Cisco Systems, Inc.

De Kleetlaan, 7 Brussels Diegem B-1831 Belgium +32 2 704 5494 ayourtch@cisco.com

Cisco Systems, Inc.

96 Commercial Quay Edinburgh EH6 6LX Scotland +44 131 561 3616 paitken@cisco.com

Cisco Systems, Inc.

De Kleetlaan, 6a b1 Diegem B-1831 Belgium +32 2 704 5622 bclaise@cisco.com

Applications IPFIX This document describes some additional IPFIX Information Elements in the range of 1-127, which is the range compatible with field types used by NetFlow version 9 in RFC3954, as specified in the IPFIX Information Model RFC 7012.

The section 4 of defines the IPFIX Information Elements in the range of 1-127 to be compatible with the NetFlow version 9 fields, as specified in the "Cisco Systems NetFlow Services Export Version 9". As was specified in 2004, it does not contain all NetFlow version 9 specific fields in the range 1-127. The question was asked whether IPFIX Devices should exclusively report the IPFIX IANA IEs. In other words, when upgrading from a NetFlow metering process to an IPFIX Metering Process, should the IPFIX Devices stop reporting NetFlow version 9 specific IEs that were not registered in IANA? This document is intended to fill the gap in this IE range. It describes some additional IPFIX Information Elements in the range of 1-127, which is the range compatible with field types used by NetFlow version 9 in , as specified in the IPFIX Information Model . With this, IPFIX implementations could export all the Information Elements specified in IANA, regardless of the range. This document followed the rules (Guidelines for Authors and Reviewers of IPFIX Information Elements). This document does not extend . The IPFIX Protocol () has its own Information Model (, IANA) which is extensible upon application to IANA, subject to expert review by IE-doctors (). This draft extends the IPFIX Information Model.

IPFIX-specific terminology used in this document is defined in Section 2 of . As in , these IPFIX-specific terms have the first letter of a word capitalized when used in this document.

The following Information Elements are discussed in the sections below: ID Name ID Name 84samplerName 34samplingInterval87flagsAndSamplerId 35samplingAlgorithm89forwardingStatus 38engineType92srcTrafficIndex 39engineId93dstTrafficIndex 43ipv4RouterSc100className 48samplerId102layer2packetSectionOffset 49samplerMode103layer2packetSectionSize 50samplerRandomInterval104layer2packetSectionData 51classId

Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled - e.g. a value of 100 indicates that one of every 100 packets is sampled. unsigned32 34 quantity deprecated packets

Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling; 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required, see PSAMP parameters. unsigned8 35 identifier deprecated

Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the collector. unsigned8 38 identifier deprecated

VIP or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the collector. unsigned8 39 identifier deprecated

This is a platform-specific field for Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. ipv4Address 43 default deprecated describes the MultiLayer Switching.

Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName. unsigned8 48 identifier deprecated

Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 - deterministic, 2 - random sampling. Use with samplerRandomInterval. unsigned8 49 identifier deprecated

Deprecated in favour of 305 samplingPacketInterval. Packet interval at which to sample - in case of random sampling. Used in connection with samplerMode 0x02 (random sampling) value. unsigned32 50 quantity deprecated

Deprecated in favour of 302 selectorId. Characterizes the traffic class, i.e. QoS treatment. unsigned8 51 identifier deprecated

Deprecated in favor of 335 selectorName. Name of the flow sampler. string 84 deprecated

Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on the collector. unsigned32 87 identifier deprecated

This Information Element describes the forwarding status of the flow and any attached reasons. The Reduced Size Encoding rules as per apply.

The basic encoding is 8 bits. The future extensions could add one or three bytes. The layout of the basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Status: 00b = Unknown 01b = Forwarded 10b = Dropped 11b = Consumed Reason Code (status = 01b, Forwarded) 01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented Reason Code (status = 10b, Dropped) 10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length 10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware Reason Code (status = 11b, Consumed) 11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us Examples: value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set

unsigned32 89 identifier current See - NetFlow Version 9 Record Format.

BGP Policy Accounting Source Traffic Index unsigned32 92 identifier current BGP policy accounting as described in

BGP Policy Accounting Destination Traffic Index unsigned32 93 identifier current BGP policy accounting as described in

Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element. string 100 deprecated

Deprecated in favor of sectionOffset (409). Layer 2 packet section offset. Potentially a generic packet section offset. unsigned16 102 quantity deprecated

Deprecated in favor of dataLinkFrameSize(312). Layer 2 packet section size. Potentially a generic packet section size. unsigned16 103 quantity deprecated

Deprecated in favor of dataLinkFrameSection (315). Layer 2 packet section data. octetArray 104 deprecated

ElementId: 65 .. 69 Performance metrics will need a consolidation in the industry, based on RFC6390. Once this consolidation happens, via a separate document the IEs 65-69 will either be assigned in the IANA registry or their status will be deprecated.

ElementId: 101 ElementId: 94 .. 97 Please refer to the RFC 6759

ElementId: 105..127 These element IDs are not covered by this draft and left "as is", i.e. for NetFlow v9 compatibility.

This document specifies several new IPFIX Information Elements in the IPFIX Information Element registry as defined in Section 3 above. The following Information Elements must be assigned: IE Number 34 for the samplingInterval IE IE Number 35 for the samplingAlgorithm IE IE Number 38 for the engineType IE IE Number 39 for the engineId IE IE Number 43 for the ipv4RouterSc IE IE Number 48 for the samplerId IE IE Number 49 for the samplerMode IE IE Number 50 for the samplerRandomInterval IE IE Number 51 for the classId IE IE Number 84 for the samplerName IE IE Number 87 for the flagsAndSamplerId IE IE Number 89 for the forwardingStatus IE IE Number 92 for the srcTrafficIndex IE IE Number 93 for the dstTrafficIndex IE IE Number 100 for the className IE IE Number 102 for the layer2packetSectionOffset IE IE Number 103 for the layer2packetSectionSize IE IE Number 104 for the layer2packetSectionData IE

This document specifies the definitions of several Information Elements and does not alter the security considerations of the base protocol. Please refer to the security considerations sections of RFC 3954 and RFC 7012. However, the export of the sections of the packet payload may unintentionally change the security assumptions of other protocols.

IANA IANA Cisco Cisco Cisco

Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled - e.g. a value of 100 indicates that one of every 100 packets is sampled. Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling; 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required, see PSAMP parameters. Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the collector. VIP or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the collector. This is a platform-specific field for Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching. http://www .cisco.com /en/US/pro ducts/hw/s witches/ps 700/products_configuration_example09186a00800ab513.shtml describes the MultiLayer Switching. Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName. Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 - deterministic, 2 - random sampling. Use with samplerRandomInterval. Deprecated in favour of 305 samplingPacketInterval. Packet interval at which to sample - in case of random sampling. Used in connection with samplerMode 0x02 (random sampling) value. Deprecated in favour of 302 selectorId. Characterizes the traffic class, i.e. QoS treatment. Deprecated in favor of 335 selectorName. Name of the flow sampler. Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on the collector. This Information Element describes the forwarding status of the flow and any attached reasons. The Reduced Size Encoding rules as per apply. The basic encoding is 8 bits. The future extensions could add one or three bytes. The layout of the basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Status: 00b = Unknown 01b = Forwarded 10b = Dropped 11b = Consumed Reason Code (status = 01b, Forwarded) 01 000000b = 64 = Unknown 01 000001b = 65 = Fragmented 01 000010b = 66 = Not Fragmented Reason Code (status = 10b, Dropped) 10 000000b = 128 = Unknown 10 000001b = 129 = ACL deny 10 000010b = 130 = ACL drop 10 000011b = 131 = Unroutable 10 000100b = 132 = Adjacency 10 000101b = 133 = Fragmentation and DF set 10 000110b = 134 = Bad header checksum 10 000111b = 135 = Bad total Length 10 001000b = 136 = Bad header length 10 001001b = 137 = bad TTL 10 001010b = 138 = Policer 10 001011b = 139 = WRED 10 001100b = 140 = RPF 10 001101b = 141 = For us 10 001110b = 142 = Bad output interface 10 001111b = 143 = Hardware Reason Code (status = 11b, Consumed) 11 000000b = 192 = Unknown 11 000001b = 193 = Punt Adjacency 11 000010b = 194 = Incomplete Adjacency 11 000011b = 195 = For us Examples: value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Fragmentation and DF set See http:/ /www.cisco .com/en/US /technolog ies/tk648/tk362/technologies_white_paper09186a00800a3db9.html - NetFlow Version 9 Record Format. BGP Policy Accounting Source Traffic Index BGP policy accounting as described in http://www .cisco.com /en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml BGP Policy Accounting Destination Traffic Index BGP policy accounting as described in http://www .cisco.com /en/US/tech/tk365/technologies_tech_note09186a0080094e88.shtml Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element. Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset. Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size. Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data. ]]>

To be removed by RFC Editor before publication 01: initial revision presented at the IETF meeting. 02: removed "flow" from flowSamplerId, flowSamplerMode, and flowSamplerRandomInterval; updated the related drafts in references; added the "reference" column to the XML definitions; renamed fsFlowEntryTotalCount into deltaFlowCount to keep the naming in sync with draft-trammell-ipfix-a9n. Also minor changes to formatting and added the IE overview table. 03: updated the references to draft-claise-export-application-info-in-ipfix, slightly tweaked the title and removed the unused reference to draft-ietf-ipfix-flow-selection-tech. 04: sync the references. 05: update references to draft-claise-export-application-info-in-ipfix with reference to rfc6759, draft-trammell-ipfix-a9n to draft-ietf-ipfix-a9n, draft-kashima-ipfix-data-link-layer-monitoring to draft-ietf-ipfix-data-link-layer-monitoring. 06: sync the references. 07: Update per comment from Andrew Feren - change semantics of ipv4RouterSc to "identifier" and remove deltaFlowCount as it made it to IANA. Update references RFC5101 to RFC7011, draft-ietf-ipfix-data-link-layer-monitoring from -03 to -04. 08: restore the 84 samplerName after its accidental deletion from table 1 in -07; mark 101-103 IEs as deprecated, include the paragraph on IE 105..126 that are not discussed in this draft. 09: now that IANA assigned the IPFIX Information Elements in draft-ietf-ipfix-data-link-layer-monitoring, this draft is updated to simplify IANA's/editor's work, with changes as follows. TBD02 became 409 as sectionOffset is now assigned by IANA. Removed "EDITOR's NOTE" for layer2packetSectionOffset, layer2packetSectionSize, layer2packetSectionData, ietf-ipfix-data-link-layer-monitoring. 10: reflect the comments from GEN-ART / LC reviews. Change the wording in abstract/introduction, add required clarifications. Per Andrew Peren, the semantic for ipv4RouterSc should be "default", not "identifier" - fixed. Alas, unfortunately no way to affect how xml2rfc trims the super-long URLs, so I could not make splitting of the URLs nicer.