idnits 2.17.1
draft-trammell-ipfix-sip-msg-02.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
== There are 47 instances of lines with non-RFC2606-compliant FQDNs in the
document.
** The document seems to lack a both a reference to RFC 2119 and the
recommended RFC 2119 boilerplate, even if it appears to use RFC 2119
keywords.
RFC 2119 keyword, line 470: '...rmation Elements MAY be added to them,...'
RFC 2119 keyword, line 471: '... these Templates MUST be replaced with...'
RFC 2119 keyword, line 473: '...ormation Element SHOULD be added for a...'
RFC 2119 keyword, line 474: '...Transaction Information Element SHOULD...'
RFC 2119 keyword, line 520: '...ation Elements within a record MUST be...'
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
-- The document date (October 27, 2011) is 4564 days in the past. Is this
intentional?
Checking references for intended status: Informational
----------------------------------------------------------------------------
-- Looks like a reference, but probably isn't: '8' on line 498
-- Looks like a reference, but probably isn't: '4' on line 501
-- Looks like a reference, but probably isn't: '2' on line 507
-- Looks like a reference, but probably isn't: '1' on line 506
== Missing Reference: 'TODO' is mentioned on line 1510, but not defined
== Unused Reference: 'RFC5655' is defined on line 1551, but no explicit
reference was found in the text
== Unused Reference: 'I-D.kaplan-dispatch-session-id' is defined on line
1557, but no explicit reference was found in the text
== Unused Reference: 'RFC2976' is defined on line 1569, but no explicit
reference was found in the text
== Unused Reference: 'RFC3665' is defined on line 1594, but no explicit
reference was found in the text
== Unused Reference: 'RFC4475' is defined on line 1601, but no explicit
reference was found in the text
== Unused Reference: 'RFC6026' is defined on line 1609, but no explicit
reference was found in the text
== Outdated reference: A later version (-13) exists of
draft-ietf-sipclf-problem-statement-07
** Obsolete normative reference: RFC 5101 (Obsoleted by RFC 7011)
== Outdated reference: A later version (-03) exists of
draft-trammell-ipfix-ie-doctors-02
-- Obsolete informational reference (is this intentional?): RFC 2976
(Obsoleted by RFC 6086)
-- Obsolete informational reference (is this intentional?): RFC 3265
(Obsoleted by RFC 6665)
-- Obsolete informational reference (is this intentional?): RFC 5226
(Obsoleted by RFC 8126)
Summary: 2 errors (**), 0 flaws (~~), 11 warnings (==), 8 comments (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 Network Working Group B. Trammell
3 Internet-Draft ETH Zurich
4 Intended status: Informational S. Niccolini
5 Expires: April 29, 2012 NEC
6 B. Claise
7 Cisco Systems Inc.
8 H. Kaplan
9 Acme Packet
10 October 27, 2011
12 SIP Message Information Export using IPFIX
13 draft-trammell-ipfix-sip-msg-02
15 Abstract
17 This draft defines a set of Information Elements and example
18 Templates for IP Flow Information Export (IPFIX) based on the SIP
19 Common Log Format data model, as well as additional useful SIP
20 Information Elements, to allow IPFIX export of application-layer
21 information about SIP messages.
23 Status of this Memo
25 This Internet-Draft is submitted in full conformance with the
26 provisions of BCP 78 and BCP 79.
28 Internet-Drafts are working documents of the Internet Engineering
29 Task Force (IETF). Note that other groups may also distribute
30 working documents as Internet-Drafts. The list of current Internet-
31 Drafts is at http://datatracker.ietf.org/drafts/current/.
33 Internet-Drafts are draft documents valid for a maximum of six months
34 and may be updated, replaced, or obsoleted by other documents at any
35 time. It is inappropriate to use Internet-Drafts as reference
36 material or to cite them other than as "work in progress."
38 This Internet-Draft will expire on April 29, 2012.
40 Copyright Notice
42 Copyright (c) 2011 IETF Trust and the persons identified as the
43 document authors. All rights reserved.
45 This document is subject to BCP 78 and the IETF Trust's Legal
46 Provisions Relating to IETF Documents
47 (http://trustee.ietf.org/license-info) in effect on the date of
48 publication of this document. Please review these documents
49 carefully, as they describe your rights and restrictions with respect
50 to this document. Code Components extracted from this document must
51 include Simplified BSD License text as described in Section 4.e of
52 the Trust Legal Provisions and are provided without warranty as
53 described in the Simplified BSD License.
55 Table of Contents
57 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
58 2. Base Information Elements for SIP Message Information
59 Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
60 2.1. sipObservationType . . . . . . . . . . . . . . . . . . . . 5
61 2.2. sipMethod . . . . . . . . . . . . . . . . . . . . . . . . 5
62 2.3. sipSequenceNumber . . . . . . . . . . . . . . . . . . . . 5
63 2.4. sipRequestURI . . . . . . . . . . . . . . . . . . . . . . 5
64 2.5. sipFromURI . . . . . . . . . . . . . . . . . . . . . . . . 6
65 2.6. sipFromTag . . . . . . . . . . . . . . . . . . . . . . . . 6
66 2.7. sipToURI . . . . . . . . . . . . . . . . . . . . . . . . . 6
67 2.8. sipToTag . . . . . . . . . . . . . . . . . . . . . . . . . 6
68 2.9. sipCallId . . . . . . . . . . . . . . . . . . . . . . . . 6
69 2.10. sipResponseStatus . . . . . . . . . . . . . . . . . . . . 6
70 2.11. sipServerTransaction . . . . . . . . . . . . . . . . . . . 7
71 2.12. sipClientTransaction . . . . . . . . . . . . . . . . . . . 7
72 2.13. sipMethod subregistry . . . . . . . . . . . . . . . . . . 7
73 3. Additional Information Elements for SIP Message
74 Information Export . . . . . . . . . . . . . . . . . . . . . . 8
75 3.1. sipContactURI . . . . . . . . . . . . . . . . . . . . . . 8
76 3.2. sipRouteURI . . . . . . . . . . . . . . . . . . . . . . . 8
77 3.3. sipPaiURI . . . . . . . . . . . . . . . . . . . . . . . . 9
78 3.4. sipPpiURI . . . . . . . . . . . . . . . . . . . . . . . . 9
79 3.5. sipPAssocURI . . . . . . . . . . . . . . . . . . . . . . . 9
80 3.6. sipPCalledPartyURI . . . . . . . . . . . . . . . . . . . . 9
81 3.7. sipVia . . . . . . . . . . . . . . . . . . . . . . . . . . 10
82 3.8. sipAuthUsername . . . . . . . . . . . . . . . . . . . . . 10
83 3.9. sipSubscriptionEvent . . . . . . . . . . . . . . . . . . . 10
84 3.10. sipSubscriptionState . . . . . . . . . . . . . . . . . . . 10
85 3.11. sipExpires . . . . . . . . . . . . . . . . . . . . . . . . 10
86 3.12. sipPVisitedNetworkID . . . . . . . . . . . . . . . . . . . 11
87 3.13. sipPAccessNetworkInfo . . . . . . . . . . . . . . . . . . 11
88 3.14. sipPChargingFunctionAddr . . . . . . . . . . . . . . . . . 11
89 3.15. sipPChargingVector . . . . . . . . . . . . . . . . . . . . 11
90 4. Recommended Templates for SIP Message Information Export . . . 12
91 5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
92 5.1. Base Template Export . . . . . . . . . . . . . . . . . . . 13
93 5.2. UAC registration . . . . . . . . . . . . . . . . . . . . . 14
94 5.3. Direct Call . . . . . . . . . . . . . . . . . . . . . . . 16
95 5.4. Single Downstream Branch Call . . . . . . . . . . . . . . 19
96 5.5. Forked Call . . . . . . . . . . . . . . . . . . . . . . . 25
97 6. Security Considerations . . . . . . . . . . . . . . . . . . . 35
98 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 35
99 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 35
100 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 35
101 9.1. Normative References . . . . . . . . . . . . . . . . . . . 35
102 9.2. Informative References . . . . . . . . . . . . . . . . . . 36
103 Appendix A. Definition of Base SIP Message Information
104 Elements in IANA XML Registry format . . . . . . . . 37
105 Appendix B. Definition of sipMethod registry in IANA XML
106 Registry format . . . . . . . . . . . . . . . . . . . 40
107 Appendix C. Definition of Additional SIP Message Information
108 Elements in IANA XML Registry format . . . . . . . . 43
109 Appendix D. Example messages in base64 . . . . . . . . . . . . . 47
110 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 50
112 1. Introduction
114 IPFIX [RFC5101] provides a standardized means of exporting flow
115 information from IPFIX exporters to IPFIX collectors. This allows
116 collectors to analyze flows from one or more sources for numerous
117 uses, such as traffic patterns/trends, anomalies, failures, attacks,
118 and much more. IPFIX supports exporting data in near real-time, in a
119 secure manner, over multiple transports; as well as in local storage
120 with a defined file format. The core IPFIX information model is
121 maintained by IANA as a registry of Information Elements at
122 http://www.iana.org/assignments/ipfix/. In addition to these, which
123 cover many network measurement and management applications,
124 enterprise-specific Information Elements may be defined, scoped to an
125 SMI private enterprise number, for vendor-proprietary Information
126 Elements.
128 Session Initiation Protocol (SIP), defined by [RFC3261] and its
129 extensions, is used by many devices to perform a rendezvous service,
130 initiate and manage real-time communication sessions, install and
131 monitor state information, and more. In many deployments, SIP
132 messages cross multiple systems managed by the same administrative
133 entity, and thus providing a means of exporting and collecting SIP
134 message information from such systems using a standard protocol is
135 highly desirable.
137 This document defines a set of IPFIX Information Elements to enable
138 SIP devices, such as user agents and proxies, to export SIP message
139 information to IPFIX collectors using the IPFIX protocol. The
140 purpose of doing so is to enable collectors to analyze the SIP
141 "traffic", for similar purposes as those for any other IPFIX flows.
142 Defining IANA-registered (i.e., well-known) IPFIX IE fields enables
143 IPFIX records of SIP message information to be generated and consumed
144 by different vendors. Within the context of this document's IPFIX IE
145 fields, a single SIP message is a complete IPFIX Flow as defined in
146 [RFC5101]
148 The SIPCLF Working Group has defined a data model
149 [I-D.ietf-sipclf-problem-statement] for logging information about SIP
150 messages to ASCII-based SIPCLF files. While useful for on-box
151 storage and analysis with ASCII-based tools, SIPCLF does not provide
152 a means of exporting such information, nor is that its goal. This
153 document borrows the data model from SIPCLF and represents these in
154 IPFIX Information Elements. It additionally provides examples for
155 IPFIX representation of the example SIP Messages provided in the
156 SIPCLF problem statement.
158 2. Base Information Elements for SIP Message Information Export
160 The following Information Elements represent SIP-specific mandatory
161 fields defined in [I-D.ietf-sipclf-problem-statement], many
162 themselves taken from [RFC3261]. Together with Information Elements
163 already available in the IPFIX IANA Information Elements registry,
164 these can be used to export information about SIP Messages.
166 2.1. sipObservationType
168 Description: Denotes whether the entry was corresponds to a SIP
169 message received, sent, or merely seen by a passive observer, as
170 follows:
171 0: unknown: The Metering Process does not specify the observation
172 type.
173 1: receiver: The Metering Process is, or is co-located with, the
174 receiver of the SIP message.
175 2: sender: The Metering Process is, or is co-located with, the
176 sender of the SIP message.
177 3: passive: The Metering Process passively observed the SIP
178 message.
179 Data Type: unsigned8
180 Data Type Semantics: identifier
181 PEN (provisional): 35566 (trammell.ch)
182 ElementId (provisional): 419
184 2.2. sipMethod
186 Description: The SIP method from the CSeq header, encoded as per
187 the IPFIX sipMethod subregistry.
188 Data Type: unsigned8
189 Data Type Semantics: identifier
190 PEN (provisional): 35566 (trammell.ch)
191 ElementId (provisional): 402
193 2.3. sipSequenceNumber
195 Description: The sequence number from the CSeq header.
196 Data Type: unsigned32
197 Data Type Semantics: identifier
198 PEN (provisional): 35566 (trammell.ch)
199 ElementId (provisional): 409
201 2.4. sipRequestURI
202 Description: The SIP Request URI, including any parameters, as a
203 UTF-8 string, escaped according to SIP rules as received by the
204 metering process.
205 Data Type: string
206 PEN (provisional): 35566 (trammell.ch)
207 ElementId (provisional): 403
209 2.5. sipFromURI
211 Description: The URI from the SIP From: header
212 Data Type: string
213 PEN (provisional): 35566 (trammell.ch)
214 ElementId (provisional): 404
216 2.6. sipFromTag
218 Description: The Tag parameter value from the SIP From: header
219 Data Type: string
220 PEN (provisional): 35566 (trammell.ch)
221 ElementId (provisional): 405
223 2.7. sipToURI
225 Description: The URI from the SIP To: header
226 Data Type: string
227 PEN (provisional): 35566 (trammell.ch)
228 ElementId (provisional): 406
230 2.8. sipToTag
232 Description: The Tag parameter value from the SIP To: header
233 Data Type: string
234 PEN (provisional): 35566 (trammell.ch)
235 ElementId (provisional): 407
237 2.9. sipCallId
239 Description: The value of the SIP Call-ID: header
240 Data Type: string
241 PEN (provisional): 35566 (trammell.ch)
242 ElementId (provisional): 408
244 2.10. sipResponseStatus
245 Description: The SIP Response code. The presence of this
246 Information Element in a SIP Message record marks it as describing
247 a SIP response; if absent, the record describes a SIP request.
248 Data Type: unsigned16
249 Data Type Semantics: identifier
250 PEN (provisional): 35566 (trammell.ch)
251 ElementId (provisional): 412
253 2.11. sipServerTransaction
255 Description: The transaction identifier associated with the server
256 transaction.
257 Data Type: string
258 Data Type Semantics: identifier
259 PEN (provisional): 35566 (trammell.ch)
260 ElementId (provisional): 413
262 2.12. sipClientTransaction
264 Description: The transaction identifier associated with the client
265 transaction.
266 Data Type: string
267 Data Type Semantics: identifier
268 PEN (provisional): 35566 (trammell.ch)
269 ElementId (provisional): 414
271 2.13. sipMethod subregistry
273 The sipMethod subregistry assigns a number to encode each of the SIP
274 methods encoded in the Methods and Response Codes registry at
275 http://www.iana.org/assignments/sip-parameters in a 16-bit integer
276 Information Element. These numbers are assigned from 1 in
277 alphabetical order for the Methods defined as of the publication time
278 of this document; subsequent Methods added to the Methods and
279 Response Codes registry will be added to the IPFIX sipMethod
280 subregistry at such time they are added to the Methods and Response
281 Codes registry, using the lowest available unassigned number at the
282 time of addition.
284 +----------+------------+-----------+
285 | Number | Method | Reference |
286 +----------+------------+-----------+
287 | 0 | Unknown | |
288 | 1 | ACK | [RFC3261] |
289 | 2 | BYE | [RFC3261] |
290 | 3 | CANCEL | [RFC3261] |
291 | 4 | INFO | [RFC6086] |
292 | 5 | INVITE | [RFC3261] |
293 | 6 | MESSAGE | [RFC3428] |
294 | 7 | NOTIFY | [RFC3265] |
295 | 8 | OPTIONS | [RFC3261] |
296 | 9 | PRACK | [RFC3262] |
297 | 10 | PUBLISH | [RFC3903] |
298 | 11 | REFER | [RFC3515] |
299 | 12 | REGISTER | [RFC3261] |
300 | 13 | SUBSCRIBE | [RFC3265] |
301 | 14 | UPDATE | [RFC3311] |
302 | 15-65535 | Unassigned | |
303 +----------+------------+-----------+
305 3. Additional Information Elements for SIP Message Information Export
307 [TODO frontmatter]
309 3.1. sipContactURI
311 Description: The addr-spec URI, including any URI parameters, of
312 the first/top-most SIP Contact header, as a UTF-8 string, escaped
313 according to SIP rules as received by the metering process.
314 Data Type: string
315 Data Type Semantics:
316 PEN (provisional): 35566
317 ElementId (provisional): 415
319 3.2. sipRouteURI
321 Description: The addr-spec URI, including any URI parameters, of
322 the first/top-most SIP Route header, as a UTF-8 string, escaped
323 according to SIP rules as received by the metering process.
324 Data Type: string
325 Data Type Semantics:
326 PEN (provisional): 35566
327 ElementId (provisional): 416
329 3.3. sipPaiURI
331 Description: The addr-spec URI, including any URI parameters, of
332 the first/top-most SIP P-Asserted-Identity header, as a UTF-8
333 string, escaped according to SIP rules as received by the metering
334 process.
335 Data Type: string
336 Data Type Semantics:
337 PEN (provisional): 35566
338 ElementId (provisional): 417
340 3.4. sipPpiURI
342 Description: The addr-spec URI, including any URI parameters, of
343 the first/top-most SIP P-Preferred-Identity header, as a UTF-8
344 string, escaped according to SIP rules as received by the metering
345 process.
346 Data Type: string
347 Data Type Semantics:
348 PEN (provisional): 35566
349 ElementId (provisional): 418
351 3.5. sipPAssocURI
353 Description: The addr-spec URI, including any URI parameters, of
354 the first/top-most SIP P-Associated-Identity header, as a UTF-8
355 string, escaped according to SIP rules as received by the metering
356 process.
357 Data Type: string
358 Data Type Semantics:
359 PEN (provisional): 35566
360 ElementId (provisional): 430
362 3.6. sipPCalledPartyURI
364 Description: The addr-spec URI, including any URI parameters, of
365 the SIP P-Called-Party-ID header, as a UTF-8 string, escaped
366 according to SIP rules as received by the metering process.
367 Data Type: string
368 Data Type Semantics:
369 PEN (provisional): 35566
370 ElementId (provisional): 420
372 3.7. sipVia
374 Description: The value of the first/top-most Via header as a UTF-8
375 string, escaped according to SIP rules as received by the metering
376 process.
377 Data Type: string
378 Data Type Semantics:
379 PEN (provisional): 35566
380 ElementId (provisional): 421
382 3.8. sipAuthUsername
384 Description: The value of the username field of the first/top-most
385 Authorization header as a UTF-8 string, escaped according to SIP
386 rules as received by the metering process.
387 Data Type: string
388 Data Type Semantics:
389 PEN (provisional): 35566
390 ElementId (provisional): 422
392 3.9. sipSubscriptionEvent
394 Description: The value of the Event header as a UTF-8 string,
395 escaped according to SIP rules as received by the metering
396 process.
397 Data Type: string
398 Data Type Semantics:
399 PEN (provisional): 35566
400 ElementId (provisional): 423
402 3.10. sipSubscriptionState
404 Description: The value of the Subscription-State header as a UTF-8
405 string, escaped according to SIP rules as received by the metering
406 process.
407 Data Type: string
408 Data Type Semantics:
409 PEN (provisional): 35566
410 ElementId (provisional): 424
412 3.11. sipExpires
414 Description: The numeric value of the expires parameter of the
415 first/top-most Contact header of a REGISTER request or response,
416 or Subscription-State header of a SUBSCRIBE or NOTIFY request or
417 response, or the Expires header if the expires parameter does not
418 exist, as received by the metering process.
420 Data Type: unsigned32
421 Data Type Semantics:
422 PEN (provisional): 35566
423 ElementId (provisional): 425
425 3.12. sipPVisitedNetworkID
427 Description: The value of the first/top-most P-Visited-Network-ID
428 header as a UTF-8 string, escaped according to SIP rules as
429 received by the metering process.
430 Data Type: string
431 Data Type Semantics:
432 PEN (provisional): 35566
433 ElementId (provisional): 426
435 3.13. sipPAccessNetworkInfo
437 Description: The value of the P-Access-Network-Info header as a
438 UTF-8 string, escaped according to SIP rules as received by the
439 metering process.
440 Data Type: string
441 Data Type Semantics:
442 PEN (provisional): 35566
443 ElementId (provisional): 427
445 3.14. sipPChargingFunctionAddr
447 Description: The value of the first/top-most P-Charging-Function-
448 Addresses header as a UTF-8 string, escaped according to SIP rules
449 as received by the metering process.
450 Data Type: string
451 Data Type Semantics:
452 PEN (provisional): 35566
453 ElementId (provisional): 428
455 3.15. sipPChargingVector
457 Description: The value of the P-Charging-Vector header as a UTF-8
458 string, escaped according to SIP rules as received by the metering
459 process.
460 Data Type: string
461 Data Type Semantics:
462 PEN (provisional): 35566
463 ElementId (provisional): 429
465 4. Recommended Templates for SIP Message Information Export
467 The SIPCLF data model represents SIP requests and SIP responses with
468 separate records. The following Templates are defined as recommended
469 base Templates for records describing requests and responses.
470 Optional Information Elements MAY be added to them, and the IPv4
471 addresses within these Templates MUST be replaced with IPv6 addresses
472 for logging IPv6 transport of SIP messages. A sipServerTransaction
473 Information Element SHOULD be added for all messages logged by a User
474 Agent Server, and a sipClientTransaction Information Element SHOULD
475 be added for all messages logged by a User Agent Client. These
476 templates follow the recommended fields for request and response
477 logging in [I-D.ietf-sipclf-problem-statement], and are defined using
478 the representation in section 9 of [I-D.trammell-ipfix-ie-doctors].
480 observationTimeMilliseconds(323)[8]
481 sipSequenceNumber(35566/409)[4]
482 sourceIPv4Address(8)[4]
483 destinationIPv4Address(12)[4]
484 sourceTransportPort(7)[2]
485 destinationTransportPort(11)[2]
486 protocolIdentifier(4)[1]
487 sipMethod(35566/402)[1]
488 sipObservationType(35566/419)[1]
489 sipRequestURI(35566/403)[v]
490 sipToURI(35566/406)[v]
491 sipToTag(35566/407)[v]
492 sipFromURI(35566/404)[v]
493 sipFromTag(35566/405)[v]
494 sipCallId(35566/408)[v]
496 Figure 1: Base Request Template (IPv4)
498 observationTimeMilliseconds(323)[8]
499 sipSequenceNumber(35566/409)[4]
500 sourceIPv4Address(8)[4]
501 destinationIPv4Address(12)[4]
502 sourceTransportPort(7)[2]
503 destinationTransportPort(11)[2]
504 protocolIdentifier(4)[1]
505 sipMethod(35566/402)[1]
506 sipObservationType(35566/419)[1]
507 sipResponseStatus(35566/412)[2]
508 sipToURI(35566/406)[v]
509 sipToTag(35566/407)[v]
510 sipFromURI(35566/404)[v]
511 sipFromTag(35566/405)[v]
512 sipCallId(35566/408)[v]
514 Figure 2: Base Response Template (IPv4)
516 Note that the Information Elements in these templates are ordered to
517 place the fixed-length elements before the variable-length ones,
518 which speeds random access to fixed-length elements. However, since
519 element order within a record is unimportant in IPFIX, any ordering
520 of the mandatory Information Elements within a record MUST be
521 accepted by a Collecting Process as a valid SIP request or response
522 record for that record type.
524 The record type is determined by the presence of the
525 sipResponseStatus field. If present in the Template, the Template
526 describes a response record. If absent, it describes a request
527 record.
529 5. Examples
531 This section presents several views of an example SIP messages
532 exported using the IPFIX templates described in this document. We
533 present both binary and textual forms. The tools to generate this
534 section are based upon the open-source ripfix [ripfix] implementation
535 of IPFIX, maintained by one of the authors of this draft.
537 Here we show the IPFIX Messages generated by the situations in
538 sections 9.1 through 9.4 of [I-D.ietf-sipclf-problem-statement].
540 5.1. Base Template Export
542 Before exporting any Request or Response records, the Templates
543 describing them must be exported. In this example, the templates
544 These Templates are derived from the base Templates as shown in
545 Figure 1 and Figure 2, with the sipClientTransaction and
546 sipServerTransaction Information Elements appended. We use two
547 templates here, one each for request and response for IPv4.
549 Exporting these Templates results in the following IPFIX message,
550 illustrated as an annotated hexdump in Figure 3.
552 0000: 00 0a 00 fc 4c c0 2a a2 00 00 00 00 00 00 30 39 ....L.*.......09
553 [ IPFIX message header, length 252 ]
554 0010: 00 02 00 ec ....
555 [ Template set (ID 2) header, length 236 ]
556 0014: 01 01 00 11 01 43 00 08 81 99 00 04 .....C......
557 0020: 00 00 8a ee 00 08 00 04 00 0c 00 04 00 07 00 02 ................
558 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................
559 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................
560 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................
561 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................
562 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................
563 0080: 81 9d ff ff 00 00 8a ee ........
564 [ Template 257, 17 elements (v4 request) ]
565 0088: 01 02 00 11 01 43 00 08 .....C..
566 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 0c 00 04 ................
567 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................
568 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................
569 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................
570 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................
571 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................
572 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee ............
573 [ Template 258, 17 elements (v4 response) ]
575 Figure 3: Base template message export
577 5.2. UAC registration
579 Having exported templates, now we create a simple IPFIX Message
580 representing a UAC registration as seen from the UAC, corresponding
581 to example 9.1 in [I-D.ietf-sipclf-problem-statement]. This message
582 contains two records, including the UAS registration request, and the
583 response received. This is shown in the annotated hexdump in
584 Figure 4.
586 0000: 00 0a 00 d8 4c 90 7f c1 00 00 00 00 00 00 30 39 ....L.........09
587 [ IPFIX message header, length 218 ]
588 0010: 01 01 00 6b ...k
589 [ Data set (ID 257) header, length 107 ]
590 0014: 00 00 01 29 13 66 13 93 00 00 00 01 ...).f......
591 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 0c 02 0f .3d..3d.........
592 0030: 73 69 70 3a 65 78 61 6d 70 6c 65 2e 63 6f 6d 00 sip:example.com.
593 0040: 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d ..sip:alice@exam
594 0050: 70 6c 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 ple.com.76yhh.f8
595 0060: 31 2d 64 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 1-d4-f6@example.
596 0070: 63 6f 6d 06 63 2d 74 72 2d 31 00 com.c-tr-1.
597 [ Request record content ]
598 007b: 01 02 00 5d ...]
599 [ Data set (ID 258) header, length 93 ]
600 007f: 00 .
601 0080: 00 01 29 13 66 15 24 00 00 00 01 c6 33 64 0a c6 ..).f.$.....3d..
602 0090: 33 64 01 13 c4 13 c4 11 0c 01 00 c8 00 00 15 73 3d.............s
603 00a0: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example
604 00b0: 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 31 2d 64 .com.76yhh.f81-d
605 00c0: 34 2d 66 36 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 4-f6@example.com
606 00d0: 06 63 2d 74 72 2d 31 00 .c-tr-1.
607 [ Response record content ]
609 Figure 4: Message containing two log entries for UAC registration
611 While this demonstrates the binary nature of the SIPCLF-IPFIX format,
612 and shows the content framing for this message, it is not readable
613 for illustration purposes. In Figure 5, we run the message through
614 the ripcollect tool provided with ripfix to provide a more human-
615 readable view. Note that the sipMethod and sipObservationType are
616 encoded according to the registries in Section 2.
618 ==== message sequence 0 in domain 12345 at 2010-08-11 11:53:27 UTC ====
619 ---- record 12345/257 ----
620 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
621 sipSequenceNumber => 1
622 sourceIPv4Address => 198.51.100.1
623 destinationIPv4Address => 198.51.100.10
624 sourceTransportPort => 5060
625 destinationTransportPort => 5060
626 protocolIdentifier => 17
627 sipMethod => 12
628 sipObservationType => 2
629 sipRequestURI => sip:example.com
630 sipToURI =>
631 sipToTag =>
632 sipFromURI => sip:alice@example.com
633 sipFromTag => 76yhh
634 sipCallId => f81-d4-f6@example.com
635 sipClientTransaction => c-tr-1
636 sipServerTransaction =>
637 ---- record 12345/258 ----
638 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
639 sipSequenceNumber => 1
640 sourceIPv4Address => 198.51.100.10
641 destinationIPv4Address => 198.51.100.1
642 sourceTransportPort => 5060
643 destinationTransportPort => 5060
644 sipResponseStatus => 200
645 protocolIdentifier => 17
646 sipMethod => 12
647 sipObservationType => 1
648 sipToURI =>
649 sipToTag =>
650 sipFromURI => sip:alice@example.com
651 sipFromTag => 76yhh
652 sipCallId => f81-d4-f6@example.com
653 sipClientTransaction => c-tr-1
654 sipServerTransaction =>
656 Figure 5: Message containing two log entries for UAC registration
658 5.3. Direct Call
660 This example demonstrates the export of a direct call from Alice to
661 Bob, as seen by Bob's agent, corresponding to example 9.2 in
662 [I-D.ietf-sipclf-problem-statement]. Here we have four records: an
663 INVITE received from Alice, a 180 Ringing sent back followed by a 200
664 OK, and an ACK received from Alice. This is shown in the ripfix dump
665 in Figure 6 and the hexdump in Figure 7. In the hexdump, message
666 headers, set headers, and data records are separated by '|'
667 characters for compactness. Note here that each record has its own
668 data set to support high-speed seeking to a specific record, even
669 when two messages using the same template are adjacent in the
670 message.
672 ===== message 12345/0 @2010-10-21 13:11:43 UTC (#2) =====
673 --- record 12345/257 (#1)---
674 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
675 sipSequenceNumber => 32
676 sourceIPv4Address => 198.51.100.1
677 destinationIPv4Address => 203.0.113.1
678 sourceTransportPort => 5060
679 destinationTransportPort => 5060
680 protocolIdentifier => 17
681 sipMethod => 5
682 sipObservationType => 2
683 sipRequestURI => sip:bob@bob1.example.net
684 sipToURI => sip:bob@example.net
685 sipToTag =>
686 sipFromURI => sip:alice@example.com
687 sipFromTag => 76yhh
688 sipCallId => f82-d4-f7@example.com
689 sipClientTransaction => c-1-xt6
690 sipServerTransaction =>
691 --- record 12345/258 (#2)---
692 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
693 sipSequenceNumber => 32
694 sourceIPv4Address => 203.0.113.1
695 destinationIPv4Address => 198.51.100.1
696 sourceTransportPort => 5060
697 destinationTransportPort => 5060
698 protocolIdentifier => 17
699 sipMethod => 5
700 sipObservationType => 1
701 sipResponseStatus => 180
702 sipToURI => sip:bob@example.net
703 sipToTag => b-in6-iu
704 sipFromURI => sip:alice@example.com
705 sipFromTag => 76yhh
706 sipCallId => f82-d4-f7@example.com
707 sipClientTransaction => c-1-xt6
708 sipServerTransaction =>
709 --- record 12345/258 (#3)---
710 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
711 sipSequenceNumber => 32
712 sourceIPv4Address => 203.0.113.1
713 destinationIPv4Address => 198.51.100.1
714 sourceTransportPort => 5060
715 destinationTransportPort => 5060
716 protocolIdentifier => 17
717 sipMethod => 5
718 sipObservationType => 1
719 sipResponseStatus => 200
720 sipToURI => sip:bob@example.net
721 sipToTag => b-in6-iu
722 sipFromURI => sip:alice@example.com
723 sipFromTag => 76yhh
724 sipCallId => f82-d4-f7@example.com
725 sipClientTransaction => c-1-xt6
726 sipServerTransaction =>
727 --- record 12345/257 (#4)---
728 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
729 sipSequenceNumber => 32
730 sourceIPv4Address => 198.51.100.1
731 destinationIPv4Address => 203.0.113.1
732 sourceTransportPort => 5060
733 destinationTransportPort => 5060
734 protocolIdentifier => 17
735 sipMethod => 1
736 sipObservationType => 2
737 sipRequestURI => sip:bob@bob1.example.net
738 sipToURI => sip:bob@example.net
739 sipToTag => b-in6-iu
740 sipFromURI => sip:alice@example.com
741 sipFromTag => 76yhh
742 sipCallId => f82-d4-f7@example.com
743 sipClientTransaction => c-1-xt6
744 sipServerTransaction =>
746 Figure 6: Message containing four records for a simple call (ripfix
747 dump)
749 0000: 00 0a 02 1a 4c c0 2c b3 00 00 00 00 00 00 30 39| ....L.,.......09
750 0010: 01 01 00 88|00 00 01 29 13 66 13 93 00 00 00 20 .......).f.....
751 0020: c6 33 64 01 cb 00 71 01 13 c4 13 c4 11 05 02 18 .3d...q.........
752 0030: 73 69 70 3a 62 6f 62 40 62 6f 62 31 2e 65 78 61 sip:bob@bob1.exa
753 0040: 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 mple.net.sip:bob
754 0050: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si
755 0060: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
756 0070: 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d 64 34 com.76yhh.f82-d4
757 0080: 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 07 -f7@example.com.
758 0090: 63 2d 31 2d 78 74 36 00|01 02 00 79|00 00 01 29 c-1-xt6....y...)
759 00a0: 13 66 18 aa 00 00 00 20 cb 00 71 01 c6 33 64 01 .f..... ..q..3d.
760 00b0: 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 6f ..........sip:bo
761 00c0: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 08 62 2d b@example.net.b-
762 00d0: 69 6e 36 2d 69 75 15 73 69 70 3a 61 6c 69 63 65 in6-iu.sip:alice
763 00e0: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 05 37 36 79 @example.com.76y
764 00f0: 68 68 15 66 38 32 2d 64 34 2d 66 37 40 65 78 61 hh.f82-d4-f7@exa
765 0100: 6d 70 6c 65 2e 63 6f 6d 07 63 2d 31 2d 78 74 36 mple.com.c-1-xt6
766 0110: 00|01 02 00 79|00 00 01 29 13 66 1c f4 00 00 00 ....y...).f.....
767 0120: 20 cb 00 71 01 c6 33 64 01 13 c4 13 c4 11 05 01 ..q..3d........
768 0130: 00 c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 ...sip:bob@examp
769 0140: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu.
770 0150: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
771 0160: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82-
772 0170: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co
773 0180: 6d 07 63 2d 31 2d 78 74 36 00|01 01 00 90|00 00 m.c-1-xt6.......
774 0190: 01 29 13 66 1d 08 00 00 00 20 c6 33 64 01 cb 00 .).f..... .3d...
775 01a0: 71 01 13 c4 13 c4 11 01 02 18 73 69 70 3a 62 6f q.........sip:bo
776 01b0: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
777 01c0: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
778 01d0: 6c 65 2e 6e 65 74 08 62 2d 69 6e 36 2d 69 75 15 le.net.b-in6-iu.
779 01e0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
780 01f0: 65 2e 63 6f 6d 05 37 36 79 68 68 15 66 38 32 2d e.com.76yhh.f82-
781 0200: 64 34 2d 66 37 40 65 78 61 6d 70 6c 65 2e 63 6f d4-f7@example.co
782 0210: 6d 07 63 2d 31 2d 78 74 36 00 m.c-1-xt6.
784 Figure 7: Message containing four records for a simple call (hexdump)
786 5.4. Single Downstream Branch Call
788 The example in Figure 8and Figure 9 demonstrates the export of a call
789 with a downstream branch to Bob, as seen by the proxy which the call
790 traverses, corresponding to example 9.3 in
791 [I-D.ietf-sipclf-problem-statement]. See this example in the problem
792 statement for more details.
794 ===== message 12345/0 @2010-10-21 13:12:42 UTC (#2) =====
795 --- record 12345/257 (#1)---
796 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
797 sipSequenceNumber => 43
798 sourceIPv4Address => 198.51.100.1
799 destinationIPv4Address => 198.51.100.10
800 sourceTransportPort => 5060
801 destinationTransportPort => 5060
802 protocolIdentifier => 17
803 sipMethod => 5
804 sipObservationType => 1
805 sipRequestURI => sip:bob@example.net
806 sipToURI => sip:bob@example.net
807 sipToTag =>
808 sipFromURI => sip:alice@example.com
809 sipFromTag => al-1
810 sipCallId => tr-87h@example.com
811 sipClientTransaction =>
812 sipServerTransaction => s-x-tr
813 --- record 12345/258 (#2)---
814 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
815 sipSequenceNumber => 43
816 sourceIPv4Address => 198.51.100.10
817 destinationIPv4Address => 198.51.100.1
818 sourceTransportPort => 5060
819 destinationTransportPort => 5060
820 protocolIdentifier => 17
821 sipMethod => 5
822 sipObservationType => 2
823 sipResponseStatus => 100
824 sipToURI => sip:bob@example.net
825 sipToTag =>
826 sipFromURI => sip:alice@example.com
827 sipFromTag => al-1
828 sipCallId => tr-87h@example.com
829 sipClientTransaction =>
830 sipServerTransaction => s-x-tr
831 --- record 12345/257 (#3)---
832 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
833 sipSequenceNumber => 43
834 sourceIPv4Address => 198.51.100.10
835 destinationIPv4Address => 203.0.113.1
836 sourceTransportPort => 5060
837 destinationTransportPort => 5060
838 protocolIdentifier => 17
839 sipMethod => 5
840 sipObservationType => 2
841 sipRequestURI => sip:bob@bob1.example.net
842 sipToURI => sip:bob@example.net
843 sipToTag =>
844 sipFromURI => sip:alice@example.com
845 sipFromTag => al-1
846 sipCallId => tr-87h@example.com
847 sipClientTransaction => c-x-tr
848 sipServerTransaction => s-x-tr
849 --- record 12345/258 (#4)---
850 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
851 sipSequenceNumber => 43
852 sourceIPv4Address => 203.0.113.1
853 destinationIPv4Address => 198.51.100.10
854 sourceTransportPort => 5060
855 destinationTransportPort => 5060
856 protocolIdentifier => 17
857 sipMethod => 5
858 sipObservationType => 1
859 sipResponseStatus => 100
860 sipToURI => sip:bob@example.net
861 sipToTag => b1-1
862 sipFromURI => sip:alice@example.com
863 sipFromTag => al-1
864 sipCallId => tr-87h@example.com
865 sipClientTransaction => c-x-tr
866 sipServerTransaction => s-x-tr
867 --- record 12345/258 (#5)---
868 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
869 sipSequenceNumber => 43
870 sourceIPv4Address => 203.0.113.1
871 destinationIPv4Address => 198.51.100.10
872 sourceTransportPort => 5060
873 destinationTransportPort => 5060
874 protocolIdentifier => 17
875 sipMethod => 5
876 sipObservationType => 1
877 sipResponseStatus => 180
878 sipToURI => sip:bob@example.net
879 sipToTag => b1-1
880 sipFromURI => sip:alice@example.com
881 sipFromTag => al-1
882 sipCallId => tr-87h@example.com
883 sipClientTransaction => c-x-tr
884 sipServerTransaction => s-x-tr
885 --- record 12345/258 (#6)---
886 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
887 sipSequenceNumber => 43
888 sourceIPv4Address => 198.51.100.10
889 destinationIPv4Address => 198.51.100.1
890 sourceTransportPort => 5060
891 destinationTransportPort => 5060
892 protocolIdentifier => 17
893 sipMethod => 5
894 sipObservationType => 2
895 sipResponseStatus => 180
896 sipToURI => sip:bob@example.net
897 sipToTag => b1-1
898 sipFromURI => sip:alice@example.com
899 sipFromTag => al-1
900 sipCallId => tr-87h@example.com
901 sipClientTransaction => c-x-tr
902 sipServerTransaction => s-x-tr
903 --- record 12345/258 (#7)---
904 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
905 sipSequenceNumber => 43
906 sourceIPv4Address => 203.0.113.1
907 destinationIPv4Address => 198.51.100.10
908 sourceTransportPort => 5060
909 destinationTransportPort => 5060
910 protocolIdentifier => 17
911 sipMethod => 5
912 sipObservationType => 1
913 sipResponseStatus => 200
914 sipToURI => sip:bob@example.net
915 sipToTag => b1-1
916 sipFromURI => sip:alice@example.com
917 sipFromTag => al-1
918 sipCallId => tr-87h@example.com
919 sipClientTransaction => c-x-tr
920 sipServerTransaction => s-x-tr
921 --- record 12345/258 (#8)---
922 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
923 sipSequenceNumber => 43
924 sourceIPv4Address => 198.51.100.10
925 destinationIPv4Address => 198.51.100.1
926 sourceTransportPort => 5060
927 destinationTransportPort => 5060
928 protocolIdentifier => 17
929 sipMethod => 5
930 sipObservationType => 2
931 sipResponseStatus => 200
932 sipToURI => sip:bob@example.net
933 sipToTag => b1-1
934 sipFromURI => sip:alice@example.com
935 sipFromTag => al-1
936 sipCallId => tr-87h@example.com
937 sipClientTransaction => c-x-tr
938 sipServerTransaction => s-x-tr
939 --- record 12345/257 (#9)---
940 observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
941 sipSequenceNumber => 43
942 sourceIPv4Address => 198.51.100.1
943 destinationIPv4Address => 198.51.100.10
944 sourceTransportPort => 5060
945 destinationTransportPort => 5060
946 protocolIdentifier => 17
947 sipMethod => 1
948 sipObservationType => 1
949 sipRequestURI => sip:bob@example.net
950 sipToURI => sip:bob@example.net
951 sipToTag => b1-1
952 sipFromURI => sip:alice@example.com
953 sipFromTag => al-1
954 sipCallId => tr-87h@example.com
955 sipClientTransaction => c-x-tr
956 sipServerTransaction => s-x-tr
957 --- record 12345/257 (#10)---
958 observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
959 sipSequenceNumber => 43
960 sourceIPv4Address => 198.51.100.10
961 destinationIPv4Address => 203.0.113.1
962 sourceTransportPort => 5060
963 destinationTransportPort => 5060
964 protocolIdentifier => 17
965 sipMethod => 1
966 sipObservationType => 2
967 sipRequestURI => sip:bob@example.net
968 sipToURI => sip:bob@example.net
969 sipToTag => b1-1
970 sipFromURI => sip:alice@example.com
971 sipFromTag => al-1
972 sipCallId => tr-87h@example.com
973 sipClientTransaction => c-x-tr
974 sipServerTransaction => s-x-tr
976 Figure 8: Message containing ten records for a downstream branch call
977 (ripfix dump)
979 0000: 00 0a 04 e1|4c c0 2c e5 00 00 00 00 00 00 30 39| ....L.,.......09
980 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+
981 0020: c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 05 01 13 .3d..3d.........
982 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
983 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam
984 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
985 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
986 0070: 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 l-1.tr-87h@examp
987 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 78 2d 74 72|01 02 le.com..s-x-tr..
989 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b c6 33 .l...).f.....+.3
990 00a0: 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 d..3d.........d.
991 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
992 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e
993 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 xample.com.al-1.
994 00e0: 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 tr-87h@example.c
995 00f0: 6f 6d 00 06 73 2d 78 2d 74 72|01 01 00 89|00 00 om..s-x-tr......
996 0100: 01 29 13 66 18 a6 00 00 00 2b c6 33 64 0a cb 00 .).f.....+.3d...
997 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo
998 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
999 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
1000 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic
1001 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c e@example.com.al
1002 0160: 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c -1.tr-87h@exampl
1003 0170: 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 e.com.c-x-tr.s-x
1004 0180: 2d 74 72|01 02 00 76|00 00 01 29 13 66 19 70 00 -tr...v...).f.p.
1005 0190: 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 c4 11 ..+..q..3d......
1006 01a0: 05 01 00 64 13 73 69 70 3a 62 6f 62 40 65 78 61 ...d.sip:bob@exa
1007 01b0: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si
1008 01c0: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
1009 01d0: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@
1010 01e0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x-
1011 01f0: 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 00 01 tr.s-x-tr...v...
1012 0200: 29 13 66 1b c8 00 00 00 2b cb 00 71 01 c6 33 64 ).f.....+..q..3d
1013 0210: 0a 13 c4 13 c4 11 05 01 00 b4 13 73 69 70 3a 62 ...........sip:b
1014 0220: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 ob@example.net.b
1015 0230: 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 1-1.sip:alice@ex
1016 0240: 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 ample.com.al-1.t
1017 0250: 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e 63 6f r-87h@example.co
1018 0260: 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 72|01 m.c-x-tr.s-x-tr.
1019 0270: 02 00 76|00 00 01 29 13 66 1c 98 00 00 00 2b c6 ..v...).f.....+.
1020 0280: 33 64 0a c6 33 64 01 13 c4 13 c4 11 05 02 00 b4 3d..3d..........
1021 0290: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example
1022 02a0: 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 6c .net.b1-1.sip:al
1023 02b0: 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 ice@example.com.
1024 02c0: 61 6c 2d 31 12 74 72 2d 38 37 68 40 65 78 61 6d al-1.tr-87h@exam
1025 02d0: 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d 74 72 06 73 ple.com.c-x-tr.s
1026 02e0: 2d 78 2d 74 72|01 02 00 76|00 00 01 29 13 66 20 -x-tr...v...).f
1027 02f0: f0 00 00 00 2b cb 00 71 01 c6 33 64 0a 13 c4 13 ....+..q..3d....
1028 0300: c4 11 05 01 00 c8 13 73 69 70 3a 62 6f 62 40 65 .......sip:bob@e
1029 0310: 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 xample.net.b1-1.
1030 0320: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
1031 0330: 65 2e 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 e.com.al-1.tr-87
1032 0340: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c-
1033 0350: 78 2d 74 72 06 73 2d 78 2d 74 72|01 02 00 76|00 x-tr.s-x-tr...v.
1034 0360: 00 01 29 13 66 21 a4 00 00 00 2b c6 33 64 0a c6 ..).f!....+.3d..
1035 0370: 33 64 01 13 c4 13 c4 11 05 02 00 c8 13 73 69 70 3d...........sip
1036 0380: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net
1037 0390: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@
1038 03a0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1
1039 03b0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example.
1040 03c0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t
1041 03d0: 72|01 01 00 88|00 00 01 29 13 66 28 ac 00 00 00 r.......).f(....
1042 03e0: 2b c6 33 64 01 c6 33 64 0a 13 c4 13 c4 11 01 01 +.3d..3d........
1043 03f0: 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 .sip:bob@example
1044 0400: 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 .net.sip:bob@exa
1045 0410: 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 mple.net.b1-1.si
1046 0420: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
1047 0430: 63 6f 6d 04 61 6c 2d 31 12 74 72 2d 38 37 68 40 com.al-1.tr-87h@
1048 0440: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 78 2d example.com.c-x-
1049 0450: 74 72 06 73 2d 78 2d 74 72|01 01 00 88|00 00 01 tr.s-x-tr.......
1050 0460: 29 13 66 28 ac 00 00 00 2b c6 33 64 0a cb 00 71 ).f(....+.3d...q
1051 0470: 01 13 c4 13 c4 11 01 02 13 73 69 70 3a 62 6f 62 .........sip:bob
1052 0480: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 @example.net.sip
1053 0490: 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 :bob@example.net
1054 04a0: 04 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 .b1-1.sip:alice@
1055 04b0: 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 6c 2d 31 example.com.al-1
1056 04c0: 12 74 72 2d 38 37 68 40 65 78 61 6d 70 6c 65 2e .tr-87h@example.
1057 04d0: 63 6f 6d 06 63 2d 78 2d 74 72 06 73 2d 78 2d 74 com.c-x-tr.s-x-t
1058 04e0: 72 r
1060 Figure 9: Message containing ten log entries for a downstream branch
1061 call (hexdump)
1063 5.5. Forked Call
1065 The example in Figure 11 and Figure 12 demonstrates the export of
1066 forked call to Bob, as seen by one of Bob's instances which forks the
1067 call traverses, corresponding to example 9.4 in
1068 [I-D.ietf-sipclf-problem-statement]. See this example for more
1069 details. Note that, since Bob's first instance is multihomed IPv4-
1070 IPv6, this example requires additional templates: request and
1071 response templates for IPv4 to IPv6 and back, these are shown in
1072 Figure 10.
1074 0000: 00 0a 01 e4 4c c0 2d 9b 00 00 00 00 00 00 30 39 ....L.-.......09
1075 0010: 00 02 01 d4 01 05 00 11 01 43 00 08 81 99 00 04 .........C......
1076 0020: 00 00 8a ee 00 08 00 04 00 1c 00 10 00 07 00 02 ................
1077 0030: 00 0b 00 02 00 04 00 01 81 92 00 01 00 00 8a ee ................
1078 0040: 81 a3 00 01 00 00 8a ee 81 93 ff ff 00 00 8a ee ................
1079 0050: 81 96 ff ff 00 00 8a ee 81 97 ff ff 00 00 8a ee ................
1080 0060: 81 94 ff ff 00 00 8a ee 81 95 ff ff 00 00 8a ee ................
1081 0070: 81 98 ff ff 00 00 8a ee 81 9e ff ff 00 00 8a ee ................
1082 0080: 81 9d ff ff 00 00 8a ee 01 06 00 11 01 43 00 08 .............C..
1083 0090: 81 99 00 04 00 00 8a ee 00 08 00 04 00 1c 00 10 ................
1084 00a0: 00 07 00 02 00 0b 00 02 00 04 00 01 81 92 00 01 ................
1085 00b0: 00 00 8a ee 81 a3 00 01 00 00 8a ee 81 9c 00 02 ................
1086 00c0: 00 00 8a ee 81 96 ff ff 00 00 8a ee 81 97 ff ff ................
1087 00d0: 00 00 8a ee 81 94 ff ff 00 00 8a ee 81 95 ff ff ................
1088 00e0: 00 00 8a ee 81 98 ff ff 00 00 8a ee 81 9e ff ff ................
1089 00f0: 00 00 8a ee 81 9d ff ff 00 00 8a ee 01 07 00 11 ................
1090 0100: 01 43 00 08 81 99 00 04 00 00 8a ee 00 1b 00 10 .C..............
1091 0110: 00 0c 00 04 00 07 00 02 00 0b 00 02 00 04 00 01 ................
1092 0120: 81 92 00 01 00 00 8a ee 81 a3 00 01 00 00 8a ee ................
1093 0130: 81 93 ff ff 00 00 8a ee 81 96 ff ff 00 00 8a ee ................
1094 0140: 81 97 ff ff 00 00 8a ee 81 94 ff ff 00 00 8a ee ................
1095 0150: 81 95 ff ff 00 00 8a ee 81 98 ff ff 00 00 8a ee ................
1096 0160: 81 9e ff ff 00 00 8a ee 81 9d ff ff 00 00 8a ee ................
1097 0170: 01 08 00 11 01 43 00 08 81 99 00 04 00 00 8a ee .....C..........
1098 0180: 00 1b 00 10 00 0c 00 04 00 07 00 02 00 0b 00 02 ................
1099 0190: 00 04 00 01 81 92 00 01 00 00 8a ee 81 a3 00 01 ................
1100 01a0: 00 00 8a ee 81 9c 00 02 00 00 8a ee 81 96 ff ff ................
1101 01b0: 00 00 8a ee 81 97 ff ff 00 00 8a ee 81 94 ff ff ................
1102 01c0: 00 00 8a ee 81 95 ff ff 00 00 8a ee 81 98 ff ff ................
1103 01d0: 00 00 8a ee 81 9e ff ff 00 00 8a ee 81 9d ff ff ................
1104 01e0: 00 00 8a ee ....
1106 Figure 10: Message containing templates for IPv4 to IPv6 requests and
1107 responses, and vice versa
1109 ===== message 12345/0 @2010-10-21 13:13:01 UTC (#3) =====
1110 --- record 12345/257 (#1)---
1111 observationTimeMilliseconds => 2010-06-07 17:12:23 UTC
1112 sipSequenceNumber => 43
1113 sourceIPv4Address => 198.51.100.1
1114 destinationIPv4Address => 203.0.113.200
1115 sourceTransportPort => 5060
1116 destinationTransportPort => 5060
1117 protocolIdentifier => 17
1118 sipMethod => 5
1119 sipObservationType => 1
1120 sipRequestURI => sip:bob@example.net
1121 sipToURI => sip:bob@example.net
1122 sipToTag =>
1123 sipFromURI => sip:alice@example.com
1124 sipFromTag => a1-1
1125 sipCallId => tr-88h@example.com
1126 sipClientTransaction =>
1127 sipServerTransaction => s-1-tr
1128 --- record 12345/258 (#2)---
1129 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
1130 sipSequenceNumber => 43
1131 sourceIPv4Address => 203.0.113.200
1132 destinationIPv4Address => 198.51.100.1
1133 sourceTransportPort => 5060
1134 destinationTransportPort => 5060
1135 protocolIdentifier => 17
1136 sipMethod => 5
1137 sipObservationType => 2
1138 sipResponseStatus => 100
1139 sipToURI => sip:bob@example.net
1140 sipToTag =>
1141 sipFromURI => sip:alice@example.com
1142 sipFromTag => a1-1
1143 sipCallId => tr-88h@example.com
1144 sipClientTransaction =>
1145 sipServerTransaction => s-1-tr
1146 --- record 12345/257 (#3)---
1147 observationTimeMilliseconds => 2010-06-07 17:12:24 UTC
1148 sipSequenceNumber => 43
1149 sourceIPv4Address => 203.0.113.200
1150 destinationIPv4Address => 203.0.113.1
1151 sourceTransportPort => 5060
1152 destinationTransportPort => 5060
1153 protocolIdentifier => 17
1154 sipMethod => 5
1155 sipObservationType => 2
1156 sipRequestURI => sip:bob@bob1.example.net
1157 sipToURI => sip:bob@example.net
1158 sipToTag =>
1159 sipFromURI => sip:alice@example.com
1160 sipFromTag => a1-1
1161 sipCallId => tr-88h@example.com
1162 sipClientTransaction => c-1-tr
1163 sipServerTransaction => s-1-tr
1164 --- record 12345/261 (#4)---
1165 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
1166 sipSequenceNumber => 43
1167 sourceIPv4Address => 203.0.113.200
1168 destinationIPv6Address => 2001:db8::9
1169 sourceTransportPort => 5060
1170 destinationTransportPort => 5060
1171 protocolIdentifier => 17
1172 sipMethod => 5
1173 sipObservationType => 2
1174 sipRequestURI => sip:bob@bob2.example.net
1175 sipToURI => sip:bob@example.net
1176 sipToTag =>
1177 sipFromURI => sip:alice@example.com
1178 sipFromTag => a1-1
1179 sipCallId => tr-88h@example.com
1180 sipClientTransaction => c-2-tr
1181 sipServerTransaction => s-1-tr
1182 --- record 12345/258 (#5)---
1183 observationTimeMilliseconds => 2010-06-07 17:12:25 UTC
1184 sipSequenceNumber => 43
1185 sourceIPv4Address => 203.0.113.1
1186 destinationIPv4Address => 203.0.113.200
1187 sourceTransportPort => 5060
1188 destinationTransportPort => 5060
1189 protocolIdentifier => 17
1190 sipMethod => 5
1191 sipObservationType => 1
1192 sipResponseStatus => 100
1193 sipToURI => sip:bob@example.net
1194 sipToTag => b1-1
1195 sipFromURI => sip:alice@example.com
1196 sipFromTag => a1-1
1197 sipCallId => tr-88h@example.com
1198 sipClientTransaction => c-1-tr
1199 sipServerTransaction => s-1-tr
1200 --- record 12345/264 (#6)---
1201 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
1202 sipSequenceNumber => 43
1203 sourceIPv6Address => 2001:db8::9
1204 destinationIPv4Address => 203.0.113.200
1205 sourceTransportPort => 5060
1206 destinationTransportPort => 5060
1207 protocolIdentifier => 17
1208 sipMethod => 5
1209 sipObservationType => 1
1210 sipResponseStatus => 100
1211 sipToURI => sip:bob@example.net
1212 sipToTag => b2-2
1213 sipFromURI => sip:alice@example.com
1214 sipFromTag => a1-1
1215 sipCallId => tr-88h@example.com
1216 sipClientTransaction => c-2-tr
1217 sipServerTransaction => s-1-tr
1218 --- record 12345/264 (#7)---
1219 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
1220 sipSequenceNumber => 43
1221 sourceIPv6Address => 2001:db8::9
1222 destinationIPv4Address => 203.0.113.200
1223 sourceTransportPort => 5060
1224 destinationTransportPort => 5060
1225 protocolIdentifier => 17
1226 sipMethod => 5
1227 sipObservationType => 1
1228 sipResponseStatus => 180
1229 sipToURI => sip:bob@example.net
1230 sipToTag => b2-2
1231 sipFromURI => sip:alice@example.com
1232 sipFromTag => a1-1
1233 sipCallId => tr-88h@example.com
1234 sipClientTransaction => c-2-tr
1235 sipServerTransaction => s-1-tr
1236 --- record 12345/258 (#8)---
1237 observationTimeMilliseconds => 2010-06-07 17:12:26 UTC
1238 sipSequenceNumber => 43
1239 sourceIPv4Address => 203.0.113.200
1240 destinationIPv4Address => 198.51.100.1
1241 sourceTransportPort => 5060
1242 destinationTransportPort => 5060
1243 protocolIdentifier => 17
1244 sipMethod => 5
1245 sipObservationType => 2
1246 sipResponseStatus => 180
1247 sipToURI => sip:bob@example.net
1248 sipToTag =>
1249 sipFromURI => sip:alice@example.com
1250 sipFromTag => a1-1
1251 sipCallId => tr-88h@example.com
1252 sipClientTransaction => c-2-tr
1253 sipServerTransaction => s-1-tr
1254 --- record 12345/258 (#9)---
1255 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
1256 sipSequenceNumber => 43
1257 sourceIPv4Address => 203.0.113.200
1258 destinationIPv4Address => 198.51.100.1
1259 sourceTransportPort => 5060
1260 destinationTransportPort => 5060
1261 protocolIdentifier => 17
1262 sipMethod => 5
1263 sipObservationType => 2
1264 sipResponseStatus => 180
1265 sipToURI => sip:bob@example.net
1266 sipToTag => b1-1
1267 sipFromURI => sip:alice@example.com
1268 sipFromTag => a1-1
1269 sipCallId => tr-88h@example.com
1270 sipClientTransaction => c-1-tr
1271 sipServerTransaction => s-1-tr
1272 --- record 12345/258 (#10)---
1273 observationTimeMilliseconds => 2010-06-07 17:12:27 UTC
1274 sipSequenceNumber => 43
1275 sourceIPv4Address => 203.0.113.1
1276 destinationIPv4Address => 203.0.113.200
1277 sourceTransportPort => 5060
1278 destinationTransportPort => 5060
1279 protocolIdentifier => 17
1280 sipMethod => 5
1281 sipObservationType => 1
1282 sipResponseStatus => 200
1283 sipToURI => sip:bob@example.net
1284 sipToTag => b1-1
1285 sipFromURI => sip:alice@example.com
1286 sipFromTag => a1-1
1287 sipCallId => tr-88h@example.com
1288 sipClientTransaction => c-1-tr
1289 sipServerTransaction => s-1-tr
1290 --- record 12345/258 (#11)---
1291 observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
1292 sipSequenceNumber => 43
1293 sourceIPv4Address => 203.0.113.200
1294 destinationIPv4Address => 198.51.100.1
1295 sourceTransportPort => 5060
1296 destinationTransportPort => 5060
1297 protocolIdentifier => 17
1298 sipMethod => 5
1299 sipObservationType => 2
1300 sipResponseStatus => 200
1301 sipToURI => sip:bob@example.net
1302 sipToTag => b1-1
1303 sipFromURI => sip:alice@example.com
1304 sipFromTag => a1-1
1305 sipCallId => tr-88h@example.com
1306 sipClientTransaction => c-1-tr
1307 sipServerTransaction => s-1-tr
1308 --- record 12345/261 (#12)---
1309 observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
1310 sipSequenceNumber => 43
1311 sourceIPv4Address => 203.0.113.200
1312 destinationIPv6Address => 2001:db8::9
1313 sourceTransportPort => 5060
1314 destinationTransportPort => 5060
1315 protocolIdentifier => 17
1316 sipMethod => 3
1317 sipObservationType => 2
1318 sipRequestURI => sip:bob@bob2.example.net
1319 sipToURI => sip:bob@example.net
1320 sipToTag =>
1321 sipFromURI => sip:alice@example.com
1322 sipFromTag => a1-1
1323 sipCallId => tr-88h@example.com
1324 sipClientTransaction => c-2-tr
1325 sipServerTransaction => s-1-tr
1326 --- record 12345/264 (#13)---
1327 observationTimeMilliseconds => 2010-06-07 17:12:28 UTC
1328 sipSequenceNumber => 43
1329 sourceIPv6Address => 2001:db8::9
1330 destinationIPv4Address => 203.0.113.200
1331 sourceTransportPort => 5060
1332 destinationTransportPort => 5060
1333 protocolIdentifier => 17
1334 sipMethod => 5
1335 sipObservationType => 1
1336 sipResponseStatus => 487
1337 sipToURI => sip:bob@example.net
1338 sipToTag =>
1339 sipFromURI => sip:alice@example.com
1340 sipFromTag => a1-1
1341 sipCallId => tr-88h@example.com
1342 sipClientTransaction => c-2-tr
1343 sipServerTransaction => s-1-tr
1344 --- record 12345/261 (#14)---
1345 observationTimeMilliseconds => 2010-06-07 17:12:29 UTC
1346 sipSequenceNumber => 43
1347 sourceIPv4Address => 203.0.113.200
1348 destinationIPv6Address => 2001:db8::9
1349 sourceTransportPort => 5060
1350 destinationTransportPort => 5060
1351 protocolIdentifier => 17
1352 sipMethod => 1
1353 sipObservationType => 2
1354 sipRequestURI => sip:bob@bob2.example.net
1355 sipToURI => sip:bob@example.net
1356 sipToTag =>
1357 sipFromURI => sip:alice@example.com
1358 sipFromTag => a1-1
1359 sipCallId => tr-88h@example.com
1360 sipClientTransaction => c-2-tr
1361 sipServerTransaction => s-1-tr
1362 --- record 12345/264 (#15)---
1363 observationTimeMilliseconds => 2010-06-07 17:12:30 UTC
1364 sipSequenceNumber => 43
1365 sourceIPv6Address => 2001:db8::9
1366 destinationIPv4Address => 203.0.113.200
1367 sourceTransportPort => 5060
1368 destinationTransportPort => 5060
1369 protocolIdentifier => 17
1370 sipMethod => 3
1371 sipObservationType => 1
1372 sipResponseStatus => 200
1373 sipToURI => sip:bob@example.net
1374 sipToTag =>
1375 sipFromURI => sip:alice@example.com
1376 sipFromTag => a1-1
1377 sipCallId => tr-88h@example.com
1378 sipClientTransaction => c-2-tr
1379 sipServerTransaction => s-1-tr
1381 Figure 11: Message containing fifteen records for a forked call
1383 0000: 00 0a 07 8c 4c c0 2d 9b 00 00 00 00 00 00 30 39| ....L.-.......09
1384 0010: 01 01 00 7e|00 00 01 29 13 66 13 93 00 00 00 2b ...~...).f.....+
1385 0020: c6 33 64 01 cb 00 71 c8 13 c4 13 c4 11 05 01 13 .3d...q.........
1386 0030: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
1387 0040: 6e 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d net.sip:bob@exam
1388 0050: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
1389 0060: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
1390 0070: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp
1391 0080: 6c 65 2e 63 6f 6d 00 06 73 2d 31 2d 74 72|01 02 le.com..s-1-tr..
1392 0090: 00 6c|00 00 01 29 13 66 14 c1 00 00 00 2b cb 00 .l...).f.....+..
1393 00a0: 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 64 13 q..3d.........d.
1394 00b0: 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e sip:bob@example.
1395 00c0: 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 net..sip:alice@e
1396 00d0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
1397 00e0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
1398 00f0: 6f 6d 00 06 73 2d 31 2d 74 72|01 01 00 89|00 00 om..s-1-tr......
1399 0100: 01 29 13 66 18 a6 00 00 00 2b cb 00 71 c8 cb 00 .).f.....+..q...
1400 0110: 71 01 13 c4 13 c4 11 05 02 18 73 69 70 3a 62 6f q.........sip:bo
1401 0120: 62 40 62 6f 62 31 2e 65 78 61 6d 70 6c 65 2e 6e b@bob1.example.n
1402 0130: 65 74 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 et.sip:bob@examp
1403 0140: 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 63 le.net..sip:alic
1404 0150: 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 e@example.com.a1
1405 0160: 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c -1.tr-88h@exampl
1406 0170: 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 e.com.c-1-tr.s-1
1407 0180: 2d 74 72|01 05 00 95|00 00 01 29 13 66 1a 9c 00 -tr.......).f...
1409 0190: 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 00 00 00 ..+..q. ........
1410 01a0: 00 00 00 00 00 00 09 13 c4 13 c4 11 05 02 18 73 ...............s
1411 01b0: 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 78 61 6d ip:bob@bob2.exam
1412 01c0: 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 6f 62 40 ple.net.sip:bob@
1413 01d0: 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 70 example.net..sip
1414 01e0: 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 :alice@example.c
1415 01f0: 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 om.a1-1.tr-88h@e
1416 0200: 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 xample.com.c-2-t
1417 0210: 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 01 29 r.s-1-tr...v...)
1418 0220: 13 66 1b c8 00 00 00 2b cb 00 71 01 cb 00 71 c8 .f.....+..q...q.
1419 0230: 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a 62 6f ........d.sip:bo
1420 0240: 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 62 31 b@example.net.b1
1421 0250: 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 -1.sip:alice@exa
1422 0260: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr
1423 0270: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com
1424 0280: 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-1-tr.s-1-tr..
1425 0290: 00 82|00 00 01 29 13 66 1c f4 00 00 00 2b 20 01 .....).f.....+ .
1426 02a0: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................
1427 02b0: 71 c8 13 c4 13 c4 11 05 01 00 64 13 73 69 70 3a q.........d.sip:
1428 02c0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net.
1429 02d0: 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 40 65 b2-2.sip:alice@e
1430 02e0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
1431 02f0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
1432 0300: 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72| om.c-2-tr.s-1-tr
1433 0310: 01 08 00 82|00 00 01 29 13 66 1f 4c 00 00 00 2b .......).f.L...+
1434 0320: 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 ...............
1435 0330: cb 00 71 c8 13 c4 13 c4 11 05 01 00 b4 13 73 69 ..q...........si
1436 0340: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne
1437 0350: 74 04 62 32 2d 32 15 73 69 70 3a 61 6c 69 63 65 t.b2-2.sip:alice
1438 0360: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d @example.com.a1-
1439 0370: 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 1.tr-88h@example
1440 0380: 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d 31 2d .com.c-2-tr.s-1-
1441 0390: 74 72|01 02 00 72|00 00 01 29 13 66 20 6e 00 00 tr...r...).f n..
1442 03a0: 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 .+..q..3d.......
1443 03b0: 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 61 6d ....sip:bob@exam
1444 03c0: 70 6c 65 2e 6e 65 74 00 15 73 69 70 3a 61 6c 69 ple.net..sip:ali
1445 03d0: 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 ce@example.com.a
1446 03e0: 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 6d 70 1-1.tr-88h@examp
1447 03f0: 6c 65 2e 63 6f 6d 06 63 2d 32 2d 74 72 06 73 2d le.com.c-2-tr.s-
1448 0400: 31 2d 74 72|01 02 00 76|00 00 01 29 13 66 21 a4 1-tr...v...).f!.
1449 0410: 00 00 00 2b cb 00 71 c8 c6 33 64 01 13 c4 13 c4 ...+..q..3d.....
1450 0420: 11 05 02 00 b4 13 73 69 70 3a 62 6f 62 40 65 78 ......sip:bob@ex
1451 0430: 61 6d 70 6c 65 2e 6e 65 74 04 62 31 2d 31 15 73 ample.net.b1-1.s
1452 0440: 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 ip:alice@example
1453 0450: 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 .com.a1-1.tr-88h
1454 0460: 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 @example.com.c-1
1455 0470: 2d 74 72 06 73 2d 31 2d 74 72|01 02 00 76|00 00 -tr.s-1-tr...v..
1456 0480: 01 29 13 66 23 98 00 00 00 2b cb 00 71 01 cb 00 .).f#....+..q...
1458 0490: 71 c8 13 c4 13 c4 11 05 01 00 c8 13 73 69 70 3a q...........sip:
1459 04a0: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 04 bob@example.net.
1460 04b0: 62 31 2d 31 15 73 69 70 3a 61 6c 69 63 65 40 65 b1-1.sip:alice@e
1461 04c0: 78 61 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 xample.com.a1-1.
1462 04d0: 74 72 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 tr-88h@example.c
1463 04e0: 6f 6d 06 63 2d 31 2d 74 72 06 73 2d 31 2d 74 72| om.c-1-tr.s-1-tr
1464 04f0: 01 02 00 76|00 00 01 29 13 66 24 60 00 00 00 2b ...v...).f$`...+
1465 0500: cb 00 71 c8 c6 33 64 01 13 c4 13 c4 11 05 02 00 ..q..3d.........
1466 0510: c8 13 73 69 70 3a 62 6f 62 40 65 78 61 6d 70 6c ..sip:bob@exampl
1467 0520: 65 2e 6e 65 74 04 62 31 2d 31 15 73 69 70 3a 61 e.net.b1-1.sip:a
1468 0530: 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d lice@example.com
1469 0540: 04 61 31 2d 31 12 74 72 2d 38 38 68 40 65 78 61 .a1-1.tr-88h@exa
1470 0550: 6d 70 6c 65 2e 63 6f 6d 06 63 2d 31 2d 74 72 06 mple.com.c-1-tr.
1471 0560: 73 2d 31 2d 74 72|01 05 00 95|00 00 01 29 13 66 s-1-tr.......).f
1472 0570: 25 29 00 00 00 2b cb 00 71 c8 20 01 0d b8 00 00 %)...+..q. .....
1473 0580: 00 00 00 00 00 00 00 00 00 09 13 c4 13 c4 11 03 ................
1474 0590: 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 32 2e 65 ..sip:bob@bob2.e
1475 05a0: 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 70 3a 62 xample.net.sip:b
1476 05b0: 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 ob@example.net..
1477 05c0: 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c sip:alice@exampl
1478 05d0: 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 e.com.a1-1.tr-88
1479 05e0: 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d h@example.com.c-
1480 05f0: 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 00 7e|00 2-tr.s-1-tr...~.
1481 0600: 00 01 29 13 66 28 3f 00 00 00 2b 20 01 0d b8 00 ..).f(?...+ ....
1482 0610: 00 00 00 00 00 00 00 00 00 00 09 cb 00 71 c8 13 .............q..
1483 0620: c4 13 c4 11 05 01 01 e7 13 73 69 70 3a 62 6f 62 .........sip:bob
1484 0630: 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 15 73 69 @example.net..si
1485 0640: 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 6c 65 2e p:alice@example.
1486 0650: 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 38 68 40 com.a1-1.tr-88h@
1487 0660: 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 2d 32 2d example.com.c-2-
1488 0670: 74 72 06 73 2d 31 2d 74 72|01 05 00 95|00 00 01 tr.s-1-tr.......
1489 0680: 29 13 66 2a 0f 00 00 00 2b cb 00 71 c8 20 01 0d ).f*....+..q. ..
1490 0690: b8 00 00 00 00 00 00 00 00 00 00 00 09 13 c4 13 ................
1491 06a0: c4 11 01 02 18 73 69 70 3a 62 6f 62 40 62 6f 62 .....sip:bob@bob
1492 06b0: 32 2e 65 78 61 6d 70 6c 65 2e 6e 65 74 13 73 69 2.example.net.si
1493 06c0: 70 3a 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 p:bob@example.ne
1494 06d0: 74 00 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 t..sip:alice@exa
1495 06e0: 6d 70 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 mple.com.a1-1.tr
1496 06f0: 2d 38 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d -88h@example.com
1497 0700: 06 63 2d 32 2d 74 72 06 73 2d 31 2d 74 72|01 08 .c-2-tr.s-1-tr..
1498 0710: 00 7e|00 00 01 29 13 66 2c 31 00 00 00 2b 20 01 .~...).f,1...+ .
1499 0720: 0d b8 00 00 00 00 00 00 00 00 00 00 00 09 cb 00 ................
1500 0730: 71 c8 13 c4 13 c4 11 03 01 00 c8 13 73 69 70 3a q...........sip:
1501 0740: 62 6f 62 40 65 78 61 6d 70 6c 65 2e 6e 65 74 00 bob@example.net.
1502 0750: 15 73 69 70 3a 61 6c 69 63 65 40 65 78 61 6d 70 .sip:alice@examp
1503 0760: 6c 65 2e 63 6f 6d 04 61 31 2d 31 12 74 72 2d 38 le.com.a1-1.tr-8
1504 0770: 38 68 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 06 63 8h@example.com.c
1505 0780: 2d 32 2d 74 72 06 73 2d 31 2d 74 72 -2-tr.s-1-tr
1506 Figure 12: Message containing sixteen log entries for a forked call
1508 6. Security Considerations
1510 [TODO]
1512 7. IANA Considerations
1514 This document defines the sipMethod subregistry for the IANA IPFIX
1515 Information Element registry at http://www.iana.org/assignments/ipfix
1516 for the values taken by the sipMethod Information Element. The
1517 initial content of this subregistry is specified in Section 2.13.
1518 Entries may be added to this subregistry subject to the same
1519 Standards Action [RFC5226] that adds new Methods to the Methods and
1520 Response Codes registry at
1521 http://www.iana.org/assignments/sip-parameters.
1523 At such time as this document is prepared for publication as an RFC,
1524 the Information Elements defined herein will be defined for inclusion
1525 in the IANA IPFIX Information Element registry at
1526 http://www.iana.org/assignments/ipfix. Until such time, the
1527 Information Elements within this document are defined within Private
1528 Enterprise Number 35566, belonging to one of the authors.
1530 8. Acknowledgments
1532 Thanks to Cullen Jennings for his provided insightful discussions,
1533 specific comments and much needed corrections, and to Nico d'Heureuse
1534 for his help with the RFC 3665 examples.
1536 9. References
1538 9.1. Normative References
1540 [I-D.ietf-sipclf-problem-statement]
1541 Gurbani, V., Burger, E., Anjali, T., Abdelnur, H., and O.
1542 Festor, "The Common Log Format (CLF) for the Session
1543 Initiation Protocol (SIP)",
1544 draft-ietf-sipclf-problem-statement-07 (work in progress),
1545 June 2011.
1547 [RFC5101] Claise, B., "Specification of the IP Flow Information
1548 Export (IPFIX) Protocol for the Exchange of IP Traffic
1549 Flow Information", RFC 5101, January 2008.
1551 [RFC5655] Trammell, B., Boschi, E., Mark, L., Zseby, T., and A.
1552 Wagner, "Specification of the IP Flow Information Export
1553 (IPFIX) File Format", RFC 5655, October 2009.
1555 9.2. Informative References
1557 [I-D.kaplan-dispatch-session-id]
1558 Kaplan, H., "A Session Identifier for the Session
1559 Initiation Protocol (SIP)",
1560 draft-kaplan-dispatch-session-id-03 (work in progress),
1561 March 2011.
1563 [I-D.trammell-ipfix-ie-doctors]
1564 Trammell, B. and B. Claise, "Guidelines for Authors and
1565 Reviewers of IPFIX Information Elements",
1566 draft-trammell-ipfix-ie-doctors-02 (work in progress),
1567 June 2011.
1569 [RFC2976] Donovan, S., "The SIP INFO Method", RFC 2976,
1570 October 2000.
1572 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
1573 A., Peterson, J., Sparks, R., Handley, M., and E.
1574 Schooler, "SIP: Session Initiation Protocol", RFC 3261,
1575 June 2002.
1577 [RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of
1578 Provisional Responses in Session Initiation Protocol
1579 (SIP)", RFC 3262, June 2002.
1581 [RFC3265] Roach, A., "Session Initiation Protocol (SIP)-Specific
1582 Event Notification", RFC 3265, June 2002.
1584 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP)
1585 UPDATE Method", RFC 3311, October 2002.
1587 [RFC3428] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C.,
1588 and D. Gurle, "Session Initiation Protocol (SIP) Extension
1589 for Instant Messaging", RFC 3428, December 2002.
1591 [RFC3515] Sparks, R., "The Session Initiation Protocol (SIP) Refer
1592 Method", RFC 3515, April 2003.
1594 [RFC3665] Johnston, A., Donovan, S., Sparks, R., Cunningham, C., and
1595 K. Summers, "Session Initiation Protocol (SIP) Basic Call
1596 Flow Examples", BCP 75, RFC 3665, December 2003.
1598 [RFC3903] Niemi, A., "Session Initiation Protocol (SIP) Extension
1599 for Event State Publication", RFC 3903, October 2004.
1601 [RFC4475] Sparks, R., Hawrylyshen, A., Johnston, A., Rosenberg, J.,
1602 and H. Schulzrinne, "Session Initiation Protocol (SIP)
1603 Torture Test Messages", RFC 4475, May 2006.
1605 [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
1606 IANA Considerations Section in RFCs", BCP 26, RFC 5226,
1607 May 2008.
1609 [RFC6026] Sparks, R. and T. Zourzouvillys, "Correct Transaction
1610 Handling for 2xx Responses to Session Initiation Protocol
1611 (SIP) INVITE Requests", RFC 6026, September 2010.
1613 [RFC6086] Holmberg, C., Burger, E., and H. Kaplan, "Session
1614 Initiation Protocol (SIP) INFO Method and Package
1615 Framework", RFC 6086, January 2011.
1617 [ripfix] Trammell, B., "ripfix: IPFIX for Ruby", available at
1618 http://ripfix.rubyforge.org/.
1620 Appendix A. Definition of Base SIP Message Information Elements in IANA
1621 XML Registry format
1623 [EDITOR'S NOTE: frontmatter]
1625
1626
1627
1628 sipObservationType
1629 unsigned8
1630 identifier
1631 35566
1632 419
1633 current
1634
1635
1636 Denotes whether the entry was
1637 corresponds to a SIP message received, sent, or merely
1638 seen by a passive observer, as follows:
1639
1640 0: unknown: The Metering Process does not
1641 specify the observation type.
1642 1: receiver: The Metering Process is, or is
1643 co-located with, the receiver of the SIP message.
1644 2: sender: The Metering Process is, or is
1645 co-located with, the sender of the SIP message.
1647 3: passive: The Metering Process passively
1648 observed the SIP message.
1649
1650
1651
1652 sipMethod
1653 unsigned8
1654 identifier
1655 35566
1656 402
1657 current
1658
1659
1660 The SIP method from the CSeq header, encoded as per
1661 the IPFIX sipMethod subregistry.
1662
1663
1664
1665
1666 sipSequenceNumber
1667 unsigned32
1668 identifier
1669 35566
1670 409
1671 current
1672
1673 The sequence number from the CSeq header.
1674
1675
1676
1677 sipRequestURI
1678 string
1679 35566
1680 403
1681 current
1682
1683 The SIP Request URI, including any parameters,
1684 as a UTF-8 string, escaped according to SIP rules as
1685 received by the metering process.
1686
1687
1688
1689 sipFromURI
1690 string
1691 35566
1692 404
1693 current
1694
1695 The URI from the SIP From: header
1696
1697
1698
1699 sipFromTag
1700 string
1701 35566
1702 405
1703 current
1704
1705 The Tag parameter value from the SIP
1706 From: header
1707
1708
1709
1710 sipToURI
1711 string
1712 35566
1713 406
1714 current
1715
1716 The URI from the SIP To: header
1717
1718
1719
1720 sipToTag
1721 string
1722 35566
1723 407
1724 current
1725
1726 The Tag parameter value from the SIP To:
1727 header
1728
1729
1730
1731 sipCallId
1732 string
1733 35566
1734 408
1735 current
1736
1737 The value of the SIP Call-ID: header
1738
1739
1740
1741 sipResponseStatus
1742 unsigned16
1743 identifier
1744 35566
1745 412
1746 current
1747
1748 The SIP Response code. The presence of this
1749 Information Element in a SIP Message record marks it as
1750 describing a SIP response; if absent, the record describes
1751 a SIP request.
1752
1753
1754
1755 sipServerTransaction
1756 string
1757 identifier
1758 35566
1759 413
1760 current
1761
1762 The transaction identifier associated with
1763 the server transaction.
1764
1765
1766
1767 sipClientTransaction
1768 string
1769 identifier
1770 35566
1771 414
1772 current
1773
1774 The transaction identifier associated with
1775 the client transaction.
1776
1777
1778
1779
1781 SIP Message Information Element definitions
1783 Appendix B. Definition of sipMethod registry in IANA XML Registry
1784 format
1786 [EDITOR'S NOTE: frontmatter]
1788
1789
1790 IPFIX sipMethod
1791 Expert Review
1792
1793 0
1794 Unknown
1795 The Metering Process did not
1796 recognize the SIP method.
1797
1798
1799 1
1800 ACK
1801
1802
1803
1804
1805 2
1806 BYE
1807
1808
1809
1810
1811 3
1812 CANCEL
1813
1814
1815
1816
1817 4
1818 INFO
1819
1820
1821
1822
1823 5
1824 INVITE
1825
1826
1827
1828
1829 6
1830 MESSAGE
1831
1832
1833
1834
1835 7
1836 NOTIFY
1837
1838
1839
1840
1841 8
1842 OPTIONS
1843
1844
1845
1846
1847 9
1848 PRACK
1849
1850
1851
1852
1853 10
1854 PUBLISH
1855
1856
1857
1858
1859 11
1860 REFER
1861
1862
1863
1864
1865 12
1866 REGISTER
1867
1868
1869
1870
1871 13
1872 SUBSCRIBE
1873
1874
1875
1876
1877 14
1878 UPDATE
1879
1880
1881
1882
1883 15-65535
1884 Unassigned
1885
1887
1888
1889
1891 sipMethod subregistry
1893 Appendix C. Definition of Additional SIP Message Information Elements
1894 in IANA XML Registry format
1896 [EDITOR'S NOTE: frontmatter]
1898
1900
1901
1903
1904 sipContactURI
1905 string
1906 35566
1907 415
1908 current
1909
1910 The addr-spec URI, including any URI parameters,
1911 of the first/top-most SIP Contact header,
1912 as a UTF-8 string, escaped according to SIP rules as
1913 received by the metering process.
1914
1915
1916
1917 sipRouteURI
1918 string
1919 35566
1920 416
1921 current
1922
1923 The addr-spec URI, including any URI parameters,
1924 of the first/top-most SIP Route header,
1925 as a UTF-8 string, escaped according to SIP rules as
1926 received by the metering process.
1927
1928
1929
1930 sipPaiURI
1931 string
1932 35566
1933 417
1934 current
1935
1936 The addr-spec URI, including any URI parameters,
1937 of the first/top-most SIP P-Asserted-Identity header,
1938 as a UTF-8 string, escaped according to SIP rules as
1939 received by the metering process.
1940
1941
1942
1943 sipPpiURI
1944 string
1945 35566
1946 418
1947 current
1948
1949 The addr-spec URI, including any URI parameters,
1950 of the first/top-most SIP P-Preferred-Identity header,
1951 as a UTF-8 string, escaped according to SIP rules as
1952 received by the metering process.
1953
1954
1955
1956 sipPAssocURI
1957 string
1958 35566
1959 430
1960 current
1961
1962 The addr-spec URI, including any URI parameters,
1963 of the first/top-most SIP P-Associated-Identity header,
1964 as a UTF-8 string, escaped according to SIP rules as
1965 received by the metering process.
1966
1967
1968
1969 sipPCalledPartyURI
1970 string
1971 35566
1972 420
1973 current
1974
1975 The addr-spec URI, including any URI parameters,
1976 of the SIP P-Called-Party-ID header,
1977 as a UTF-8 string, escaped according to SIP rules as
1978 received by the metering process.
1979
1980
1981
1982 sipVia
1983 string
1984 35566
1985 421
1986 current
1987
1988 The value of the first/top-most Via header
1989 as a UTF-8 string, escaped according to SIP rules as
1990 received by the metering process.
1991
1992
1993
1994 sipAuthUsername
1995 string
1996 35566
1997 422
1998 current
1999
2000 The value of the username field
2001 of the first/top-most Authorization header
2002 as a UTF-8 string, escaped according to SIP rules as
2003 received by the metering process.
2004
2005
2006
2007 sipSubscriptionEvent
2008 string
2009 35566
2010 423
2011 current
2012
2013 The value of the Event header
2014 as a UTF-8 string, escaped according to SIP rules as
2015 received by the metering process.
2016
2017
2018
2019 sipSubscriptionState
2020 string
2021 35566
2022 424
2023 current
2024
2025 The value of the Subscription-State header
2026 as a UTF-8 string, escaped according to SIP rules as
2027 received by the metering process.
2028
2029
2030
2031 sipExpires
2032 unsigned32
2033 35566
2034 425
2035 current
2036
2037 The numeric value of the expires parameter of the
2038 first/top-most Contact header of a REGISTER request
2039 or response, or Subscription-State header of a SUBSCRIBE
2040 or NOTIFY request or response, or the Expires header
2041 if the expires parameter does not exist, as
2042 received by the metering process.
2043
2044
2045
2046 sipPVisitedNetworkID
2047 string
2048 35566
2049 426
2050 current
2051
2052 The value of the first/top-most P-Visited-Network-ID
2053 header as a UTF-8 string, escaped according to SIP rules as
2054 received by the metering process.
2055
2056
2057
2058 sipPAccessNetworkInfo
2059 string
2060 35566
2061 427
2062 current
2063
2064 The value of the P-Access-Network-Info header
2065 as a UTF-8 string, escaped according to SIP rules as
2066 received by the metering process.
2067
2068
2069
2070 sipPChargingFunctionAddr
2071 string
2072 35566
2073 428
2074 current
2075
2076 The value of the first/top-most
2077 P-Charging-Function-Addresses header
2078 as a UTF-8 string, escaped according to SIP rules as
2079 received by the metering process.
2080
2081
2082
2083 sipPChargingVector
2084 string
2085 35566
2086 429
2087 current
2088
2089 The value of the P-Charging-Vector header
2090 as a UTF-8 string, escaped according to SIP rules as
2091 received by the metering process.
2092
2093
2094
2095
2097 Additional SIP Message Information Element definitions
2099 Appendix D. Example messages in base64
2101 This section contains the example messages from this revision of this
2102 draft in base64 encoding, for ease of processing by automated tools.
2104 The base templates are in this message:
2106 AAoA/EzALZsAAAAAAAAwOQACAOwBAQARAUMACIGZAAQAAIruAAgABAAMAAQA
2107 BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
2108 //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
2109 7gECABEBQwAIgZkABAAAiu4ACAAEAAwABAAHAAIACwACAAQAAYGSAAEAAIru
2110 gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
2111 AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIru
2113 The extended 4to6 and 6to4 templates are in this message:
2115 AAoB5EzALZsAAAAAAAAwOQACAdQBBQARAUMACIGZAAQAAIruAAgABAAcABAA
2116 BwACAAsAAgAEAAGBkgABAACK7oGjAAEAAIrugZP//wAAiu6Blv//AACK7oGX
2117 //8AAIrugZT//wAAiu6Blf//AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK
2118 7gEGABEBQwAIgZkABAAAiu4ACAAEABwAEAAHAAIACwACAAQAAYGSAAEAAIru
2119 gaMAAQAAiu6BnAACAACK7oGW//8AAIrugZf//wAAiu6BlP//AACK7oGV//8A
2120 AIrugZj//wAAiu6Bnv//AACK7oGd//8AAIruAQcAEQFDAAiBmQAEAACK7gAb
2121 ABAADAAEAAcAAgALAAIABAABgZIAAQAAiu6BowABAACK7oGT//8AAIrugZb/
2122 /wAAiu6Bl///AACK7oGU//8AAIrugZX//wAAiu6BmP//AACK7oGe//8AAIru gZ3//
2123 wAAiu4BCAARAUMACIGZAAQAAIruABsAEAAMAAQABwACAAsAAgAEAAGB
2124 kgABAACK7oGjAAEAAIrugZwAAgAAiu6Blv//AACK7oGX//8AAIrugZT//wAA iu6Blf//
2125 AACK7oGY//8AAIrugZ7//wAAiu6Bnf//AACK7g==
2127 The UAC registration in Section 5.2 is in this message:
2129 AAoA2EzAO88AAAAAAAAwOQEBAGsAAAEpE2YTkwAAAAHGM2QBxjNkChPEE8QR
2130 DAIPc2lwOmV4YW1wbGUuY29tAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
2131 eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEAAQIAXQAAASkTZhUk
2132 AAAAAcYzZArGM2QBE8QTxBEMAQDIAAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
2133 BTc2eWhoFWY4MS1kNC1mNkBleGFtcGxlLmNvbQZjLXRyLTEA
2135 The direct call in Section 5.3 is in this message:
2137 AAoCGkzAPA8AAAAAAAAwOQEBAIgAAAEpE2YTkwAAACDGM2QBywBxARPEE8QR
2138 BQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5u
2139 ZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQU3NnloaBVmODItZDQtZjdAZXhh
2140 bXBsZS5jb20HYy0xLXh0NgABAgB5AAABKRNmGKoAAAAgywBxAcYzZAETxBPE
2141 EQUBALQTc2lwOmJvYkBleGFtcGxlLm5ldAhiLWluNi1pdRVzaXA6YWxpY2VA
2142 ZXhhbXBsZS5jb20FNzZ5aGgVZjgyLWQ0LWY3QGV4YW1wbGUuY29tB2MtMS14
2143 dDYAAQIAeQAAASkTZhz0AAAAIMsAcQHGM2QBE8QTxBEFAQDIE3NpcDpib2JA
2144 ZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1wbGUuY29tBTc2
2145 eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AAEBAJAAAAEpE2Yd
2146 CAAAACDGM2QBywBxARPEE8QRAQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0
2147 E3NpcDpib2JAZXhhbXBsZS5uZXQIYi1pbjYtaXUVc2lwOmFsaWNlQGV4YW1w
2148 bGUuY29tBTc2eWhoFWY4Mi1kNC1mN0BleGFtcGxlLmNvbQdjLTEteHQ2AA==
2150 The downstream branch call in Section 5.4 is in this message:
2152 AAoE4UzAPEoAAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBxjNkChPEE8QR
2153 BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
2154 aXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20A
2155 BnMteC10cgECAGwAAAEpE2YUwQAAACvGM2QKxjNkARPEE8QRBQIAZBNzaXA6
2156 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0
2157 ci04N2hAZXhhbXBsZS5jb20ABnMteC10cgEBAIkAAAEpE2YYpgAAACvGM2QK
2158 ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
2159 ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3
2160 aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZhlwAAAAK8sA
2161 cQHGM2QKE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6
2162 YWxpY2VAZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14
2163 LXRyBnMteC10cgECAHYAAAEpE2YbyAAAACvLAHEBxjNkChPEE8QRBQEAtBNz
2164 aXA6Ym9iQGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29t
2165 BGFsLTESdHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAgB2AAAB
2166 KRNmHJgAAAArxjNkCsYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
2167 dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0xEnRyLTg3aEBleGFt
2168 cGxlLmNvbQZjLXgtdHIGcy14LXRyAQIAdgAAASkTZiDwAAAAK8sAcQHGM2QK
2169 E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
2170 ZXhhbXBsZS5jb20EYWwtMRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMt
2171 eC10cgECAHYAAAEpE2YhpAAAACvGM2QKxjNkARPEE8QRBQIAyBNzaXA6Ym9i
2172 QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGFsLTES
2173 dHItODdoQGV4YW1wbGUuY29tBmMteC10cgZzLXgtdHIBAQCIAAABKRNmKKwA
2174 AAArxjNkAcYzZAoTxBPEEQEBE3NpcDpib2JAZXhhbXBsZS5uZXQTc2lwOmJv
2175 YkBleGFtcGxlLm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhbC0x
2176 EnRyLTg3aEBleGFtcGxlLmNvbQZjLXgtdHIGcy14LXRyAQEAiAAAASkTZiis
2177 AAAAK8YzZArLAHEBE8QTxBEBAhNzaXA6Ym9iQGV4YW1wbGUubmV0E3NpcDpi
2178 b2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYWwt
2179 MRJ0ci04N2hAZXhhbXBsZS5jb20GYy14LXRyBnMteC10cg==
2181 The forked call in Section 5.5 is in this message:
2183 AAoHjEzAPF0AAAAAAAAwOQEBAH4AAAEpE2YTkwAAACvGM2QBywBxyBPEE8QR
2184 BQETc2lwOmJvYkBleGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVz
2185 aXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20A
2186 BnMtMS10cgECAGwAAAEpE2YUwQAAACvLAHHIxjNkARPEE8QRBQIAZBNzaXA6
2187 Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0
2188 ci04OGhAZXhhbXBsZS5jb20ABnMtMS10cgEBAIkAAAEpE2YYpgAAACvLAHHI
2189 ywBxARPEE8QRBQIYc2lwOmJvYkBib2IxLmV4YW1wbGUubmV0E3NpcDpib2JA
2190 ZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4
2191 aEBleGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQUAlQAAASkTZhqcAAAAK8sA
2192 ccggAQ24AAAAAAAAAAAAAAAJE8QTxBEFAhhzaXA6Ym9iQGJvYjIuZXhhbXBs
2193 ZS5uZXQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUu
2194 Y29tBGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2
2195 AAABKRNmG8gAAAArywBxAcsAccgTxBPEEQUBAGQTc2lwOmJvYkBleGFtcGxl
2196 Lm5ldARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBl
2197 eGFtcGxlLmNvbQZjLTEtdHIGcy0xLXRyAQgAggAAASkTZhz0AAAAKyABDbgA
2198 AAAAAAAAAAAAAAnLAHHIE8QTxBEFAQBkE3NpcDpib2JAZXhhbXBsZS5uZXQE
2199 YjItMhVzaXA6YWxpY2VAZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBs
2200 ZS5jb20GYy0yLXRyBnMtMS10cgEIAIIAAAEpE2YfTAAAACsgAQ24AAAAAAAA
2201 AAAAAAAJywBxyBPEE8QRBQEAtBNzaXA6Ym9iQGV4YW1wbGUubmV0BGIyLTIV
2202 c2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTESdHItODhoQGV4YW1wbGUuY29t
2203 BmMtMi10cgZzLTEtdHIBAgByAAABKRNmIG4AAAArywBxyMYzZAETxBPEEQUC
2204 ALQTc2lwOmJvYkBleGFtcGxlLm5ldAAVc2lwOmFsaWNlQGV4YW1wbGUuY29t
2205 BGExLTESdHItODhoQGV4YW1wbGUuY29tBmMtMi10cgZzLTEtdHIBAgB2AAAB
2206 KRNmIaQAAAArywBxyMYzZAETxBPEEQUCALQTc2lwOmJvYkBleGFtcGxlLm5l
2207 dARiMS0xFXNpcDphbGljZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFt
2208 cGxlLmNvbQZjLTEtdHIGcy0xLXRyAQIAdgAAASkTZiOYAAAAK8sAcQHLAHHI
2209 E8QTxBEFAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQEYjEtMRVzaXA6YWxpY2VA
2210 ZXhhbXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0xLXRyBnMt
2211 MS10cgECAHYAAAEpE2YkYAAAACvLAHHIxjNkARPEE8QRBQIAyBNzaXA6Ym9i
2212 QGV4YW1wbGUubmV0BGIxLTEVc2lwOmFsaWNlQGV4YW1wbGUuY29tBGExLTES
2213 dHItODhoQGV4YW1wbGUuY29tBmMtMS10cgZzLTEtdHIBBQCVAAABKRNmJSkA
2214 AAArywBxyCABDbgAAAAAAAAAAAAAAAkTxBPEEQMCGHNpcDpib2JAYm9iMi5l
2215 eGFtcGxlLm5ldBNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhh
2216 bXBsZS5jb20EYTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10
2217 cgEIAH4AAAEpE2YoPwAAACsgAQ24AAAAAAAAAAAAAAAJywBxyBPEE8QRBQEB
2218 5xNzaXA6Ym9iQGV4YW1wbGUubmV0ABVzaXA6YWxpY2VAZXhhbXBsZS5jb20E
2219 YTEtMRJ0ci04OGhAZXhhbXBsZS5jb20GYy0yLXRyBnMtMS10cgEFAJUAAAEp
2220 E2YqDwAAACvLAHHIIAENuAAAAAAAAAAAAAAACRPEE8QRAQIYc2lwOmJvYkBi
2221 b2IyLmV4YW1wbGUubmV0E3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGlj
2222 ZUBleGFtcGxlLmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIG
2223 cy0xLXRyAQgAfgAAASkTZiwxAAAAKyABDbgAAAAAAAAAAAAAAAnLAHHIE8QT
2224 xBEDAQDIE3NpcDpib2JAZXhhbXBsZS5uZXQAFXNpcDphbGljZUBleGFtcGxl
2225 LmNvbQRhMS0xEnRyLTg4aEBleGFtcGxlLmNvbQZjLTItdHIGcy0xLXRy
2227 Authors' Addresses
2229 Brian Trammell
2230 Swiss Federal Institute of Technology Zurich
2231 Gloriastrasse 35
2232 8092 Zurich
2233 Switzerland
2235 Email: trammell@tik.ee.ethz.ch
2237 Saverio Niccolini
2238 NEC Laboratories Europe, NEC Europe Ltd.
2239 Kurfuersten-Anlage 36
2240 Heidelberg 69115
2241 Germany
2243 Phone: +49 (0) 6221 4342 118
2244 Email: niccolini@neclab.eu
2245 URI: http://www.neclab.eu
2247 Benoit Claise
2248 Cisco Systems Inc.
2249 De Kleetlaan 6a b1
2250 Diegem, 1813
2251 Belgium
2253 Phone: +32 2 704 5622
2254 Fax:
2255 Email: bclaise@cisco.com
2256 URI:
2258 Hadriel Kaplan
2259 Acme Packet
2260 71 Third Ave.
2261 Burlington, MA 01803
2262 USA
2264 Phone:
2265 Email: hkaplan@acmepacket.com