idnits 2.17.1 draft-ietf-ipfix-info-11.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 19. -- Found old boilerplate from RFC 3978, Section 5.5 on line 6429. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 6406. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 6413. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 6419. ** This document has an original RFC 3978 Section 5.4 Copyright Line, instead of the newer IETF Trust Copyright according to RFC 4748. ** This document has an original RFC 3978 Section 5.5 Disclaimer, instead of the newer disclaimer which includes the IETF Trust according to RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 3 instances of lines with multicast IPv4 addresses in the document. If these are generic example addresses, they should be changed to use the 233.252.0.x range defined in RFC 5771 ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 316: '...future extension MUST have the followi...' RFC 2119 keyword, line 336: '...rmation Elements MUST have the followi...' RFC 2119 keyword, line 347: '...cific identifier MUST be made globally...' RFC 2119 keyword, line 354: '...future extension MAY have the followin...' RFC 2119 keyword, line 603: '...rise identifiers MUST be registered as...' (15 more instances...) Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (September 22, 2005) is 6784 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Unused Reference: 'I-D.ietf-ipfix-architecture' is defined on line 3091, but no explicit reference was found in the text == Unused Reference: 'I-D.ietf-ipfix-as' is defined on line 3097, but no explicit reference was found in the text == Unused Reference: 'IEEE.802-11.1999' is defined on line 3107, but no explicit reference was found in the text == Unused Reference: 'IEEE.802-3.2002' is defined on line 3116, but no explicit reference was found in the text == Unused Reference: 'IEEE.P802-1Q.2003' is defined on line 3124, but no explicit reference was found in the text == Unused Reference: 'RFC0768' is defined on line 3140, but no explicit reference was found in the text == Unused Reference: 'RFC0791' is defined on line 3143, but no explicit reference was found in the text == Unused Reference: 'RFC0792' is defined on line 3146, but no explicit reference was found in the text == Unused Reference: 'RFC0793' is defined on line 3149, but no explicit reference was found in the text == Unused Reference: 'RFC1771' is defined on line 3152, but no explicit reference was found in the text == Unused Reference: 'RFC1812' is defined on line 3155, but no explicit reference was found in the text == Unused Reference: 'RFC1930' is defined on line 3158, but no explicit reference was found in the text == Unused Reference: 'RFC2236' is defined on line 3162, but no explicit reference was found in the text == Unused Reference: 'RFC2402' is defined on line 3165, but no explicit reference was found in the text == Unused Reference: 'RFC2406' is defined on line 3168, but no explicit reference was found in the text == Unused Reference: 'RFC2460' is defined on line 3175, but no explicit reference was found in the text == Unused Reference: 'RFC2463' is defined on line 3178, but no explicit reference was found in the text == Unused Reference: 'RFC2547' is defined on line 3182, but no explicit reference was found in the text == Unused Reference: 'RFC2629' is defined on line 3185, but no explicit reference was found in the text == Unused Reference: 'RFC2863' is defined on line 3188, but no explicit reference was found in the text == Unused Reference: 'RFC2960' is defined on line 3191, but no explicit reference was found in the text == Unused Reference: 'RFC3031' is defined on line 3196, but no explicit reference was found in the text == Unused Reference: 'RFC3032' is defined on line 3199, but no explicit reference was found in the text == Unused Reference: 'RFC3036' is defined on line 3203, but no explicit reference was found in the text == Unused Reference: 'RFC3260' is defined on line 3209, but no explicit reference was found in the text == Unused Reference: 'RFC3667' is defined on line 3212, but no explicit reference was found in the text == Unused Reference: 'RFC3668' is defined on line 3215, but no explicit reference was found in the text == Unused Reference: 'RFC3917' is defined on line 3218, but no explicit reference was found in the text == Outdated reference: A later version (-26) exists of draft-ietf-ipfix-protocol-12 == Outdated reference: A later version (-12) exists of draft-ietf-ipfix-architecture-07 == Outdated reference: A later version (-12) exists of draft-ietf-ipfix-as-04 -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1771 (Obsoleted by RFC 4271) -- Obsolete informational reference (is this intentional?): RFC 2402 (Obsoleted by RFC 4302, RFC 4305) -- Obsolete informational reference (is this intentional?): RFC 2406 (Obsoleted by RFC 4303, RFC 4305) -- Obsolete informational reference (is this intentional?): RFC 2434 (Obsoleted by RFC 5226) -- Obsolete informational reference (is this intentional?): RFC 2460 (Obsoleted by RFC 8200) -- Obsolete informational reference (is this intentional?): RFC 2463 (Obsoleted by RFC 4443) -- Obsolete informational reference (is this intentional?): RFC 2547 (Obsoleted by RFC 4364) -- Obsolete informational reference (is this intentional?): RFC 2629 (Obsoleted by RFC 7749) -- Obsolete informational reference (is this intentional?): RFC 2960 (Obsoleted by RFC 4960) -- Obsolete informational reference (is this intentional?): RFC 3036 (Obsoleted by RFC 5036) -- Obsolete informational reference (is this intentional?): RFC 3667 (Obsoleted by RFC 3978) -- Obsolete informational reference (is this intentional?): RFC 3668 (Obsoleted by RFC 3979) Summary: 4 errors (**), 0 flaws (~~), 34 warnings (==), 20 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Quittek 3 Internet-Draft NEC 4 Expires: March 26, 2006 S. Bryant 5 B. Claise 6 Cisco Systems 7 J. Meyer 8 PayPal 9 September 22, 2005 11 Information Model for IP Flow Information Export 12 draft-ietf-ipfix-info-11 14 Status of this Memo 16 By submitting this Internet-Draft, each author represents that any 17 applicable patent or other IPR claims of which he or she is aware 18 have been or will be disclosed, and any of which he or she becomes 19 aware will be disclosed, in accordance with Section 6 of BCP 79. 21 Internet-Drafts are working documents of the Internet Engineering 22 Task Force (IETF), its areas, and its working groups. Note that 23 other groups may also distribute working documents as Internet- 24 Drafts. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress." 31 The list of current Internet-Drafts can be accessed at 32 http://www.ietf.org/ietf/1id-abstracts.txt. 34 The list of Internet-Draft Shadow Directories can be accessed at 35 http://www.ietf.org/shadow.html. 37 This Internet-Draft will expire on March 26, 2006. 39 Copyright Notice 41 Copyright (C) The Internet Society (2005). 43 Abstract 45 This memo defines an information model for the IP Flow Information 46 eXport (IPFIX) protocol. It is used by the IPFIX protocol for 47 encoding measured traffic information and information related to the 48 traffic Observation Point, the traffic Metering Process and the 49 Exporting Process. Although developed for the IPFIX protocol, the 50 model is defined in an open way that easily allows using it in other 51 protocols, interfaces, and applications. 53 Table of Contents 55 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 7 56 2. Properties of IPFIX Protocol Information Elements . . . . . . 7 57 2.1. Information Elements Specification Template . . . . . . . 8 58 2.2. Scope of Information Elements . . . . . . . . . . . . . . 9 59 2.3. Naming Conventions for Information Elements . . . . . . . 9 60 3. Type Space . . . . . . . . . . . . . . . . . . . . . . . . . 10 61 3.1. Data Types . . . . . . . . . . . . . . . . . . . . . . . 10 62 3.1.1. octet . . . . . . . . . . . . . . . . . . . . . . . . 10 63 3.1.2. unsigned16 . . . . . . . . . . . . . . . . . . . . . 11 64 3.1.3. unsigned32 . . . . . . . . . . . . . . . . . . . . . 11 65 3.1.4. unsigned64 . . . . . . . . . . . . . . . . . . . . . 11 66 3.1.5. float32 . . . . . . . . . . . . . . . . . . . . . . . 11 67 3.1.6. boolean . . . . . . . . . . . . . . . . . . . . . . . 11 68 3.1.7. macAddress . . . . . . . . . . . . . . . . . . . . . 11 69 3.1.8. octetArray . . . . . . . . . . . . . . . . . . . . . 11 70 3.1.9. string . . . . . . . . . . . . . . . . . . . . . . . 11 71 3.1.10. dateTimeSeconds . . . . . . . . . . . . . . . . . . . 11 72 3.1.11. dateTimeMilliSeconds . . . . . . . . . . . . . . . . 12 73 3.1.12. dateTimeMicroSeconds . . . . . . . . . . . . . . . . 12 74 3.1.13. dateTimeNanoSeconds . . . . . . . . . . . . . . . . . 12 75 3.1.14. ipv4Address . . . . . . . . . . . . . . . . . . . . . 12 76 3.1.15. ipv6Address . . . . . . . . . . . . . . . . . . . . . 12 77 3.2. Data Type Semantics . . . . . . . . . . . . . . . . . . . 12 78 3.2.1. quantity . . . . . . . . . . . . . . . . . . . . . . 12 79 3.2.2. totalCounter . . . . . . . . . . . . . . . . . . . . 12 80 3.2.3. deltaCounter . . . . . . . . . . . . . . . . . . . . 13 81 3.2.4. identifier . . . . . . . . . . . . . . . . . . . . . 13 82 3.2.5. flags . . . . . . . . . . . . . . . . . . . . . . . . 13 83 4. Information Element Identifiers . . . . . . . . . . . . . . . 13 84 5. Information Elements . . . . . . . . . . . . . . . . . . . . 17 85 5.1. Identifiers . . . . . . . . . . . . . . . . . . . . . . . 18 86 5.1.1. lineCardId . . . . . . . . . . . . . . . . . . . . . 18 87 5.1.2. portId . . . . . . . . . . . . . . . . . . . . . . . 18 88 5.1.3. ingressInterface . . . . . . . . . . . . . . . . . . 18 89 5.1.4. egressInterface . . . . . . . . . . . . . . . . . . . 19 90 5.1.5. meteringProcessId . . . . . . . . . . . . . . . . . . 19 91 5.1.6. exportingProcessId . . . . . . . . . . . . . . . . . 19 92 5.1.7. flowId . . . . . . . . . . . . . . . . . . . . . . . 19 93 5.1.8. templateId . . . . . . . . . . . . . . . . . . . . . 20 94 5.1.9. sourceId . . . . . . . . . . . . . . . . . . . . . . 20 95 5.2. Metering and Exporting Process Properties . . . . . . . . 20 96 5.2.1. exporterIPv4Address . . . . . . . . . . . . . . . . . 21 97 5.2.2. exporterIPv6Address . . . . . . . . . . . . . . . . . 21 98 5.2.3. exportedMessageTotalCount . . . . . . . . . . . . . . 21 99 5.2.4. exportedOctetTotalCount . . . . . . . . . . . . . . . 21 100 5.2.5. exportedFlowTotalCount . . . . . . . . . . . . . . . 22 101 5.2.6. observedFlowTotalCount . . . . . . . . . . . . . . . 22 102 5.2.7. ignoredPacketTotalCount . . . . . . . . . . . . . . . 22 103 5.2.8. ignoredOctetTotalCount . . . . . . . . . . . . . . . 22 104 5.2.9. notSentFlowTotalCount . . . . . . . . . . . . . . . . 23 105 5.2.10. notSentPacketTotalCount . . . . . . . . . . . . . . . 23 106 5.2.11. notSentOctetTotalCount . . . . . . . . . . . . . . . 23 107 5.2.12. flowKeyIndicator . . . . . . . . . . . . . . . . . . 24 108 5.3. IP Header Fields . . . . . . . . . . . . . . . . . . . . 24 109 5.3.1. ipVersion . . . . . . . . . . . . . . . . . . . . . . 25 110 5.3.2. sourceIPv4Address . . . . . . . . . . . . . . . . . . 25 111 5.3.3. sourceIPv6Address . . . . . . . . . . . . . . . . . . 26 112 5.3.4. sourceIPv4Mask . . . . . . . . . . . . . . . . . . . 26 113 5.3.5. sourceIPv6Mask . . . . . . . . . . . . . . . . . . . 26 114 5.3.6. sourceIPv4Prefix . . . . . . . . . . . . . . . . . . 26 115 5.3.7. sourceIPv6Prefix . . . . . . . . . . . . . . . . . . 26 116 5.3.8. destinationIPv4Address . . . . . . . . . . . . . . . 27 117 5.3.9. destinationIPv6Address . . . . . . . . . . . . . . . 27 118 5.3.10. destinationIPv4Mask . . . . . . . . . . . . . . . . . 27 119 5.3.11. destinationIPv6Mask . . . . . . . . . . . . . . . . . 27 120 5.3.12. destinationIPv4Prefix . . . . . . . . . . . . . . . . 28 121 5.3.13. destinationIPv6Prefix . . . . . . . . . . . . . . . . 28 122 5.3.14. ipTimeToLive . . . . . . . . . . . . . . . . . . . . 28 123 5.3.15. protocolIdentifier . . . . . . . . . . . . . . . . . 28 124 5.3.16. nextHeaderIPv6 . . . . . . . . . . . . . . . . . . . 29 125 5.3.17. ipClassOfService . . . . . . . . . . . . . . . . . . 29 126 5.3.18. ipDiffServCodePoint . . . . . . . . . . . . . . . . . 29 127 5.3.19. ipPrecedence . . . . . . . . . . . . . . . . . . . . 30 128 5.3.20. classOfServiceIPv4 . . . . . . . . . . . . . . . . . 30 129 5.3.21. postClassOfServiceIPv4 . . . . . . . . . . . . . . . 30 130 5.3.22. classOfServiceIPv6 . . . . . . . . . . . . . . . . . 31 131 5.3.23. postClassOfServiceIPv6 . . . . . . . . . . . . . . . 31 132 5.3.24. flowLabelIPv6 . . . . . . . . . . . . . . . . . . . . 31 133 5.3.25. isMulticast . . . . . . . . . . . . . . . . . . . . . 32 134 5.3.26. identificationIPv4 . . . . . . . . . . . . . . . . . 32 135 5.3.27. fragmentOffsetIPv4 . . . . . . . . . . . . . . . . . 33 136 5.3.28. fragmentFlagsIPv4 . . . . . . . . . . . . . . . . . . 33 137 5.3.29. ipHeaderLength . . . . . . . . . . . . . . . . . . . 33 138 5.3.30. headerLengthIPv4 . . . . . . . . . . . . . . . . . . 34 139 5.3.31. internetHeaderLengthIPv4 . . . . . . . . . . . . . . 34 140 5.3.32. totalLengthIPv4 . . . . . . . . . . . . . . . . . . . 34 141 5.3.33. payloadLengthIPv6 . . . . . . . . . . . . . . . . . . 35 142 5.3.34. ipPayloadLength . . . . . . . . . . . . . . . . . . . 35 143 5.4. Transport Header Fields . . . . . . . . . . . . . . . . . 35 144 5.4.1. sourceTransportPort . . . . . . . . . . . . . . . . . 36 145 5.4.2. destinationTransportPort . . . . . . . . . . . . . . 36 146 5.4.3. udpSourcePort . . . . . . . . . . . . . . . . . . . . 37 147 5.4.4. udpDestinationPort . . . . . . . . . . . . . . . . . 37 148 5.4.5. udpMessageLength . . . . . . . . . . . . . . . . . . 37 149 5.4.6. tcpSourcePort . . . . . . . . . . . . . . . . . . . . 37 150 5.4.7. tcpDestinationPort . . . . . . . . . . . . . . . . . 38 151 5.4.8. tcpSequenceNumber . . . . . . . . . . . . . . . . . . 38 152 5.4.9. tcpAcknowledgementNumber . . . . . . . . . . . . . . 38 153 5.4.10. tcpWindowSize . . . . . . . . . . . . . . . . . . . . 38 154 5.4.11. tcpUrgentPointer . . . . . . . . . . . . . . . . . . 38 155 5.4.12. tcpHeaderLength . . . . . . . . . . . . . . . . . . . 39 156 5.4.13. icmpTypeCodeIPv4 . . . . . . . . . . . . . . . . . . 39 157 5.4.14. icmpTypeIPv4 . . . . . . . . . . . . . . . . . . . . 39 158 5.4.15. icmpCodeIPv4 . . . . . . . . . . . . . . . . . . . . 39 159 5.4.16. icmpTypeCodeIPv6 . . . . . . . . . . . . . . . . . . 40 160 5.4.17. icmpTypeIPv6 . . . . . . . . . . . . . . . . . . . . 40 161 5.4.18. icmpCodeIPv6 . . . . . . . . . . . . . . . . . . . . 40 162 5.4.19. igmpType . . . . . . . . . . . . . . . . . . . . . . 40 163 5.5. Sub-IP Header Fields . . . . . . . . . . . . . . . . . . 40 164 5.5.1. sourceMacAddress . . . . . . . . . . . . . . . . . . 41 165 5.5.2. postSourceMacAddress . . . . . . . . . . . . . . . . 41 166 5.5.3. vlanId . . . . . . . . . . . . . . . . . . . . . . . 41 167 5.5.4. postVlanId . . . . . . . . . . . . . . . . . . . . . 42 168 5.5.5. destinationMacAddress . . . . . . . . . . . . . . . . 42 169 5.5.6. postDestinationMacAddr . . . . . . . . . . . . . . . 42 170 5.5.7. wlanChannelId . . . . . . . . . . . . . . . . . . . . 42 171 5.5.8. wlanSsid . . . . . . . . . . . . . . . . . . . . . . 43 172 5.5.9. mplsTopLabelTtl . . . . . . . . . . . . . . . . . . . 43 173 5.5.10. mplsTopLabelExp . . . . . . . . . . . . . . . . . . . 43 174 5.5.11. mplsLabelStackDepth . . . . . . . . . . . . . . . . . 44 175 5.5.12. mplsLabelStackLength . . . . . . . . . . . . . . . . 44 176 5.5.13. mplsPayloadLength . . . . . . . . . . . . . . . . . . 44 177 5.5.14. mplsTopLabelStackEntry . . . . . . . . . . . . . . . 44 178 5.5.15. mplsLabelStackEntry2 . . . . . . . . . . . . . . . . 45 179 5.5.16. mplsLabelStackEntry3 . . . . . . . . . . . . . . . . 45 180 5.5.17. mplsLabelStackEntry4 . . . . . . . . . . . . . . . . 45 181 5.5.18. mplsLabelStackEntry5 . . . . . . . . . . . . . . . . 46 182 5.5.19. mplsLabelStackEntry6 . . . . . . . . . . . . . . . . 46 183 5.5.20. mplsLabelStackEntry7 . . . . . . . . . . . . . . . . 46 184 5.5.21. mplsLabelStackEntry8 . . . . . . . . . . . . . . . . 47 185 5.5.22. mplsLabelStackEntry9 . . . . . . . . . . . . . . . . 47 186 5.5.23. mplsLabelStackEntry10 . . . . . . . . . . . . . . . . 47 187 5.6. Derived Packet Properties . . . . . . . . . . . . . . . . 47 188 5.6.1. ipNextHopIPv4Address . . . . . . . . . . . . . . . . 48 189 5.6.2. ipNextHopIPv6Address . . . . . . . . . . . . . . . . 48 190 5.6.3. bgpSourceAsNumber . . . . . . . . . . . . . . . . . . 48 191 5.6.4. bgpDestinationAsNumber . . . . . . . . . . . . . . . 49 192 5.6.5. bgpNextAdjacentAsNumber . . . . . . . . . . . . . . . 49 193 5.6.6. bgpPrevAdjacentAsNumber . . . . . . . . . . . . . . . 49 194 5.6.7. bgpNextHopIPv4Address . . . . . . . . . . . . . . . . 50 195 5.6.8. bgpNextHopIPv6Address . . . . . . . . . . . . . . . . 50 196 5.6.9. mplsTopLabelType . . . . . . . . . . . . . . . . . . 50 197 5.6.10. mplsTopLabelIPv4Address . . . . . . . . . . . . . . . 50 198 5.6.11. mplsTopLabelIPv6Address . . . . . . . . . . . . . . . 51 199 5.7. Min/Max Flow Properties . . . . . . . . . . . . . . . . . 51 200 5.7.1. minimumPacketLength . . . . . . . . . . . . . . . . . 51 201 5.7.2. maximumPacketLength . . . . . . . . . . . . . . . . . 51 202 5.7.3. minimumTtl . . . . . . . . . . . . . . . . . . . . . 52 203 5.7.4. maximumTtl . . . . . . . . . . . . . . . . . . . . . 52 204 5.7.5. ipv4Options . . . . . . . . . . . . . . . . . . . . . 52 205 5.7.6. ipv6ExtensionHeaders . . . . . . . . . . . . . . . . 54 206 5.7.7. tcpControlBits . . . . . . . . . . . . . . . . . . . 56 207 5.7.8. tcpOptions . . . . . . . . . . . . . . . . . . . . . 56 208 5.8. Flow Time Stamps . . . . . . . . . . . . . . . . . . . . 57 209 5.8.1. flowStartSeconds . . . . . . . . . . . . . . . . . . 57 210 5.8.2. flowEndSeconds . . . . . . . . . . . . . . . . . . . 58 211 5.8.3. flowStartMilliSeconds . . . . . . . . . . . . . . . . 58 212 5.8.4. flowEndMilliSeconds . . . . . . . . . . . . . . . . . 58 213 5.8.5. flowStartMicroSeconds . . . . . . . . . . . . . . . . 58 214 5.8.6. flowEndMicroSeconds . . . . . . . . . . . . . . . . . 58 215 5.8.7. flowStartNanoSeconds . . . . . . . . . . . . . . . . 58 216 5.8.8. flowEndNanoSeconds . . . . . . . . . . . . . . . . . 59 217 5.8.9. flowStartDeltaMicroSeconds . . . . . . . . . . . . . 59 218 5.8.10. flowEndDeltaMicroSeconds . . . . . . . . . . . . . . 59 219 5.8.11. systemInitTimeMilliSeconds . . . . . . . . . . . . . 59 220 5.8.12. flowStartSysUpTime . . . . . . . . . . . . . . . . . 60 221 5.8.13. flowEndSysUpTime . . . . . . . . . . . . . . . . . . 60 222 5.9. Per-Flow Counters . . . . . . . . . . . . . . . . . . . . 60 223 5.9.1. octetDeltaCount . . . . . . . . . . . . . . . . . . . 61 224 5.9.2. postOctetDeltaCount . . . . . . . . . . . . . . . . . 61 225 5.9.3. octetDeltaSumOfSquares . . . . . . . . . . . . . . . 61 226 5.9.4. octetTotalCount . . . . . . . . . . . . . . . . . . . 62 227 5.9.5. postOctetTotalCount . . . . . . . . . . . . . . . . . 62 228 5.9.6. octetTotalSumOfSquares . . . . . . . . . . . . . . . 62 229 5.9.7. packetDeltaCount . . . . . . . . . . . . . . . . . . 62 230 5.9.8. postPacketDeltaCount . . . . . . . . . . . . . . . . 63 231 5.9.9. packetTotalCount . . . . . . . . . . . . . . . . . . 63 232 5.9.10. postPacketTotalCount . . . . . . . . . . . . . . . . 63 233 5.9.11. droppedOctetDeltaCount . . . . . . . . . . . . . . . 64 234 5.9.12. droppedPacketDeltaCount . . . . . . . . . . . . . . . 64 235 5.9.13. droppedOctetTotalCount . . . . . . . . . . . . . . . 64 236 5.9.14. droppedPacketTotalCount . . . . . . . . . . . . . . . 64 237 5.9.15. postMCastPacketDeltaCount . . . . . . . . . . . . . . 65 238 5.9.16. postMCastOctetDeltaCount . . . . . . . . . . . . . . 65 239 5.9.17. postMCastPacketTotalCount . . . . . . . . . . . . . . 65 240 5.9.18. postMCastOctetTotalCount . . . . . . . . . . . . . . 66 241 5.10. Miscellaneous Flow Properties . . . . . . . . . . . . . . 66 242 5.10.1. flowActiveTimeOut . . . . . . . . . . . . . . . . . . 66 243 5.10.2. flowInactiveTimeout . . . . . . . . . . . . . . . . . 66 244 5.10.3. flowEndReason . . . . . . . . . . . . . . . . . . . . 67 245 5.10.4. flowDurationMilliSeconds . . . . . . . . . . . . . . 67 246 5.10.5. flowDurationMicroSeconds . . . . . . . . . . . . . . 68 247 5.11. Padding . . . . . . . . . . . . . . . . . . . . . . . . . 68 248 5.11.1. paddingOctets . . . . . . . . . . . . . . . . . . . . 68 249 6. Extending the Information Model . . . . . . . . . . . . . . . 68 250 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 69 251 8. Security Considerations . . . . . . . . . . . . . . . . . . . 70 252 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 70 253 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 70 254 10.1. Normative References . . . . . . . . . . . . . . . . . . 70 255 10.2. Informative References . . . . . . . . . . . . . . . . . 70 256 Appendix A. Formal Specification of IPFIX Information Element . 73 257 Appendix B. Formal Specification of Abstract Data Types . . . . 127 258 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 139 259 Intellectual Property and Copyright Statements . . . . . . . . . 140 261 1. Introduction 263 The IP Flow Information eXport (IPFIX) protocol serves for 264 transmitting information related to measured IP traffic over the 265 Internet. The protocol specification in [I-D.ietf-ipfix-protocol] 266 defines how Information Elements are transmitted. For Information 267 Elements, it specifies the encoding of a set of basic data types. 268 However, the list of Information Elements that can be transmitted by 269 the protocol, such as Flow attributes (source IP address, number of 270 packets, etc.) and information about the Metering and Exporting 271 Process (packet Observation Point, sampling rate, Flow timeout 272 interval, etc.), is not specified in [I-D.ietf-ipfix-protocol]. 274 This document complements the IPFIX protocol specification by 275 providing the IPFIX information model. IPFIX-specific terminology 276 used in this document is defined in section 3 of [I-D.ietf-ipfix- 277 protocol]. As in [I-D.ietf-ipfix-protocol], these IPFIX-specific 278 terms have the first letter of a word capitalized when used in this 279 document. 281 The main part of this document is section 5 defining the (extensible) 282 list of Information Elements to be transmitted by the IPFIX protocol. 283 Section 2 defines a template for specifying IPFIX Information 284 Elements in section 4. Section 3 defines the set of abstract data 285 types that are available for IPFIX Information Elements. Section 5 286 discusses extensibility of the IPFIX information model. 288 The main bodies of sections 2, 3 and 4 were generated from XML 289 documents. The XML-based specification of template, abstract data 290 types and IPFIX Information Elements can be used for automatically 291 checking syntactical correctness of the specification of IPFIX 292 Information Elements. It can further be used for generating IPFIX 293 protocol implementation code that deals with processing IPFIX 294 Information Elements. Also code for applications that further 295 process traffic information transmitted via the IPFIX protocol can be 296 generated with the XML specification of IPFIX Information Elements. 298 For that reason, the XML document that served as source for section 4 299 and the XML schema that served as source for sections 2 and 3 are 300 attached to this document in Appendices A and B. 302 Note that although partially generated from the attached XML 303 documents, the main body of this document is normative while the 304 appendices are informational. 306 2. Properties of IPFIX Protocol Information Elements 307 2.1. Information Elements Specification Template 309 Information in messages of the IPFIX protocol is modeled in terms of 310 Information Elements of the IPFIX information model. IPFIX 311 Information Elements are specified in section 4. For specifying 312 these Information Elements, a template is used that is described 313 below. 315 All Information Elements specified for the IPFIX protocol either in 316 this document or by any future extension MUST have the following 317 properties defined: 319 name - A unique and meaningful name for the Information Element. 321 description - The semantics of this Information Element. Describes 322 how this Information Element is derived from the Flow or other 323 information available to the observer. 325 dataType - One of the types listed in section 3.1 of this document or 326 in a future extension of the information model. The type space 327 for attributes is constrained to facilitate implementation. The 328 existing type space does however encompass most basic types used 329 in modern programming languages, as well as some derived types 330 (such as ipv4Address) which are common to this domain and useful 331 to distinguish. 333 status - The status of the specification of this Information Element. 334 Allowed values are 'current', 'deprecated', and 'obsolete'. 336 Enterprise-specific Information Elements MUST have the following 337 property defined: 339 enterpriseId - Enterprises may wish to define Information Elements 340 without registering them with IANA, for example for enterprise- 341 internal purposes. For such Information Elements the Information 342 Element identifier described above is not sufficient when the 343 Information Element is used outside the enterprise. If 344 specifications of enterprise-specific Information Elements are 345 made public and/or if enterprise-specific identifiers are used by 346 the IPFIX protocol outside the enterprise, then the enterprise- 347 specific identifier MUST be made globally unique by combining it 348 with an enterprise identifier. Valid values for the enterpriseId 349 are defined by IANA as SMI network management private enterprise 350 codes. They are defined at 351 http://www.iana.org/assignments/enterprise-numbers. 353 All Information Elements specified for the IPFIX protocol either in 354 this document or by any future extension MAY have the following 355 properties defined: 357 dataTypeSemantics - The integral types may be qualified by additional 358 semantic details. Valid values for the data type semantics are 359 specified in section 3.2 of this document or in a future extension 360 of the information model. 362 units - If the Information Element is a measure of some kind, the 363 units identify what the measure is. 365 range - Some Information Elements may only be able to take on a 366 restricted set of values which can be expressed as a range (e.g. 0 367 through 511 inclusive). If this is the case, the valid inclusive 368 range should be specified. 370 reference - Identifies additional specifications which more precisely 371 define this item or provide additional context for its use. 373 2.2. Scope of Information Elements 375 By default, most Information Elements have a scope specified in their 376 definitions. 378 o The Information Elements defined in section 5.2 have a default of 379 "a specific Metering Process" or of "a specific Exporting 380 Process", respectively. 381 o The Information Elements defined in sections 5.3 - 5.9 have a 382 scope of "a specific Flow". 384 Within Data Records defined by Option Templates, the IPFIX protocol 385 allows further limiting of the Information Element scope. The new 386 scope is specified by one or more scope fields and defined as the 387 combination of all specified scope values. 389 2.3. Naming Conventions for Information Elements 391 The following naming conventions were used for naming Information 392 Elements in this document. It is recommended that extensions of the 393 model use the same conventions. 395 o Names of Information Elements start with non-capitalized letters. 397 o Composed names use capital letters for the first letter of each 398 component (except for the first one). All other letters are non- 399 capitalized, even for acronyms. Exceptions are made for acronyms 400 containing non-capitalized letter, such as 'IPv4' and 'IPv6'. 401 Examples are sourceMacAddress and destinationIPv4Address. 402 o Middleboxes [RFC3234] may change Flow properties, such as the DSCP 403 value or the source IP address. If an IPFIX Observation Point is 404 located in the path of a Flow before one or more middleboxes that 405 potentially modify packets of the Flow, then it may be desirable 406 to report also flow properties after the modification performed by 407 the middleboxes. An example is an observation point before a 408 packet marker changing a packet's IPv4 TOS field that is encoded 409 in Information Element classOfServiceIPv4. Then the value 410 observed and reported by Information Element classOfServiceIPv4 is 411 valid at the observation point, but not anymore after the packet 412 passed the packet marker. For reporting the change value of the 413 TOS field, the IPFIX information model uses Information Elements 414 that have a name prefix "post", for example, 415 "postClassOfServiceIPv4". Information Elements with prefix "post" 416 report on Flow properties that are not necessarily observed at the 417 observation point, but which are obtained withing the Flow's 418 Observation Domain by other means that are considered to be 419 sufficiently reliable, for example, by analyzing the packet 420 marker's marking tables. 422 3. Type Space 424 This section describes the abstract data types that can be used for 425 the specification of IPFIX Information Elements in section 4. 426 Section 3.1 describes the set of data types. 428 Data types octet, unsigned16, unsigned32, and unsigned64 are integral 429 data types. As described in section 3.2, their data type semantics 430 can be further specified, for example, by 'totalCounter', 431 'deltaCounter', 'identifier' or 'flags'. 433 3.1. Data Types 435 This section describes the set of valid data types of the IPFIX 436 information model. Note that further data types may be specified by 437 future protocol extensions. 439 3.1.1. octet 441 The type "octet" represents a non-negative integer value in the range 442 of 0 to 255. 444 3.1.2. unsigned16 446 The type "unsigned16" represents a non-negative integer value in the 447 range of 0 to 65535. 449 3.1.3. unsigned32 451 The type "unsigned32" represents a non-negative integer value in the 452 range of 0 to 4294967295. 454 3.1.4. unsigned64 456 The type "unsigned64" represents a non-negative integer value in the 457 range of 0 to 18446744073709551615. 459 3.1.5. float32 461 The type "float32" corresponds to an IEEE single-precision 32-bit 462 floating point type as defined in [IEEE.754.1985]. 464 3.1.6. boolean 466 The type "boolean" represents a binary value. The only allowed 467 values are "true" and false. 469 3.1.7. macAddress 471 The type "macAddress" represents a string of 6 octets. 473 3.1.8. octetArray 475 The type "octetArray" represents a finite length string of octets. 477 3.1.9. string 479 The type "string" represents a finite length string of valid 480 characters from the Unicode character encoding set [ISO.10646- 481 1.1993]. Unicode allows for ASCII [ISO.646.1991] and many other 482 international character sets to be used. It is expected that strings 483 will be encoded in UTF-8 format, which is identical in encoding for 484 ASCII characters, but also accommodates other Unicode multi-byte 485 characters. 487 3.1.10. dateTimeSeconds 489 The type "dateTimeSeconds" represents a time value in units of 490 seconds normalized to the GMT time zone. 492 3.1.11. dateTimeMilliSeconds 494 The type "dateTimeMilliSeconds" represents a time value in units of 495 milliseconds normalized to the GMT time zone. 497 3.1.12. dateTimeMicroSeconds 499 The type "dateTimeMicroSeconds" represents a time value in units of 500 microseconds normalized to the GMT time zone. 502 3.1.13. dateTimeNanoSeconds 504 The type "dateTimeNanoSeconds" represents a time value in units of 505 nanoseconds normalized to the GMT time zone. 507 3.1.14. ipv4Address 509 The type "ipv4Address" represents a value of an IPv4 address. 511 3.1.15. ipv6Address 513 The type "ipv6Address" represents a value of an IPv6 address. 515 3.2. Data Type Semantics 517 This section describes the set of valid data type semantics of the 518 IPFIX information model. Note that further data type semantics may 519 be specified by future protocol extensions. 521 3.2.1. quantity 523 A quantity value represents a discrete measured value pertaining to 524 the record. This is distinguished from counters which represent an 525 ongoing measured value whose "odometer" reading is captured as part 526 of a given record. If no semantic qualifier is given, the 527 Information Elements that have an integral data type should behave as 528 a quantity. 530 3.2.2. totalCounter 532 An integral value reporting the value of a counter. Basically the 533 same semantics as counters in SNMP. Counters are unsigned and wrap 534 back to zero after reaching the limit of the type. For example, an 535 unsigned64 with counter semantics will continue to increment until 536 reaching the value of 2**64 - 1. At this point the next increment 537 will wrap its value to zero and continue counting from zero. A 538 running counter counts independently of the export of its value. 540 3.2.3. deltaCounter 542 An integral value reporting the value of a counter. Basically the 543 same semantics as counters in SNMP. Counters are unsigned and wrap 544 back to zero after reaching the limit of the type. For example, an 545 unsigned64 with counter semantics will continue to increment until 546 reaching the value of 2**64 - 1. At this point the next increment 547 will wrap its value to zero and continue counting from zero. A delta 548 counter is reset to zero each time its value is exported. 550 3.2.4. identifier 552 An integral value which serves as an identifier. Specifically 553 mathematical operations on two identifiers (aside from the equality 554 operation) are meaningless. For example, Autonomous System ID 1 * 555 Autonomous System ID 2 is meaningless. 557 3.2.5. flags 559 An integral value which actually represents a set of bit fields. 560 Logical operations are appropriate on such values, but not other 561 mathematical operations. Flags should always be of an unsigned type. 563 4. Information Element Identifiers 565 All Information Elements defined in section 5 of this document or in 566 future extensions of the IPFIX information model have their 567 identifiers assigned by IANA. Their identifiers can be retrieved at 568 http://www.iana.org/assignments/ipfix-element-numbers. 570 EDITORIAL NOTE: this URL needs probably to be updated after IANA 571 created a URL for IPFIX Information Elements 573 The value of these identifiers are in the range of 1 - 32767. Within 574 this range, Information Element identifier values in the sub-range of 575 1-127 are compatible with field types used by NetFlow version 9 576 [RFC3954]. 578 +---------------------------------+---------------------------------+ 579 | Range of IANA-assigned | Description | 580 | Information Element identifiers | | 581 +---------------------------------+---------------------------------+ 582 | 0 | Reserved. | 583 | 1 - 127 | Information Element identifiers | 584 | | compatible with NetFlow version | 585 | | 9 field types [RFC3954]. | 586 | 128 - 32767 | Further Information Element | 587 | | identifiers. | 588 +---------------------------------+---------------------------------+ 590 Enterprise-specific Information Element identifiers have the same 591 range of 1-32767, but they are coupled with an additional enterprise 592 identifier. 594 Enterprise-specific Information Element identifiers can be chosen by 595 an enterprise arbitrarily within the range of 1-32767. The same 596 identifier may be assigned by other enterprises for different 597 purposes. 599 Still, Collecting Processes can distinguish these Information 600 Elements because the Information Element identifier is coupled with 601 an enterprise identifier. 603 Enterprise identifiers MUST be registered as SMI network management 604 private enterprise code numbers with IANA. The registry can be found 605 at http://www.iana.org/assignments/enterprise-numbers. 607 The following list gives an overview of the Information Element 608 identifiers that are specified in section 5 and are compatible with 609 field types used by NetFlow version 9 [RFC3954]. 611 +-------+-------------------------+-------+-------------------------+ 612 | ID | Name | ID | Name | 613 +-------+-------------------------+-------+-------------------------+ 614 | 1 | octetDeltaCount | 43 | RESERVED | 615 | 2 | packetDeltaCount | 44 | sourceIPv4Prefix | 616 | 3 | RESERVED | 45 | destinationIPv4Prefix | 617 | 4 | protocolIdentifier | 46 | mplsTopLabelType | 618 | 5 | classOfServiceIPv4 | 47 | mplsTopLabelIPv4Address | 619 | 6 | tcpControlBits | 48-51 | RESERVED | 620 | 7 | sourceTransportPort | 52 | minimumTtl | 621 | 8 | sourceIPv4Address | 53 | maximumTtl | 622 | 9 | sourceIPv4Mask | 54 | identificationIPv4 | 623 | 10 | ingressInterface | 55 | postClassOfServiceIPv4 | 624 | 11 | destinationTransportPort| 56 | sourceMacAddress | 625 | 12 | destinationIPv4Address | 57 | postDestinationMacAddr | 626 | 13 | destinationIPv4Mask | 58 | vlanId | 627 | 14 | egressInterface | 59 | postVlanId | 628 | 15 | ipNextHopIPv4Address | 60 | ipVersion | 629 | 16 | bgpSourceAsNumber | 61 | RESERVED | 630 | 17 | bgpDestinationAsNumber | 62 | ipNextHopIPv6Address | 631 | 18 | bgpNexthopIPv4Address | 63 | bgpNexthopIPv6Address | 632 | 19 | postMCastPacketDeltaCount| 64 | ipv6ExtensionHeaders | 633 | 20 | postMCastOctetDeltaCount| 65-69 | RESERVED | 634 | 21 | flowEndSysUpTime | 70 | mplsTopLabelStackEntry | 635 | 22 | flowStartSysUpTime | 71 | mplsLabelStackEntry2 | 636 | 23 | postOctetDeltaCount | 72 | mplsLabelStackEntry3 | 637 | 24 | postPacketDeltaCount | 73 | mplsLabelStackEntry4 | 638 | 25 | minimumPacketLength | 74 | mplsLabelStackEntry5 | 639 | 26 | maximumPacketLength | 75 | mplsLabelStackEntry6 | 640 | 27 | sourceIPv6Address | 76 | mplsLabelStackEntry7 | 641 | 28 | destinationIPv6Address | 77 | mplsLabelStackEntry8 | 642 | 29 | sourceIPv6Mask | 78 | mplsLabelStackEntry9 | 643 | 30 | destinationIPv6Mask | 79 | mplsLabelStackEntry10 | 644 | 31 | flowLabelIPv6 | 80 | destinationMacAddress | 645 | 32 | icmpTypeCodeIPv4 | 81 | postSourceMacAddress | 646 | 33 | igmpType | 82-84 | RESERVED | 647 | 34-35 | RESERVED | 85 | octetTotalCount | 648 | 36 | flowActiveTimeOut | 86 | packetTotalCount | 649 | 37 | flowInactiveTimeout | 87 | RESERVED | 650 | 38-39 | RESERVED | 88 | fragmentOffsetIPv4 | 651 | 40 | exportedOctetTotalCount |89-127 | RESERVED | 652 | 41 | exportedMessageTotalCount| | | 653 | 42 | exportedFlowTotalCount | | | 654 +-------+-------------------------+-------+-------------------------+ 656 The following list gives an overview of the Information Element 657 identifiers that are specified in section 5 and extend the list of 658 Information Element identifiers specified already in [RFC3954]. 660 +-----+---------------------------+-----+---------------------------+ 661 | ID | Name | ID | Name | 662 +-----+---------------------------+-----+---------------------------+ 663 | 128 | bgpNextAdjacentAsNumber | 172 | postPacketTotalCount | 664 | 129 | bgpPrevAdjacentAsNumber | 173 | flowKeyIndicator | 665 | 130 | exporterIPv4Address | 174 | postMCastPacketTotalCount | 666 | 131 | exporterIPv6Address | 175 | postMCastOctetTotalCount | 667 | 132 | droppedOctetDeltaCount | 176 | icmpTypeIPv4 | 668 | 133 | droppedPacketDeltaCount | 177 | icmpCodeIPv4 | 669 | 134 | droppedOctetTotalCount | 178 | icmpTypeIPv6 | 670 | 135 | droppedPacketTotalCount | 179 | icmpCodeIPv6 | 671 | 136 | flowEndReason | 180 | udpSourcePort | 672 | 137 | classOfServiceIPv6 | 181 | udpDestinationPort | 673 | 138 | postClassOfServiceIPv6 | 182 | tcpSourcePort | 674 | 139 | icmpTypeCodeIPv6 | 183 | tcpDestinationPort | 675 | 140 | mplsTopLabelIPv6Address | 184 | tcpSequenceNumber | 676 | 141 | lineCardId | 185 | tcpAcknowledgementNumber | 677 | 142 | portId | 186 | tcpWindowSize | 678 | 143 | meteringProcessId | 187 | tcpUrgentPointer | 679 | 144 | exportingProcessId | 188 | tcpHeaderLength | 680 | 145 | templateId | 189 | ipHeaderLength | 681 | 146 | wlanChannelId | 190 | totalLengthIPv4 | 682 | 147 | wlanSsid | 191 | payloadLengthIPv6 | 683 | 148 | flowId | 192 | ipTimeToLive | 684 | 149 | sourceId | 193 | nextHeaderIPv6 | 685 | 150 | flowStartSeconds | 194 | ipClassOfService | 686 | 151 | flowEndSeconds | 195 | ipDiffServCodePoint | 687 | 152 | flowStartMilliSeconds | 196 | ipPrecedence | 688 | 153 | flowEndMilliSeconds | 197 | fragmentFlagsIPv4 | 689 | 154 | flowStartMicroSeconds | 198 | octetDeltaSumOfSquares | 690 | 155 | flowEndMicroSeconds | 199 | octetTotalSumOfSquares | 691 | 156 | flowStartNanoSeconds | 200 | mplsTopLabelTtl | 692 | 157 | flowEndNanoSeconds | 201 | mplsLabelStackLength | 693 | 158 | flowStartDeltaMicroSeconds| 202 | mplsLabelStackDepth | 694 | 159 | flowEndDeltaMicroSeconds | 203 | mplsTopLabelExp | 695 | 160 | systemInitTimeMilliSeconds| 204 | ipPayloadLength | 696 | 161 | flowDurationMilliSeconds | 205 | udpMessageLength | 697 | 162 | flowDurationMicroSeconds | 206 | isMulticast | 698 | 163 | observedFlowTotalCount | 207 | internetHeaderLengthIPv4 | 699 | 164 | ignoredPacketTotalCount | 208 | ipv4Options | 700 | 165 | ignoredOctetTotalCount | 209 | tcpOptions | 701 | 166 | notSentFlowTotalCount | 210 | paddingOctets | 702 | 167 | notSentPacketTotalCount | 211 | | 703 | 168 | notSentOctetTotalCount | 212 | | 704 | 169 | destinationIPv6Prefix | 213 | headerLengthIPv4 | 705 | 170 | sourceIPv6Prefix | 214 | mplsPayloadLength | 706 | 171 | postOctetTotalCount | | | 707 +-----+---------------------------+-----+---------------------------+ 708 Information Element identifiers 211-212 are already in use by some 709 implementations, but their descriptions were not agreed when this 710 document was edited. 712 5. Information Elements 714 This section describes the Flow attributes of the IPFIX information 715 model. The elements are grouped into 9 groups according to their 716 semantics and their applicability: 718 1. Identifiers 719 2. Metering and Exporting Process Properties 720 3. IP Header Fields 721 4. Transport Header Fields 722 5. Sub-IP Header Fields 723 6. Derived Packet Properties 724 7. Min/Max Flow Properties 725 8. Flow Time Stamps 726 9. Per-Flow Counters 727 10. Miscellaneous Flow Properties 729 The Information Elements that are derived from fields of packets or 730 from packet treatment, such as the Information Elements in groups 731 3.-6., can serve as Flow Keys used for mapping packets to Flows. 733 If they do not serve as Flow Keys, their value may change from packet 734 to packet within a single Flow. For Information Elements with values 735 that are derived from fields of packets or from packet treatment and 736 for which the value may change from packet to packet within a single 737 Flow, the IPFIX information model defines that their value is 738 determined by the first packet observed for the corresponding Flow, 739 unless the description of the Information Element explicitly 740 specifies a different semantics. This simple rule allows writing all 741 Information Elements related to header fields once when the first 742 packet of the Flow is observed. For further observed packets of the 743 same Flow, only Flow properties that depend on more than one packet, 744 such as the Information Elements in groups 7.-9., need to be updated. 746 Information Elements with a name having the "post" prefix, for 747 example, "postClassOfServiceIPv4", do not report properties that were 748 actually observed at the Observation Point, but retrieved by other 749 means within the Observation Domain. These information Elements can 750 be used if there are middlebox functions within the Observation 751 Domain changing Flow properties after packets passed the Observation 752 Point. 754 5.1. Identifiers 756 Information Elements grouped in the table below are identifying 757 components of the IPFIX architecture, of an IPFIX Device, or of the 758 IPFIX protocol. All of them have an integral data type and data type 759 semantics "identifier" as described in section 3.2.4. 761 Typically, some of them are used for limiting scopes of other 762 Information Elements. However, also other Information Elements MAY 763 be used for limiting scopes. Note also that all Information Elements 764 listed below MAY be used for other purposes than limiting scopes. 766 +-----+---------------------------+-----+---------------------------+ 767 | ID | Name | ID | Name | 768 +-----+---------------------------+-----+---------------------------+ 769 | 141 | lineCardId | 143 | meteringProcessId | 770 | 142 | portId | 144 | exportingProcessId | 771 | 10 | ingressInterface | 148 | flowId | 772 | 14 | egressInterface | 145 | templateId | 773 | | | 149 | sourceId | 774 +-----+---------------------------+-----+---------------------------+ 776 5.1.1. lineCardId 778 Description: 779 A locally unique identifier of a line card at an IPFIX Device 780 hosting an Observation Point. Typically, this Information Element 781 is used for limiting the scope of other Information Elements. 782 Abstract Data Type: unsigned32 783 Data Type Semantics: identifier 784 ElementId: 141 785 Status: current 787 5.1.2. portId 789 Description: 790 A locally unique identifier of a line port at an IPFIX Device 791 hosting an Observation Point. Typically, this Information Element 792 is used for limiting the scope of other Information Elements. 793 Abstract Data Type: unsigned32 794 Data Type Semantics: identifier 795 ElementId: 142 796 Status: current 798 5.1.3. ingressInterface 799 Description: 800 The index of the IP interface (ifIndex) where packets of this Flow 801 are being received. 802 Abstract Data Type: unsigned32 803 Data Type Semantics: identifier 804 ElementId: 10 805 Status: current 806 Reference: See RFC 2863 for the definition of the ifIndex object. 808 5.1.4. egressInterface 810 Description: 811 The index of the IP interface (ifIndex) where packets of this Flow 812 are being sent. 813 Abstract Data Type: unsigned32 814 Data Type Semantics: identifier 815 ElementId: 14 816 Status: current 817 Reference: See RFC 2863 for the definition of the ifIndex object. 819 5.1.5. meteringProcessId 821 Description: 822 A locally unique identifier of a Metering Process at an IPFIX 823 Device. Typically, this Information Element is used for limiting 824 the scope of other Information Elements. 825 Abstract Data Type: unsigned32 826 Data Type Semantics: identifier 827 ElementId: 143 828 Status: current 830 5.1.6. exportingProcessId 832 Description: 833 A locally unique identifier of an Exporting Process at an IPFIX 834 Device. Typically, this Information Element is used for limiting 835 the scope of other Information Elements. 836 Abstract Data Type: unsigned32 837 Data Type Semantics: identifier 838 ElementId: 144 839 Status: current 841 5.1.7. flowId 842 Description: 843 An identifier of a Flow that is unique within an Observation 844 Domain. This Information Element can be used to distinguish 845 between different Flows if Flow Keys such as IP addresses and port 846 numbers are not reported or reported in separate records. 847 Abstract Data Type: unsigned32 848 Data Type Semantics: identifier 849 ElementId: 148 850 Status: current 852 5.1.8. templateId 854 Description: 855 An identifier of a Template that is locally unique to an Exporting 856 Process. Typically, this Information Element is used for limiting 857 the scope of other Information Elements. 858 Abstract Data Type: unsigned16 859 Data Type Semantics: identifier 860 ElementId: 145 861 Status: current 863 5.1.9. sourceId 865 Description: 866 An identifier of an Observation Domain that is locally unique to 867 an Exporting Process. Typically, this Information Element is used 868 for limiting the scope of other Information Elements. 869 Abstract Data Type: unsigned32 870 Data Type Semantics: identifier 871 ElementId: 149 872 Status: current 874 5.2. Metering and Exporting Process Properties 876 Information Elements in this section describe static and dynamic 877 properties of the Metering Process and/or the Exporting Process. The 878 set of these Information Elements is listed in the table below 880 +-----+---------------------------+-----+---------------------------+ 881 | ID | Name | ID | Name | 882 +-----+---------------------------+-----+---------------------------+ 883 | 130 | exporterIPv4Address | 164 | ignoredPacketTotalCount | 884 | 131 | exporterIPv6Address | 165 | ignoredOctetTotalCount | 885 | 41 | exportedMessageTotalCount | 166 | notSentFlowTotalCount | 886 | 40 | exportedOctetTotalCount | 167 | notSentPacketTotalCount | 887 | 42 | exportedFlowTotalCount | 168 | notSentOctetTotalCount | 888 | 163 | observedFlowTotalCount | 173 | flowKeyIndicator | 889 +-----+---------------------------+-----+---------------------------+ 891 5.2.1. exporterIPv4Address 893 Description: 894 The IPv4 address used by the Exporting Process. This is used by 895 the Collector to identify the Exporter in cases where the identity 896 of the Exporter may have been obscured by the use of a proxy. 897 Abstract Data Type: ipv4Address 898 Data Type Semantics: identifier 899 ElementId: 130 900 Status: current 902 5.2.2. exporterIPv6Address 904 Description: 905 The IPv6 address used by the Exporting Process. This is used by 906 the Collector to identify the Exporter in cases where the identity 907 of the Exporter may have been obscured by the use of a proxy. 908 Abstract Data Type: ipv6Address 909 Data Type Semantics: identifier 910 ElementId: 131 911 Status: current 913 5.2.3. exportedMessageTotalCount 915 Description: 916 The total number of IPFIX Messages that the Exporting Process 917 successfully sent since the Exporting Process (re-)initialization 918 to the Collecting Process receiving a report that contains this 919 Information Element. 920 Abstract Data Type: unsigned64 921 Data Type Semantics: totalCounter 922 ElementId: 41 923 Status: current 924 Units: messages 926 5.2.4. exportedOctetTotalCount 928 Description: 929 The total number of octets that the Exporting Process successfully 930 sent since the Exporting Process (re-)initialization to the 931 Collecting Process receiving a report that contains this 932 Information Element. The value of this Information Element is 933 calculated by summing up the IPFIX Message header length values of 934 all IPFIX Messages that were successfully sent to the Collecting 935 Process receiving a report that contains this Information Element. 937 Abstract Data Type: unsigned64 938 Data Type Semantics: totalCounter 939 ElementId: 40 940 Status: current 941 Units: octets 943 5.2.5. exportedFlowTotalCount 945 Description: 946 The total number of Flows Records that the Exporting Process 947 successfully sent as Data Records since the Exporting Process 948 (re-)initialization to the Collecting Process receiving a report 949 that contains this Information Element. 950 Abstract Data Type: unsigned64 951 Data Type Semantics: totalCounter 952 ElementId: 42 953 Status: current 954 Units: Flows 956 5.2.6. observedFlowTotalCount 958 Description: 959 The total number of Flows observed in the Observation Domain since 960 the Metering Process (re-)initialization for this Observation 961 Point. 962 Abstract Data Type: unsigned64 963 Data Type Semantics: totalCounter 964 ElementId: 163 965 Status: current 966 Units: Flows 968 5.2.7. ignoredPacketTotalCount 970 Description: 971 The total number of observed IP packets that the Metering Process 972 did not process since the (re-)initialization of the Metering 973 Process. 974 Abstract Data Type: unsigned64 975 Data Type Semantics: totalCounter 976 ElementId: 164 977 Status: current 978 Units: packets 980 5.2.8. ignoredOctetTotalCount 981 Description: 982 The total number of octets in observed IP packets that the 983 Metering Process did not process since the (re-)initialization of 984 the Metering Process. 985 Abstract Data Type: unsigned64 986 Data Type Semantics: totalCounter 987 ElementId: 165 988 Status: current 989 Units: octets 991 5.2.9. notSentFlowTotalCount 993 Description: 994 The total number of Flow Records that were generated by the 995 Metering Process and but dropped by the Metering Process or by the 996 Exporting Process instead of sending it to the Collecting Process. 997 There are several potential reasons for this including resource 998 shortage and special Flow export policies. 999 Abstract Data Type: unsigned64 1000 Data Type Semantics: totalCounter 1001 ElementId: 166 1002 Status: current 1003 Units: Flows 1005 5.2.10. notSentPacketTotalCount 1007 Description: 1008 The total number of packets in Flow Records that were generated by 1009 the Metering Process and but dropped by the Metering Process or by 1010 the Exporting Process instead of sending it to the Collecting 1011 Process. There are several potential reasons for this including 1012 resource shortage and special Flow export policies. 1013 Abstract Data Type: unsigned64 1014 Data Type Semantics: totalCounter 1015 ElementId: 167 1016 Status: current 1017 Units: packets 1019 5.2.11. notSentOctetTotalCount 1021 Description: 1022 The total number of octets in packets in Flow Records that were 1023 generated by the Metering Process and but dropped by the Metering 1024 Process or by the Exporting Process instead of sending it to the 1025 Collecting Process. There are several potential reasons for this 1026 including resource shortage and special Flow export policies. 1028 Abstract Data Type: unsigned64 1029 Data Type Semantics: totalCounter 1030 ElementId: 168 1031 Status: current 1032 Units: octets 1034 5.2.12. flowKeyIndicator 1036 Description: 1037 This set of bit fields is used for marking the Information 1038 Elements of a Data Record that serve as Flow Key. Each bit 1039 represents an Information Element in the Data Record with the n-th 1040 bit representing the n-th Information Element. A set bit with 1041 value 1 indicates that the corresponding Information element is a 1042 Flow Key of the reported Flow. A value of 0 indicates that this 1043 is not the case. If the Data Record contains more than 64 1044 Information Elements, the corresponding Template SHOULD be 1045 designed such that all Flow Keys are among the first 64 1046 Information Elements, because the flowKeyIndicator only contains 1047 64 bits. If the Data Record contains less than 64 Information 1048 Elements, then the bits in the flowKeyIndicator for which no 1049 corresponding Information Element exists SHOULD have the value 0. 1050 Abstract Data Type: unsigned64 1051 Data Type Semantics: flags 1052 ElementId: 173 1053 Status: current 1055 5.3. IP Header Fields 1057 Information Elements in this section indicate values of IP header 1058 fields or are derived from IP header field values in combination with 1059 further information. 1061 +-----+---------------------------+-----+---------------------------+ 1062 | ID | Name | ID | Name | 1063 +-----+---------------------------+-----+---------------------------+ 1064 | 60 | ipVersion | 195 | ipDiffServCodePoint | 1065 | 8 | sourceIPv4Address | 196 | ipPrecedence | 1066 | 27 | sourceIPv6Address | 5 | classOfServiceIPv4 | 1067 | 9 | sourceIPv4Mask | 55 | postClassOfServiceIPv4 | 1068 | 29 | sourceIPv6Mask | 137 | classOfServiceIPv6 | 1069 | 44 | sourceIPv4Prefix | 138 | postClassOfServiceIPv6 | 1070 | 170 | sourceIPv6Prefix | 31 | flowLabelIPv6 | 1071 | 12 | destinationIPv4Address | 206 | isMulticast | 1072 | 28 | destinationIPv6Address | 54 | identificationIPv4 | 1073 | 13 | destinationIPv4Mask | 88 | fragmentOffsetIPv4 | 1074 | 30 | destinationIPv6Mask | 197 | fragmentFlagsIPv4 | 1075 | 45 | destinationIPv4Prefix | 189 | ipHeaderLength | 1076 | 169 | destinationIPv6Prefix | 213 | headerLengthIPv4 | 1077 | 192 | ipTimeToLive | 207 | internetHeaderLengthIPv4 | 1078 | 4 | protocolIdentifier | 190 | totalLengthIPv4 | 1079 | 193 | nextHeaderIPv6 | 191 | payloadLengthIPv6 | 1080 | 194 | ipClassOfService | 204 | ipPayloadLength | 1081 +-----+---------------------------+-----+---------------------------+ 1083 5.3.1. ipVersion 1085 Description: The IP version field in the IP packet header. 1086 Abstract Data Type: octet 1087 Data Type Semantics: identifier 1088 ElementId: 60 1089 Status: current 1090 Reference: 1091 See RFC 791 for a definition of the version field in the IPv4 1092 packet header. See RFC 2460 for a definition of the version field 1093 in the IPv6 packet header. Additional information on defined 1094 version numbers can be found at 1095 http://www.iana.org/assignments/version-numbers. 1097 5.3.2. sourceIPv4Address 1099 Description: 1100 The IPv4 source address in the IP packet header. 1101 Abstract Data Type: ipv4Address 1102 Data Type Semantics: identifier 1103 ElementId: 8 1104 Status: current 1105 Reference: See RFC 791 for the definition of the IPv4 source address 1106 field. 1108 5.3.3. sourceIPv6Address 1110 Description: 1111 The IPv6 source address in the IP packet header. 1112 Abstract Data Type: ipv6Address 1113 Data Type Semantics: identifier 1114 ElementId: 27 1115 Status: current 1117 5.3.4. sourceIPv4Mask 1119 Description: 1120 The number of contiguous bits that are relevant in the 1121 sourceIPv4Prefix Information Element. 1122 Abstract Data Type: octet 1123 ElementId: 9 1124 Status: current 1125 Units: bits 1126 Range: The valid range is 0-32. 1128 5.3.5. sourceIPv6Mask 1130 Description: 1131 The number of contiguous bits that are relevant in the 1132 sourceIPv6Prefix Information Element. 1133 Abstract Data Type: octet 1134 ElementId: 29 1135 Status: current 1136 Units: bits 1137 Range: The valid range is 0-128. 1139 5.3.6. sourceIPv4Prefix 1141 Description: 1142 IPv4 source address prefix. 1143 Abstract Data Type: ipv4Address 1144 ElementId: 44 1145 Status: current 1147 5.3.7. sourceIPv6Prefix 1148 Description: 1149 IPv6 source address prefix. 1150 Abstract Data Type: ipv6Address 1151 ElementId: 170 1152 Status: current 1154 5.3.8. destinationIPv4Address 1156 Description: 1157 The IPv4 destination address in the IP packet header. 1158 Abstract Data Type: ipv4Address 1159 Data Type Semantics: identifier 1160 ElementId: 12 1161 Status: current 1162 Reference: See RFC 791 for the definition of the IPv4 destination 1163 address field. 1165 5.3.9. destinationIPv6Address 1167 Description: 1168 The IPv6 destination address in the IP packet header. 1169 Abstract Data Type: ipv6Address 1170 Data Type Semantics: identifier 1171 ElementId: 28 1172 Status: current 1174 5.3.10. destinationIPv4Mask 1176 Description: 1177 The number of contiguous bits that are relevant in the 1178 destinationIPv4Prefix Information Element. 1179 Abstract Data Type: octet 1180 ElementId: 13 1181 Status: current 1182 Units: bits 1183 Range: The valid range is 0-32. 1185 5.3.11. destinationIPv6Mask 1187 Description: 1188 The number of contiguous bits that are relevant in the 1189 destinationIPv6Prefix Information Element. 1190 Abstract Data Type: octet 1191 ElementId: 30 1192 Status: current 1193 Units: bits 1194 Range: The valid range is 0-128. 1196 5.3.12. destinationIPv4Prefix 1198 Description: 1199 IPv4 destination address prefix. 1200 Abstract Data Type: ipv4Address 1201 ElementId: 45 1202 Status: current 1204 5.3.13. destinationIPv6Prefix 1206 Description: 1207 IPv6 destination address prefix. 1208 Abstract Data Type: ipv6Address 1209 ElementId: 169 1210 Status: current 1212 5.3.14. ipTimeToLive 1214 Description: 1215 For IPv4, the value of the Information Element matches the value 1216 of the Time to Live field in the IPv4 packet header. For IPv6, 1217 the value of the Information Element matches the value of the Hop 1218 Limit field in the IPv6 packet header. 1219 Abstract Data Type: octet 1220 ElementId: 192 1221 Status: current 1222 Units: hops 1223 Reference: See RFC 791 for the definition of the IPv4 Time to Live 1224 field. See RFC 2460 for the definition of the IPv6 Hop Limit 1225 field. 1227 5.3.15. protocolIdentifier 1229 Description: 1230 The value of the protocol number in the IP packet header. The 1231 protocol number identifies the IP packet payload type. Protocol 1232 numbers are defined in the IANA Protocol Numbers registry. 1233 In Internet Protocol version 4 (IPv4) this is carried in the 1234 "Protocol" field. In Internet Protocol version 6 (IPv6) this is 1235 carried in the "Next Header" field in the last extension header of 1236 the packet. 1238 Abstract Data Type: octet 1239 Data Type Semantics: identifier 1240 ElementId: 4 1241 Status: current 1242 Reference: 1243 See RFC 791 for the specification of the IPv4 protocol field. See 1244 RFC 2460 for the specification of the IPv6 protocol field. See 1245 the list of protocol numbers assigned by IANA at 1246 http://www.iana.org/assignments/protocol-numbers. 1248 5.3.16. nextHeaderIPv6 1250 Description: 1251 The value of the Next Header field of the IPv6 header. The value 1252 identifies the type of the following IPv6 extension header or of 1253 the following IP payload. Valid values are defined in the IANA 1254 Protocol Numbers registry. 1255 Abstract Data Type: octet 1256 ElementId: 193 1257 Status: current 1258 Reference: See RFC 2460 for the definition of the IPv6 Next Header 1259 field. See the list of protocol numbers assigned by IANA at 1260 http://www.iana.org/assignments/protocol-numbers. 1262 5.3.17. ipClassOfService 1264 Description: 1265 For IPv4 packets, this is the value of the TOS field in the IPv4 1266 packet header. For IPv6 packets, this is the value of the Traffic 1267 Class field in the IPv6 packet header. 1268 Abstract Data Type: octet 1269 Data Type Semantics: identifier 1270 ElementId: 194 1271 Status: current 1272 Reference: See section 5.3.2 of RFC 1812 and RFC 791 for the 1273 definition of the IPv4 TOS field. See RFC 2460 for the definition 1274 of the IPv6 Traffic Class field. 1276 5.3.18. ipDiffServCodePoint 1278 Description: 1279 The value of a Differentiated Services Code Point (DSCP) encoded 1280 in the Differentiated Services Field. The Differentiated Services 1281 Field spans the most significant 6 bits of the IPv4 TOS field or 1282 the IPv6 Traffic class field, respectively. 1284 This Information Element encodes only the 6 bits of the 1285 Differentiated Services field. Therefore its value may range from 1286 0 to 63. 1287 Abstract Data Type: octet 1288 Data Type Semantics: identifier 1289 ElementId: 195 1290 Status: current 1291 Range: The valid range is 0-63. 1292 Reference: See RFC 3260 for the definition of the Differentiated 1293 Services Field. See section 5.3.2 of RFC 1812 and RFC 791 for the 1294 definition of the IPv4 TOS field. See RFC 2460 for the definition 1295 of the IPv6 Traffic Class field. 1297 5.3.19. ipPrecedence 1299 Description: 1300 The value of the IP Precedence. The IP Precedence value is 1301 encoded in the first 3 bits of the IPv4 TOS field or the IPv6 1302 Traffic class field, respectively. 1303 This Information Element encodes only the 3 bits of the 1304 Differentiated Services field. Therefore its value may range from 1305 0 to 7. 1306 Abstract Data Type: octet 1307 Data Type Semantics: identifier 1308 ElementId: 196 1309 Status: current 1310 Range: The valid range is 0-7. 1311 Reference: See section 5.3.3 of RFC 1812 and RFC 791 for the 1312 definition of the IP Precedence. See section 5.3.2 of RFC 1812 1313 and RFC 791 for the definition of the IPv4 TOS field. See RFC 1314 2460 for the definition of the IPv6 Traffic Class field. 1316 5.3.20. classOfServiceIPv4 1318 Description: 1319 The value of the TOS field in the IPv4 packet header. 1320 Abstract Data Type: octet 1321 Data Type Semantics: identifier 1322 ElementId: 5 1323 Status: current 1324 Reference: See RFC 791 for the definition of the IPv4 TOS field. 1326 5.3.21. postClassOfServiceIPv4 1327 Description: 1328 The definition of this Information Element is identical to the 1329 definition of Information Element 'classOfServiceIPv4', except 1330 that it reports a potentially modified value caused by a middlebox 1331 function after the packet passed the observation point. 1332 Abstract Data Type: octet 1333 Data Type Semantics: identifier 1334 ElementId: 55 1335 Status: current 1336 Reference: See RFC 791 for the definition of the IPv4 TOS field. See 1337 RFC 3234 for the definition of middleboxes. 1339 5.3.22. classOfServiceIPv6 1341 Description: 1342 The value of the Traffic Class field in the IPv6 packet header. 1343 Abstract Data Type: octet 1344 Data Type Semantics: identifier 1345 ElementId: 137 1346 Status: current 1347 Reference: See RFC 2460 for the definition of the IPv6 Traffic Class 1348 field. 1350 5.3.23. postClassOfServiceIPv6 1352 Description: 1353 The definition of this Information Element is identical to the 1354 definition of Information Element 'classOfServiceIPv6', except 1355 that it reports a potentially modified value caused by a middlebox 1356 function after the packet passed the observation point. 1357 Abstract Data Type: octet 1358 Data Type Semantics: identifier 1359 ElementId: 138 1360 Status: current 1361 Reference: See RFC 2460 for the definition of the IPv6 traffic class 1362 field. 1364 5.3.24. flowLabelIPv6 1366 Description: 1367 The value of the IPv6 Flow Label field in the IP packet header. 1368 Abstract Data Type: unsigned32 1369 Data Type Semantics: identifier 1370 ElementId: 31 1371 Status: current 1372 Reference: See RFC 2460 for a definition of the flow label field in 1373 the IPv6 packet header. 1375 5.3.25. isMulticast 1377 Description: 1378 If the IP destination address is a reserved multicast address then 1379 the value of this Information Element is not equal to zero. 1380 Otherwise, the value of all bits of the octet is zero. 1381 The first bit of this octet is set to 1 if the Version field of 1382 the IP header has the value 4 and if the Destination Address field 1383 contains a reserved multicast address in the range from 224.0.0.0 1384 to 239.255.255.255. Otherwise, this bit is set to 0. 1385 The second and third bit of this octet are reserved for future 1386 use. 1387 The remaining bits of the octet are only set to values other than 1388 zero if th IP Destination Address is a reserved IPv6 multicast 1389 address. Then the fourth bit of the octet is set to the value of 1390 the T flag in the IPv6 multicast address and the remaining four 1391 bits are set to the value of the scope field in the IPv6 multicast 1392 address. 1394 0 1 2 3 4 5 6 7 1395 +------+------+------+------+------+------+------+------+ 1396 | MCv4 | RES. | RES. | T | IPv6 multicast scope | 1397 +------+------+------+------+------+------+------+------+ 1399 Bit 0: set to 1 if IPv4 multicast 1400 Bit 1-2: reserved for future use 1401 Bit 4: set to value of T-flag, if IPv6 multicast 1402 Bit 4-7: set to value of multicast scope if IPv6 multicast 1404 Abstract Data Type: octet 1405 Data Type Semantics: flags 1406 ElementId: 206 1407 Status: current 1408 Reference: See RFC 1112 for the specification of reserved IPv4 1409 multicast addresses. See RFC 3513 for the specification of 1410 reserved IPv6 multicast addresses and the definition of the T-flag 1411 and the IPv6 multicast scope. 1413 5.3.26. identificationIPv4 1414 Description: 1415 The value of the IPv4 packet identification field in the IP packet 1416 header. 1417 Abstract Data Type: unsigned16 1418 Data Type Semantics: identifier 1419 ElementId: 54 1420 Status: current 1421 Reference: See RFC 791 for the definition of the IPv4 identification 1422 field. 1424 5.3.27. fragmentOffsetIPv4 1426 Description: 1427 The value of the IPv4 fragment offset field in the IP packet 1428 header. 1429 Abstract Data Type: unsigned16 1430 Data Type Semantics: identifier 1431 ElementId: 88 1432 Status: current 1433 Reference: 1434 See RFC 791 for the specification of the IPv4 fragment offset. 1436 5.3.28. fragmentFlagsIPv4 1438 Description: 1439 The value of the fragmentation bits in the IPv4 packet header. 1441 Bit 0: reserved, must be zero. 1442 Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. 1443 Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. 1444 Bits 3-7: (DC) Don't Care, value is irrelevant. 1446 0 1 2 3 4 5 6 7 1447 +---+---+---+---+---+---+---+---+ 1448 | | D | M | D | D | D | D | D | 1449 | 0 | F | F | C | C | C | C | C | 1450 +---+---+---+---+---+---+---+---+ 1452 Abstract Data Type: octet 1453 Data Type Semantics: flags 1454 ElementId: 197 1455 Status: current 1456 Reference: 1457 See RFC 791 for the specification of the IPv4 fragment flags. 1459 5.3.29. ipHeaderLength 1460 Description: 1461 The length of the IP header. For IPv6, the value of this 1462 Information Element is 40. 1463 Abstract Data Type: octet 1464 ElementId: 189 1465 Status: current 1466 Units: octets 1467 Reference: 1468 See RFC 791 for the specification of the IPv4 header. See RFC 1469 2460 for the specification of the IPv6 header. 1471 5.3.30. headerLengthIPv4 1473 Description: 1474 The length of the IPv4 header. 1475 Abstract Data Type: octet 1476 ElementId: 213 1477 Status: current 1478 Units: octets 1479 Reference: 1480 See RFC 791 for the specification of the IPv4 header. 1482 5.3.31. internetHeaderLengthIPv4 1484 Description: 1485 The value of the Internet Header Length (IHL) field in the IPv4 1486 header. It specifies the length of the header in units of 4 1487 octets. 1488 Abstract Data Type: octet 1489 ElementId: 207 1490 Status: current 1491 Units: 4 octets 1492 Reference: 1493 See RFC 791 for the specification of the IPv4 header. 1495 5.3.32. totalLengthIPv4 1497 Description: 1498 The total length of the IPv4 packet. 1499 Abstract Data Type: unsigned16 1500 ElementId: 190 1501 Status: current 1502 Units: octets 1503 Reference: 1505 See RFC 791 for the specification of the IPv4 total length. 1507 5.3.33. payloadLengthIPv6 1509 Description: 1510 The length of the IPv6 payload, i.e., the rest of the packet 1511 following the IPv6 header, in octets. Note that any extension 1512 headers present are considered part of the payload, i.e., included 1513 in the length count. 1514 This Information Element reports the value of the Payload Length 1515 field in the IPv6 header except in the case that the value of this 1516 field is zero and that there is a valid jumbo payload option. 1517 Then the value of the Jumbo Payload Length field in the jumbo 1518 payload option is reported. 1519 Abstract Data Type: unsigned32 1520 ElementId: 191 1521 Status: current 1522 Reference: 1523 See RFC 2460 for the specification of the IPv6 payload length. 1524 See RFC 2675 for the specification of the IPv6 jumbo payload 1525 length. 1527 5.3.34. ipPayloadLength 1529 Description: 1530 The effective length of the IP payload. 1531 For IPv4 packets the value of this Information Element is the 1532 difference between the total length of the IPv4 packet (as 1533 reported by Information Element totalLengthIPv4) and the length of 1534 the IPv4 header (as reported by Information Element 1535 headerLengthIPv4). 1536 For IPv6, the value of the Payload Length field in the IPv6 header 1537 is reported except in the case that the value of this field is 1538 zero and that there is a valid jumbo payload option. In this case 1539 the value of the Jumbo Payload Length field in the jumbo payload 1540 option is reported. 1541 Abstract Data Type: unsigned64 1542 ElementId: 204 1543 Status: current 1544 Reference: 1545 See RFC 791 for the specification of IPv4 packets. See RFC 2460 1546 for the specification of the IPv6 payload length. See RFC 2675 1547 for the specification of the IPv6 jumbo payload length. 1549 5.4. Transport Header Fields 1551 The set of Information Elements related to transport header fields 1552 and length includes the Information Elements listed in the table 1553 below. 1555 +-----+---------------------------+-----+---------------------------+ 1556 | ID | Name | ID | Name | 1557 +-----+---------------------------+-----+---------------------------+ 1558 | 7 | sourceTransportPort | 187 | tcpUrgentPointer | 1559 | 11 | destinationTransportPort | 188 | tcpHeaderLength | 1560 | 180 | udpSourcePort | 32 | icmpTypeCodeIPv4 | 1561 | 181 | udpDestinationPort | 176 | icmpTypeIPv4 | 1562 | 205 | udpMessageLength | 177 | icmpCodeIPv4 | 1563 | 182 | tcpSourcePort | 139 | icmpTypeCodeIPv6 | 1564 | 183 | tcpDestinationPort | 178 | icmpTypeIPv6 | 1565 | 184 | tcpSequenceNumber | 179 | icmpCodeIPv6 | 1566 | 185 | tcpAcknowledgementNumber | 33 | igmpType | 1567 | 186 | tcpWindowSize | | | 1568 +-----+---------------------------+-----+---------------------------+ 1570 5.4.1. sourceTransportPort 1572 Description: 1573 The source port identifier in the transport header. For the 1574 transport protocols UDP, TCP and SCTP this is the source port 1575 number given in the respective header. This field MAY also be 1576 used for future transport protocols that have 16 bit source port 1577 identifiers. 1578 Abstract Data Type: unsigned16 1579 Data Type Semantics: identifier 1580 ElementId: 7 1581 Status: current 1582 Reference: 1583 See RFC 768 for the definition of the UDP source port field. See 1584 RFC 793 for the definition of the TCP source port field. See RFC 1585 2960 for the definition of SCTP. 1586 Additional information on defined UDP and TCP port numbers can be 1587 found at http://www.iana.org/assignments/port-numbers. 1589 5.4.2. destinationTransportPort 1591 Description: 1592 The destination port identifier in the transport header. For the 1593 transport protocols UDP, TCP and SCTP this is the destination port 1594 number given in the respective header. This field MAY also be 1595 used for future transport protocols that have 16 bit destination 1596 port identifiers. 1598 Abstract Data Type: unsigned16 1599 Data Type Semantics: identifier 1600 ElementId: 11 1601 Status: current 1602 Reference: 1603 See RFC 768 for the definition of the UDP source port field. See 1604 RFC 793 for the definition of the TCP source port field. See RFC 1605 2960 for the definition of SCTP. 1606 Additional information on defined UDP and TCP port numbers can be 1607 found at http://www.iana.org/assignments/port-numbers. 1609 5.4.3. udpSourcePort 1611 Description: The source port identifier in the UDP header. 1612 Abstract Data Type: unsigned16 1613 Data Type Semantics: identifier 1614 ElementId: 180 1615 Status: current 1616 Reference: See RFC 768 for the definition of the UDP source port 1617 field. Additional information on defined UDP port numbers can be 1618 found at http://www.iana.org/assignments/port-numbers. 1620 5.4.4. udpDestinationPort 1622 Description: The destination port identifier in the UDP header. 1623 Abstract Data Type: unsigned16 1624 Data Type Semantics: identifier 1625 ElementId: 181 1626 Status: current 1627 Reference: See RFC 768 for the definition of the UDP source port 1628 field. Additional information on defined UDP port numbers can be 1629 found at http://www.iana.org/assignments/port-numbers. 1631 5.4.5. udpMessageLength 1633 Description: The value of the Length field in the UDP header. 1634 Abstract Data Type: unsigned16 1635 ElementId: 205 1636 Status: current 1637 Units: octets 1638 Reference: See RFC 768 for the specification of the UDP header. 1640 5.4.6. tcpSourcePort 1641 Description: The source port identifier in the TCP header. 1642 Abstract Data Type: unsigned16 1643 Data Type Semantics: identifier 1644 ElementId: 182 1645 Status: current 1646 Reference: See RFC 793 for the definition of the TCP source port 1647 field. Additional information on defined TCP port numbers can be 1648 found at http://www.iana.org/assignments/port-numbers. 1650 5.4.7. tcpDestinationPort 1652 Description: The destination port identifier in the TCP header. 1653 Abstract Data Type: unsigned16 1654 Data Type Semantics: identifier 1655 ElementId: 183 1656 Status: current 1657 Reference: See RFC 793 for the definition of the TCP source port 1658 field. Additional information on defined TCP port numbers can be 1659 found at http://www.iana.org/assignments/port-numbers. 1661 5.4.8. tcpSequenceNumber 1663 Description: The sequence number in the TCP header. 1664 Abstract Data Type: unsigned32 1665 ElementId: 184 1666 Status: current 1667 Reference: See RFC 793 for the definition of the TCP sequence number. 1669 5.4.9. tcpAcknowledgementNumber 1671 Description: The acknowledgement number in the TCP header. 1672 Abstract Data Type: unsigned32 1673 ElementId: 185 1674 Status: current 1675 Reference: See RFC 793 for the definition of the TCP acknowledgement 1676 number. 1678 5.4.10. tcpWindowSize 1680 Description: The window field in the TCP header. 1681 Abstract Data Type: unsigned16 1682 ElementId: 186 1683 Status: current 1684 Reference: See RFC 793 for the definition of the TCP window field. 1686 5.4.11. tcpUrgentPointer 1687 Description: The urgent pointer in the TCP header. 1688 Abstract Data Type: unsigned16 1689 ElementId: 187 1690 Status: current 1691 Reference: See RFC 793 for the definition of the TCP urgent pointer. 1693 5.4.12. tcpHeaderLength 1695 Description: The length of the TCP header. 1696 Abstract Data Type: unsigned16 1697 ElementId: 188 1698 Status: current 1699 Units: octets 1700 Reference: See RFC 793 for the definition of the TCP header. 1702 5.4.13. icmpTypeCodeIPv4 1704 Description: 1705 Type and Code of the IPv4 ICMP message. The combination of both 1706 values is reported as (ICMP type * 256) + ICMP code. 1707 Abstract Data Type: unsigned16 1708 Data Type Semantics: identifier 1709 ElementId: 32 1710 Status: current 1711 Reference: See RFC 792 for a definition of the IPv4 ICMP type and 1712 code fields. 1714 5.4.14. icmpTypeIPv4 1716 Description: 1717 Type of the IPv4 ICMP message. 1718 Abstract Data Type: octet 1719 Data Type Semantics: identifier 1720 ElementId: 176 1721 Status: current 1722 Reference: See RFC 792 for a definition of the IPv4 ICMP type field. 1724 5.4.15. icmpCodeIPv4 1726 Description: 1727 Code of the IPv4 ICMP message. 1728 Abstract Data Type: octet 1729 Data Type Semantics: identifier 1730 ElementId: 177 1731 Status: current 1732 Reference: See RFC 792 for a definition of the IPv4 ICMP code field. 1734 5.4.16. icmpTypeCodeIPv6 1736 Description: 1737 Type and Code of the IPv6 ICMP message. The combination of both 1738 values is reported as (ICMP type * 256) + ICMP code. 1739 Abstract Data Type: unsigned16 1740 Data Type Semantics: identifier 1741 ElementId: 139 1742 Status: current 1743 Reference: See RFC 2463 for a definition of the IPv6 ICMP type and 1744 code fields. 1746 5.4.17. icmpTypeIPv6 1748 Description: 1749 Type of the IPv6 ICMP message. 1750 Abstract Data Type: octet 1751 Data Type Semantics: identifier 1752 ElementId: 178 1753 Status: current 1754 Reference: See RFC 2463 for a definition of the IPv6 ICMP type field. 1756 5.4.18. icmpCodeIPv6 1758 Description: 1759 Code of the IPv6 ICMP message. 1760 Abstract Data Type: octet 1761 Data Type Semantics: identifier 1762 ElementId: 179 1763 Status: current 1764 Reference: See RFC 2463 for a definition of the IPv6 ICMP code field. 1766 5.4.19. igmpType 1768 Description: The type field of the IGMP message. 1769 Abstract Data Type: octet 1770 Data Type Semantics: identifier 1771 ElementId: 33 1772 Status: current 1773 Reference: See RFC 2236 for a definition of the IGMP type field. 1775 5.5. Sub-IP Header Fields 1777 The set of Information Elements related to Sub-IP header fields 1778 includes the Information Elements listed in the table below. 1780 +-----+---------------------------+-----+---------------------------+ 1781 | ID | Name | ID | Name | 1782 +-----+---------------------------+-----+---------------------------+ 1783 | 56 | sourceMacAddress | 214 | mplsPayloadLength | 1784 | 81 | postSourceMacAddress | 70 | mplsTopLabelStackEntry | 1785 | 58 | vlanId | 71 | mplsLabelStackEntry2 | 1786 | 59 | postVlanId | 72 | mplsLabelStackEntry3 | 1787 | 80 | destinationMacAddress | 73 | mplsLabelStackEntry4 | 1788 | 57 | postDestinationMacAddr | 74 | mplsLabelStackEntry5 | 1789 | 146 | wlanChannelId | 75 | mplsLabelStackEntry6 | 1790 | 147 | wlanSsid | 76 | mplsLabelStackEntry7 | 1791 | 200 | mplsTopLabelTtl | 77 | mplsLabelStackEntry8 | 1792 | 203 | mplsTopLabelExp | 78 | mplsLabelStackEntry9 | 1793 | 202 | mplsLabelStackDepth | 79 | mplsLabelStackEntry10 | 1794 | 201 | mplsLabelStackLength | | | 1795 +-----+---------------------------+-----+---------------------------+ 1797 5.5.1. sourceMacAddress 1799 Description: 1800 The IEEE 802 source MAC address field. 1801 Abstract Data Type: macAddress 1802 Data Type Semantics: identifier 1803 ElementId: 56 1804 Status: current 1805 Reference: See IEEE.802-3.2002. 1807 5.5.2. postSourceMacAddress 1809 Description: 1810 The definition of this Information Element is identical to the 1811 definition of Information Element 'sourceMacAddress', except that 1812 it reports a potentially modified value caused by a middlebox 1813 function after the packet passed the observation point. 1814 Abstract Data Type: macAddress 1815 Data Type Semantics: identifier 1816 ElementId: 81 1817 Status: current 1818 Reference: See IEEE.802-3.2002. 1820 5.5.3. vlanId 1822 Description: 1823 The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag 1824 Control Information field that was attached to the IP packet. 1826 Abstract Data Type: unsigned16 1827 Data Type Semantics: identifier 1828 ElementId: 58 1829 Status: current 1830 Reference: See IEEE.802-1Q.2003. 1832 5.5.4. postVlanId 1834 Description: 1835 The definition of this Information Element is identical to the 1836 definition of Information Element 'vlanId', except that it reports 1837 a potentially modified value caused by a middlebox function after 1838 the packet passed the observation point. 1839 Abstract Data Type: unsigned16 1840 Data Type Semantics: identifier 1841 ElementId: 59 1842 Status: current 1843 Reference: See IEEE.802-1Q.2003. 1845 5.5.5. destinationMacAddress 1847 Description: 1848 The IEEE 802 destination MAC address field. 1849 Abstract Data Type: macAddress 1850 Data Type Semantics: identifier 1851 ElementId: 80 1852 Status: current 1853 Reference: See IEEE.802-3.2002. 1855 5.5.6. postDestinationMacAddr 1857 Description: 1858 The definition of this Information Element is identical to the 1859 definition of Information Element 'destinationMacAddress', except 1860 that it reports a potentially modified value caused by a middlebox 1861 function after the packet passed the observation point. 1862 Abstract Data Type: macAddress 1863 Data Type Semantics: identifier 1864 ElementId: 57 1865 Status: current 1866 Reference: See IEEE.802-3.2002. 1868 5.5.7. wlanChannelId 1869 Description: 1870 The identifier of the 802.11 (Wi-Fi) channel used. 1871 Abstract Data Type: octet 1872 Data Type Semantics: identifier 1873 ElementId: 146 1874 Status: current 1875 Reference: See IEEE.802-11.1999. 1877 5.5.8. wlanSsid 1879 Description: 1880 The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) 1881 network used. According to IEEE.802-11.1999 the SSID is encoded 1882 into a string of up to 32 characters. 1883 Abstract Data Type: string 1884 ElementId: 147 1885 Status: current 1886 Reference: See IEEE.802-11.1999. 1888 5.5.9. mplsTopLabelTtl 1890 Description: The TTL field from the top MPLS label stack entry, i.e. 1891 the last label that was pushed. 1892 Abstract Data Type: unsigned32 1893 ElementId: 200 1894 Status: current 1895 Reference: See RFC 3032 for the specification of the TTL field. 1897 5.5.10. mplsTopLabelExp 1899 Description: 1900 The Exp field from the top MPLS label stack entry, i.e. the last 1901 label that was pushed. 1903 Bit 0-4: Don't Care, value is irrelevant. 1904 Bit 5-7: MPLS Exp field 1906 0 1 2 3 4 5 6 7 1907 +---+---+---+---+---+---+---+---+ 1908 | don't care | Exp | 1909 +---+---+---+---+---+---+---+---+ 1911 Abstract Data Type: octet 1912 Data Type Semantics: flags 1913 ElementId: 203 1914 Status: current 1915 Reference: See RFC 3032 for the specification of the Exp field. See 1916 RFC 3270 for usage of the Exp field. 1918 5.5.11. mplsLabelStackDepth 1920 Description: The number of labels in the MPLS label stack. 1921 Abstract Data Type: unsigned32 1922 ElementId: 202 1923 Status: current 1924 Units: label stack entries 1925 Reference: See RFC 3032 for the specification of the MPLS label 1926 stack. 1928 5.5.12. mplsLabelStackLength 1930 Description: The length of the MPLS label stack in units of octets. 1931 Abstract Data Type: unsigned32 1932 ElementId: 201 1933 Status: current 1934 Units: octets 1935 Reference: See RFC 3032 for the specification of the MPLS label 1936 stack. 1938 5.5.13. mplsPayloadLength 1940 Description: The size of the MPLS packet without the label stack. 1941 Abstract Data Type: unsigned32 1942 ElementId: 214 1943 Status: current 1944 Units: octets 1945 Reference: See RFC 3031 for the specification of MPLS packets. See 1946 RFC 3032 for the specification of the MPLS label stack. 1948 5.5.14. mplsTopLabelStackEntry 1950 Description: 1951 The label, exp and s fields from the top MPLS label stack entry, 1952 i.e. the last label that was pushed. 1954 0 1 2 1955 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 1956 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1957 | Label | Exp |S| 1958 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1960 Label: Label Value, 20 bits 1961 Exp: Experimental Use, 3 bits 1962 S: Bottom of Stack, 1 bit 1964 Abstract Data Type: unsigned32 1965 Data Type Semantics: identifier 1966 ElementId: 70 1967 Status: current 1968 Reference: See RFC 3032. 1970 5.5.15. mplsLabelStackEntry2 1972 Description: 1973 The label, exp, and s fields from the label stack entry that was 1974 pushed immediately before the label stack entry that would be 1975 reported by mplsTopLabelStackEntry. See the definition of 1976 mplsTopLabelStackEntry for further details. 1977 Abstract Data Type: unsigned32 1978 Data Type Semantics: identifier 1979 ElementId: 71 1980 Status: current 1981 Reference: See RFC 3032. 1983 5.5.16. mplsLabelStackEntry3 1985 Description: 1986 The label, exp, and s fields from the label stack entry that was 1987 pushed immediately before the label stack entry that would be 1988 reported by mplsLabelStackEntry2. See the definition of 1989 mplsTopLabelStackEntry for further details. 1990 Abstract Data Type: unsigned32 1991 Data Type Semantics: identifier 1992 ElementId: 72 1993 Status: current 1994 Reference: See RFC 3032. 1996 5.5.17. mplsLabelStackEntry4 1997 Description: 1998 The label, exp, and s fields from the label stack entry that was 1999 pushed immediately before the label stack entry that would be 2000 reported by mplsLabelStackEntry3. See the definition of 2001 mplsTopLabelStackEntry for further details. 2002 Abstract Data Type: unsigned32 2003 Data Type Semantics: identifier 2004 ElementId: 73 2005 Status: current 2006 Reference: See RFC 3032. 2008 5.5.18. mplsLabelStackEntry5 2010 Description: 2011 The label, exp, and s fields from the label stack entry that was 2012 pushed immediately before the label stack entry that would be 2013 reported by mplsLabelStackEntry4. See the definition of 2014 mplsTopLabelStackEntry for further details. 2015 Abstract Data Type: unsigned32 2016 Data Type Semantics: identifier 2017 ElementId: 74 2018 Status: current 2019 Reference: See RFC 3032. 2021 5.5.19. mplsLabelStackEntry6 2023 Description: 2024 The label, exp, and s fields from the label stack entry that was 2025 pushed immediately before the label stack entry that would be 2026 reported by mplsLabelStackEntry5. See the definition of 2027 mplsTopLabelStackEntry for further details. 2028 Abstract Data Type: unsigned32 2029 Data Type Semantics: identifier 2030 ElementId: 75 2031 Status: current 2032 Reference: See RFC 3032. 2034 5.5.20. mplsLabelStackEntry7 2036 Description: 2037 The label, exp, and s fields from the label stack entry that was 2038 pushed immediately before the label stack entry that would be 2039 reported by mplsLabelStackEntry6. See the definition of 2040 mplsTopLabelStackEntry for further details. 2042 Abstract Data Type: unsigned32 2043 Data Type Semantics: identifier 2044 ElementId: 76 2045 Status: current 2046 Reference: See RFC 3032. 2048 5.5.21. mplsLabelStackEntry8 2050 Description: 2051 The label, exp, and s fields from the label stack entry that was 2052 pushed immediately before the label stack entry that would be 2053 reported by mplsLabelStackEntry7. See the definition of 2054 mplsTopLabelStackEntry for further details. 2055 Abstract Data Type: unsigned32 2056 Data Type Semantics: identifier 2057 ElementId: 77 2058 Status: current 2059 Reference: See RFC 3032. 2061 5.5.22. mplsLabelStackEntry9 2063 Description: 2064 The label, exp, and s fields from the label stack entry that was 2065 pushed immediately before the label stack entry that would be 2066 reported by mplsLabelStackEntry8. See the definition of 2067 mplsTopLabelStackEntry for further details. 2068 Abstract Data Type: unsigned32 2069 Data Type Semantics: identifier 2070 ElementId: 78 2071 Status: current 2072 Reference: See RFC 3032. 2074 5.5.23. mplsLabelStackEntry10 2076 Description: 2077 The label, exp, and s fields from the label stack entry that was 2078 pushed immediately before the label stack entry that would be 2079 reported by mplsLabelStackEntry9. See the definition of 2080 mplsTopLabelStackEntry for further details. 2081 Abstract Data Type: unsigned32 2082 Data Type Semantics: identifier 2083 ElementId: 79 2084 Status: current 2085 Reference: See RFC 3032. 2087 5.6. Derived Packet Properties 2089 The set of Information Elements derived from values of header fields 2090 and further information includes the Information Elements listed in 2091 the table below. 2093 +-----+---------------------------+-----+---------------------------+ 2094 | ID | Name | ID | Name | 2095 +-----+---------------------------+-----+---------------------------+ 2096 | 15 | ipNextHopIPv4Address | 18 | bgpNextHopIPv4Address | 2097 | 62 | ipNextHopIPv6Address | 63 | bgpNextHopIPv6Address | 2098 | 16 | bgpSourceAsNumber | 46 | mplsTopLabelType | 2099 | 17 | bgpDestinationAsNumber | 47 | mplsTopLabelIPv4Address | 2100 | 128 | bgpNextAdjacentAsNumber | 140 | mplsTopLabelIPv6Address | 2101 | 129 | bgpPrevAdjacentAsNumber | | | 2102 +-----+---------------------------+-----+---------------------------+ 2104 5.6.1. ipNextHopIPv4Address 2106 Description: 2107 The IPv4 address of the next IPv4 hop. 2108 Abstract Data Type: ipv4Address 2109 Data Type Semantics: identifier 2110 ElementId: 15 2111 Status: current 2113 5.6.2. ipNextHopIPv6Address 2115 Description: 2116 The IPv6 address of the next IPv6 hop. 2117 Abstract Data Type: ipv6Address 2118 Data Type Semantics: identifier 2119 ElementId: 62 2120 Status: current 2122 5.6.3. bgpSourceAsNumber 2124 Description: 2125 The autonomous system (AS) number of the source IP address. If AS 2126 path information for this Flow is only available as unordered AS 2127 set (and not as ordered AS sequence), then the value of this 2128 Information Element is 0. 2129 Abstract Data Type: unsigned16 2130 Data Type Semantics: identifier 2131 ElementId: 16 2132 Status: current 2133 Reference: See RFC 1771 for a description of BGP-4 and see RFC 1930 2134 for a definition of the AS number. 2136 5.6.4. bgpDestinationAsNumber 2138 Description: 2139 The autonomous system (AS) number of the destination IP address. 2140 If AS path information for this Flow is only available as 2141 unordered AS set (and not as ordered AS sequence), then the value 2142 of this Information Element is 0. 2143 Abstract Data Type: unsigned16 2144 Data Type Semantics: identifier 2145 ElementId: 17 2146 Status: current 2147 Reference: See RFC 1771 for a description of BGP-4 and see RFC 1930 2148 for a definition of the AS number. 2150 5.6.5. bgpNextAdjacentAsNumber 2152 Description: 2153 The autonomous system (AS) number of the first AS in the AS path 2154 to the destination IP address. The path is deduced by looking up 2155 the destination IP address of the Flow in the BGP routing 2156 information base. If AS path information for this Flow is only 2157 available as unordered AS set (and not as ordered AS sequence), 2158 then the value of this Information Element is 0. 2159 Abstract Data Type: unsigned16 2160 Data Type Semantics: identifier 2161 ElementId: 128 2162 Status: current 2163 Reference: See RFC 1771 for a description of BGP-4 and see RFC 1930 2164 for a definition of the AS number. 2166 5.6.6. bgpPrevAdjacentAsNumber 2168 Description: 2169 The autonomous system (AS) number of the last AS in the AS path 2170 from the source IP address. The path is deduced by looking up the 2171 source IP address of the Flow in the BGP routing information base. 2172 If AS path information for this Flow is only available as 2173 unordered AS set (and not as ordered AS sequence), then the value 2174 of this Information Element is 0. In case of BGP asymmetry, the 2175 bgpPrevAdjacentAsNumber might not be able to report the correct 2176 value. 2177 Abstract Data Type: unsigned16 2178 Data Type Semantics: identifier 2179 ElementId: 129 2180 Status: current 2181 Reference: See RFC 1771 for a description of BGP-4 and see RFC 1930 2182 for a definition of the AS number. 2184 5.6.7. bgpNextHopIPv4Address 2186 Description: 2187 The IPv4 address of the next (adjacent) BGP hop. 2188 Abstract Data Type: ipv4Address 2189 Data Type Semantics: identifier 2190 ElementId: 18 2191 Status: current 2192 Reference: See RFC 1771 for a description of BGP-4 and 2194 5.6.8. bgpNextHopIPv6Address 2196 Description: 2197 The IPv6 address of the next (adjacent) BGP hop. 2198 Abstract Data Type: ipv6Address 2199 Data Type Semantics: identifier 2200 ElementId: 63 2201 Status: current 2202 Reference: See RFC 1771 for a description of BGP-4. 2204 5.6.9. mplsTopLabelType 2206 Description: 2207 This field identifies the control protocol that allocated the top 2208 of stack label. Defined values for this field include: 2210 - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label 2211 - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label 2212 - 0x03 VPN: Any label associated with VPN 2213 - 0x04 BGP: Any label associated with BGP or BGP routing 2214 - 0x05 LDP: Any label associated with dynamically assigned 2215 labels using LDP 2217 Abstract Data Type: octet 2218 Data Type Semantics: identifier 2219 ElementId: 46 2220 Status: current 2221 Reference: See RFC 3031 for the MPLS label structure. See RFC 2547 2222 for the association of MPLS labels with VPNs. See RFC 1771 for 2223 BGP and BGP routing. See RFC 3036 for LDP. and IP addresses. 2225 5.6.10. mplsTopLabelIPv4Address 2226 Description: 2227 The IPv4 address of the system that the MPLS top label will cause 2228 this Flow to be forwarded to. 2229 Abstract Data Type: ipv4Address 2230 Data Type Semantics: identifier 2231 ElementId: 47 2232 Status: current 2233 Reference: See RFC 3031 for the association between MPLS labels and 2234 IP addresses. 2236 5.6.11. mplsTopLabelIPv6Address 2238 Description: 2239 The IPv6 address of the system that the MPLS top label will cause 2240 this Flow to be forwarded to. 2241 Abstract Data Type: ipv6Address 2242 Data Type Semantics: identifier 2243 ElementId: 140 2244 Status: current 2245 Reference: See RFC 3031 for the association between MPLS labels and 2246 IP addresses. 2248 5.7. Min/Max Flow Properties 2250 Information Elements in this section are results of minimum or 2251 maximum operations over all packets of a Flow. 2253 +-----+---------------------------+-----+---------------------------+ 2254 | ID | Name | ID | Name | 2255 +-----+---------------------------+-----+---------------------------+ 2256 | 25 | minimumPacketLength | 208 | ipv4Options | 2257 | 26 | maximumPacketLength | 64 | ipv6ExtensionHeaders | 2258 | 52 | minimumTtl | 6 | tcpControlBits | 2259 | 53 | maximumTtl | 209 | tcpOptions | 2260 +-----+---------------------------+-----+---------------------------+ 2262 5.7.1. minimumPacketLength 2264 Description: 2265 Length of the smallest packet observed for this Flow. 2266 Abstract Data Type: unsigned16 2267 ElementId: 25 2268 Status: current 2269 Units: octets 2271 5.7.2. maximumPacketLength 2272 Description: 2273 Length of the largest packet observed for this Flow. 2274 Abstract Data Type: unsigned16 2275 ElementId: 26 2276 Status: current 2277 Units: octets 2279 5.7.3. minimumTtl 2281 Description: 2282 Minimum TTL value observed for any packet in this Flow. 2283 Abstract Data Type: octet 2284 ElementId: 52 2285 Status: current 2287 5.7.4. maximumTtl 2289 Description: 2290 Maximum TTL value observed for any packet in this Flow. 2291 Abstract Data Type: octet 2292 ElementId: 53 2293 Status: current 2295 5.7.5. ipv4Options 2297 Description: 2298 IPv4 options in packets of this Flow. The information is encoded 2299 in a set of bit fields. For each valid IPv4 option type there is 2300 a bit in this set. The bit is set to 1 if any observed packet of 2301 this Flow contains the corresponding IPv4 option type. Otherwise, 2302 if no observed packet of this Flow contained the respective IPv4 2303 option type, the value of the corresponding bit is 0. 2304 The list of valid IPv4 options is maintained by IANA. Note that 2305 for identifying an option not just the 5-bit Option Number, but 2306 all 8 bits of the Option Type need to match one of the IPv4 2307 options specified at 2308 http://www.iana.org/assignments/ip-parameters. 2309 Options are mapped to bits according to their option numbers. 2310 Option number X is mapped to bit X. The mapping is illustrated by 2311 the figure below. 2313 0 1 2 3 4 5 6 7 2314 +------+------+------+------+------+------+------+------+ 2315 | EOOL | NOP | SEC | LSR | TS |E-SEC |CIPSO | RR | ... 2316 +------+------+------+------+------+------+------+------+ 2318 8 9 10 11 12 13 14 15 2319 +------+------+------+------+------+------+------+------+ 2321 ... | SID | SSR | ZSU | MTUP | MTUR | FINN | VISA |ENCODE| ... 2322 +------+------+------+------+------+------+------+------+ 2324 16 17 18 19 20 21 22 23 2325 +------+------+------+------+------+------+------+------+ 2326 ... |IMITD | EIP | TR |ADDEXT|RTRALT| SDB |NSAPA | DPS | ... 2327 +------+------+------+------+------+------+------+------+ 2329 24 25 26 27 28 29 30 31 2330 +------+------+------+------+------+------+------+------+ 2331 ... | UMP | to be assigned by IANA | 2332 +------+------+------+------+------+------+------+------+ 2334 Type Option 2335 Bit Value Name Reference 2336 ---+-----+-------+------------------------------------ 2337 0 0 EOOL End of Options List, RFC 791 2338 1 1 NOP No Operation, RFC 791 2339 2 130 SEC Security, RFC 1108 2340 3 131 LSR Loose Source Route, RFC 791 2341 4 68 TS Time Stamp, RFC 791 2342 5 133 E-SEC Extended Security, RFC 1108 2343 6 134 CIPSO Commercial Security 2344 7 7 RR Record Route, RFC 791 2345 8 136 SID Stream ID, RFC 791 2346 9 137 SSR Strict Source Route, RFC 791 2347 10 10 ZSU Experimental Measurement 2348 11 11 MTUP (obsoleted) MTU Probe, RFC 1191 2349 12 12 MTUR (obsoleted) MTU Reply, RFC 1191 2350 13 205 FINN Experimental Flow Control 2351 14 142 VISA Experimental Access Control 2352 15 15 ENDOCE 2353 16 144 IMITD IMI Traffic Descriptor 2354 17 145 EIP Extended Internet Protocol, RFC 1385 2355 18 82 TR Traceroute, RFC 3193 2356 19 147 ADDEXT Address Extension 2357 20 148 RTRALT Router Alert, RFC 2113 2358 21 149 SDB Selective Directed Broadcast 2359 22 150 NSAPA NSAP Address 2360 23 151 DPS Dynamic Packet State 2361 24 152 UMP Upstream Multicast Pkt. 2362 ... ... ... Further options numbers 2363 may be assigned by IANA 2365 Abstract Data Type: unsigned32 2366 Data Type Semantics: flags 2367 ElementId: 208 2368 Status: current 2369 Reference: See RFC 791 for the definition of IPv4 options. See the 2370 list of IPv4 option numbers assigned by IANA at 2371 http://www.iana.org/assignments/ip-parameters. 2373 5.7.6. ipv6ExtensionHeaders 2375 Description: 2376 IPv6 extension headers observed in packets of this Flow. The 2377 information is encoded in a set of bit fields. For each IPv6 2378 option header there is a bit in this set. The bit is set to 1 if 2379 any observed packet of this Flow contains the corresponding IPv6 2380 extension header. Otherwise, if no observed packet of this Flow 2381 contained the respective IPv6 extension header, the value of the 2382 corresponding bit is 0. 2384 0 1 2 3 4 5 6 7 2385 +-----+-----+-----+-----+-----+-----+-----+-----+ 2386 | Res | FRA1| ROU | FRA0| UNK | Res | HOP | DST | ... 2387 +-----+-----+-----+-----+-----+-----+-----+-----+ 2389 8 9 10 11 12 13 14 15 2390 +-----+-----+-----+-----+-----+-----+-----+-----+ 2391 ... | PAY | AUT | ENC | Reserved | ... 2392 +-----+-----+-----+-----+-----+-----+-----+-----+ 2394 16 17 18 19 20 21 22 23 2395 +-----+-----+-----+-----+-----+-----+-----+-----+ 2396 ... | Reserved | ... 2397 +-----+-----+-----+-----+-----+-----+-----+-----+ 2399 24 25 26 27 28 29 30 31 2400 +-----+-----+-----+-----+-----+-----+-----+-----+ 2401 ... | Reserved | 2402 +-----+-----+-----+-----+-----+-----+-----+-----+ 2404 Bit IPv6 Option Description 2406 0, Res Reserved 2407 1, FRA1 44 Fragmentation header - not first fragment 2408 2, ROU 43 Routing header 2409 3, FRA0 44 Fragment header - first fragment 2410 4, UNK Unknown Layer 4 header 2411 (compressed, encrypted, not supported) 2412 5, Res Reserved 2413 6, HOP 0 Hop-by-hop option header 2414 7, DST 60 Destination option header 2415 8, PAY 108 Payload compression header 2416 9, AUT 51 Authentication Header 2417 10, ENC 50 Encrypted security payload 2418 11 to 31 Reserved 2420 Abstract Data Type: unsigned32 2421 Data Type Semantics: flags 2422 ElementId: 64 2423 Status: current 2424 Reference: See RFC 2460 for the general definition of IPv6 extensions 2425 headers and for the specification of the hop-by-hop options 2426 header, the routing header, the fragment header, and the 2427 destination options header. See RFC 2402 for the specification of 2428 the authentication header. See RFC 2406 for the specification of 2429 the encapsulating security payload. 2431 5.7.7. tcpControlBits 2433 Description: 2434 TCP control bits observed for packets of this Flow. The 2435 information is encoded in a set of bit fields. For each TCP 2436 control bit there is a bit in this set. A bit is set to 1 if any 2437 observed packet of this Flow has the corresponding TCP control bit 2438 set to 1. A value of 0 for a bit indicates that the corresponding 2439 bit was not set in any of the observed packets of this Flow. 2441 0 1 2 3 4 5 6 7 2442 +-----+-----+-----+-----+-----+-----+-----+-----+ 2443 | Reserved | URG | ACK | PSH | RST | SYN | FIN | 2444 +-----+-----+-----+-----+-----+-----+-----+-----+ 2446 Reserved: Reserved for future use by TCP. Must be zero. 2447 URG: Urgent Pointer field significant 2448 ACK: Acknowledgment field significant 2449 PSH: Push Function 2450 RST: Reset the connection 2451 SYN: Synchronize sequence numbers 2452 FIN: No more data from sender 2454 Abstract Data Type: octet 2455 Data Type Semantics: flags 2456 ElementId: 6 2457 Status: current 2458 Reference: See RFC 793 for a definition of the TCP control bits in 2459 the TCP header. 2461 5.7.8. tcpOptions 2463 Description: 2464 TCP options in packets of this Flow. The information is encoded 2465 in a set of bit fields. For each TCP option there is a bit in 2466 this set. The bit is set to 1 if any observed packet of this Flow 2467 contains the corresponding TCP option. Otherwise, if no observed 2468 packet of this Flow contained the respective TCP option, the value 2469 of the corresponding bit is 0. 2470 Options are mapped to bits according to their option numbers. 2471 Option number X is mapped to bit X. TCP option numbers are 2472 maintained by IANA. 2473 Abstract Data Type: unsigned64 2474 Data Type Semantics: flags 2475 ElementId: 209 2476 Status: current 2477 Reference: See RFC 793 for the definition of TCP options. See the 2478 list of TCP option numbers assigned by IANA at 2479 http://www.iana.org/assignments/tcp-parameters. 2481 5.8. Flow Time Stamps 2483 Information Elements in this section are time stamps of events. 2485 Time stamps flowStartSeconds, flowEndSeconds, flowStartMilliSeconds, 2486 flowEndMilliSeconds, flowStartMicroSeconds, flowEndMicroSeconds, 2487 flowStartNanoSeconds, flowEndNanoSeconds, and 2488 systemInitTimeMilliSeconds are absolute and have a well defined fixed 2489 time base, such as, for example, the number of seconds since 0000 UTC 2490 Jan 1st 1970. 2492 Time stamps flowStartDeltaMicroSeconds and flowEndDeltaMicroSeconds 2493 are relative time stamps only valid within the scope of a single 2494 IPFIX Message. They contain the negative time offsets relative to 2495 the export time specified in the IPFIX Message header. 2497 Time stamps flowStartSysUpTime and flowEndSysUpTime are relative time 2498 stamps indicating the time relative to the last (re-)initialization 2499 of the IPFIX Device. For reporting the time of the last 2500 (re-)initialization, systemInitTimeMilliSeconds can be reported, for 2501 example, in Data Records defined by Option Templates. 2503 +-----+---------------------------+-----+---------------------------+ 2504 | ID | Name | ID | Name | 2505 +-----+---------------------------+-----+---------------------------+ 2506 | 150 | flowStartSeconds | 156 | flowStartNanoSeconds | 2507 | 151 | flowEndSeconds | 157 | flowEndNanoSeconds | 2508 | 152 | flowStartMilliSeconds | 158 | flowStartDeltaMicroSeconds| 2509 | 153 | flowEndMilliSeconds | 159 | flowEndDeltaMicroSeconds | 2510 | 154 | flowStartMicroSeconds | 160 | systemInitTimeMilliSeconds| 2511 | 155 | flowEndMicroSeconds | 22 | flowStartSysUpTime | 2512 | | | 21 | flowEndSysUpTime | 2513 +-----+---------------------------+-----+---------------------------+ 2515 5.8.1. flowStartSeconds 2517 Description: The absolute timestamp of the first packet of this Flow. 2518 Abstract Data Type: dateTimeSeconds 2519 ElementId: 150 2520 Status: current 2521 Units: seconds 2523 5.8.2. flowEndSeconds 2525 Description: The absolute timestamp of the last packet of this Flow. 2526 Abstract Data Type: dateTimeSeconds 2527 ElementId: 151 2528 Status: current 2529 Units: seconds 2531 5.8.3. flowStartMilliSeconds 2533 Description: The absolute timestamp of the first packet of this Flow. 2534 Abstract Data Type: dateTimeMilliSeconds 2535 ElementId: 152 2536 Status: current 2537 Units: milliseconds 2539 5.8.4. flowEndMilliSeconds 2541 Description: The absolute timestamp of the last packet of this Flow. 2542 Abstract Data Type: dateTimeMilliSeconds 2543 ElementId: 153 2544 Status: current 2545 Units: milliseconds 2547 5.8.5. flowStartMicroSeconds 2549 Description: The absolute timestamp of the first packet of this Flow. 2550 Abstract Data Type: dateTimeMicroSeconds 2551 ElementId: 154 2552 Status: current 2553 Units: microseconds 2555 5.8.6. flowEndMicroSeconds 2557 Description: The absolute timestamp of the last packet of this Flow. 2558 Abstract Data Type: dateTimeMicroSeconds 2559 ElementId: 155 2560 Status: current 2561 Units: microseconds 2563 5.8.7. flowStartNanoSeconds 2564 Description: The absolute timestamp of the first packet of this Flow. 2565 Abstract Data Type: dateTimeNanoSeconds 2566 ElementId: 156 2567 Status: current 2568 Units: nanoseconds 2570 5.8.8. flowEndNanoSeconds 2572 Description: The absolute timestamp of the last packet of this Flow. 2573 Abstract Data Type: dateTimeNanoSeconds 2574 ElementId: 157 2575 Status: current 2576 Units: nanoseconds 2578 5.8.9. flowStartDeltaMicroSeconds 2580 Description: This is a relative time stamp only valid within the 2581 scope of a single IPFIX Message. It contains the negative time 2582 offset of the first observed packet of this Flow relative to the 2583 export time specified in the IPFIX Message header. 2584 Abstract Data Type: unsigned32 2585 ElementId: 158 2586 Status: current 2587 Units: microseconds 2588 Reference: See [I-D.ietf-ipfix-protocol] for the definition of the 2589 IPFIX Message header. 2591 5.8.10. flowEndDeltaMicroSeconds 2593 Description: This is a relative time stamp only valid within the 2594 scope of a single IPFIX Message. It contains the negative time 2595 offset of the last observed packet of this Flow relative to the 2596 export time specified in the IPFIX Message header. 2597 Abstract Data Type: unsigned32 2598 ElementId: 159 2599 Status: current 2600 Units: microseconds 2601 Reference: See [I-D.ietf-ipfix-protocol] for the definition of the 2602 IPFIX Message header. 2604 5.8.11. systemInitTimeMilliSeconds 2606 Description: The absolute timestamp of the last (re-)initialization 2607 of the IPFIX Device. 2609 Abstract Data Type: dateTimeMilliSeconds 2610 ElementId: 160 2611 Status: current 2612 Units: milliseconds 2614 5.8.12. flowStartSysUpTime 2616 Description: The relative timestamp of the first packet of this Flow. 2617 It indicates the number of milliseconds since the last 2618 (re-)initialization of the IPFIX Device (sysUpTime). 2619 Abstract Data Type: unsigned32 2620 ElementId: 22 2621 Status: current 2622 Units: milliseconds 2624 5.8.13. flowEndSysUpTime 2626 Description: The relative timestamp of the last packet of this Flow. 2627 It indicates the number of milliseconds since the last 2628 (re-)initialization of the IPFIX Device (sysUpTime). 2629 Abstract Data Type: unsigned32 2630 ElementId: 21 2631 Status: current 2632 Units: milliseconds 2634 5.9. Per-Flow Counters 2636 Information Elements in this section are counters all having integer 2637 values. Their values may change for every report they are used in. 2638 They cannot serve as part of a Flow Key used for mapping packets to 2639 Flows. However, potentially they can be used for selecting exported 2640 Flows, for example, by only exporting Flows with more than a 2641 threshold number of observed octets. 2643 There are running counters and delta counters. Delta counters are 2644 reset to zero each time their values are exported. Running counters 2645 continue counting independently of the Exporting Process. 2647 There are per-Flow counters and counters related to the Metering 2648 Process and/or the Exporting Process. Per-Flow counters are Flow 2649 properties that potentially change each time a packet belonging to 2650 the Flow is observed. The set of per-Flow counters includes the 2651 Information Elements listed in the table below. 2653 +-----+---------------------------+-----+---------------------------+ 2654 | ID | Name | ID | Name | 2655 +-----+---------------------------+-----+---------------------------+ 2656 | 1 | octetDeltaCount | 132 | droppedOctetDeltaCount | 2657 | 23 | postOctetDeltaCount | 133 | droppedPacketDeltaCount | 2658 | 198 | octetDeltaSumOfSquares | 134 | droppedOctetTotalCount | 2659 | 85 | octetTotalCount | 135 | droppedPacketTotalCount | 2660 | 171 | postOctetTotalCount | 19 | postMCastPacketDeltaCount | 2661 | 199 | octetTotalSumOfSquares | 20 | postMCastOctetDeltaCount | 2662 | 2 | packetDeltaCount | 174 | postMCastPacketTotalCount | 2663 | 24 | postPacketDeltaCount | 175 | postMCastOctetTotalCount | 2664 | 86 | packetTotalCount | | | 2665 | 172 | postPacketTotalCount | | | 2666 +-----+---------------------------+-----+---------------------------+ 2668 5.9.1. octetDeltaCount 2670 Description: 2671 The number of octets since the previous report (if any) in 2672 incoming packets for this Flow at the Observation Point. The 2673 number of octets include IP header(s) and IP payload. 2674 Abstract Data Type: unsigned64 2675 Data Type Semantics: deltaCounter 2676 ElementId: 1 2677 Status: current 2678 Units: octets 2680 5.9.2. postOctetDeltaCount 2682 Description: 2683 The definition of this Information Element is identical to the 2684 definition of Information Element 'octetDeltaCount', except that 2685 it reports a potentially modified value caused by a middlebox 2686 function after the packet passed the observation point. 2687 Abstract Data Type: unsigned64 2688 Data Type Semantics: deltaCounter 2689 ElementId: 23 2690 Status: current 2691 Units: octets 2693 5.9.3. octetDeltaSumOfSquares 2695 Description: 2696 The sum of the squared numbers of octets per incoming packet since 2697 the previous report (if any) for this Flow at the Observation 2698 Point. The number of octets include IP header(s) and IP payload. 2700 Abstract Data Type: unsigned64 2701 ElementId: 198 2702 Status: current 2704 5.9.4. octetTotalCount 2706 Description: 2707 The total number of octets in incoming packets for this Flow at 2708 the Observation Point since the Metering Process 2709 (re-)initialization for this Observation Point. The number of 2710 octets include IP header(s) and IP payload. 2711 Abstract Data Type: unsigned64 2712 Data Type Semantics: totalCounter 2713 ElementId: 85 2714 Status: current 2715 Units: octets 2717 5.9.5. postOctetTotalCount 2719 Description: 2720 The definition of this Information Element is identical to the 2721 definition of Information Element 'octetTotalCount', except that 2722 it reports a potentially modified value caused by a middlebox 2723 function after the packet passed the observation point. 2724 Abstract Data Type: unsigned64 2725 Data Type Semantics: totalCounter 2726 ElementId: 171 2727 Status: current 2728 Units: octets 2730 5.9.6. octetTotalSumOfSquares 2732 Description: 2733 The total sum of the squared numbers of octets in incoming packets 2734 for this Flow at the Observation Point since the Metering Process 2735 (re-)initialization for this Observation Point. The number of 2736 octets include IP header(s) and IP payload. 2737 Abstract Data Type: unsigned64 2738 ElementId: 199 2739 Status: current 2740 Units: octets 2742 5.9.7. packetDeltaCount 2743 Description: 2744 The number of incoming packets since the previous report (if any) 2745 for this Flow at the Observation Point. 2746 Abstract Data Type: unsigned64 2747 Data Type Semantics: deltaCounter 2748 ElementId: 2 2749 Status: current 2750 Units: packets 2752 5.9.8. postPacketDeltaCount 2754 Description: 2755 The definition of this Information Element is identical to the 2756 definition of Information Element 'packetDeltaCount', except that 2757 it reports a potentially modified value caused by a middlebox 2758 function after the packet passed the observation point. 2759 Abstract Data Type: unsigned64 2760 Data Type Semantics: deltaCounter 2761 ElementId: 24 2762 Status: current 2763 Units: packets 2765 5.9.9. packetTotalCount 2767 Description: 2768 The total number of incoming packets for this Flow at the 2769 Observation Point since the Metering Process (re-)initialization 2770 for this Observation Point. 2771 Abstract Data Type: unsigned64 2772 Data Type Semantics: totalCounter 2773 ElementId: 86 2774 Status: current 2775 Units: packets 2777 5.9.10. postPacketTotalCount 2779 Description: 2780 The definition of this Information Element is identical to the 2781 definition of Information Element 'packetTotalCount', except that 2782 it reports a potentially modified value caused by a middlebox 2783 function after the packet passed the observation point. 2784 Abstract Data Type: unsigned64 2785 Data Type Semantics: totalCounter 2786 ElementId: 172 2787 Status: current 2788 Units: packets 2790 5.9.11. droppedOctetDeltaCount 2792 Description: 2793 The number of octets since the previous report (if any) in packets 2794 of this Flow dropped by packet treatment. The number of octets 2795 include IP header(s) and IP payload. 2796 Abstract Data Type: unsigned64 2797 Data Type Semantics: deltaCounter 2798 ElementId: 132 2799 Status: current 2800 Units: octets 2802 5.9.12. droppedPacketDeltaCount 2804 Description: 2805 The number of packets since the previous report (if any) of this 2806 Flow dropped by packet treatment. 2807 Abstract Data Type: unsigned64 2808 Data Type Semantics: deltaCounter 2809 ElementId: 133 2810 Status: current 2811 Units: packets 2813 5.9.13. droppedOctetTotalCount 2815 Description: 2816 The total number of octets in packets of this Flow dropped by 2817 packet treatment since the Metering Process (re-)initialization 2818 for this Observation Point. The number of octets include IP 2819 header(s) and IP payload. 2820 Abstract Data Type: unsigned64 2821 Data Type Semantics: totalCounter 2822 ElementId: 134 2823 Status: current 2824 Units: octets 2826 5.9.14. droppedPacketTotalCount 2828 Description: 2829 The number of packets of this Flow dropped by packet treatment 2830 since the Metering Process (re-)initialization for this 2831 Observation Point. 2833 Abstract Data Type: unsigned64 2834 Data Type Semantics: totalCounter 2835 ElementId: 135 2836 Status: current 2837 Units: packets 2839 5.9.15. postMCastPacketDeltaCount 2841 Description: 2842 The number of outgoing multicast packets since the previous report 2843 (if any) sent for packets of this Flow by a multicast daemon 2844 within the Observation Domain. This property cannot necessarily 2845 be observed at the Observation Point, but may be retrieved by 2846 other means. 2847 Abstract Data Type: unsigned64 2848 Data Type Semantics: deltaCounter 2849 ElementId: 19 2850 Status: current 2851 Units: packets 2853 5.9.16. postMCastOctetDeltaCount 2855 Description: 2856 The number of octets since the previous report (if any) in 2857 outgoing multicast packets sent for packets of this Flow by a 2858 multicast daemon within the Observation Domain. This property 2859 cannot necessarily be observed at the Observation Point, but may 2860 be retrieved by other means. The number of octets include IP 2861 header(s) and IP payload. 2862 Abstract Data Type: unsigned64 2863 Data Type Semantics: deltaCounter 2864 ElementId: 20 2865 Status: current 2866 Units: octets 2868 5.9.17. postMCastPacketTotalCount 2870 Description: 2871 The total number of outgoing multicast packets sent for packets of 2872 this Flow by a multicast daemon within the Observation Domain 2873 since the Metering Process (re-)initialization. This property 2874 cannot necessarily be observed at the Observation Point, but may 2875 be retrieved by other means. 2876 Abstract Data Type: unsigned64 2877 Data Type Semantics: totalCounter 2878 ElementId: 174 2879 Status: current 2880 Units: packets 2882 5.9.18. postMCastOctetTotalCount 2884 Description: 2885 The total number of octets in outgoing multicast packets sent for 2886 packets of this Flow by a multicast daemon in the Observation 2887 Domain since the Metering Process (re-)initialization. This 2888 property cannot necessarily be observed at the Observation Point, 2889 but may be retrieved by other means. The number of octets include 2890 IP header(s) and IP payload. 2891 Abstract Data Type: unsigned64 2892 Data Type Semantics: totalCounter 2893 ElementId: 175 2894 Status: current 2895 Units: octets 2897 5.10. Miscellaneous Flow Properties 2899 Information Elements in this section describe properties of Flows 2900 that are related to Flow start, Flow duration and Flow termination, 2901 but they are no time stamps as Information Elements in section 5.8. 2903 +-----+---------------------------+-----+---------------------------+ 2904 | ID | Name | ID | Name | 2905 +-----+---------------------------+-----+---------------------------+ 2906 | 36 | flowActiveTimeOut | 161 | flowDurationMilliSeconds | 2907 | 37 | flowInactiveTimeout | 162 | flowDurationMicroSeconds | 2908 | 136 | flowEndReason | | | 2909 +-----+---------------------------+-----+---------------------------+ 2911 5.10.1. flowActiveTimeOut 2913 Description: 2914 The number of seconds after which an active Flow is timed out 2915 anyway, even if there is still a continuous flow of packets. 2916 Abstract Data Type: unsigned16 2917 ElementId: 36 2918 Status: current 2919 Units: seconds 2921 5.10.2. flowInactiveTimeout 2922 Description: 2923 A Flow is considered to be timed out if no packets belonging to 2924 the Flow have been observed for the number of seconds specified by 2925 this field. 2926 Abstract Data Type: unsigned16 2927 ElementId: 37 2928 Status: current 2929 Units: seconds 2931 5.10.3. flowEndReason 2933 Description: 2934 The reason for Flow termination. The range of values includes 2936 0x01: idle timeout 2937 The flow was terminated because it was considered to be 2938 idle. 2939 0x02: active timeout 2940 The flow was terminated for reporting purposes while it was 2941 still active, for example, after the maximum lifetime of 2942 unreported flows was reached. 2943 0x03: end of Flow detected 2944 The flow was terminated because the Metering Process 2945 detected signals indicating the end of the flow, 2946 for example, the TCP FIN flag. 2947 0x04: forced end 2948 The flow was terminated because of some external event, 2949 for example, a shut down of the Metering Process initiated 2950 by a network management application. 2951 0x05: cache full 2952 the flow was terminated because of lack of resources 2953 available to the Metering Process and/or the Exporting 2954 Process 2956 Abstract Data Type: octet 2957 Data Type Semantics: identifier 2958 ElementId: 136 2959 Status: current 2961 5.10.4. flowDurationMilliSeconds 2963 Description: The difference between in time between the observation 2964 of the first packet of this Flow and the observation of the last 2965 packet of this Flow. 2967 Abstract Data Type: unsigned32 2968 ElementId: 161 2969 Status: current 2970 Units: milliseconds 2972 5.10.5. flowDurationMicroSeconds 2974 Description: The difference between in time between the observation 2975 of the first packet of this Flow and the observation of the last 2976 packet of this Flow. 2977 Abstract Data Type: unsigned32 2978 ElementId: 162 2979 Status: current 2980 Units: microseconds 2982 5.11. Padding 2984 This section contains a single Information Element only, that can be 2985 used for padding of Flow Records. 2987 IPFIX Implementations may wish to align Information Elements within 2988 Data Records or to align entire Data Records to 4 octet or 8 octet 2989 boundaries. This can be achieved by including one or more 2990 paddingOctets Information Elements in a Data Record. 2992 +-----+---------------------------+-----+---------------------------+ 2993 | ID | Name | ID | Name | 2994 +-----+---------------------------+-----+---------------------------+ 2995 | 210 | paddingOctets | | | 2996 +-----+---------------------------+-----+---------------------------+ 2998 5.11.1. paddingOctets 3000 Description: 3001 The value of this Information Element is always 0. 3002 Abstract Data Type: octetArray 3003 ElementId: 210 3004 Status: current 3006 6. Extending the Information Model 3008 A key requirement for IPFIX is to allow for extending the set of 3009 Information Elements which are reported. This section defines the 3010 mechanism for extending this set. 3012 Extension is done by defining new Information Elements. Each new 3013 Information Element MUST be assigned a unique Information Element 3014 identifier as part of its definition. These unique Information 3015 Element identifiers are the connection between the record structure 3016 communicated by the protocol using templates and a consuming 3017 application. For generally applicable Information Elements using 3018 IETF and IANA mechanisms for extending the information model is 3019 recommended. 3021 Names of new Information Elements SHOULD be chosen according to the 3022 naming conventions given in section 2.3. 3024 For extensions, the type space defined in section 3 can be used. If 3025 required, new data types can be added. New data types SHOULD be 3026 defined in IETF standards track documents. 3028 Enterprises may wish to define Information Elements without 3029 registering them with IANA. IPFIX explicitly supports enterprise- 3030 specific Information Elements. Enterprise-specific Information 3031 Elements as described in sections 2.1 and 4. 3033 However, before creating enterprise-specific Information Elements, 3034 the general applicability of such Information Elements should be 3035 considered. IPFIX does not support enterprise-specific data types. 3037 7. IANA Considerations 3039 This documents defines an initial set of IPFIX Information Elements. 3040 For extending them in the future, IANA needs to create a new registry 3041 for IPFIX Information Element identifiers. 3043 New assignments for IPFIX Information Elements will be administered 3044 by IANA, on a First Come First Served basis [RFC2434], subject to 3045 Expert Review [RFC2434], i.e. review by one of a group of experts 3046 designated by an IETF Operations and Management Area Director. The 3047 group of experts must double check the Information Elements 3048 definitions with already defined Information Elements for 3049 completeness, accuracy, redundancy, and correct naming following the 3050 naming conventions in section 2.3. Those experts will initially be 3051 drawn from the Working Group Chairs and document editors of the IPFIX 3052 and PSAMP Working Groups. 3054 Appendix B defines an XML schema which may be used to create 3055 consistent machine readable extensions to the IPFIX information 3056 model. This schema introduces a new namespace, which will be 3057 assigned by IANA according to RFC 3688. Currently the name space for 3058 this schema is identified as http://www.ietf.org/ipfix. 3060 8. Security Considerations 3062 The IPFIX information model itself does not directly introduce 3063 security issues. Rather it defines a set of attributes which may for 3064 privacy or business issues be considered sensitive information. 3066 The underlying protocol used to exchange the information described 3067 here must therefore apply appropriate procedures to guarantee the 3068 integrity and confidentiality of the exported information. Such 3069 protocols are defined in separate documents, specifically the IPFIX 3070 protocol document [I-D.ietf-ipfix-protocol]. 3072 9. Acknowledgements 3074 The editors thank Paul Callato for creating the initial version of 3075 this document, Thomas Dietz for developing the XSLT scripts that 3076 generate large portions of the text part of this document from the 3077 XML appendices, and Paul Aitken for a very detailed review that 3078 helped improving the document significantly. 3080 10. References 3082 10.1. Normative References 3084 [I-D.ietf-ipfix-protocol] 3085 Claise, B., "IPFIX Protocol Specification", 3086 draft-ietf-ipfix-protocol-12 (work in progress), 3087 April 2005. 3089 10.2. Informative References 3091 [I-D.ietf-ipfix-architecture] 3092 Sadasivan, G., Brownlee, N., Claise, B., and J. Quittek, 3093 "Architecture for IP Flow Information Export", 3094 draft-ietf-ipfix-architecture-07 (work in progress), 3095 March 2005. 3097 [I-D.ietf-ipfix-as] 3098 Zseby, T., Boschi, E., Brownlee, N., and B. Claise, "IPFIX 3099 Applicability", draft-ietf-ipfix-as-04 (work in progress), 3100 February 2005. 3102 [IEEE.754.1985] 3103 Institute of Electrical and Electronics Engineers, 3104 "Standard for Binary Floating-Point Arithmetic", 3105 IEEE Standard 754, August 1985. 3107 [IEEE.802-11.1999] 3108 "Information technology - Telecommunications and 3109 information exchange between systems - Local and 3110 metropolitan area networks - Specific requirements - Part 3111 11: Wireless LAN Medium Access Control (MAC) and Physical 3112 Layer (PHY) specifications", IEEE Standard 802.11, 1999, 3113 . 3116 [IEEE.802-3.2002] 3117 "Information technology - Telecommunications and 3118 information exchange between systems - Local and 3119 metropolitan area networks - Specific requirements - Part 3120 3: Carrier sense multiple access with collision detection 3121 (CSMA/CD) access method and physical layer 3122 specifications"", IEEE Standard 802.3, September 2002. 3124 [IEEE.P802-1Q.2003] 3125 Institute of Electrical and Electronics Engineers, "Local 3126 and Metropolitan Area Networks: Virtual Bridged Local Area 3127 Networks", IEEE Standard 802.1Q, March 2003. 3129 [ISO.10646-1.1993] 3130 International Organization for Standardization, 3131 "Information Technology - Universal Multiple-octet coded 3132 Character Set (UCS) - Part 1: Architecture and Basic 3133 Multilingual Plane", ISO Standard 10646-1, May 1993. 3135 [ISO.646.1991] 3136 International Organization for Standardization, 3137 "Information technology - ISO 7-bit coded character set 3138 for information interchange", ISO Standard 646, 1991. 3140 [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, 3141 August 1980. 3143 [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, 3144 September 1981. 3146 [RFC0792] Postel, J., "Internet Control Message Protocol", STD 5, 3147 RFC 792, September 1981. 3149 [RFC0793] Postel, J., "Transmission Control Protocol", STD 7, 3150 RFC 793, September 1981. 3152 [RFC1771] Rekhter, Y. and T. Li, "A Border Gateway Protocol 4 3153 (BGP-4)", RFC 1771, March 1995. 3155 [RFC1812] Baker, F., "Requirements for IP Version 4 Routers", 3156 RFC 1812, June 1995. 3158 [RFC1930] Hawkinson, J. and T. Bates, "Guidelines for creation, 3159 selection, and registration of an Autonomous System (AS)", 3160 BCP 6, RFC 1930, March 1996. 3162 [RFC2236] Fenner, W., "Internet Group Management Protocol, Version 3163 2", RFC 2236, November 1997. 3165 [RFC2402] Kent, S. and R. Atkinson, "IP Authentication Header", 3166 RFC 2402, November 1998. 3168 [RFC2406] Kent, S. and R. Atkinson, "IP Encapsulating Security 3169 Payload (ESP)", RFC 2406, November 1998. 3171 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an 3172 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 3173 October 1998. 3175 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 3176 (IPv6) Specification", RFC 2460, December 1998. 3178 [RFC2463] Conta, A. and S. Deering, "Internet Control Message 3179 Protocol (ICMPv6) for the Internet Protocol Version 6 3180 (IPv6) Specification", RFC 2463, December 1998. 3182 [RFC2547] Rosen, E. and Y. Rekhter, "BGP/MPLS VPNs", RFC 2547, 3183 March 1999. 3185 [RFC2629] Rose, M., "Writing I-Ds and RFCs using XML", RFC 2629, 3186 June 1999. 3188 [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group 3189 MIB", RFC 2863, June 2000. 3191 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., 3192 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., 3193 Zhang, L., and V. Paxson, "Stream Control Transmission 3194 Protocol", RFC 2960, October 2000. 3196 [RFC3031] Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol 3197 Label Switching Architecture", RFC 3031, January 2001. 3199 [RFC3032] Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y., 3200 Farinacci, D., Li, T., and A. Conta, "MPLS Label Stack 3201 Encoding", RFC 3032, January 2001. 3203 [RFC3036] Andersson, L., Doolan, P., Feldman, N., Fredette, A., and 3204 B. Thomas, "LDP Specification", RFC 3036, January 2001. 3206 [RFC3234] Carpenter, B. and S. Brim, "Middleboxes: Taxonomy and 3207 Issues", RFC 3234, February 2002. 3209 [RFC3260] Grossman, D., "New Terminology and Clarifications for 3210 Diffserv", RFC 3260, April 2002. 3212 [RFC3667] Bradner, S., "IETF Rights in Contributions", RFC 3667, 3213 February 2004. 3215 [RFC3668] Bradner, S., "Intellectual Property Rights in IETF 3216 Technology", RFC 3668, February 2004. 3218 [RFC3917] Quittek, J., Zseby, T., Claise, B., and S. Zander, 3219 "Requirements for IP Flow Information Export (IPFIX)", 3220 RFC 3917, October 2004. 3222 [RFC3954] Claise, B., "Cisco Systems NetFlow Services Export Version 3223 9", RFC 3954, October 2004. 3225 Appendix A. Formal Specification of IPFIX Information Element 3227 This appendix contains a formal description of the IPFIX information 3228 model XML document. Note that this appendix is of informational 3229 nature, while the text in section 4 generated from this appendix is 3230 normative. 3232 Using a formal and machine readable syntax for the Information model 3233 enables the creation of IPFIX aware tools which can automatically 3234 adapt to extensions to the information model, by simply reading 3235 updated information model specifications. 3237 The wide availability of XML aware tools and libraries for client 3238 devices is a primary consideration for this choice. In particular 3239 libraries for parsing XML documents are readily available. Also 3240 mechanisms such as the Extensible Stylesheet Language (XSL) allow for 3241 transforming a source XML document into other documents. This draft 3242 was authored in XML and transformed according to RFC2629. 3244 It should be noted that the use of XML in Exporters, Collectors or 3245 other tools is not mandatory for the deployment of IPFIX. In 3246 particular Exporting Processes do not produce or consume XML as part 3247 of their operation. It is expected that IPFIX Collectors MAY take 3248 advantage of the machine readability of the Information Model vs. 3249 hard coding their behavior or inventing proprietary means for 3250 accommodating extensions. 3252 3254 3258 3259 The IP version field in the IP packet header. 3260 3261 3262 3263 See RFC 791 for a definition of the version field in the 3264 IPv4 packet header. 3265 See RFC 2460 for a definition of the version field in the 3266 IPv6 packet header. 3267 Additional information on defined version numbers 3268 can be found at 3269 http://www.iana.org/assignments/version-numbers. 3270 3271 3272 3274 3278 3279 3280 The IPv4 source address in the IP packet header. 3281 3282 3283 3284 See RFC 791 for the definition of the IPv4 source address 3285 field. 3286 3287 3289 3293 3294 3295 The IPv6 source address in the IP packet header. 3296 3297 3298 3300 3303 3304 3305 The number of contiguous bits that are relevant in the 3306 sourceIPv4Prefix Information Element. 3307 3308 3309 bits 3310 0-32 3311 3313 3316 3317 3318 The number of contiguous bits that are relevant in the 3319 sourceIPv6Prefix Information Element. 3320 3321 3322 bits 3323 0-128 3324 3326 3329 3330 3331 IPv4 source address prefix. 3332 3333 3334 3336 3339 3340 3341 IPv6 source address prefix. 3342 3344 3345 3347 3351 3352 3353 The IPv4 destination address in the IP packet header. 3354 3355 3356 3357 See RFC 791 for the definition of the IPv4 destination address 3358 field. 3359 3360 3362 3366 3367 3368 The IPv6 destination address in the IP packet header. 3369 3370 3371 3373 3376 3377 3378 The number of contiguous bits that are relevant in the 3379 destinationIPv4Prefix Information Element. 3380 3381 3382 bits 3383 0-32 3384 3386 3389 3390 3391 The number of contiguous bits that are relevant in the 3392 destinationIPv6Prefix Information Element. 3393 3394 3395 bits 3396 0-128 3397 3399 3402 3403 IPv4 destination address prefix. 3404 3405 3407 3410 3411 IPv6 destination address prefix. 3412 3413 3415 3418 3419 3420 For IPv4, the value of the Information Element matches 3421 the value of the Time to Live field in the IPv4 packet 3422 header. For IPv6, the value of the Information Element 3423 matches the value of the Hop Limit field in the IPv6 3424 packet header. 3425 3426 3427 3428 See RFC 791 for the definition of the IPv4 Time to Live 3429 field. 3430 See RFC 2460 for the definition of the IPv6 Hop Limit 3431 field. 3432 3433 hops 3434 3436 3441 3442 3443 The value of the protocol number in the IP packet header. 3444 The protocol number identifies the IP packet payload type. 3445 Protocol numbers are defined in the IANA Protocol Numbers 3446 registry. 3448 3449 In Internet Protocol version 4 (IPv4) this is carried in the 3450 "Protocol" field. In Internet Protocol version 6 (IPv6) this 3451 is carried in the "Next Header" field in the last extension 3452 header of the packet. 3453 3454 3455 3456 See RFC 791 for the specification of the IPv4 protocol field. 3457 See RFC 2460 for the specification of the IPv6 protocol field. 3458 See the list of protocol numbers assigned by IANA at 3459 http://www.iana.org/assignments/protocol-numbers. 3460 3461 3462 3464 3467 3468 3469 The value of the Next Header field of the IPv6 header. 3470 The value identifies the type of the following IPv6 3471 extension header or of the following IP payload. 3472 Valid values are defined in the IANA 3473 Protocol Numbers registry. 3474 3475 3476 3477 See RFC 2460 for the definition of the IPv6 Next Header field. 3478 See the list of protocol numbers assigned by IANA at 3479 http://www.iana.org/assignments/protocol-numbers. 3480 3481 3483 3487 3488 3489 For IPv4 packets, this is the value of the TOS field in 3490 the IPv4 packet header. For IPv6 packets, this is the 3491 value of the Traffic Class field in the IPv6 packet header. 3492 3493 3494 3495 See section 5.3.2 of RFC 1812 and RFC 791 for the 3496 definition of the IPv4 TOS field. 3497 See RFC 2460 for the definition of the IPv6 Traffic Class 3498 field. 3499 3500 3502 3506 3507 3508 The value of a Differentiated Services Code Point (DSCP) 3509 encoded in the Differentiated Services Field. The 3510 Differentiated Services Field spans the most significant 3511 6 bits of the IPv4 TOS field or the IPv6 Traffic class 3512 field, respectively. 3513 3514 3515 This Information Element encodes only the 6 bits of the 3516 Differentiated Services field. Therefore its value may 3517 range from 0 to 63. 3518 3519 3520 0-63 3521 3522 See RFC 3260 for the definition of the Differentiated 3523 Services Field. 3524 See section 5.3.2 of RFC 1812 and RFC 791 for the 3525 definition of the IPv4 TOS field. 3526 See RFC 2460 for the definition of the IPv6 Traffic Class 3527 field. 3528 3529 3531 3535 3536 3537 The value of the IP Precedence. The IP Precedence value 3538 is encoded in the first 3 bits of the IPv4 TOS field 3539 or the IPv6 Traffic class field, respectively. 3540 3541 3542 This Information Element encodes only the 3 bits of the 3543 Differentiated Services field. Therefore its value may 3544 range from 0 to 7. 3545 3546 3547 0-7 3548 3549 See section 5.3.3 of RFC 1812 and RFC 791 for the 3550 definition of the IP Precedence. 3551 See section 5.3.2 of RFC 1812 and RFC 791 for the 3552 definition of the IPv4 TOS field. 3553 See RFC 2460 for the definition of the IPv6 Traffic Class 3554 field. 3555 3556 3558 3562 3563 3564 The value of the TOS field in the IPv4 packet header. 3565 3566 3567 3568 See RFC 791 for the definition of the IPv4 TOS field. 3569 3570 3572 3576 3577 3578 The definition of this Information Element is identical 3579 to the definition of Information Element 3580 'classOfServiceIPv4', except that it reports a 3581 potentially modified value caused by a middlebox 3582 function after the packet passed the observation point. 3583 3584 3585 3586 See RFC 791 for the definition of the IPv4 TOS field. 3587 See RFC 3234 for the definition of middleboxes. 3588 3589 3591 3595 3596 3597 The value of the Traffic Class field in the 3598 IPv6 packet header. 3599 3600 3601 3602 See RFC 2460 for the definition of the IPv6 Traffic Class 3603 field. 3604 3605 3607 3611 3612 3613 The definition of this Information Element is identical 3614 to the definition of Information Element 3615 'classOfServiceIPv6', except that it reports a 3616 potentially modified value caused by a middlebox 3617 function after the packet passed the observation point. 3618 3619 3620 3621 See RFC 2460 for the definition of the IPv6 traffic class 3622 field. 3623 3624 3626 3630 3631 3632 The value of the IPv6 Flow Label field in the IP packet header. 3634 3635 3636 3637 See RFC 2460 for a definition of the flow label field in the 3638 IPv6 packet header. 3639 3640 3642 3646 3647 3648 If the IP destination address is a reserved multicast 3649 address then the value of this Information Element is 3650 not equal to zero. Otherwise, the value of all bits 3651 of the octet is zero. 3652 3653 3654 The first bit of this octet is set to 1 if the Version 3655 field of the IP header has the value 4 and if the 3656 Destination Address field contains a reserved multicast 3657 address in the range from 224.0.0.0 to 239.255.255.255. 3658 Otherwise, this bit is set to 0. 3659 3660 3661 The second and third bit of this octet are reserved for 3662 future use. 3663 3664 3665 The remaining bits of the octet are only set to values 3666 other than zero if th IP Destination Address is a 3667 reserved IPv6 multicast address. Then the fourth bit 3668 of the octet is set to the value of the T flag in the 3669 IPv6 multicast address and the remaining four bits are 3670 set to the value of the scope field in the IPv6 3671 multicast address. 3672 3673 3674 0 1 2 3 4 5 6 7 3675 +------+------+------+------+------+------+------+------+ 3676 | MCv4 | RES. | RES. | T | IPv6 multicast scope | 3677 +------+------+------+------+------+------+------+------+ 3679 Bit 0: set to 1 if IPv4 multicast 3680 Bit 1-2: reserved for future use 3681 Bit 4: set to value of T-flag, if IPv6 multicast 3682 Bit 4-7: set to value of multicast scope if IPv6 multicast 3683 3684 3685 3686 See RFC 1112 for the specification of reserved IPv4 multicast 3687 addresses. 3688 See RFC 3513 for the specification of reserved IPv6 multicast 3689 addresses and the definition of the T-flag and the IPv6 3690 multicast scope. 3691 3692 3694 3698 3699 3700 The value of the IPv4 packet identification field 3701 in the IP packet header. 3702 3703 3704 3705 See RFC 791 for the definition of the IPv4 identification 3706 field. 3707 3708 3710 3714 3715 3716 The value of the IPv4 fragment offset field 3717 in the IP packet header. 3718 3719 3720 3721 3722 See RFC 791 for the specification of the IPv4 fragment offset. 3723 3724 3725 3727 3731 3732 3733 The value of the fragmentation bits 3734 in the IPv4 packet header. 3735 3736 3737 Bit 0: reserved, must be zero. 3738 Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. 3739 Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. 3740 Bits 3-7: (DC) Don't Care, value is irrelevant. 3742 0 1 2 3 4 5 6 7 3743 +---+---+---+---+---+---+---+---+ 3744 | | D | M | D | D | D | D | D | 3745 | 0 | F | F | C | C | C | C | C | 3746 +---+---+---+---+---+---+---+---+ 3747 3748 3749 3750 3751 See RFC 791 for the specification of the IPv4 fragment flags. 3752 3753 3754 3756 3759 3760 3761 The length of the IP header. For IPv6, the value of this 3762 Information Element is 40. 3763 3764 3765 3766 3767 See RFC 791 for the specification of the IPv4 header. 3768 See RFC 2460 for the specification of the IPv6 header. 3769 3770 3771 octets 3772 3774 3777 3778 3779 The length of the IPv4 header. 3780 3781 3782 3783 3784 See RFC 791 for the specification of the IPv4 header. 3785 3786 3787 octets 3788 3790 3793 3794 3795 The value of the Internet Header Length (IHL) field in 3796 the IPv4 header. It specifies the length of the header 3797 in units of 4 octets. 3798 3799 3800 3801 3802 See RFC 791 for the specification of the IPv4 header. 3803 3804 3805 4 octets 3806 3808 3811 3812 3813 The total length of the IPv4 packet. 3814 3815 3816 3817 3818 See RFC 791 for the specification of the IPv4 total length. 3819 3820 3821 octets 3822 3824 3827 3828 3829 The length of the IPv6 payload, i.e., the rest of the 3830 packet following the IPv6 header, in octets. Note that any 3831 extension headers present are considered part 3832 of the payload, i.e., included in the length count. 3833 3834 3835 This Information Element reports the value of the Payload 3836 Length field in the IPv6 header except in the case that 3837 the value of this field is zero and that there is a valid 3838 jumbo payload option. Then the value of the Jumbo Payload 3839 Length field in the jumbo payload option is reported. 3840 3841 3842 3843 3844 See RFC 2460 for the specification of the IPv6 payload length. 3845 See RFC 2675 for the specification of the IPv6 jumbo payload 3846 length. 3847 3848 3849 3851 3854 3855 3856 The effective length of the IP payload. 3857 3858 3859 For IPv4 packets the value of this Information Element is 3860 the difference between the total length of the IPv4 packet 3861 (as reported by Information Element totalLengthIPv4) and the 3862 length of the IPv4 header (as reported by Information Element 3863 headerLengthIPv4). 3864 3865 3866 For IPv6, the value of the Payload Length field 3867 in the IPv6 header is reported except in the case that 3868 the value of this field is zero and that there is a valid 3869 jumbo payload option. In this case the value of the 3870 Jumbo Payload Length field in the jumbo payload option 3871 is reported. 3872 3873 3874 3875 3876 See RFC 791 for the specification of IPv4 packets. 3877 See RFC 2460 for the specification of the IPv6 payload length. 3878 See RFC 2675 for the specification of the IPv6 jumbo payload 3879 length. 3880 3881 3882 3884 3888 3889 3890 The source port identifier in the transport header. 3891 For the transport 3892 protocols UDP, TCP and SCTP this is the source port number 3893 given in the respective header. This field MAY also be used 3894 for future transport protocols that have 16 bit source port 3895 identifiers. 3896 3897 3898 3899 3900 See RFC 768 for the definition of the UDP source port field. 3901 See RFC 793 for the definition of the TCP source port field. 3902 See RFC 2960 for the definition of SCTP. 3903 3904 Additional information on defined UDP and TCP port numbers can 3905 be found at http://www.iana.org/assignments/port-numbers. 3906 3907 3908 3910 3914 3915 3916 The destination port identifier in the transport header. 3917 For the transport protocols UDP, TCP and SCTP this is the 3918 destination port number given in the respective header. 3919 This field MAY also be used for future transport protocols 3920 that have 16 bit destination port identifiers. 3921 3923 3924 3925 3926 See RFC 768 for the definition of the UDP source port field. 3927 See RFC 793 for the definition of the TCP source port field. 3928 See RFC 2960 for the definition of SCTP. 3930 3931 Additional information on defined UDP and TCP port numbers can 3932 be found at http://www.iana.org/assignments/port-numbers. 3933 3934 3935 3937 3941 3942 The source port identifier in the UDP header. 3943 3944 3945 See RFC 768 for the definition of the UDP source port field. 3946 Additional information on defined UDP port numbers can 3947 be found at http://www.iana.org/assignments/port-numbers. 3948 3949 3951 3955 3956 The destination port identifier in the UDP header. 3957 3958 3959 See RFC 768 for the definition of the UDP source port field. 3960 Additional information on defined UDP port numbers can 3961 be found at http://www.iana.org/assignments/port-numbers. 3962 3963 3965 3968 3969 The value of the Length field in the UDP header. 3970 3971 3972 See RFC 768 for the specification of the UDP header. 3973 3974 octets 3975 3977 3981 3982 The source port identifier in the TCP header. 3983 3984 3985 See RFC 793 for the definition of the TCP source port field. 3986 Additional information on defined TCP port numbers can 3987 be found at http://www.iana.org/assignments/port-numbers. 3988 3989 3991 3995 3996 The destination port identifier in the TCP header. 3997 3998 3999 See RFC 793 for the definition of the TCP source port field. 4000 Additional information on defined TCP port numbers can 4001 be found at http://www.iana.org/assignments/port-numbers. 4002 4003 4005 4008 4009 The sequence number in the TCP header. 4010 4011 4012 See RFC 793 for the definition of the TCP sequence number. 4013 4014 4016 4020 4021 The acknowledgement number in the TCP header. 4022 4023 4024 See RFC 793 for the definition of the TCP acknowledgement 4025 number. 4026 4027 4029 4032 4033 The window field in the TCP header. 4034 4035 4036 See RFC 793 for the definition of the TCP window field. 4037 4038 4040 4043 4044 The urgent pointer in the TCP header. 4045 4046 4047 See RFC 793 for the definition of the TCP urgent pointer. 4048 4049 4051 4054 4055 The length of the TCP header. 4056 4057 4058 See RFC 793 for the definition of the TCP header. 4059 4060 octets 4061 4063 4067 4068 4069 Type and Code of the IPv4 ICMP message. The combination of 4070 both values is reported as (ICMP type * 256) + ICMP code. 4071 4072 4073 4074 See RFC 792 for a definition of the IPv4 ICMP type and code 4075 fields. 4076 4077 4079 4083 4084 4085 Type of the IPv4 ICMP message. 4086 4087 4088 4089 See RFC 792 for a definition of the IPv4 ICMP type field. 4090 4091 4093 4097 4098 4099 Code of the IPv4 ICMP message. 4100 4101 4102 4103 See RFC 792 for a definition of the IPv4 ICMP code field. 4104 4105 4107 4111 4112 4113 Type and Code of the IPv6 ICMP message. The combination of 4114 both values is reported as (ICMP type * 256) + ICMP code. 4115 4117 4118 4119 See RFC 2463 for a definition of the IPv6 ICMP type and code 4120 fields. 4121 4122 4124 4128 4129 4130 Type of the IPv6 ICMP message. 4131 4132 4133 4134 See RFC 2463 for a definition of the IPv6 ICMP type field. 4135 4136 4138 4142 4143 4144 Code of the IPv6 ICMP message. 4145 4146 4147 4148 See RFC 2463 for a definition of the IPv6 ICMP code field. 4149 4150 4152 4156 4157 The type field of the IGMP message. 4158 4159 4160 See RFC 2236 for a definition of the IGMP type field. 4161 4162 4164 4168 4169 4170 The IEEE 802 source MAC address field. 4171 4172 4173 4174 See IEEE.802-3.2002. 4175 4176 4178 4182 4183 4184 The definition of this Information Element is identical 4185 to the definition of Information Element 4186 'sourceMacAddress', except that it reports a 4187 potentially modified value caused by a middlebox 4188 function after the packet passed the observation point. 4189 4190 4191 4192 See IEEE.802-3.2002. 4193 4194 4196 4200 4201 4202 The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag 4203 Control Information field that was attached to the IP packet. 4204 4205 4206 4207 See IEEE.802-1Q.2003. 4208 4209 4211 4215 4216 4217 The definition of this Information Element is identical 4218 to the definition of Information Element 4219 'vlanId', except that it reports a 4220 potentially modified value caused by a middlebox 4221 function after the packet passed the observation point. 4222 4223 4224 4225 See IEEE.802-1Q.2003. 4226 4227 4229 4233 4234 4235 The IEEE 802 destination MAC address field. 4236 4237 4238 4239 See IEEE.802-3.2002. 4240 4241 4243 4247 4248 4249 The definition of this Information Element is identical 4250 to the definition of Information Element 4251 'destinationMacAddress', except that it reports a 4252 potentially modified value caused by a middlebox 4253 function after the packet passed the observation point. 4254 4255 4256 4257 See IEEE.802-3.2002. 4258 4259 4260 4264 4265 4266 The identifier of the 802.11 (Wi-Fi) channel used. 4267 4268 4269 4270 See IEEE.802-11.1999. 4271 4272 4274 4277 4278 4279 The Service Set IDentifier (SSID) identifying an 802.11 4280 (Wi-Fi) network used. According to IEEE.802-11.1999 the 4281 SSID is encoded into a string of up to 32 characters. 4282 4283 4284 4285 See IEEE.802-11.1999. 4286 4287 4289 4292 4293 The TTL field from the top MPLS label stack entry, 4294 i.e. the last label that was pushed. 4295 4296 4297 See RFC 3032 for the specification of the TTL field. 4298 4299 4301 4305 4306 4307 The Exp field from the top MPLS label stack entry, 4308 i.e. the last label that was pushed. 4309 4310 4311 Bit 0-4: Don't Care, value is irrelevant. 4312 Bit 5-7: MPLS Exp field 4314 0 1 2 3 4 5 6 7 4315 +---+---+---+---+---+---+---+---+ 4316 | don't care | Exp | 4317 +---+---+---+---+---+---+---+---+ 4318 4319 4320 4321 See RFC 3032 for the specification of the Exp field. 4322 See RFC 3270 for usage of the Exp field. 4323 4324 4326 4329 4330 The number of labels in the MPLS label stack. 4331 4332 4333 See RFC 3032 for the specification of the MPLS label 4334 stack. 4335 4336 label stack entries 4337 4339 4342 4343 The length of the MPLS label stack in units of octets. 4344 4345 4346 See RFC 3032 for the specification of the MPLS label 4347 stack. 4348 4349 octets 4350 4352 4355 4356 The size of the MPLS packet without the label stack. 4357 4358 4359 See RFC 3031 for the specification of MPLS packets. 4360 See RFC 3032 for the specification of the MPLS label 4361 stack. 4362 4363 octets 4364 4366 4370 4371 4372 The label, exp and s fields from the top MPLS label 4373 stack entry, i.e. the last label that was pushed. 4374 4375 4376 0 1 2 4377 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4378 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4379 | Label | Exp |S| 4380 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4382 Label: Label Value, 20 bits 4383 Exp: Experimental Use, 3 bits 4384 S: Bottom of Stack, 1 bit 4385 4386 4387 4388 See RFC 3032. 4389 4390 4392 4396 4397 4398 The label, exp, and s fields from the label stack entry that 4399 was pushed immediately before the label stack entry that would 4400 be reported by mplsTopLabelStackEntry. See the definition of 4401 mplsTopLabelStackEntry for further details. 4402 4403 4404 4405 See RFC 3032. 4406 4407 4409 4413 4414 4415 The label, exp, and s fields from the label stack entry that 4416 was pushed immediately before the label stack entry that would 4417 be reported by mplsLabelStackEntry2. See the definition of 4418 mplsTopLabelStackEntry for further details. 4419 4420 4421 4422 See RFC 3032. 4423 4424 4426 4430 4431 4432 The label, exp, and s fields from the label stack entry that 4433 was pushed immediately before the label stack entry that would 4434 be reported by mplsLabelStackEntry3. See the definition of 4435 mplsTopLabelStackEntry for further details. 4436 4437 4438 4439 See RFC 3032. 4440 4441 4443 4447 4448 4449 The label, exp, and s fields from the label stack entry that 4450 was pushed immediately before the label stack entry that would 4451 be reported by mplsLabelStackEntry4. See the definition of 4452 mplsTopLabelStackEntry for further details. 4453 4454 4455 4456 See RFC 3032. 4457 4458 4460 4464 4465 4466 The label, exp, and s fields from the label stack entry that 4467 was pushed immediately before the label stack entry that would 4468 be reported by mplsLabelStackEntry5. See the definition of 4469 mplsTopLabelStackEntry for further details. 4470 4471 4472 4473 See RFC 3032. 4474 4475 4477 4481 4482 4483 The label, exp, and s fields from the label stack entry that 4484 was pushed immediately before the label stack entry that would 4485 be reported by mplsLabelStackEntry6. See the definition of 4486 mplsTopLabelStackEntry for further details. 4487 4488 4489 4490 See RFC 3032. 4491 4492 4494 4498 4499 4500 The label, exp, and s fields from the label stack entry that 4501 was pushed immediately before the label stack entry that would 4502 be reported by mplsLabelStackEntry7. See the definition of 4503 mplsTopLabelStackEntry for further details. 4504 4505 4506 4507 See RFC 3032. 4508 4509 4511 4515 4516 4517 The label, exp, and s fields from the label stack entry that 4518 was pushed immediately before the label stack entry that would 4519 be reported by mplsLabelStackEntry8. See the definition of 4520 mplsTopLabelStackEntry for further details. 4521 4522 4523 4524 See RFC 3032. 4525 4526 4528 4532 4533 4534 The label, exp, and s fields from the label stack entry that 4535 was pushed immediately before the label stack entry that would 4536 be reported by mplsLabelStackEntry9. See the definition of 4537 mplsTopLabelStackEntry for further details. 4538 4539 4540 4541 See RFC 3032. 4542 4543 4545 4549 4550 4551 The IPv4 address of the next IPv4 hop. 4552 4553 4554 4556 4560 4561 4562 The IPv6 address of the next IPv6 hop. 4563 4564 4565 4567 4584 4588 4589 4590 The autonomous system (AS) number of the source IP address. 4591 If AS path information for this Flow is only available as 4592 unordered AS set (and not as ordered AS sequence), 4593 then the value of this Information Element is 0. 4594 4595 4596 4597 See RFC 1771 for a description of BGP-4 and 4598 see RFC 1930 for a definition of the AS number. 4599 4600 4602 4606 4607 4608 The autonomous system (AS) number of the destination IP 4609 address. If AS path information for this Flow is only 4610 available as unordered AS set (and not as ordered AS 4611 sequence), then the value of this Information Element is 0. 4612 4613 4614 4615 See RFC 1771 for a description of BGP-4 and 4616 see RFC 1930 for a definition of the AS number. 4617 4618 4620 4624 4625 4626 The autonomous system (AS) number of the first AS in the AS 4627 path to the destination IP address. The path is deduced 4628 by looking up the destination IP address of the Flow in the 4629 BGP routing information base. If AS path information for 4630 this Flow is only available as unordered AS set (and not as 4631 ordered AS sequence), 4632 then the value of this Information Element is 0. 4633 4634 4635 4636 See RFC 1771 for a description of BGP-4 and 4637 see RFC 1930 for a definition of the AS number. 4638 4639 4641 4645 4646 4647 The autonomous system (AS) number of the last AS in the AS 4648 path from the source IP address. The path is deduced 4649 by looking up the source IP address of the Flow in the BGP 4650 routing information base. If AS path information for this 4651 Flow is only available as unordered AS set (and not as 4652 ordered AS sequence), then the value of this Information 4653 Element is 0. In case of BGP asymmetry, the 4654 bgpPrevAdjacentAsNumber might not be 4655 able to report the correct value. 4656 4657 4658 4659 See RFC 1771 for a description of BGP-4 and 4660 see RFC 1930 for a definition of the AS number. 4661 4662 4664 4668 4669 4670 The IPv4 address of the next (adjacent) BGP hop. 4671 4672 4673 4674 See RFC 1771 for a description of BGP-4 and 4675 4676 4678 4682 4683 4684 The IPv6 address of the next (adjacent) BGP hop. 4685 4686 4687 4688 See RFC 1771 for a description of BGP-4. 4689 4690 4691 4695 4696 4697 This field identifies the control protocol that allocated the 4698 top of stack label. Defined values for this field include: 4699 4700 - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label 4701 - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label 4702 - 0x03 VPN: Any label associated with VPN 4703 - 0x04 BGP: Any label associated with BGP or BGP routing 4704 - 0x05 LDP: Any label associated with dynamically assigned 4705 labels using LDP 4706 4707 4708 4709 4710 See RFC 3031 for the MPLS label structure. 4711 See RFC 2547 for the association of MPLS labels with VPNs. 4712 See RFC 1771 for BGP and BGP routing. 4713 See RFC 3036 for LDP. 4714 and IP addresses. 4715 4716 4718 4722 4723 4724 The IPv4 address of the system that the MPLS top label will 4725 cause this Flow to be forwarded to. 4726 4727 4728 4729 See RFC 3031 for the association between MPLS labels 4730 and IP addresses. 4731 4732 4734 4738 4739 4740 The IPv6 address of the system that the MPLS top label will 4741 cause this Flow to be forwarded to. 4742 4743 4744 4745 See RFC 3031 for the association between MPLS labels 4746 and IP addresses. 4747 4748 4750 4754 4755 4756 The IPv4 address used by the Exporting Process. This is used 4757 by the Collector to identify the Exporter in cases where the 4758 identity of the Exporter may have been obscured by the use of 4759 a proxy. 4760 4761 4762 4764 4768 4769 4770 The IPv6 address used by the Exporting Process. This is used 4771 by the Collector to identify the Exporter in cases where the 4772 identity of the Exporter may have been obscured by the use of 4773 a proxy. 4774 4775 4776 4778 4781 4782 4783 Length of the smallest packet observed for this Flow. 4784 4785 4786 octets 4788 4790 4793 4794 4795 Length of the largest packet observed for this Flow. 4796 4797 4798 octets 4799 4801 4804 4805 4806 Minimum TTL value observed for any packet in this Flow. 4807 4808 4809 4811 4814 4815 4816 Maximum TTL value observed for any packet in this Flow. 4817 4818 4819 4821 4825 4826 4827 IPv4 options in packets of this Flow. 4828 The information is encoded in a set of bit fields. For 4829 each valid IPv4 option type there is a bit in this set. 4830 The bit is set to 1 if any observed packet of this Flow 4831 contains the corresponding IPv4 option type. Otherwise, 4832 if no observed packet of this Flow contained the 4833 respective IPv4 option type, the value of the 4834 corresponding bit is 0. 4835 4836 4837 The list of valid IPv4 options is maintained by IANA. 4838 Note that for identifying an option not just the 5-bit 4839 Option Number, but all 8 bits of the Option Type need to 4840 match one of the IPv4 options specified at 4841 http://www.iana.org/assignments/ip-parameters. 4842 4843 4844 Options are mapped to bits according to their option numbers. 4845 Option number X is mapped to bit X. 4846 The mapping is illustrated by the figure below. 4847 4848 4849 0 1 2 3 4 5 6 7 4850 +------+------+------+------+------+------+------+------+ 4851 | EOOL | NOP | SEC | LSR | TS |E-SEC |CIPSO | RR | ... 4852 +------+------+------+------+------+------+------+------+ 4854 8 9 10 11 12 13 14 15 4855 +------+------+------+------+------+------+------+------+ 4856 ... | SID | SSR | ZSU | MTUP | MTUR | FINN | VISA |ENCODE| ... 4857 +------+------+------+------+------+------+------+------+ 4859 16 17 18 19 20 21 22 23 4860 +------+------+------+------+------+------+------+------+ 4861 ... |IMITD | EIP | TR |ADDEXT|RTRALT| SDB |NSAPA | DPS | ... 4862 +------+------+------+------+------+------+------+------+ 4864 24 25 26 27 28 29 30 31 4865 +------+------+------+------+------+------+------+------+ 4866 ... | UMP | to be assigned by IANA | 4867 +------+------+------+------+------+------+------+------+ 4869 Type Option 4870 Bit Value Name Reference 4871 ---+-----+-------+------------------------------------ 4872 0 0 EOOL End of Options List, RFC 791 4873 1 1 NOP No Operation, RFC 791 4874 2 130 SEC Security, RFC 1108 4875 3 131 LSR Loose Source Route, RFC 791 4876 4 68 TS Time Stamp, RFC 791 4877 5 133 E-SEC Extended Security, RFC 1108 4878 6 134 CIPSO Commercial Security 4879 7 7 RR Record Route, RFC 791 4880 8 136 SID Stream ID, RFC 791 4881 9 137 SSR Strict Source Route, RFC 791 4882 10 10 ZSU Experimental Measurement 4883 11 11 MTUP (obsoleted) MTU Probe, RFC 1191 4884 12 12 MTUR (obsoleted) MTU Reply, RFC 1191 4885 13 205 FINN Experimental Flow Control 4886 14 142 VISA Experimental Access Control 4887 15 15 ENDOCE 4888 16 144 IMITD IMI Traffic Descriptor 4889 17 145 EIP Extended Internet Protocol, RFC 1385 4890 18 82 TR Traceroute, RFC 3193 4891 19 147 ADDEXT Address Extension 4892 20 148 RTRALT Router Alert, RFC 2113 4893 21 149 SDB Selective Directed Broadcast 4894 22 150 NSAPA NSAP Address 4895 23 151 DPS Dynamic Packet State 4896 24 152 UMP Upstream Multicast Pkt. 4897 ... ... ... Further options numbers 4898 may be assigned by IANA 4899 4900 4901 4902 See RFC 791 for the definition of IPv4 options. 4903 See the list of IPv4 option numbers assigned by IANA 4904 at http://www.iana.org/assignments/ip-parameters. 4905 4906 4908 4912 4913 4914 IPv6 extension headers observed in packets of this Flow. 4915 The information is encoded in a set of bit fields. For 4916 each IPv6 option header there is a bit in this set. 4917 The bit is set to 1 if any observed packet of this Flow 4918 contains the corresponding IPv6 extension header. 4919 Otherwise, if no observed packet of this Flow contained 4920 the respective IPv6 extension header, the value of the 4921 corresponding bit is 0. 4922 4923 4924 0 1 2 3 4 5 6 7 4925 +-----+-----+-----+-----+-----+-----+-----+-----+ 4926 | Res | FRA1| ROU | FRA0| UNK | Res | HOP | DST | ... 4927 +-----+-----+-----+-----+-----+-----+-----+-----+ 4929 8 9 10 11 12 13 14 15 4930 +-----+-----+-----+-----+-----+-----+-----+-----+ 4932 ... | PAY | AUT | ENC | Reserved | ... 4933 +-----+-----+-----+-----+-----+-----+-----+-----+ 4935 16 17 18 19 20 21 22 23 4936 +-----+-----+-----+-----+-----+-----+-----+-----+ 4937 ... | Reserved | ... 4938 +-----+-----+-----+-----+-----+-----+-----+-----+ 4940 24 25 26 27 28 29 30 31 4941 +-----+-----+-----+-----+-----+-----+-----+-----+ 4942 ... | Reserved | 4943 +-----+-----+-----+-----+-----+-----+-----+-----+ 4945 Bit IPv6 Option Description 4947 0, Res Reserved 4948 1, FRA1 44 Fragmentation header - not first fragment 4949 2, ROU 43 Routing header 4950 3, FRA0 44 Fragment header - first fragment 4951 4, UNK Unknown Layer 4 header 4952 (compressed, encrypted, not supported) 4953 5, Res Reserved 4954 6, HOP 0 Hop-by-hop option header 4955 7, DST 60 Destination option header 4956 8, PAY 108 Payload compression header 4957 9, AUT 51 Authentication Header 4958 10, ENC 50 Encrypted security payload 4959 11 to 31 Reserved 4960 4961 4962 4963 See RFC 2460 for the general definition of IPv6 extensions 4964 headers and for the specification of the hop-by-hop options 4965 header, the routing header, the fragment header, and the 4966 destination options header. 4967 See RFC 2402 for the specification of the authentication 4968 header. 4969 See RFC 2406 for the specification of the encapsulating 4970 security payload. 4971 4972 4974 4978 4979 4980 TCP control bits observed for packets of this Flow. 4981 The information is encoded in a set of bit fields. 4982 For each TCP control bit there is a bit in this 4983 set. A bit is set to 1 if any observed packet of this 4984 Flow has the corresponding TCP control bit set to 1. 4985 A value of 0 for a bit indicates that the corresponding 4986 bit was not set in any of the observed packets 4987 of this Flow. 4988 4989 4990 0 1 2 3 4 5 6 7 4991 +-----+-----+-----+-----+-----+-----+-----+-----+ 4992 | Reserved | URG | ACK | PSH | RST | SYN | FIN | 4993 +-----+-----+-----+-----+-----+-----+-----+-----+ 4995 Reserved: Reserved for future use by TCP. Must be zero. 4996 URG: Urgent Pointer field significant 4997 ACK: Acknowledgment field significant 4998 PSH: Push Function 4999 RST: Reset the connection 5000 SYN: Synchronize sequence numbers 5001 FIN: No more data from sender 5002 5003 5004 See RFC 793 for a definition of the TCP control bits 5005 in the TCP header. 5006 5008 5012 5013 5014 TCP options in packets of this Flow. 5015 The information is encoded in a set of bit fields. For 5016 each TCP option there is a bit in this set. 5017 The bit is set to 1 if any observed packet of this Flow 5018 contains the corresponding TCP option. 5019 Otherwise, if no observed packet of this Flow contained 5020 the respective TCP option, the value of the 5021 corresponding bit is 0. 5022 5023 5024 Options are mapped to bits according to their option 5025 numbers. Option number X is mapped to bit X. 5026 TCP option numbers are maintained by IANA. 5027 5029 5030 5031 See RFC 793 for the definition of TCP options. 5032 See the list of TCP option numbers assigned by IANA 5033 at http://www.iana.org/assignments/tcp-parameters. 5034 5035 5037 5040 5041 The absolute timestamp of the first packet of this Flow. 5042 5043 seconds 5044 5046 5049 5050 The absolute timestamp of the last packet of this Flow. 5051 5052 seconds 5053 5055 5058 5059 The absolute timestamp of the first packet of this Flow. 5060 5061 milliseconds 5062 5064 5067 5068 The absolute timestamp of the last packet of this Flow. 5069 5070 milliseconds 5071 5073 5076 5077 The absolute timestamp of the first packet of this Flow. 5078 5079 microseconds 5080 5082 5085 5086 The absolute timestamp of the last packet of this Flow. 5087 5088 microseconds 5089 5091 5094 5095 The absolute timestamp of the first packet of this Flow. 5096 5097 nanoseconds 5098 5100 5103 5104 The absolute timestamp of the last packet of this Flow. 5105 5106 nanoseconds 5107 5109 5112 5113 This is a relative time stamp only valid within the scope 5114 of a single IPFIX Message. It contains the negative time 5115 offset of the first observed packet of this Flow relative 5116 to the export time specified in the IPFIX Message header. 5117 5118 5119 See [I-D.ietf-ipfix-protocol] for the definition of the IPFIX 5120 Message header. 5121 5122 microseconds 5123 5124 5127 5128 This is a relative time stamp only valid within the scope 5129 of a single IPFIX Message. It contains the negative time 5130 offset of the last observed packet of this Flow relative 5131 to the export time specified in the IPFIX Message header. 5132 5133 5134 See [I-D.ietf-ipfix-protocol] for the definition of the IPFIX 5135 Message header. 5136 5137 microseconds 5138 5140 5144 5145 The absolute timestamp of the last (re-)initialization of the 5146 IPFIX Device. 5147 5148 milliseconds 5149 5151 5154 5155 The relative timestamp of the first packet of this Flow. 5156 It indicates the number of milliseconds since the 5157 last (re-)initialization of the IPFIX Device (sysUpTime). 5158 5159 milliseconds 5160 5162 5165 5166 The relative timestamp of the last packet of this Flow. 5167 It indicates the number of milliseconds since the 5168 last (re-)initialization of the IPFIX Device (sysUpTime). 5169 5170 milliseconds 5171 5172 5175 5176 5177 The number of seconds after which an active Flow is timed out 5178 anyway, even if there is still a continuous flow of packets. 5179 5180 5181 seconds 5182 5184 5187 5188 5189 A Flow is considered to be timed out if no packets belonging 5190 to the Flow have been observed for the number of seconds 5191 specified by this field. 5192 5193 5194 seconds 5195 5197 5201 5202 5203 The reason for Flow termination. The range of values includes 5204 5205 0x01: idle timeout 5206 The flow was terminated because it was considered to be 5207 idle. 5208 0x02: active timeout 5209 The flow was terminated for reporting purposes while it was 5210 still active, for example, after the maximum lifetime of 5211 unreported flows was reached. 5212 0x03: end of Flow detected 5213 The flow was terminated because the Metering Process 5214 detected signals indicating the end of the flow, 5215 for example, the TCP FIN flag. 5216 0x04: forced end 5217 The flow was terminated because of some external event, 5218 for example, a shut down of the Metering Process initiated 5219 by a network management application. 5221 0x05: cache full 5222 the flow was terminated because of lack of resources 5223 available to the Metering Process and/or the Exporting 5224 Process 5225 5226 5227 5228 5230 5233 5234 The difference between in time between the observation of the 5235 first packet of this Flow and the observation of the last 5236 packet of this Flow. 5237 5238 milliseconds 5239 5241 5244 5245 The difference between in time between the observation of the 5246 first packet of this Flow and the observation of the last 5247 packet of this Flow. 5248 5249 microseconds 5250 5252 5256 5257 5258 The number of octets since the previous report (if any) 5259 in incoming packets for this Flow at the Observation Point. 5260 The number of octets include IP header(s) and IP payload. 5261 5262 5263 octets 5264 5266 5270 5271 5272 The definition of this Information Element is identical 5273 to the definition of Information Element 5274 'octetDeltaCount', except that it reports a 5275 potentially modified value caused by a middlebox 5276 function after the packet passed the observation point. 5277 5278 5279 octets 5280 5282 5285 5286 5287 The sum of the squared numbers of octets per incoming 5288 packet since the previous report (if any) for this 5289 Flow at the Observation Point. 5290 The number of octets include IP header(s) and IP payload. 5291 5292 5293 5295 5299 5300 5301 The total number of octets in incoming packets 5302 for this Flow at the Observation Point since the Metering 5303 Process (re-)initialization for this Observation Point. The 5304 number of octets include IP header(s) and IP payload. 5305 5306 5307 octets 5308 5310 5314 5315 5316 The definition of this Information Element is identical 5317 to the definition of Information Element 5318 'octetTotalCount', except that it reports a 5319 potentially modified value caused by a middlebox 5320 function after the packet passed the observation point. 5321 5322 5323 octets 5324 5326 5329 5330 5331 The total sum of the squared numbers of octets in incoming 5332 packets for this Flow at the Observation Point since the 5333 Metering Process (re-)initialization for this Observation 5334 Point. The number of octets include IP header(s) and IP 5335 payload. 5336 5337 5338 octets 5339 5341 5345 5346 5347 The number of incoming packets since the previous report 5348 (if any) for this Flow at the Observation Point. 5349 5350 5351 packets 5352 5354 5358 5359 5360 The definition of this Information Element is identical 5361 to the definition of Information Element 5362 'packetDeltaCount', except that it reports a 5363 potentially modified value caused by a middlebox 5364 function after the packet passed the observation point. 5366 5367 5368 packets 5369 5371 5375 5376 5377 The total number of incoming packets for this Flow 5378 at the Observation Point since the Metering Process 5379 (re-)initialization for this Observation Point. 5380 5381 5382 packets 5383 5385 5389 5390 5391 The definition of this Information Element is identical 5392 to the definition of Information Element 5393 'packetTotalCount', except that it reports a 5394 potentially modified value caused by a middlebox 5395 function after the packet passed the observation point. 5396 5397 5398 packets 5399 5401 5405 5406 5407 The number of octets since the previous report (if any) 5408 in packets of this Flow dropped by packet treatment. 5409 The number of octets include IP header(s) and IP payload. 5410 5411 5412 octets 5413 5414 5418 5419 5420 The number of packets since the previous report (if any) 5421 of this Flow dropped by packet treatment. 5422 5423 5424 packets 5425 5427 5431 5432 5433 The total number of octets in packets of this Flow dropped 5434 by packet treatment since the Metering Process 5435 (re-)initialization for this Observation Point. 5436 The number of octets include IP header(s) and IP payload. 5437 5438 5439 octets 5440 5442 5446 5447 5448 The number of packets of this Flow dropped by packet 5449 treatment since the Metering Process 5450 (re-)initialization for this Observation Point. 5451 5452 5453 packets 5454 5456 5460 5461 5462 The number of outgoing multicast packets since the 5463 previous report (if any) sent for packets of this Flow 5464 by a multicast daemon within the Observation Domain. 5465 This property cannot necessarily be observed at the 5466 Observation Point, but may be retrieved by other means. 5467 5468 5469 packets 5470 5472 5476 5477 5478 The number of octets since the previous report (if any) 5479 in outgoing multicast packets sent for packets of this 5480 Flow by a multicast daemon within the Observation Domain. 5481 This property cannot necessarily be observed at the 5482 Observation Point, but may be retrieved by other means. 5483 The number of octets include IP header(s) and IP payload. 5484 5485 5486 octets 5487 5489 5493 5494 5495 The total number of outgoing multicast packets sent for 5496 packets of this Flow by a multicast daemon within the 5497 Observation Domain since the Metering Process 5498 (re-)initialization. This property cannot necessarily 5499 be observed at the Observation Point, but may be retrieved 5500 by other means. 5501 5502 5503 packets 5504 5506 5511 5512 5513 The total number of octets in outgoing multicast packets 5514 sent for packets of this Flow by a multicast daemon in the 5515 Observation Domain since the Metering Process 5516 (re-)initialization. This property cannot necessarily be 5517 observed at the Observation Point, but may be retrieved by 5518 other means. 5519 The number of octets include IP header(s) and IP payload. 5520 5521 5522 octets 5523 5525 5529 5530 5531 The total number of IPFIX Messages that the Exporting Process 5532 successfully sent since the Exporting Process 5533 (re-)initialization to the Collecting Process receiving a 5534 report that contains this Information Element. 5535 5536 5537 messages 5538 5540 5544 5545 5546 The total number of octets that the Exporting Process 5547 successfully sent since the Exporting Process 5548 (re-)initialization to the Collecting Process receiving a 5549 report that contains this Information Element. The value 5550 of this Information Element is calculated by summing up 5551 the IPFIX Message header length values of all IPFIX Messages 5552 that were successfully sent to the Collecting Process 5553 receiving a report that contains this Information Element. 5554 5555 5556 octets 5557 5558 5562 5563 5564 The total number of Flows Records that the Exporting 5565 Process successfully sent as Data Records since the Exporting 5566 Process (re-)initialization to the Collecting Process receiving 5567 a report that contains this Information Element. 5568 5569 5570 Flows 5571 5573 5577 5578 5579 The total number of Flows observed in the Observation Domain 5580 since the Metering Process (re-)initialization for this 5581 Observation Point. 5582 5583 5584 Flows 5585 5587 5591 5592 5593 The total number of observed IP packets that the 5594 Metering Process did not process since the 5595 (re-)initialization of the Metering Process. 5596 5597 5598 packets 5599 5601 5605 5606 5607 The total number of octets in observed IP packets 5608 that the Metering Process did not process since the 5609 (re-)initialization of the Metering Process. 5610 5611 5612 octets 5613 5615 5619 5620 5621 The total number of Flow Records that were generated by the 5622 Metering Process and but dropped by the Metering Process or 5623 by the Exporting Process 5624 instead of sending it to the Collecting Process. 5625 There are several potential reasons for this including 5626 resource shortage and special Flow export policies. 5627 5628 5629 Flows 5630 5632 5636 5637 5638 The total number of packets in Flow Records that were 5639 generated by the Metering Process and but dropped 5640 by the Metering Process or by the Exporting Process 5641 instead of sending it to the Collecting Process. 5642 There are several potential reasons for this including 5643 resource shortage and special Flow export policies. 5644 5645 5646 packets 5647 5649 5653 5654 5655 The total number of octets in packets in Flow Records 5656 that were generated by the Metering Process and but 5657 dropped by the Metering Process or by the Exporting 5658 Process instead of sending it to the Collecting Process. 5659 There are several potential reasons for this including 5660 resource shortage and special Flow export policies. 5661 5662 5663 octets 5664 5666 5670 5671 5672 This set of bit fields is used for marking the Information 5673 Elements of a Data Record that serve as Flow Key. Each bit 5674 represents an Information Element in the Data Record with 5675 the n-th bit representing the n-th Information Element. 5676 A set bit with value 1 indicates that the corresponding 5677 Information element is a Flow Key of the reported Flow. 5678 A value of 0 indicates that this is not the case. If the 5679 Data Record contains more than 64 Information Elements, the 5680 corresponding Template SHOULD be designed such that all Flow 5681 Keys are among the first 64 Information Elements, because the 5682 flowKeyIndicator only contains 64 bits. If the Data Record 5683 contains less than 64 Information Elements, then the bits in 5684 the flowKeyIndicator for which no corresponding Information 5685 Element exists SHOULD have the value 0. 5686 5687 5688 5690 5694 5695 5696 A locally unique identifier of a line card at an IPFIX 5697 Device hosting an Observation Point. Typically, this 5698 Information Element is used for limiting the scope 5699 of other Information Elements. 5700 5701 5703 5705 5709 5710 5711 A locally unique identifier of a line port at an IPFIX 5712 Device hosting an Observation Point. Typically, this 5713 Information Element is used for limiting the scope 5714 of other Information Elements. 5715 5716 5717 5719 5723 5724 5725 The index of the IP interface (ifIndex) where packets of 5726 this Flow are being received. 5727 5728 5729 5730 See RFC 2863 for the definition of the ifIndex object. 5731 5732 5734 5738 5739 5740 The index of the IP interface (ifIndex) where packets of 5741 this Flow are being sent. 5742 5743 5744 5745 See RFC 2863 for the definition of the ifIndex object. 5746 5747 5749 5753 5754 5755 A locally unique identifier of a Metering Process 5756 at an IPFIX Device. Typically, this 5757 Information Element is used for limiting the scope 5758 of other Information Elements. 5759 5760 5761 5763 5767 5768 5769 A locally unique identifier of an Exporting Process 5770 at an IPFIX Device. Typically, this 5771 Information Element is used for limiting the scope 5772 of other Information Elements. 5773 5774 5775 5777 5781 5782 5783 An identifier of a Flow that is unique within an Observation 5784 Domain. This Information Element can be used to distinguish 5785 between different Flows if Flow Keys such as IP addresses and 5786 port numbers are not reported or reported in separate 5787 records. 5788 5789 5790 5792 5796 5797 5798 An identifier of a Template that is locally unique to an 5799 Exporting Process. Typically, this Information Element is 5800 used for limiting the scope of other Information Elements. 5801 5802 5803 5805 5809 5810 5811 An identifier of an Observation Domain that is locally 5812 unique to an Exporting Process. Typically, this Information 5813 Element is used for limiting the scope of other Information 5814 Elements. 5815 5816 5817 5819 5822 5823 5824 The value of this Information Element is always 0. 5825 5826 5827 5829 5831 Appendix B. Formal Specification of Abstract Data Types 5833 This appendix containfs a formal description of the abstract data 5834 types to be used for IPFIX Information Elements and a formal 5835 description of the template used for defining IPFIX Information 5836 Elements. Note that this appendix is of informational nature, while 5837 the text in sections 2 and 3 generated from this appendix is 5838 normative. 5840 5841 5842 5847 5848 5849 5850 5851 The type "octet" represents a 5852 non-negative integer value in the range of 0 to 255. 5853 5854 5855 5857 5858 5859 The type "unsigned16" represents a 5860 non-negative integer value in the range of 0 to 65535. 5861 5862 5863 5865 5866 5867 The type "unsigned32" represents a 5868 non-negative integer value in the range of 0 to 5869 4294967295. 5870 5871 5872 5874 5875 5876 The type "unsigned64" represents a 5877 non-negative integer value in the range of 0 to 5878 18446744073709551615. 5879 5880 5881 5883 5884 5885 The type "float32" corresponds to an IEEE 5886 single-precision 32-bit floating point type as defined 5887 in [IEEE.754.1985]. 5888 5890 5891 5893 5894 5895 The type "boolean" represents a binary 5896 value. The only allowed values are "true" and false. 5897 5898 5899 5901 5902 5903 The type "macAddress" represents a 5904 string of 6 octets. 5905 5906 5907 5909 5910 5911 The type "octetArray" represents a finite 5912 length string of octets. 5913 5914 5915 5917 5918 5919 5920 The type "string" represents a finite length string 5921 of valid characters from the Unicode character encoding 5922 set [ISO.10646-1.1993]. Unicode allows for ASCII 5923 [ISO.646.1991] and many other international character 5924 sets to be used. It is expected that strings will be 5925 encoded in UTF-8 format, which is identical in encoding 5926 for ASCII characters, but also accommodates other Unicode 5927 multi-byte characters. 5928 5929 5930 5932 5933 5934 5935 The type "dateTimeSeconds" represents a time value 5936 in units of seconds normalized to the 5937 GMT time zone. 5939 5940 5941 5943 5944 5945 The type "dateTimeMilliSeconds" represents 5946 a time value in units of milliseconds 5947 normalized to the GMT time zone. 5948 5949 5950 5952 5953 5954 The type "dateTimeMicroSeconds" represents 5955 a time value in units of microseconds 5956 normalized to the GMT time zone. 5957 5958 5959 5961 5962 5963 The type "dateTimeNanoSeconds" represents 5964 a time value in units of nanoseconds 5965 normalized to the GMT time zone. 5966 5967 5968 5970 5971 5972 The type "ipv4Address" represents a value 5973 of an IPv4 address. 5974 5975 5976 5978 5979 5980 The type "ipv6Address" represents a value 5981 of an IPv6 address. 5982 5983 5984 5985 5986 5987 5988 5989 5990 5991 5992 A quantity value represents a discrete 5993 measured value pertaining to the record. This is 5994 distinguished from counters which represent an ongoing 5995 measured value whose "odometer" reading is captured as 5996 part of a given record. If no semantic qualifier is 5997 given, the Information Elements that have an integral 5998 data type should behave as a quantity. 5999 6000 6001 6003 6004 6005 6006 An integral value reporting the value of a counter. 6007 Basically the same semantics as counters in SNMP. 6008 Counters are unsigned and wrap back to zero after 6009 reaching the limit of the type. For example, an 6010 unsigned64 with counter semantics will continue to 6011 increment until reaching the value of 2**64 - 1. At 6012 this point the next increment will wrap its value to 6013 zero and continue counting from zero. A running counter 6014 counts independently of the export of its value. 6015 6016 6017 6019 6020 6021 6022 An integral value reporting the value of a counter. 6023 Basically the same semantics as counters in SNMP. 6024 Counters are unsigned and wrap back to zero after 6025 reaching the limit of the type. For example, an 6026 unsigned64 with counter semantics will continue to 6027 increment until reaching the value of 2**64 - 1. At 6028 this point the next increment will wrap its value to 6029 zero and continue counting from zero. A delta counter 6030 is reset to zero each time its value is exported. 6031 6032 6033 6034 6035 6036 6037 An integral value which serves as an identifier. 6038 Specifically mathematical operations on two 6039 identifiers (aside from the equality operation) are 6040 meaningless. For example, Autonomous System ID 1 * 6041 Autonomous System ID 2 is meaningless. 6042 6043 6044 6046 6047 6048 6049 An integral value which actually represents a set of 6050 bit fields. Logical operations are appropriate on 6051 such values, but not other mathematical operations. 6052 Flags should always be of an unsigned type. 6053 6054 6055 6056 6057 6059 6060 6061 6062 6063 6064 Used for Information Elements that are applicable to 6065 Flow Records only. 6066 6067 6068 6070 6071 6072 6073 Used for Information Elements that are applicable to 6074 option records only. 6075 6076 6077 6079 6080 6081 6082 Used for Information Elements that are applicable to 6083 Flow Records as well as to option records. 6084 6085 6086 6087 6088 6090 6091 6092 6093 6094 6095 Indicates that the Information Element definition 6096 is that the definition is current and valid. 6097 6098 6099 6101 6102 6103 6104 Indicates that the Information Element definition is 6105 obsolete, but it permits new/continued implementation 6106 in order to foster interoperability with older/existing 6107 implementations. 6108 6109 6110 6112 6113 6114 6115 Indicates that the Information Element definition is 6116 obsolete and should not be implemented and/or can be 6117 removed if previously implemented. 6118 6119 6120 6121 6122 6124 6129 6130 6131 6133 6134 6135 6137 6138 to be done ... 6139 6140 6141 6142 6144 6145 6146 6148 6149 to be done ... 6150 6151 6152 6154 6155 to be done ... 6156 6157 6158 6159 6161 6162 6163 6164 6165 6166 6167 6169 6170 6171 The semantics of this Information Element. 6172 Describes how this Information Element is 6173 derived from the Flow or other information 6174 available to the observer. 6175 6176 6178 6179 6187 6189 6190 6191 If the Information Element is a measure of some 6192 kind, the units identify what the measure is. 6193 6194 6195 6197 6199 6200 6201 Identifies additional specifications which more 6202 precisely define this item or provide additional 6203 context for its use. 6204 6205 6206 6208 6223 6225 6226 6227 Some Information Elements may only be able to 6228 take on a restricted set of values which can be 6229 expressed as a range (e.g. 0 through 511 6230 inclusive). If this is the case, the valid 6231 inclusive range should be specified. 6232 6233 6234 6235 6237 6238 6239 6240 A unique and meaningful name for the Information 6241 Element. 6242 6243 6244 6246 6248 6249 6250 One of the types listed in section 3.1 of this 6251 document or in a future extension of the 6252 information model. The type space for attributes 6253 is constrained to facilitate implementation. The 6254 existing type space does however encompass most 6255 basic types used in modern programming languages, 6256 as well as some derived types (such as ipv4Address) 6257 which are common to this domain and useful 6258 to distinguish. 6259 6260 6261 6263 6265 6266 6267 The integral types may be qualified by additional 6268 semantic details. Valid values for the data type 6269 semantics are specified in section 3.2 of this 6270 document or in a future extension of the 6271 information model. 6272 6273 6275 6277 6279 6280 6281 A numeric identifier of the Information Element. 6282 If this identifier is used without an enterprise 6283 identifier (see below), then it is globally unique 6284 and the list of allowed values is administered by 6285 IANA. It is used for compact identification of an 6286 Information Element when encoding templates in the 6287 protocol. 6288 6289 6290 6292 6294 6295 6296 Enterprises may wish to define Information Elements 6297 without registering them with IANA, for example for 6298 enterprise-internal purposes. For such Information 6299 Elements the Information Element identifier 6300 described above is not sufficient when the 6301 Information Element is used outside the enterprise. 6302 If specifications of enterprise-specific 6303 Information Elements are made public and/or if 6304 enterprise-specific identifiers are used by the 6305 IPFIX protocol outside the enterprise, then the 6306 enterprise-specific identifier MUST be made 6307 globally unique by combining it with an enterprise 6308 identifier. Valid values for the enterpriseId are 6309 defined by IANA as SMI network management private 6310 enterprise codes. They are defined at 6311 http://www.iana.org/assignments/enterprise-numbers. 6312 6313 6314 6316 6318 6319 This propoerty of an Information 6320 Element indicates in which kind of records the 6321 Information Element can be used. 6322 Allowed values for this property are 'data', 6323 'option', and 'all'. 6324 6325 6327 6329 6330 6331 The status of the specification of this 6332 Information Element. Allowed values are 'current', 6333 'deprecated', and 'obsolete'. 6334 6335 6336 6338 6340 6341 to be done ... 6342 6343 6345 6346 6347 6348 6350 6351 6353 6354 6355 6356 6358 Authors' Addresses 6360 Juergen Quittek 6361 NEC 6362 Kurfuersten-Anlage 36 6363 Heidelberg 69115 6364 Germany 6366 Phone: +49 6221 90511-15 6367 Email: quittek@netlab.nec.de 6368 URI: http://www.netlab.nec.de/ 6370 Stewart Bryant 6371 Cisco Systems 6372 250, Longwater, Green Park 6373 Reading RG2 6GB 6374 United Kingdom 6376 Email: stbryant@cisco.com 6378 Benoit Claise 6379 Cisco Systems 6380 De Kleetlaan 6a b1 6381 Diegem 1831 6382 Belgium 6384 Phone: +32 2 704 5622 6385 Email: bclaise@cisco.com 6387 Jeff Meyer 6388 PayPal 6389 2211 N. First St. 6390 San Jose, CA 95131-2021 6391 US 6393 Phone: +1 408 976-9149 6394 Email: jemeyer@paypal.com 6395 URI: http://www.paypal.com 6397 Intellectual Property Statement 6399 The IETF takes no position regarding the validity or scope of any 6400 Intellectual Property Rights or other rights that might be claimed to 6401 pertain to the implementation or use of the technology described in 6402 this document or the extent to which any license under such rights 6403 might or might not be available; nor does it represent that it has 6404 made any independent effort to identify any such rights. Information 6405 on the procedures with respect to rights in RFC documents can be 6406 found in BCP 78 and BCP 79. 6408 Copies of IPR disclosures made to the IETF Secretariat and any 6409 assurances of licenses to be made available, or the result of an 6410 attempt made to obtain a general license or permission for the use of 6411 such proprietary rights by implementers or users of this 6412 specification can be obtained from the IETF on-line IPR repository at 6413 http://www.ietf.org/ipr. 6415 The IETF invites any interested party to bring to its attention any 6416 copyrights, patents or patent applications, or other proprietary 6417 rights that may cover technology that may be required to implement 6418 this standard. Please address the information to the IETF at 6419 ietf-ipr@ietf.org. 6421 Disclaimer of Validity 6423 This document and the information contained herein are provided on an 6424 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 6425 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET 6426 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, 6427 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 6428 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 6429 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 6431 Copyright Statement 6433 Copyright (C) The Internet Society (2005). This document is subject 6434 to the rights, licenses and restrictions contained in BCP 78, and 6435 except as set forth therein, the authors retain all their rights. 6437 Acknowledgment 6439 Funding for the RFC Editor function is currently provided by the 6440 Internet Society.