idnits 2.17.1 draft-trammell-ipfix-sip-msg-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 47 instances of lines with non-RFC2606-compliant FQDNs in the document. ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 470: '...rmation Elements MAY be added to them,...' RFC 2119 keyword, line 471: '... these Templates MUST be replaced with...' RFC 2119 keyword, line 473: '...ormation Element SHOULD be added for a...' RFC 2119 keyword, line 474: '...Transaction Information Element SHOULD...' RFC 2119 keyword, line 520: '...ation Elements within a record MUST be...' Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (October 27, 2011) is 4564 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '8' on line 498 -- Looks like a reference, but probably isn't: '4' on line 501 -- Looks like a reference, but probably isn't: '2' on line 507 -- Looks like a reference, but probably isn't: '1' on line 506 == Missing Reference: 'TODO' is mentioned on line 1510, but not defined == Unused Reference: 'RFC5655' is defined on line 1551, but no explicit reference was found in the text == Unused Reference: 'I-D.kaplan-dispatch-session-id' is defined on line 1557, but no explicit reference was found in the text == Unused Reference: 'RFC2976' is defined on line 1569, but no explicit reference was found in the text == Unused Reference: 'RFC3665' is defined on line 1594, but no explicit reference was found in the text == Unused Reference: 'RFC4475' is defined on line 1601, but no explicit reference was found in the text == Unused Reference: 'RFC6026' is defined on line 1609, but no explicit reference was found in the text == Outdated reference: A later version (-13) exists of draft-ietf-sipclf-problem-statement-07 ** Obsolete normative reference: RFC 5101 (Obsoleted by RFC 7011) == Outdated reference: A later version (-03) exists of draft-trammell-ipfix-ie-doctors-02 -- Obsolete informational reference (is this intentional?): RFC 2976 (Obsoleted by RFC 6086) -- Obsolete informational reference (is this intentional?): RFC 3265 (Obsoleted by RFC 6665) -- Obsolete informational reference (is this intentional?): RFC 5226 (Obsoleted by RFC 8126) Summary: 2 errors (**), 0 flaws (~~), 11 warnings (==), 8 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group B. Trammell 3 Internet-Draft ETH Zurich 4 Intended status: Informational S. Niccolini 5 Expires: April 29, 2012 NEC 6 B. Claise 7 Cisco Systems Inc. 8 H. Kaplan 9 Acme Packet 10 October 27, 2011 12 SIP Message Information Export using IPFIX 13 draft-trammell-ipfix-sip-msg-02 15 Abstract 17 This draft defines a set of Information Elements and example 18 Templates for IP Flow Information Export (IPFIX) based on the SIP 19 Common Log Format data model, as well as additional useful SIP 20 Information Elements, to allow IPFIX export of application-layer 21 information about SIP messages. 23 Status of this Memo 25 This Internet-Draft is submitted in full conformance with the 26 provisions of BCP 78 and BCP 79. 28 Internet-Drafts are working documents of the Internet Engineering 29 Task Force (IETF). Note that other groups may also distribute 30 working documents as Internet-Drafts. The list of current Internet- 31 Drafts is at http://datatracker.ietf.org/drafts/current/. 33 Internet-Drafts are draft documents valid for a maximum of six months 34 and may be updated, replaced, or obsoleted by other documents at any 35 time. It is inappropriate to use Internet-Drafts as reference 36 material or to cite them other than as "work in progress." 38 This Internet-Draft will expire on April 29, 2012. 40 Copyright Notice 42 Copyright (c) 2011 IETF Trust and the persons identified as the 43 document authors. All rights reserved. 45 This document is subject to BCP 78 and the IETF Trust's Legal 46 Provisions Relating to IETF Documents 47 (http://trustee.ietf.org/license-info) in effect on the date of 48 publication of this document. Please review these documents 49 carefully, as they describe your rights and restrictions with respect 50 to this document. Code Components extracted from this document must 51 include Simplified BSD License text as described in Section 4.e of 52 the Trust Legal Provisions and are provided without warranty as 53 described in the Simplified BSD License. 55 Table of Contents 57 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 58 2. Base Information Elements for SIP Message Information 59 Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 60 2.1. sipObservationType . . . . . . . . . . . . . . . . . . . . 5 61 2.2. sipMethod . . . . . . . . . . . . . . . . . . . . . . . . 5 62 2.3. sipSequenceNumber . . . . . . . . . . . . . . . . . . . . 5 63 2.4. sipRequestURI . . . . . . . . . . . . . . . . . . . . . . 5 64 2.5. sipFromURI . . . . . . . . . . . . . . . . . . . . . . . . 6 65 2.6. sipFromTag . . . . . . . . . . . . . . . . . . . . . . . . 6 66 2.7. sipToURI . . . . . . . . . . . . . . . . . . . . . . . . . 6 67 2.8. sipToTag . . . . . . . . . . . . . . . . . . . . . . . . . 6 68 2.9. sipCallId . . . . . . . . . . . . . . . . . . . . . . . . 6 69 2.10. sipResponseStatus . . . . . . . . . . . . . . . . . . . . 6 70 2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . . 7 71 2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . . 7 72 2.13. sipMethod subregistry . . . . . . . . . . . . . . . . . . 7 73 3. Additional Information Elements for SIP Message 74 Information Export . . . . . . . . . . . . . . . . . . . . . . 8 75 3.1. sipContactURI . . . . . . . . . . . . . . . . . . . . . . 8 76 3.2. sipRouteURI . . . . . . . . . . . . . . . . . . . . . . . 8 77 3.3. sipPaiURI . . . . . . . . . . . . . . . . . . . . . . . . 9 78 3.4. sipPpiURI . . . . . . . . . . . . . . . . . . . . . . . . 9 79 3.5. sipPAssocURI . . . . . . . . . . . . . . . . . . . . . . . 9 80 3.6. sipPCalledPartyURI . . . . . . . . . . . . . . . . . . . . 9 81 3.7. sipVia . . . . . . . . . . . . . . . . . . . . . . . . . . 10 82 3.8. sipAuthUsername . . . . . . . . . . . . . . . . . . . . . 10 83 3.9. sipSubscriptionEvent . . . . . . . . . . . . . . . . . . . 10 84 3.10. sipSubscriptionState . . . . . . . . . . . . . . . . . . . 10 85 3.11. sipExpires . . . . . . . . . . . . . . . . . . . . . . . . 10 86 3.12. sipPVisitedNetworkID . . . . . . . . . . . . . . . . . . . 11 87 3.13. sipPAccessNetworkInfo . . . . . . . . . . . . . . . . . . 11 88 3.14. sipPChargingFunctionAddr . . . . . . . . . . . . . . . . . 11 89 3.15. sipPChargingVector . . . . . . . . . . . . . . . . . . . . 11 90 4. Recommended Templates for SIP Message Information Export . . . 12 91 5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 92 5.1. Base Template Export . . . . . . . . . . . . . . . . . . . 13 93 5.2. UAC registration . . . . . . . . . . . . . . . . . . . . . 14 94 5.3. Direct Call . . . . . . . . . . . . . . . . . . . . . . . 16 95 5.4. Single Downstream Branch Call . . . . . . . . . . . . . . 19 96 5.5. Forked Call . . . . . . . . . . . . . . . . . . . . . . . 25 97 6. Security Considerations . . . . . . . . . . . . . . . . . . . 35 98 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 35 99 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 35 100 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 35 101 9.1. Normative References . . . . . . . . . . . . . . . . . . . 35 102 9.2. Informative References . . . . . . . . . . . . . . . . . . 36 103 Appendix A. Definition of Base SIP Message Information 104 Elements in IANA XML Registry format . . . . . . . . 37 105 Appendix B. Definition of sipMethod registry in IANA XML 106 Registry format . . . . . . . . . . . . . . . . . . . 40 107 Appendix C. Definition of Additional SIP Message Information 108 Elements in IANA XML Registry format . . . . . . . . 43 109 Appendix D. Example messages in base64 . . . . . . . . . . . . . 47 110 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 50 112 1. Introduction 114 IPFIX [RFC5101] provides a standardized means of exporting flow 115 information from IPFIX exporters to IPFIX collectors. This allows 116 collectors to analyze flows from one or more sources for numerous 117 uses, such as traffic patterns/trends, anomalies, failures, attacks, 118 and much more. IPFIX supports exporting data in near real-time, in a 119 secure manner, over multiple transports; as well as in local storage 120 with a defined file format. The core IPFIX information model is 121 maintained by IANA as a registry of Information Elements at 122 http://www.iana.org/assignments/ipfix/. In addition to these, which 123 cover many network measurement and management applications, 124 enterprise-specific Information Elements may be defined, scoped to an 125 SMI private enterprise number, for vendor-proprietary Information 126 Elements. 128 Session Initiation Protocol (SIP), defined by [RFC3261] and its 129 extensions, is used by many devices to perform a rendezvous service, 130 initiate and manage real-time communication sessions, install and 131 monitor state information, and more. In many deployments, SIP 132 messages cross multiple systems managed by the same administrative 133 entity, and thus providing a means of exporting and collecting SIP 134 message information from such systems using a standard protocol is 135 highly desirable. 137 This document defines a set of IPFIX Information Elements to enable 138 SIP devices, such as user agents and proxies, to export SIP message 139 information to IPFIX collectors using the IPFIX protocol. The 140 purpose of doing so is to enable collectors to analyze the SIP 141 "traffic", for similar purposes as those for any other IPFIX flows. 142 Defining IANA-registered (i.e., well-known) IPFIX IE fields enables 143 IPFIX records of SIP message information to be generated and consumed 144 by different vendors. Within the context of this document's IPFIX IE 145 fields, a single SIP message is a complete IPFIX Flow as defined in 146 [RFC5101] 148 The SIPCLF Working Group has defined a data model 149 [I-D.ietf-sipclf-problem-statement] for logging information about SIP 150 messages to ASCII-based SIPCLF files. While useful for on-box 151 storage and analysis with ASCII-based tools, SIPCLF does not provide 152 a means of exporting such information, nor is that its goal. This 153 document borrows the data model from SIPCLF and represents these in 154 IPFIX Information Elements. It additionally provides examples for 155 IPFIX representation of the example SIP Messages provided in the 156 SIPCLF problem statement. 158 2. Base Information Elements for SIP Message Information Export 160 The following Information Elements represent SIP-specific mandatory 161 fields defined in [I-D.ietf-sipclf-problem-statement], many 162 themselves taken from [RFC3261]. Together with Information Elements 163 already available in the IPFIX IANA Information Elements registry, 164 these can be used to export information about SIP Messages. 166 2.1. sipObservationType 168 Description: Denotes whether the entry was corresponds to a SIP 169 message received, sent, or merely seen by a passive observer, as 170 follows: 171 0: unknown: The Metering Process does not specify the observation 172 type. 173 1: receiver: The Metering Process is, or is co-located with, the 174 receiver of the SIP message. 175 2: sender: The Metering Process is, or is co-located with, the 176 sender of the SIP message. 177 3: passive: The Metering Process passively observed the SIP 178 message. 179 Data Type: unsigned8 180 Data Type Semantics: identifier 181 PEN (provisional): 35566 (trammell.ch) 182 ElementId (provisional): 419 184 2.2. sipMethod 186 Description: The SIP method from the CSeq header, encoded as per 187 the IPFIX sipMethod subregistry. 188 Data Type: unsigned8 189 Data Type Semantics: identifier 190 PEN (provisional): 35566 (trammell.ch) 191 ElementId (provisional): 402 193 2.3. sipSequenceNumber 195 Description: The sequence number from the CSeq header. 196 Data Type: unsigned32 197 Data Type Semantics: identifier 198 PEN (provisional): 35566 (trammell.ch) 199 ElementId (provisional): 409 201 2.4. sipRequestURI 202 Description: The SIP Request URI, including any parameters, as a 203 UTF-8 string, escaped according to SIP rules as received by the 204 metering process. 205 Data Type: string 206 PEN (provisional): 35566 (trammell.ch) 207 ElementId (provisional): 403 209 2.5. sipFromURI 211 Description: The URI from the SIP From: header 212 Data Type: string 213 PEN (provisional): 35566 (trammell.ch) 214 ElementId (provisional): 404 216 2.6. sipFromTag 218 Description: The Tag parameter value from the SIP From: header 219 Data Type: string 220 PEN (provisional): 35566 (trammell.ch) 221 ElementId (provisional): 405 223 2.7. sipToURI 225 Description: The URI from the SIP To: header 226 Data Type: string 227 PEN (provisional): 35566 (trammell.ch) 228 ElementId (provisional): 406 230 2.8. sipToTag 232 Description: The Tag parameter value from the SIP To: header 233 Data Type: string 234 PEN (provisional): 35566 (trammell.ch) 235 ElementId (provisional): 407 237 2.9. sipCallId 239 Description: The value of the SIP Call-ID: header 240 Data Type: string 241 PEN (provisional): 35566 (trammell.ch) 242 ElementId (provisional): 408 244 2.10. sipResponseStatus 245 Description: The SIP Response code. The presence of this 246 Information Element in a SIP Message record marks it as describing 247 a SIP response; if absent, the record describes a SIP request. 248 Data Type: unsigned16 249 Data Type Semantics: identifier 250 PEN (provisional): 35566 (trammell.ch) 251 ElementId (provisional): 412 253 2.11. sipServerTransaction 255 Description: The transaction identifier associated with the server 256 transaction. 257 Data Type: string 258 Data Type Semantics: identifier 259 PEN (provisional): 35566 (trammell.ch) 260 ElementId (provisional): 413 262 2.12. sipClientTransaction 264 Description: The transaction identifier associated with the client 265 transaction. 266 Data Type: string 267 Data Type Semantics: identifier 268 PEN (provisional): 35566 (trammell.ch) 269 ElementId (provisional): 414 271 2.13. sipMethod subregistry 273 The sipMethod subregistry assigns a number to encode each of the SIP 274 methods encoded in the Methods and Response Codes registry at 275 http://www.iana.org/assignments/sip-parameters in a 16-bit integer 276 Information Element. These numbers are assigned from 1 in 277 alphabetical order for the Methods defined as of the publication time 278 of this document; subsequent Methods added to the Methods and 279 Response Codes registry will be added to the IPFIX sipMethod 280 subregistry at such time they are added to the Methods and Response 281 Codes registry, using the lowest available unassigned number at the 282 time of addition. 284 +----------+------------+-----------+ 285 | Number | Method | Reference | 286 +----------+------------+-----------+ 287 | 0 | Unknown | | 288 | 1 | ACK | [RFC3261] | 289 | 2 | BYE | [RFC3261] | 290 | 3 | CANCEL | [RFC3261] | 291 | 4 | INFO | [RFC6086] | 292 | 5 | INVITE | [RFC3261] | 293 | 6 | MESSAGE | [RFC3428] | 294 | 7 | NOTIFY | [RFC3265] | 295 | 8 | OPTIONS | [RFC3261] | 296 | 9 | PRACK | [RFC3262] | 297 | 10 | PUBLISH | [RFC3903] | 298 | 11 | REFER | [RFC3515] | 299 | 12 | REGISTER | [RFC3261] | 300 | 13 | SUBSCRIBE | [RFC3265] | 301 | 14 | UPDATE | [RFC3311] | 302 | 15-65535 | Unassigned | | 303 +----------+------------+-----------+ 305 3. Additional Information Elements for SIP Message Information Export 307 [TODO frontmatter] 309 3.1. sipContactURI 311 Description: The addr-spec URI, including any URI parameters, of 312 the first/top-most SIP Contact header, as a UTF-8 string, escaped 313 according to SIP rules as received by the metering process. 314 Data Type: string 315 Data Type Semantics: 316 PEN (provisional): 35566 317 ElementId (provisional): 415 319 3.2. sipRouteURI 321 Description: The addr-spec URI, including any URI parameters, of 322 the first/top-most SIP Route header, as a UTF-8 string, escaped 323 according to SIP rules as received by the metering process. 324 Data Type: string 325 Data Type Semantics: 326 PEN (provisional): 35566 327 ElementId (provisional): 416 329 3.3. sipPaiURI 331 Description: The addr-spec URI, including any URI parameters, of 332 the first/top-most SIP P-Asserted-Identity header, as a UTF-8 333 string, escaped according to SIP rules as received by the metering 334 process. 335 Data Type: string 336 Data Type Semantics: 337 PEN (provisional): 35566 338 ElementId (provisional): 417 340 3.4. sipPpiURI 342 Description: The addr-spec URI, including any URI parameters, of 343 the first/top-most SIP P-Preferred-Identity header, as a UTF-8 344 string, escaped according to SIP rules as received by the metering 345 process. 346 Data Type: string 347 Data Type Semantics: 348 PEN (provisional): 35566 349 ElementId (provisional): 418 351 3.5. sipPAssocURI 353 Description: The addr-spec URI, including any URI parameters, of 354 the first/top-most SIP P-Associated-Identity header, as a UTF-8 355 string, escaped according to SIP rules as received by the metering 356 process. 357 Data Type: string 358 Data Type Semantics: 359 PEN (provisional): 35566 360 ElementId (provisional): 430 362 3.6. sipPCalledPartyURI 364 Description: The addr-spec URI, including any URI parameters, of 365 the SIP P-Called-Party-ID header, as a UTF-8 string, escaped 366 according to SIP rules as received by the metering process. 367 Data Type: string 368 Data Type Semantics: 369 PEN (provisional): 35566 370 ElementId (provisional): 420 372 3.7. sipVia 374 Description: The value of the first/top-most Via header as a UTF-8 375 string, escaped according to SIP rules as received by the metering 376 process. 377 Data Type: string 378 Data Type Semantics: 379 PEN (provisional): 35566 380 ElementId (provisional): 421 382 3.8. sipAuthUsername 384 Description: The value of the username field of the first/top-most 385 Authorization header as a UTF-8 string, escaped according to SIP 386 rules as received by the metering process. 387 Data Type: string 388 Data Type Semantics: 389 PEN (provisional): 35566 390 ElementId (provisional): 422 392 3.9. sipSubscriptionEvent 394 Description: The value of the Event header as a UTF-8 string, 395 escaped according to SIP rules as received by the metering 396 process. 397 Data Type: string 398 Data Type Semantics: 399 PEN (provisional): 35566 400 ElementId (provisional): 423 402 3.10. sipSubscriptionState 404 Description: The value of the Subscription-State header as a UTF-8 405 string, escaped according to SIP rules as received by the metering 406 process. 407 Data Type: string 408 Data Type Semantics: 409 PEN (provisional): 35566 410 ElementId (provisional): 424 412 3.11. sipExpires 414 Description: The numeric value of the expires parameter of the 415 first/top-most Contact header of a REGISTER request or response, 416 or Subscription-State header of a SUBSCRIBE or NOTIFY request or 417 response, or the Expires header if the expires parameter does not 418 exist, as received by the metering process. 420 Data Type: unsigned32 421 Data Type Semantics: 422 PEN (provisional): 35566 423 ElementId (provisional): 425 425 3.12. sipPVisitedNetworkID 427 Description: The value of the first/top-most P-Visited-Network-ID 428 header as a UTF-8 string, escaped according to SIP rules as 429 received by the metering process. 430 Data Type: string 431 Data Type Semantics: 432 PEN (provisional): 35566 433 ElementId (provisional): 426 435 3.13. sipPAccessNetworkInfo 437 Description: The value of the P-Access-Network-Info header as a 438 UTF-8 string, escaped according to SIP rules as received by the 439 metering process. 440 Data Type: string 441 Data Type Semantics: 442 PEN (provisional): 35566 443 ElementId (provisional): 427 445 3.14. sipPChargingFunctionAddr 447 Description: The value of the first/top-most P-Charging-Function- 448 Addresses header as a UTF-8 string, escaped according to SIP rules 449 as received by the metering process. 450 Data Type: string 451 Data Type Semantics: 452 PEN (provisional): 35566 453 ElementId (provisional): 428 455 3.15. sipPChargingVector 457 Description: The value of the P-Charging-Vector header as a UTF-8 458 string, escaped according to SIP rules as received by the metering 459 process. 460 Data Type: string 461 Data Type Semantics: 462 PEN (provisional): 35566 463 ElementId (provisional): 429 465 4. Recommended Templates for SIP Message Information Export 467 The SIPCLF data model represents SIP requests and SIP responses with 468 separate records. The following Templates are defined as recommended 469 base Templates for records describing requests and responses. 470 Optional Information Elements MAY be added to them, and the IPv4 471 addresses within these Templates MUST be replaced with IPv6 addresses 472 for logging IPv6 transport of SIP messages. A sipServerTransaction 473 Information Element SHOULD be added for all messages logged by a User 474 Agent Server, and a sipClientTransaction Information Element SHOULD 475 be added for all messages logged by a User Agent Client. These 476 templates follow the recommended fields for request and response 477 logging in [I-D.ietf-sipclf-problem-statement], and are defined using 478 the representation in section 9 of [I-D.trammell-ipfix-ie-doctors]. 480 observationTimeMilliseconds(323)[8] 481 sipSequenceNumber(35566/409)[4] 482 sourceIPv4Address(8)[4] 483 destinationIPv4Address(12)[4] 484 sourceTransportPort(7)[2] 485 destinationTransportPort(11)[2] 486 protocolIdentifier(4)[1] 487 sipMethod(35566/402)[1] 488 sipObservationType(35566/419)[1] 489 sipRequestURI(35566/403)[v] 490 sipToURI(35566/406)[v] 491 sipToTag(35566/407)[v] 492 sipFromURI(35566/404)[v] 493 sipFromTag(35566/405)[v] 494 sipCallId(35566/408)[v] 496 Figure 1: Base Request Template (IPv4) 498 observationTimeMilliseconds(323)[8] 499 sipSequenceNumber(35566/409)[4] 500 sourceIPv4Address(8)[4] 501 destinationIPv4Address(12)[4] 502 sourceTransportPort(7)[2] 503 destinationTransportPort(11)[2] 504 protocolIdentifier(4)[1] 505 sipMethod(35566/402)[1] 506 sipObservationType(35566/419)[1] 507 sipResponseStatus(35566/412)[2] 508 sipToURI(35566/406)[v] 509 sipToTag(35566/407)[v] 510 sipFromURI(35566/404)[v] 511 sipFromTag(35566/405)[v] 512 sipCallId(35566/408)[v] 514 Figure 2: Base Response Template (IPv4) 516 Note that the Information Elements in these templates are ordered to 517 place the fixed-length elements before the variable-length ones, 518 which speeds random access to fixed-length elements. However, since 519 element order within a record is unimportant in IPFIX, any ordering 520 of the mandatory Information Elements within a record MUST be 521 accepted by a Collecting Process as a valid SIP request or response 522 record for that record type. 524 The record type is determined by the presence of the 525 sipResponseStatus field. If present in the Template, the Template 526 describes a response record. If absent, it describes a request 527 record. 529 5. Examples 531 This section presents several views of an example SIP messages 532 exported using the IPFIX templates described in this document. We 533 present both binary and textual forms. The tools to generate this 534 section are based upon the open-source ripfix [ripfix] implementation 535 of IPFIX, maintained by one of the authors of this draft. 537 Here we show the IPFIX Messages generated by the situations in 538 sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement]. 540 5.1. Base Template Export 542 Before exporting any Request or Response records, the Templates 543 describing them must be exported. In this example, the templates 544 These Templates are derived from the base Templates as shown in 545 Figure 1 and Figure 2, with the sipClientTransaction and 546 sipServerTransaction Information Elements appended. We use two 547 templates here, one each for request and response for IPv4. 549 Exporting these Templates results in the following IPFIX message, 550 illustrated as an annotated hexdump in Figure 3. 552 0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39 ....L.*.......09 553 [ IPFIX message header, length 252 ] 554 0010: 00 02 00 ec .... 555 [ Template set (ID 2) header, length 236 ] 556 0014: 01 01 00 11 01 43 00 08 81 99 00 04 .....C...... 557 0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02 ................ 558 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................ 559 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................ 560 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................ 561 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................ 562 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................ 563 0080: 81 9d ff ff 00 00 8a ee ........ 564 [ Template 257, 17 elements (v4 request) ] 565 0088: 01 02 00 11 01 43 00 08 .....C.. 566 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04 ................ 567 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................ 568 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................ 569 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................ 570 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................ 571 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................ 572 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee ............ 573 [ Template 258, 17 elements (v4 response) ] 575 Figure 3: Base template message export 577 5.2. UAC registration 579 Having exported templates, now we create a simple IPFIX Message 580 representing a UAC registration as seen from the UAC, corresponding 581 to example 9.1 in [I-D.ietf-sipclf-problem-statement]. This message 582 contains two records, including the UAS registration request, and the 583 response received. This is shown in the annotated hexdump in 584 Figure 4. 586 0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39 ....L.........09 587 [ IPFIX message header, length 218 ] 588 0010: 01 01 00 6b ...k 589 [ Data set (ID 257) header, length 107 ] 590 0014: 00 00 01 29 13 66 13 93 00 00 00 01 ...).f...... 591 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f .3d..3d......... 592 0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00 sip:example.com. 593 0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d ..sip:alice@exam 594 0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 ple.com.76yhh.f8 595 0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 1-d4-f6@example. 596 0070: 63 6f 6d 06 63 2d 74 72 2d 31 00 com.c-tr-1. 597 [ Request record content ] 598 007b: 01 02 00 5d ...] 599 [ Data set (ID 258) header, length 93 ] 600 007f: 00 . 601 0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6 ..).f.$.....3d.. 602 0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73 3d.............s 603 00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example 604 00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64 .com.76yhh.f81-d 605 00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 4-f6@example.com 606 00d0: 06 63 2d 74 72 2d 31 00 .c-tr-1. 607 [ Response record content ] 609 Figure 4: Message containing two log entries for UAC registration 611 While this demonstrates the binary nature of the SIPCLF-IPFIX format, 612 and shows the content framing for this message, it is not readable 613 for illustration purposes. In Figure 5, we run the message through 614 the ripcollect tool provided with ripfix to provide a more human- 615 readable view. Note that the sipMethod and sipObservationType are 616 encoded according to the registries in Section 2. 618 ==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ==== 619 ---- record 12345/257 ---- 620 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC 621 sipSequenceNumber => 1 622 sourceIPv4Address => 198.51.100.1 623 destinationIPv4Address => 198.51.100.10 624 sourceTransportPort => 5060 625 destinationTransportPort => 5060 626 protocolIdentifier => 17 627 sipMethod => 12 628 sipObservationType => 2 629 sipRequestURI => sip:example.com 630 sipToURI => 631 sipToTag => 632 sipFromURI => sip:alice@example.com 633 sipFromTag => 76yhh 634 sipCallId => f81-d4-f6@example.com 635 sipClientTransaction => c-tr-1 636 sipServerTransaction => 637 ---- record 12345/258 ---- 638 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC 639 sipSequenceNumber => 1 640 sourceIPv4Address => 198.51.100.10 641 destinationIPv4Address => 198.51.100.1 642 sourceTransportPort => 5060 643 destinationTransportPort => 5060 644 sipResponseStatus => 200 645 protocolIdentifier => 17 646 sipMethod => 12 647 sipObservationType => 1 648 sipToURI => 649 sipToTag => 650 sipFromURI => sip:alice@example.com 651 sipFromTag => 76yhh 652 sipCallId => f81-d4-f6@example.com 653 sipClientTransaction => c-tr-1 654 sipServerTransaction => 656 Figure 5: Message containing two log entries for UAC registration 658 5.3. Direct Call 660 This example demonstrates the export of a direct call from Alice to 661 Bob, as seen by Bob's agent, corresponding to example 9.2 in 662 [I-D.ietf-sipclf-problem-statement]. Here we have four records: an 663 INVITE received from Alice, a 180 Ringing sent back followed by a 200 664 OK, and an ACK received from Alice. This is shown in the ripfix dump 665 in Figure 6 and the hexdump in Figure 7. In the hexdump, message 666 headers, set headers, and data records are separated by '|' 667 characters for compactness. Note here that each record has its own 668 data set to support high-speed seeking to a specific record, even 669 when two messages using the same template are adjacent in the 670 message. 672 ===== message 12345/0 @2010-10-21 13:11:43 UTC (#2) ===== 673 --- record 12345/257 (#1)--- 674 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC 675 sipSequenceNumber => 32 676 sourceIPv4Address => 198.51.100.1 677 destinationIPv4Address => 203.0.113.1 678 sourceTransportPort => 5060 679 destinationTransportPort => 5060 680 protocolIdentifier => 17 681 sipMethod => 5 682 sipObservationType => 2 683 sipRequestURI => sip:bob@bob1.example.net 684 sipToURI => sip:bob@example.net 685 sipToTag => 686 sipFromURI => sip:alice@example.com 687 sipFromTag => 76yhh 688 sipCallId => f82-d4-f7@example.com 689 sipClientTransaction => c-1-xt6 690 sipServerTransaction => 691 --- record 12345/258 (#2)--- 692 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC 693 sipSequenceNumber => 32 694 sourceIPv4Address => 203.0.113.1 695 destinationIPv4Address => 198.51.100.1 696 sourceTransportPort => 5060 697 destinationTransportPort => 5060 698 protocolIdentifier => 17 699 sipMethod => 5 700 sipObservationType => 1 701 sipResponseStatus => 180 702 sipToURI => sip:bob@example.net 703 sipToTag => b-in6-iu 704 sipFromURI => sip:alice@example.com 705 sipFromTag => 76yhh 706 sipCallId => f82-d4-f7@example.com 707 sipClientTransaction => c-1-xt6 708 sipServerTransaction => 709 --- record 12345/258 (#3)--- 710 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC 711 sipSequenceNumber => 32 712 sourceIPv4Address => 203.0.113.1 713 destinationIPv4Address => 198.51.100.1 714 sourceTransportPort => 5060 715 destinationTransportPort => 5060 716 protocolIdentifier => 17 717 sipMethod => 5 718 sipObservationType => 1 719 sipResponseStatus => 200 720 sipToURI => sip:bob@example.net 721 sipToTag => b-in6-iu 722 sipFromURI => sip:alice@example.com 723 sipFromTag => 76yhh 724 sipCallId => f82-d4-f7@example.com 725 sipClientTransaction => c-1-xt6 726 sipServerTransaction => 727 --- record 12345/257 (#4)--- 728 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC 729 sipSequenceNumber => 32 730 sourceIPv4Address => 198.51.100.1 731 destinationIPv4Address => 203.0.113.1 732 sourceTransportPort => 5060 733 destinationTransportPort => 5060 734 protocolIdentifier => 17 735 sipMethod => 1 736 sipObservationType => 2 737 sipRequestURI => sip:bob@bob1.example.net 738 sipToURI => sip:bob@example.net 739 sipToTag => b-in6-iu 740 sipFromURI => sip:alice@example.com 741 sipFromTag => 76yhh 742 sipCallId => f82-d4-f7@example.com 743 sipClientTransaction => c-1-xt6 744 sipServerTransaction => 746 Figure 6: Message containing four records for a simple call (ripfix 747 dump) 749 0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39| ....L.,.......09 750 0010: 01 01 00 88|00 00 01 29 13 66 13 93 00 00 00 20 .......).f..... 751 0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18 .3d...q......... 752 0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61 sip:bob@bob1.exa 753 0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 mple.net.sip:bob 754 0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si 755 0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 756 0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34 com.76yhh.f82-d4 757 0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07 -f7@example.com. 758 0090: 63 2d 31 2d 78 74 36 00|01 02 00 79|00 00 01 29 c-1-xt6....y...) 759 00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01 .f..... ..q..3d. 760 00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f ..........sip:bo 761 00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d b@example.net.b- 762 00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65 in6-iu.sip:alice 763 00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79 @example.com.76y 764 00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61 hh.f82-d4-f7@exa 765 0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36 mple.com.c-1-xt6 766 0110: 00|01 02 00 79|00 00 01 29 13 66 1c f4 00 00 00 ....y...).f..... 767 0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01 ..q..3d........ 768 0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 ...sip:bob@examp 769 0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu. 770 0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 771 0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82- 772 0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co 773 0180: 6d 07 63 2d 31 2d 78 74 36 00|01 01 00 90|00 00 m.c-1-xt6....... 774 0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00 .).f..... .3d... 775 01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f q.........sip:bo 776 01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 777 01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 778 01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu. 779 01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 780 01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82- 781 0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co 782 0210: 6d 07 63 2d 31 2d 78 74 36 00 m.c-1-xt6. 784 Figure 7: Message containing four records for a simple call (hexdump) 786 5.4. Single Downstream Branch Call 788 The example in Figure 8and Figure 9 demonstrates the export of a call 789 with a downstream branch to Bob, as seen by the proxy which the call 790 traverses, corresponding to example 9.3 in 791 [I-D.ietf-sipclf-problem-statement]. See this example in the problem 792 statement for more details. 794 ===== message 12345/0 @2010-10-21 13:12:42 UTC (#2) ===== 795 --- record 12345/257 (#1)--- 796 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC 797 sipSequenceNumber => 43 798 sourceIPv4Address => 198.51.100.1 799 destinationIPv4Address => 198.51.100.10 800 sourceTransportPort => 5060 801 destinationTransportPort => 5060 802 protocolIdentifier => 17 803 sipMethod => 5 804 sipObservationType => 1 805 sipRequestURI => sip:bob@example.net 806 sipToURI => sip:bob@example.net 807 sipToTag => 808 sipFromURI => sip:alice@example.com 809 sipFromTag => al-1 810 sipCallId => tr-87h@example.com 811 sipClientTransaction => 812 sipServerTransaction => s-x-tr 813 --- record 12345/258 (#2)--- 814 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC 815 sipSequenceNumber => 43 816 sourceIPv4Address => 198.51.100.10 817 destinationIPv4Address => 198.51.100.1 818 sourceTransportPort => 5060 819 destinationTransportPort => 5060 820 protocolIdentifier => 17 821 sipMethod => 5 822 sipObservationType => 2 823 sipResponseStatus => 100 824 sipToURI => sip:bob@example.net 825 sipToTag => 826 sipFromURI => sip:alice@example.com 827 sipFromTag => al-1 828 sipCallId => tr-87h@example.com 829 sipClientTransaction => 830 sipServerTransaction => s-x-tr 831 --- record 12345/257 (#3)--- 832 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC 833 sipSequenceNumber => 43 834 sourceIPv4Address => 198.51.100.10 835 destinationIPv4Address => 203.0.113.1 836 sourceTransportPort => 5060 837 destinationTransportPort => 5060 838 protocolIdentifier => 17 839 sipMethod => 5 840 sipObservationType => 2 841 sipRequestURI => sip:bob@bob1.example.net 842 sipToURI => sip:bob@example.net 843 sipToTag => 844 sipFromURI => sip:alice@example.com 845 sipFromTag => al-1 846 sipCallId => tr-87h@example.com 847 sipClientTransaction => c-x-tr 848 sipServerTransaction => s-x-tr 849 --- record 12345/258 (#4)--- 850 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC 851 sipSequenceNumber => 43 852 sourceIPv4Address => 203.0.113.1 853 destinationIPv4Address => 198.51.100.10 854 sourceTransportPort => 5060 855 destinationTransportPort => 5060 856 protocolIdentifier => 17 857 sipMethod => 5 858 sipObservationType => 1 859 sipResponseStatus => 100 860 sipToURI => sip:bob@example.net 861 sipToTag => b1-1 862 sipFromURI => sip:alice@example.com 863 sipFromTag => al-1 864 sipCallId => tr-87h@example.com 865 sipClientTransaction => c-x-tr 866 sipServerTransaction => s-x-tr 867 --- record 12345/258 (#5)--- 868 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC 869 sipSequenceNumber => 43 870 sourceIPv4Address => 203.0.113.1 871 destinationIPv4Address => 198.51.100.10 872 sourceTransportPort => 5060 873 destinationTransportPort => 5060 874 protocolIdentifier => 17 875 sipMethod => 5 876 sipObservationType => 1 877 sipResponseStatus => 180 878 sipToURI => sip:bob@example.net 879 sipToTag => b1-1 880 sipFromURI => sip:alice@example.com 881 sipFromTag => al-1 882 sipCallId => tr-87h@example.com 883 sipClientTransaction => c-x-tr 884 sipServerTransaction => s-x-tr 885 --- record 12345/258 (#6)--- 886 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC 887 sipSequenceNumber => 43 888 sourceIPv4Address => 198.51.100.10 889 destinationIPv4Address => 198.51.100.1 890 sourceTransportPort => 5060 891 destinationTransportPort => 5060 892 protocolIdentifier => 17 893 sipMethod => 5 894 sipObservationType => 2 895 sipResponseStatus => 180 896 sipToURI => sip:bob@example.net 897 sipToTag => b1-1 898 sipFromURI => sip:alice@example.com 899 sipFromTag => al-1 900 sipCallId => tr-87h@example.com 901 sipClientTransaction => c-x-tr 902 sipServerTransaction => s-x-tr 903 --- record 12345/258 (#7)--- 904 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC 905 sipSequenceNumber => 43 906 sourceIPv4Address => 203.0.113.1 907 destinationIPv4Address => 198.51.100.10 908 sourceTransportPort => 5060 909 destinationTransportPort => 5060 910 protocolIdentifier => 17 911 sipMethod => 5 912 sipObservationType => 1 913 sipResponseStatus => 200 914 sipToURI => sip:bob@example.net 915 sipToTag => b1-1 916 sipFromURI => sip:alice@example.com 917 sipFromTag => al-1 918 sipCallId => tr-87h@example.com 919 sipClientTransaction => c-x-tr 920 sipServerTransaction => s-x-tr 921 --- record 12345/258 (#8)--- 922 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC 923 sipSequenceNumber => 43 924 sourceIPv4Address => 198.51.100.10 925 destinationIPv4Address => 198.51.100.1 926 sourceTransportPort => 5060 927 destinationTransportPort => 5060 928 protocolIdentifier => 17 929 sipMethod => 5 930 sipObservationType => 2 931 sipResponseStatus => 200 932 sipToURI => sip:bob@example.net 933 sipToTag => b1-1 934 sipFromURI => sip:alice@example.com 935 sipFromTag => al-1 936 sipCallId => tr-87h@example.com 937 sipClientTransaction => c-x-tr 938 sipServerTransaction => s-x-tr 939 --- record 12345/257 (#9)--- 940 observationTimeMilliseconds => 2010-06-07 17:12:29 UTC 941 sipSequenceNumber => 43 942 sourceIPv4Address => 198.51.100.1 943 destinationIPv4Address => 198.51.100.10 944 sourceTransportPort => 5060 945 destinationTransportPort => 5060 946 protocolIdentifier => 17 947 sipMethod => 1 948 sipObservationType => 1 949 sipRequestURI => sip:bob@example.net 950 sipToURI => sip:bob@example.net 951 sipToTag => b1-1 952 sipFromURI => sip:alice@example.com 953 sipFromTag => al-1 954 sipCallId => tr-87h@example.com 955 sipClientTransaction => c-x-tr 956 sipServerTransaction => s-x-tr 957 --- record 12345/257 (#10)--- 958 observationTimeMilliseconds => 2010-06-07 17:12:29 UTC 959 sipSequenceNumber => 43 960 sourceIPv4Address => 198.51.100.10 961 destinationIPv4Address => 203.0.113.1 962 sourceTransportPort => 5060 963 destinationTransportPort => 5060 964 protocolIdentifier => 17 965 sipMethod => 1 966 sipObservationType => 2 967 sipRequestURI => sip:bob@example.net 968 sipToURI => sip:bob@example.net 969 sipToTag => b1-1 970 sipFromURI => sip:alice@example.com 971 sipFromTag => al-1 972 sipCallId => tr-87h@example.com 973 sipClientTransaction => c-x-tr 974 sipServerTransaction => s-x-tr 976 Figure 8: Message containing ten records for a downstream branch call 977 (ripfix dump) 979 0000: 00 0a 04 e1|4c c0 2c e5 00 00 00 00 00 00 30 39| ....L.,.......09 980 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+ 981 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13 .3d..3d......... 982 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 983 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam 984 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 985 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 986 0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 l-1.tr-87h@examp 987 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72|01 02 le.com..s-x-tr.. 989 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b c6 33 .l...).f.....+.3 990 00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 d..3d.........d. 991 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 992 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e 993 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 xample.com.al-1. 994 00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 tr-87h@example.c 995 00f0: 6f 6d 00 06 73 2d 78 2d 74 72|01 01 00 89|00 00 om..s-x-tr...... 996 0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00 .).f.....+.3d... 997 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo 998 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 999 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 1000 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic 1001 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c e@example.com.al 1002 0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c -1.tr-87h@exampl 1003 0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 e.com.c-x-tr.s-x 1004 0180: 2d 74 72|01 02 00 76|00 00 01 29 13 66 19 70 00 -tr...v...).f.p. 1005 0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11 ..+..q..3d...... 1006 01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61 ...d.sip:bob@exa 1007 01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si 1008 01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 1009 01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@ 1010 01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x- 1011 01f0: 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 00 01 tr.s-x-tr...v... 1012 0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64 ).f.....+..q..3d 1013 0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 ...........sip:b 1014 0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 ob@example.net.b 1015 0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 1-1.sip:alice@ex 1016 0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 ample.com.al-1.t 1017 0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f r-87h@example.co 1018 0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72|01 m.c-x-tr.s-x-tr. 1019 0270: 02 00 76|00 00 01 29 13 66 1c 98 00 00 00 2b c6 ..v...).f.....+. 1020 0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4 3d..3d.......... 1021 0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example 1022 02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c .net.b1-1.sip:al 1023 02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 ice@example.com. 1024 02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d al-1.tr-87h@exam 1025 02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 ple.com.c-x-tr.s 1026 02e0: 2d 78 2d 74 72|01 02 00 76|00 00 01 29 13 66 20 -x-tr...v...).f 1027 02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 ....+..q..3d.... 1028 0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65 .......sip:bob@e 1029 0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 xample.net.b1-1. 1030 0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 1031 0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 e.com.al-1.tr-87 1032 0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c- 1033 0350: 78 2d 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 x-tr.s-x-tr...v. 1034 0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6 ..).f!....+.3d.. 1035 0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70 3d...........sip 1036 0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net 1037 0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@ 1038 03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1 1039 03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example. 1040 03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t 1041 03d0: 72|01 01 00 88|00 00 01 29 13 66 28 ac 00 00 00 r.......).f(.... 1042 03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01 +.3d..3d........ 1043 03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example 1044 0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 .net.sip:bob@exa 1045 0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si 1046 0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 1047 0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@ 1048 0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x- 1049 0450: 74 72 06 73 2d 78 2d 74 72|01 01 00 88|00 00 01 tr.s-x-tr....... 1050 0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71 ).f(....+.3d...q 1051 0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62 .........sip:bob 1052 0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 @example.net.sip 1053 0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net 1054 04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@ 1055 04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1 1056 04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example. 1057 04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t 1058 04e0: 72 r 1060 Figure 9: Message containing ten log entries for a downstream branch 1061 call (hexdump) 1063 5.5. Forked Call 1065 The example in Figure 11 and Figure 12 demonstrates the export of 1066 forked call to Bob, as seen by one of Bob's instances which forks the 1067 call traverses, corresponding to example 9.4 in 1068 [I-D.ietf-sipclf-problem-statement]. See this example for more 1069 details. Note that, since Bob's first instance is multihomed IPv4- 1070 IPv6, this example requires additional templates: request and 1071 response templates for IPv4 to IPv6 and back, these are shown in 1072 Figure 10. 1074 0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09 1075 0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04 .........C...... 1076 0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02 ................ 1077 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................ 1078 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................ 1079 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................ 1080 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................ 1081 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................ 1082 0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08 .............C.. 1083 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10 ................ 1084 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................ 1085 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................ 1086 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................ 1087 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................ 1088 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................ 1089 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11 ................ 1090 0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10 .C.............. 1091 0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01 ................ 1092 0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee ................ 1093 0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee ................ 1094 0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee ................ 1095 0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee ................ 1096 0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee ................ 1097 0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee .....C.......... 1098 0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02 ................ 1099 0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01 ................ 1100 01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff ................ 1101 01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff ................ 1102 01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff ................ 1103 01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff ................ 1104 01e0: 00 00 8a ee .... 1106 Figure 10: Message containing templates for IPv4 to IPv6 requests and 1107 responses, and vice versa 1109 ===== message 12345/0 @2010-10-21 13:13:01 UTC (#3) ===== 1110 --- record 12345/257 (#1)--- 1111 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC 1112 sipSequenceNumber => 43 1113 sourceIPv4Address => 198.51.100.1 1114 destinationIPv4Address => 203.0.113.200 1115 sourceTransportPort => 5060 1116 destinationTransportPort => 5060 1117 protocolIdentifier => 17 1118 sipMethod => 5 1119 sipObservationType => 1 1120 sipRequestURI => sip:bob@example.net 1121 sipToURI => sip:bob@example.net 1122 sipToTag => 1123 sipFromURI => sip:alice@example.com 1124 sipFromTag => a1-1 1125 sipCallId => tr-88h@example.com 1126 sipClientTransaction => 1127 sipServerTransaction => s-1-tr 1128 --- record 12345/258 (#2)--- 1129 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC 1130 sipSequenceNumber => 43 1131 sourceIPv4Address => 203.0.113.200 1132 destinationIPv4Address => 198.51.100.1 1133 sourceTransportPort => 5060 1134 destinationTransportPort => 5060 1135 protocolIdentifier => 17 1136 sipMethod => 5 1137 sipObservationType => 2 1138 sipResponseStatus => 100 1139 sipToURI => sip:bob@example.net 1140 sipToTag => 1141 sipFromURI => sip:alice@example.com 1142 sipFromTag => a1-1 1143 sipCallId => tr-88h@example.com 1144 sipClientTransaction => 1145 sipServerTransaction => s-1-tr 1146 --- record 12345/257 (#3)--- 1147 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC 1148 sipSequenceNumber => 43 1149 sourceIPv4Address => 203.0.113.200 1150 destinationIPv4Address => 203.0.113.1 1151 sourceTransportPort => 5060 1152 destinationTransportPort => 5060 1153 protocolIdentifier => 17 1154 sipMethod => 5 1155 sipObservationType => 2 1156 sipRequestURI => sip:bob@bob1.example.net 1157 sipToURI => sip:bob@example.net 1158 sipToTag => 1159 sipFromURI => sip:alice@example.com 1160 sipFromTag => a1-1 1161 sipCallId => tr-88h@example.com 1162 sipClientTransaction => c-1-tr 1163 sipServerTransaction => s-1-tr 1164 --- record 12345/261 (#4)--- 1165 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC 1166 sipSequenceNumber => 43 1167 sourceIPv4Address => 203.0.113.200 1168 destinationIPv6Address => 2001:db8::9 1169 sourceTransportPort => 5060 1170 destinationTransportPort => 5060 1171 protocolIdentifier => 17 1172 sipMethod => 5 1173 sipObservationType => 2 1174 sipRequestURI => sip:bob@bob2.example.net 1175 sipToURI => sip:bob@example.net 1176 sipToTag => 1177 sipFromURI => sip:alice@example.com 1178 sipFromTag => a1-1 1179 sipCallId => tr-88h@example.com 1180 sipClientTransaction => c-2-tr 1181 sipServerTransaction => s-1-tr 1182 --- record 12345/258 (#5)--- 1183 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC 1184 sipSequenceNumber => 43 1185 sourceIPv4Address => 203.0.113.1 1186 destinationIPv4Address => 203.0.113.200 1187 sourceTransportPort => 5060 1188 destinationTransportPort => 5060 1189 protocolIdentifier => 17 1190 sipMethod => 5 1191 sipObservationType => 1 1192 sipResponseStatus => 100 1193 sipToURI => sip:bob@example.net 1194 sipToTag => b1-1 1195 sipFromURI => sip:alice@example.com 1196 sipFromTag => a1-1 1197 sipCallId => tr-88h@example.com 1198 sipClientTransaction => c-1-tr 1199 sipServerTransaction => s-1-tr 1200 --- record 12345/264 (#6)--- 1201 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC 1202 sipSequenceNumber => 43 1203 sourceIPv6Address => 2001:db8::9 1204 destinationIPv4Address => 203.0.113.200 1205 sourceTransportPort => 5060 1206 destinationTransportPort => 5060 1207 protocolIdentifier => 17 1208 sipMethod => 5 1209 sipObservationType => 1 1210 sipResponseStatus => 100 1211 sipToURI => sip:bob@example.net 1212 sipToTag => b2-2 1213 sipFromURI => sip:alice@example.com 1214 sipFromTag => a1-1 1215 sipCallId => tr-88h@example.com 1216 sipClientTransaction => c-2-tr 1217 sipServerTransaction => s-1-tr 1218 --- record 12345/264 (#7)--- 1219 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC 1220 sipSequenceNumber => 43 1221 sourceIPv6Address => 2001:db8::9 1222 destinationIPv4Address => 203.0.113.200 1223 sourceTransportPort => 5060 1224 destinationTransportPort => 5060 1225 protocolIdentifier => 17 1226 sipMethod => 5 1227 sipObservationType => 1 1228 sipResponseStatus => 180 1229 sipToURI => sip:bob@example.net 1230 sipToTag => b2-2 1231 sipFromURI => sip:alice@example.com 1232 sipFromTag => a1-1 1233 sipCallId => tr-88h@example.com 1234 sipClientTransaction => c-2-tr 1235 sipServerTransaction => s-1-tr 1236 --- record 12345/258 (#8)--- 1237 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC 1238 sipSequenceNumber => 43 1239 sourceIPv4Address => 203.0.113.200 1240 destinationIPv4Address => 198.51.100.1 1241 sourceTransportPort => 5060 1242 destinationTransportPort => 5060 1243 protocolIdentifier => 17 1244 sipMethod => 5 1245 sipObservationType => 2 1246 sipResponseStatus => 180 1247 sipToURI => sip:bob@example.net 1248 sipToTag => 1249 sipFromURI => sip:alice@example.com 1250 sipFromTag => a1-1 1251 sipCallId => tr-88h@example.com 1252 sipClientTransaction => c-2-tr 1253 sipServerTransaction => s-1-tr 1254 --- record 12345/258 (#9)--- 1255 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC 1256 sipSequenceNumber => 43 1257 sourceIPv4Address => 203.0.113.200 1258 destinationIPv4Address => 198.51.100.1 1259 sourceTransportPort => 5060 1260 destinationTransportPort => 5060 1261 protocolIdentifier => 17 1262 sipMethod => 5 1263 sipObservationType => 2 1264 sipResponseStatus => 180 1265 sipToURI => sip:bob@example.net 1266 sipToTag => b1-1 1267 sipFromURI => sip:alice@example.com 1268 sipFromTag => a1-1 1269 sipCallId => tr-88h@example.com 1270 sipClientTransaction => c-1-tr 1271 sipServerTransaction => s-1-tr 1272 --- record 12345/258 (#10)--- 1273 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC 1274 sipSequenceNumber => 43 1275 sourceIPv4Address => 203.0.113.1 1276 destinationIPv4Address => 203.0.113.200 1277 sourceTransportPort => 5060 1278 destinationTransportPort => 5060 1279 protocolIdentifier => 17 1280 sipMethod => 5 1281 sipObservationType => 1 1282 sipResponseStatus => 200 1283 sipToURI => sip:bob@example.net 1284 sipToTag => b1-1 1285 sipFromURI => sip:alice@example.com 1286 sipFromTag => a1-1 1287 sipCallId => tr-88h@example.com 1288 sipClientTransaction => c-1-tr 1289 sipServerTransaction => s-1-tr 1290 --- record 12345/258 (#11)--- 1291 observationTimeMilliseconds => 2010-06-07 17:12:28 UTC 1292 sipSequenceNumber => 43 1293 sourceIPv4Address => 203.0.113.200 1294 destinationIPv4Address => 198.51.100.1 1295 sourceTransportPort => 5060 1296 destinationTransportPort => 5060 1297 protocolIdentifier => 17 1298 sipMethod => 5 1299 sipObservationType => 2 1300 sipResponseStatus => 200 1301 sipToURI => sip:bob@example.net 1302 sipToTag => b1-1 1303 sipFromURI => sip:alice@example.com 1304 sipFromTag => a1-1 1305 sipCallId => tr-88h@example.com 1306 sipClientTransaction => c-1-tr 1307 sipServerTransaction => s-1-tr 1308 --- record 12345/261 (#12)--- 1309 observationTimeMilliseconds => 2010-06-07 17:12:28 UTC 1310 sipSequenceNumber => 43 1311 sourceIPv4Address => 203.0.113.200 1312 destinationIPv6Address => 2001:db8::9 1313 sourceTransportPort => 5060 1314 destinationTransportPort => 5060 1315 protocolIdentifier => 17 1316 sipMethod => 3 1317 sipObservationType => 2 1318 sipRequestURI => sip:bob@bob2.example.net 1319 sipToURI => sip:bob@example.net 1320 sipToTag => 1321 sipFromURI => sip:alice@example.com 1322 sipFromTag => a1-1 1323 sipCallId => tr-88h@example.com 1324 sipClientTransaction => c-2-tr 1325 sipServerTransaction => s-1-tr 1326 --- record 12345/264 (#13)--- 1327 observationTimeMilliseconds => 2010-06-07 17:12:28 UTC 1328 sipSequenceNumber => 43 1329 sourceIPv6Address => 2001:db8::9 1330 destinationIPv4Address => 203.0.113.200 1331 sourceTransportPort => 5060 1332 destinationTransportPort => 5060 1333 protocolIdentifier => 17 1334 sipMethod => 5 1335 sipObservationType => 1 1336 sipResponseStatus => 487 1337 sipToURI => sip:bob@example.net 1338 sipToTag => 1339 sipFromURI => sip:alice@example.com 1340 sipFromTag => a1-1 1341 sipCallId => tr-88h@example.com 1342 sipClientTransaction => c-2-tr 1343 sipServerTransaction => s-1-tr 1344 --- record 12345/261 (#14)--- 1345 observationTimeMilliseconds => 2010-06-07 17:12:29 UTC 1346 sipSequenceNumber => 43 1347 sourceIPv4Address => 203.0.113.200 1348 destinationIPv6Address => 2001:db8::9 1349 sourceTransportPort => 5060 1350 destinationTransportPort => 5060 1351 protocolIdentifier => 17 1352 sipMethod => 1 1353 sipObservationType => 2 1354 sipRequestURI => sip:bob@bob2.example.net 1355 sipToURI => sip:bob@example.net 1356 sipToTag => 1357 sipFromURI => sip:alice@example.com 1358 sipFromTag => a1-1 1359 sipCallId => tr-88h@example.com 1360 sipClientTransaction => c-2-tr 1361 sipServerTransaction => s-1-tr 1362 --- record 12345/264 (#15)--- 1363 observationTimeMilliseconds => 2010-06-07 17:12:30 UTC 1364 sipSequenceNumber => 43 1365 sourceIPv6Address => 2001:db8::9 1366 destinationIPv4Address => 203.0.113.200 1367 sourceTransportPort => 5060 1368 destinationTransportPort => 5060 1369 protocolIdentifier => 17 1370 sipMethod => 3 1371 sipObservationType => 1 1372 sipResponseStatus => 200 1373 sipToURI => sip:bob@example.net 1374 sipToTag => 1375 sipFromURI => sip:alice@example.com 1376 sipFromTag => a1-1 1377 sipCallId => tr-88h@example.com 1378 sipClientTransaction => c-2-tr 1379 sipServerTransaction => s-1-tr 1381 Figure 11: Message containing fifteen records for a forked call 1383 0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39| ....L.-.......09 1384 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+ 1385 0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13 .3d...q......... 1386 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 1387 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam 1388 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 1389 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 1390 0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp 1391 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72|01 02 le.com..s-1-tr.. 1392 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b cb 00 .l...).f.....+.. 1393 00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 q..3d.........d. 1394 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example. 1395 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e 1396 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 1397 00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 1398 00f0: 6f 6d 00 06 73 2d 31 2d 74 72|01 01 00 89|00 00 om..s-1-tr...... 1399 0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00 .).f.....+..q... 1400 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo 1401 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n 1402 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp 1403 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic 1404 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 e@example.com.a1 1405 0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c -1.tr-88h@exampl 1406 0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 e.com.c-1-tr.s-1 1407 0180: 2d 74 72|01 05 00 95|00 00 01 29 13 66 1a 9c 00 -tr.......).f... 1409 0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00 ..+..q. ........ 1410 01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73 ...............s 1411 01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d ip:bob@bob2.exam 1412 01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 ple.net.sip:bob@ 1413 01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70 example.net..sip 1414 01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 :alice@example.c 1415 01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 om.a1-1.tr-88h@e 1416 0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 xample.com.c-2-t 1417 0210: 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 01 29 r.s-1-tr...v...) 1418 0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8 .f.....+..q...q. 1419 0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f ........d.sip:bo 1420 0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 b@example.net.b1 1421 0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 -1.sip:alice@exa 1422 0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr 1423 0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com 1424 0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-1-tr.s-1-tr.. 1425 0290: 00 82|00 00 01 29 13 66 1c f4 00 00 00 2b 20 01 .....).f.....+ . 1426 02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................ 1427 02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a q.........d.sip: 1428 02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net. 1429 02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65 b2-2.sip:alice@e 1430 02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 1431 02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 1432 0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72| om.c-2-tr.s-1-tr 1433 0310: 01 08 00 82|00 00 01 29 13 66 1f 4c 00 00 00 2b .......).f.L...+ 1434 0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 ............... 1435 0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69 ..q...........si 1436 0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne 1437 0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 t.b2-2.sip:alice 1438 0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d @example.com.a1- 1439 0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 1.tr-88h@example 1440 0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d .com.c-2-tr.s-1- 1441 0390: 74 72|01 02 00 72|00 00 01 29 13 66 20 6e 00 00 tr...r...).f n.. 1442 03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 .+..q..3d....... 1443 03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d ....sip:bob@exam 1444 03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali 1445 03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a 1446 03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp 1447 03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d le.com.c-2-tr.s- 1448 0400: 31 2d 74 72|01 02 00 76|00 00 01 29 13 66 21 a4 1-tr...v...).f!. 1449 0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 ...+..q..3d..... 1450 0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 ......sip:bob@ex 1451 0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 ample.net.b1-1.s 1452 0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example 1453 0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 .com.a1-1.tr-88h 1454 0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 @example.com.c-1 1455 0470: 2d 74 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 -tr.s-1-tr...v.. 1456 0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00 .).f#....+..q... 1458 0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a q...........sip: 1459 04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net. 1460 04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 b1-1.sip:alice@e 1461 04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1. 1462 04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c 1463 04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72| om.c-1-tr.s-1-tr 1464 04f0: 01 02 00 76|00 00 01 29 13 66 24 60 00 00 00 2b ...v...).f$`...+ 1465 0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 ..q..3d......... 1466 0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c ..sip:bob@exampl 1467 0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 e.net.b1-1.sip:a 1468 0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d lice@example.com 1469 0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 .a1-1.tr-88h@exa 1470 0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 mple.com.c-1-tr. 1471 0560: 73 2d 31 2d 74 72|01 05 00 95|00 00 01 29 13 66 s-1-tr.......).f 1472 0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 %)...+..q. ..... 1473 0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03 ................ 1474 0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 ..sip:bob@bob2.e 1475 05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 xample.net.sip:b 1476 05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 ob@example.net.. 1477 05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl 1478 05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 e.com.a1-1.tr-88 1479 05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c- 1480 05f0: 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 00 7e|00 2-tr.s-1-tr...~. 1481 0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00 ..).f(?...+ .... 1482 0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13 .............q.. 1483 0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62 .........sip:bob 1484 0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si 1485 0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example. 1486 0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 com.a1-1.tr-88h@ 1487 0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d example.com.c-2- 1488 0670: 74 72 06 73 2d 31 2d 74 72|01 05 00 95|00 00 01 tr.s-1-tr....... 1489 0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d ).f*....+..q. .. 1490 0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13 ................ 1491 06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 .....sip:bob@bob 1492 06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 2.example.net.si 1493 06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne 1494 06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 t..sip:alice@exa 1495 06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr 1496 06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com 1497 0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-2-tr.s-1-tr.. 1498 0710: 00 7e|00 00 01 29 13 66 2c 31 00 00 00 2b 20 01 .~...).f,1...+ . 1499 0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................ 1500 0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a q...........sip: 1501 0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 bob@example.net. 1502 0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 .sip:alice@examp 1503 0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 le.com.a1-1.tr-8 1504 0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 8h@example.com.c 1505 0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72 -2-tr.s-1-tr 1506 Figure 12: Message containing sixteen log entries for a forked call 1508 6. Security Considerations 1510 [TODO] 1512 7. IANA Considerations 1514 This document defines the sipMethod subregistry for the IANA IPFIX 1515 Information Element registry at http://www.iana.org/assignments/ipfix 1516 for the values taken by the sipMethod Information Element. The 1517 initial content of this subregistry is specified in Section 2.13. 1518 Entries may be added to this subregistry subject to the same 1519 Standards Action [RFC5226] that adds new Methods to the Methods and 1520 Response Codes registry at 1521 http://www.iana.org/assignments/sip-parameters. 1523 At such time as this document is prepared for publication as an RFC, 1524 the Information Elements defined herein will be defined for inclusion 1525 in the IANA IPFIX Information Element registry at 1526 http://www.iana.org/assignments/ipfix. Until such time, the 1527 Information Elements within this document are defined within Private 1528 Enterprise Number 35566, belonging to one of the authors. 1530 8. Acknowledgments 1532 Thanks to Cullen Jennings for his provided insightful discussions, 1533 specific comments and much needed corrections, and to Nico d'Heureuse 1534 for his help with the RFC 3665 examples. 1536 9. References 1538 9.1. Normative References 1540 [I-D.ietf-sipclf-problem-statement] 1541 Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O. 1542 Festor, "The Common Log Format (CLF) for the Session 1543 Initiation Protocol (SIP)", 1544 draft-ietf-sipclf-problem-statement-07 (work in progress), 1545 June 2011. 1547 [RFC5101] Claise, B., "Specification of the IP Flow Information 1548 Export (IPFIX) Protocol for the Exchange of IP Traffic 1549 Flow Information", RFC 5101, January 2008. 1551 [RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A. 1552 Wagner, "Specification of the IP Flow Information Export 1553 (IPFIX) File Format", RFC 5655, October 2009. 1555 9.2. Informative References 1557 [I-D.kaplan-dispatch-session-id] 1558 Kaplan, H., "A Session Identifier for the Session 1559 Initiation Protocol (SIP)", 1560 draft-kaplan-dispatch-session-id-03 (work in progress), 1561 March 2011. 1563 [I-D.trammell-ipfix-ie-doctors] 1564 Trammell, B. and B. Claise, "Guidelines for Authors and 1565 Reviewers of IPFIX Information Elements", 1566 draft-trammell-ipfix-ie-doctors-02 (work in progress), 1567 June 2011. 1569 [RFC2976] Donovan, S., "The SIP INFO Method", RFC 2976, 1570 October 2000. 1572 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 1573 A., Peterson, J., Sparks, R., Handley, M., and E. 1574 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 1575 June 2002. 1577 [RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of 1578 Provisional Responses in Session Initiation Protocol 1579 (SIP)", RFC 3262, June 2002. 1581 [RFC3265] Roach, A., "Session Initiation Protocol (SIP)-Specific 1582 Event Notification", RFC 3265, June 2002. 1584 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) 1585 UPDATE Method", RFC 3311, October 2002. 1587 [RFC3428] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C., 1588 and D. Gurle, "Session Initiation Protocol (SIP) Extension 1589 for Instant Messaging", RFC 3428, December 2002. 1591 [RFC3515] Sparks, R., "The Session Initiation Protocol (SIP) Refer 1592 Method", RFC 3515, April 2003. 1594 [RFC3665] Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and 1595 K. Summers, "Session Initiation Protocol (SIP) Basic Call 1596 Flow Examples", BCP 75, RFC 3665, December 2003. 1598 [RFC3903] Niemi, A., "Session Initiation Protocol (SIP) Extension 1599 for Event State Publication", RFC 3903, October 2004. 1601 [RFC4475] Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J., 1602 and H. Schulzrinne, "Session Initiation Protocol (SIP) 1603 Torture Test Messages", RFC 4475, May 2006. 1605 [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an 1606 IANA Considerations Section in RFCs", BCP 26, RFC 5226, 1607 May 2008. 1609 [RFC6026] Sparks, R. and T. Zourzouvillys, "Correct Transaction 1610 Handling for 2xx Responses to Session Initiation Protocol 1611 (SIP) INVITE Requests", RFC 6026, September 2010. 1613 [RFC6086] Holmberg, C., Burger, E., and H. Kaplan, "Session 1614 Initiation Protocol (SIP) INFO Method and Package 1615 Framework", RFC 6086, January 2011. 1617 [ripfix] Trammell, B., "ripfix: IPFIX for Ruby", available at 1618 http://ripfix.rubyforge.org/. 1620 Appendix A. Definition of Base SIP Message Information Elements in IANA 1621 XML Registry format 1623 [EDITOR'S NOTE: frontmatter] 1625 1626 1627 1628 sipObservationType 1629 unsigned8 1630 identifier 1631 35566 1632 419 1633 current 1634 1635 1636 Denotes whether the entry was 1637 corresponds to a SIP message received, sent, or merely 1638 seen by a passive observer, as follows: 1639 1640 0: unknown: The Metering Process does not 1641 specify the observation type. 1642 1: receiver: The Metering Process is, or is 1643 co-located with, the receiver of the SIP message. 1644 2: sender: The Metering Process is, or is 1645 co-located with, the sender of the SIP message. 1647 3: passive: The Metering Process passively 1648 observed the SIP message. 1649 1650 1651 1652 sipMethod 1653 unsigned8 1654 identifier 1655 35566 1656 402 1657 current 1658 1659 1660 The SIP method from the CSeq header, encoded as per 1661 the IPFIX sipMethod subregistry. 1662 1663 1664 1665 1666 sipSequenceNumber 1667 unsigned32 1668 identifier 1669 35566 1670 409 1671 current 1672 1673 The sequence number from the CSeq header. 1674 1675 1676 1677 sipRequestURI 1678 string 1679 35566 1680 403 1681 current 1682 1683 The SIP Request URI, including any parameters, 1684 as a UTF-8 string, escaped according to SIP rules as 1685 received by the metering process. 1686 1687 1688 1689 sipFromURI 1690 string 1691 35566 1692 404 1693 current 1694 1695 The URI from the SIP From: header 1696 1697 1698 1699 sipFromTag 1700 string 1701 35566 1702 405 1703 current 1704 1705 The Tag parameter value from the SIP 1706 From: header 1707 1708 1709 1710 sipToURI 1711 string 1712 35566 1713 406 1714 current 1715 1716 The URI from the SIP To: header 1717 1718 1719 1720 sipToTag 1721 string 1722 35566 1723 407 1724 current 1725 1726 The Tag parameter value from the SIP To: 1727 header 1728 1729 1730 1731 sipCallId 1732 string 1733 35566 1734 408 1735 current 1736 1737 The value of the SIP Call-ID: header 1738 1739 1740 1741 sipResponseStatus 1742 unsigned16 1743 identifier 1744 35566 1745 412 1746 current 1747 1748 The SIP Response code. The presence of this 1749 Information Element in a SIP Message record marks it as 1750 describing a SIP response; if absent, the record describes 1751 a SIP request. 1752 1753 1754 1755 sipServerTransaction 1756 string 1757 identifier 1758 35566 1759 413 1760 current 1761 1762 The transaction identifier associated with 1763 the server transaction. 1764 1765 1766 1767 sipClientTransaction 1768 string 1769 identifier 1770 35566 1771 414 1772 current 1773 1774 The transaction identifier associated with 1775 the client transaction. 1776 1777 1778 1779 1781 SIP Message Information Element definitions 1783 Appendix B. Definition of sipMethod registry in IANA XML Registry 1784 format 1786 [EDITOR'S NOTE: frontmatter] 1788 1789 1790 IPFIX sipMethod 1791 Expert Review 1792 1793 0 1794 Unknown 1795 The Metering Process did not 1796 recognize the SIP method. 1797 1798 1799 1 1800 ACK 1801 1802 1803 1804 1805 2 1806 BYE 1807 1808 1809 1810 1811 3 1812 CANCEL 1813 1814 1815 1816 1817 4 1818 INFO 1819 1820 1821 1822 1823 5 1824 INVITE 1825 1826 1827 1828 1829 6 1830 MESSAGE 1831 1832 1833 1834 1835 7 1836 NOTIFY 1837 1838 1839 1840 1841 8 1842 OPTIONS 1843 1844 1845 1846 1847 9 1848 PRACK 1849 1850 1851 1852 1853 10 1854 PUBLISH 1855 1856 1857 1858 1859 11 1860 REFER 1861 1862 1863 1864 1865 12 1866 REGISTER 1867 1868 1869 1870 1871 13 1872 SUBSCRIBE 1873 1874 1875 1876 1877 14 1878 UPDATE 1879 1880 1881 1882 1883 15-65535 1884 Unassigned 1885 1887 1888 1889 1891 sipMethod subregistry 1893 Appendix C. Definition of Additional SIP Message Information Elements 1894 in IANA XML Registry format 1896 [EDITOR'S NOTE: frontmatter] 1898 1900 1901 1903 1904 sipContactURI 1905 string 1906 35566 1907 415 1908 current 1909 1910 The addr-spec URI, including any URI parameters, 1911 of the first/top-most SIP Contact header, 1912 as a UTF-8 string, escaped according to SIP rules as 1913 received by the metering process. 1914 1915 1916 1917 sipRouteURI 1918 string 1919 35566 1920 416 1921 current 1922 1923 The addr-spec URI, including any URI parameters, 1924 of the first/top-most SIP Route header, 1925 as a UTF-8 string, escaped according to SIP rules as 1926 received by the metering process. 1927 1928 1929 1930 sipPaiURI 1931 string 1932 35566 1933 417 1934 current 1935 1936 The addr-spec URI, including any URI parameters, 1937 of the first/top-most SIP P-Asserted-Identity header, 1938 as a UTF-8 string, escaped according to SIP rules as 1939 received by the metering process. 1940 1941 1942 1943 sipPpiURI 1944 string 1945 35566 1946 418 1947 current 1948 1949 The addr-spec URI, including any URI parameters, 1950 of the first/top-most SIP P-Preferred-Identity header, 1951 as a UTF-8 string, escaped according to SIP rules as 1952 received by the metering process. 1953 1954 1955 1956 sipPAssocURI 1957 string 1958 35566 1959 430 1960 current 1961 1962 The addr-spec URI, including any URI parameters, 1963 of the first/top-most SIP P-Associated-Identity header, 1964 as a UTF-8 string, escaped according to SIP rules as 1965 received by the metering process. 1966 1967 1968 1969 sipPCalledPartyURI 1970 string 1971 35566 1972 420 1973 current 1974 1975 The addr-spec URI, including any URI parameters, 1976 of the SIP P-Called-Party-ID header, 1977 as a UTF-8 string, escaped according to SIP rules as 1978 received by the metering process. 1979 1980 1981 1982 sipVia 1983 string 1984 35566 1985 421 1986 current 1987 1988 The value of the first/top-most Via header 1989 as a UTF-8 string, escaped according to SIP rules as 1990 received by the metering process. 1991 1992 1993 1994 sipAuthUsername 1995 string 1996 35566 1997 422 1998 current 1999 2000 The value of the username field 2001 of the first/top-most Authorization header 2002 as a UTF-8 string, escaped according to SIP rules as 2003 received by the metering process. 2004 2005 2006 2007 sipSubscriptionEvent 2008 string 2009 35566 2010 423 2011 current 2012 2013 The value of the Event header 2014 as a UTF-8 string, escaped according to SIP rules as 2015 received by the metering process. 2016 2017 2018 2019 sipSubscriptionState 2020 string 2021 35566 2022 424 2023 current 2024 2025 The value of the Subscription-State header 2026 as a UTF-8 string, escaped according to SIP rules as 2027 received by the metering process. 2028 2029 2030 2031 sipExpires 2032 unsigned32 2033 35566 2034 425 2035 current 2036 2037 The numeric value of the expires parameter of the 2038 first/top-most Contact header of a REGISTER request 2039 or response, or Subscription-State header of a SUBSCRIBE 2040 or NOTIFY request or response, or the Expires header 2041 if the expires parameter does not exist, as 2042 received by the metering process. 2043 2044 2045 2046 sipPVisitedNetworkID 2047 string 2048 35566 2049 426 2050 current 2051 2052 The value of the first/top-most P-Visited-Network-ID 2053 header as a UTF-8 string, escaped according to SIP rules as 2054 received by the metering process. 2055 2056 2057 2058 sipPAccessNetworkInfo 2059 string 2060 35566 2061 427 2062 current 2063 2064 The value of the P-Access-Network-Info header 2065 as a UTF-8 string, escaped according to SIP rules as 2066 received by the metering process. 2067 2068 2069 2070 sipPChargingFunctionAddr 2071 string 2072 35566 2073 428 2074 current 2075 2076 The value of the first/top-most 2077 P-Charging-Function-Addresses header 2078 as a UTF-8 string, escaped according to SIP rules as 2079 received by the metering process. 2080 2081 2082 2083 sipPChargingVector 2084 string 2085 35566 2086 429 2087 current 2088 2089 The value of the P-Charging-Vector header 2090 as a UTF-8 string, escaped according to SIP rules as 2091 received by the metering process. 2092 2093 2094 2095 2097 Additional SIP Message Information Element definitions 2099 Appendix D. Example messages in base64 2101 This section contains the example messages from this revision of this 2102 draft in base64 encoding, for ease of processing by automated tools. 2104 The base templates are in this message: 2106 AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA 2107 BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX 2108 //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK 2109 7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru 2110 gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A 2111 AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru 2113 The extended 4to6 and 6to4 templates are in this message: 2115 AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA 2116 BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX 2117 //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK 2118 7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru 2119 gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A 2120 AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb 2121 ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/ 2122 /wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3// 2123 wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB 2124 kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf// 2125 AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g== 2127 The UAC registration in Section 5.2 is in this message: 2129 AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR 2130 DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2 2131 eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk 2132 AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t 2133 BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA 2135 The direct call in Section 5.3 is in this message: 2137 AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR 2138 BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u 2139 ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh 2140 bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE 2141 EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA 2142 ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14 2143 dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA 2144 ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2 2145 eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd 2146 CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0 2147 E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w 2148 bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA== 2150 The downstream branch call in Section 5.4 is in this message: 2152 AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR 2153 BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz 2154 aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A 2155 BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6 2156 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0 2157 ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK 2158 ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA 2159 ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3 2160 aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA 2161 cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6 2162 YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14 2163 LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz 2164 aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t 2165 BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB 2166 KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l 2167 dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt 2168 cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK 2169 E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA 2170 ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt 2171 eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i 2172 QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES 2173 dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA 2174 AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv 2175 YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x 2176 EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis 2177 AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi 2178 b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt 2179 MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg== 2181 The forked call in Section 5.5 is in this message: 2183 AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR 2184 BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz 2185 aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A 2186 BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6 2187 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0 2188 ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI 2189 ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA 2190 ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4 2191 aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA 2192 ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs 2193 ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu 2194 Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2 2195 AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl 2196 Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl 2197 eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA 2198 AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE 2199 YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs 2200 ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA 2201 AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV 2202 c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t 2203 BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC 2204 ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t 2205 BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB 2206 KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l 2207 dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt 2208 cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI 2209 E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA 2210 ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt 2211 MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i 2212 QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES 2213 dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA 2214 AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l 2215 eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh 2216 bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10 2217 cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB 2218 5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E 2219 YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp 2220 E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi 2221 b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj 2222 ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG 2223 cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT 2224 xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl 2225 LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy 2227 Authors' Addresses 2229 Brian Trammell 2230 Swiss Federal Institute of Technology Zurich 2231 Gloriastrasse 35 2232 8092 Zurich 2233 Switzerland 2235 Email: trammell@tik.ee.ethz.ch 2237 Saverio Niccolini 2238 NEC Laboratories Europe, NEC Europe Ltd. 2239 Kurfuersten-Anlage 36 2240 Heidelberg 69115 2241 Germany 2243 Phone: +49 (0) 6221 4342 118 2244 Email: niccolini@neclab.eu 2245 URI: http://www.neclab.eu 2247 Benoit Claise 2248 Cisco Systems Inc. 2249 De Kleetlaan 6a b1 2250 Diegem, 1813 2251 Belgium 2253 Phone: +32 2 704 5622 2254 Fax: 2255 Email: bclaise@cisco.com 2256 URI: 2258 Hadriel Kaplan 2259 Acme Packet 2260 71 Third Ave. 2261 Burlington, MA 01803 2262 USA 2264 Phone: 2265 Email: hkaplan@acmepacket.com