idnits 2.17.1 draft-johnson-ipfix-mib-variable-export-04.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 12, 2012) is 4422 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Possible downref: Non-RFC (?) normative reference: ref. 'IANA-DATATYPES' -- Possible downref: Non-RFC (?) normative reference: ref. 'IANA-IPFIX' -- Possible downref: Non-RFC (?) normative reference: ref. 'IANA-SETS' -- Possible downref: Non-RFC (?) normative reference: ref. 'PEN' ** Obsolete normative reference: RFC 5101 (Obsoleted by RFC 7011) ** Obsolete normative reference: RFC 5102 (Obsoleted by RFC 7012) Summary: 2 errors (**), 0 flaws (~~), 1 warning (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 IPFIX Working Group B. Claise 3 Internet-Draft P. Aitken 4 Intended status: Standards Track S. B S 5 Expires: September 13, 2012 Cisco Systems, Inc. 6 J. Schoenwaelder 7 Jacobs University Bremen 8 March 12, 2012 10 Exporting MIB Variables using the IPFIX Protocol 11 draft-johnson-ipfix-mib-variable-export-04 13 Abstract 15 This document specifies a way to complement IPFIX Flow Records with 16 Management Base (MIB) objects, avoiding the need to define new IPFIX 17 Information Elements for existing Management Information Base objects 18 that are already fully specified. 20 This method requires an extension to the current IPFIX protocol. New 21 Template Set and Options Template Sets are specified to allow the 22 export of Simple Network Management Protocol (SNMP) MIB Objects along 23 with IPFIX Information Elements. 25 Status of this Memo 27 This Internet-Draft is submitted in full conformance with the 28 provisions of BCP 78 and BCP 79. 30 Internet-Drafts are working documents of the Internet Engineering 31 Task Force (IETF). Note that other groups may also distribute 32 working documents as Internet-Drafts. The list of current Internet- 33 Drafts is at http://datatracker.ietf.org/drafts/current/. 35 Internet-Drafts are draft documents valid for a maximum of six months 36 and may be updated, replaced, or obsoleted by other documents at any 37 time. It is inappropriate to use Internet-Drafts as reference 38 material or to cite them other than as "work in progress." 40 This Internet-Draft will expire on September 13, 2012. 42 Copyright Notice 44 Copyright (c) 2012 IETF Trust and the persons identified as the 45 document authors. All rights reserved. 47 This document is subject to BCP 78 and the IETF Trust's Legal 48 Provisions Relating to IETF Documents 49 (http://trustee.ietf.org/license-info) in effect on the date of 50 publication of this document. Please review these documents 51 carefully, as they describe your rights and restrictions with respect 52 to this document. Code Components extracted from this document must 53 include Simplified BSD License text as described in Section 4.e of 54 the Trust Legal Provisions and are provided without warranty as 55 described in the Simplified BSD License. 57 Table of Contents 59 1. Open Issues / To do list . . . . . . . . . . . . . . . . . . . 5 60 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 6 61 3. Motivation and Architectural Model . . . . . . . . . . . . . . 7 62 4. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 9 63 5. MIB OID Extended Template Formats . . . . . . . . . . . . . . 10 64 5.1. MIB OID Extended Template Record Format . . . . . . . . . 10 65 5.2. MIB OID Extended Options Template Record Format . . . . . 11 66 5.3. MIB OID Extended Field Specifier Format . . . . . . . . . 12 67 5.3.1. Standard Field Specifier Format . . . . . . . . . . . 13 68 5.3.2. Extended Field Specifier Format for a non-indexed 69 MIB Object . . . . . . . . . . . . . . . . . . . . . . 14 70 5.3.3. Extended Field Specifier Format for an Indexed MIB 71 Object, with an MIB OID as Index . . . . . . . . . . . 15 72 5.3.4. Extended Field Specifier Format for an Indexed MIB 73 Object, with an IPFIX Information Element as Index . . 18 74 5.3.5. Extended Field Specifier Format for an Indexed MIB 75 Object, with one IPFIX Information Element for the 76 OID segment identifying the instance . . . . . . . . . 20 77 5.4. Indices Considerations . . . . . . . . . . . . . . . . . . 23 78 5.5. Identifying the SNMP Context . . . . . . . . . . . . . . . 24 79 5.6. Template Management . . . . . . . . . . . . . . . . . . . 24 80 6. Example Use Cases . . . . . . . . . . . . . . . . . . . . . . 24 81 6.1. Without Using the Specifications in this Document . . . . 25 82 6.2. Non-indexed MIB Object: Established TCP Connections . . . 25 83 6.3. Enterprise Specific MIB Object: Detailing CPU Load 84 History . . . . . . . . . . . . . . . . . . . . . . . . . 28 85 6.4. Indexed MIB Object with an OID: Output Interface Queue 86 Size in PSAMP Packet Report . . . . . . . . . . . . . . . 30 87 6.5. Indexed MIB Object with Two OIDs: The 88 ipIfStatsInForwDatagrams . . . . . . . . . . . . . . . . . 34 89 6.6. Indexed MIB Object with an IPFIX Information Element: 90 Output Interface Queue Size in PSAMP Packet Report . . . . 36 91 6.7. Indexed MIB Objects with a mix of MIB OID and IPFIX 92 Information Element . . . . . . . . . . . . . . . . . . . 40 93 6.8. Indexed MIB Object with MIBInstanceIdentifier 94 Information Element: ipIfStatsOutOctets . . . . . . . . . 40 95 6.9. Using MIB Objects as IPFIX Options Scope fields . . . . . 42 96 6.9.1. Using non-Indexed MIB Objects as Option Scope 97 fields . . . . . . . . . . . . . . . . . . . . . . . . 42 98 6.9.2. Using Indexed MIB Objects as Option Scope fields . . . 44 99 6.10. Using MIB Objects with IPFIX Structured Data . . . . . . . 46 100 7. Configuration Considerations . . . . . . . . . . . . . . . . . 47 101 8. The Collecting Process's Side . . . . . . . . . . . . . . . . 47 102 9. Applicability . . . . . . . . . . . . . . . . . . . . . . . . 47 103 10. Security Considerations . . . . . . . . . . . . . . . . . . . 48 104 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 48 105 11.1. New Set IDs . . . . . . . . . . . . . . . . . . . . . . . 48 106 11.2. New Data Types . . . . . . . . . . . . . . . . . . . . . . 48 107 11.3. New Information Elements . . . . . . . . . . . . . . . . . 48 108 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 49 109 13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 49 110 13.1. Normative References . . . . . . . . . . . . . . . . . . . 49 111 13.2. Informative References . . . . . . . . . . . . . . . . . . 50 112 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 51 114 1. Open Issues / To do list 116 o Skipping the length. Is a new Set ID the right solution? 118 o "timestamps, exporters, and other animals" -> see the mailing 119 list. 121 o Question: index is an IPFIX IE that didn't appear the flow record? 122 Do we preclude this case? 124 o The value of the MIB OID acting as an index may not be of fixed 125 length and may have no default length, for example the OID can be 126 of type string or type MIB OID. 128 o "we can use the IE as an index if there is one and only one 129 similar with that length in the Template Records". To be 130 discussed. 132 o use case: no index count and no index OID in the SNMP agent -> add 133 this with the solution discussed with the DCM2.0 team. 135 o This also allows reduced size encoding for the indices. 137 o some TODO in the XML version: 139 * write section: "Indexed MIB Objects with a mix of MIB OID and 140 IPFIX Information Element" 142 * insert example: "Using MIB Objects with IPFIX Structured Data" 144 o Describe how to choose between multiple instances of the required 145 index field (eg, when the index is the egress interface for 146 multicast). eg, rather than specifying the index IE by ID, we 147 could specify it by number: the n'th field in the record. 149 o IPFIX Structured Data: how should it work? Add example to 150 "sectionStructuredData". 152 o How does the example in 5.5 work (ifOutQLen indexed by: ifIndex) 153 since ifIndex is not present in the record? 155 o How does the example in 5.8.2 work, since the ifName is indexed by 156 ifIndex which comes after - so the value is not already known. 158 o Improve the examples: Add an example with the mix of IPFIX IE and 159 OID in sectionUseIndexedwithaMixofOIDAndIPFIXIE. 161 o RFC 5610: explain what needs to be updated. 163 o ID to name mappings? -> use this for an example in section 5. 165 o What does this mean? : "(Consider the counter synchronization 166 issue, non-key info should be static)". 168 o Tidy up the XML. 170 o (JS) Do we need to add something about the contextEngineID and 171 contextName? Optionally associate context with template via 172 options Could be done with common properties or in a flow record 173 However, do we limit all MIB variables in a Template Record to a 174 single context? 3 cases: 176 1. if a simple SNMP agent, no contextEngineID and contextName, 177 because it's the default 179 2. the context information is valid for the entire flow record 181 3. the context information is specific for each IE within the 182 entire flow record 184 question regarding 3.: only one context for an entire flow or can 185 a flow record export MIB OID from different context? (JS): ask 186 the IPFIX mailing list. (BC): ask internally in Cisco Action: 187 complete the "Identifying the SNMP Context" section 189 o (JS) Inacio's figure: send email to the mailing list. 191 2. Introduction 193 There is growing interest in using IPFIX as a push mechanism for 194 exporting management information. Using a push protocol such as 195 IPFIX instead of a polling protocol like SNMP is especially 196 interesting in situations, where large chunks of repetitive data need 197 to be exported periodically. 199 While initially targeted at different problems, there is a large 200 parallel between the information transported via IPFIX and SNMP. 201 Furthermore, certain Management Information Base (MIB) objects are 202 highly relevant to flows as they are understood today. For example, 203 in the IPFIX information model [RFC5102], Information Elements coming 204 from the SNMP world have already been specified, e.g., 205 ingressInterface and egressInterface both refer to the ifIndex 206 defined in [RFC2863]. 208 Rather than mapping existing MIB objects to IPFIX Information 209 Elements on a case by case basis, it would be advantageous to enable 210 the export of any existing or future MIB objects as part of an IPFIX 211 Flow Record. This way, the duplication of data models [RFC3444], 212 both as SMI MIB objects and IPFIX Information Elements, out of the 213 same information model [RFC3444] would be avoided. 215 In this document, new Template Sets for Flow Records and Options 216 Records are specified to allow Templates to contain any combination 217 of fields defined by traditional IPFIX Information Element(s) and/or 218 MIB Object Identifier(s). The MIB Object Identifiers can reference 219 either non-indexed or indexed MIB object(s). Note that the 220 enterprise-specific MIB Object Identifiers are also supported. 222 When an indexed MIB object is exported, a method to identify how that 223 MIB object is indexed is specified so that the full meaning of the 224 information being exported can be conveyed. The specifications 225 encompasses the different index types for the MIB Objects Identifier: 226 indexed by one or multiple MIB variable(s), indexed by one or 227 multiple IPFIX Information Element(s), indexed by a mix of MIB 228 variable(s) and IPFIX Information Element(s). A set of example use 229 cases is used to illustrate how these specifications can be used. 231 Some Exporters may not have the knowledge to convey the full 232 information on how the MIB objects being exported are indexed. They 233 may not know the index count and/or the OID's of the objects that are 234 used to index a MIB object. In such cases the Exporter can send the 235 the values of the index OID's identifying the instance of the object 236 being exported as one string that conveys the instance identifier 237 part of an object being exported. The Collecting Process may know 238 how a MIB object is indexed by some other means, for example, it 239 could compile this information from the MIB Module that defines 240 exported MIB object or the Collecting Process could be hardcoded with 241 this information for a pre-defined set of MIB objects that it is 242 interested in. An example use case is used to illustrate this 243 mechanism. 245 3. Motivation and Architectural Model 247 Most Flow Records contain the ingressInterface and/or the 248 egressInterface Information Element. These Information Elements 249 carry an ifIndex value, a MIB object defined in [RFC2863]. In order 250 to retrieve additional information about the identified interface, a 251 Collector could simply poll relevant objects from the device running 252 the Exporter via SNMP, however, that approach has several problems: 254 o It requires implementing a mediation function between two data 255 models, i.e., MIB objects and IPFIX Information Elements. 257 o Confirming the validity of simple mappings (e.g., ifIndex to 258 ifName) requires to either check on a regular basis that the 259 Exporter's network management system did not reload, or to impose 260 ifIndex persistence across an Exporter's reload. 262 o Synchronization problems occur since counters carried in Flow 263 Records and counters carried in SNMP messages are retrieved from 264 the Exporter at different points in time and thus can't be 265 correlated. In the best case, assuming very tight integration of 266 an IPFIX Collector with and SNMP polling engine, SNMP data is 267 retrieved shortly after Data Records have been received, which 268 implies the sum of the active or inactive timeouts (if not null) 269 plus the time to export the Flow Record to the Collector. If, 270 however, the SNMP data is retrieved by a generic Network 271 Management Station (NMS) polling interface statistics, then the 272 time lag between IPFIX counters and SNMP counters can be 273 significant. 275 The intended scope of this work is the addition of MIB variable(s) to 276 IPFIX Information Elements in Flow Records, in order to complement 277 the Flow Records with useful and already standardized information. 278 More specifically, the case of an existing Template Record, which 279 needed to be augmented with some MIB variables whose index was 280 already present in the Template Record as an IPFIX Information 281 Element: typically, a 7-tuple Flow Record containing the 282 ingressInterface Information Element, augmented by interface counters 283 [RFC2863], which are indexed by the respective ingressInterface 284 values in the Flow Records. 286 The intended goal of this work is not a replacement of SNMP 287 notifications, even if the specifications in this document could 288 potentially allow this. Since IPFIX is a push mechanism, initiated 289 from the Exporter with no acknowledgment method, this specification 290 does not provide the ability to execute configuration changes. 292 The Distributed Management Expression MIB [RFC2982], which is a 293 mechanism to create new MIB variables based on the content of 294 existing ones, could also be advantageous in this context of this 295 specification. Indeed, newly created MIB object (for example, the 296 link utilization MIB variable), created with the Distributed 297 Management Expression MIB [RFC2982] could nicely complement Flow 298 Records. 300 Another advantage of exporting MIB objects via IPFIX is that IPFIX 301 would benefit from an extended series of types to be exported. The 302 simple and application-wide data types specified in SMIv2 [RFC2578], 303 along with a new textual conventions, can be exported within IPFIX 304 and then decoded in the Collector. 306 +------+ +-------+ +.........+ +.....+ 307 | SNMP | | IPFIX | : NETCONF : : CLI : 308 +------+ +-------+ +.........+ +.....+ 309 | | | | 310 +--------------------------------------------+ 311 | Instrumentation (specified in MIB modules) | 312 +--------------------------------------------+ 314 Figure 1: Architectural Model 316 The overall architectural model is depicted in Figure 1. The IPFIX 317 Exporter accesses the device's instrumentation, which follows the 318 specifications contained in MIB modules. Other management interfaces 319 such as NETCONF or the device's Command Line Interface (CLI) may 320 provide access to the same instrumentation. 322 4. Terminology 324 IPFIX-specific terminology (Information Element, Template, Template 325 Record, Options Template Record, Template Set, Collector, Exporter, 326 Flow Record, etc.) used in this document is defined in Section 2 of 327 [RFC5101]. As in [RFC5101], these IPFIX-specific terms have the 328 first letter of a word capitalized. 330 This document prefers the more generic term "Data Record" as opposed 331 to "Flow Record" as this specification allows the export of MIB 332 objects. 334 MIB Object Identifier (MIB OID) 336 An ASCII character sequences of decimal non-negative sub- 337 identifier values. Each sub-identifier value MUST NOT exceed 338 2^32-1 (4294967295) and MUST NOT have leading zeros. Sub- 339 identifiers are separated by single dots and without any 340 intermediate whitespace. 342 MIB Object Identifier Information Element 344 An IPFIX Information Element ("MIBObjectIdentifierMarker") that 345 denotes that a MIB Object Identifier is exported in the 346 (Options) Template Record. 348 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 349 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 350 "OPTIONAL" in this document are to be interpreted as described in 351 [RFC2119]. 353 5. MIB OID Extended Template Formats 355 Extended Template Record Formats are required to export data defined 356 by MIB Object Identifiers. New Template Sets are required for these 357 extended Template Record Formats. 359 5.1. MIB OID Extended Template Record Format 361 The format of the MIB Object Identifier Extended Template Record is 362 shown in Figure 2. It consists of a Template Record Header and one 363 or more Field Specifiers. 365 +---------------------------------------------------+ 366 | Template Record Header | 367 +---------------------------------------------------+ 368 | Field Specifier | 369 +---------------------------------------------------+ 370 | Field Specifier | 371 +---------------------------------------------------+ 372 ... 373 +---------------------------------------------------+ 374 | Field Specifier | 375 +---------------------------------------------------+ 377 Figure 2: MIB Object Identifier Extended Template Record Format 379 A MIB Object Identifier Extended Template Record MUST contain at 380 least one MIB Object Identifier Extended Field Specifier. It MAY 381 also contain any combination of IANA-assigned and/or enterprise- 382 specific Information Element identifiers as specified in [RFC5101]. 384 The format of the Template Record Header is shown in Figure 3. 386 0 1 2 3 387 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 388 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 389 | Template ID (> 255) | Field Count | 390 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 392 Figure 3: Template Record Header Format 394 Where: 396 Template ID 398 Template ID of this Template Record. This value is greater 399 than 255. 401 Field Count 403 Number of all fields in this Template Record. 405 At this level of detail the layout of the Template Record Format, as 406 specified in [RFC5101], and the MIB Object Identifier Extended 407 Template Record Format are identical. It is only the structure of 408 the Field Specifiers that is different (see Section 5.3). 410 5.2. MIB OID Extended Options Template Record Format 412 The format of the MIB Object Identifier Extended Options Template 413 Record is shown in Figure 4. It consists of an Options Template 414 Record Header and one or more Field Specifiers. 416 +---------------------------------------------------+ 417 | Options Template Record Header | 418 +---------------------------------------------------+ 419 | Field Specifier | 420 +---------------------------------------------------+ 421 | Field Specifier | 422 +---------------------------------------------------+ 423 ... 424 +---------------------------------------------------+ 425 | Field Specifier | 426 +---------------------------------------------------+ 428 Figure 4: MIB Object Identifier Options Extended Template Record 429 Format 431 A MIB Object Identifier Extended Options Template Record MUST contain 432 at least one MIB Object Identifier Extended Field Specifier, which 433 MAY be a scope field. It MAY also contain any combination of IANA- 434 assigned and/or enterprise-specific Information Element identifiers. 436 The format of the Options Template Record Header is shown in 437 Figure 5. 439 0 1 2 3 440 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 441 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 442 | Template ID (> 255) | Field Count | 443 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 444 | Scope Field Count | 445 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 447 Figure 5: Options Template Record Header Format 449 Where: 451 Template ID 453 Template ID of this Template Record. This value is greater 454 than 255. 456 Field Count 458 Number of all fields in this Template Record, including the 459 Scope Fields. 461 Scope Field Count 463 Number of scope fields in this Options Template Record. The 464 Scope Fields are normal Fields except that they are interpreted 465 as Scope at the Collector. The Scope Field Count MUST NOT be 466 zero for an Options Template Record. 468 As with the Template Record Format, the only difference between the 469 standard Options Template Record Format as defined in [RFC5101] and 470 the MIB Object Identifier Extended Template Options Record Format is 471 the structure of the Field Specifiers (see Section 5.3). 473 Both indexed and non-indexed MIB Objects may be used as scope fields 474 in an IPFIX Options Template Record. Each scope MIB object is 475 included in the IPFIX Scope Field Count. When indexed MIB Objects 476 are used, the index information is not included in the Scope Field 477 Count since the size of the index information is already specified in 478 the MIB Object's "index count" field (see Section 5.3.3). Examples 479 are given in Section 6.9. 481 5.3. MIB OID Extended Field Specifier Format 483 This section specifies how the Field Specifier format in [RFC5101] is 484 extended to allow fields to be defined using a specified MIB Object. 485 First for a MIB Object Identifier that is a non-indexed MIB object, 486 then for an indexed MIB object. 488 The Field Specifier formats are shown in Figure 6 to Figure 9 below. 490 5.3.1. Standard Field Specifier Format 492 The Field Specifier format in Figure 6, along with the associated 493 definitions, has been copied from [RFC5101], for an easier comparison 494 with the MIB Object Identifier Extended Field Specifier Format in 495 Figure 7 through Figure 9. 497 When exporting an IANA-assigned and/or enterprise-specific IPFIX 498 Information Element identifier, the Field Specifier Format is the 499 same as shown below. 501 0 1 2 3 502 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 503 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 504 |E| Information Element ident. | Field Length | 505 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 506 | Enterprise Number | 507 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 509 Figure 6: Standard Field Specifier format 511 Where: 513 E 515 Enterprise bit. This is the first bit of the Field Specifier. 516 If this bit is zero, the Information Element Identifier 517 identifies an IETF specified Information Element, and the four 518 octet Enterprise Number field MUST NOT be present. If this bit 519 is one, the Information Element identifier identifies an 520 enterprise-specific Information Element, and the Enterprise 521 Number filed MUST be present. 523 Information Element identifier 525 A numeric value that represents the type of the Information 526 Element. Refer to [RFC5102]. 528 Field Length 530 The length of the corresponding encoded Information Element, in 531 octets. Refer to [RFC5102]. The field length may be smaller 532 than the definition in [RFC5102] if reduced size encoding is 533 used. The value 65535 is reserved for variable length 534 Information Element. 536 Enterprise Number 538 IANA enterprise number [PEN] of the authority defining the 539 Information Element identifier in this Template Record. 541 5.3.2. Extended Field Specifier Format for a non-indexed MIB Object 543 When a MIB object is to be exported, a special Information Element 544 value is used to show that the extended Field Specifier is being 545 used, as shown in Figure 7: 547 0 1 2 3 548 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 549 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 550 |E| MIB OID IE | Field Length | 551 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 552 |Index Count = 0| MIB OID Len | MIB Object Identifier ... | 553 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 554 | ... MIB Object Identifier continued | 555 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 557 Figure 7: MIB Object Identifier Extended Field Specifier Format for a 558 non-indexed MIB Object with an OID length < 255 560 Where: 562 E 564 Enterprise bit. This is the first bit of the Field Specifier. 565 The value is always set to 0 for the MIB Object Identifier 566 Extended Field Specifier Format, even if the MIB Object 567 Identifier is enterprise-specific, because the MIB OID IE is an 568 IANA standard field and is not enterprise-specific. 570 MIB OID IE 572 Special IPFIX Information Element, MIBObjectIdentifierMarker, 573 that denotes that a MIB object is exported in the (Options) 574 Template Record. When the MIB Object Identifier Information 575 Element (MIB OID IE) is used, the MIB Object Identifier must be 576 specified in the MIB Object Identifier Extended Field Specifier 577 for the Collecting Process to be able to decode the Records. 579 Field Length 581 The definition is as [RFC5101]. Note that the Field Length can 582 be expressed using reduced size encoding per [RFC5101]. 584 Index Count 586 The number of indices for a MIB object. Set to zero for a non- 587 indexed MIB object. 589 MIB Object Identifier Length 591 The length of the textual representation of the MIB Object 592 Identifier that follows. This is encoded in the same manner as 593 the variable length encoding in [RFC5101]. If the length of 594 the MIB Object Identifier is greater than or equal to 255 595 octets, the length is encoded into 3 octets before the MIB 596 Object Name, where the first octet is 255 and the length is 597 carried in the second and third octets as shown in Figure 8. 598 If the MIB Object Identifier is longer than 254 characters then 599 the length MUST be extended. 601 MIB Object Identifier 603 The textual representation of a MIB object identifier as 604 defined in Section 4. 606 0 1 2 3 607 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 608 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 609 |E| MIB OID IE | Field Length | 610 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 611 |Index Count = 0| 255 | MIB Object Identifier Length | 612 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 613 | MIB Object Identifier ... | 614 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 615 | ... MIB Object Identifier continued | 616 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 618 Figure 8: MIB Object Identifier Extended Field Specifier Format for a 619 non-indexed MIB Object with an OID length >= 255 621 5.3.3. Extended Field Specifier Format for an Indexed MIB Object, with 622 an MIB OID as Index 624 The mechanism for "Extended Field Specifier Format for non-indexed 625 MIB Object" in Section 5.3.2 can be used for exporting any MIB 626 objects, including indexed MIB objects. However, per the nature of 627 indexing in MIB module, every indexed object is specified by a new 628 MIB Object Identifier, which in turn implies that a new Template 629 Record must be used for every indexed object. For example, the 630 ifInOctets for the interface represented by the interface ifIndex 1 631 is ifInOctets.1, the ifInOctets for the interface represented by the 632 interface ifIndex 2 is ifInOctets.2, ... This makes the export 633 mechanism for "Extended Field Specifier Format for non-indexed MIB 634 Object" inefficient when used for indexed MIB objects. An example is 635 shown in Section 6.1. 637 When an indexed MIB object is exported in IPFIX, either the meaning 638 of the exported value of each index may be identified or the complete 639 OID segment identifying the instance can be sent as one piece. When 640 the meaning of each index is identified, this index (or indices) MUST 641 be a MIB Object Identifier (this section) or an IPFIX Information 642 Element (see Section 5.3.4). 644 A MIB Object Identifier MAY be used as an index and sent as described 645 in Figure 9. However, if a MIB Object Identifier with an index is 646 used as an index then its indices will not be identified. 648 0 1 2 3 649 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 650 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 651 |E| MIB OID IE | Field Length | 652 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 653 | Index Count | MIB OID Len | MIB Object Identifier ... | 654 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 655 | ... MIB Object Identifier continued | 656 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 657 |E| MIB OID IE | Index Field length | 658 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 659 |Idx MIB OID Len| Index MIB Object Identifier ... | 660 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 661 | ... Index MIB Object Identifier continued ... | 662 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 663 ... 665 Figure 9: MIB Object Identifier Extended Field Specifier Format with 666 a MIB Index using a normal MIB Object Identifier as index 668 Where: 670 E 672 Enterprise bit. This is the first bit of the Field Specifier. 673 The value is always set to 0 for the MIB Object Identifier 674 Extended Field Specifier Format, even if the MIB Object 675 Identifier is enterprise-specific, because the MIB OID IE is an 676 IANA standard field and is not enterprise-specific. 678 MIB OID IE 680 Special IPFIX Information Element, MIBObjectIdentifierMarker, 681 that denotes that a MIB object is exported in the (Options) 682 Template Record. When the MIB Object Identifier Information 683 Element (MIB OID IE) is used, the MIB Object Identifier must be 684 specified in the MIB Object Identifier Extended Field Specifier 685 for the Collecting Process to be able to decode the Records. 687 Field Length 689 The definition is as [RFC5101]. Note that the Field Length can 690 be expressed using reduced size encoding per [RFC5101]. 692 Index Count 694 The number of indices for a MIB object, and zero for a non- 695 indexed MIB object. 697 MIB Object Identifier Length 699 The length of the textual representation of the MIB Object 700 Identifier that follows. This is encoded in the same manner as 701 the variable length encoding in [RFC5101]. If the length of 702 the MIB Object Identifier is greater than or equal to 255 703 octets, the length is encoded into 3 octets before the MIB 704 Object Name Where the first octet is 255 and the length is 705 carried in the second and third octets (as shown in Figure 8). 706 If the MIB Object Identifier is longer than 254 characters then 707 the length MUST be extended. 709 MIB Object Identifier 711 The textual representation of a MIB object identifier as 712 defined in Section 4. For any indices identified using 713 Information Elements the Enterprise bit can be 1, indicating 714 that an Enterprise Number will follow the Information Element. 716 Index Field Length 718 The length of the encoded index field, in octets, per the Field 719 Length definition in [RFC5101]. Note that the Index Field 720 Length can be expressed using reduced size encoding per 721 [RFC5101]. 723 Index MIB Object Identifier Length 724 The length of the textual representation of the MIB Object 725 Identifier being used as an index. This is encoded in the same 726 manner as the variable length encoding in [RFC5101]. If the 727 length of the MIB Object Identifier is greater than or equal to 728 255 octets, the length is encoded into 3 octets before the MIB 729 Object Name. The first octet is 255 and the length is carried 730 in the second and third octets. 732 Index MIB Object Identifier 734 The textual representation of a MIB object identifier as 735 defined in Section 4. 737 5.3.4. Extended Field Specifier Format for an Indexed MIB Object, with 738 an IPFIX Information Element as Index 740 A possible optimization for the Extended Field Specifier Format for 741 an Indexed MIB Object as specified in Section 5.3.3 is to use an 742 existing IPFIX Information Element, which is already present in the 743 Flow definition, as the index for indexed MIB Object. On the top not 744 repeating the index, the primary advantage is to make a clear link 745 between the Flow Record values and the MIB variable index. 747 For example, if a Flow Record definition contains the source IP 748 address, the destination IP address, and the ingressInterface 749 Information Element as Flow Keys, this implies that the IP address 750 pairs are seen on that specific interface. If the ifInOctets, 751 indexed by that specific interface, is added to the Flow Record, it's 752 clear from the Flow Record, that the ifInOctets is related to the 753 same interface. If the ifInOctets was indexed by the ifIndex (as 754 specified in Section 5.3.3), the Collector would have to hardcode 755 that the semantic of ifIndex MIB variable is equivalent to the 756 ingressInterface Information Element. 758 When an indexed MIB object is exported in IPFIX, the index (or 759 indices) MAY be an IPFIX Information Element(s). Note that this/ 760 these IPFIX Information Element(s) MAY be an enterprise-specific 761 Information Element. 763 Indexed MIB Objects, with IPFIX Information Elements as index, are 764 exported as shown in Figure 10. 766 0 1 2 3 767 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 768 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 769 |E| MIB OID IE | Field Length | 770 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 771 | Index Count | MIB OID Len | MIB Object Identifier ... | 772 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 773 | ... MIB Object Identifier continued | 774 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 775 |E| Index Information Element 1 | Index 1 Length | 776 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 777 |E| Index Information Element 2 | Index 2 Length | 778 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 779 | Index Information Element 2 Enterprise Number | 780 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 781 ... 782 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 783 |E| Index Information Element N | Index N Length | 784 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 785 | Index Information Element N Enterprise Number | 786 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 788 Figure 10: MIB Object Identifier Extended Field Specifier Format with 789 an indexed MIB Object using an IPFIX Information Element as Index 791 Where: 793 E 795 Enterprise bit. This is the first bit of the Field Specifier. 796 The value is always set to 0 for the MIB Object Identifier 797 Extended Field Specifier Format, even if the MIB Object 798 Identifier is enterprise-specific, because the MIB OID IE is an 799 IANA standard field and is not enterprise-specific. 801 MIB OID IE 803 Special IPFIX Information Element, MIBObjectIdentifierMarker, 804 that denotes that a MIB object is exported in the (Options) 805 Template Record. When the MIB Object Identifier Information 806 Element (MIB OID IE) is used, the MIB Object Identifier must be 807 specified in the MIB Object Identifier Extended Field Specifier 808 for the Collecting Process to be able to decode the Records. 810 Field Length 812 The definition is as [RFC5101]. The Field Length does not 813 include the length of the index fields, since these are 814 specified separately. Note that the Field Length can be 815 expressed using reduced size encoding per [RFC5101]. 817 Index Count 819 The number of indices for a MIB object, and zero for a non- 820 indexed MIB object. The index count MUST be consistent with 821 the INDEX definition of the corresponding MIB module. 823 MIB Object Identifier Length 825 The length of the textual representation of the MIB Object 826 Identifier that follows. This is encoded in the same manner as 827 the variable length encoding in [RFC5101]. If the length of 828 the MIB Object Identifier is greater than or equal to 255 829 octets, the length is encoded into 3 octets before the MIB 830 Object Name where the first octet is 255 and the length is 831 carried in the second and third octets (as shown in Figure 8). 832 If the MIB Object Identifier is longer than 254 characters then 833 the length MUST be extended. 835 MIB Object Identifier 837 The textual representation of a MIB object identifier as 838 defined in Section 4. 840 Index Information Element 1..N 842 The Information Element(s) that are used as indices for the MIB 843 Object Identifier. 845 Regular Information Elements, enterprise-specific Information 846 Elements, and non-indexed MIB object identifiers may all be 847 used as indices. However, indexed MIB object identifiers may 848 not be used as indices because SNMP doesn't support 849 hierarchical indexing. 851 Index 1..N Length 853 The respective index lengths for the Information Element(s) 854 1..N 856 5.3.5. Extended Field Specifier Format for an Indexed MIB Object, with 857 one IPFIX Information Element for the OID segment identifying 858 the instance 860 When MIB objects are to be exported, the Exporter may need to 861 interact with the MIB instrumentation in an SNMP agent to obtain the 862 required information. For some SNMP agents, the MIB instrumentation 863 by design does not have knowledge of the OID of the indice(s) that 864 identify the instance of the MIB object being accessed. For example, 865 when accessing a MIB object ifInOctets.10, the MIB instrumentation 866 code may not know that the object ifInOctets is indexed by ifIndex, 867 it is sufficient for it to map the value (10) of the ifIndex to an 868 interface on the device. For such SNMP agents, the Exporter can not 869 use the methods described in Section 5.3.3 and Section 5.3.4 without 870 making extensive changes to the existing MIB instrumentation. 872 An alternate method for exporting Indexed MIB objects in such cases 873 is to convey only the value(s) of the indice(s) that identify the 874 instances being exported. The index count and OIDs of the indice(s) 875 are not conveyed in the IPFIX template record. The Collecting 876 Process is assumed to have the intelligence to understand how the 877 exported objects are indexed. For example, it can either compile 878 this information from the MIB Module where this object type is 879 defined or it may be hardcoded with this information for specific MIB 880 objects that are of interest to it. The object identifier of the 881 indexed MIB object is split into two parts, first part is the OID 882 prefix which is the OID of the corresponding object type and the 883 second part is the OID segment identifying the instance. An 884 information element called MIBInstanceIdentifier is defined for 885 conveying the instance identification segment of an indexed MIB 886 object's OID in string format. While the OID prefix is sent in the 887 template record, the instance identifier segment is sent in the data 888 record. Since the instance identifier segment of the MIB OID is in 889 the data-record, the same template record can be used for exporting 890 different instances of the same MIB object. 892 Indexed MIB objects, with MIBInstanceIdentifier as index are exported 893 as shown in Figure 11 895 0 1 2 3 896 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 897 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 898 |E| MIB OID IE | Field Length | 899 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 900 | Index Count=1 | MIB OID Len | MIB Object Identifier ... | 901 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 902 | ... MIB Object Identifier continued | 903 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 904 |E| MIBInstanceIdentifier |MIBInstanceIdentifier Len=FFFF | 905 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 907 Figure 11: MIB Object Identifier Extended Field Specifier Format with 908 an indexed MIB Object using MIBInstanceIdentifier as Index 910 Where: 912 E 914 Enterprise bit. This is the first bit of the Field Specifier. 915 The value is always set to 0 for the MIB Object Identifier 916 Extended Field Specifier Format, even if the MIB Object 917 Identifier is enterprise-specific, because the MIB OID IE is an 918 IANA standard field and is not enterprise-specific. 920 MIB OID IE 922 Special IPFIX Information Element, MIBObjectIdentifierMarker, 923 that denotes that a MIB object is exported in the (Options) 924 Template Record. When the MIB Object Identifier Information 925 Element (MIB OID IE) is used, the MIB Object Identifier must be 926 specified in the MIB Object Identifier Extended Field Specifier 927 for the Collecting Process to be able to decode the Records. 929 Field Length 931 The definition is as [RFC5101]. The Field Length does not 932 include the length of the index fields, since these are 933 specified separately. Note that the Field Length can be 934 expressed using reduced size encoding per [RFC5101]. 936 Index Count 938 When the OID segment identifying the instance is exported as 939 one string using the MIBInstanceIdentifier the Index Count 940 value is always set to 1 to indicate that there is one 941 information element conveying index values for this MIB object. 942 Since the Collecting Process is assumed to know the INDEX 943 definition of the MIB object, the actual index count need not 944 be conveyed. 946 MIB Object Identifier Length 948 The length of the textual representation of the MIB Object 949 Identifier that follows. This is encoded in the same manner as 950 the variable length encoding in [RFC5101]. If the length of 951 the MIB Object Identifier is greater than or equal to 255 952 octets, the length is encoded into 3 octets before the MIB 953 Object Name where the first octet is 255 and the length is 954 carried in the second and third octets (as shown in Figure 8). 955 If the MIB Object Identifier is longer than 254 characters then 956 the length MUST be extended. 958 MIB Object Identifier 960 The textual representation of a MIB object identifier as 961 defined in Section 4. 963 E 965 Enterprise bit. This is the enterprise bit for the 966 MIBInstanceIdentifier that follows. The value is always set to 967 0 when the MIBInstanceIdentifier is used because the 968 MIBInstanceIdentifier is an IANA standard field and is not 969 enterprise-specific. 971 MIB Instance Identifier 973 IPFIX Information Element, MIBInstanceIdentifier, that denotes 974 that a MIB Instance identifier string is exported in the data 975 record following the MIB Object's value. This instance 976 identifier when concatenated with the MIB object type OID that 977 was sent in the template record gives the complete OID of the 978 MIB variable that is being exported. 980 5.4. Indices Considerations 982 When using an Indexed MIB Object, the Template Record contains the 983 index/indices length. In some cases, this index/indices information 984 might be redundant in the export information. For example, when the 985 index is an Information Element already contained in the Template 986 Record, the length is already part of the Template Record, and 987 available to the Collecting Process for decode, as shown in the 988 example in Section 6.6. A second example in Section 6.9 is when a 989 specific MIB OID is already part of the Template Record as a 990 standalone MIB object in a Template Record, and also reused as an 991 index. 993 However, there are two cases where the index length is required. 994 Therefore, for consistent decoding on the Collecting Process, the 995 Index Length is always specified next to the index. 997 Situation 1: When a non-indexed MIB object is used as an index, and 998 doesn't appear as a standalone MIB object in the Template Record, the 999 Collecting Process might not want, per design, to access the MIB 1000 modules in order to find the length of the value for a particular MIB 1001 OID. 1003 Situation 2: A Template Record might contain two similar Information 1004 Elements with different encoding lengths even if this situation is an 1005 unlikely real-world scenario), while an Indexed MIB Object might want 1006 to refer to one of this Information Element as the index. However, 1007 without clearly specifying the index length, the Collecting Process 1008 would not know which length to decode the index with. 1010 When an Information Element is used as index, there MUST be one and 1011 only one similar Information Element with the exact same length in 1012 the Template Record, so that the Collecting Process knows which 1013 Information Element value from the Flow Records to match. Note that 1014 this rule also implies that the reduced size encoding [RFC5101] of 1015 the Information Element in the index compared to the Information 1016 Element in the Template Record is not allowed. If the Collecting 1017 Process can not determine clearly which Information Element value to 1018 chose as the index because there are two (or more) Information 1019 Elements with the same length, then index MUST specified as the MIB 1020 Object Identifier. 1022 An indexed MIB object MAY be indexed by a mix of MIB OID(s) and IPFIX 1023 Information Element(s) 1025 5.5. Identifying the SNMP Context 1027 Each MIB OID is looked up in a specific context, usually the default 1028 context. If exporting a MIB OID value that isn't in the default 1029 context then the context string MUST be identified and associated 1030 with the MIB OID. This can be done on a per template basis by 1031 exporting an Options Template Record. 1033 A new IPFIX Information Element, "MIBObjectIdentifierMarker" has been 1034 allocated for this purpose. See Section 11. 1036 5.6. Template Management 1038 Templates are managed as per [RFC5101]. 1040 The Set ID field MUST contain the value TBD1 for any Template Set 1041 that contains a MIB Object Identifier Extended Field Specifier. The 1042 Template Withdrawal Message for such a Template must also use a Set 1043 ID field containing the value TBD1. 1045 The Set ID field MUST contain the value TBD2 for any Option Template 1046 Set that contains a MIB Object Identifier Extended Field Specifier. 1047 The Template Withdrawal Message for such an Option Template must also 1048 use a Set ID field containing the value TBD2. 1050 6. Example Use Cases 1051 6.1. Without Using the Specifications in this Document 1053 This example shows the need for indexed MIB objects using the example 1054 of exporting ifInOctets from Section 5.3.3. 1056 A Template Record for exporting the ifInOctets for the interface 1057 represented by the interface ifIndex 1 (i.e., ifInOctets.1) is shown 1058 in Figure 12. While this may be useful for exporting the single 1059 ifInOctets.1 field, clearly additional Templates are required in 1060 order to export ifInOctets.2, ifInOctets.3, etc. Therefore Indexed 1061 MIB objects (per Section 5.3.3) are required in order to export 1062 arbitrary ifInOctets.x. 1064 0 1 2 3 1065 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1066 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1067 | Set ID = TBD1 | Length = 36 | 1068 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1069 | Template ID = 256 | Field Count = 1 | 1070 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1071 |0|IE=MIBObjectIdentifierMarker | Field Length = 4 | 1072 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1073 |Index Count = 0|MIB OID Len=22 | MIB Object Identifier ... | 1074 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1075 | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.10.1" | 1076 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1077 | ... MIB Object Identifier continued ... | 1078 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1079 | ... MIB Object Identifier continued ... | 1080 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1081 | ... MIB Object Identifier continued ... | 1082 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1083 | ... MIB Object Identifier continued | 1084 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1086 Figure 12: Template for exporting ifInOctets.1 1088 6.2. Non-indexed MIB Object: Established TCP Connections 1090 The number of established TCP connections of a remote network device 1091 could be monitored by configuring it to periodically export the 1092 number of established TCP connections to a centralized Collector. In 1093 this example, the Exporter would export an IPFIX Message every 30 1094 minutes that contained Data Records detailing the number of 1095 established TCP connections. 1097 The table of data that is to be exported looks like: 1099 +-------------------------+-----------------------+ 1100 | TIMESTAMP | ESTABLISHED TCP CONN. | 1101 +-------------------------+-----------------------+ 1102 | StartTime + 0 seconds | 10 | 1103 | StartTime + 60 seconds | 14 | 1104 | StartTime + 120 seconds | 19 | 1105 | StartTime + 180 seconds | 16 | 1106 | StartTime + 240 seconds | 23 | 1107 | StartTime + 300 seconds | 29 | 1108 +-------------------------+-----------------------+ 1110 Table 1: Established TCP Connections 1112 The Template Record for such a Data Record will detail two 1113 Information Elements: 1115 1. flowStartSeconds from [RFC5102], Information Element 150: The 1116 absolute timestamp of the first packet of this Flow. 1118 2. tcpCurrEstab from [RFC4022], Object ID "1.3.6.1.2.1.6.9": The 1119 number of TCP connections for which the current state is either 1120 ESTABLISHED or CLOSE-WAIT. 1122 Figure 13 shows the exported Template Set detailing the Template 1123 Record for exporting the number of established TCP connections (see 1124 Section 6.2). 1126 0 1 2 3 1127 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1128 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1129 | Set ID = TBD1 | Length = 33 | 1130 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1131 | Template ID = 257 | Field Count = 2 | 1132 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1133 |0| IE = flowStartSeconds | Field Length = 4 | 1134 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1135 |0|IE=MIBObjectIdentifierMarker | Field Length = 4 | 1136 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1137 |Index Count = 0|MIB OID Len=15 | MIB Object Identifier ... | 1138 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1139 | ... MIB Object Identifier = "1.3.6.1.2.1.6.9" | 1140 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1141 | ... MIB Object Identifier continued ... | 1142 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1143 | ... MIB Object Identifier continued ... | 1144 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1145 | ... | 1146 +-+-+-+-+-+-+-+-+ 1148 Figure 13: Example of tcpCurrEstab Template Set 1150 Figure 14 shows the start of the Data Set for exporting the number of 1151 established TCP connections (see Section 6.2). 1153 0 1 2 3 1154 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1155 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1156 | Set ID = 257 | Length = 52 | 1157 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1158 | StartTime + 0 seconds | 1159 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1160 | 10 | 1161 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1162 | StartTime + 60 seconds | 1163 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1164 | 14 | 1165 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1166 | StartTime + 120 seconds | 1167 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1168 | 19 | 1169 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1170 | StartTime + 180 seconds | 1171 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1172 | 16 | 1173 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1174 | StartTime + 240 seconds | 1175 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1176 | 23 | 1177 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1178 | StartTime + 300 seconds | 1179 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1180 | 29 | 1181 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1183 Figure 14: Example of tcpCurrEstab Data Set 1185 6.3. Enterprise Specific MIB Object: Detailing CPU Load History 1187 For the sake of demonstrating a enterprise-specific MIB object, a 1188 non-indexed MIB object is chosen for simplicity. The CPU Usage of a 1189 remote network device could be monitored by configuring it to 1190 periodically export CPU usage information, i.e. the 1191 cpmCPUTotal1minRev from the proprietary CISCO-PROCESS-MIB, Object ID 1192 "1.3.6.1.4.1.9.9.109.1.1.1.1.7", to a centralized Collector. In this 1193 example, the Exporter would export an IPFIX Message every 30 minutes 1194 that contained Data Records detailing the CPU 1 minute busy average 1195 at 1 minute intervals. 1197 The table of data that is to be exported looks like: 1199 +-------------------------+---------------------+ 1200 | TIMESTAMP | CPU BUSY PERCENTAGE | 1201 +-------------------------+---------------------+ 1202 | StartTime + 0 seconds | 10% | 1203 | StartTime + 60 seconds | 14% | 1204 | StartTime + 120 seconds | 19% | 1205 | StartTime + 180 seconds | 16% | 1206 | StartTime + 240 seconds | 23% | 1207 | StartTime + 300 seconds | 29% | 1208 +-------------------------+---------------------+ 1210 Table 2: CPU Usage Data 1212 The Template Record for such a Data Record will detail two 1213 Information Elements: 1215 1. flowStartSeconds from [RFC5102], Information Element 150: The 1216 absolute timestamp of the first packet of this Flow. 1218 2. cpmCPUTotal1minRev, the overall CPU busy percentage in the last 1219 one-minute period 1221 Figure 15 shows the exported Template Set detailing the Template 1222 Record for exporting CPU Load (see Section 6.3). 1224 0 1 2 3 1225 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1226 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1227 | Set ID = TBD1 | Length = 47 | 1228 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1229 | Template ID = 258 | Field Count = 2 | 1230 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1231 |0| IE = flowStartSeconds | Field Length = 4 | 1232 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1233 |0|IE=MIBObjectIdentifierMarker | Field Length = 1 | 1234 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1235 |Index Count = 0|MIB OID Len=29 | MIB Object Identifier ... | 1236 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1237 | ... MIB Object Identifier = "1.3.6.1.4.1.9.9.109.1.1.1.1.7" | 1238 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1239 | ... MIB Object Identifier continued ... | 1240 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1241 | ... MIB Object Identifier continued ... | 1242 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1243 | ... MIB Object Identifier continued ... | 1244 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1245 | ... MIB Object Identifier continued ... | 1246 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1247 | ... MIB Object Identifier continued ... | 1248 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1249 | ... MIB Object Identifier continued | 1250 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1252 Figure 15: Example of CPU Load Template Set 1254 Note that although cpmCPUTotal1minRev is 32 bits long, reduced size 1255 encoding ([RFC5101]) has been used to encoded it within a single 1256 octet. 1258 This example stresses that, even though the OID cpmCPUTotal1minRev is 1259 enterprise-specific, the E bit for the MIBObjectIdentifierMarker is 1260 set to "0" since the "MIBObjectIdentifierMarker" Information Element 1261 is not enterprise-specific. 1263 The corresponding Data Set does not add any value for this example, 1264 and is therefore not displayed. 1266 6.4. Indexed MIB Object with an OID: Output Interface Queue Size in 1267 PSAMP Packet Report 1269 Following on the example from the previous section (see Section 6.6), 1270 if the Template Record for the example Data Record does not contain 1271 the egressInterface, the ifOutQLen must be indexed by the ifIndex 1272 interface index as detailed in the IF-MIB [RFC2863]: 1274 The Template Record for the example Data Record contains the 1275 following Information Elements: 1277 1. sourceIPv4Address 1279 2. destinationIPv4Address 1281 3. totalLengthIPv4 1283 4. ifOutQLen indexed by: ifIndex 1285 Figure 16 shows the exported Template Set detailing the Template for 1286 exporting a PSAMP Report with Interface Output Queue Length 1287 (ifOutQLen) but using the ifIndex MIB object as the exported index. 1289 0 1 2 3 1290 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1291 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1292 | Set ID = TBD1 | Length = 70 | 1293 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1294 | Template ID = 259 | Field Count = 4 | 1295 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1296 |0| IE = sourceIPv4Address | Field Length = 4 | 1297 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1298 |0| IE = destinationIPv4Address | Field Length = 4 | 1299 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1300 |0| IE = totalLengthIPv4 | Field Length = 4 | 1301 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1302 |0|IE=MIBObjectIdentifierMarker | Field Length = 1 | 1303 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1304 | Index Count=1 |MIB OID Len=20 | MIB Object Identifier ... | 1305 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1306 | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.21" | 1307 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1308 | ... MIB Object Identifier continued ... | 1309 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1310 | ... MIB Object Identifier continued ... | 1311 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1312 | ... MIB Object Identifier continued ... | 1313 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1314 | ... MIB OID continued |0|IE=MIBObjectIdentifierMarker | 1315 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1316 | 1.3.6.1.2.1.2.2.1.1 length |MIB OID Len=19 | MIB Obj ID ...| 1317 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1318 | MIB Object Identifier = "1.3.6.1.2.1.2.2.1.1" ... | 1319 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1320 | ... MIB Object Identifier continued ... | 1321 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1322 | ... MIB Object Identifier continued ... | 1323 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1324 | ... MIB Object Identifier continued ... | 1325 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1326 | ... MIB Object Identifier cont| 1327 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1329 Figure 16: Example of a Template for a PSAMP Report with ifOutQLen 1330 using ifIndex from IF-MIB [RFC2863] as an index 1332 Note that IPFIX reduced size encoding [RFC5101] has been used in this 1333 example to express ifOutQLen in a single octet, rather than the 32 1334 bits specified in the IF-MIB [RFC2863]. 1336 The corresponding IPFIX Data Record is shown in Figure 17. For the 1337 sake of the example, the interface index of "Eth 1/0" is 15 and the 1338 interface index of "Eth 1/1" is 16. 1340 0 1 2 3 1341 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1342 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1343 | Set ID = 259 | Length = 72 | 1344 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1345 | 192.0.2.1 | 1346 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1347 | 192.0.2.3 | 1348 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1349 | 150 | 1350 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1351 | 45 | 15 ... | 1352 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1353 | ... | 192.0.2.4 ... | 1354 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1355 | ... | 192.0.2.9 ... | 1356 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1357 | ... | 350 ... | 1358 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1359 | ... | 45 | 15 ... | 1360 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1361 | ... | 192.0.2.3 ... | 1362 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1363 | ... | 192.0.2.9 ... | 1364 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1365 | ... | 650 ... | 1366 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1367 | ... | 23 | ... | 1368 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1369 | ... 15 | ... | 1370 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1371 | ... 192.0.2.4 | ... | 1372 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1373 | ... 192.0.2.6 | ... | 1374 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1375 | ... 350 | 0 | 1376 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1377 | 16 | 1378 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1380 Figure 17: Example of PSAMP Packet Report with the ifOutQLen using 1381 ifIndex from IF-MIB [RFC2863] as an index 1383 6.5. Indexed MIB Object with Two OIDs: The ipIfStatsInForwDatagrams 1385 MIB objects may be indexed by multiple indices. Note that all the 1386 indices apply to the MIB object, i.e. index 2 is not an index of 1387 index 1. 1389 This example shows the export of ipIfStatsInForwDatagrams from the 1390 IP-MIB [RFC4293] indexed by the ipIfStatsIPVersion and 1391 ipIfStatsIfIndex which are provided as scope fields in an IPFIX 1392 option. Note that since these fields are used as indices for 1393 ipIfStatsInForwDatagrams, they don't need their own indices to be 1394 identified. 1396 The Options Template Record for the example Data Record contains the 1397 following Information Elements: 1399 1. ipIfStatsIPVersion (1.3.6.1.2.1.4.31.3.1.1) (scope field) 1401 2. ipIfStatsIfIndex (1.3.6.1.2.1.4.31.3.1.2) (scope field) 1403 3. ipIfStatsInForwDatagrams (1.3.6.1.2.1.4.31.3.1.12) (non-scope 1404 field) indexed by ipIfStatsIPVersion and ipIfStatsIfIndex 1406 Figure 18 shows the exported Options Template Set. 1408 0 1 2 3 1409 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1410 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1411 | Set ID = TBD2 | Length = 146 | 1412 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1413 | Template ID = 260 | Field Count = 3 | 1414 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1415 | Scope Field Count = 2 |0| MIBObjectIdentifierMarker | 1416 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1417 | Scope Field 1 Length = 1 |Index Count = 0|MIB OID Len=22 | 1418 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1419 | MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.1" ... | 1420 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1421 | ... MIB Object Identifier continued ... | 1422 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1423 | ... MIB Object Identifier continued ... | 1424 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1425 | ... MIB Object Identifier continued ... | 1426 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1427 | ... MIB Object Identifier continued ... | 1428 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1429 |MIB Object Identifier continued|0| MIBObjectIdentifierMarker | 1430 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1431 | Scope Field 2 Length = 2 |Index Count = 0|MIB OID Len=22 | 1432 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1433 | MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.2" ... | 1434 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1435 | ... MIB Object Identifier continued ... | 1436 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1437 | ... MIB Object Identifier continued ... | 1438 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1439 | ... MIB Object Identifier continued ... | 1440 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1441 | ... MIB Object Identifier continued ... | 1442 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1443 |MIB Object Identifier continued|0| MIBObjectIdentifierMarker | 1444 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1445 | Field Length = 4 |Index Count = 2|MIB OID Len=23 | 1446 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1447 | MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.12" ... | 1448 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1449 | ... MIB Object Identifier continued ... | 1450 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1451 | ... MIB Object Identifier continued ... | 1452 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1453 | ... MIB Object Identifier continued ... | 1454 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1455 | ... MIB Object Identifier continued ... | 1456 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1457 | ... MIB Object Identifier continued|0|MIB OID IE...| 1458 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1459 |... MIB OID IE | 1.3.6.1.2.1.4.31.3.1.1 Length |MIB OID Len=22 | 1460 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1461 | MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.1" ... | 1462 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1463 | ... MIB Object Identifier continued ... | 1464 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1465 | ... MIB Object Identifier continued ... | 1466 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1467 | ... MIB Object Identifier continued ... | 1468 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1469 | ... MIB Object Identifier continued ... | 1470 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1471 | ... MIB Object Identifier |0| MIB OID IE | 1472 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1473 | 1.3.6.1.2.1.4.31.3.1.2 Length | MIB OID Len=22| MIB Obj ID ...| 1474 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1475 | MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.2" ... | 1476 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1477 | ... MIB Object Identifier continued ... | 1478 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1479 | ... MIB Object Identifier continued ... | 1480 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1481 | ... MIB Object Identifier continued ... | 1482 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1483 | ... MIB Object Identifier | 1484 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1486 Figure 18: Example of an Options Template for an Indexed MIB Object 1487 with two indices. 1489 6.6. Indexed MIB Object with an IPFIX Information Element: Output 1490 Interface Queue Size in PSAMP Packet Report 1492 If a PSAMP Packet Report [RFC5476] was generated on any dropped 1493 packets on an interface then it may be desirable to know if the send 1494 queue on the output interface was full. This could be done be 1495 exporting the size of the send queue (ifOutQLen) in the same Data 1496 Record as the PSAMP Packet Report. 1498 The exported data looks like: 1500 +-----------+-----------+--------+------------+---------------------+ 1501 | SRC ADDR | DST ADDR | PAK | OUTPUT I/F | OUTPUT Q. LEN | 1502 | | | LEN | | (ifOutQLen) | 1503 +-----------+-----------+--------+------------+---------------------+ 1504 | 192.0.2.1 | 192.0.2.3 | 150 | Eth 1/0 | 45 | 1505 | | | | (15) | | 1506 | 192.0.2.4 | 192.0.2.9 | 350 | Eth 1/0 | 45 | 1507 | | | | (15) | | 1508 | 192.0.2.3 | 192.0.2.9 | 650 | Eth 1/0 | 23 | 1509 | | | | (15) | | 1510 | 192.0.2.4 | 192.0.2.6 | 350 | Eth 1/1 | 0 | 1511 | | | | (16) | | 1512 +-----------+-----------+--------+------------+---------------------+ 1514 Table 3: Packet Report with Interface Output Queue Length (ifOutQLen) 1515 Data 1517 The MIB object for the Interface Output Queue Length, ifOutQLen 1518 ("1.3.6.1.2.1.2.2.1.21"), is indexed by the ifIndex interface index 1519 as detailed in the IF-MIB [RFC2863]. If, for example, the interface 1520 index of "Eth 1/0" in the example is 15, the full MIB Object 1521 Identifier for (ifOutQLen) would be "1.3.6.1.2.1.2.2.1.21.15". 1522 Without a method to specify the index the full MIB OID would have to 1523 be used, which would mean specifying a new Template Record. Rather 1524 than export a separate Template Record for each Interface Index, it 1525 is more practical to identify the index in the Data Record itself. 1527 In fact, only how the indexed object was indexed is necessary, 1528 although it is often useful to specify the index value. The example 1529 identifies the Egress Interface, but for other uses it may be 1530 sufficient to know that the ifOutQLen value was taken for the 1531 interface that the packet was switched out of, without identifying 1532 the actual interface. 1534 The Template Record for the example Data Record contains the 1535 following Information Elements: 1537 1. sourceIPv4Address 1539 2. destinationIPv4Address 1541 3. totalLengthIPv4 1543 4. egressInterface 1545 5. ifOutQLen indexed by: egressInterface 1547 Figure 19 shows the exported Template Set detailing the Template for 1548 exporting a PSAMP Report with Interface Output Queue Length 1549 (ifOutQLen) (see Section 6.4). 1551 0 1 2 3 1552 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1553 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1554 | Set ID = TBD1 | Length = 54 | 1555 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1556 | Template ID = 261 | Field Count = 5 | 1557 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1558 |0| IE = sourceIPv4Address | Field Length = 4 | 1559 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1560 |0| IE = destinationIPv4Address | Field Length = 4 | 1561 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1562 |0| IE = totalLengthIPv4 | Field Length = 4 | 1563 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1564 |0| IE = egressInterface | Field Length = 4 | 1565 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1566 |0|IE=MIBObjectIdentifierMarker | Field Length 4 | 1567 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1568 | Index Count=1 |MIB OID Len=20 | MIB Object Identifier ... | 1569 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1570 | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.21" | 1571 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1572 | ... MIB Object Identifier continued ... | 1573 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1574 | ... MIB Object Identifier continued ... | 1575 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1576 | ... MIB Object Identifier continued ... | 1577 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1578 | ... MIB OID continued |0| IE = egressInterface | 1579 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1580 | egressInterface Length = 4 | 1581 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1583 Figure 19: Example of Template for a PSAMP Report with ifOutQLen 1584 indexed by egressInterface 1586 The corresponding IPFIX Data Record is shown in Figure 20. For the 1587 sake of the example, the interface index of "Eth 1/0" is 15 and the 1588 interface index of "Eth 1/1" is 16. 1590 0 1 2 3 1591 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1592 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1593 | Set ID = 261 | Length = 84 | 1594 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1595 | 192.0.2.1 | 1596 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1597 | 192.0.2.3 | 1598 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1599 | 150 | 1600 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1601 | 15 (Eth 1/0) | 1602 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1603 | 45 | 1604 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1605 | 192.0.2.4 | 1606 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1607 | 192.0.2.9 | 1608 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1609 | 350 | 1610 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1611 | 15 (Eth 1/0) | 1612 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1613 | 45 | 1614 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1615 | 192.0.2.3 | 1616 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1617 | 192.0.2.9 | 1618 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1619 | 650 | 1620 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1621 | 15 (Eth 1/0) | 1622 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1623 | 23 | 1624 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1625 | 192.0.2.4 | 1626 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1627 | 192.0.2.6 | 1628 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1629 | 350 | 1630 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1631 | 16 (Eth 1/1) | 1632 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1633 | 0 | 1634 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1636 Figure 20: Example of PSAMP Packet Report with ifOutQLen indexed by 1637 egressInterface 1639 6.7. Indexed MIB Objects with a mix of MIB OID and IPFIX Information 1640 Element 1642 TODO. 1644 6.8. Indexed MIB Object with MIBInstanceIdentifier Information Element: 1645 ipIfStatsOutOctets 1647 This example shows the export of ipIfStatsOutOctets from the IP-MIB 1648 [RFC4293] indexed by the ipIfStatsIPVersion and ipIfStatsIfIndex, 1649 using the MIBInstanceIdentifier Information Element to carry the 1650 index information. 1652 The exported data looks like: 1654 +--------------------+------------------+--------------------+ 1655 | ipIfStatsIPVersion | ipIfStatsIfIndex | ipIfStatsOutOctets | 1656 +--------------------+------------------+--------------------+ 1657 | 1(IPv4) | 10 | 235876 | 1658 | 2(IPv6) | 11 | 38688 | 1659 +--------------------+------------------+--------------------+ 1661 Table 4: The number octets in IP datagrams delivered to the lower 1662 layers for transmission 1664 The MIB object ipIfStatsOutOctets ("1.3.6.1.2.1.4.31.3.1.32"), is 1665 indexed by ipIfStatsIPVersion and ipIfStatsIfIndex as detailed in IP- 1666 MIB [RFC4293]. The instance of the ipIfStatsOutOctets for the IPv4 1667 protocol on the interface identified by ifIndex 10 is identified in 1668 the data record with the instance identifier segment ("1.10") in 1669 string format, while the instance of the ipIfStatsOutOctets for the 1670 IPv6 protocol on the interface identified by ifIndex 11 is identified 1671 in the data record with the instance identifier segment ("2.11") in 1672 string format. 1674 The Template Record for the example Data Records contains the 1675 following Information Elements: 1677 1. ipIfStatsOutOctets (1.3.6.1.2.1.4.31.3.1.32) 1679 Figure 21 shows the exported Template Set. 1681 0 1 2 2 1682 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1683 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1684 | Set ID = TBD1 | Length = 86 | 1685 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1686 | Template ID = 264 | Field Count = 1 | 1687 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1688 |0|IE=MIBObjectIdentifierMarker | Field Length = 4 | 1689 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1690 | Index Count=1 |MIB OID Len=23 | MIB Object Identifier ... | 1691 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1692 | ...MIB Object Identifier = "1.3.6.1.2.1.4.31.3.1.32" | 1693 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1694 | ... MIB Object Identifier continued ... | 1695 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1696 | ... MIB Object Identifier continued ... | 1697 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1698 | ... MIB Object Identifier continued ... | 1699 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1700 | ... MIB Object Identifier continued ... | 1701 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1702 |...MIB OID |0| MIBInstanceIdentifier IE | FieldLength...| 1703 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1704 | ... = FFFF | 1705 +-+-+-+-+-+-+-+-+ 1707 Figure 21: Example of a Template for an MIB Objects that use the 1708 MIBInstanceIdentifier Information Element 1710 The corresponding IPFIX Data Record is shown in Figure 22. 1712 Variable length encoding is used for MIBInstanceIdentifier 1713 Information Element. 1715 0 1 2 3 1716 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1717 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1718 | Set ID = 264 | Length = 22 | 1719 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1720 | ipIfStatsOutOctets = 235876 | 1721 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1722 | Length = 4 | "1.10"... | 1723 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1724 | ... | ipIfStatsOutOctets = 38688 | 1725 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1726 | ... | Length = 4 | "2.11"... | 1727 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1728 | ... | 1729 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1731 Figure 22: Example of ipIfStatsOutOctets using ipIfStatsIPVersion and 1732 ipIfStatsIfIndex as indices 1734 6.9. Using MIB Objects as IPFIX Options Scope fields 1736 Both indexed and non-indexed MIB Objects may be used as IPFIX Options 1737 Scope fields as discussed in Section 5.2. 1739 6.9.1. Using non-Indexed MIB Objects as Option Scope fields 1741 In this example, a Cisco Telepresence system uses an IPFIX option to 1742 report bandwidth usage statistics. The ctpcLocalAddrType and 1743 ctpcLocalAddr OIDs from the CISCO-TELEPRESENCE-CALL MIB are used as 1744 scope fields to identify the Telepresence system. The 1745 ctpcLocalAddrType is expressed with a fixed size of 1 octet, while 1746 the ctpcLocalAddr is expressed using a variable length field. 1748 These scope fields are followed by two non-scope fields containing 1749 the number of packets and bytes. IPFIX reduced size encoding is used 1750 to express each of these fields in 32 bits. 1752 Therefore the Options Template Record for the example Data Record 1753 contains the following Information Elements: 1755 1. ctpcLocalAddrType (1.3.6.1.4.1.9.9.644.1.2.1) (scope field) 1757 2. ctpcLocalAddr (1.3.6.1.4.1.9.9.644.1.2.2) (scope field) 1759 3. octetDeltaCount (non-scope field) 1761 4. packetDeltaCount (non-scope field) 1762 The IPFIX Options Template Record is shown in Figure 23. 1764 0 1 2 3 1765 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1766 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1767 | Set ID = TBD2 | Length = 80 | 1768 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1769 | Template ID = 262 | Field Count = 4 | 1770 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1771 | Scope Field Count = 2 |0| MIBObjectIdentifierMarker | 1772 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1773 | Scope Field 1 Length = 1 |Index Count = 0|MIB OID Len=25 | 1774 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1775 | MIB Object Identifier = "1.3.6.1.4.1.9.9.644.1.2.1" ... | 1776 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1777 | ... MIB Object Identifier continued ... | 1778 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1779 | ... MIB Object Identifier continued ... | 1780 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1781 | ... MIB Object Identifier continued ... | 1782 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1783 | ... MIB Object Identifier continued ... | 1784 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1785 | ... MIB Object Identifier continued ... | 1786 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1787 |... MIB OID ID |0| MIBObjectIdentifierMarker | Scope Field ...| 1788 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1789 |...Length=65535|Index Count = 0|MIB OID Len=25 | MIB OID ID ...| 1790 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1791 | ... MIB Object Identifier = "1.3.6.1.4.1.9.9.644.1.2.2" ... | 1792 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1793 | ... MIB Object Identifier continued ... | 1794 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1795 | ... MIB Object Identifier continued ... | 1796 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1797 | ... MIB Object Identifier continued ... | 1798 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1799 | ... MIB Object Identifier continued ... | 1800 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1801 | ... MIB Object Identifier continued | 1802 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1803 |0| octetDeltaCount = 1 | Field Length = 4 | 1804 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1805 |0| packetDeltaCount = 2 | Field Length = 4 | 1806 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1808 Figure 23: Example of an IPFIX Options Template Record using non- 1809 Indexed MIB Objects as scope fields 1811 The corresponding IPFIX Options Data Record is shown in Figure 24. 1813 0 1 2 3 1814 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1815 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1816 | Set ID = 262 | Length = 18 | 1817 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1818 | AddrType = 1 | Length = 4 | ctpcLocalAddrsystemID = ... | 1819 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1820 | ... 192.0.2.1 | octetDeltaCount = nnnn ... | 1821 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1822 | ... octetDeltaCount continued | packetDeltaCount = nnnn ... | 1823 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1824 | ... packetDeltaCount continued| 1825 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1827 Figure 24: Example of an IPFIX Options Data Record using non-Indexed 1828 MIB Objects as scope fields 1830 6.9.2. Using Indexed MIB Objects as Option Scope fields 1832 In this example, interface statistics are reported using ifName and 1833 ifInOctets from the IF-MIB [RFC2863]. Both of these fields are 1834 indexed by the ifIndex. The ifName and ifIndex are scope fields. 1836 Therefore the Options Template Record for the example Data Record 1837 contains the following Information Elements: 1839 1. ifName (1.3.6.1.2.1.31.1.1.1.1) (scope field) indexed by ifIndex 1841 2. ifIndex (1.3.6.1.2.1.2.2.1.1) (scope field) 1843 3. ifInOctets (1.3.6.1.2.1.2.2.1.10) (non-scope field) indexed by 1844 ifIndex 1846 The IPFIX Options Template Record is shown in Figure 25. 1848 0 1 2 3 1849 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1850 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1851 | Set ID = TBD2 | Length = 137 | 1852 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1853 | Template ID 263 | Field Count = 3 | 1854 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1855 | Scope Field Count = 2 |0| MIBObjectIdentifierMarker | 1856 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1857 | Scope Field 1 Length = 65535 |Index Count = 1|MIB OID Len=22 | 1858 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1859 | MIB Object Identifier = "1.3.6.1.2.1.31.1.1.1.1" | 1860 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1861 | ... MIB Object Identifier continued ... | 1862 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1863 | ... MIB Object Identifier continued ... | 1864 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1865 | ... MIB Object Identifier continued ... | 1866 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1867 | ... MIB Object Identifier continued ... | 1868 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1869 |MIB Object Identifier continued|0| MIBObjectIdentifierMarker | 1870 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1871 | Scope Field 1 index Length = 4|MIB OID Len=19 | MIB OID ID ...| 1872 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1873 | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.1" ... | 1874 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1875 | ... MIB Object Identifier continued ... | 1876 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1877 | ... MIB Object Identifier continued ... | 1878 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1879 | ... MIB Object Identifier continued | 1880 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1881 | ... MIB Object Identifier |0| MIBObjectIdentifierMarker | 1882 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1883 | Scope Field 2 Length = 4 |Index Count = 0|MIB OID Len=19 | 1884 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1885 | MIB Object Identifier = "1.3.6.1.2.1.2.2.1.1" ... | 1886 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1887 | ... MIB Object Identifier continued ... | 1888 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1889 | ... MIB Object Identifier continued ... | 1890 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1891 | ... MIB Object Identifier continued ... | 1892 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1893 | ... MIB Obj Identifier continued |0| MIBObject...| 1894 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1895 |...Ident Marker| Field Length = 4 |Index Count = 1| 1896 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1897 |MIB OID Len=20 |MIB Object Identifier="1.3.6.1.2.1.2.2.1.10"...| 1898 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1899 | ... MIB Object Identifier continued ... | 1900 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1901 | ... MIB Object Identifier continued ... | 1902 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1903 | ... MIB Object Identifier continued ... | 1904 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1905 | ... MIB Object Identifier continued ... | 1906 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1907 | ... MIB OID |0| MIBObjectIdentifierMarker | Field 1 ... | 1908 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1909 |... index Len=4|MIB OID Len=19 | MIB Object Identifier ... | 1910 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1911 | ... MIB Object Identifier = "1.3.6.1.2.1.2.2.1.1" ... | 1912 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1913 | ... MIB Object Identifier continued ... | 1914 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1915 | ... MIB Object Identifier continued ... | 1916 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1917 | ... MIB Object Identifier continued ... | 1918 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1919 |... MIB Obj Id | 1920 +-+-+-+-+-+-+-+-+ 1922 Figure 25: Example of an IPFIX Options Template Record using Indexed 1923 MIB Objects as scope fields 1925 The corresponding IPFIX Options Data Record is shown in Figure 26. 1926 For the sake of the example, the interface index of "Eth 1/1" is 15 1927 and the ifInOctets are 1000. 1929 0 1 2 3 1930 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1931 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1932 | Set ID = 263 | Length = 20 | 1933 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1934 | Length = 7 | ifName = "Eth 1/1" ... | 1935 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1936 | ... ifName continued | 1937 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1938 | ifIndex = 15 | 1939 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1940 | ifInOctets = 1000 | 1941 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1943 Figure 26: Example of an IPFIX Options Data Record using Indexed MIB 1944 Objects as scope fields 1946 6.10. Using MIB Objects with IPFIX Structured Data 1948 It's possible to export both indexed and non-indexed MIB Objects 1949 using IPFIX Structured Data per [RFC6313] as shown in the example 1950 below. 1952 TODO: insert example. 1954 7. Configuration Considerations 1956 When configuring a MIB OID for export, consideration should be given 1957 to whether the SNMP Context String should also be configurable. If a 1958 non-default Context String is used then it should be associated with 1959 the fields as per Section 5.5. 1961 8. The Collecting Process's Side 1963 This section describes the Collecting Process when using SCTP and PR- 1964 SCTP as the transport protocol. Any necessary changes to the 1965 Collecting Process specifically related to TCP or UDP transport 1966 protocols are specified in section 10 of [RFC5101]. 1968 The specifications in section 9 of [RFC5101] also apply to 1969 Collector's that implement this specification. In addition, the 1970 following specifications should be noted. 1972 A Collecting Process that implements this specification MUST be able 1973 to receive Set IDs TBD1 and TBD2, as specified in this document. 1975 A Collecting Process that implements this specification MUST have 1976 access to MIB modules in order to look up the received MIB Object 1977 Identifiers and find the type and name of MIB OID fields used in 1978 received templates. It should be noted that since reduced size 1979 encoding MAY be used by the Exporting Process then the Collecting 1980 Process cannot assume a received size for a field is the maximum size 1981 it should expect for that field. 1983 If a Collecting Process receives a MIB Object ID that it cannot 1984 decode, it SHOULD log an error. 1986 If a Collecting Process receives a MIB Object ID for an indexed MIB 1987 Object but isn't sent the appropriate number of indices then it 1988 SHOULD log an error, but it MAY use the Template Record to decode the 1989 Data Records as the associated indices are purely semantic 1990 information. 1992 9. Applicability 1994 Making available the many and varied items from MIB modules opens up 1995 a wide range of possible applications for the IPFIX protocol, some 1996 quite different from the usual flow information. Some potential 1997 enhancements for traditional applications are detailed below: 1999 Some monitoring applications periodically export an interface id to 2000 interface name mapping using IPFIX Options Templates. This could be 2001 expanded to include the MIB object "ifInUcastPkts" of the IF-MIB 2002 [RFC2863] indexed using the ingressInterface Information Element, as 2003 a index. This would give the input statistics for each interface 2004 which can be compared to the flow information to ensure the sampling 2005 rate is expected. Or, if there is no sampling, to ensure that all 2006 the expected packets are being monitored. 2008 10. Security Considerations 2010 For this extension to the IPFIX protocol, the same security 2011 considerations as for the IPFIX protocol apply [RFC5101]. 2013 The access to MIB objects is controlled by the configuration of the 2014 IPFIX exporter. This is consistent with the way IPFIX controls 2015 access to other Information Elements in general. The configuration 2016 of an IPFIX exporter determines which MIB objects are included in 2017 IPFIX flow records sent to certain collectors. Network operators 2018 should take care that only MIB objects are included in IPFIX flow 2019 records that the receiving flow collector is allowed to receive. 2021 11. IANA Considerations 2023 11.1. New Set IDs 2025 IPFIX Messages use two fields with assigned values. These are the 2026 IPFIX Version Number, indicating which version of the IPFIX Protocol 2027 was used to export an IPFIX Message, and the IPFIX Set ID, indicating 2028 the type for each set of information within an IPFIX Message. 2030 The previously reserved Set ID values of TBD1 and TBD2 are allocated 2031 in IANA's IPFIX Set IDs registry [IANA-SETS], and are used as 2032 specified in this document. All other Set ID values are reserved for 2033 future use. Set ID values above 255 are used for Data Sets. 2035 11.2. New Data Types 2037 A new mibObject data type must be allocated in IANA's IPFIX 2038 Information Element Data Types registry, [IANA-DATATYPES]. 2040 11.3. New Information Elements 2042 Two new Information Elements, "MIBObjectIdentifierMarker", and 2043 "MIBInstanceIdentifier" must be allocated in IANA's IPFIX registry, 2044 [IANA-IPFIX]: 2046 MIB Object Identifier Marker 2048 Description: An IPFIX Information Element 2049 ("MIBObjectIdentifierMarker") that denotes that a MIB Object 2050 Identifier is exported in the (Options) Template Record. 2052 Abstract Data Type: mibObject 2054 Data Type Semantics: identifier 2056 ElementId: TBD 2058 Status: current 2060 Reference: [this document]. 2062 MIB Instance Identifier 2064 Description: IPFIX Information Element, MIBInstanceIdentifier, 2065 that denotes that a MIB Instance identifier string is exported in 2066 the data record following the MIB Object's value. This instance 2067 identifier when concatenated with the MIB object type OID that was 2068 sent in the template record gives the complete OID of the MIB 2069 variable that is being exported. 2071 Abstract Data Type: mibObject 2073 Data Type Semantics: identifier 2075 ElementId: TBD 2077 Status: current 2079 Reference: [this document]. 2081 12. Acknowledgements 2083 The authors would like to thank Andrew Johnson for his collaboration 2084 on the first version of the draft. 2086 13. References 2088 13.1. Normative References 2090 [IANA-DATATYPES] 2091 IANA, "IPFIX Information Element Data Types registry", . 2095 [IANA-IPFIX] 2096 IANA, "IPFIX Information Elements registry", 2097 . 2099 [IANA-SETS] 2100 IANA, "IPFIX Set IDs registry", . 2103 [PEN] IANA, "Private Enterprise Numbers registry", 2104 . 2106 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2107 Requirement Levels", BCP 14, RFC 2119, March 1997. 2109 [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. 2110 Schoenwaelder, Ed., "Structure of Management Information 2111 Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. 2113 [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group 2114 MIB", RFC 2863, June 2000. 2116 [RFC4293] Routhier, S., "Management Information Base for the 2117 Internet Protocol (IP)", RFC 4293, April 2006. 2119 [RFC5101] Claise, B., "Specification of the IP Flow Information 2120 Export (IPFIX) Protocol for the Exchange of IP Traffic 2121 Flow Information", RFC 5101, January 2008. 2123 [RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J. 2124 Meyer, "Information Model for IP Flow Information Export", 2125 RFC 5102, January 2008. 2127 13.2. Informative References 2129 [RFC2982] Kavasseri, R., "Distributed Management Expression MIB", 2130 RFC 2982, October 2000. 2132 [RFC3444] Pras, A. and J. Schoenwaelder, "On the Difference between 2133 Information Models and Data Models", RFC 3444, 2134 January 2003. 2136 [RFC4022] Raghunarayan, R., "Management Information Base for the 2137 Transmission Control Protocol (TCP)", RFC 4022, 2138 March 2005. 2140 [RFC5476] Claise, B., Johnson, A., and J. Quittek, "Packet Sampling 2141 (PSAMP) Protocol Specifications", RFC 5476, March 2009. 2143 [RFC6313] Claise, B., Dhandapani, G., Aitken, P., and S. Yates, 2144 "Export of Structured Data in IP Flow Information Export 2145 (IPFIX)", RFC 6313, July 2011. 2147 Authors' Addresses 2149 Benoit Claise 2150 Cisco Systems, Inc. 2151 De Kleetlaan 6a b1 2152 Diegem, 1813 2153 Belgium 2155 Phone: +32 2 704 5622 2156 Email: bclaise@cisco.com 2158 Paul Aitken 2159 Cisco Systems, Inc. 2160 96 Commercial Quay 2161 Commercial Street 2162 Edinburgh, EH6 6LX 2163 UK 2165 Phone: +44 131 561 3616 2166 Email: paitken@cisco.com 2168 Srikar 2169 Cisco Systems, Inc. 2170 Mail Stop BGL13/3/, SEZ Unit, Cessna Business Park, Kadubeesanahalli 2171 Village Varthur Hobli, Sarjapur Marathalli Outer Ring Road 2172 Bangalore, KARNATAKA 560 103 2173 IN 2175 Phone: +91 80 4426 3264 2176 Email: srikar@cisco.com 2177 Juergen Schoenwaelder 2178 Jacobs University Bremen 2179 Campus Ring 1 2180 Bremen, 28725 2181 Germany 2183 Phone: +49 421 200-3587 2184 Email: j.schoenwaelder@jacobs-university.de