2673 ipfixSelectorBasicGroup 2674 } 2675 ::= { ipfixSelectorCompliances 1 } 2677 -------------------------------------------------------------------- 2678 -- 2.2: MIB Grouping 2679 -------------------------------------------------------------------- 2680 ipfixSelectorBasicGroup OBJECT-GROUP 2681 OBJECTS { 2682 ipfixFuncSelectAllAvail 2683 } 2685 STATUS current 2686 DESCRIPTION 2687 "The main IPFIX objects." 2688 ::= { ipfixSelectorGroups 1 } 2690 END 2692 9. Security Considerations 2694 There are no management objects defined in this MIB module that have 2695 a MAX-ACCESS clause of read-write and/or read-create. So, if these 2696 MIB modules are implemented correctly, then there is no risk that an 2697 intruder can alter or create any management objects of these MIB 2698 modules via direct SNMP SET operations. 2700 Some of the readable objects in these MIB modules (i.e., objects with 2701 a MAX-ACCESS other than not-accessible) may be considered sensitive 2702 or vulnerable in some network environments. It is thus important to 2703 control even GET and/or NOTIFY access to these objects and possibly 2704 to even encrypt the values of these objects when sending them over 2705 the network via SNMP. These are the tables and objects and their 2706 sensitivity/vulnerability: 2708 o ipfixTransportSessionTable - contains configuration data that 2709 might be sensitive because objects in this table may reveal 2710 information about the network infrastructure 2712 o ipfixExportTable - contains configuration data that might be 2713 sensitive because object in this table may reveal information 2714 about the network infrastructure as well 2716 o ipfixMeteringProcessTable - contains configuration data that might 2717 be sensitive because objects in this table may reveal information 2718 about the IPFIX Device itself 2720 o ipfixObservationPointTable - contains configuration data that 2721 might be sensitive because objects in this table may reveal 2722 information about the IPFIX Device itself and the network 2723 infrastructure 2725 o ipfixSelectorFunctions - currently contains no sensitive data but 2726 might want to be secured anyway since it may contain sensitive 2727 data in a future version 2729 All other objects and tables contain no data that is considered 2730 sensitive. 2732 SNMP versions prior to SNMPv3 did not include adequate security. 2733 Even if the network itself is secure (for example by using IPsec), 2734 even then, there is no control as to who on the secure network is 2735 allowed to access and GET/SET (read/change/create/delete) the objects 2736 in these MIB modules. 2738 It is RECOMMENDED that implementers consider the security features as 2739 provided by the SNMPv3 framework (see [RFC3410] Section 8), including 2740 full support for the SNMPv3 cryptographic mechanisms (for 2741 authentication and privacy). 2743 Further, deployment of SNMP versions prior to SNMPv3 is NOT 2744 RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to 2745 enable cryptographic security. It is then a customer/operator 2746 responsibility to ensure that the SNMP entity giving access to an 2747 instance of these MIB modules is properly configured to give access 2748 to the objects only to those principals (users) that have legitimate 2749 rights to indeed GET or SET (change/create/delete) them. 2751 10. IANA Considerations 2753 The MIB module in this document uses the following IANA-assigned 2754 OBJECT IDENTIFIER values recorded in the SMI Numbers registry: 2756 Descriptor OBJECT IDENTIFIER value 2757 ---------- ----------------------- 2758 ipfixMIB { mib-2 193 } 2759 ipfixSelectorMIB { mib-2 194 } 2761 NOTE TO RFC EDITOR: substitute ThisRFC with the RFC number of this 2762 document after assignment in the following section. 2764 The IPFIX SELECTOR MIB registry as defined in [RFC5815] Section 10 2765 will be removed by IANA as its use is discontinued with this 2766 document. 2768 IANA will create and maintain a subregistry at 2769 http://www.iana.org/assignments/smi-numbers in which the toplevel 2770 OIDs in the subtree under object ipfixSelectorFunctions MUST be 2771 registered. The initial version of this subregistry should contain 2772 the following content: 2774 Sub-registry Name: IPFIX-SELECTOR-MIB Functions 2775 Reference: [ThisRFC] 2776 Registration Procedures: Expert Review [RFC5226] 2778 Prefix: 2779 mib-2.ipfixSelectorMIB.ipfixSelectorObjects.ipfixSelectorFunctions 2780 (1.3.6.1.2.1.194.1.1) 2781 Decimal Name Description Reference 2782 ------- ---- ----------- --------- 2783 1 ipfixFuncSelectAll Select everything [ThisRFC] 2785 Additions to this subregistry are subject to Expert Review [RFC5226], 2786 i.e., review by one of a group of experts designated by an IETF Area 2787 Director. The group of experts MUST check the requested MIB objects 2788 for completeness and accuracy of the description. Requests for MIB 2789 objects that duplicate the functionality of existing objects SHOULD 2790 be declined. The smallest available OID SHOULD be assigned to new 2791 MIB objects. The specification of new MIB objects SHOULD follow the 2792 structure specified in Section 6 and MUST be published using a well- 2793 established and persistent publication medium. The experts will 2794 initially be drawn from the Working Group Chairs and document editors 2795 of the IPFIX and PSAMP Working Groups. 2797 11. Acknowledgments 2799 This document is a product of the IPFIX Working Group. The authors 2800 would like to thank the following persons: Paul Aitken for his 2801 detailed review, Dan Romascanu and the MIB doctors, and many more, 2802 for the technical reviews and feedback. 2804 12. References 2806 12.1. Normative References 2808 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2809 Requirement Levels", BCP 14, RFC 2119, March 1997. 2811 [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. 2812 Schoenwaelder, Ed., "Structure of Management Information 2813 Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. 2815 [RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J. 2816 Schoenwaelder, Ed., "Textual Conventions for SMIv2", 2817 STD 58, RFC 2579, April 1999. 2819 [RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, 2820 "Conformance Statements for SMIv2", STD 58, RFC 2580, 2821 April 1999. 2823 [RFC4001] Daniele, M., Haberman, B., Routhier, S., and J. 2824 Schoenwaelder, "Textual Conventions for Internet Network 2825 Addresses", RFC 4001, February 2005. 2827 [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group 2828 MIB", RFC 2863, June 2000. 2830 [RFC3873] Pastor, J. and M. Belinchon, "Stream Control Transmission 2831 Protocol (SCTP) Management Information Base (MIB)", 2832 RFC 3873, September 2004. 2834 [RFC4133] Bierman, A. and K. McCloghrie, "Entity MIB (Version 3)", 2835 RFC 4133, August 2005. 2837 [RFC5101] Claise, B., "Specification of the IP Flow Information 2838 Export (IPFIX) Protocol for the Exchange of IP Traffic 2839 Flow Information", RFC 5101, January 2008. 2841 [RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J. 2842 Meyer, "Information Model for IP Flow Information Export", 2843 RFC 5102, January 2008. 2845 [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an 2846 IANA Considerations Section in RFCs", BCP 26, RFC 5226, 2847 May 2008. 2849 [RFC5815] Dietz, T., Kobayashi, A., Claise, B., and G. Muenz, 2850 "Definitions of Managed Objects for IP Flow Information 2851 Export", RFC 5815, April 2010. 2853 12.2. Informative References 2855 [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, 2856 "Introduction and Applicability Statements for Internet- 2857 Standard Management Framework", RFC 3410, December 2002. 2859 [RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander, 2860 "Requirements for IP Flow Information Export (IPFIX)", 2861 RFC 3917, October 2004. 2863 [RFC5470] Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek, 2864 "Architecture for IP Flow Information Export", RFC 5470, 2865 March 2009. 2867 [RFC5472] Zseby, T., Boschi, E., Brownlee, N., and B. Claise, "IP 2868 Flow Information Export (IPFIX) Applicability", RFC 5472, 2869 March 2009. 2871 [RFC5474] Duffield, N., Chiou, D., Claise, B., Greenberg, A., 2872 Grossglauser, M., and J. Rexford, "A Framework for Packet 2873 Selection and Reporting", RFC 5474, March 2009. 2875 [RFC5475] Zseby, T., Molina, M., Duffield, N., Niccolini, S., and F. 2876 Raspall, "Sampling and Filtering Techniques for IP Packet 2877 Selection", RFC 5475, March 2009. 2879 [RFC5476] Claise, B., Johnson, A., and J. Quittek, "Packet Sampling 2880 (PSAMP) Protocol Specifications", RFC 5476, March 2009. 2882 Authors' Addresses 2884 Thomas Dietz (editor) 2885 NEC Europe, Ltd. 2886 NEC Laboratories Europe 2887 Network Research Division 2888 Kurfuersten-Anlage 36 2889 Heidelberg 69115 2890 DE 2892 Phone: +49 6221 4342-128 2893 Email: Thomas.Dietz@neclab.eu 2895 Atsushi Kobayashi 2896 NTT Information Sharing Platform Laboratories 2897 3-9-11 Midori-cho 2898 Musashino-shi, Tokyo 180-8585 2899 JA 2901 Phone: +81-422-59-3978 2902 Email: akoba@nttv6.net 2904 Benoit Claise 2905 Cisco Systems, Inc. 2906 De Kleetlaan 6a b1 2907 Diegem 1831 2908 BE 2910 Phone: +32 2 704 5622 2911 Email: bclaise@cisco.com 2913 Gerhard Muenz 2914 Technische Universitaet Muenchen 2915 Department of Informatics 2916 Chair for Network Architectures and Services (I8) 2917 Boltzmannstr. 3 2918 Garching 85748 2919 DE 2921 Email: muenz@net.in.tum.de