idnits 2.17.1 draft-ietf-ipfix-info-15.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 20. -- Found old boilerplate from RFC 3978, Section 5.5, updated by RFC 4748 on line 7837. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 7848. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 7855. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 7861. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 3 instances of lines with multicast IPv4 addresses in the document. If these are generic example addresses, they should be changed to use the 233.252.0.x range defined in RFC 5771 Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (February 24, 2007) is 6265 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Unused Reference: 'IEEE.802-11.1999' is defined on line 3722, but no explicit reference was found in the text == Outdated reference: A later version (-26) exists of draft-ietf-ipfix-protocol-24 -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1323 (Obsoleted by RFC 7323) -- Obsolete informational reference (is this intentional?): RFC 1385 (Obsoleted by RFC 6814) -- Obsolete informational reference (is this intentional?): RFC 2434 (Obsoleted by RFC 5226) -- Obsolete informational reference (is this intentional?): RFC 2460 (Obsoleted by RFC 8200) -- Obsolete informational reference (is this intentional?): RFC 2629 (Obsoleted by RFC 7749) -- Obsolete informational reference (is this intentional?): RFC 2960 (Obsoleted by RFC 4960) -- Obsolete informational reference (is this intentional?): RFC 3036 (Obsoleted by RFC 5036) Summary: 1 error (**), 0 flaws (~~), 4 warnings (==), 15 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Quittek 3 Internet-Draft NEC 4 Intended status: Standards Track S. Bryant 5 Expires: August 28, 2007 B. Claise 6 P. Aitken 7 Cisco Systems Inc. 8 J. Meyer 9 PayPal 10 February 24, 2007 12 Information Model for IP Flow Information Export 13 draft-ietf-ipfix-info-15 15 Status of this Memo 17 By submitting this Internet-Draft, each author represents that any 18 applicable patent or other IPR claims of which he or she is aware 19 have been or will be disclosed, and any of which he or she becomes 20 aware will be disclosed, in accordance with Section 6 of BCP 79. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF), its areas, and its working groups. Note that 24 other groups may also distribute working documents as Internet- 25 Drafts. 27 Internet-Drafts are draft documents valid for a maximum of six months 28 and may be updated, replaced, or obsoleted by other documents at any 29 time. It is inappropriate to use Internet-Drafts as reference 30 material or to cite them other than as "work in progress." 32 The list of current Internet-Drafts can be accessed at 33 http://www.ietf.org/ietf/1id-abstracts.txt. 35 The list of Internet-Draft Shadow Directories can be accessed at 36 http://www.ietf.org/shadow.html. 38 This Internet-Draft will expire on August 28, 2007. 40 Copyright Notice 42 Copyright (C) The IETF Trust (2007). 44 Abstract 46 This memo defines an information model for the IP Flow Information 47 eXport (IPFIX) protocol. It is used by the IPFIX protocol for 48 encoding measured traffic information and information related to the 49 traffic Observation Point, the traffic Metering Process and the 50 Exporting Process. Although developed for the IPFIX protocol, the 51 model is defined in an open way that easily allows using it in other 52 protocols, interfaces, and applications. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 7 57 2. Properties of IPFIX Protocol Information Elements . . . . . . 8 58 2.1. Information Elements Specification Template . . . . . . . 8 59 2.2. Scope of Information Elements . . . . . . . . . . . . . . 9 60 2.3. Naming Conventions for Information Elements . . . . . . . 10 61 3. Type Space . . . . . . . . . . . . . . . . . . . . . . . . . 11 62 3.1. Abstract Data Types . . . . . . . . . . . . . . . . . . . 11 63 3.1.1. unsigned8 . . . . . . . . . . . . . . . . . . . . . 11 64 3.1.2. unsigned16 . . . . . . . . . . . . . . . . . . . . . 11 65 3.1.3. unsigned32 . . . . . . . . . . . . . . . . . . . . . 11 66 3.1.4. unsigned64 . . . . . . . . . . . . . . . . . . . . . 11 67 3.1.5. signed8 . . . . . . . . . . . . . . . . . . . . . . 11 68 3.1.6. signed16 . . . . . . . . . . . . . . . . . . . . . . 11 69 3.1.7. signed32 . . . . . . . . . . . . . . . . . . . . . . 12 70 3.1.8. signed64 . . . . . . . . . . . . . . . . . . . . . . 12 71 3.1.9. float32 . . . . . . . . . . . . . . . . . . . . . . 12 72 3.1.10. float64 . . . . . . . . . . . . . . . . . . . . . . 12 73 3.1.11. boolean . . . . . . . . . . . . . . . . . . . . . . 12 74 3.1.12. macAddress . . . . . . . . . . . . . . . . . . . . . 12 75 3.1.13. octetArray . . . . . . . . . . . . . . . . . . . . . 12 76 3.1.14. string . . . . . . . . . . . . . . . . . . . . . . . 12 77 3.1.15. dateTimeSeconds . . . . . . . . . . . . . . . . . . 12 78 3.1.16. dateTimeMilliseconds . . . . . . . . . . . . . . . . 12 79 3.1.17. dateTimeMicroseconds . . . . . . . . . . . . . . . . 13 80 3.1.18. dateTimeNanoseconds . . . . . . . . . . . . . . . . 13 81 3.1.19. ipv4Address . . . . . . . . . . . . . . . . . . . . 13 82 3.1.20. ipv6Address . . . . . . . . . . . . . . . . . . . . 13 83 3.2. Data Type Semantics . . . . . . . . . . . . . . . . . . . 13 84 3.2.1. quantity . . . . . . . . . . . . . . . . . . . . . . 13 85 3.2.2. totalCounter . . . . . . . . . . . . . . . . . . . . 13 86 3.2.3. deltaCounter . . . . . . . . . . . . . . . . . . . . 14 87 3.2.4. identifier . . . . . . . . . . . . . . . . . . . . . 14 88 3.2.5. flags . . . . . . . . . . . . . . . . . . . . . . . 14 89 4. Information Element Identifiers . . . . . . . . . . . . . . . 14 90 5. Information Elements . . . . . . . . . . . . . . . . . . . . 18 91 5.1. Identifiers . . . . . . . . . . . . . . . . . . . . . . . 19 92 5.1.1. lineCardId . . . . . . . . . . . . . . . . . . . . . 19 93 5.1.2. portId . . . . . . . . . . . . . . . . . . . . . . . 20 94 5.1.3. ingressInterface . . . . . . . . . . . . . . . . . . 20 95 5.1.4. egressInterface . . . . . . . . . . . . . . . . . . 20 96 5.1.5. meteringProcessId . . . . . . . . . . . . . . . . . 21 97 5.1.6. exportingProcessId . . . . . . . . . . . . . . . . . 21 98 5.1.7. flowId . . . . . . . . . . . . . . . . . . . . . . . 21 99 5.1.8. templateId . . . . . . . . . . . . . . . . . . . . . 21 100 5.1.9. observationDomainId . . . . . . . . . . . . . . . . 22 101 5.1.10. observationPointId . . . . . . . . . . . . . . . . . 22 102 5.1.11. commonPropertiesId . . . . . . . . . . . . . . . . . 22 103 5.2. Metering and Exporting Process Configuration . . . . . . 23 104 5.2.1. exporterIPv4Address . . . . . . . . . . . . . . . . 23 105 5.2.2. exporterIPv6Address . . . . . . . . . . . . . . . . 23 106 5.2.3. exporterTransportPort . . . . . . . . . . . . . . . 24 107 5.2.4. collectorIPv4Address . . . . . . . . . . . . . . . . 24 108 5.2.5. collectorIPv6Address . . . . . . . . . . . . . . . . 24 109 5.2.6. collectorInterface . . . . . . . . . . . . . . . . . 24 110 5.2.7. collectorProtocolVersion . . . . . . . . . . . . . . 25 111 5.2.8. collectorTransportProtocol . . . . . . . . . . . . . 25 112 5.2.9. collectorTransportPort . . . . . . . . . . . . . . . 26 113 5.2.10. flowKeyIndicator . . . . . . . . . . . . . . . . . . 26 114 5.3. Metering and Exporting Process Statistics . . . . . . . . 27 115 5.3.1. exportedMessageTotalCount . . . . . . . . . . . . . 27 116 5.3.2. exportedOctetTotalCount . . . . . . . . . . . . . . 27 117 5.3.3. exportedFlowRecordTotalCount . . . . . . . . . . . . 28 118 5.3.4. observedFlowTotalCount . . . . . . . . . . . . . . . 28 119 5.3.5. ignoredPacketTotalCount . . . . . . . . . . . . . . 28 120 5.3.6. ignoredOctetTotalCount . . . . . . . . . . . . . . . 28 121 5.3.7. notSentFlowTotalCount . . . . . . . . . . . . . . . 29 122 5.3.8. notSentPacketTotalCount . . . . . . . . . . . . . . 29 123 5.3.9. notSentOctetTotalCount . . . . . . . . . . . . . . . 29 124 5.4. IP Header Fields . . . . . . . . . . . . . . . . . . . . 30 125 5.4.1. ipVersion . . . . . . . . . . . . . . . . . . . . . 30 126 5.4.2. sourceIPv4Address . . . . . . . . . . . . . . . . . 31 127 5.4.3. sourceIPv6Address . . . . . . . . . . . . . . . . . 31 128 5.4.4. sourceIPv4PrefixLength . . . . . . . . . . . . . . . 31 129 5.4.5. sourceIPv6PrefixLength . . . . . . . . . . . . . . . 31 130 5.4.6. sourceIPv4Prefix . . . . . . . . . . . . . . . . . . 31 131 5.4.7. sourceIPv6Prefix . . . . . . . . . . . . . . . . . . 32 132 5.4.8. destinationIPv4Address . . . . . . . . . . . . . . . 32 133 5.4.9. destinationIPv6Address . . . . . . . . . . . . . . . 32 134 5.4.10. destinationIPv4PrefixLength . . . . . . . . . . . . 32 135 5.4.11. destinationIPv6PrefixLength . . . . . . . . . . . . 33 136 5.4.12. destinationIPv4Prefix . . . . . . . . . . . . . . . 33 137 5.4.13. destinationIPv6Prefix . . . . . . . . . . . . . . . 33 138 5.4.14. ipTTL . . . . . . . . . . . . . . . . . . . . . . . 33 139 5.4.15. protocolIdentifier . . . . . . . . . . . . . . . . . 34 140 5.4.16. nextHeaderIPv6 . . . . . . . . . . . . . . . . . . . 34 141 5.4.17. ipDiffServCodePoint . . . . . . . . . . . . . . . . 34 142 5.4.18. ipPrecedence . . . . . . . . . . . . . . . . . . . . 35 143 5.4.19. ipClassOfService . . . . . . . . . . . . . . . . . . 35 144 5.4.20. postIpClassOfService . . . . . . . . . . . . . . . . 36 145 5.4.21. flowLabelIPv6 . . . . . . . . . . . . . . . . . . . 36 146 5.4.22. isMulticast . . . . . . . . . . . . . . . . . . . . 36 147 5.4.23. fragmentIdentification . . . . . . . . . . . . . . . 37 148 5.4.24. fragmentOffset . . . . . . . . . . . . . . . . . . . 37 149 5.4.25. fragmentFlags . . . . . . . . . . . . . . . . . . . 38 150 5.4.26. ipHeaderLength . . . . . . . . . . . . . . . . . . . 39 151 5.4.27. ipv4IHL . . . . . . . . . . . . . . . . . . . . . . 39 152 5.4.28. totalLengthIPv4 . . . . . . . . . . . . . . . . . . 39 153 5.4.29. ipTotalLength . . . . . . . . . . . . . . . . . . . 39 154 5.4.30. payloadLengthIPv6 . . . . . . . . . . . . . . . . . 40 155 5.5. Transport Header Fields . . . . . . . . . . . . . . . . . 40 156 5.5.1. sourceTransportPort . . . . . . . . . . . . . . . . 41 157 5.5.2. destinationTransportPort . . . . . . . . . . . . . . 41 158 5.5.3. udpSourcePort . . . . . . . . . . . . . . . . . . . 41 159 5.5.4. udpDestinationPort . . . . . . . . . . . . . . . . . 42 160 5.5.5. udpMessageLength . . . . . . . . . . . . . . . . . . 42 161 5.5.6. tcpSourcePort . . . . . . . . . . . . . . . . . . . 42 162 5.5.7. tcpDestinationPort . . . . . . . . . . . . . . . . . 42 163 5.5.8. tcpSequenceNumber . . . . . . . . . . . . . . . . . 43 164 5.5.9. tcpAcknowledgementNumber . . . . . . . . . . . . . . 43 165 5.5.10. tcpWindowSize . . . . . . . . . . . . . . . . . . . 43 166 5.5.11. tcpWindowScale . . . . . . . . . . . . . . . . . . . 43 167 5.5.12. tcpUrgentPointer . . . . . . . . . . . . . . . . . . 44 168 5.5.13. tcpHeaderLength . . . . . . . . . . . . . . . . . . 44 169 5.5.14. icmpTypeCodeIPv4 . . . . . . . . . . . . . . . . . . 44 170 5.5.15. icmpTypeIPv4 . . . . . . . . . . . . . . . . . . . . 45 171 5.5.16. icmpCodeIPv4 . . . . . . . . . . . . . . . . . . . . 45 172 5.5.17. icmpTypeCodeIPv6 . . . . . . . . . . . . . . . . . . 45 173 5.5.18. icmpTypeIPv6 . . . . . . . . . . . . . . . . . . . . 45 174 5.5.19. icmpCodeIPv6 . . . . . . . . . . . . . . . . . . . . 46 175 5.5.20. igmpType . . . . . . . . . . . . . . . . . . . . . . 46 176 5.6. Sub-IP Header Fields . . . . . . . . . . . . . . . . . . 46 177 5.6.1. sourceMacAddress . . . . . . . . . . . . . . . . . . 47 178 5.6.2. postSourceMacAddress . . . . . . . . . . . . . . . . 47 179 5.6.3. vlanId . . . . . . . . . . . . . . . . . . . . . . . 47 180 5.6.4. postVlanId . . . . . . . . . . . . . . . . . . . . . 47 181 5.6.5. destinationMacAddress . . . . . . . . . . . . . . . 48 182 5.6.6. postDestinationMacAddress . . . . . . . . . . . . . 48 183 5.6.7. wlanChannelId . . . . . . . . . . . . . . . . . . . 48 184 5.6.8. wlanSSID . . . . . . . . . . . . . . . . . . . . . . 48 185 5.6.9. mplsTopLabelTTL . . . . . . . . . . . . . . . . . . 49 186 5.6.10. mplsTopLabelExp . . . . . . . . . . . . . . . . . . 49 187 5.6.11. postMplsTopLabelExp . . . . . . . . . . . . . . . . 49 188 5.6.12. mplsLabelStackDepth . . . . . . . . . . . . . . . . 50 189 5.6.13. mplsLabelStackLength . . . . . . . . . . . . . . . . 50 190 5.6.14. mplsPayloadLength . . . . . . . . . . . . . . . . . 50 191 5.6.15. mplsTopLabelStackSection . . . . . . . . . . . . . . 51 192 5.6.16. mplsLabelStackSection2 . . . . . . . . . . . . . . . 51 193 5.6.17. mplsLabelStackSection3 . . . . . . . . . . . . . . . 51 194 5.6.18. mplsLabelStackSection4 . . . . . . . . . . . . . . . 52 195 5.6.19. mplsLabelStackSection5 . . . . . . . . . . . . . . . 52 196 5.6.20. mplsLabelStackSection6 . . . . . . . . . . . . . . . 52 197 5.6.21. mplsLabelStackSection7 . . . . . . . . . . . . . . . 53 198 5.6.22. mplsLabelStackSection8 . . . . . . . . . . . . . . . 53 199 5.6.23. mplsLabelStackSection9 . . . . . . . . . . . . . . . 53 200 5.6.24. mplsLabelStackSection10 . . . . . . . . . . . . . . 54 201 5.7. Derived Packet Properties . . . . . . . . . . . . . . . . 54 202 5.7.1. ipPayloadLength . . . . . . . . . . . . . . . . . . 55 203 5.7.2. ipNextHopIPv4Address . . . . . . . . . . . . . . . . 55 204 5.7.3. ipNextHopIPv6Address . . . . . . . . . . . . . . . . 55 205 5.7.4. bgpSourceAsNumber . . . . . . . . . . . . . . . . . 55 206 5.7.5. bgpDestinationAsNumber . . . . . . . . . . . . . . . 56 207 5.7.6. bgpNextAdjacentAsNumber . . . . . . . . . . . . . . 56 208 5.7.7. bgpPrevAdjacentAsNumber . . . . . . . . . . . . . . 56 209 5.7.8. bgpNextHopIPv4Address . . . . . . . . . . . . . . . 57 210 5.7.9. bgpNextHopIPv6Address . . . . . . . . . . . . . . . 57 211 5.7.10. mplsTopLabelType . . . . . . . . . . . . . . . . . . 57 212 5.7.11. mplsTopLabelIPv4Address . . . . . . . . . . . . . . 58 213 5.7.12. mplsTopLabelIPv6Address . . . . . . . . . . . . . . 58 214 5.7.13. mplsVpnRouteDistinguisher . . . . . . . . . . . . . 58 215 5.8. Min/Max Flow Properties . . . . . . . . . . . . . . . . . 59 216 5.8.1. minimumIpTotalLength . . . . . . . . . . . . . . . . 59 217 5.8.2. maximumIpTotalLength . . . . . . . . . . . . . . . . 59 218 5.8.3. minimumTTL . . . . . . . . . . . . . . . . . . . . . 60 219 5.8.4. maximumTTL . . . . . . . . . . . . . . . . . . . . . 60 220 5.8.5. ipv4Options . . . . . . . . . . . . . . . . . . . . 60 221 5.8.6. ipv6ExtensionHeaders . . . . . . . . . . . . . . . . 62 222 5.8.7. tcpControlBits . . . . . . . . . . . . . . . . . . . 64 223 5.8.8. tcpOptions . . . . . . . . . . . . . . . . . . . . . 64 224 5.9. Flow Time Stamps . . . . . . . . . . . . . . . . . . . . 65 225 5.9.1. flowStartSeconds . . . . . . . . . . . . . . . . . . 66 226 5.9.2. flowEndSeconds . . . . . . . . . . . . . . . . . . . 66 227 5.9.3. flowStartMilliseconds . . . . . . . . . . . . . . . 66 228 5.9.4. flowEndMilliseconds . . . . . . . . . . . . . . . . 66 229 5.9.5. flowStartMicroseconds . . . . . . . . . . . . . . . 67 230 5.9.6. flowEndMicroseconds . . . . . . . . . . . . . . . . 67 231 5.9.7. flowStartNanoseconds . . . . . . . . . . . . . . . . 67 232 5.9.8. flowEndNanoseconds . . . . . . . . . . . . . . . . . 67 233 5.9.9. flowStartDeltaMicroseconds . . . . . . . . . . . . . 67 234 5.9.10. flowEndDeltaMicroseconds . . . . . . . . . . . . . . 68 235 5.9.11. systemInitTimeMilliseconds . . . . . . . . . . . . . 68 236 5.9.12. flowStartSysUpTime . . . . . . . . . . . . . . . . . 68 237 5.9.13. flowEndSysUpTime . . . . . . . . . . . . . . . . . . 69 238 5.10. Per-Flow Counters . . . . . . . . . . . . . . . . . . . . 69 239 5.10.1. octetDeltaCount . . . . . . . . . . . . . . . . . . 70 240 5.10.2. postOctetDeltaCount . . . . . . . . . . . . . . . . 70 241 5.10.3. octetDeltaSumOfSquares . . . . . . . . . . . . . . . 70 242 5.10.4. octetTotalCount . . . . . . . . . . . . . . . . . . 71 243 5.10.5. postOctetTotalCount . . . . . . . . . . . . . . . . 71 244 5.10.6. octetTotalSumOfSquares . . . . . . . . . . . . . . . 71 245 5.10.7. packetDeltaCount . . . . . . . . . . . . . . . . . . 72 246 5.10.8. postPacketDeltaCount . . . . . . . . . . . . . . . . 72 247 5.10.9. packetTotalCount . . . . . . . . . . . . . . . . . . 72 248 5.10.10. postPacketTotalCount . . . . . . . . . . . . . . . . 72 249 5.10.11. droppedOctetDeltaCount . . . . . . . . . . . . . . . 73 250 5.10.12. droppedPacketDeltaCount . . . . . . . . . . . . . . 73 251 5.10.13. droppedOctetTotalCount . . . . . . . . . . . . . . . 73 252 5.10.14. droppedPacketTotalCount . . . . . . . . . . . . . . 73 253 5.10.15. postMCastPacketDeltaCount . . . . . . . . . . . . . 74 254 5.10.16. postMCastOctetDeltaCount . . . . . . . . . . . . . . 74 255 5.10.17. postMCastPacketTotalCount . . . . . . . . . . . . . 74 256 5.10.18. postMCastOctetTotalCount . . . . . . . . . . . . . . 75 257 5.10.19. tcpSynTotalCount . . . . . . . . . . . . . . . . . . 75 258 5.10.20. tcpFinTotalCount . . . . . . . . . . . . . . . . . . 75 259 5.10.21. tcpRstTotalCount . . . . . . . . . . . . . . . . . . 76 260 5.10.22. tcpPshTotalCount . . . . . . . . . . . . . . . . . . 76 261 5.10.23. tcpAckTotalCount . . . . . . . . . . . . . . . . . . 76 262 5.10.24. tcpUrgTotalCount . . . . . . . . . . . . . . . . . . 76 263 5.11. Miscellaneous Flow Properties . . . . . . . . . . . . . . 77 264 5.11.1. flowActiveTimeout . . . . . . . . . . . . . . . . . 77 265 5.11.2. flowIdleTimeout . . . . . . . . . . . . . . . . . . 77 266 5.11.3. flowEndReason . . . . . . . . . . . . . . . . . . . 78 267 5.11.4. flowDurationMilliseconds . . . . . . . . . . . . . . 78 268 5.11.5. flowDurationMicroseconds . . . . . . . . . . . . . . 78 269 5.11.6. flowDirection . . . . . . . . . . . . . . . . . . . 79 270 5.12. Padding . . . . . . . . . . . . . . . . . . . . . . . . . 79 271 5.12.1. paddingOctets . . . . . . . . . . . . . . . . . . . 79 272 6. Extending the Information Model . . . . . . . . . . . . . . . 80 273 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 80 274 7.1. IPFIX Information Elements . . . . . . . . . . . . . . . 80 275 7.2. MPLS Label Type Identifier . . . . . . . . . . . . . . . 81 276 7.3. XML Namespace and Schema . . . . . . . . . . . . . . . . 81 277 8. Security Considerations . . . . . . . . . . . . . . . . . . . 82 278 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 82 279 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 82 280 10.1. Normative References . . . . . . . . . . . . . . . . . . 82 281 10.2. Informative References . . . . . . . . . . . . . . . . . 83 282 Appendix A. XML Specification of IPFIX Information Elements . . 86 283 Appendix B. XML Specification of Abstract Data Types . . . . . . 156 284 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 168 285 Intellectual Property and Copyright Statements . . . . . . . . . 170 287 1. Introduction 289 The IP Flow Information eXport (IPFIX) protocol serves for 290 transmitting information related to measured IP traffic over the 291 Internet. The protocol specification in [I-D.ietf-ipfix-protocol] 292 defines how Information Elements are transmitted. For Information 293 Elements, it specifies the encoding of a set of basic data types. 294 However, the list of Information Elements that can be transmitted by 295 the protocol, such as Flow attributes (source IP address, number of 296 packets, etc.) and information about the Metering and Exporting 297 Process (packet Observation Point, sampling rate, Flow timeout 298 interval, etc.), is not specified in [I-D.ietf-ipfix-protocol]. 300 This document complements the IPFIX protocol specification by 301 providing the IPFIX information model. IPFIX-specific terminology 302 used in this document is defined in section 2 of [I-D.ietf-ipfix- 303 protocol]. As in [I-D.ietf-ipfix-protocol], these IPFIX-specific 304 terms have the first letter of a word capitalized when used in this 305 document. 307 The use of the term 'information model' is not fully in line with the 308 definition of this term in [RFC3444]. The IPFIX information model 309 does not specify relationships between Information Elements, but also 310 it does not specify a concrete encoding of Information Elements. 311 Besides the encoding used by the IPFIX protocol, also other encodings 312 of IPFIX Information Elements can be applied, for example XML-based 313 encodings. 315 The main part of this document is section 5 defining the (extensible) 316 list of Information Elements to be transmitted by the IPFIX protocol. 317 Section 2 defines a template for specifying IPFIX Information 318 Elements in section 5. Section 3 defines the set of abstract data 319 types that are available for IPFIX Information Elements. Section 6 320 discusses extensibility of the IPFIX information model. 322 The main bodies of sections 2, 3 and 5 were generated from XML 323 documents. The XML-based specification of template, abstract data 324 types and IPFIX Information Elements can be used for automatically 325 checking syntactical correctness of the specification of IPFIX 326 Information Elements. It can further be used for generating IPFIX 327 protocol implementation code that deals with processing IPFIX 328 Information Elements. Also code for applications that further 329 process traffic information transmitted via the IPFIX protocol can be 330 generated with the XML specification of IPFIX Information Elements. 332 For that reason, the XML document that served as source for section 5 333 and the XML schema that served as source for sections 2 and 3 are 334 attached to this document in Appendices A and B. 336 Note that although partially generated from the attached XML 337 documents, the main body of this document is normative while the 338 appendices are informational. 340 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 341 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 342 document are to be interpreted as described in [RFC2119]. 344 2. Properties of IPFIX Protocol Information Elements 346 2.1. Information Elements Specification Template 348 Information in messages of the IPFIX protocol is modeled in terms of 349 Information Elements of the IPFIX information model. IPFIX 350 Information Elements are specified in section 5. For specifying 351 these Information Elements, a template is used that is described 352 below. 354 All Information Elements specified for the IPFIX protocol either in 355 this document or by any future extension MUST have the following 356 properties defined: 358 name - A unique and meaningful name for the Information Element. 360 elementId - A numeric identifier of the Information Element. If this 361 identifier is used without an enterprise identifier (see 362 [I-D.ietf-ipfix-protocol] and enterpriseId below), then it is 363 globally unique and the list of allowed values is administered by 364 IANA. It is used for compact identification of an Information 365 Element when encoding Templates in the protocol. 367 description - The semantics of this Information Element. Describes 368 how this Information Element is derived from the Flow or other 369 information available to the observer. 371 dataType - One of the types listed in section 3.1 of this document or 372 in a future extension of the information model. The type space 373 for attributes is constrained to facilitate implementation. The 374 existing type space does however encompass most basic types used 375 in modern programming languages, as well as some derived types 376 (such as ipv4Address) which are common to this domain and useful 377 to distinguish. 379 status - The status of the specification of this Information Element. 380 Allowed values are 'current', 'deprecated', and 'obsolete'. 382 Enterprise-specific Information Elements MUST have the following 383 property defined: 385 enterpriseId - Enterprises may wish to define Information Elements 386 without registering them with IANA, for example for enterprise- 387 internal purposes. For such Information Elements the Information 388 Element identifier described above is not sufficient when the 389 Information Element is used outside the enterprise. If 390 specifications of enterprise-specific Information Elements are 391 made public and/or if enterprise-specific identifiers are used by 392 the IPFIX protocol outside the enterprise, then the enterprise- 393 specific identifier MUST be made globally unique by combining it 394 with an enterprise identifier. Valid values for the enterpriseId 395 are defined by IANA as SMI network management private enterprise 396 codes. They are defined at 397 http://www.iana.org/assignments/enterprise-numbers. 399 All Information Elements specified for the IPFIX protocol either in 400 this document or by any future extension MAY have the following 401 properties defined: 403 dataTypeSemantics - The integral types may be qualified by additional 404 semantic details. Valid values for the data type semantics are 405 specified in section 3.2 of this document or in a future extension 406 of the information model. 408 units - If the Information Element is a measure of some kind, the 409 units identify what the measure is. 411 range - Some Information Elements may only be able to take on a 412 restricted set of values which can be expressed as a range (e.g. 0 413 through 511 inclusive). If this is the case, the valid inclusive 414 range should be specified. 416 reference - Identifies additional specifications which more precisely 417 define this item or provide additional context for its use. 419 2.2. Scope of Information Elements 421 By default, most Information Elements have a scope specified in their 422 definitions. 424 o The Information Elements defined in sections 5.2 and 5.3 have a 425 default of "a specific Metering Process" or of "a specific 426 Exporting Process", respectively. 427 o The Information Elements defined in sections 5.4 - 5.11 have a 428 scope of "a specific Flow". 430 Within Data Records defined by Option Templates, the IPFIX protocol 431 allows further limiting of the Information Element scope. The new 432 scope is specified by one or more scope fields and defined as the 433 combination of all specified scope values, see section 3.4.2.1 on 434 IPFIX scopes in [I-D.ietf-ipfix-protocol]. 436 2.3. Naming Conventions for Information Elements 438 The following naming conventions were used for naming Information 439 Elements in this document. It is recommended that extensions of the 440 model use the same conventions. 442 o Names of Information Elements schould be descriptive. 443 o Names of Information Elements that are not enterprise-specific 444 MUST be unique within the IPFIX Information Model. Enterprise- 445 specific Information Elements SHOULD be prefixed with a vendor 446 name. 447 o Names of Information Elements start with non-capitalized letters. 448 o Composed names use capital letters for the first letter of each 449 component (except for the first one). All other letters are non- 450 capitalized, even for acronyms. Exceptions are made for acronyms 451 containing non-capitalized letter, such as 'IPv4' and 'IPv6'. 452 Examples are sourceMacAddress and destinationIPv4Address. 453 o Middleboxes [RFC3234] may change Flow properties, such as the DSCP 454 value or the source IP address. If an IPFIX Observation Point is 455 located in the path of a Flow before one or more middleboxes that 456 potentially modify packets of the Flow, then it may be desirable 457 to also report Flow properties after the modification performed by 458 the middleboxes. An example is an Observation Point before a 459 packet marker changing a packet's IPv4 TOS field that is encoded 460 in Information Element classOfServiceIPv4. Then the value 461 observed and reported by Information Element classOfServiceIPv4 is 462 valid at the Observation Point, but not anymore after the packet 463 passed the packet marker. For reporting the change value of the 464 TOS field, the IPFIX information model uses Information Elements 465 that have a name prefix "post", for example, 466 "postClassOfServiceIPv4". Information Elements with prefix "post" 467 report on Flow properties that are not necessarily observed at the 468 Observation Point, but which are obtained within the Flow's 469 Observation Domain by other means that are considered to be 470 sufficiently reliable, for example, by analyzing the packet 471 marker's marking tables. 473 3. Type Space 475 This section describes the abstract data types that can be used for 476 the specification of IPFIX Information Elements in section 4. 477 Section 3.1 describes the set of abstract data types. 479 Abstract data types unsigned8, unsigned16, unsigned32, unsigned64, 480 signed8, signed16, signed32, and signed64 are integral data types. 481 As described in section 3.2, their data type semantics can be further 482 specified, for example, by 'totalCounter', 'deltaCounter', 483 'identifier' or 'flags'. 485 3.1. Abstract Data Types 487 This section describes the set of valid abstract data types of the 488 IPFIX information model. Note that further abstract data types may 489 be specified by future extensions of the IPFIX information model. 491 3.1.1. unsigned8 493 The type "unsigned8" represents a non-negative integer value in the 494 range of 0 to 255. 496 3.1.2. unsigned16 498 The type "unsigned16" represents a non-negative integer value in the 499 range of 0 to 65535. 501 3.1.3. unsigned32 503 The type "unsigned32" represents a non-negative integer value in the 504 range of 0 to 4294967295. 506 3.1.4. unsigned64 508 The type "unsigned64" represents a non-negative integer value in the 509 range of 0 to 18446744073709551615. 511 3.1.5. signed8 513 The type "signed8" represents an integer value in the range of -128 514 to 127. 516 3.1.6. signed16 518 The type "signed16" represents an integer value in the range of 519 -32768 to 32767. 521 3.1.7. signed32 523 The type "signed32" represents an integer value in the range of 524 -2147483648 to 2147483647. 526 3.1.8. signed64 528 The type "signed64" represents an integer value in the range of 529 -9223372036854775808 to 9223372036854775807. 531 3.1.9. float32 533 The type "float32" corresponds to an IEEE single-precision 32-bit 534 floating point type as defined in [IEEE.754.1985]. 536 3.1.10. float64 538 The type "float64" corresponds to an IEEE double-precision 64-bit 539 floating point type as defined in [IEEE.754.1985]. 541 3.1.11. boolean 543 The type "boolean" represents a binary value. The only allowed 544 values are "true" and "false". 546 3.1.12. macAddress 548 The type "macAddress" represents a string of 6 octets. 550 3.1.13. octetArray 552 The type "octetArray" represents a finite length string of octets. 554 3.1.14. string 556 The type "string" represents a finite length string of valid 557 characters from the Unicode character encoding set [ISO.10646- 558 1.1993]. Unicode allows for ASCII [ISO.646.1991] and many other 559 international character sets to be used. 561 3.1.15. dateTimeSeconds 563 The type "dateTimeSeconds" represents a time value in units of 564 seconds normalized to the GMT time zone. 566 3.1.16. dateTimeMilliseconds 568 The type "dateTimeMilliseconds" represents a time value in units of 569 milliseconds normalized to the GMT time zone. 571 3.1.17. dateTimeMicroseconds 573 The type "dateTimeMicroseconds" represents a time value in units of 574 microseconds normalized to the GMT time zone. 576 3.1.18. dateTimeNanoseconds 578 The type "dateTimeNanoseconds" represents a time value in units of 579 nanoseconds normalized to the GMT time zone. 581 3.1.19. ipv4Address 583 The type "ipv4Address" represents a value of an IPv4 address. 585 3.1.20. ipv6Address 587 The type "ipv6Address" represents a value of an IPv6 address. 589 3.2. Data Type Semantics 591 This section describes the set of valid data type semantics of the 592 IPFIX information model. Note that further data type semantics may 593 be specified by future extensions of the IPFIX information model. 595 3.2.1. quantity 597 A quantity value represents a discrete measured value pertaining to 598 the record. This is distinguished from counters which represent an 599 ongoing measured value whose "odometer" reading is captured as part 600 of a given record. If no semantic qualifier is given, the 601 Information Elements that have an integral data type should behave as 602 a quantity. 604 3.2.2. totalCounter 606 An integral value reporting the value of a counter. Counters are 607 unsigned and wrap back to zero after reaching the limit of the type. 608 For example, an unsigned64 with counter semantics will continue to 609 increment until reaching the value of 2**64 - 1. At this point the 610 next increment will wrap its value to zero and continue counting from 611 zero. The semantics of a total counter is similar to the semantics 612 of counters used in SNMP, such as Counter32 defined in RFC 2578 613 [RFC2578]. The only difference between total counters and counters 614 used in SNMP is that the total counters have an initial value of 0. 615 A total counter counts independently of the export of its value. 617 3.2.3. deltaCounter 619 An integral value reporting the value of a counter. Counters are 620 unsigned and wrap back to zero after reaching the limit of the type. 621 For example, an unsigned64 with counter semantics will continue to 622 increment until reaching the value of 2**64 - 1. At this point the 623 next increment will wrap its value to zero and continue counting from 624 zero. The semantics of a delta counter is similar to the semantics 625 of counters used in SNMP, such as Counter32 defined in RFC 2578 626 [RFC2578]. The only difference between delta counters and counters 627 used in SNMP is that the delta counters have an initial value of 0. 628 A delta counter is reset to 0 each time its value is exported. 630 3.2.4. identifier 632 An integral value which serves as an identifier. Specifically 633 mathematical operations on two identifiers (aside from the equality 634 operation) are meaningless. For example, Autonomous System ID 1 * 635 Autonomous System ID 2 is meaningless. 637 3.2.5. flags 639 An integral value which actually represents a set of bit fields. 640 Logical operations are appropriate on such values, but not other 641 mathematical operations. Flags should always be of an unsigned type. 643 4. Information Element Identifiers 645 All Information Elements defined in section 5 of this document or in 646 future extensions of the IPFIX information model have their 647 identifiers assigned by IANA. Their identifiers can be retrieved at 648 http://www.iana.org/assignments/ipfix-element-numbers. 650 EDITORIAL NOTE: this URL needs probably to be updated after IANA 651 created a URL for IPFIX Information Elements 653 The value of these identifiers are in the range of 1 - 32767. Within 654 this range, Information Element identifier values in the sub-range of 655 1-127 are compatible with field types used by NetFlow version 9 656 [RFC3954]. 658 +---------------------------------+---------------------------------+ 659 | Range of IANA-assigned | Description | 660 | Information Element identifiers | | 661 +---------------------------------+---------------------------------+ 662 | 0 | Reserved. | 663 | 1 - 127 | Information Element identifiers | 664 | | compatible with NetFlow version | 665 | | 9 field types [RFC3954]. | 666 | 128 - 32767 | Further Information Element | 667 | | identifiers. | 668 +---------------------------------+---------------------------------+ 670 Enterprise-specific Information Element identifiers have the same 671 range of 1-32767, but they are coupled with an additional enterprise 672 identifier. 674 Enterprise-specific Information Element identifiers can be chosen by 675 an enterprise arbitrarily within the range of 1-32767. The same 676 identifier may be assigned by other enterprises for different 677 purposes. 679 Still, Collecting Processes can distinguish these Information 680 Elements because the Information Element identifier is coupled with 681 an enterprise identifier. 683 Enterprise identifiers MUST be registered as SMI network management 684 private enterprise code numbers with IANA. The registry can be found 685 at http://www.iana.org/assignments/enterprise-numbers. 687 The following list gives an overview of the Information Element 688 identifiers that are specified in section 5 and are compatible with 689 field types used by NetFlow version 9 [RFC3954]. 691 +----+----------------------------+-------+-------------------------+ 692 | ID | Name | ID | Name | 693 +----+----------------------------+-------+-------------------------+ 694 | 1 | octetDeltaCount | 43 | RESERVED | 695 | 2 | packetDeltaCount | 44 | sourceIPv4Prefix | 696 | 3 | RESERVED | 45 | destinationIPv4Prefix | 697 | 4 | protocolIdentifier | 46 | mplsTopLabelType | 698 | 5 | ipClassOfService | 47 | mplsTopLabelIPv4Address | 699 | 6 | tcpControlBits | 48-51 | RESERVED | 700 | 7 | sourceTransportPort | 52 | minimumTTL | 701 | 8 | sourceIPv4Address | 53 | maximumTTL | 702 | 9 | sourceIPv4PrefixLength | 54 | fragmentIdentification | 703 | 10 | ingressInterface | 55 | postIpClassOfService | 704 | 11 | destinationTransportPort | 56 | sourceMacAddress | 705 | 12 | destinationIPv4Address | 57 |postDestinationMacAddress| 706 | 13 | destinationIPv4PrefixLength| 58 | vlanId | 707 | 14 | egressInterface | 59 | postVlanId | 708 | 15 | ipNextHopIPv4Address | 60 | ipVersion | 709 | 16 | bgpSourceAsNumber | 61 | flowDirection | 710 | 17 | bgpDestinationAsNumber | 62 | ipNextHopIPv6Address | 711 | 18 | bgpNexthopIPv4Address | 63 | bgpNexthopIPv6Address | 712 | 19 | postMCastPacketDeltaCount | 64 | ipv6ExtensionHeaders | 713 | 20 | postMCastOctetDeltaCount | 65-69 | RESERVED | 714 | 21 | flowEndSysUpTime | 70 | mplsTopLabelStackSection| 715 | 22 | flowStartSysUpTime | 71 | mplsLabelStackSection2 | 716 | 23 | postOctetDeltaCount | 72 | mplsLabelStackSection3 | 717 | 24 | postPacketDeltaCount | 73 | mplsLabelStackSection4 | 718 | 25 | minimumIpTotalLength | 74 | mplsLabelStackSection5 | 719 | 26 | maximumIpTotalLength | 75 | mplsLabelStackSection6 | 720 | 27 | sourceIPv6Address | 76 | mplsLabelStackSection7 | 721 | 28 | destinationIPv6Address | 77 | mplsLabelStackSection8 | 722 | 29 | sourceIPv6PrefixLength | 78 | mplsLabelStackSection9 | 723 | 30 | destinationIPv6PrefixLength| 79 | mplsLabelStackSection10 | 724 | 31 | flowLabelIPv6 | 80 | destinationMacAddress | 725 | 32 | icmpTypeCodeIPv4 | 81 | postSourceMacAddress | 726 | 33 | igmpType | 82-84 | RESERVED | 727 | 34 | RESERVED | 85 | octetTotalCount | 728 | 35 | RESERVED | 86 | packetTotalCount | 729 | 36 | flowActiveTimeout | 87 | RESERVED | 730 | 37 | flowIdleTimeout | 88 | fragmentOffset | 731 | 38 | RESERVED | 89 | RESERVED | 732 | 39 | RESERVED | 90 |mplsVpnRouteDistinguisher| 733 | 40 | exportedOctetTotalCount |91-127 | RESERVED | 734 | 41 | exportedMessageTotalCount | | | 735 | 42 |exportedFlowRecordTotalCount| | | 736 +----+----------------------------+-------+-------------------------+ 738 The following list gives an overview of the Information Element 739 identifiers that are specified in section 5 and extend the list of 740 Information Element identifiers specified already in [RFC3954]. 742 +-----+---------------------------+-----+---------------------------+ 743 | ID | Name | ID | Name | 744 +-----+---------------------------+-----+---------------------------+ 745 | 128 | bgpNextAdjacentAsNumber | 169 | destinationIPv6Prefix | 746 | 129 | bgpPrevAdjacentAsNumber | 170 | sourceIPv6Prefix | 747 | 130 | exporterIPv4Address | 171 | postOctetTotalCount | 748 | 131 | exporterIPv6Address | 172 | postPacketTotalCount | 749 | 132 | droppedOctetDeltaCount | 173 | flowKeyIndicator | 750 | 133 | droppedPacketDeltaCount | 174 | postMCastPacketTotalCount | 751 | 134 | droppedOctetTotalCount | 175 | postMCastOctetTotalCount | 752 | 135 | droppedPacketTotalCount | 176 | icmpTypeIPv4 | 753 | 136 | flowEndReason | 177 | icmpCodeIPv4 | 754 | 137 | commonPropertiesId | 178 | icmpTypeIPv6 | 755 | 138 | observationPointId | 179 | icmpCodeIPv6 | 756 | 139 | icmpTypeCodeIPv6 | 180 | udpSourcePort | 757 | 140 | mplsTopLabelIPv6Address | 181 | udpDestinationPort | 758 | 141 | lineCardId | 182 | tcpSourcePort | 759 | 142 | portId | 183 | tcpDestinationPort | 760 | 143 | meteringProcessId | 184 | tcpSequenceNumber | 761 | 144 | exportingProcessId | 185 | tcpAcknowledgementNumber | 762 | 145 | templateId | 186 | tcpWindowSize | 763 | 146 | wlanChannelId | 187 | tcpUrgentPointer | 764 | 147 | wlanSSID | 188 | tcpHeaderLength | 765 | 148 | flowId | 189 | ipHeaderLength | 766 | 149 | observationDomainId | 190 | totalLengthIPv4 | 767 | 150 | flowStartSeconds | 191 | payloadLengthIPv6 | 768 | 151 | flowEndSeconds | 192 | ipTTL | 769 | 152 | flowStartMilliseconds | 193 | nextHeaderIPv6 | 770 | 153 | flowEndMilliseconds | 194 | mplsPayloadLength | 771 | 154 | flowStartMicroseconds | 195 | ipDiffServCodePoint | 772 | 155 | flowEndMicroseconds | 196 | ipPrecedence | 773 | 156 | flowStartNanoseconds | 197 | fragmentFlags | 774 | 157 | flowEndNanoseconds | 198 | octetDeltaSumOfSquares | 775 | 158 | flowStartDeltaMicroseconds| 199 | octetTotalSumOfSquares | 776 | 159 | flowEndDeltaMicroseconds | 200 | mplsTopLabelTTL | 777 | 160 | systemInitTimeMilliseconds| 201 | mplsLabelStackLength | 778 | 161 | flowDurationMilliseconds | 202 | mplsLabelStackDepth | 779 | 162 | flowDurationMicroseconds | 203 | mplsTopLabelExp | 780 | 163 | observedFlowTotalCount | 204 | ipPayloadLength | 781 | 164 | ignoredPacketTotalCount | 205 | udpMessageLength | 782 | 165 | ignoredOctetTotalCount | 206 | isMulticast | 783 | 166 | notSentFlowTotalCount | 207 | ipv4IHL | 784 | 167 | notSentPacketTotalCount | 208 | ipv4Options | 785 | 168 | notSentOctetTotalCount | 209 | tcpOptions | 786 +-----+---------------------------+-----+---------------------------+ 787 +-----+---------------------------+-----+---------------------------+ 788 | ID | Name | ID | Name | 789 +-----+---------------------------+-----+---------------------------+ 790 | 210 | paddingOctets | 218 | tcpSynTotalCount | 791 | 211 | collectorIPv4Address | 219 | tcpFinTotalCount | 792 | 212 | collectorIPv6Address | 220 | tcpRstTotalCount | 793 | 213 | collectorInterface | 221 | tcpPshTotalCount | 794 | 214 | collectorProtocolVersion | 222 | tcpAckTotalCount | 795 | 215 | collectorTransportProtocol| 223 | tcpUrgTotalCount | 796 | 216 | collectorTransportPort | 224 | ipTotalLength | 797 | 217 | exporterTransportPort | 237 | postMplsTopLabelExp | 798 | | | 238 | tcpWindowScale | 799 +-----+---------------------------+-----+---------------------------+ 801 5. Information Elements 803 This section describes the Information Elements of the IPFIX 804 information model. The elements are grouped into 12 groups according 805 to their semantics and their applicability: 807 1. Identifiers 808 2. Metering and Exporting Process Configuration 809 3. Metering and Exporting Process Statistics 810 4. IP Header Fields 811 5. Transport Header Fields 812 6. Sub-IP Header Fields 813 7. Derived Packet Properties 814 8. Min/Max Flow Properties 815 9. Flow Time Stamps 816 10. Per-Flow Counters 817 11. Miscellaneous Flow Properties 818 12. Padding 820 The Information Elements that are derived from fields of packets or 821 from packet treatment, such as the Information Elements in groups 822 4.-7., can serve as Flow Keys used for mapping packets to Flows. 824 If they do not serve as Flow Keys, their value may change from packet 825 to packet within a single Flow. For Information Elements with values 826 that are derived from fields of packets or from packet treatment and 827 for which the value may change from packet to packet within a single 828 Flow, the IPFIX information model defines that their value is 829 determined by the first packet observed for the corresponding Flow, 830 unless the description of the Information Element explicitly 831 specifies a different semantics. This simple rule allows writing all 832 Information Elements related to header fields once when the first 833 packet of the Flow is observed. For further observed packets of the 834 same Flow, only Flow properties that depend on more than one packet, 835 such as the Information Elements in groups 8.-11., need to be 836 updated. 838 Information Elements with a name having the "post" prefix, for 839 example, "postClassOfServiceIPv4", do not report properties that were 840 actually observed at the Observation Point, but retrieved by other 841 means within the Observation Domain. These information Elements can 842 be used if there are middlebox functions within the Observation 843 Domain changing Flow properties after packets passed the Observation 844 Point. 846 Information Elemens in this section use the reference property to 847 reference [RFC0768], [RFC0791], [RFC0792], [RFC0793], [RFC1108], 848 [RFC1112], [RFC1191], [RFC1323], [RFC1385], [RFC1812], [RFC1930], 849 [RFC2113], [RFC2119], [RFC4302], [RFC2460], [RFC2675], [RFC2863], 850 [RFC2960], [RFC3031], [RFC3032], [RFC3036], [RFC3193], [RFC3234], 851 [RFC3260], [RFC3270], [RFC3376], [RFC3954], [RFC4271], [RFC4291], 852 [RFC4302], [RFC4303], [RFC4364], [RFC4382], [RFC4443], [IEEE.802- 853 11.1999], [IEEE.802-1Q.2003], and [IEEE.802-3.2002]. 855 5.1. Identifiers 857 Information Elements grouped in the table below are identifying 858 components of the IPFIX architecture, of an IPFIX Device, or of the 859 IPFIX protocol. All of them have an integral abstract data type and 860 data type semantics "identifier" as described in section 3.2.4. 862 Typically, some of them are used for limiting scopes of other 863 Information Elements. However, also other Information Elements MAY 864 be used for limiting scopes. Note also that all Information Elements 865 listed below MAY be used for other purposes than limiting scopes. 867 +-----+---------------------------+-----+---------------------------+ 868 | ID | Name | ID | Name | 869 +-----+---------------------------+-----+---------------------------+ 870 | 141 | lineCardId | 148 | flowId | 871 | 142 | portId | 145 | templateId | 872 | 10 | ingressInterface | 149 | observationDomainId | 873 | 14 | egressInterface | 138 | observationPointId | 874 | 143 | meteringProcessId | 137 | commonPropertiesId | 875 | 144 | exportingProcessId | | | 876 +-----+---------------------------+-----+---------------------------+ 878 5.1.1. lineCardId 879 Description: 880 An identifier of a line card that is unique per IPFIX Device 881 hosting an Observation Point. Typically, this Information Element 882 is used for limiting the scope of other Information Elements. 883 Abstract Data Type: unsigned32 884 Data Type Semantics: identifier 885 ElementId: 141 886 Status: current 888 5.1.2. portId 890 Description: 891 An identifier of a line port that is unique per IPFIX Device 892 hosting an Observation Point. Typically, this Information Element 893 is used for limiting the scope of other Information Elements. 894 Abstract Data Type: unsigned32 895 Data Type Semantics: identifier 896 ElementId: 142 897 Status: current 899 5.1.3. ingressInterface 901 Description: 902 The index of the IP interface where packets of this Flow are being 903 received. The value matches the value of managed object 'ifIndex' 904 as defined in RFC 2863. Note that ifIndex values are not assigned 905 statically to an interface, and that the interfaces may be 906 renumbered every time the device's management system is re- 907 initialized, as specified in RFC 2863. 908 Abstract Data Type: unsigned32 909 Data Type Semantics: identifier 910 ElementId: 10 911 Status: current 912 Reference: 913 See RFC 2863 for the definition of the ifIndex object. 915 5.1.4. egressInterface 917 Description: 918 The index of the IP interface where packets of this Flow are being 919 sent. The value matches the value of managed object 'ifIndex' as 920 defined in RFC 2863. Note that ifIndex values are not assigned 921 statically to an interface, and that the interfaces may be 922 renumbered every time the device's management system is re- 923 initialized, as specified in RFC 2863. 925 Abstract Data Type: unsigned32 926 Data Type Semantics: identifier 927 ElementId: 14 928 Status: current 929 Reference: 930 See RFC 2863 for the definition of the ifIndex object. 932 5.1.5. meteringProcessId 934 Description: 935 An identifier of a Metering Process that is unique per IPFIX 936 Device. Typically, this Information Element is used for limiting 937 the scope of other Information Elements. Note that process 938 identifiers are typically assigned dynamically. The Metering 939 Process may be re-started with a different ID. 940 Abstract Data Type: unsigned32 941 Data Type Semantics: identifier 942 ElementId: 143 943 Status: current 945 5.1.6. exportingProcessId 947 Description: 948 An identifier of an Exporting Process that is unique per IPFIX 949 Device. Typically, this Information Element is used for limiting 950 the scope of other Information Elements. Note that process 951 identifiers are typically assigned dynamically. The Exporting 952 Process may be re-started with a different ID. 953 Abstract Data Type: unsigned32 954 Data Type Semantics: identifier 955 ElementId: 144 956 Status: current 958 5.1.7. flowId 960 Description: 961 An identifier of a Flow that is unique within an Observation 962 Domain. This Information Element can be used to distinguish 963 between different Flows if Flow Keys such as IP addresses and port 964 numbers are not reported or are reported in separate records. 965 Abstract Data Type: unsigned64 966 Data Type Semantics: identifier 967 ElementId: 148 968 Status: current 970 5.1.8. templateId 971 Description: 972 An identifier of a Template that is locally unique within a 973 combination of a Transport session and an Observation Domain. 974 Template IDs 0-255 are reserved for Template Sets, Options 975 Template Sets, and other reserved Sets yet to be created. 976 Template IDs of Data Sets are numbered from 256 to 65535. 977 Typically, this Information Element is used for limiting the scope 978 of other Information Elements. Note that after a re-start of the 979 Exporting Process Template identifiers may be re-assigned. 980 Abstract Data Type: unsigned16 981 Data Type Semantics: identifier 982 ElementId: 145 983 Status: current 985 5.1.9. observationDomainId 987 Description: 988 An identifier of an Observation Domain that is locally unique to 989 an Exporting Process. The Exporting Process uses the Observation 990 Domain ID to uniquely identify to the Collecting Process the 991 Observation Domain where Flows were metered. It is RECOMMENDED 992 that this identifier is also unique per IPFIX Device. 993 A value of 0 indicates that no specific Observation Domain is 994 identified by this Information Element. 995 Typically, this Information Element is used for limiting the scope 996 of other Information Elements. 997 Abstract Data Type: unsigned32 998 Data Type Semantics: identifier 999 ElementId: 149 1000 Status: current 1002 5.1.10. observationPointId 1004 Description: 1005 An identifier of an Observation Point that is unique per 1006 Observation Domain. It is RECOMMENDED that this identifier is 1007 also unique per IPFIX Device. Typically, this Information Element 1008 is used for limiting the scope of other Information Elements. 1009 Abstract Data Type: unsigned32 1010 Data Type Semantics: identifier 1011 ElementId: 138 1012 Status: current 1014 5.1.11. commonPropertiesId 1015 Description: 1016 An identifier of a set of common properties that is unique per 1017 Observation Domain and Transport Session. Typically, this 1018 Information Element is used to link to information reported in 1019 separate Data Records. 1020 Abstract Data Type: unsigned64 1021 Data Type Semantics: identifier 1022 ElementId: 137 1023 Status: current 1025 5.2. Metering and Exporting Process Configuration 1027 Information Elements in this section describe the configuration of 1028 the Metering Process or the Exporting Process. The set of these 1029 Information Elements is listed in the table below 1031 +-----+--------------------------+-----+----------------------------+ 1032 | ID | Name | ID | Name | 1033 +-----+--------------------------+-----+----------------------------+ 1034 | 130 | exporterIPv4Address | 213 | collectorInterface | 1035 | 131 | exporterIPv6Address | 214 | collectorProtocolVersion | 1036 | 217 | exporterTransportPort | 215 | collectorTransportProtocol | 1037 | 211 | collectorIPv4Address | 216 | collectorTransportPort | 1038 | 212 | collectorIPv6Address | 173 | flowKeyIndicator | 1039 +-----+--------------------------+-----+----------------------------+ 1041 5.2.1. exporterIPv4Address 1043 Description: 1044 The IPv4 address used by the Exporting Process. This is used by 1045 the Collector to identify the Exporter in cases where the identity 1046 of the Exporter may have been obscured by the use of a proxy. 1047 Abstract Data Type: ipv4Address 1048 Data Type Semantics: identifier 1049 ElementId: 130 1050 Status: current 1052 5.2.2. exporterIPv6Address 1054 Description: 1055 The IPv6 address used by the Exporting Process. This is used by 1056 the Collector to identify the Exporter in cases where the identity 1057 of the Exporter may have been obscured by the use of a proxy. 1058 Abstract Data Type: ipv6Address 1059 Data Type Semantics: identifier 1060 ElementId: 131 1061 Status: current 1063 5.2.3. exporterTransportPort 1065 Description: 1066 The source port identifier from which the Exporting Process sends 1067 Flow information. For the transport protocols UDP, TCP and SCTP 1068 this is the source port number. This field MAY also be used for 1069 future transport protocols that have 16 bit source port 1070 identifiers. This field may be useful for distinguishing multiple 1071 Exporting Processes that use the same IP address. 1072 Abstract Data Type: unsigned16 1073 Data Type Semantics: identifier 1074 ElementId: 217 1075 Status: current 1076 Reference: 1077 See RFC 768 for the definition of the UDP source port field. See 1078 RFC 793 for the definition of the TCP source port field. See RFC 1079 2960 for the definition of SCTP. 1080 Additional information on defined UDP and TCP port numbers can be 1081 found at http://www.iana.org/assignments/port-numbers. 1083 5.2.4. collectorIPv4Address 1085 Description: 1086 An IPv4 address to which the Exporting Process sends Flow 1087 information. 1088 Abstract Data Type: ipv4Address 1089 Data Type Semantics: identifier 1090 ElementId: 211 1091 Status: current 1093 5.2.5. collectorIPv6Address 1095 Description: 1096 An IPv6 address to which the Exporting Process sends Flow 1097 information. 1098 Abstract Data Type: ipv6Address 1099 Data Type Semantics: identifier 1100 ElementId: 212 1101 Status: current 1103 5.2.6. collectorInterface 1104 Description: 1105 The index of the interface from which IPFIX Messages sent by the 1106 Exporting Process to a Collector leave the IPFIX Device. The 1107 value matches the value of managed object 'ifIndex' as defined in 1108 RFC 2863. Note that ifIndex values are not assigned statically to 1109 an interface, and that the interfaces may be renumbered every time 1110 the device's management system is re-initialized, as specified in 1111 RFC 2863. 1112 Abstract Data Type: unsigned32 1113 Data Type Semantics: identifier 1114 ElementId: 213 1115 Status: current 1116 Reference: 1117 See RFC 2863 for the definition of the ifIndex object. 1119 5.2.7. collectorProtocolVersion 1121 Description: 1122 The protocol version used by the Exporting Process for sending 1123 Flow information. The protocol version is given by the value of 1124 the Version Number field in the Message Header. 1125 The protocol version is 10 for IPFIX and 9 for NetFlow version 9. 1126 A value of 0 indicates that no export protocol is in use. 1127 Abstract Data Type: unsigned8 1128 Data Type Semantics: identifier 1129 ElementId: 214 1130 Status: current 1131 Reference: 1132 See the IPFIX protocol specification for the definition of the 1133 IPFIX Message header. 1134 EDITOR'S NOTE: This should be replaced by a reference to the IPFIX 1135 protocol specification as soon as an RFC number has been assigned 1136 to it. 1137 See RFC 3954 or the definition of the NetFlow version 9 message 1138 header. 1140 5.2.8. collectorTransportProtocol 1142 Description: 1143 The value of the protocol number used by the Exporting Process for 1144 sending Flow information. The protocol number identifies the IP 1145 packet payload type. Protocol numbers are defined in the IANA 1146 Protocol Numbers registry. 1147 In Internet Protocol version 4 (IPv4) this is carried in the 1148 "Protocol" field. In Internet Protocol version 6 (IPv6) this is 1149 carried in the "Next Header" field in the last extension header of 1150 the packet. 1152 Abstract Data Type: unsigned8 1153 Data Type Semantics: identifier 1154 ElementId: 215 1155 Status: current 1156 Reference: 1157 See RFC 791 for the specification of the IPv4 protocol field. See 1158 RFC 2460 for the specification of the IPv6 protocol field. See 1159 the list of protocol numbers assigned by IANA at 1160 http://www.iana.org/assignments/protocol-numbers. 1162 5.2.9. collectorTransportPort 1164 Description: 1165 The destination port identifier to which the Exporting Process 1166 sends Flow information. For the transport protocols UDP, TCP and 1167 SCTP this is the destination port number. This field MAY also be 1168 used for future transport protocols that have 16 bit source port 1169 identifiers. 1170 Abstract Data Type: unsigned16 1171 Data Type Semantics: identifier 1172 ElementId: 216 1173 Status: current 1174 Reference: 1175 See RFC 768 for the definition of the UDP destination port field. 1176 See RFC 793 for the definition of the TCP destination port field. 1177 See RFC 2960 for the definition of SCTP. 1178 Additional information on defined UDP and TCP port numbers can be 1179 found at http://www.iana.org/assignments/port-numbers. 1181 5.2.10. flowKeyIndicator 1183 Description: 1184 This set of bit fields is used for marking the Information 1185 Elements of a Data Record that serve as Flow Key. Each bit 1186 represents an Information Element in the Data Record with the n-th 1187 bit representing the n-th Information Element. A bit set to value 1188 1 indicates that the corresponding Information Element is a Flow 1189 Key of the reported Flow. A bit set to value 0 indicates that 1190 this is not the case. 1191 If the Data Record contains more than 64 Information Elements, the 1192 corresponding Template SHOULD be designed such that all Flow Keys 1193 are among the first 64 Information Elements, because the 1194 flowKeyIndicator only contains 64 bits. If the Data Record 1195 contains less than 64 Information Elements, then the bits in the 1196 flowKeyIndicator for which no corresponding Information Element 1197 exists MUST have the value 0. 1199 Abstract Data Type: unsigned64 1200 Data Type Semantics: flags 1201 ElementId: 173 1202 Status: current 1204 5.3. Metering and Exporting Process Statistics 1206 Information Elements in this section describe statistics of the 1207 Metering Process and/or the Exporting Process. The set of these 1208 Information Elements is listed in the table below 1210 +-----+-----------------------------+-----+-------------------------+ 1211 | ID | Name | ID | Name | 1212 +-----+-----------------------------+-----+-------------------------+ 1213 | 41 | exportedMessageTotalCount | 165 | ignoredOctetTotalCount | 1214 | 40 | exportedOctetTotalCount | 166 | notSentFlowTotalCount | 1215 | 42 | exportedFlowRecordTotalCount| 167 | notSentPacketTotalCount | 1216 | 163 | observedFlowTotalCount | 168 | notSentOctetTotalCount | 1217 | 164 | ignoredPacketTotalCount | | | 1218 +-----+-----------------------------+-----+-------------------------+ 1220 5.3.1. exportedMessageTotalCount 1222 Description: 1223 The total number of IPFIX Messages that the Exporting Process sent 1224 since the Exporting Process (re-)initialization to the Collecting 1225 Process receiving a report that contains this Information Element. 1226 The reported number excludes the IPFIX Message that carries the 1227 counter value. 1228 Abstract Data Type: unsigned64 1229 Data Type Semantics: totalCounter 1230 ElementId: 41 1231 Status: current 1232 Units: messages 1234 5.3.2. exportedOctetTotalCount 1236 Description: 1237 The total number of octets that the Exporting Process successfully 1238 sent since the Exporting Process (re-)initialization to the 1239 Collecting Process receiving a report that contains this 1240 Information Element. The value of this Information Element is 1241 calculated by summing up the IPFIX Message Header length values of 1242 all IPFIX Messages that were successfully sent to the Collecting 1243 Process receiving a report that contains this Information Element. 1244 The reported number excludes octets in the IPFIX Message that 1245 carries the counter value. 1247 Abstract Data Type: unsigned64 1248 Data Type Semantics: totalCounter 1249 ElementId: 40 1250 Status: current 1251 Units: octets 1253 5.3.3. exportedFlowRecordTotalCount 1255 Description: 1256 The total number of Flow Records that the Exporting Process 1257 successfully sent as Data Records since the Exporting Process 1258 (re-)initialization to the Collecting Process receiving a report 1259 that contains this Information Element. The reported number 1260 excludes Flow Records in the IPFIX message that carries the 1261 counter value. 1262 Abstract Data Type: unsigned64 1263 Data Type Semantics: totalCounter 1264 ElementId: 42 1265 Status: current 1266 Units: flows 1268 5.3.4. observedFlowTotalCount 1270 Description: 1271 The total number of Flows observed in the Observation Domain since 1272 the Metering Process (re-)initialization for this Observation 1273 Point. 1274 Abstract Data Type: unsigned64 1275 Data Type Semantics: totalCounter 1276 ElementId: 163 1277 Status: current 1278 Units: flows 1280 5.3.5. ignoredPacketTotalCount 1282 Description: 1283 The total number of observed IP packets that the Metering Process 1284 did not process since the (re-)initialization of the Metering 1285 Process. 1286 Abstract Data Type: unsigned64 1287 Data Type Semantics: totalCounter 1288 ElementId: 164 1289 Status: current 1290 Units: packets 1292 5.3.6. ignoredOctetTotalCount 1293 Description: 1294 The total number of octets in observed IP packets (including the 1295 IP header) that the Metering Process did not process since the 1296 (re-)initialization of the Metering Process. 1297 Abstract Data Type: unsigned64 1298 Data Type Semantics: totalCounter 1299 ElementId: 165 1300 Status: current 1301 Units: octets 1303 5.3.7. notSentFlowTotalCount 1305 Description: 1306 The total number of Flow Records that were generated by the 1307 Metering Process and but dropped by the Metering Process or by the 1308 Exporting Process instead of sending it to the Collecting Process. 1309 There are several potential reasons for this including resource 1310 shortage and special Flow export policies. 1311 Abstract Data Type: unsigned64 1312 Data Type Semantics: totalCounter 1313 ElementId: 166 1314 Status: current 1315 Units: flows 1317 5.3.8. notSentPacketTotalCount 1319 Description: 1320 The total number of packets in Flow Records that were generated by 1321 the Metering Process and but dropped by the Metering Process or by 1322 the Exporting Process instead of sending it to the Collecting 1323 Process. There are several potential reasons for this including 1324 resource shortage and special Flow export policies. 1325 Abstract Data Type: unsigned64 1326 Data Type Semantics: totalCounter 1327 ElementId: 167 1328 Status: current 1329 Units: packets 1331 5.3.9. notSentOctetTotalCount 1333 Description: 1334 The total number of octets in packets in Flow Records that were 1335 generated by the Metering Process and but dropped by the Metering 1336 Process or by the Exporting Process instead of sending it to the 1337 Collecting Process. There are several potential reasons for this 1338 including resource shortage and special Flow export policies. 1340 Abstract Data Type: unsigned64 1341 Data Type Semantics: totalCounter 1342 ElementId: 168 1343 Status: current 1344 Units: octets 1346 5.4. IP Header Fields 1348 Information Elements in this section indicate values of IP header 1349 fields or are derived from IP header field values in combination with 1350 further information. 1352 +-----+----------------------------+-----+--------------------------+ 1353 | ID | Name | ID | Name | 1354 +-----+----------------------------+-----+--------------------------+ 1355 | 60 | ipVersion | 193 | nextHeaderIPv6 | 1356 | 8 | sourceIPv4Address | 195 | ipDiffServCodePoint | 1357 | 27 | sourceIPv6Address | 196 | ipPrecedence | 1358 | 9 | sourceIPv4PrefixLength | 5 | ipClassOfService | 1359 | 29 | sourceIPv6PrefixLength | 55 | postIpClassOfService | 1360 | 44 | sourceIPv4Prefix | 31 | flowLabelIPv6 | 1361 | 170 | sourceIPv6Prefix | 206 | isMulticast | 1362 | 12 | destinationIPv4Address | 54 | fragmentIdentification | 1363 | 28 | destinationIPv6Address | 88 | fragmentOffset | 1364 | 13 | destinationIPv4PrefixLength| 197 | fragmentFlags | 1365 | 30 | destinationIPv6PrefixLength| 189 | ipHeaderLength | 1366 | 45 | destinationIPv4Prefix | 207 | ipv4IHL | 1367 | 169 | destinationIPv6Prefix | 190 | totalLengthIPv4 | 1368 | 192 | ipTTL | 224 | ipTotalLength | 1369 | 4 | protocolIdentifier | 191 | payloadLengthIPv6 | 1370 +-----+----------------------------+-----+--------------------------+ 1372 5.4.1. ipVersion 1374 Description: 1375 The IP version field in the IP packet header. 1376 Abstract Data Type: unsigned8 1377 Data Type Semantics: identifier 1378 ElementId: 60 1379 Status: current 1380 Reference: 1381 See RFC 791 for the definition of the version field in the IPv4 1382 packet header. See RFC 2460 for the definition of the version 1383 field in the IPv6 packet header. Additional information on 1384 defined version numbers can be found at 1385 http://www.iana.org/assignments/version-numbers. 1387 5.4.2. sourceIPv4Address 1389 Description: 1390 The IPv4 source address in the IP packet header. 1391 Abstract Data Type: ipv4Address 1392 Data Type Semantics: identifier 1393 ElementId: 8 1394 Status: current 1395 Reference: 1396 See RFC 791 for the definition of the IPv4 source address field. 1398 5.4.3. sourceIPv6Address 1400 Description: 1401 The IPv6 source address in the IP packet header. 1402 Abstract Data Type: ipv6Address 1403 Data Type Semantics: identifier 1404 ElementId: 27 1405 Status: current 1406 Reference: 1407 See RFC 2460 for the definition of the Source Address field in the 1408 IPv6 header. 1410 5.4.4. sourceIPv4PrefixLength 1412 Description: 1413 The number of contiguous bits that are relevant in the 1414 sourceIPv4Prefix Information Element. 1415 Abstract Data Type: unsigned8 1416 ElementId: 9 1417 Status: current 1418 Units: bits 1419 Range: The valid range is 0-32. 1421 5.4.5. sourceIPv6PrefixLength 1423 Description: 1424 The number of contiguous bits that are relevant in the 1425 sourceIPv6Prefix Information Element. 1426 Abstract Data Type: unsigned8 1427 ElementId: 29 1428 Status: current 1429 Units: bits 1430 Range: The valid range is 0-128. 1432 5.4.6. sourceIPv4Prefix 1433 Description: 1434 IPv4 source address prefix. 1435 Abstract Data Type: ipv4Address 1436 ElementId: 44 1437 Status: current 1439 5.4.7. sourceIPv6Prefix 1441 Description: 1442 IPv6 source address prefix. 1443 Abstract Data Type: ipv6Address 1444 ElementId: 170 1445 Status: current 1447 5.4.8. destinationIPv4Address 1449 Description: 1450 The IPv4 destination address in the IP packet header. 1451 Abstract Data Type: ipv4Address 1452 Data Type Semantics: identifier 1453 ElementId: 12 1454 Status: current 1455 Reference: 1456 See RFC 791 for the definition of the IPv4 destination address 1457 field. 1459 5.4.9. destinationIPv6Address 1461 Description: 1462 The IPv6 destination address in the IP packet header. 1463 Abstract Data Type: ipv6Address 1464 Data Type Semantics: identifier 1465 ElementId: 28 1466 Status: current 1467 Reference: 1468 See RFC 2460 for the definition of the Destination Address field 1469 in the IPv6 header. 1471 5.4.10. destinationIPv4PrefixLength 1473 Description: 1474 The number of contiguous bits that are relevant in the 1475 destinationIPv4Prefix Information Element. 1476 Abstract Data Type: unsigned8 1477 ElementId: 13 1478 Status: current 1479 Units: bits 1480 Range: The valid range is 0-32. 1482 5.4.11. destinationIPv6PrefixLength 1484 Description: 1485 The number of contiguous bits that are relevant in the 1486 destinationIPv6Prefix Information Element. 1487 Abstract Data Type: unsigned8 1488 ElementId: 30 1489 Status: current 1490 Units: bits 1491 Range: The valid range is 0-128. 1493 5.4.12. destinationIPv4Prefix 1495 Description: 1496 IPv4 destination address prefix. 1497 Abstract Data Type: ipv4Address 1498 ElementId: 45 1499 Status: current 1501 5.4.13. destinationIPv6Prefix 1503 Description: 1504 IPv6 destination address prefix. 1505 Abstract Data Type: ipv6Address 1506 ElementId: 169 1507 Status: current 1509 5.4.14. ipTTL 1511 Description: 1512 For IPv4, the value of the Information Element matches the value 1513 of the Time to Live field in the IPv4 packet header. For IPv6, 1514 the value of the Information Element matches the value of the Hop 1515 Limit field in the IPv6 packet header. 1516 Abstract Data Type: unsigned8 1517 ElementId: 192 1518 Status: current 1519 Units: hops 1520 Reference: 1522 See RFC 791 for the definition of the IPv4 Time to Live field. 1523 See RFC 2460 for the definition of the IPv6 Hop Limit field. 1525 5.4.15. protocolIdentifier 1527 Description: 1528 The value of the protocol number in the IP packet header. The 1529 protocol number identifies the IP packet payload type. Protocol 1530 numbers are defined in the IANA Protocol Numbers registry. 1531 In Internet Protocol version 4 (IPv4) this is carried in the 1532 "Protocol" field. In Internet Protocol version 6 (IPv6) this is 1533 carried in the "Next Header" field in the last extension header of 1534 the packet. 1535 Abstract Data Type: unsigned8 1536 Data Type Semantics: identifier 1537 ElementId: 4 1538 Status: current 1539 Reference: 1540 See RFC 791 for the specification of the IPv4 protocol field. See 1541 RFC 2460 for the specification of the IPv6 protocol field. See 1542 the list of protocol numbers assigned by IANA at 1543 http://www.iana.org/assignments/protocol-numbers. 1545 5.4.16. nextHeaderIPv6 1547 Description: 1548 The value of the Next Header field of the IPv6 header. The value 1549 identifies the type of the following IPv6 extension header or of 1550 the following IP payload. Valid values are defined in the IANA 1551 Protocol Numbers registry. 1552 Abstract Data Type: unsigned8 1553 ElementId: 193 1554 Status: current 1555 Reference: 1556 See RFC 2460 for the definition of the IPv6 Next Header field. 1557 See the list of protocol numbers assigned by IANA at 1558 http://www.iana.org/assignments/protocol-numbers. 1560 5.4.17. ipDiffServCodePoint 1562 Description: 1563 The value of a Differentiated Services Code Point (DSCP) encoded 1564 in the Differentiated Services Field. The Differentiated Services 1565 Field spans the most significant 6 bits of the IPv4 TOS field or 1566 the IPv6 Traffic class field, respectively. 1568 This Information Element encodes only the 6 bits of the 1569 Differentiated Services field. Therefore its value may range from 1570 0 to 63. 1571 Abstract Data Type: unsigned8 1572 Data Type Semantics: identifier 1573 ElementId: 195 1574 Status: current 1575 Range: The valid range is 0-63. 1576 Reference: 1577 See RFC 3260 for the definition of the Differentiated Services 1578 Field. See section 5.3.2 of RFC 1812 and RFC 791 for the 1579 definition of the IPv4 TOS field. See RFC 2460 for the definition 1580 of the IPv6 Traffic Class field. 1582 5.4.18. ipPrecedence 1584 Description: 1585 The value of the IP Precedence. The IP Precedence value is 1586 encoded in the first 3 bits of the IPv4 TOS field or the IPv6 1587 Traffic class field, respectively. 1588 This Information Element encodes only these 3 bits. Therefore its 1589 value may range from 0 to 7. 1590 Abstract Data Type: unsigned8 1591 Data Type Semantics: identifier 1592 ElementId: 196 1593 Status: current 1594 Range: The valid range is 0-7. 1595 Reference: 1596 See section 5.3.3 of RFC 1812 and RFC 791 for the definition of 1597 the IP Precedence. See section 5.3.2 of RFC 1812 and RFC 791 for 1598 the definition of the IPv4 TOS field. See RFC 2460 for the 1599 definition of the IPv6 Traffic Class field. 1601 5.4.19. ipClassOfService 1603 Description: 1604 For IPv4 packets, this is the value of the TOS field in the IPv4 1605 packet header. For IPv6 packets, this is the value of the Traffic 1606 Class field in the IPv6 packet header. 1607 Abstract Data Type: unsigned8 1608 Data Type Semantics: identifier 1609 ElementId: 5 1610 Status: current 1611 Reference: 1613 See section 5.3.2 of RFC 1812 and RFC 791 for the definition of 1614 the IPv4 TOS field. See RFC 2460 for the definition of the IPv6 1615 Traffic Class field. 1617 5.4.20. postIpClassOfService 1619 Description: 1620 The definition of this Information Element is identical to the 1621 definition of Information Element 'ipClassOfService', except that 1622 it reports a potentially modified value caused by a middlebox 1623 function after the packet passed the Observation Point. 1624 Abstract Data Type: unsigned8 1625 Data Type Semantics: identifier 1626 ElementId: 55 1627 Status: current 1628 Reference: 1629 See RFC 791 for the definition of the IPv4 TOS field. See RFC 1630 2460 for the definition of the IPv6 traffic class field. See RFC 1631 3234 for the definition of middleboxes. 1633 5.4.21. flowLabelIPv6 1635 Description: 1636 The value of the IPv6 Flow Label field in the IP packet header. 1637 Abstract Data Type: unsigned32 1638 Data Type Semantics: identifier 1639 ElementId: 31 1640 Status: current 1641 Reference: 1642 See RFC 2460 for the definition of the flow label field in the 1643 IPv6 packet header. 1645 5.4.22. isMulticast 1647 Description: 1648 If the IP destination address is not a reserved multicast address 1649 then the value of all bits of the octet (including the reserved 1650 ones) is zero. 1651 The first bit of this octet is set to 1 if the Version field of 1652 the IP header has the value 4 and if the Destination Address field 1653 contains a reserved multicast address in the range from 224.0.0.0 1654 to 239.255.255.255. Otherwise, this bit is set to 0. 1655 The second and third bit of this octet are reserved for future 1656 use. 1658 The remaining bits of the octet are only set to values other than 1659 zero if the IP Destination Address is a reserved IPv6 multicast 1660 address. Then the fourth bit of the octet is set to the value of 1661 the T flag in the IPv6 multicast address and the remaining four 1662 bits are set to the value of the scope field in the IPv6 multicast 1663 address. 1665 0 1 2 3 4 5 6 7 1666 +------+------+------+------+------+------+------+------+ 1667 | MCv4 | RES. | RES. | T | IPv6 multicast scope | 1668 +------+------+------+------+------+------+------+------+ 1670 Bit 0: set to 1 if IPv4 multicast 1671 Bit 1-2: reserved for future use 1672 Bit 4: set to value of T-flag, if IPv6 multicast 1673 Bit 4-7: set to value of multicast scope if IPv6 multicast 1675 Abstract Data Type: unsigned8 1676 Data Type Semantics: flags 1677 ElementId: 206 1678 Status: current 1679 Reference: 1680 See RFC 1112 for the specification of reserved IPv4 multicast 1681 addresses. See RFC 4291 for the specification of reserved IPv6 1682 multicast addresses and the definition of the T-flag and the IPv6 1683 multicast scope. 1685 5.4.23. fragmentIdentification 1687 Description: 1688 The value of the Identification field in the IPv4 packet header or 1689 the IPv6 Fragment header, respectively. The value is 0 for IPv6 1690 if there is no Fragment header. 1691 Abstract Data Type: unsigned32 1692 Data Type Semantics: identifier 1693 ElementId: 54 1694 Status: current 1695 Reference: 1696 See RFC 791 for the definition of the IPv4 Identification field. 1697 See RFC 2460 for the definition of the Identification field in the 1698 IPv6 Fragment header. 1700 5.4.24. fragmentOffset 1701 Description: 1702 The value of the IP fragment offset field in the IPv4 packet 1703 header or the IPv6 Fragment header, respectively. The value is 0 1704 for IPv6 if there is no Fragment header. 1705 Abstract Data Type: unsigned16 1706 Data Type Semantics: identifier 1707 ElementId: 88 1708 Status: current 1709 Reference: 1710 See RFC 791 for the specification of the fragment offset in the 1711 IPv4 header. See RFC 2460 for the specification of the fragment 1712 offset in the IPv6 Fragment header. 1714 5.4.25. fragmentFlags 1716 Description: 1717 Fragmentation properties indicated by flags in the IPv4 packet 1718 header or the IPv6 Fragment header, respectively. 1720 Bit 0: (RS) Reserved. 1721 The value of this bit MUST be 0 until specified 1722 otherwise. 1723 Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. 1724 Corresponds to the value of the DF flag in the 1725 IPv4 header. Will always be 0 for IPv6 unless 1726 a "don't fragment" feature is introduced to IPv6. 1727 Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. 1728 Corresponds to the MF flag in the IPv4 header 1729 or to the M flag in the IPv6 Fragment header, 1730 respectively. The value is 0 for IPv6 if there 1731 is no Fragment header. 1732 Bits 3-7: (DC) Don't Care. 1733 The values of these bits are irrelevant. 1735 0 1 2 3 4 5 6 7 1736 +---+---+---+---+---+---+---+---+ 1737 | R | D | M | D | D | D | D | D | 1738 | S | F | F | C | C | C | C | C | 1739 +---+---+---+---+---+---+---+---+ 1741 Abstract Data Type: unsigned8 1742 Data Type Semantics: flags 1743 ElementId: 197 1744 Status: current 1745 Reference: 1746 See RFC 791 for the specification of the IPv4 fragment flags. See 1747 RFC 2460 for the specification of the IPv6 Fragment header. 1749 5.4.26. ipHeaderLength 1751 Description: 1752 The length of the IP header. For IPv6, the value of this 1753 Information Element is 40. 1754 Abstract Data Type: unsigned8 1755 ElementId: 189 1756 Status: current 1757 Units: octets 1758 Reference: 1759 See RFC 791 for the specification of the IPv4 header. See RFC 1760 2460 for the specification of the IPv6 header. 1762 5.4.27. ipv4IHL 1764 Description: 1765 The value of the Internet Header Length (IHL) field in the IPv4 1766 header. It specifies the length of the header in units of 4 1767 octets. Please note that its unit is different to most of the 1768 other Information Elements reporting length values. 1769 Abstract Data Type: unsigned8 1770 ElementId: 207 1771 Status: current 1772 Units: 4 octets 1773 Reference: 1774 See RFC 791 for the specification of the IPv4 header. 1776 5.4.28. totalLengthIPv4 1778 Description: 1779 The total length of the IPv4 packet. 1780 Abstract Data Type: unsigned16 1781 ElementId: 190 1782 Status: current 1783 Units: octets 1784 Reference: 1785 See RFC 791 for the specification of the IPv4 total length. 1787 5.4.29. ipTotalLength 1788 Description: 1789 The total length of the IP packet. 1790 Abstract Data Type: unsigned64 1791 ElementId: 224 1792 Status: current 1793 Units: octets 1794 Reference: 1795 See RFC 791 for the specification of the IPv4 total length. See 1796 RFC 2460 for the specification of the IPv6 payload length. See 1797 RFC 2675 for the specification of the IPv6 jumbo payload length. 1799 5.4.30. payloadLengthIPv6 1801 Description: 1802 This Information Element reports the value of the Payload Length 1803 field in the IPv6 header. Note that IPv6 extension headers belong 1804 to the payload. Also note that in case of a jumbo payload option 1805 the value of the Payload Length field in the IPv6 header is zero 1806 and so will be the value reported by this Information Element. 1807 Abstract Data Type: unsigned16 1808 ElementId: 191 1809 Status: current 1810 Reference: 1811 See RFC 2460 for the specification of the IPv6 payload length. 1812 See RFC 2675 for the specification of the IPv6 jumbo payload 1813 option. 1815 5.5. Transport Header Fields 1817 The set of Information Elements related to transport header fields 1818 and length includes the Information Elements listed in the table 1819 below. 1821 +-----+---------------------------+-----+---------------------------+ 1822 | ID | Name | ID | Name | 1823 +-----+---------------------------+-----+---------------------------+ 1824 | 7 | sourceTransportPort | 238 | tcpWindowScale | 1825 | 11 | destinationTransportPort | 187 | tcpUrgentPointer | 1826 | 180 | udpSourcePort | 188 | tcpHeaderLength | 1827 | 181 | udpDestinationPort | 32 | icmpTypeCodeIPv4 | 1828 | 205 | udpMessageLength | 176 | icmpTypeIPv4 | 1829 | 182 | tcpSourcePort | 177 | icmpCodeIPv4 | 1830 | 183 | tcpDestinationPort | 139 | icmpTypeCodeIPv6 | 1831 | 184 | tcpSequenceNumber | 178 | icmpTypeIPv6 | 1832 | 185 | tcpAcknowledgementNumber | 179 | icmpCodeIPv6 | 1833 | 186 | tcpWindowSize | 33 | igmpType | 1834 +-----+---------------------------+-----+---------------------------+ 1836 5.5.1. sourceTransportPort 1838 Description: 1839 The source port identifier in the transport header. For the 1840 transport protocols UDP, TCP and SCTP this is the source port 1841 number given in the respective header. This field MAY also be 1842 used for future transport protocols that have 16 bit source port 1843 identifiers. 1844 Abstract Data Type: unsigned16 1845 Data Type Semantics: identifier 1846 ElementId: 7 1847 Status: current 1848 Reference: 1849 See RFC 768 for the definition of the UDP source port field. See 1850 RFC 793 for the definition of the TCP source port field. See RFC 1851 2960 for the definition of SCTP. 1852 Additional information on defined UDP and TCP port numbers can be 1853 found at http://www.iana.org/assignments/port-numbers. 1855 5.5.2. destinationTransportPort 1857 Description: 1858 The destination port identifier in the transport header. For the 1859 transport protocols UDP, TCP and SCTP this is the destination port 1860 number given in the respective header. This field MAY also be 1861 used for future transport protocols that have 16 bit destination 1862 port identifiers. 1863 Abstract Data Type: unsigned16 1864 Data Type Semantics: identifier 1865 ElementId: 11 1866 Status: current 1867 Reference: 1868 See RFC 768 for the definition of the UDP destination port field. 1869 See RFC 793 for the definition of the TCP destination port field. 1870 See RFC 2960 for the definition of SCTP. 1871 Additional information on defined UDP and TCP port numbers can be 1872 found at http://www.iana.org/assignments/port-numbers. 1874 5.5.3. udpSourcePort 1876 Description: 1877 The source port identifier in the UDP header. 1878 Abstract Data Type: unsigned16 1879 Data Type Semantics: identifier 1880 ElementId: 180 1881 Status: current 1882 Reference: 1883 See RFC 768 for the definition of the UDP source port field. 1884 Additional information on defined UDP port numbers can be found at 1885 http://www.iana.org/assignments/port-numbers. 1887 5.5.4. udpDestinationPort 1889 Description: 1890 The destination port identifier in the UDP header. 1891 Abstract Data Type: unsigned16 1892 Data Type Semantics: identifier 1893 ElementId: 181 1894 Status: current 1895 Reference: 1896 See RFC 768 for the definition of the UDP destination port field. 1897 Additional information on defined UDP port numbers can be found at 1898 http://www.iana.org/assignments/port-numbers. 1900 5.5.5. udpMessageLength 1902 Description: 1903 The value of the Length field in the UDP header. 1904 Abstract Data Type: unsigned16 1905 ElementId: 205 1906 Status: current 1907 Units: octets 1908 Reference: 1909 See RFC 768 for the specification of the UDP header. 1911 5.5.6. tcpSourcePort 1913 Description: 1914 The source port identifier in the TCP header. 1915 Abstract Data Type: unsigned16 1916 Data Type Semantics: identifier 1917 ElementId: 182 1918 Status: current 1919 Reference: 1920 See RFC 793 for the definition of the TCP source port field. 1921 Additional information on defined TCP port numbers can be found at 1922 http://www.iana.org/assignments/port-numbers. 1924 5.5.7. tcpDestinationPort 1925 Description: 1926 The destination port identifier in the TCP header. 1927 Abstract Data Type: unsigned16 1928 Data Type Semantics: identifier 1929 ElementId: 183 1930 Status: current 1931 Reference: 1932 See RFC 793 for the definition of the TCP source port field. 1933 Additional information on defined TCP port numbers can be found at 1934 http://www.iana.org/assignments/port-numbers. 1936 5.5.8. tcpSequenceNumber 1938 Description: 1939 The sequence number in the TCP header. 1940 Abstract Data Type: unsigned32 1941 ElementId: 184 1942 Status: current 1943 Reference: 1944 See RFC 793 for the definition of the TCP sequence number. 1946 5.5.9. tcpAcknowledgementNumber 1948 Description: 1949 The acknowledgement number in the TCP header. 1950 Abstract Data Type: unsigned32 1951 ElementId: 185 1952 Status: current 1953 Reference: 1954 See RFC 793 for the definition of the TCP acknowledgement number. 1956 5.5.10. tcpWindowSize 1958 Description: 1959 The window field in the TCP header. If the TCP window scale is 1960 supported, then TCP window scale must be known to fully interpret 1961 the value of this information. 1962 Abstract Data Type: unsigned16 1963 ElementId: 186 1964 Status: current 1965 Reference: 1966 See RFC 793 for the definition of the TCP window field. See RFC 1967 1323 for the definition of the TCP window scale. 1969 5.5.11. tcpWindowScale 1970 Description: 1971 The scale of the window field in the TCP header. 1972 Abstract Data Type: unsigned16 1973 ElementId: 238 1974 Status: current 1975 Reference: 1976 See RFC 1323 for the definition of the TCP window scale. 1978 5.5.12. tcpUrgentPointer 1980 Description: 1981 The urgent pointer in the TCP header. 1982 Abstract Data Type: unsigned16 1983 ElementId: 187 1984 Status: current 1985 Reference: 1986 See RFC 793 for the definition of the TCP urgent pointer. 1988 5.5.13. tcpHeaderLength 1990 Description: 1991 The length of the TCP header. Note that the value of this 1992 Information Element is different to the value of the Data Offest 1993 field in the TCP header. The Data Offset field indicates the 1994 length of the TCP header in units of 4 octets. This Information 1995 Elements specifies the length of the TCP header in units of 1996 octets. 1997 Abstract Data Type: unsigned8 1998 ElementId: 188 1999 Status: current 2000 Units: octets 2001 Reference: 2002 See RFC 793 for the definition of the TCP header. 2004 5.5.14. icmpTypeCodeIPv4 2006 Description: 2007 Type and Code of the IPv4 ICMP message. The combination of both 2008 values is reported as (ICMP type * 256) + ICMP code. 2009 Abstract Data Type: unsigned16 2010 Data Type Semantics: identifier 2011 ElementId: 32 2012 Status: current 2013 Reference: 2015 See RFC 792 for the definition of the IPv4 ICMP type and code 2016 fields. 2018 5.5.15. icmpTypeIPv4 2020 Description: 2021 Type of the IPv4 ICMP message. 2022 Abstract Data Type: unsigned8 2023 Data Type Semantics: identifier 2024 ElementId: 176 2025 Status: current 2026 Reference: 2027 See RFC 792 for the definition of the IPv4 ICMP type field. 2029 5.5.16. icmpCodeIPv4 2031 Description: 2032 Code of the IPv4 ICMP message. 2033 Abstract Data Type: unsigned8 2034 Data Type Semantics: identifier 2035 ElementId: 177 2036 Status: current 2037 Reference: 2038 See RFC 792 for the definition of the IPv4 ICMP code field. 2040 5.5.17. icmpTypeCodeIPv6 2042 Description: 2043 Type and Code of the IPv6 ICMP message. The combination of both 2044 values is reported as (ICMP type * 256) + ICMP code. 2045 Abstract Data Type: unsigned16 2046 Data Type Semantics: identifier 2047 ElementId: 139 2048 Status: current 2049 Reference: 2050 See RFC 4443 for the definition of the IPv6 ICMP type and code 2051 fields. 2053 5.5.18. icmpTypeIPv6 2055 Description: 2056 Type of the IPv6 ICMP message. 2057 Abstract Data Type: unsigned8 2058 Data Type Semantics: identifier 2059 ElementId: 178 2060 Status: current 2061 Reference: 2062 See RFC 4443 for the definition of the IPv6 ICMP type field. 2064 5.5.19. icmpCodeIPv6 2066 Description: 2067 Code of the IPv6 ICMP message. 2068 Abstract Data Type: unsigned8 2069 Data Type Semantics: identifier 2070 ElementId: 179 2071 Status: current 2072 Reference: 2073 See RFC 4443 for the definition of the IPv6 ICMP code field. 2075 5.5.20. igmpType 2077 Description: 2078 The type field of the IGMP message. 2079 Abstract Data Type: unsigned8 2080 Data Type Semantics: identifier 2081 ElementId: 33 2082 Status: current 2083 Reference: 2084 See RFC 3376 for the definition of the IGMP type field. 2086 5.6. Sub-IP Header Fields 2088 The set of Information Elements related to Sub-IP header fields 2089 includes the Information Elements listed in the table below. 2091 +-----+---------------------------+-----+---------------------------+ 2092 | ID | Name | ID | Name | 2093 +-----+---------------------------+-----+---------------------------+ 2094 | 56 | sourceMacAddress | 201 | mplsLabelStackLength | 2095 | 81 | postSourceMacAddress | 194 | mplsPayloadLength | 2096 | 58 | vlanId | 70 | mplsTopLabelStackSection | 2097 | 59 | postVlanId | 71 | mplsLabelStackSection2 | 2098 | 80 | destinationMacAddress | 72 | mplsLabelStackSection3 | 2099 | 57 | postDestinationMacAddress | 73 | mplsLabelStackSection4 | 2100 | 146 | wlanChannelId | 74 | mplsLabelStackSection5 | 2101 | 147 | wlanSSID | 75 | mplsLabelStackSection6 | 2102 | 200 | mplsTopLabelTTL | 76 | mplsLabelStackSection7 | 2103 | 203 | mplsTopLabelExp | 77 | mplsLabelStackSection8 | 2104 | 237 | postMplsTopLabelExp | 78 | mplsLabelStackSection9 | 2105 | 202 | mplsLabelStackDepth | 79 | mplsLabelStackSection10 | 2106 +-----+---------------------------+-----+---------------------------+ 2108 5.6.1. sourceMacAddress 2110 Description: 2111 The IEEE 802 source MAC address field. 2112 Abstract Data Type: macAddress 2113 Data Type Semantics: identifier 2114 ElementId: 56 2115 Status: current 2116 Reference: 2117 See IEEE.802-3.2002. 2119 5.6.2. postSourceMacAddress 2121 Description: 2122 The definition of this Information Element is identical to the 2123 definition of Information Element 'sourceMacAddress', except that 2124 it reports a potentially modified value caused by a middlebox 2125 function after the packet passed the Observation Point. 2126 Abstract Data Type: macAddress 2127 Data Type Semantics: identifier 2128 ElementId: 81 2129 Status: current 2130 Reference: 2131 See IEEE.802-3.2002. 2133 5.6.3. vlanId 2135 Description: 2136 The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag 2137 Control Information field that was attached to the IP packet. 2138 Abstract Data Type: unsigned16 2139 Data Type Semantics: identifier 2140 ElementId: 58 2141 Status: current 2142 Reference: 2143 See IEEE.802-1Q.2003. 2145 5.6.4. postVlanId 2147 Description: 2148 The definition of this Information Element is identical to the 2149 definition of Information Element 'vlanId', except that it reports 2150 a potentially modified value caused by a middlebox function after 2151 the packet passed the Observation Point. 2153 Abstract Data Type: unsigned16 2154 Data Type Semantics: identifier 2155 ElementId: 59 2156 Status: current 2157 Reference: 2158 See IEEE.802-1Q.2003. 2160 5.6.5. destinationMacAddress 2162 Description: 2163 The IEEE 802 destination MAC address field. 2164 Abstract Data Type: macAddress 2165 Data Type Semantics: identifier 2166 ElementId: 80 2167 Status: current 2168 Reference: 2169 See IEEE.802-3.2002. 2171 5.6.6. postDestinationMacAddress 2173 Description: 2174 The definition of this Information Element is identical to the 2175 definition of Information Element 'destinationMacAddress', except 2176 that it reports a potentially modified value caused by a middlebox 2177 function after the packet passed the Observation Point. 2178 Abstract Data Type: macAddress 2179 Data Type Semantics: identifier 2180 ElementId: 57 2181 Status: current 2182 Reference: 2183 See IEEE.802-3.2002. 2185 5.6.7. wlanChannelId 2187 Description: 2188 The identifier of the 802.11 (Wi-Fi) channel used. 2189 Abstract Data Type: unsigned8 2190 Data Type Semantics: identifier 2191 ElementId: 146 2192 Status: current 2193 Reference: 2194 See IEEE.802-11.1999. 2196 5.6.8. wlanSSID 2197 Description: 2198 The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) 2199 network used. According to IEEE.802-11.1999 the SSID is encoded 2200 into a string of up to 32 characters. 2201 Abstract Data Type: string 2202 ElementId: 147 2203 Status: current 2204 Reference: 2205 See IEEE.802-11.1999. 2207 5.6.9. mplsTopLabelTTL 2209 Description: 2210 The TTL field from the top MPLS label stack entry, i.e. the last 2211 label that was pushed. 2212 Abstract Data Type: unsigned8 2213 ElementId: 200 2214 Status: current 2215 Reference: 2216 See RFC 3032 for the specification of the TTL field. 2218 5.6.10. mplsTopLabelExp 2220 Description: 2221 The Exp field from the top MPLS label stack entry, i.e. the last 2222 label that was pushed. 2224 Bit 0-4: Don't Care, value is irrelevant. 2225 Bit 5-7: MPLS Exp field 2227 0 1 2 3 4 5 6 7 2228 +---+---+---+---+---+---+---+---+ 2229 | don't care | Exp | 2230 +---+---+---+---+---+---+---+---+ 2232 Abstract Data Type: unsigned8 2233 Data Type Semantics: flags 2234 ElementId: 203 2235 Status: current 2236 Reference: 2237 See RFC 3032 for the specification of the Exp field. See RFC 3270 2238 for usage of the Exp field. 2240 5.6.11. postMplsTopLabelExp 2241 Description: 2242 The definition of this Information Element is identical to the 2243 definition of Information Element 'mplsTopLabelExp', except that 2244 it reports a potentially modified value caused by a middlebox 2245 function after the packet passed the Observation Point. 2246 Abstract Data Type: unsigned8 2247 Data Type Semantics: flags 2248 ElementId: 237 2249 Status: current 2250 Reference: 2251 See RFC 3032 for the specification of the Exp field. See RFC 3270 2252 for usage of the Exp field. 2254 5.6.12. mplsLabelStackDepth 2256 Description: 2257 The number of labels in the MPLS label stack. 2258 Abstract Data Type: unsigned32 2259 ElementId: 202 2260 Status: current 2261 Units: label stack entries 2262 Reference: 2263 See RFC 3032 for the specification of the MPLS label stack. 2265 5.6.13. mplsLabelStackLength 2267 Description: 2268 The length of the MPLS label stack in units of octets. 2269 Abstract Data Type: unsigned32 2270 ElementId: 201 2271 Status: current 2272 Units: octets 2273 Reference: 2274 See RFC 3032 for the specification of the MPLS label stack. 2276 5.6.14. mplsPayloadLength 2278 Description: 2279 The size of the MPLS packet without the label stack. 2280 Abstract Data Type: unsigned32 2281 ElementId: 194 2282 Status: current 2283 Units: octets 2284 Reference: 2286 See RFC 3031 for the specification of MPLS packets. See RFC 3032 2287 for the specification of the MPLS label stack. 2289 5.6.15. mplsTopLabelStackSection 2291 Description: 2292 The label, exp and s fields from the top MPLS label stack entry, 2293 i.e. from the last label that was pushed. 2294 The size of this Information Element is 3 octets. 2296 0 1 2 2297 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 2298 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2299 | Label | Exp |S| 2300 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2302 Label: Label Value, 20 bits 2303 Exp: Experimental Use, 3 bits 2304 S: Bottom of Stack, 1 bit 2306 Abstract Data Type: octetArray 2307 Data Type Semantics: identifier 2308 ElementId: 70 2309 Status: current 2310 Reference: 2311 See RFC 3032. 2313 5.6.16. mplsLabelStackSection2 2315 Description: 2316 The label, exp, and s fields from the label stack entry that was 2317 pushed immediately before the label stack entry that would be 2318 reported by mplsTopLabelStackSection. See the definition of 2319 mplsTopLabelStackSection for further details. 2320 The size of this Information Element is 3 octets. 2321 Abstract Data Type: octetArray 2322 Data Type Semantics: identifier 2323 ElementId: 71 2324 Status: current 2325 Reference: 2326 See RFC 3032. 2328 5.6.17. mplsLabelStackSection3 2329 Description: 2330 The label, exp, and s fields from the label stack entry that was 2331 pushed immediately before the label stack entry that would be 2332 reported by mplsLabelStackSection2. See the definition of 2333 mplsTopLabelStackSection for further details. 2334 The size of this Information Element is 3 octets. 2335 Abstract Data Type: octetArray 2336 Data Type Semantics: identifier 2337 ElementId: 72 2338 Status: current 2339 Reference: 2340 See RFC 3032. 2342 5.6.18. mplsLabelStackSection4 2344 Description: 2345 The label, exp, and s fields from the label stack entry that was 2346 pushed immediately before the label stack entry that would be 2347 reported by mplsLabelStackSection3. See the definition of 2348 mplsTopLabelStackSection for further details. 2349 The size of this Information Element is 3 octets. 2350 Abstract Data Type: octetArray 2351 Data Type Semantics: identifier 2352 ElementId: 73 2353 Status: current 2354 Reference: 2355 See RFC 3032. 2357 5.6.19. mplsLabelStackSection5 2359 Description: 2360 The label, exp, and s fields from the label stack entry that was 2361 pushed immediately before the label stack entry that would be 2362 reported by mplsLabelStackSection4. See the definition of 2363 mplsTopLabelStackSection for further details. 2364 The size of this Information Element is 3 octets. 2365 Abstract Data Type: octetArray 2366 Data Type Semantics: identifier 2367 ElementId: 74 2368 Status: current 2369 Reference: 2370 See RFC 3032. 2372 5.6.20. mplsLabelStackSection6 2373 Description: 2374 The label, exp, and s fields from the label stack entry that was 2375 pushed immediately before the label stack entry that would be 2376 reported by mplsLabelStackSection5. See the definition of 2377 mplsTopLabelStackSection for further details. 2378 The size of this Information Element is 3 octets. 2379 Abstract Data Type: octetArray 2380 Data Type Semantics: identifier 2381 ElementId: 75 2382 Status: current 2383 Reference: 2384 See RFC 3032. 2386 5.6.21. mplsLabelStackSection7 2388 Description: 2389 The label, exp, and s fields from the label stack entry that was 2390 pushed immediately before the label stack entry that would be 2391 reported by mplsLabelStackSection6. See the definition of 2392 mplsTopLabelStackSection for further details. 2393 The size of this Information Element is 3 octets. 2394 Abstract Data Type: octetArray 2395 Data Type Semantics: identifier 2396 ElementId: 76 2397 Status: current 2398 Reference: 2399 See RFC 3032. 2401 5.6.22. mplsLabelStackSection8 2403 Description: 2404 The label, exp, and s fields from the label stack entry that was 2405 pushed immediately before the label stack entry that would be 2406 reported by mplsLabelStackSection7. See the definition of 2407 mplsTopLabelStackSection for further details. 2408 The size of this Information Element is 3 octets. 2409 Abstract Data Type: octetArray 2410 Data Type Semantics: identifier 2411 ElementId: 77 2412 Status: current 2413 Reference: 2414 See RFC 3032. 2416 5.6.23. mplsLabelStackSection9 2417 Description: 2418 The label, exp, and s fields from the label stack entry that was 2419 pushed immediately before the label stack entry that would be 2420 reported by mplsLabelStackSection8. See the definition of 2421 mplsTopLabelStackSection for further details. 2422 The size of this Information Element is 3 octets. 2423 Abstract Data Type: octetArray 2424 Data Type Semantics: identifier 2425 ElementId: 78 2426 Status: current 2427 Reference: 2428 See RFC 3032. 2430 5.6.24. mplsLabelStackSection10 2432 Description: 2433 The label, exp, and s fields from the label stack entry that was 2434 pushed immediately before the label stack entry that would be 2435 reported by mplsLabelStackSection9. See the definition of 2436 mplsTopLabelStackSection for further details. 2437 The size of this Information Element is 3 octets. 2438 Abstract Data Type: octetArray 2439 Data Type Semantics: identifier 2440 ElementId: 79 2441 Status: current 2442 Reference: 2443 See RFC 3032. 2445 5.7. Derived Packet Properties 2447 The set of Information Elements derived from values of header fields 2448 and further information includes the Information Elements listed in 2449 the table below. 2451 +-----+---------------------------+-----+---------------------------+ 2452 | ID | Name | ID | Name | 2453 +-----+---------------------------+-----+---------------------------+ 2454 | 204 | ipPayloadLength | 18 | bgpNextHopIPv4Address | 2455 | 15 | ipNextHopIPv4Address | 63 | bgpNextHopIPv6Address | 2456 | 62 | ipNextHopIPv6Address | 46 | mplsTopLabelType | 2457 | 16 | bgpSourceAsNumber | 47 | mplsTopLabelIPv4Address | 2458 | 17 | bgpDestinationAsNumber | 140 | mplsTopLabelIPv6Address | 2459 | 128 | bgpNextAdjacentAsNumber | 90 | mplsVpnRouteDistinguisher | 2460 | 129 | bgpPrevAdjacentAsNumber | | | 2461 +-----+---------------------------+-----+---------------------------+ 2463 5.7.1. ipPayloadLength 2465 Description: 2466 The effective length of the IP payload. 2467 For IPv4 packets the value of this Information Element is the 2468 difference between the total length of the IPv4 packet (as 2469 reported by Information Element totalLengthIPv4) and the length of 2470 the IPv4 header (as reported by Information Element 2471 headerLengthIPv4). 2472 For IPv6, the value of the Payload Length field in the IPv6 header 2473 is reported except in the case that the value of this field is 2474 zero and that there is a valid jumbo payload option. In this case 2475 the value of the Jumbo Payload Length field in the jumbo payload 2476 option is reported. 2477 Abstract Data Type: unsigned32 2478 ElementId: 204 2479 Status: current 2480 Reference: 2481 See RFC 791 for the specification of IPv4 packets. See RFC 2460 2482 for the specification of the IPv6 payload length. See RFC 2675 2483 for the specification of the IPv6 jumbo payload length. 2485 5.7.2. ipNextHopIPv4Address 2487 Description: 2488 The IPv4 address of the next IPv4 hop. 2489 Abstract Data Type: ipv4Address 2490 Data Type Semantics: identifier 2491 ElementId: 15 2492 Status: current 2494 5.7.3. ipNextHopIPv6Address 2496 Description: 2497 The IPv6 address of the next IPv6 hop. 2498 Abstract Data Type: ipv6Address 2499 Data Type Semantics: identifier 2500 ElementId: 62 2501 Status: current 2503 5.7.4. bgpSourceAsNumber 2505 Description: 2506 The autonomous system (AS) number of the source IP address. If AS 2507 path information for this Flow is only available as an unordered 2508 AS set (and not as an ordered AS sequence), then the value of this 2509 Information Element is 0. 2511 Abstract Data Type: unsigned32 2512 Data Type Semantics: identifier 2513 ElementId: 16 2514 Status: current 2515 Reference: 2516 See RFC 4271 for a description of BGP-4 and see RFC 1930 for the 2517 definition of the AS number. 2519 5.7.5. bgpDestinationAsNumber 2521 Description: 2522 The autonomous system (AS) number of the destination IP address. 2523 If AS path information for this Flow is only available as an 2524 unordered AS set (and not as an ordered AS sequence), then the 2525 value of this Information Element is 0. 2526 Abstract Data Type: unsigned32 2527 Data Type Semantics: identifier 2528 ElementId: 17 2529 Status: current 2530 Reference: 2531 See RFC 4271 for a description of BGP-4 and see RFC 1930 for the 2532 definition 2534 5.7.6. bgpNextAdjacentAsNumber 2536 Description: 2537 The autonomous system (AS) number of the first AS in the AS path 2538 to the destination IP address. The path is deduced by looking up 2539 the destination IP address of the Flow in the BGP routing 2540 information base. If AS path information for this Flow is only 2541 available as an unordered AS set (and not as an ordered AS 2542 sequence), then the value of this Information Element is 0. 2543 Abstract Data Type: unsigned32 2544 Data Type Semantics: identifier 2545 ElementId: 128 2546 Status: current 2547 Reference: 2548 See RFC 4271 for a description of BGP-4 and see RFC 1930 for the 2549 definition of the AS number. 2551 5.7.7. bgpPrevAdjacentAsNumber 2553 Description: 2554 The autonomous system (AS) number of the last AS in the AS path 2555 from the source IP address. The path is deduced by looking up the 2556 source IP address of the Flow in the BGP routing information base. 2557 If AS path information for this Flow is only available as an 2558 unordered AS set (and not as an ordered AS sequence), then the 2559 value of this Information Element is 0. In case of BGP asymmetry, 2560 the bgpPrevAdjacentAsNumber might not be able to report the 2561 correct value. 2562 Abstract Data Type: unsigned32 2563 Data Type Semantics: identifier 2564 ElementId: 129 2565 Status: current 2566 Reference: 2567 See RFC 4271 for a description of BGP-4 and see RFC 1930 for the 2568 definition of the AS number. 2570 5.7.8. bgpNextHopIPv4Address 2572 Description: 2573 The IPv4 address of the next (adjacent) BGP hop. 2574 Abstract Data Type: ipv4Address 2575 Data Type Semantics: identifier 2576 ElementId: 18 2577 Status: current 2578 Reference: 2579 See RFC 4271 for a description of BGP-4. 2581 5.7.9. bgpNextHopIPv6Address 2583 Description: 2584 The IPv6 address of the next (adjacent) BGP hop. 2585 Abstract Data Type: ipv6Address 2586 Data Type Semantics: identifier 2587 ElementId: 63 2588 Status: current 2589 Reference: 2590 See RFC 4271 for a description of BGP-4. 2592 5.7.10. mplsTopLabelType 2594 Description: 2595 This field identifies the control protocol that allocated the top 2596 of stack label. Initial values for this field are listed below. 2597 Further values may be assigned by IANA in the MPLS label type 2598 registry. 2600 - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label 2601 - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label 2602 - 0x03 VPN: Any label associated with VPN 2603 - 0x04 BGP: Any label associated with BGP or BGP routing 2604 - 0x05 LDP: Any label associated with dynamically assigned 2605 labels using LDP 2607 Abstract Data Type: unsigned8 2608 Data Type Semantics: identifier 2609 ElementId: 46 2610 Status: current 2611 Reference: 2612 See RFC 3031 for the MPLS label structure. See RFC 4364 for the 2613 association of MPLS labels with VPNs. See RFC 4271 for BGP and 2614 BGP routing. See RFC 3036 for LDP. See the list of MPLS label 2615 types assigned by IANA at 2616 http://www.iana.org/assignments/mpls-label-types. 2618 5.7.11. mplsTopLabelIPv4Address 2620 Description: 2621 The IPv4 address of the system that the MPLS top label will cause 2622 this Flow to be forwarded to. 2623 Abstract Data Type: ipv4Address 2624 Data Type Semantics: identifier 2625 ElementId: 47 2626 Status: current 2627 Reference: 2628 See RFC 3031 for the association between MPLS labels and IP 2629 addresses. 2631 5.7.12. mplsTopLabelIPv6Address 2633 Description: 2634 The IPv6 address of the system that the MPLS top label will cause 2635 this Flow to be forwarded to. 2636 Abstract Data Type: ipv6Address 2637 Data Type Semantics: identifier 2638 ElementId: 140 2639 Status: current 2640 Reference: 2641 See RFC 3031 for the association between MPLS labels and IP 2642 addresses. 2644 5.7.13. mplsVpnRouteDistinguisher 2646 Description: 2647 The value of the VPN route distinguisher of a corresponding entry 2648 in a VPN routing and forwarding table. Route distinguisher 2649 ensures that the same address can be used in several different 2650 MPLS VPNs, and that it is possible for BGP to carry several 2651 completely different routes to that address, one for each VPN. 2652 According to RFC 4364 the size of mplsVpnRouteDistinguisher is 8 2653 octets. However, in RFC 4382 an octet string with flexible length 2654 was chosen for representing a VPN route distinguisher by object 2655 MplsL3VpnRouteDistinguisher. This choice was made in order to be 2656 open to future changes of the size. This idea was adopted when 2657 choosing octetArray as abstract data type for this Information 2658 Element. The maximum length of this Information Element is 256 2659 octets. 2660 Abstract Data Type: octetArray 2661 Data Type Semantics: identifier 2662 ElementId: 90 2663 Status: current 2664 Reference: 2665 See RFC 4364 for the specification of the route distinguisher. 2666 See RFC 4382 for the specification of the MPLS/BGP Layer 3 Virtual 2667 Private Network (VPN) Management Information Base. 2669 5.8. Min/Max Flow Properties 2671 Information Elements in this section are results of minimum or 2672 maximum operations over all packets of a Flow. 2674 +-----+---------------------------+-----+---------------------------+ 2675 | ID | Name | ID | Name | 2676 +-----+---------------------------+-----+---------------------------+ 2677 | 25 | minimumIpTotalLength | 208 | ipv4Options | 2678 | 26 | maximumIpTotalLength | 64 | ipv6ExtensionHeaders | 2679 | 52 | minimumTTL | 6 | tcpControlBits | 2680 | 53 | maximumTTL | 209 | tcpOptions | 2681 +-----+---------------------------+-----+---------------------------+ 2683 5.8.1. minimumIpTotalLength 2685 Description: 2686 Length of the smallest packet observed for this Flow. The packet 2687 length includes the IP header(s) length and the IP payload length. 2688 Abstract Data Type: unsigned64 2689 ElementId: 25 2690 Status: current 2691 Units: octets 2692 Reference: 2693 See RFC 791 for the specification of the IPv4 total length. See 2694 RFC 2460 for the specification of the IPv6 payload length. See 2695 RFC 2675 for the specification of the IPv6 jumbo payload length. 2697 5.8.2. maximumIpTotalLength 2698 Description: 2699 Length of the largest packet observed for this Flow. The packet 2700 length includes the IP header(s) length and the IP payload length. 2701 Abstract Data Type: unsigned64 2702 ElementId: 26 2703 Status: current 2704 Units: octets 2705 Reference: 2706 See RFC 791 for the specification of the IPv4 total length. See 2707 RFC 2460 for the specification of the IPv6 payload length. See 2708 RFC 2675 for the specification of the IPv6 jumbo payload length. 2710 5.8.3. minimumTTL 2712 Description: 2713 Minimum TTL value observed for any packet in this Flow. 2714 Abstract Data Type: unsigned8 2715 ElementId: 52 2716 Status: current 2718 5.8.4. maximumTTL 2720 Description: 2721 Maximum TTL value observed for any packet in this Flow. 2722 Abstract Data Type: unsigned8 2723 ElementId: 53 2724 Status: current 2726 5.8.5. ipv4Options 2728 Description: 2729 IPv4 options in packets of this Flow. The information is encoded 2730 in a set of bit fields. For each valid IPv4 option type there is 2731 a bit in this set. The bit is set to 1 if any observed packet of 2732 this Flow contains the corresponding IPv4 option type. Otherwise, 2733 if no observed packet of this Flow contained the respective IPv4 2734 option type, the value of the corresponding bit is 0. 2735 The list of valid IPv4 options is maintained by IANA. Note that 2736 for identifying an option not just the 5-bit Option Number, but 2737 all 8 bits of the Option Type need to match one of the IPv4 2738 options specified at 2739 http://www.iana.org/assignments/ip-parameters. 2740 Options are mapped to bits according to their option numbers. 2741 Option number X is mapped to bit X. The mapping is illustrated by 2742 the figure below. 2744 0 1 2 3 4 5 6 7 2745 +------+------+------+------+------+------+------+------+ 2746 | EOOL | NOP | SEC | LSR | TS |E-SEC |CIPSO | RR | ... 2747 +------+------+------+------+------+------+------+------+ 2749 8 9 10 11 12 13 14 15 2750 +------+------+------+------+------+------+------+------+ 2751 ... | SID | SSR | ZSU | MTUP | MTUR | FINN | VISA |ENCODE| ... 2752 +------+------+------+------+------+------+------+------+ 2754 16 17 18 19 20 21 22 23 2755 +------+------+------+------+------+------+------+------+ 2756 ... |IMITD | EIP | TR |ADDEXT|RTRALT| SDB |NSAPA | DPS | ... 2757 +------+------+------+------+------+------+------+------+ 2759 24 25 26 27 28 29 30 31 2760 +------+------+------+------+------+------+------+------+ 2761 ... | UMP | to be assigned by IANA | 2762 +------+------+------+------+------+------+------+------+ 2764 Type Option 2765 Bit Value Name Reference 2766 ---+-----+-------+------------------------------------ 2767 0 0 EOOL End of Options List, RFC 791 2768 1 1 NOP No Operation, RFC 791 2769 2 130 SEC Security, RFC 1108 2770 3 131 LSR Loose Source Route, RFC 791 2771 4 68 TS Time Stamp, RFC 791 2772 5 133 E-SEC Extended Security, RFC 1108 2773 6 134 CIPSO Commercial Security 2774 7 7 RR Record Route, RFC 791 2775 8 136 SID Stream ID, RFC 791 2776 9 137 SSR Strict Source Route, RFC 791 2777 10 10 ZSU Experimental Measurement 2778 11 11 MTUP (obsoleted) MTU Probe, RFC 1191 2779 12 12 MTUR (obsoleted) MTU Reply, RFC 1191 2780 13 205 FINN Experimental Flow Control 2781 14 142 VISA Experimental Access Control 2782 15 15 ENCODE 2783 16 144 IMITD IMI Traffic Descriptor 2784 17 145 EIP Extended Internet Protocol, RFC 1385 2785 18 82 TR Traceroute, RFC 3193 2786 19 147 ADDEXT Address Extension 2787 20 148 RTRALT Router Alert, RFC 2113 2788 21 149 SDB Selective Directed Broadcast 2789 22 150 NSAPA NSAP Address 2790 23 151 DPS Dynamic Packet State 2791 24 152 UMP Upstream Multicast Pkt. 2792 ... ... ... Further options numbers 2793 may be assigned by IANA 2795 Abstract Data Type: unsigned32 2796 Data Type Semantics: flags 2797 ElementId: 208 2798 Status: current 2799 Reference: 2800 See RFC 791 for the definition of IPv4 options. See the list of 2801 IPv4 option numbers assigned by IANA at 2802 http://www.iana.org/assignments/ip-parameters. 2804 5.8.6. ipv6ExtensionHeaders 2806 Description: 2807 IPv6 extension headers observed in packets of this Flow. The 2808 information is encoded in a set of bit fields. For each IPv6 2809 option header there is a bit in this set. The bit is set to 1 if 2810 any observed packet of this Flow contains the corresponding IPv6 2811 extension header. Otherwise, if no observed packet of this Flow 2812 contained the respective IPv6 extension header, the value of the 2813 corresponding bit is 0. 2815 0 1 2 3 4 5 6 7 2816 +-----+-----+-----+-----+-----+-----+-----+-----+ 2817 | Res | FRA1| RH | FRA0| UNK | Res | HOP | DST | ... 2818 +-----+-----+-----+-----+-----+-----+-----+-----+ 2820 8 9 10 11 12 13 14 15 2821 +-----+-----+-----+-----+-----+-----+-----+-----+ 2822 ... | PAY | AH | ESP | Reserved | ... 2823 +-----+-----+-----+-----+-----+-----+-----+-----+ 2825 16 17 18 19 20 21 22 23 2826 +-----+-----+-----+-----+-----+-----+-----+-----+ 2827 ... | Reserved | ... 2828 +-----+-----+-----+-----+-----+-----+-----+-----+ 2830 24 25 26 27 28 29 30 31 2831 +-----+-----+-----+-----+-----+-----+-----+-----+ 2832 ... | Reserved | 2833 +-----+-----+-----+-----+-----+-----+-----+-----+ 2835 Bit IPv6 Option Description 2837 0, Res Reserved 2838 1, FRA1 44 Fragmentation header - not first fragment 2839 2, RH 43 Routing header 2840 3, FRA0 44 Fragment header - first fragment 2841 4, UNK Unknown Layer 4 header 2842 (compressed, encrypted, not supported) 2843 5, Res Reserved 2844 6, HOP 0 Hop-by-hop option header 2845 7, DST 60 Destination option header 2846 8, PAY 108 Payload compression header 2847 9, AH 51 Authentication Header 2848 10, ESP 50 Encrypted security payload 2849 11 to 31 Reserved 2851 Abstract Data Type: unsigned32 2852 Data Type Semantics: flags 2853 ElementId: 64 2854 Status: current 2855 Reference: 2856 See RFC 2460 for the general definition of IPv6 extension headers 2857 and for the specification of the hop-by-hop options header, the 2858 routing header, the fragment header, and the destination options 2859 header. See RFC 4302 for the specification of the authentication 2860 header. See RFC 4303 for the specification of the encapsulating 2861 security payload. 2863 5.8.7. tcpControlBits 2865 Description: 2866 TCP control bits observed for packets of this Flow. The 2867 information is encoded in a set of bit fields. For each TCP 2868 control bit there is a bit in this set. A bit is set to 1 if any 2869 observed packet of this Flow has the corresponding TCP control bit 2870 set to 1. A value of 0 for a bit indicates that the corresponding 2871 bit was not set in any of the observed packets of this Flow. 2873 0 1 2 3 4 5 6 7 2874 +-----+-----+-----+-----+-----+-----+-----+-----+ 2875 | Reserved | URG | ACK | PSH | RST | SYN | FIN | 2876 +-----+-----+-----+-----+-----+-----+-----+-----+ 2878 Reserved: Reserved for future use by TCP. Must be zero. 2879 URG: Urgent Pointer field significant 2880 ACK: Acknowledgment field significant 2881 PSH: Push Function 2882 RST: Reset the connection 2883 SYN: Synchronize sequence numbers 2884 FIN: No more data from sender 2886 Abstract Data Type: unsigned8 2887 Data Type Semantics: flags 2888 ElementId: 6 2889 Status: current 2890 Reference: 2891 See RFC 793 for the definition of the TCP control bits in the TCP 2892 header. 2894 5.8.8. tcpOptions 2896 Description: 2897 TCP options in packets of this Flow. The information is encoded 2898 in a set of bit fields. For each TCP option there is a bit in 2899 this set. The bit is set to 1 if any observed packet of this Flow 2900 contains the corresponding TCP option. Otherwise, if no observed 2901 packet of this Flow contained the respective TCP option, the value 2902 of the corresponding bit is 0. 2903 Options are mapped to bits according to their option numbers. 2904 Option number X is mapped to bit X. TCP option numbers are 2905 maintained by IANA. 2907 0 1 2 3 4 5 6 7 2908 +-----+-----+-----+-----+-----+-----+-----+-----+ 2909 | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | ... 2910 +-----+-----+-----+-----+-----+-----+-----+-----+ 2912 8 9 10 11 12 13 14 15 2913 +-----+-----+-----+-----+-----+-----+-----+-----+ 2914 ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |... 2915 +-----+-----+-----+-----+-----+-----+-----+-----+ 2917 16 17 18 19 20 21 22 23 2918 +-----+-----+-----+-----+-----+-----+-----+-----+ 2919 ... | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 |... 2920 +-----+-----+-----+-----+-----+-----+-----+-----+ 2922 . . . 2924 56 57 58 59 60 61 62 63 2925 +-----+-----+-----+-----+-----+-----+-----+-----+ 2926 ... | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 2927 +-----+-----+-----+-----+-----+-----+-----+-----+ 2929 Abstract Data Type: unsigned64 2930 Data Type Semantics: flags 2931 ElementId: 209 2932 Status: current 2933 Reference: 2934 See RFC 793 for the definition of TCP options. See the list of 2935 TCP option numbers assigned by IANA at 2936 http://www.iana.org/assignments/tcp-parameters. 2938 5.9. Flow Time Stamps 2940 Information Elements in this section are time stamps of events. 2942 Time stamps flowStartSeconds, flowEndSeconds, flowStartMilliseconds, 2943 flowEndMilliseconds, flowStartMicroseconds, flowEndMicroseconds, 2944 flowStartNanoseconds, flowEndNanoseconds, and 2945 systemInitTimeMilliseconds are absolute and have a well defined fixed 2946 time base, such as, for example, the number of seconds since 0000 UTC 2947 Jan 1st 1970. 2949 Time stamps flowStartDeltaMicroseconds and flowEndDeltaMicroseconds 2950 are relative time stamps only valid within the scope of a single 2951 IPFIX Message. They contain the negative time offsets relative to 2952 the export time specified in the IPFIX Message Header. The maximum 2953 time offset that can be encoded by these delta counters is 1 hour, 11 2954 minutes, and 34.967295 seconds. 2956 Time stamps flowStartSysUpTime and flowEndSysUpTime are relative time 2957 stamps indicating the time relative to the last (re-)initialization 2958 of the IPFIX Device. For reporting the time of the last 2959 (re-)initialization, systemInitTimeMilliseconds can be reported, for 2960 example, in Data Records defined by Option Templates. 2962 +-----+---------------------------+-----+---------------------------+ 2963 | ID | Name | ID | Name | 2964 +-----+---------------------------+-----+---------------------------+ 2965 | 150 | flowStartSeconds | 156 | flowStartNanoseconds | 2966 | 151 | flowEndSeconds | 157 | flowEndNanoseconds | 2967 | 152 | flowStartMilliseconds | 158 | flowStartDeltaMicroseconds| 2968 | 153 | flowEndMilliseconds | 159 | flowEndDeltaMicroseconds | 2969 | 154 | flowStartMicroseconds | 160 | systemInitTimeMilliseconds| 2970 | 155 | flowEndMicroseconds | 22 | flowStartSysUpTime | 2971 | | | 21 | flowEndSysUpTime | 2972 +-----+---------------------------+-----+---------------------------+ 2974 5.9.1. flowStartSeconds 2976 Description: 2977 The absolute timestamp of the first packet of this Flow. 2978 Abstract Data Type: dateTimeSeconds 2979 ElementId: 150 2980 Status: current 2981 Units: seconds 2983 5.9.2. flowEndSeconds 2985 Description: 2986 The absolute timestamp of the last packet of this Flow. 2987 Abstract Data Type: dateTimeSeconds 2988 ElementId: 151 2989 Status: current 2990 Units: seconds 2992 5.9.3. flowStartMilliseconds 2994 Description: 2995 The absolute timestamp of the first packet of this Flow. 2996 Abstract Data Type: dateTimeMilliseconds 2997 ElementId: 152 2998 Status: current 2999 Units: milliseconds 3001 5.9.4. flowEndMilliseconds 3002 Description: 3003 The absolute timestamp of the last packet of this Flow. 3004 Abstract Data Type: dateTimeMilliseconds 3005 ElementId: 153 3006 Status: current 3007 Units: milliseconds 3009 5.9.5. flowStartMicroseconds 3011 Description: 3012 The absolute timestamp of the first packet of this Flow. 3013 Abstract Data Type: dateTimeMicroseconds 3014 ElementId: 154 3015 Status: current 3016 Units: microseconds 3018 5.9.6. flowEndMicroseconds 3020 Description: 3021 The absolute timestamp of the last packet of this Flow. 3022 Abstract Data Type: dateTimeMicroseconds 3023 ElementId: 155 3024 Status: current 3025 Units: microseconds 3027 5.9.7. flowStartNanoseconds 3029 Description: 3030 The absolute timestamp of the first packet of this Flow. 3031 Abstract Data Type: dateTimeNanoseconds 3032 ElementId: 156 3033 Status: current 3034 Units: nanoseconds 3036 5.9.8. flowEndNanoseconds 3038 Description: 3039 The absolute timestamp of the last packet of this Flow. 3040 Abstract Data Type: dateTimeNanoseconds 3041 ElementId: 157 3042 Status: current 3043 Units: nanoseconds 3045 5.9.9. flowStartDeltaMicroseconds 3046 Description: 3047 This is a relative time stamp only valid within the scope of a 3048 single IPFIX Message. It contains the negative time offset of the 3049 first observed packet of this Flow relative to the export time 3050 specified in the IPFIX Message Header. 3051 Abstract Data Type: unsigned32 3052 ElementId: 158 3053 Status: current 3054 Units: microseconds 3055 Reference: 3056 See the IPFIX protocol specification for the definition of the 3057 IPFIX Message Header. 3058 EDITOR'S NOTE: This should be replaced by a reference to the IPFIX 3059 protocol specification as soon as an RFC number has been assigned 3060 to it. 3062 5.9.10. flowEndDeltaMicroseconds 3064 Description: 3065 This is a relative time stamp only valid within the scope of a 3066 single IPFIX Message. It contains the negative time offset of the 3067 last observed packet of this Flow relative to the export time 3068 specified in the IPFIX Message Header. 3069 Abstract Data Type: unsigned32 3070 ElementId: 159 3071 Status: current 3072 Units: microseconds 3073 Reference: 3074 See the IPFIX protocol specification for the definition of the 3075 IPFIX Message Header. 3077 5.9.11. systemInitTimeMilliseconds 3079 Description: 3080 The absolute timestamp of the last (re-)initialization of the 3081 IPFIX Device. 3082 Abstract Data Type: dateTimeMilliseconds 3083 ElementId: 160 3084 Status: current 3085 Units: milliseconds 3087 5.9.12. flowStartSysUpTime 3089 Description: 3091 The relative timestamp of the first packet of this Flow. It 3092 indicates the number of milliseconds since the last 3093 (re-)initialization of the IPFIX Device (sysUpTime). 3094 Abstract Data Type: unsigned32 3095 ElementId: 22 3096 Status: current 3097 Units: milliseconds 3099 5.9.13. flowEndSysUpTime 3101 Description: 3102 The relative timestamp of the last packet of this Flow. It 3103 indicates the number of milliseconds since the last 3104 (re-)initialization of the IPFIX Device (sysUpTime). 3105 Abstract Data Type: unsigned32 3106 ElementId: 21 3107 Status: current 3108 Units: milliseconds 3110 5.10. Per-Flow Counters 3112 Information Elements in this section are counters all having integer 3113 values. Their values may change for every report they are used in. 3114 They cannot serve as part of a Flow Key used for mapping packets to 3115 Flows. However, potentially they can be used for selecting exported 3116 Flows, for example, by only exporting Flows with more than a 3117 threshold number of observed octets. 3119 There are running counters and delta counters. Delta counters are 3120 reset to zero each time their values are exported. Running counters 3121 continue counting independently of the Exporting Process. 3123 There are per-Flow counters and counters related to the Metering 3124 Process and/or the Exporting Process. Per-Flow counters are Flow 3125 properties that potentially change each time a packet belonging to 3126 the Flow is observed. The set of per-Flow counters includes the 3127 Information Elements listed in the table below. Counters related to 3128 the Metering Process and/or the Exporting Process are described in 3129 section 5.3. 3131 +-----+---------------------------+-----+---------------------------+ 3132 | ID | Name | ID | Name | 3133 +-----+---------------------------+-----+---------------------------+ 3134 | 1 | octetDeltaCount | 134 | droppedOctetTotalCount | 3135 | 23 | postOctetDeltaCount | 135 | droppedPacketTotalCount | 3136 | 198 | octetDeltaSumOfSquares | 19 | postMCastPacketDeltaCount | 3137 | 85 | octetTotalCount | 20 | postMCastOctetDeltaCount | 3138 | 171 | postOctetTotalCount | 174 | postMCastPacketTotalCount | 3139 | 199 | octetTotalSumOfSquares | 175 | postMCastOctetTotalCount | 3140 | 2 | packetDeltaCount | 218 | tcpSynTotalCount | 3141 | 24 | postPacketDeltaCount | 219 | tcpFinTotalCount | 3142 | 86 | packetTotalCount | 220 | tcpRstTotalCount | 3143 | 172 | postPacketTotalCount | 221 | tcpPshTotalCount | 3144 | 132 | droppedOctetDeltaCount | 222 | tcpAckTotalCount | 3145 | 133 | droppedPacketDeltaCount | 223 | tcpUrgTotalCount | 3146 +-----+---------------------------+-----+---------------------------+ 3148 5.10.1. octetDeltaCount 3150 Description: 3151 The number of octets since the previous report (if any) in 3152 incoming packets for this Flow at the Observation Point. The 3153 number of octets include IP header(s) and IP payload. 3154 Abstract Data Type: unsigned64 3155 Data Type Semantics: deltaCounter 3156 ElementId: 1 3157 Status: current 3158 Units: octets 3160 5.10.2. postOctetDeltaCount 3162 Description: 3163 The definition of this Information Element is identical to the 3164 definition of Information Element 'octetDeltaCount', except that 3165 it reports a potentially modified value caused by a middlebox 3166 function after the packet passed the Observation Point. 3167 Abstract Data Type: unsigned64 3168 Data Type Semantics: deltaCounter 3169 ElementId: 23 3170 Status: current 3171 Units: octets 3173 5.10.3. octetDeltaSumOfSquares 3174 Description: 3175 The sum of the squared numbers of octets per incoming packet since 3176 the previous report (if any) for this Flow at the Observation 3177 Point. The number of octets include IP header(s) and IP payload. 3178 Abstract Data Type: unsigned64 3179 ElementId: 198 3180 Status: current 3182 5.10.4. octetTotalCount 3184 Description: 3185 The total number of octets in incoming packets for this Flow at 3186 the Observation Point since the Metering Process 3187 (re-)initialization for this Observation Point. The number of 3188 octets include IP header(s) and IP payload. 3189 Abstract Data Type: unsigned64 3190 Data Type Semantics: totalCounter 3191 ElementId: 85 3192 Status: current 3193 Units: octets 3195 5.10.5. postOctetTotalCount 3197 Description: 3198 The definition of this Information Element is identical to the 3199 definition of Information Element 'octetTotalCount', except that 3200 it reports a potentially modified value caused by a middlebox 3201 function after the packet passed the Observation Point. 3202 Abstract Data Type: unsigned64 3203 Data Type Semantics: totalCounter 3204 ElementId: 171 3205 Status: current 3206 Units: octets 3208 5.10.6. octetTotalSumOfSquares 3210 Description: 3211 The total sum of the squared numbers of octets in incoming packets 3212 for this Flow at the Observation Point since the Metering Process 3213 (re-)initialization for this Observation Point. The number of 3214 octets include IP header(s) and IP payload. 3215 Abstract Data Type: unsigned64 3216 ElementId: 199 3217 Status: current 3218 Units: octets 3220 5.10.7. packetDeltaCount 3222 Description: 3223 The number of incoming packets since the previous report (if any) 3224 for this Flow at the Observation Point. 3225 Abstract Data Type: unsigned64 3226 Data Type Semantics: deltaCounter 3227 ElementId: 2 3228 Status: current 3229 Units: packets 3231 5.10.8. postPacketDeltaCount 3233 Description: 3234 The definition of this Information Element is identical to the 3235 definition of Information Element 'packetDeltaCount', except that 3236 it reports a potentially modified value caused by a middlebox 3237 function after the packet passed the Observation Point. 3238 Abstract Data Type: unsigned64 3239 Data Type Semantics: deltaCounter 3240 ElementId: 24 3241 Status: current 3242 Units: packets 3244 5.10.9. packetTotalCount 3246 Description: 3247 The total number of incoming packets for this Flow at the 3248 Observation Point since the Metering Process (re-)initialization 3249 for this Observation Point. 3250 Abstract Data Type: unsigned64 3251 Data Type Semantics: totalCounter 3252 ElementId: 86 3253 Status: current 3254 Units: packets 3256 5.10.10. postPacketTotalCount 3258 Description: 3259 The definition of this Information Element is identical to the 3260 definition of Information Element 'packetTotalCount', except that 3261 it reports a potentially modified value caused by a middlebox 3262 function after the packet passed the Observation Point. 3264 Abstract Data Type: unsigned64 3265 Data Type Semantics: totalCounter 3266 ElementId: 172 3267 Status: current 3268 Units: packets 3270 5.10.11. droppedOctetDeltaCount 3272 Description: 3273 The number of octets since the previous report (if any) in packets 3274 of this Flow dropped by packet treatment. The number of octets 3275 include IP header(s) and IP payload. 3276 Abstract Data Type: unsigned64 3277 Data Type Semantics: deltaCounter 3278 ElementId: 132 3279 Status: current 3280 Units: octets 3282 5.10.12. droppedPacketDeltaCount 3284 Description: 3285 The number of packets since the previous report (if any) of this 3286 Flow dropped by packet treatment. 3287 Abstract Data Type: unsigned64 3288 Data Type Semantics: deltaCounter 3289 ElementId: 133 3290 Status: current 3291 Units: packets 3293 5.10.13. droppedOctetTotalCount 3295 Description: 3296 The total number of octets in packets of this Flow dropped by 3297 packet treatment since the Metering Process (re-)initialization 3298 for this Observation Point. The number of octets include IP 3299 header(s) and IP payload. 3300 Abstract Data Type: unsigned64 3301 Data Type Semantics: totalCounter 3302 ElementId: 134 3303 Status: current 3304 Units: octets 3306 5.10.14. droppedPacketTotalCount 3307 Description: 3308 The number of packets of this Flow dropped by packet treatment 3309 since the Metering Process (re-)initialization for this 3310 Observation Point. 3311 Abstract Data Type: unsigned64 3312 Data Type Semantics: totalCounter 3313 ElementId: 135 3314 Status: current 3315 Units: packets 3317 5.10.15. postMCastPacketDeltaCount 3319 Description: 3320 The number of outgoing multicast packets since the previous report 3321 (if any) sent for packets of this Flow by a multicast daemon 3322 within the Observation Domain. This property cannot necessarily 3323 be observed at the Observation Point, but may be retrieved by 3324 other means. 3325 Abstract Data Type: unsigned64 3326 Data Type Semantics: deltaCounter 3327 ElementId: 19 3328 Status: current 3329 Units: packets 3331 5.10.16. postMCastOctetDeltaCount 3333 Description: 3334 The number of octets since the previous report (if any) in 3335 outgoing multicast packets sent for packets of this Flow by a 3336 multicast daemon within the Observation Domain. This property 3337 cannot necessarily be observed at the Observation Point, but may 3338 be retrieved by other means. The number of octets include IP 3339 header(s) and IP payload. 3340 Abstract Data Type: unsigned64 3341 Data Type Semantics: deltaCounter 3342 ElementId: 20 3343 Status: current 3344 Units: octets 3346 5.10.17. postMCastPacketTotalCount 3348 Description: 3349 The total number of outgoing multicast packets sent for packets of 3350 this Flow by a multicast daemon within the Observation Domain 3351 since the Metering Process (re-)initialization. This property 3352 cannot necessarily be observed at the Observation Point, but may 3353 be retrieved by other means. 3355 Abstract Data Type: unsigned64 3356 Data Type Semantics: totalCounter 3357 ElementId: 174 3358 Status: current 3359 Units: packets 3361 5.10.18. postMCastOctetTotalCount 3363 Description: 3364 The total number of octets in outgoing multicast packets sent for 3365 packets of this Flow by a multicast daemon in the Observation 3366 Domain since the Metering Process (re-)initialization. This 3367 property cannot necessarily be observed at the Observation Point, 3368 but may be retrieved by other means. The number of octets include 3369 IP header(s) and IP payload. 3370 Abstract Data Type: unsigned64 3371 Data Type Semantics: totalCounter 3372 ElementId: 175 3373 Status: current 3374 Units: octets 3376 5.10.19. tcpSynTotalCount 3378 Description: 3379 The total number of packets of this flow with TCP "Synchronize 3380 sequence numbers" (SYN) flag set. 3381 Abstract Data Type: unsigned64 3382 Data Type Semantics: totalCounter 3383 ElementId: 218 3384 Status: current 3385 Units: packets 3386 Reference: 3387 See RFC 793 for the definition of the TCP SYN flag. 3389 5.10.20. tcpFinTotalCount 3391 Description: 3392 The total number of packets of this flow with TCP "No more data 3393 from sender" (FIN) flag set. 3394 Abstract Data Type: unsigned64 3395 Data Type Semantics: totalCounter 3396 ElementId: 219 3397 Status: current 3398 Units: packets 3399 Reference: 3400 See RFC 793 for the definition of the TCP FIN flag. 3402 5.10.21. tcpRstTotalCount 3404 Description: 3405 The total number of packets of this flow with TCP "Reset the 3406 connection" (RST) flag set. 3407 Abstract Data Type: unsigned64 3408 Data Type Semantics: totalCounter 3409 ElementId: 220 3410 Status: current 3411 Units: packets 3412 Reference: 3413 See RFC 793 for the definition of the TCP RST flag. 3415 5.10.22. tcpPshTotalCount 3417 Description: 3418 The total number of packets of this flow with TCP "Push Function" 3419 (PSH) flag set. 3420 Abstract Data Type: unsigned64 3421 Data Type Semantics: totalCounter 3422 ElementId: 221 3423 Status: current 3424 Units: packets 3425 Reference: 3426 See RFC 793 for the definition of the TCP PSH flag. 3428 5.10.23. tcpAckTotalCount 3430 Description: 3431 The total number of packets of this flow with TCP "Acknowledgment 3432 field significant" (ACK) flag set. 3433 Abstract Data Type: unsigned64 3434 Data Type Semantics: totalCounter 3435 ElementId: 222 3436 Status: current 3437 Units: packets 3438 Reference: 3439 See RFC 793 for the definition of the TCP ACK flag. 3441 5.10.24. tcpUrgTotalCount 3442 Description: 3443 The total number of packets of this flow with TCP "Urgent Pointer 3444 field significant" (URG) flag set. 3445 Abstract Data Type: unsigned64 3446 Data Type Semantics: totalCounter 3447 ElementId: 223 3448 Status: current 3449 Units: packets 3450 Reference: 3451 See RFC 793 for the definition of the TCP URG flag. 3453 5.11. Miscellaneous Flow Properties 3455 Information Elements in this section describe properties of Flows 3456 that are related to Flow start, Flow duration and Flow termination, 3457 but they are not time stamps as Information Elements in section 5.9. 3459 +-----+---------------------------+-----+---------------------------+ 3460 | ID | Name | ID | Name | 3461 +-----+---------------------------+-----+---------------------------+ 3462 | 36 | flowActiveTimeout | 161 | flowDurationMilliseconds | 3463 | 37 | flowIdleTimeout | 162 | flowDurationMicroseconds | 3464 | 136 | flowEndReason | 61 | flowDirection | 3465 +-----+---------------------------+-----+---------------------------+ 3467 5.11.1. flowActiveTimeout 3469 Description: 3470 The number of seconds after which an active Flow is timed out 3471 anyway, even if there is still a continuous flow of packets. 3472 Abstract Data Type: unsigned16 3473 ElementId: 36 3474 Status: current 3475 Units: seconds 3477 5.11.2. flowIdleTimeout 3479 Description: 3480 A Flow is considered to be timed out if no packets belonging to 3481 the Flow have been observed for the number of seconds specified by 3482 this field. 3483 Abstract Data Type: unsigned16 3484 ElementId: 37 3485 Status: current 3486 Units: seconds 3488 5.11.3. flowEndReason 3490 Description: 3491 The reason for Flow termination. The range of values includes 3493 0x01: idle timeout 3494 The Flow was terminated because it was considered to be 3495 idle. 3496 0x02: active timeout 3497 The Flow was terminated for reporting purposes while it was 3498 still active, for example, after the maximum lifetime of 3499 unreported Flows was reached. 3500 0x03: end of Flow detected 3501 The Flow was terminated because the Metering Process 3502 detected signals indicating the end of the Flow, 3503 for example, the TCP FIN flag. 3504 0x04: forced end 3505 The Flow was terminated because of some external event, 3506 for example, a shut down of the Metering Process initiated 3507 by a network management application. 3508 0x05: lack of resources 3509 the Flow was terminated because of lack of resources 3510 available to the Metering Process and/or the Exporting 3511 Process 3513 Abstract Data Type: unsigned8 3514 Data Type Semantics: identifier 3515 ElementId: 136 3516 Status: current 3518 5.11.4. flowDurationMilliseconds 3520 Description: 3521 The difference in time between the first observed packet of this 3522 Flow and the last observed packet of this Flow. 3523 Abstract Data Type: unsigned32 3524 ElementId: 161 3525 Status: current 3526 Units: milliseconds 3528 5.11.5. flowDurationMicroseconds 3529 Description: 3530 The difference in time between the first observed packet of this 3531 Flow and the last observed packet of this Flow. 3532 Abstract Data Type: unsigned32 3533 ElementId: 162 3534 Status: current 3535 Units: microseconds 3537 5.11.6. flowDirection 3539 Description: 3540 The direction of the Flow observed at the Observation Point. 3541 There are only two values defined. 3543 0x00: ingress flow 3544 0x01: egress flow 3546 Abstract Data Type: unsigned8 3547 Data Type Semantics: identifier 3548 ElementId: 61 3549 Status: current 3551 5.12. Padding 3553 This section contains a single Information Element only, that can be 3554 used for padding of Flow Records. 3556 IPFIX Implementations may wish to align Information Elements within 3557 Data Records or to align entire Data Records to 4 octet or 8 octet 3558 boundaries. This can be achieved by including one or more 3559 paddingOctets Information Elements in a Data Record. 3561 +-----+---------------------------+-----+---------------------------+ 3562 | ID | Name | ID | Name | 3563 +-----+---------------------------+-----+---------------------------+ 3564 | 210 | paddingOctets | | | 3565 +-----+---------------------------+-----+---------------------------+ 3567 5.12.1. paddingOctets 3569 Description: 3570 The value of this Information Element is always a sequence of 0x00 3571 values. 3572 Abstract Data Type: octetArray 3573 ElementId: 210 3574 Status: current 3576 6. Extending the Information Model 3578 A key requirement for IPFIX is to allow for extending the set of 3579 Information Elements which are reported. This section defines the 3580 mechanism for extending this set. 3582 Extension can be done by defining new Information Elements. Each new 3583 Information Element MUST be assigned a unique Information Element 3584 identifier as part of its definition. These unique Information 3585 Element identifiers are the connection between the record structure 3586 communicated by the protocol using Templates and a consuming 3587 application. For generally applicable Information Elements, using 3588 IETF and IANA mechanisms to extend the information model is 3589 RECOMMENDED. 3591 Names of new Information Elements SHOULD be chosen according to the 3592 naming conventions given in section 2.3. 3594 For extensions, the type space defined in section 3 can be used. If 3595 required, new abstract data types can be added. New abstract data 3596 types MUST be defined in IETF standards track documents. 3598 Enterprises may wish to define Information Elements without 3599 registering them with IANA. IPFIX explicitly supports enterprise- 3600 specific Information Elements. Enterprise-specific Information 3601 Elements as described in sections 2.1 and 4. 3603 However, before creating enterprise-specific Information Elements, 3604 the general applicability of such Information Elements should be 3605 considered. IPFIX does not support enterprise-specific abstract data 3606 types. 3608 7. IANA Considerations 3610 7.1. IPFIX Information Elements 3612 This document specifies an initial set of IPFIX Information Elements. 3613 The list of these Information Elements with their identifiers is 3614 given in section 4. The Internet Assigned Numbers Authority (IANA) 3615 is requested to create a new registry for IPFIX Information Element 3616 identifiers and fill it with the initial list in section 4. 3618 New assignments for IPFIX Information Elements will be administered 3619 by IANA through Expert Review [RFC2434], i.e. review by one of a 3620 group of experts designated by an IETF Area Director. The group of 3621 experts MUST check the requested Information Element for completeness 3622 and accuracy of the description and for correct naming according to 3623 the naming conventions in section 2.3. Requests for Information 3624 Elements that duplicate the functionality of existing Information 3625 Elements SHOULD be declined. The smallest available identifier 3626 SHOULD be assigned to a new Information Element. 3628 The specification of new IPFIX Information Elements MUST use the 3629 template specified in section 2.1 and MUST be published using a well 3630 established and persistent publication medium. The experts will 3631 initially be drawn from the Working Group Chairs and document editors 3632 of the IPFIX and PSAMP Working Groups. 3634 7.2. MPLS Label Type Identifier 3636 Information Element #46 named mplsTopLabelType carries MPLS label 3637 types. So far, values for 5 different types have initially been 3638 defined. For ensuring extensibility of this information, IANA is 3639 requested to create a new registry for MPLS label types and fill it 3640 with the initial list the description Information Element #46 named 3641 mplsTopLabelType. 3643 New assignments for MPLS label types will be administered by IANA 3644 through Expert Review [RFC2434], i.e. review by one of a group of 3645 experts designated by an IETF Area Director. The group of experts 3646 must double check the label type definitions with already defined 3647 label types for completeness, accuracy, and redundancy. The 3648 specification of new MPLS label types MUST be published using a well 3649 established and persistent publication medium. 3651 7.3. XML Namespace and Schema 3653 Appendix B defines an XML schema for IPFIX Information Element 3654 definitions. All Information Elements specified in this document are 3655 defined by the XML specification in Appendix A that is a valid XML 3656 record according to the schema in appendix B. This schema may also 3657 be used for specifying further Information Elements in future 3658 extensions of the IPFIX information model in a machine readable way. 3660 Appendix uses URNs to describe an XML namespace and an the XML schema 3661 for IPFIX Information Elements conforming to a registry mechanism 3662 described in [RFC3688]. Two URI assignments are requested. 3663 1. Registration request for the IPFIX information model namespace 3664 * URI: urn:ietf:params:xml:ns:ipfix-info-15 3665 * Registrant Contact: IETF IPFIX Working Group , 3666 as designated by the IESG . 3667 * XML: None. Namespace URIs do not represent an XML 3668 2. Registration request for the IPFIX information model schema 3669 * URI: urn:ietf:params:xml:schema:ipfix-info-15 3670 * Registrant Contact: IETF IPFIX Working Group , 3671 as designated by the IESG . 3672 * XML: See Appendix B for this document. 3674 8. Security Considerations 3676 The IPFIX information model itself does not directly introduce 3677 security issues. Rather it defines a set of attributes which may for 3678 privacy or business issues be considered sensitive information. 3680 For example, exporting values of header fields may make attacks 3681 possible for the receiver of this information, which would otherwise 3682 only be possible for direct observers of the reported flows along the 3683 data path. 3685 The underlying protocol used to exchange the information described 3686 here must therefore apply appropriate procedures to guarantee the 3687 integrity and confidentiality of the exported information. Such 3688 protocols are defined in separate documents, specifically the IPFIX 3689 protocol document [I-D.ietf-ipfix-protocol]. 3691 This document does not specify any Information Element carrying 3692 keying material. If future extensions will do so, then appropriate 3693 precautions need to be taken for properly protecting such sensible 3694 information. 3696 9. Acknowledgements 3698 The editors thank Paul Callato for creating the initial version of 3699 this document, and Thomas Dietz for developing the XSLT scripts that 3700 generate large portions of the text part of this document from the 3701 XML appendices. 3703 10. References 3705 10.1. Normative References 3707 [I-D.ietf-ipfix-protocol] 3708 Claise, B., "Specification of the IPFIX Protocol for the 3709 Exchange", draft-ietf-ipfix-protocol-24 (work in 3710 progress), November 2006. 3712 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 3713 Requirement Levels", BCP 14, RFC 2119, March 1997. 3715 10.2. Informative References 3717 [IEEE.754.1985] 3718 Institute of Electrical and Electronics Engineers, 3719 "Standard for Binary Floating-Point Arithmetic", 3720 IEEE Standard 754, August 1985. 3722 [IEEE.802-11.1999] 3723 "Information technology - Telecommunications and 3724 information exchange between systems - Local and 3725 metropolitan area networks - Specific requirements - Part 3726 11: Wireless LAN Medium Access Control (MAC) and Physical 3727 Layer (PHY) specifications", IEEE Standard 802.11, 1999, 3728 . 3731 [IEEE.802-1Q.2003] 3732 Institute of Electrical and Electronics Engineers, "Local 3733 and Metropolitan Area Networks: Virtual Bridged Local 3734 Area Networks", IEEE Standard 802.1Q, March 2003. 3736 [IEEE.802-3.2002] 3737 "Information technology - Telecommunications and 3738 information exchange between systems - Local and 3739 metropolitan area networks - Specific requirements - Part 3740 3: Carrier sense multiple access with collision detection 3741 (CSMA/CD) access method and physical layer 3742 specifications"", IEEE Standard 802.3, September 2002. 3744 [ISO.10646-1.1993] 3745 International Organization for Standardization, 3746 "Information Technology - Universal Multiple-octet coded 3747 Character Set (UCS) - Part 1: Architecture and Basic 3748 Multilingual Plane", ISO Standard 10646-1, May 1993. 3750 [ISO.646.1991] 3751 International Organization for Standardization, 3752 "Information technology - ISO 7-bit coded character set 3753 for information interchange", ISO Standard 646, 1991. 3755 [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, 3756 August 1980. 3758 [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, 3759 September 1981. 3761 [RFC0792] Postel, J., "Internet Control Message Protocol", STD 5, 3762 RFC 792, September 1981. 3764 [RFC0793] Postel, J., "Transmission Control Protocol", STD 7, 3765 RFC 793, September 1981. 3767 [RFC1108] Kent, S., "U.S", RFC 1108, November 1991. 3769 [RFC1112] Deering, S., "Host extensions for IP multicasting", STD 5, 3770 RFC 1112, August 1989. 3772 [RFC1191] Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191, 3773 November 1990. 3775 [RFC1323] Jacobson, V., Braden, B., and D. Borman, "TCP Extensions 3776 for High Performance", RFC 1323, May 1992. 3778 [RFC1385] Wang, Z., "EIP: The Extended Internet Protocol", RFC 1385, 3779 November 1992. 3781 [RFC1812] Baker, F., "Requirements for IP Version 4 Routers", 3782 RFC 1812, June 1995. 3784 [RFC1930] Hawkinson, J. and T. Bates, "Guidelines for creation, 3785 selection, and registration of an Autonomous System (AS)", 3786 BCP 6, RFC 1930, March 1996. 3788 [RFC2113] Katz, D., "IP Router Alert Option", RFC 2113, 3789 February 1997. 3791 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an 3792 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 3793 October 1998. 3795 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 3796 (IPv6) Specification", RFC 2460, December 1998. 3798 [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. 3799 Schoenwaelder, Ed., "Structure of Management Information 3800 Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. 3802 [RFC2629] Rose, M., "Writing I-Ds and RFCs using XML", RFC 2629, 3803 June 1999. 3805 [RFC2675] Borman, D., Deering, S., and R. Hinden, "IPv6 Jumbograms", 3806 RFC 2675, August 1999. 3808 [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group 3809 MIB", RFC 2863, June 2000. 3811 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., 3812 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., 3813 Zhang, L., and V. Paxson, "Stream Control Transmission 3814 Protocol", RFC 2960, October 2000. 3816 [RFC3031] Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol 3817 Label Switching Architecture", RFC 3031, January 2001. 3819 [RFC3032] Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y., 3820 Farinacci, D., Li, T., and A. Conta, "MPLS Label Stack 3821 Encoding", RFC 3032, January 2001. 3823 [RFC3036] Andersson, L., Doolan, P., Feldman, N., Fredette, A., and 3824 B. Thomas, "LDP Specification", RFC 3036, January 2001. 3826 [RFC3193] Patel, B., Aboba, B., Dixon, W., Zorn, G., and S. Booth, 3827 "Securing L2TP using IPsec", RFC 3193, November 2001. 3829 [RFC3234] Carpenter, B. and S. Brim, "Middleboxes: Taxonomy and 3830 Issues", RFC 3234, February 2002. 3832 [RFC3260] Grossman, D., "New Terminology and Clarifications for 3833 Diffserv", RFC 3260, April 2002. 3835 [RFC3270] Le Faucheur, F., Wu, L., Davie, B., Davari, S., Vaananen, 3836 P., Krishnan, R., Cheval, P., and J. Heinanen, "Multi- 3837 Protocol Label Switching (MPLS) Support of Differentiated 3838 Services", RFC 3270, May 2002. 3840 [RFC3376] Cain, B., Deering, S., Kouvelas, I., Fenner, B., and A. 3841 Thyagarajan, "Internet Group Management Protocol, Version 3842 3", RFC 3376, October 2002. 3844 [RFC3444] Pras, A. and J. Schoenwaelder, "On the Difference between 3845 Information Models and Data Models", RFC 3444, 3846 January 2003. 3848 [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, 3849 January 2004. 3851 [RFC3954] Claise, B., "Cisco Systems NetFlow Services Export Version 3852 9", RFC 3954, October 2004. 3854 [RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway 3855 Protocol 4 (BGP-4)", RFC 4271, January 2006. 3857 [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing 3858 Architecture", RFC 4291, February 2006. 3860 [RFC4302] Kent, S., "IP Authentication Header", RFC 4302, 3861 December 2005. 3863 [RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", 3864 RFC 4303, December 2005. 3866 [RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private 3867 Networks (VPNs)", RFC 4364, February 2006. 3869 [RFC4382] Nadeau, T. and H. van der Linde, "MPLS/BGP Layer 3 Virtual 3870 Private Network (VPN) Management Information Base", 3871 RFC 4382, February 2006. 3873 [RFC4443] Conta, A., Deering, S., and M. Gupta, "Internet Control 3874 Message Protocol (ICMPv6) for the Internet Protocol 3875 Version 6 (IPv6) Specification", RFC 4443, March 2006. 3877 Appendix A. XML Specification of IPFIX Information Elements 3879 This appendix contains a machine readable description of the IPFIX 3880 information model coded in XML. Note that this appendix is of 3881 informational nature, while the text in section 4 (generated from 3882 this appendix) is normative. 3884 Using a machine readable syntax for the Information model enables the 3885 creation of IPFIX aware tools which can automatically adapt to 3886 extensions to the information model, by simply reading updated 3887 information model specifications. 3889 The wide availability of XML aware tools and libraries for client 3890 devices is a primary consideration for this choice. In particular 3891 libraries for parsing XML documents are readily available. Also 3892 mechanisms such as the Extensible Stylesheet Language (XSL) allow for 3893 transforming a source XML document into other documents. This draft 3894 was authored in XML and transformed according to [RFC2629]. 3896 It should be noted that the use of XML in Exporters, Collectors or 3897 other tools is not mandatory for the deployment of IPFIX. In 3898 particular Exporting Processes do not produce or consume XML as part 3899 of their operation. It is expected that IPFIX Collectors MAY take 3900 advantage of the machine readability of the Information Model vs. 3902 hard coding their behavior or inventing proprietary means for 3903 accommodating extensions. 3905 3907 3912 3916 3917 3918 An identifier of a line card that is unique per IPFIX 3919 Device hosting an Observation Point. Typically, this 3920 Information Element is used for limiting the scope 3921 of other Information Elements. 3922 3923 3924 3926 3930 3931 3932 An identifier of a line port that is unique per IPFIX 3933 Device hosting an Observation Point. Typically, this 3934 Information Element is used for limiting the scope 3935 of other Information Elements. 3936 3937 3938 3940 3944 3945 3946 The index of the IP interface where packets of this Flow 3947 are being received. The value matches the value of managed 3948 object 'ifIndex' as defined in RFC 2863. 3949 Note that ifIndex values are not assigned statically to an 3950 interface, and that the interfaces may be renumbered every 3951 time the device's management system is re-initialized, as 3952 specified in RFC 2863. 3953 3954 3955 3956 3957 See RFC 2863 for the definition of the ifIndex object. 3958 3959 3960 3962 3966 3967 3968 The index of the IP interface where packets of 3969 this Flow are being sent. The value matches the value of 3970 managed object 'ifIndex' as defined in RFC 2863. 3971 Note that ifIndex values are not assigned statically to an 3972 interface, and that the interfaces may be renumbered every 3973 time the device's management system is re-initialized, as 3974 specified in RFC 2863. 3975 3976 3977 3978 3979 See RFC 2863 for the definition of the ifIndex object. 3980 3981 3982 3984 3988 3989 3990 An identifier of a Metering Process that is unique per 3991 IPFIX Device. Typically, this Information Element is used 3992 for limiting the scope of other Information Elements. 3993 Note that process identifiers are typically assigned 3994 dynamically. 3995 The Metering Process may be re-started with a different ID. 3997 3998 3999 4001 4005 4006 4007 An identifier of an Exporting Process that is unique per 4008 IPFIX Device. Typically, this Information Element is used 4009 for limiting the scope of other Information Elements. 4010 Note that process identifiers are typically assigned 4011 dynamically. The Exporting Process may be re-started 4012 with a different ID. 4013 4014 4015 4017 4021 4022 4023 An identifier of a Flow that is unique within an Observation 4024 Domain. This Information Element can be used to distinguish 4025 between different Flows if Flow Keys such as IP addresses and 4026 port numbers are not reported or are reported in separate 4027 records. 4028 4029 4030 4032 4036 4037 4038 An identifier of a Template that is locally unique within a 4039 combination of a Transport session and an Observation Domain. 4040 4041 4042 Template IDs 0-255 are reserved for Template Sets, Options 4043 Template Sets, and other reserved Sets yet to be created. 4044 Template IDs of Data Sets are numbered from 256 to 65535. 4046 4047 4048 Typically, this Information Element is used for limiting 4049 the scope of other Information Elements. 4050 Note that after a re-start of the Exporting Process Template 4051 identifiers may be re-assigned. 4052 4053 4054 4056 4060 4061 4062 An identifier of an Observation Domain that is locally 4063 unique to an Exporting Process. The Exporting Process uses 4064 the Observation Domain ID to uniquely identify to the 4065 Collecting Process the Observation Domain where Flows 4066 were metered. It is RECOMMENDED that this identifier is 4067 also unique per IPFIX Device. 4068 4069 4070 A value of 0 indicates that no specific Observation Domain 4071 is identified by this Information Element. 4072 4073 4074 Typically, this Information Element is used for limiting 4075 the scope of other Information Elements. 4076 4077 4078 4080 4084 4085 4086 An identifier of an Observation Point that is unique per 4087 Observation Domain. It is RECOMMENDED that this identifier is 4088 also unique per IPFIX Device. Typically, this Information 4089 Element is used for limiting the scope of other Information 4090 Elements. 4091 4092 4093 4094 4098 4099 4100 An identifier of a set of common properties that is 4101 unique per Observation Domain and Transport Session. 4102 Typically, this Information Element is used to link to 4103 information reported in separate Data Records. 4104 4105 4106 4108 4112 4113 4114 The IPv4 address used by the Exporting Process. This is used 4115 by the Collector to identify the Exporter in cases where the 4116 identity of the Exporter may have been obscured by the use of 4117 a proxy. 4118 4119 4120 4122 4126 4127 4128 The IPv6 address used by the Exporting Process. This is used 4129 by the Collector to identify the Exporter in cases where the 4130 identity of the Exporter may have been obscured by the use of 4131 a proxy. 4132 4133 4134 4136 4140 4141 4142 The source port identifier from which the Exporting 4143 Process sends Flow information. For the transport protocols 4144 UDP, TCP and SCTP this is the source port number. 4145 This field MAY also be used for future transport protocols 4146 that have 16 bit source port identifiers. This field may 4147 be useful for distinguishing multiple Exporting Processes 4148 that use the same IP address. 4149 4150 4151 4152 4153 See RFC 768 for the definition of the UDP 4154 source port field. 4155 See RFC 793 for the definition of the TCP 4156 source port field. 4157 See RFC 2960 for the definition of SCTP. 4158 4159 4160 Additional information on defined UDP and TCP port numbers can 4161 be found at http://www.iana.org/assignments/port-numbers. 4162 4163 4164 4166 4170 4171 4172 An IPv4 address to which the Exporting Process sends Flow 4173 information. 4174 4175 4176 4178 4182 4183 4184 An IPv6 address to which the Exporting Process sends Flow 4185 information. 4186 4187 4188 4189 4193 4194 4195 The index of the interface from which IPFIX Messages sent 4196 by the Exporting Process to a Collector leave the IPFIX 4197 Device. The value matches the value of 4198 managed object 'ifIndex' as defined in RFC 2863. 4199 Note that ifIndex values are not assigned statically to an 4200 interface, and that the interfaces may be renumbered every 4201 time the device's management system is re-initialized, as 4202 specified in RFC 2863. 4203 4204 4205 4206 4207 See RFC 2863 for the definition of the ifIndex object. 4208 4209 4210 4212 4216 4217 4218 The protocol version used by the Exporting Process for 4219 sending Flow information. The protocol version is given 4220 by the value of the Version Number field in the Message 4221 Header. 4222 4223 4224 The protocol version is 10 for IPFIX and 9 for NetFlow 4225 version 9. 4226 A value of 0 indicates that no export protocol is in use. 4227 4228 4229 4230 4231 See the IPFIX protocol specification for the definition 4232 of the IPFIX Message header. 4233 4234 4235 EDITOR'S NOTE: This should be replaced by a reference to 4236 the IPFIX protocol specification as soon as an RFC number 4237 has been assigned to it. 4238 4239 4240 See RFC 3954 or the definition of the NetFlow 4241 version 9 message header. 4242 4243 4244 4246 4250 4251 4252 The value of the protocol number used by the Exporting Process 4253 for sending Flow information. 4254 The protocol number identifies the IP packet payload type. 4255 Protocol numbers are defined in the IANA Protocol Numbers 4256 registry. 4258 4259 In Internet Protocol version 4 (IPv4) this is carried in the 4260 "Protocol" field. In Internet Protocol version 6 (IPv6) this 4261 is carried in the "Next Header" field in the last extension 4262 header of the packet. 4263 4264 4265 4266 See RFC 791 for the specification of the IPv4 4267 protocol field. 4268 See RFC 2460 for the specification of the IPv6 4269 protocol field. 4270 See the list of protocol numbers assigned by IANA at 4271 http://www.iana.org/assignments/protocol-numbers. 4272 4273 4274 4276 4280 4281 4282 The destination port identifier to which the Exporting 4283 Process sends Flow information. For the transport protocols 4284 UDP, TCP and SCTP this is the destination port number. 4286 This field MAY also be used for future transport protocols 4287 that have 16 bit source port identifiers. 4288 4289 4290 4291 4292 See RFC 768 for the definition of the UDP 4293 destination port field. 4294 See RFC 793 for the definition of the TCP 4295 destination port field. 4296 See RFC 2960 for the definition of SCTP. 4297 4298 4299 Additional information on defined UDP and TCP port numbers can 4300 be found at http://www.iana.org/assignments/port-numbers. 4301 4302 4303 4305 4309 4310 4311 This set of bit fields is used for marking the Information 4312 Elements of a Data Record that serve as Flow Key. Each bit 4313 represents an Information Element in the Data Record with 4314 the n-th bit representing the n-th Information Element. 4315 A bit set to value 1 indicates that the corresponding 4316 Information Element is a Flow Key of the reported Flow. 4317 A bit set to value 0 indicates that this is not the case. 4318 4319 4320 If the 4321 Data Record contains more than 64 Information Elements, the 4322 corresponding Template SHOULD be designed such that all Flow 4323 Keys are among the first 64 Information Elements, because the 4324 flowKeyIndicator only contains 64 bits. If the Data Record 4325 contains less than 64 Information Elements, then the bits in 4326 the flowKeyIndicator for which no corresponding Information 4327 Element exists MUST have the value 0. 4328 4329 4330 4332 4336 4337 4338 The total number of IPFIX Messages that the Exporting Process 4339 sent since the Exporting Process 4340 (re-)initialization to the Collecting Process receiving a 4341 report that contains this Information Element. 4342 The reported number excludes the IPFIX Message that carries 4343 the counter value. 4344 4345 4346 messages 4347 4349 4353 4354 4355 The total number of octets that the Exporting Process 4356 successfully sent since the Exporting Process 4357 (re-)initialization to the Collecting Process receiving a 4358 report that contains this Information Element. The value 4359 of this Information Element is calculated by summing up 4360 the IPFIX Message Header length values of all IPFIX Messages 4361 that were successfully sent to the Collecting Process 4362 receiving a report that contains this Information Element. 4363 The reported number excludes octets in the IPFIX Message 4364 that carries the counter value. 4365 4366 4367 octets 4368 4370 4374 4375 4376 The total number of Flow Records that the Exporting 4377 Process successfully sent as Data Records since the Exporting 4378 Process (re-)initialization to the Collecting Process 4379 receiving a report that contains this Information Element. 4380 The reported number excludes Flow Records in the IPFIX 4381 message that carries the counter value. 4383 4384 4385 flows 4386 4388 4392 4393 4394 The total number of Flows observed in the Observation Domain 4395 since the Metering Process (re-)initialization for this 4396 Observation Point. 4397 4398 4399 flows 4400 4402 4406 4407 4408 The total number of observed IP packets that the 4409 Metering Process did not process since the 4410 (re-)initialization of the Metering Process. 4411 4412 4413 packets 4414 4416 4420 4421 4422 The total number of octets in observed IP packets 4423 (including the IP header) that the Metering Process 4424 did not process since the (re-)initialization of the 4425 Metering Process. 4426 4427 4428 octets 4429 4430 4434 4435 4436 The total number of Flow Records that were generated by the 4437 Metering Process and but dropped by the Metering Process or 4438 by the Exporting Process 4439 instead of sending it to the Collecting Process. 4440 There are several potential reasons for this including 4441 resource shortage and special Flow export policies. 4442 4443 4444 flows 4445 4447 4451 4452 4453 The total number of packets in Flow Records that were 4454 generated by the Metering Process and but dropped 4455 by the Metering Process or by the Exporting Process 4456 instead of sending it to the Collecting Process. 4457 There are several potential reasons for this including 4458 resource shortage and special Flow export policies. 4459 4460 4461 packets 4462 4464 4468 4469 4470 The total number of octets in packets in Flow Records 4471 that were generated by the Metering Process and but 4472 dropped by the Metering Process or by the Exporting 4473 Process instead of sending it to the Collecting Process. 4474 There are several potential reasons for this including 4475 resource shortage and special Flow export policies. 4476 4477 4478 octets 4479 4481 4485 4486 4487 The IP version field in the IP packet header. 4488 4489 4490 4491 4492 See RFC 791 for the definition of the version field 4493 in the IPv4 packet header. 4494 See RFC 2460 for the definition of the version field 4495 in the IPv6 packet header. 4496 Additional information on defined version numbers 4497 can be found at 4498 http://www.iana.org/assignments/version-numbers. 4499 4500 4501 4503 4507 4508 4509 The IPv4 source address in the IP packet header. 4510 4511 4512 4513 4514 See RFC 791 for the definition of the IPv4 source 4515 address field. 4516 4517 4518 4520 4524 4525 4526 The IPv6 source address in the IP packet header. 4527 4528 4529 4530 4531 See RFC 2460 for the definition of the 4532 Source Address field in the IPv6 header. 4533 4534 4535 4537 4540 4541 4542 The number of contiguous bits that are relevant in the 4543 sourceIPv4Prefix Information Element. 4544 4545 4546 bits 4547 0-32 4548 4550 4553 4554 4555 The number of contiguous bits that are relevant in the 4556 sourceIPv6Prefix Information Element. 4557 4558 4559 bits 4560 0-128 4561 4563 4566 4567 4568 IPv4 source address prefix. 4569 4570 4571 4573 4576 4577 4578 IPv6 source address prefix. 4579 4580 4581 4583 4587 4588 4589 The IPv4 destination address in the IP packet header. 4590 4591 4592 4593 4594 See RFC 791 for the definition of the IPv4 4595 destination address field. 4596 4597 4598 4600 4604 4605 4606 The IPv6 destination address in the IP packet header. 4607 4608 4609 4610 4611 See RFC 2460 for the definition of the 4612 Destination Address field in the IPv6 header. 4613 4614 4615 4617 4620 4621 4622 The number of contiguous bits that are relevant in the 4623 destinationIPv4Prefix Information Element. 4624 4625 4626 bits 4627 0-32 4628 4630 4633 4634 4635 The number of contiguous bits that are relevant in the 4636 destinationIPv6Prefix Information Element. 4637 4638 4639 bits 4640 0-128 4641 4643 4646 4647 IPv4 destination address prefix. 4648 4649 4651 4654 4655 IPv6 destination address prefix. 4656 4657 4659 4662 4663 4664 For IPv4, the value of the Information Element matches 4665 the value of the Time to Live field in the IPv4 packet 4666 header. For IPv6, the value of the Information Element 4667 matches the value of the Hop Limit field in the IPv6 4668 packet header. 4669 4671 4672 4673 4674 See RFC 791 for the definition of the IPv4 4675 Time to Live field. 4676 See RFC 2460 for the definition of the IPv6 4677 Hop Limit field. 4678 4679 4680 hops 4681 4683 4687 4688 4689 The value of the protocol number in the IP packet header. 4690 The protocol number identifies the IP packet payload type. 4691 Protocol numbers are defined in the IANA Protocol Numbers 4692 registry. 4694 4695 In Internet Protocol version 4 (IPv4) this is carried in the 4696 "Protocol" field. In Internet Protocol version 6 (IPv6) this 4697 is carried in the "Next Header" field in the last extension 4698 header of the packet. 4699 4700 4701 4702 See RFC 791 for the specification of the IPv4 4703 protocol field. 4704 See RFC 2460 for the specification of the IPv6 4705 protocol field. 4706 See the list of protocol numbers assigned by IANA at 4707 http://www.iana.org/assignments/protocol-numbers. 4708 4709 4710 4712 4715 4716 4717 The value of the Next Header field of the IPv6 header. 4718 The value identifies the type of the following IPv6 4719 extension header or of the following IP payload. 4720 Valid values are defined in the IANA 4721 Protocol Numbers registry. 4722 4723 4724 4725 4726 See RFC 2460 for the definition of the IPv6 4727 Next Header field. 4728 See the list of protocol numbers assigned by IANA at 4729 http://www.iana.org/assignments/protocol-numbers. 4730 4731 4732 4734 4738 4739 4740 The value of a Differentiated Services Code Point (DSCP) 4741 encoded in the Differentiated Services Field. The 4742 Differentiated Services Field spans the most significant 4743 6 bits of the IPv4 TOS field or the IPv6 Traffic class 4744 field, respectively. 4745 4746 4747 This Information Element encodes only the 6 bits of the 4748 Differentiated Services field. Therefore its value may 4749 range from 0 to 63. 4750 4751 4752 4753 4754 See RFC 3260 for the definition of the 4755 Differentiated Services Field. 4756 See section 5.3.2 of RFC 1812 and RFC 791 for the definition 4757 of the IPv4 TOS field. See RFC 2460 for the definition of 4758 the IPv6 Traffic Class field. 4759 4760 4761 0-63 4762 4764 4768 4769 4770 The value of the IP Precedence. The IP Precedence value 4771 is encoded in the first 3 bits of the IPv4 TOS field 4772 or the IPv6 Traffic class field, respectively. 4773 4774 4775 This Information Element encodes only these 3 bits. 4776 Therefore its value may range from 0 to 7. 4777 4778 4779 4780 4781 See section 5.3.3 of RFC 1812 and RFC 791 4782 for the definition of the IP Precedence. 4783 See section 5.3.2 of RFC 1812 and RFC 791 4784 for the definition of the IPv4 TOS field. 4785 See RFC 2460 for the definition of the IPv6 4786 Traffic Class field. 4787 4788 4789 0-7 4790 4792 4796 4797 4798 For IPv4 packets, this is the value of the TOS field in 4799 the IPv4 packet header. For IPv6 packets, this is the 4800 value of the Traffic Class field in the IPv6 packet header. 4801 4802 4803 4804 4805 See section 5.3.2 of RFC 1812 and RFC 791 4806 for the definition of the IPv4 TOS field. 4807 See RFC 2460 for the definition of the IPv6 4808 Traffic Class field. 4809 4810 4811 4813 4817 4818 4819 The definition of this Information Element is identical 4820 to the definition of Information Element 4821 'ipClassOfService', except that it reports a 4822 potentially modified value caused by a middlebox 4823 function after the packet passed the Observation Point. 4824 4825 4826 4827 4828 See RFC 791 for the definition of the IPv4 4829 TOS field. 4830 See RFC 2460 for the definition of the IPv6 4831 traffic class field. 4832 See RFC 3234 for the definition of middleboxes. 4833 4834 4835 4837 4841 4842 4843 The value of the IPv6 Flow Label field in the IP packet header. 4844 4845 4846 4847 4848 See RFC 2460 for the definition of the 4849 flow label field in the IPv6 packet header. 4850 4851 4852 4854 4858 4859 4860 If the IP destination address is not a reserved multicast 4861 address then the value of all bits of the octet (including 4862 the reserved ones) is zero. 4864 4865 4866 The first bit of this octet is set to 1 if the Version 4867 field of the IP header has the value 4 and if the 4868 Destination Address field contains a reserved multicast 4869 address in the range from 224.0.0.0 to 239.255.255.255. 4870 Otherwise, this bit is set to 0. 4871 4872 4873 The second and third bit of this octet are reserved for 4874 future use. 4875 4876 4877 The remaining bits of the octet are only set to values 4878 other than zero if the IP Destination Address is a 4879 reserved IPv6 multicast address. Then the fourth bit 4880 of the octet is set to the value of the T flag in the 4881 IPv6 multicast address and the remaining four bits are 4882 set to the value of the scope field in the IPv6 4883 multicast address. 4884 4885 4886 0 1 2 3 4 5 6 7 4887 +------+------+------+------+------+------+------+------+ 4888 | MCv4 | RES. | RES. | T | IPv6 multicast scope | 4889 +------+------+------+------+------+------+------+------+ 4891 Bit 0: set to 1 if IPv4 multicast 4892 Bit 1-2: reserved for future use 4893 Bit 4: set to value of T-flag, if IPv6 multicast 4894 Bit 4-7: set to value of multicast scope if IPv6 multicast 4895 4896 4897 4898 4899 See RFC 1112 for the specification of reserved 4900 IPv4 multicast addresses. 4901 See RFC 4291 for the specification of reserved 4902 IPv6 multicast addresses and the definition of the T-flag 4903 and the IPv6 multicast scope. 4904 4905 4906 4908 4913 4914 4915 The value of the Identification field 4916 in the IPv4 packet header or the IPv6 Fragment header, 4917 respectively. The value is 0 for IPv6 if there is 4918 no Fragment header. 4919 4920 4921 4922 4923 See RFC 791 for the definition of the IPv4 4924 Identification field. 4925 See RFC 2460 for the definition of the 4926 Identification field in the IPv6 Fragment header. 4927 4928 4929 4931 4935 4936 4937 The value of the IP fragment offset field in the 4938 IPv4 packet header or the IPv6 Fragment header, 4939 respectively. The value is 0 for IPv6 if there is 4940 no Fragment header. 4941 4942 4943 4944 4945 See RFC 791 for the specification of the 4946 fragment offset in the IPv4 header. 4947 See RFC 2460 for the specification of the 4948 fragment offset in the IPv6 Fragment header. 4949 4950 4951 4953 4957 4958 4959 Fragmentation properties indicated by flags in the IPv4 4960 packet header or the IPv6 Fragment header, respectively. 4962 4963 4965 Bit 0: (RS) Reserved. 4966 The value of this bit MUST be 0 until specified 4967 otherwise. 4968 Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. 4969 Corresponds to the value of the DF flag in the 4970 IPv4 header. Will always be 0 for IPv6 unless 4971 a "don't fragment" feature is introduced to IPv6. 4972 Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. 4973 Corresponds to the MF flag in the IPv4 header 4974 or to the M flag in the IPv6 Fragment header, 4975 respectively. The value is 0 for IPv6 if there 4976 is no Fragment header. 4977 Bits 3-7: (DC) Don't Care. 4978 The values of these bits are irrelevant. 4980 0 1 2 3 4 5 6 7 4981 +---+---+---+---+---+---+---+---+ 4982 | R | D | M | D | D | D | D | D | 4983 | S | F | F | C | C | C | C | C | 4984 +---+---+---+---+---+---+---+---+ 4985 4986 4987 4988 4989 See RFC 791 for the specification of the IPv4 4990 fragment flags. 4991 See RFC 2460 for the specification of the IPv6 4992 Fragment header. 4993 4994 4995 4997 5000 5001 5002 The length of the IP header. For IPv6, the value of this 5003 Information Element is 40. 5004 5005 5006 5007 5008 See RFC 791 for the specification of the 5009 IPv4 header. 5011 See RFC 2460 for the specification of the 5012 IPv6 header. 5013 5014 5015 octets 5016 5018 5021 5022 5023 The value of the Internet Header Length (IHL) field in 5024 the IPv4 header. It specifies the length of the header 5025 in units of 4 octets. Please note that its unit is 5026 different to most of the other Information Elements 5027 reporting length values. 5028 5029 5030 5031 5032 See RFC 791 for the specification of the 5033 IPv4 header. 5034 5035 5036 4 octets 5037 5039 5042 5043 5044 The total length of the IPv4 packet. 5045 5046 5047 5048 5049 See RFC 791 for the specification of the 5050 IPv4 total length. 5051 5052 5053 octets 5054 5056 5060 5061 5062 The total length of the IP packet. 5063 5064 5065 5066 5067 See RFC 791 for the specification of the 5068 IPv4 total length. 5069 See RFC 2460 for the specification of the 5070 IPv6 payload length. 5071 See RFC 2675 for the specification of the 5072 IPv6 jumbo payload length. 5073 5074 5075 octets 5076 5078 5081 5082 5083 This Information Element reports the value of the Payload 5084 Length field in the IPv6 header. Note that IPv6 extension 5085 headers belong to the payload. Also note that in case of a 5086 jumbo payload option the value of the Payload Length field in 5087 the IPv6 header is zero and so will be the value reported 5088 by this Information Element. 5089 5090 5091 5092 5093 See RFC 2460 for the specification of the 5094 IPv6 payload length. 5095 See RFC 2675 for the specification of the 5096 IPv6 jumbo payload option. 5097 5098 5099 5101 5105 5106 5107 The source port identifier in the transport header. 5109 For the transport 5110 protocols UDP, TCP and SCTP this is the source port number 5111 given in the respective header. This field MAY also be used 5112 for future transport protocols that have 16 bit source port 5113 identifiers. 5114 5115 5116 5117 5118 See RFC 768 for the definition of the UDP 5119 source port field. 5120 See RFC 793 for the definition of the TCP 5121 source port field. 5122 See RFC 2960 for the definition of SCTP. 5123 5124 5125 Additional information on defined UDP and TCP port numbers can 5126 be found at http://www.iana.org/assignments/port-numbers. 5127 5128 5129 5131 5135 5136 5137 The destination port identifier in the transport header. 5138 For the transport protocols UDP, TCP and SCTP this is the 5139 destination port number given in the respective header. 5140 This field MAY also be used for future transport protocols 5141 that have 16 bit destination port identifiers. 5142 5143 5144 5145 5146 See RFC 768 for the definition of the UDP 5147 destination port field. 5148 See RFC 793 for the definition of the TCP 5149 destination port field. 5150 See RFC 2960 for the definition of SCTP. 5151 5152 5153 Additional information on defined UDP and TCP port numbers can 5154 be found at http://www.iana.org/assignments/port-numbers. 5155 5156 5158 5160 5164 5165 5166 The source port identifier in the UDP header. 5167 5168 5169 5170 5171 See RFC 768 for the definition of the 5172 UDP source port field. 5173 Additional information on defined UDP port numbers can 5174 be found at http://www.iana.org/assignments/port-numbers. 5175 5176 5177 5179 5183 5184 5185 The destination port identifier in the UDP header. 5186 5187 5188 5189 5190 See RFC 768 for the definition of the 5191 UDP destination port field. 5192 Additional information on defined UDP port numbers can 5193 be found at http://www.iana.org/assignments/port-numbers. 5194 5195 5196 5198 5201 5202 5203 The value of the Length field in the UDP header. 5204 5205 5206 5207 5208 See RFC 768 for the specification of the 5209 UDP header. 5210 5211 5212 octets 5213 5215 5219 5220 5221 The source port identifier in the TCP header. 5222 5223 5224 5225 5226 See RFC 793 for the definition of the TCP 5227 source port field. 5228 Additional information on defined TCP port numbers can 5229 be found at http://www.iana.org/assignments/port-numbers. 5230 5231 5232 5234 5238 5239 5240 The destination port identifier in the TCP header. 5241 5242 5243 5244 5245 See RFC 793 for the definition of the TCP 5246 source port field. 5247 Additional information on defined TCP port numbers can 5248 be found at http://www.iana.org/assignments/port-numbers. 5249 5250 5251 5253 5256 5257 5258 The sequence number in the TCP header. 5259 5260 5261 5262 5263 See RFC 793 for the definition of the TCP 5264 sequence number. 5265 5266 5267 5269 5272 5273 5274 The acknowledgement number in the TCP header. 5275 5276 5277 5278 5279 See RFC 793 for the definition of the TCP 5280 acknowledgement number. 5281 5282 5283 5285 5288 5289 5290 The window field in the TCP header. 5291 If the TCP window scale is supported, 5292 then TCP window scale must be known 5293 to fully interpret the value of this information. 5294 5295 5296 5297 5298 See RFC 793 for the definition of the TCP window field. 5299 See RFC 1323 for the definition of the TCP window scale. 5300 5301 5303 5305 5308 5309 5310 The scale of the window field in the TCP header. 5311 5312 5313 5314 5315 See RFC 1323 for the definition of the TCP window scale. 5316 5317 5318 5320 5323 5324 5325 The urgent pointer in the TCP header. 5326 5327 5328 5329 5330 See RFC 793 for the definition of the TCP 5331 urgent pointer. 5332 5333 5334 5336 5339 5340 5341 The length of the TCP header. Note that the value of this 5342 Information Element is different to the value of the Data 5343 Offest field in the TCP header. The Data Offset field 5344 indicates the length of the TCP header in units of 4 octets. 5345 This Information Elements specifies the length of the TCP 5346 header in units of octets. 5347 5348 5349 5350 5351 See RFC 793 for the definition of the 5352 TCP header. 5353 5354 5355 octets 5356 5358 5362 5363 5364 Type and Code of the IPv4 ICMP message. The combination of 5365 both values is reported as (ICMP type * 256) + ICMP code. 5366 5367 5368 5369 5370 See RFC 792 for the definition of the IPv4 ICMP 5371 type and code 5372 fields. 5373 5374 5375 5377 5381 5382 5383 Type of the IPv4 ICMP message. 5384 5385 5386 5387 5388 See RFC 792 for the definition of the IPv4 ICMP 5389 type field. 5390 5391 5392 5394 5398 5399 5400 Code of the IPv4 ICMP message. 5401 5402 5403 5404 5405 See RFC 792 for the definition of the IPv4 5406 ICMP code field. 5407 5408 5409 5411 5415 5416 5417 Type and Code of the IPv6 ICMP message. The combination of 5418 both values is reported as (ICMP type * 256) + ICMP code. 5419 5420 5421 5422 5423 See RFC 4443 for the definition of the IPv6 5424 ICMP type and code fields. 5425 5426 5427 5429 5433 5434 5435 Type of the IPv6 ICMP message. 5436 5437 5438 5439 5440 See RFC 4443 for the definition of the IPv6 5441 ICMP type field. 5442 5443 5444 5446 5450 5451 5452 Code of the IPv6 ICMP message. 5453 5454 5455 5456 5457 See RFC 4443 for the definition of the IPv6 5458 ICMP code field. 5459 5460 5461 5463 5467 5468 5469 The type field of the IGMP message. 5470 5471 5472 5473 5474 See RFC 3376 for the definition of the IGMP 5475 type field. 5476 5477 5478 5480 5484 5485 5486 The IEEE 802 source MAC address field. 5487 5488 5489 5490 5491 See IEEE.802-3.2002. 5492 5493 5494 5495 5499 5500 5501 The definition of this Information Element is identical 5502 to the definition of Information Element 5503 'sourceMacAddress', except that it reports a 5504 potentially modified value caused by a middlebox 5505 function after the packet passed the Observation Point. 5506 5507 5508 5509 5510 See IEEE.802-3.2002. 5511 5512 5513 5515 5519 5520 5521 The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag 5522 Control Information field that was attached to the IP packet. 5523 5524 5525 5526 5527 See IEEE.802-1Q.2003. 5528 5529 5530 5532 5536 5537 5538 The definition of this Information Element is identical 5539 to the definition of Information Element 5540 'vlanId', except that it reports a 5541 potentially modified value caused by a middlebox 5542 function after the packet passed the Observation Point. 5544 5545 5546 5547 5548 See IEEE.802-1Q.2003. 5549 5550 5551 5553 5557 5558 5559 The IEEE 802 destination MAC address field. 5560 5561 5562 5563 5564 See IEEE.802-3.2002. 5565 5566 5567 5569 5573 5574 5575 The definition of this Information Element is identical 5576 to the definition of Information Element 5577 'destinationMacAddress', except that it reports a 5578 potentially modified value caused by a middlebox 5579 function after the packet passed the Observation Point. 5580 5581 5582 5583 5584 See IEEE.802-3.2002. 5585 5586 5587 5589 5593 5594 5595 The identifier of the 802.11 (Wi-Fi) channel used. 5596 5597 5598 5599 5600 See IEEE.802-11.1999. 5601 5602 5603 5605 5608 5609 5610 The Service Set IDentifier (SSID) identifying an 802.11 5611 (Wi-Fi) network used. According to IEEE.802-11.1999 the 5612 SSID is encoded into a string of up to 32 characters. 5613 5614 5615 5616 5617 See IEEE.802-11.1999. 5618 5619 5620 5622 5625 5626 5627 The TTL field from the top MPLS label stack entry, 5628 i.e. the last label that was pushed. 5629 5630 5631 5632 5633 See RFC 3032 for the specification of the 5634 TTL field. 5635 5636 5637 5639 5643 5644 5645 The Exp field from the top MPLS label stack entry, 5646 i.e. the last label that was pushed. 5647 5648 5649 Bit 0-4: Don't Care, value is irrelevant. 5650 Bit 5-7: MPLS Exp field 5652 0 1 2 3 4 5 6 7 5653 +---+---+---+---+---+---+---+---+ 5654 | don't care | Exp | 5655 +---+---+---+---+---+---+---+---+ 5656 5657 5658 5659 5660 See RFC 3032 for the specification of the Exp field. 5661 See RFC 3270 for usage of the Exp field. 5662 5663 5664 5666 5670 5671 5672 The definition of this Information Element is identical to the 5673 definition of Information Element 'mplsTopLabelExp', except 5674 that it reports a potentially modified value caused by a 5675 middlebox function after the packet passed the Observation 5676 Point. 5677 5678 5679 5680 5681 See RFC 3032 for the specification of the Exp field. 5682 See RFC 3270 for usage of the Exp field. 5683 5684 5685 5687 5690 5691 5692 The number of labels in the MPLS label stack. 5693 5694 5695 5696 5697 See RFC 3032 for the specification of 5698 the MPLS label stack. 5699 5700 5701 label stack entries 5702 5704 5707 5708 5709 The length of the MPLS label stack in units of octets. 5710 5711 5712 5713 5714 See RFC 3032 for the specification of 5715 the MPLS label stack. 5716 5717 5718 octets 5719 5721 5724 5725 5726 The size of the MPLS packet without the label stack. 5727 5728 5729 5730 5731 See RFC 3031 for the specification of 5732 MPLS packets. 5733 See RFC 3032 for the specification of 5734 the MPLS label stack. 5735 5737 5738 octets 5739 5741 5745 5746 5747 The label, exp and s fields from the top MPLS label 5748 stack entry, i.e. from the last label that was pushed. 5749 5750 5751 The size of this Information Element is 3 octets. 5752 5753 5754 0 1 2 5755 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 5756 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 5757 | Label | Exp |S| 5758 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 5760 Label: Label Value, 20 bits 5761 Exp: Experimental Use, 3 bits 5762 S: Bottom of Stack, 1 bit 5763 5764 5765 5766 5767 See RFC 3032. 5768 5769 5770 5772 5776 5777 5778 The label, exp, and s fields from the label stack entry that 5779 was pushed immediately before the label stack entry that would 5780 be reported by mplsTopLabelStackSection. See the definition of 5781 mplsTopLabelStackSection for further details. 5782 5783 5784 The size of this Information Element is 3 octets. 5786 5787 5788 5789 5790 See RFC 3032. 5791 5792 5793 5795 5799 5800 5801 The label, exp, and s fields from the label stack entry that 5802 was pushed immediately before the label stack entry that would 5803 be reported by mplsLabelStackSection2. See the definition of 5804 mplsTopLabelStackSection for further details. 5805 5806 5807 The size of this Information Element is 3 octets. 5808 5809 5810 5811 5812 See RFC 3032. 5813 5814 5815 5817 5821 5822 5823 The label, exp, and s fields from the label stack entry that 5824 was pushed immediately before the label stack entry that would 5825 be reported by mplsLabelStackSection3. See the definition of 5826 mplsTopLabelStackSection for further details. 5827 5828 5829 The size of this Information Element is 3 octets. 5830 5831 5832 5833 5834 See RFC 3032. 5835 5836 5837 5839 5843 5844 5845 The label, exp, and s fields from the label stack entry that 5846 was pushed immediately before the label stack entry that would 5847 be reported by mplsLabelStackSection4. See the definition of 5848 mplsTopLabelStackSection for further details. 5849 5850 5851 The size of this Information Element is 3 octets. 5852 5853 5854 5855 5856 See RFC 3032. 5857 5858 5859 5861 5865 5866 5867 The label, exp, and s fields from the label stack entry that 5868 was pushed immediately before the label stack entry that would 5869 be reported by mplsLabelStackSection5. See the definition of 5870 mplsTopLabelStackSection for further details. 5871 5872 5873 The size of this Information Element is 3 octets. 5874 5875 5876 5877 5878 See RFC 3032. 5879 5880 5881 5882 5886 5887 5888 The label, exp, and s fields from the label stack entry that 5889 was pushed immediately before the label stack entry that would 5890 be reported by mplsLabelStackSection6. See the definition of 5891 mplsTopLabelStackSection for further details. 5892 5893 5894 The size of this Information Element is 3 octets. 5895 5896 5897 5898 5899 See RFC 3032. 5900 5901 5902 5904 5908 5909 5910 The label, exp, and s fields from the label stack entry that 5911 was pushed immediately before the label stack entry that would 5912 be reported by mplsLabelStackSection7. See the definition of 5913 mplsTopLabelStackSection for further details. 5914 5915 5916 The size of this Information Element is 3 octets. 5917 5918 5919 5920 5921 See RFC 3032. 5922 5923 5924 5926 5931 5932 5933 The label, exp, and s fields from the label stack entry that 5934 was pushed immediately before the label stack entry that would 5935 be reported by mplsLabelStackSection8. See the definition of 5936 mplsTopLabelStackSection for further details. 5937 5938 5939 The size of this Information Element is 3 octets. 5940 5941 5942 5943 5944 See RFC 3032. 5945 5946 5947 5949 5953 5954 5955 The label, exp, and s fields from the label stack entry that 5956 was pushed immediately before the label stack entry that would 5957 be reported by mplsLabelStackSection9. See the definition of 5958 mplsTopLabelStackSection for further details. 5959 5960 5961 The size of this Information Element is 3 octets. 5962 5963 5964 5965 5966 See RFC 3032. 5967 5968 5969 5971 5974 5975 5976 The effective length of the IP payload. 5977 5978 5979 For IPv4 packets the value of this Information Element is 5980 the difference between the total length of the IPv4 packet 5981 (as reported by Information Element totalLengthIPv4) and the 5982 length of the IPv4 header (as reported by Information Element 5983 headerLengthIPv4). 5984 5985 5986 For IPv6, the value of the Payload Length field 5987 in the IPv6 header is reported except in the case that 5988 the value of this field is zero and that there is a valid 5989 jumbo payload option. In this case the value of the 5990 Jumbo Payload Length field in the jumbo payload option 5991 is reported. 5992 5993 5994 5995 5996 See RFC 791 for the specification of 5997 IPv4 packets. 5998 See RFC 2460 for the specification of the 5999 IPv6 payload length. 6000 See RFC 2675 for the specification of the 6001 IPv6 jumbo payload length. 6002 6003 6004 6006 6010 6011 6012 The IPv4 address of the next IPv4 hop. 6013 6014 6015 6017 6021 6022 6023 The IPv6 address of the next IPv6 hop. 6024 6025 6026 6027 6031 6032 6033 The autonomous system (AS) number of the source IP address. 6034 If AS path information for this Flow is only available as 6035 an unordered AS set (and not as an ordered AS sequence), 6036 then the value of this Information Element is 0. 6037 6038 6039 6040 6041 See RFC 4271 for a description of 6042 BGP-4 and see RFC 1930 for the definition 6043 of the AS number. 6044 6045 6046 6048 6052 6053 6054 The autonomous system (AS) number of the destination IP 6055 address. If AS path information for this Flow is only 6056 available as an unordered AS set (and not as an ordered AS 6057 sequence), then the value of this Information Element is 0. 6058 6059 6060 6061 6062 See RFC 4271 for a description of 6063 BGP-4 and see RFC 1930 for the definition 6064 6065 6066 6068 6072 6073 6074 The autonomous system (AS) number of the first AS in the AS 6075 path to the destination IP address. The path is deduced 6076 by looking up the destination IP address of the Flow in the 6077 BGP routing information base. If AS path information for 6078 this Flow is only available as an unordered AS set (and not 6079 as an ordered AS sequence), 6080 then the value of this Information Element is 0. 6081 6082 6083 6084 6085 See RFC 4271 for a description of BGP-4 and 6086 see RFC 1930 for the definition of the AS number. 6087 6088 6089 6091 6095 6096 6097 The autonomous system (AS) number of the last AS in the AS 6098 path from the source IP address. The path is deduced 6099 by looking up the source IP address of the Flow in the BGP 6100 routing information base. If AS path information for this 6101 Flow is only available as an unordered AS set (and not as 6102 an ordered AS sequence), then the value of this Information 6103 Element is 0. In case of BGP asymmetry, the 6104 bgpPrevAdjacentAsNumber might not be 6105 able to report the correct value. 6106 6107 6108 6109 6110 See RFC 4271 for a description of BGP-4 and 6111 see RFC 1930 for the definition of the AS number. 6112 6113 6114 6116 6120 6121 6122 The IPv4 address of the next (adjacent) BGP hop. 6124 6125 6126 6127 6128 See RFC 4271 for a description of BGP-4. 6129 6130 6131 6133 6137 6138 6139 The IPv6 address of the next (adjacent) BGP hop. 6140 6141 6142 6143 6144 See RFC 4271 for a description of BGP-4. 6145 6146 6147 6149 6153 6154 6155 This field identifies the control protocol that allocated the 6156 top of stack label. Initial values for this field are 6157 listed below. Further values may be assigned by IANA in 6158 the MPLS label type registry. 6159 6160 6161 - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label 6162 - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label 6163 - 0x03 VPN: Any label associated with VPN 6164 - 0x04 BGP: Any label associated with BGP or BGP routing 6165 - 0x05 LDP: Any label associated with dynamically assigned 6166 labels using LDP 6167 6168 6169 6170 6171 See RFC 3031 for the MPLS label structure. 6173 See RFC 4364 for the association of MPLS labels 6174 with VPNs. 6175 See RFC 4271 for BGP and BGP routing. 6176 See RFC 3036 for LDP. 6177 See the list of MPLS label types assigned by IANA at 6178 http://www.iana.org/assignments/mpls-label-types. 6179 6180 6181 6183 6187 6188 6189 The IPv4 address of the system that the MPLS top label will 6190 cause this Flow to be forwarded to. 6191 6192 6193 6194 6195 See RFC 3031 for the association between 6196 MPLS labels and IP addresses. 6197 6198 6199 6201 6205 6206 6207 The IPv6 address of the system that the MPLS top label will 6208 cause this Flow to be forwarded to. 6209 6210 6211 6212 6213 See RFC 3031 for the association between 6214 MPLS labels and IP addresses. 6215 6216 6217 6219 6223 6224 6225 The value of the VPN route distinguisher of a corresponding 6226 entry in a VPN routing and forwarding table. Route 6227 distinguisher ensures that the same address can be used in 6228 several different MPLS VPNs, and that it is possible for BGP to 6229 carry several completely different routes to that address, one 6230 for each VPN. According to RFC 4364 the size of 6231 mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an 6232 octet string with flexible length was chosen for representing a 6233 VPN route distinguisher by object MplsL3VpnRouteDistinguisher. 6234 This choice was made in order to be open to future changes of 6235 the size. This idea was adopted when choosing octetArray as 6236 abstract data type for this Information Element. The maximum 6237 length of this Information Element is 256 octets. 6238 6239 6240 6241 6242 See RFC 4364 for the specification of the route 6243 distinguisher. See RFC 4382 for the specification 6244 of the MPLS/BGP Layer 3 Virtual Private Network (VPN) 6245 Management Information Base. 6246 6247 6248 6250 6253 6254 6255 Length of the smallest packet observed for this Flow. 6256 The packet length includes the IP header(s) length and 6257 the IP payload length. 6258 6259 6260 6261 6262 See RFC 791 for the specification of the 6263 IPv4 total length. 6264 See RFC 2460 for the specification of the 6265 IPv6 payload length. 6266 See RFC 2675 for the specification of the 6267 IPv6 jumbo payload length. 6268 6270 6271 octets 6272 6274 6277 6278 6279 Length of the largest packet observed for this Flow. 6280 The packet length includes the IP header(s) length and 6281 the IP payload length. 6282 6283 6284 6285 6286 See RFC 791 for the specification of the 6287 IPv4 total length. 6288 See RFC 2460 for the specification of the 6289 IPv6 payload length. 6290 See RFC 2675 for the specification of the 6291 IPv6 jumbo payload length. 6292 6293 6294 octets 6295 6297 6300 6301 6302 Minimum TTL value observed for any packet in this Flow. 6303 6304 6305 6307 6310 6311 6312 Maximum TTL value observed for any packet in this Flow. 6313 6314 6315 6317 6321 6322 6323 IPv4 options in packets of this Flow. 6324 The information is encoded in a set of bit fields. For 6325 each valid IPv4 option type there is a bit in this set. 6326 The bit is set to 1 if any observed packet of this Flow 6327 contains the corresponding IPv4 option type. Otherwise, 6328 if no observed packet of this Flow contained the 6329 respective IPv4 option type, the value of the 6330 corresponding bit is 0. 6331 6332 6333 The list of valid IPv4 options is maintained by IANA. 6334 Note that for identifying an option not just the 5-bit 6335 Option Number, but all 8 bits of the Option Type need to 6336 match one of the IPv4 options specified at 6337 http://www.iana.org/assignments/ip-parameters. 6338 6339 6340 Options are mapped to bits according to their option numbers. 6341 Option number X is mapped to bit X. 6342 The mapping is illustrated by the figure below. 6343 6344 6345 0 1 2 3 4 5 6 7 6346 +------+------+------+------+------+------+------+------+ 6347 | EOOL | NOP | SEC | LSR | TS |E-SEC |CIPSO | RR | ... 6348 +------+------+------+------+------+------+------+------+ 6350 8 9 10 11 12 13 14 15 6351 +------+------+------+------+------+------+------+------+ 6352 ... | SID | SSR | ZSU | MTUP | MTUR | FINN | VISA |ENCODE| ... 6353 +------+------+------+------+------+------+------+------+ 6355 16 17 18 19 20 21 22 23 6356 +------+------+------+------+------+------+------+------+ 6357 ... |IMITD | EIP | TR |ADDEXT|RTRALT| SDB |NSAPA | DPS | ... 6358 +------+------+------+------+------+------+------+------+ 6360 24 25 26 27 28 29 30 31 6361 +------+------+------+------+------+------+------+------+ 6362 ... | UMP | to be assigned by IANA | 6363 +------+------+------+------+------+------+------+------+ 6364 Type Option 6365 Bit Value Name Reference 6366 ---+-----+-------+------------------------------------ 6367 0 0 EOOL End of Options List, RFC 791 6368 1 1 NOP No Operation, RFC 791 6369 2 130 SEC Security, RFC 1108 6370 3 131 LSR Loose Source Route, RFC 791 6371 4 68 TS Time Stamp, RFC 791 6372 5 133 E-SEC Extended Security, RFC 1108 6373 6 134 CIPSO Commercial Security 6374 7 7 RR Record Route, RFC 791 6375 8 136 SID Stream ID, RFC 791 6376 9 137 SSR Strict Source Route, RFC 791 6377 10 10 ZSU Experimental Measurement 6378 11 11 MTUP (obsoleted) MTU Probe, RFC 1191 6379 12 12 MTUR (obsoleted) MTU Reply, RFC 1191 6380 13 205 FINN Experimental Flow Control 6381 14 142 VISA Experimental Access Control 6382 15 15 ENCODE 6383 16 144 IMITD IMI Traffic Descriptor 6384 17 145 EIP Extended Internet Protocol, RFC 1385 6385 18 82 TR Traceroute, RFC 3193 6386 19 147 ADDEXT Address Extension 6387 20 148 RTRALT Router Alert, RFC 2113 6388 21 149 SDB Selective Directed Broadcast 6389 22 150 NSAPA NSAP Address 6390 23 151 DPS Dynamic Packet State 6391 24 152 UMP Upstream Multicast Pkt. 6392 ... ... ... Further options numbers 6393 may be assigned by IANA 6394 6395 6396 6397 6398 See RFC 791 for the definition of IPv4 options. 6399 See the list of IPv4 option numbers assigned by IANA 6400 at http://www.iana.org/assignments/ip-parameters. 6401 6402 6403 6405 6409 6410 6411 IPv6 extension headers observed in packets of this Flow. 6413 The information is encoded in a set of bit fields. For 6414 each IPv6 option header there is a bit in this set. 6415 The bit is set to 1 if any observed packet of this Flow 6416 contains the corresponding IPv6 extension header. 6417 Otherwise, if no observed packet of this Flow contained 6418 the respective IPv6 extension header, the value of the 6419 corresponding bit is 0. 6420 6421 6422 0 1 2 3 4 5 6 7 6423 +-----+-----+-----+-----+-----+-----+-----+-----+ 6424 | Res | FRA1| RH | FRA0| UNK | Res | HOP | DST | ... 6425 +-----+-----+-----+-----+-----+-----+-----+-----+ 6427 8 9 10 11 12 13 14 15 6428 +-----+-----+-----+-----+-----+-----+-----+-----+ 6429 ... | PAY | AH | ESP | Reserved | ... 6430 +-----+-----+-----+-----+-----+-----+-----+-----+ 6432 16 17 18 19 20 21 22 23 6433 +-----+-----+-----+-----+-----+-----+-----+-----+ 6434 ... | Reserved | ... 6435 +-----+-----+-----+-----+-----+-----+-----+-----+ 6437 24 25 26 27 28 29 30 31 6438 +-----+-----+-----+-----+-----+-----+-----+-----+ 6439 ... | Reserved | 6440 +-----+-----+-----+-----+-----+-----+-----+-----+ 6442 Bit IPv6 Option Description 6444 0, Res Reserved 6445 1, FRA1 44 Fragmentation header - not first fragment 6446 2, RH 43 Routing header 6447 3, FRA0 44 Fragment header - first fragment 6448 4, UNK Unknown Layer 4 header 6449 (compressed, encrypted, not supported) 6450 5, Res Reserved 6451 6, HOP 0 Hop-by-hop option header 6452 7, DST 60 Destination option header 6453 8, PAY 108 Payload compression header 6454 9, AH 51 Authentication Header 6455 10, ESP 50 Encrypted security payload 6456 11 to 31 Reserved 6457 6458 6459 6460 6461 See RFC 2460 for the general definition of 6462 IPv6 extension headers and for the specification of 6463 the hop-by-hop options header, the routing header, 6464 the fragment header, and the destination options header. 6465 See RFC 4302 for the specification of the 6466 authentication header. 6467 See RFC 4303 for the specification of the 6468 encapsulating security payload. 6469 6470 6471 6473 6477 6478 6479 TCP control bits observed for packets of this Flow. 6480 The information is encoded in a set of bit fields. 6481 For each TCP control bit there is a bit in this 6482 set. A bit is set to 1 if any observed packet of this 6483 Flow has the corresponding TCP control bit set to 1. 6484 A value of 0 for a bit indicates that the corresponding 6485 bit was not set in any of the observed packets 6486 of this Flow. 6487 6488 6489 0 1 2 3 4 5 6 7 6490 +-----+-----+-----+-----+-----+-----+-----+-----+ 6491 | Reserved | URG | ACK | PSH | RST | SYN | FIN | 6492 +-----+-----+-----+-----+-----+-----+-----+-----+ 6494 Reserved: Reserved for future use by TCP. Must be zero. 6495 URG: Urgent Pointer field significant 6496 ACK: Acknowledgment field significant 6497 PSH: Push Function 6498 RST: Reset the connection 6499 SYN: Synchronize sequence numbers 6500 FIN: No more data from sender 6501 6502 6503 6504 6505 See RFC 793 for the definition of 6506 the TCP control bits in the TCP header. 6507 6508 6510 6512 6516 6517 6518 TCP options in packets of this Flow. 6519 The information is encoded in a set of bit fields. For 6520 each TCP option there is a bit in this set. 6521 The bit is set to 1 if any observed packet of this Flow 6522 contains the corresponding TCP option. 6523 Otherwise, if no observed packet of this Flow contained 6524 the respective TCP option, the value of the 6525 corresponding bit is 0. 6526 6527 6528 Options are mapped to bits according to their option 6529 numbers. Option number X is mapped to bit X. 6530 TCP option numbers are maintained by IANA. 6531 6532 6533 0 1 2 3 4 5 6 7 6534 +-----+-----+-----+-----+-----+-----+-----+-----+ 6535 | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | ... 6536 +-----+-----+-----+-----+-----+-----+-----+-----+ 6538 8 9 10 11 12 13 14 15 6539 +-----+-----+-----+-----+-----+-----+-----+-----+ 6540 ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |... 6541 +-----+-----+-----+-----+-----+-----+-----+-----+ 6543 16 17 18 19 20 21 22 23 6544 +-----+-----+-----+-----+-----+-----+-----+-----+ 6545 ... | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 |... 6546 +-----+-----+-----+-----+-----+-----+-----+-----+ 6548 . . . 6550 56 57 58 59 60 61 62 63 6551 +-----+-----+-----+-----+-----+-----+-----+-----+ 6552 ... | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 6553 +-----+-----+-----+-----+-----+-----+-----+-----+ 6554 6555 6556 6557 6558 See RFC 793 for the definition of TCP options. 6559 See the list of TCP option numbers assigned by IANA 6560 at http://www.iana.org/assignments/tcp-parameters. 6561 6562 6563 6565 6568 6569 6570 The absolute timestamp of the first packet of this Flow. 6571 6572 6573 seconds 6574 6576 6579 6580 6581 The absolute timestamp of the last packet of this Flow. 6582 6583 6584 seconds 6585 6587 6590 6591 6592 The absolute timestamp of the first packet of this Flow. 6593 6594 6595 milliseconds 6596 6598 6601 6602 6603 The absolute timestamp of the last packet of this Flow. 6604 6605 6606 milliseconds 6607 6609 6612 6613 6614 The absolute timestamp of the first packet of this Flow. 6615 6616 6617 microseconds 6618 6620 6623 6624 6625 The absolute timestamp of the last packet of this Flow. 6626 6627 6628 microseconds 6629 6631 6634 6635 6636 The absolute timestamp of the first packet of this Flow. 6637 6638 6639 nanoseconds 6640 6642 6645 6646 6647 The absolute timestamp of the last packet of this Flow. 6648 6649 6650 nanoseconds 6651 6653 6656 6657 6658 This is a relative time stamp only valid within the scope 6659 of a single IPFIX Message. It contains the negative time 6660 offset of the first observed packet of this Flow relative 6661 to the export time specified in the IPFIX Message Header. 6662 6663 6664 6665 6666 See the IPFIX protocol specification for the definition 6667 of the IPFIX Message Header. 6668 6669 6670 EDITOR'S NOTE: This should be replaced by a reference to 6671 the IPFIX protocol specification as soon as an RFC number 6672 has been assigned to it. 6673 6674 6675 microseconds 6676 6678 6681 6682 6683 This is a relative time stamp only valid within the scope 6684 of a single IPFIX Message. It contains the negative time 6685 offset of the last observed packet of this Flow relative 6686 to the export time specified in the IPFIX Message Header. 6687 6688 6689 6690 6691 See the IPFIX protocol specification for the definition 6692 of the IPFIX Message Header. 6693 6694 6695 microseconds 6696 6698 6703 6704 6705 The absolute timestamp of the last (re-)initialization of the 6706 IPFIX Device. 6707 6708 6709 milliseconds 6710 6712 6715 6716 6717 The relative timestamp of the first packet of this Flow. 6718 It indicates the number of milliseconds since the 6719 last (re-)initialization of the IPFIX Device (sysUpTime). 6720 6721 6722 milliseconds 6723 6725 6728 6729 6730 The relative timestamp of the last packet of this Flow. 6731 It indicates the number of milliseconds since the 6732 last (re-)initialization of the IPFIX Device (sysUpTime). 6733 6734 6735 milliseconds 6736 6738 6742 6743 6744 The number of octets since the previous report (if any) 6745 in incoming packets for this Flow at the Observation Point. 6746 The number of octets include IP header(s) and IP payload. 6747 6748 6749 octets 6750 6751 6755 6756 6757 The definition of this Information Element is identical 6758 to the definition of Information Element 6759 'octetDeltaCount', except that it reports a 6760 potentially modified value caused by a middlebox 6761 function after the packet passed the Observation Point. 6762 6763 6764 octets 6765 6767 6770 6771 6772 The sum of the squared numbers of octets per incoming 6773 packet since the previous report (if any) for this 6774 Flow at the Observation Point. 6775 The number of octets include IP header(s) and IP payload. 6776 6777 6778 6780 6784 6785 6786 The total number of octets in incoming packets 6787 for this Flow at the Observation Point since the Metering 6788 Process (re-)initialization for this Observation Point. The 6789 number of octets include IP header(s) and IP payload. 6790 6791 6792 octets 6793 6795 6800 6801 6802 The definition of this Information Element is identical 6803 to the definition of Information Element 6804 'octetTotalCount', except that it reports a 6805 potentially modified value caused by a middlebox 6806 function after the packet passed the Observation Point. 6807 6808 6809 octets 6810 6812 6815 6816 6817 The total sum of the squared numbers of octets in incoming 6818 packets for this Flow at the Observation Point since the 6819 Metering Process (re-)initialization for this Observation 6820 Point. The number of octets include IP header(s) and IP 6821 payload. 6822 6823 6824 octets 6825 6827 6831 6832 6833 The number of incoming packets since the previous report 6834 (if any) for this Flow at the Observation Point. 6835 6836 6837 packets 6838 6840 6844 6845 6846 The definition of this Information Element is identical 6847 to the definition of Information Element 6848 'packetDeltaCount', except that it reports a 6849 potentially modified value caused by a middlebox 6850 function after the packet passed the Observation Point. 6851 6852 6853 packets 6854 6856 6860 6861 6862 The total number of incoming packets for this Flow 6863 at the Observation Point since the Metering Process 6864 (re-)initialization for this Observation Point. 6865 6866 6867 packets 6868 6870 6874 6875 6876 The definition of this Information Element is identical 6877 to the definition of Information Element 6878 'packetTotalCount', except that it reports a 6879 potentially modified value caused by a middlebox 6880 function after the packet passed the Observation Point. 6881 6882 6883 packets 6884 6886 6890 6891 6892 The number of octets since the previous report (if any) 6893 in packets of this Flow dropped by packet treatment. 6894 The number of octets include IP header(s) and IP payload. 6895 6897 6898 octets 6899 6901 6905 6906 6907 The number of packets since the previous report (if any) 6908 of this Flow dropped by packet treatment. 6909 6910 6911 packets 6912 6914 6918 6919 6920 The total number of octets in packets of this Flow dropped 6921 by packet treatment since the Metering Process 6922 (re-)initialization for this Observation Point. 6923 The number of octets include IP header(s) and IP payload. 6924 6925 6926 octets 6927 6929 6933 6934 6935 The number of packets of this Flow dropped by packet 6936 treatment since the Metering Process 6937 (re-)initialization for this Observation Point. 6938 6939 6940 packets 6941 6943 6947 6948 6949 The number of outgoing multicast packets since the 6950 previous report (if any) sent for packets of this Flow 6951 by a multicast daemon within the Observation Domain. 6952 This property cannot necessarily be observed at the 6953 Observation Point, but may be retrieved by other means. 6954 6955 6956 packets 6957 6959 6963 6964 6965 The number of octets since the previous report (if any) 6966 in outgoing multicast packets sent for packets of this 6967 Flow by a multicast daemon within the Observation Domain. 6968 This property cannot necessarily be observed at the 6969 Observation Point, but may be retrieved by other means. 6970 The number of octets include IP header(s) and IP payload. 6971 6972 6973 octets 6974 6976 6980 6981 6982 The total number of outgoing multicast packets sent for 6983 packets of this Flow by a multicast daemon within the 6984 Observation Domain since the Metering Process 6985 (re-)initialization. This property cannot necessarily 6986 be observed at the Observation Point, but may be retrieved 6987 by other means. 6988 6989 6990 packets 6991 6992 6996 6997 6998 The total number of octets in outgoing multicast packets 6999 sent for packets of this Flow by a multicast daemon in the 7000 Observation Domain since the Metering Process 7001 (re-)initialization. This property cannot necessarily be 7002 observed at the Observation Point, but may be retrieved by 7003 other means. 7004 The number of octets include IP header(s) and IP payload. 7005 7006 7007 octets 7008 7010 7014 7015 7016 The total number of packets of this flow with 7017 TCP "Synchronize sequence numbers" (SYN) flag set. 7018 7019 7020 7021 7022 See RFC 793 for the definition of the TCP SYN flag. 7023 7024 7025 packets 7026 7028 7032 7033 7034 The total number of packets of this flow with 7035 TCP "No more data from sender" (FIN) flag set. 7036 7037 7038 7039 7040 See RFC 793 for the definition of the TCP FIN flag. 7041 7042 7043 packets 7044 7046 7050 7051 7052 The total number of packets of this flow with 7053 TCP "Reset the connection" (RST) flag set. 7054 7055 7056 7057 7058 See RFC 793 for the definition of the TCP RST flag. 7059 7060 7061 packets 7062 7064 7068 7069 7070 The total number of packets of this flow with 7071 TCP "Push Function" (PSH) flag set. 7072 7073 7074 7075 7076 See RFC 793 for the definition of the TCP PSH flag. 7077 7078 7079 packets 7080 7082 7086 7087 7088 The total number of packets of this flow with 7089 TCP "Acknowledgment field significant" (ACK) flag set. 7090 7091 7092 7093 7094 See RFC 793 for the definition of the TCP ACK flag. 7095 7096 7097 packets 7098 7100 7104 7105 7106 The total number of packets of this flow with 7107 TCP "Urgent Pointer field significant" (URG) flag set. 7108 7109 7110 7111 7112 See RFC 793 for the definition of the TCP URG flag. 7113 7114 7115 packets 7116 7118 7121 7122 7123 The number of seconds after which an active Flow is timed out 7124 anyway, even if there is still a continuous flow of packets. 7125 7126 7127 seconds 7128 7130 7133 7134 7135 A Flow is considered to be timed out if no packets belonging 7136 to the Flow have been observed for the number of seconds 7137 specified by this field. 7138 7139 7140 seconds 7141 7143 7147 7148 7149 The reason for Flow termination. The range of values includes 7150 7151 7152 0x01: idle timeout 7153 The Flow was terminated because it was considered to be 7154 idle. 7155 0x02: active timeout 7156 The Flow was terminated for reporting purposes while it was 7157 still active, for example, after the maximum lifetime of 7158 unreported Flows was reached. 7159 0x03: end of Flow detected 7160 The Flow was terminated because the Metering Process 7161 detected signals indicating the end of the Flow, 7162 for example, the TCP FIN flag. 7163 0x04: forced end 7164 The Flow was terminated because of some external event, 7165 for example, a shut down of the Metering Process initiated 7166 by a network management application. 7167 0x05: lack of resources 7168 the Flow was terminated because of lack of resources 7169 available to the Metering Process and/or the Exporting 7170 Process 7171 7172 7173 7175 7178 7179 7180 The difference in time between the first observed packet 7181 of this Flow and the last observed packet of this Flow. 7182 7183 7184 milliseconds 7185 7187 7190 7191 7192 The difference in time between the first observed packet 7193 of this Flow and the last observed packet of this Flow. 7194 7195 7196 microseconds 7197 7199 7203 7204 7205 The direction of the Flow observed at the Observation 7206 Point. There are only two values defined. 7207 7208 7209 0x00: ingress flow 7210 0x01: egress flow 7211 7212 7213 7215 7218 7219 7220 The value of this Information Element is always a sequence of 7221 0x00 values. 7222 7223 7224 7226 7228 Appendix B. XML Specification of Abstract Data Types 7230 This appendix containfs a machine readable description of the 7231 abstract data types to be used for IPFIX Information Elements and a 7232 machine readable description of the template used for defining IPFIX 7233 Information Elements. Note that this appendix is of informational 7234 nature, while the text in sections 2 and 3 (generated from this 7235 appendix) is normative. 7237 At the same time, this appendix is also an XML schema that was used 7238 for creating the XML specification of Information Elements in 7239 Appendix A. It may also be used for specifying further Information 7240 Elements in extensions of the IPFIX information model. Thi schema 7241 and its namespace are regitered by IANA at ... 7243 7245 7250 7251 7252 7253 7254 The type "unsigned8" represents a 7255 non-negative integer value in the range of 0 to 255. 7256 7257 7258 7260 7261 7262 The type "unsigned16" represents a 7263 non-negative integer value in the range of 0 to 65535. 7264 7265 7266 7268 7269 7270 The type "unsigned32" represents a 7271 non-negative integer value in the range of 0 to 7272 4294967295. 7273 7275 7276 7278 7279 7280 The type "unsigned64" represents a 7281 non-negative integer value in the range of 0 to 7282 18446744073709551615. 7283 7284 7285 7287 7288 7289 The type "signed8" represents 7290 an integer value in the range of -128 to 127. 7291 7292 7293 7295 7296 7297 The type "signed16" represents an 7298 integer value in the range of -32768 to 32767. 7299 7300 7301 7303 7304 7305 The type "signed32" represents an 7306 integer value in the range of -2147483648 to 7307 2147483647. 7308 7309 7310 7312 7313 7314 The type "signed64" represents an 7315 integer value in the range of -9223372036854775808 7316 to 9223372036854775807. 7317 7318 7319 7321 7322 7323 The type "float32" corresponds to an IEEE 7324 single-precision 32-bit floating point type as defined 7325 in [IEEE.754.1985]. 7326 7327 7328 7330 7331 7332 The type "float64" corresponds to an IEEE 7333 double-precision 64-bit floating point type as defined 7334 in [IEEE.754.1985]. 7335 7336 7337 7339 7340 7341 The type "boolean" represents a binary 7342 value. The only allowed values are "true" and "false". 7343 7344 7345 7347 7348 7349 The type "macAddress" represents a 7350 string of 6 octets. 7351 7352 7353 7355 7356 7357 The type "octetArray" represents a finite 7358 length string of octets. 7359 7360 7361 7363 7364 7365 7366 The type "string" represents a finite length string 7367 of valid characters from the Unicode character encoding 7368 set [ISO.10646-1.1993]. Unicode allows for ASCII 7369 [ISO.646.1991] and many other international character 7370 sets to be used. 7372 7373 7374 7376 7377 7378 7379 The type "dateTimeSeconds" represents a time value 7380 in units of seconds normalized to the 7381 GMT time zone. 7382 7383 7384 7386 7387 7388 The type "dateTimeMilliseconds" represents 7389 a time value in units of milliseconds 7390 normalized to the GMT time zone. 7391 7392 7393 7395 7396 7397 The type "dateTimeMicroseconds" represents 7398 a time value in units of microseconds 7399 normalized to the GMT time zone. 7400 7401 7402 7404 7405 7406 The type "dateTimeNanoseconds" represents 7407 a time value in units of nanoseconds 7408 normalized to the GMT time zone. 7409 7410 7411 7413 7414 7415 The type "ipv4Address" represents a value 7416 of an IPv4 address. 7417 7418 7419 7420 7421 7422 The type "ipv6Address" represents a value 7423 of an IPv6 address. 7424 7425 7426 7427 7428 7430 7431 7432 7433 7434 7435 A quantity value represents a discrete 7436 measured value pertaining to the record. This is 7437 distinguished from counters which represent an ongoing 7438 measured value whose "odometer" reading is captured as 7439 part of a given record. If no semantic qualifier is 7440 given, the Information Elements that have an integral 7441 data type should behave as a quantity. 7442 7443 7444 7446 7447 7448 7449 An integral value reporting the value of a counter. 7450 Counters are unsigned and wrap back to zero after 7451 reaching the limit of the type. For example, an 7452 unsigned64 with counter semantics will continue to 7453 increment until reaching the value of 2**64 - 1. At 7454 this point the next increment will wrap its value to 7455 zero and continue counting from zero. The semantics 7456 of a total counter is similar to the semantics of 7457 counters used in SNMP, such as Counter32 defined in 7458 RFC 2578 [RFC2578]. The only difference between total 7459 counters and counters used in SNMP is that the total 7460 counters have an initial value of 0. A total counter 7461 counts independently of the export of its value. 7462 7463 7464 7466 7467 7468 7469 An integral value reporting the value of a counter. 7470 Counters are unsigned and wrap back to zero after 7471 reaching the limit of the type. For example, an 7472 unsigned64 with counter semantics will continue to 7473 increment until reaching the value of 2**64 - 1. At 7474 this point the next increment will wrap its value to 7475 zero and continue counting from zero. The semantics 7476 of a delta counter is similar to the semantics of 7477 counters used in SNMP, such as Counter32 defined in 7478 RFC 2578 [RFC2578]. The only difference between delta 7479 counters and counters used in SNMP is that the delta 7480 counters have an initial value of 0. A delta counter 7481 is reset to 0 each time its value is exported. 7482 7483 7484 7486 7487 7488 7489 An integral value which serves as an identifier. 7490 Specifically mathematical operations on two 7491 identifiers (aside from the equality operation) are 7492 meaningless. For example, Autonomous System ID 1 * 7493 Autonomous System ID 2 is meaningless. 7494 7495 7496 7498 7499 7500 7501 An integral value which actually represents a set of 7502 bit fields. Logical operations are appropriate on 7503 such values, but not other mathematical operations. 7504 Flags should always be of an unsigned type. 7505 7506 7507 7508 7509 7511 7512 7513 7514 7515 7516 Used for Information Elements that are applicable to 7517 Flow Records only. 7518 7519 7520 7522 7523 7524 7525 Used for Information Elements that are applicable to 7526 option records only. 7527 7528 7529 7531 7532 7533 7534 Used for Information Elements that are applicable to 7535 Flow Records as well as to option records. 7536 7537 7538 7539 7540 7542 7543 7544 7545 7546 7547 Indicates that the Information Element definition 7548 is that the definition is current and valid. 7549 7550 7551 7553 7554 7555 7556 Indicates that the Information Element definition is 7557 obsolete, but it permits new/continued implementation 7558 in order to foster interoperability with older/existing 7559 implementations. 7560 7561 7562 7563 7564 7565 7566 Indicates that the Information Element definition is 7567 obsolete and should not be implemented and/or can be 7568 removed if previously implemented. 7569 7570 7571 7572 7573 7575 7576 7577 7578 7579 7580 7582 7583 7585 7586 7587 7588 7589 7590 7591 7592 7593 7594 7595 7596 7598 7599 7600 7602 7603 7604 7605 7606 7607 7608 7610 7611 7612 The semantics of this Information Element. 7613 Describes how this Information Element is 7614 derived from the Flow or other information 7615 available to the observer. 7616 7617 7618 7620 7622 7623 7624 Identifies additional specifications which more 7625 precisely define this item or provide additional 7626 context for its use. 7627 7628 7629 7631 7633 7634 7635 If the Information Element is a measure of some 7636 kind, the units identify what the measure is. 7637 7638 7639 7641 7643 7644 7645 Some Information Elements may only be able to 7646 take on a restricted set of values which can be 7647 expressed as a range (e.g. 0 through 511 7648 inclusive). If this is the case, the valid 7649 inclusive range should be specified. 7650 7651 7652 7653 7655 7656 7657 7658 A unique and meaningful name for the Information 7659 Element. 7660 7661 7662 7664 7666 7667 7668 One of the types listed in section 3.1 of this 7669 document or in a future extension of the 7670 information model. The type space for attributes 7671 is constrained to facilitate implementation. The 7672 existing type space does however encompass most 7673 basic types used in modern programming languages, 7674 as well as some derived types (such as ipv4Address) 7675 which are common to this domain and useful 7676 to distinguish. 7677 7678 7679 7681 7683 7684 7685 The integral types may be qualified by additional 7686 semantic details. Valid values for the data type 7687 semantics are specified in section 3.2 of this 7688 document or in a future extension of the 7689 information model. 7690 7691 7692 7694 7696 7697 7698 A numeric identifier of the Information Element. 7699 If this identifier is used without an enterprise 7700 identifier (see [I-D.ietf-ipfix-protocol] and 7701 enterpriseId below), then it is globally unique 7702 and the list of allowed values is administered by 7703 IANA. It is used for compact identification of an 7704 Information Element when encoding Templates in the 7705 protocol. 7706 7708 7709 7711 7713 7714 7715 Enterprises may wish to define Information Elements 7716 without registering them with IANA, for example for 7717 enterprise-internal purposes. For such Information 7718 Elements the Information Element identifier 7719 described above is not sufficient when the 7720 Information Element is used outside the enterprise. 7721 If specifications of enterprise-specific 7722 Information Elements are made public and/or if 7723 enterprise-specific identifiers are used by the 7724 IPFIX protocol outside the enterprise, then the 7725 enterprise-specific identifier MUST be made 7726 globally unique by combining it with an enterprise 7727 identifier. Valid values for the enterpriseId are 7728 defined by IANA as SMI network management private 7729 enterprise codes. They are defined at 7730 http://www.iana.org/assignments/enterprise-numbers. 7731 7732 7733 7735 7737 7738 This propoerty of an Information 7739 Element indicates in which kind of records the 7740 Information Element can be used. 7741 Allowed values for this property are 'data', 7742 'option', and 'all'. 7743 7744 7746 7748 7749 7750 The status of the specification of this 7751 Information Element. Allowed values are 'current', 7752 'deprecated', and 'obsolete'. 7753 7754 7755 7756 7758 7759 to be done ... 7760 7761 7763 7764 7765 7766 7768 7769 7771 7772 7773 7774 7776 Authors' Addresses 7778 Juergen Quittek 7779 NEC 7780 Kurfuersten-Anlage 36 7781 Heidelberg 69115 7782 Germany 7784 Phone: +49 6221 90511-15 7785 Email: quittek@netlab.nec.de 7786 URI: http://www.netlab.nec.de/ 7788 Stewart Bryant 7789 Cisco Systems Inc. 7790 250, Longwater, Green Park 7791 Reading RG2 6GB 7792 United Kingdom 7794 Email: stbryant@cisco.com 7796 Benoit Claise 7797 Cisco Systems Inc. 7798 De Kleetlaan 6a b1 7799 Diegem 1831 7800 Belgium 7802 Phone: +32 2 704 5622 7803 Email: bclaise@cisco.com 7805 Paul Aitken 7806 Cisco Systems Inc. 7807 96 Commercial Quay 7808 Edinburgh EH6 6LX 7809 Scotland 7811 Phone: +44 131 561 3616 7812 Email: paitken@cisco.com 7813 Jeff Meyer 7814 PayPal 7815 2211 N. First St. 7816 San Jose, CA 95131-2021 7817 US 7819 Phone: +1 408 976-9149 7820 Email: jemeyer@paypal.com 7821 URI: http://www.paypal.com 7823 Full Copyright Statement 7825 Copyright (C) The IETF Trust (2007). 7827 This document is subject to the rights, licenses and restrictions 7828 contained in BCP 78, and except as set forth therein, the authors 7829 retain all their rights. 7831 This document and the information contained herein are provided on an 7832 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 7833 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 7834 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 7835 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 7836 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 7837 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 7839 Intellectual Property Statement 7841 The IETF takes no position regarding the validity or scope of any 7842 Intellectual Property Rights or other rights that might be claimed to 7843 pertain to the implementation or use of the technology described in 7844 this document or the extent to which any license under such rights 7845 might or might not be available; nor does it represent that it has 7846 made any independent effort to identify any such rights. Information 7847 on the procedures with respect to rights in RFC documents can be 7848 found in BCP 78 and BCP 79. 7850 Copies of IPR disclosures made to the IETF Secretariat and any 7851 assurances of licenses to be made available, or the result of an 7852 attempt made to obtain a general license or permission for the use of 7853 such proprietary rights by implementers or users of this 7854 specification can be obtained from the IETF on-line IPR repository at 7855 http://www.ietf.org/ipr. 7857 The IETF invites any interested party to bring to its attention any 7858 copyrights, patents or patent applications, or other proprietary 7859 rights that may cover technology that may be required to implement 7860 this standard. Please address the information to the IETF at 7861 ietf-ipr@ietf.org. 7863 Acknowledgment 7865 Funding for the RFC Editor function is provided by the IETF 7866 Administrative Support Activity (IASA).