Internet Assigned Numbers Authority

IP Flow Information Export (IPFIX) Entities

Created
2007-05-10
Last Updated
2024-03-13
Note
[RFC7012] has obsoleted [RFC5102]. However, references to [RFC5102]
remain as part of the historical record.
Available Formats

XML

HTML

Plain text

Registries included below

IPFIX Information Elements

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7012]
Note
Values 0-127: NFv9-compatible
Note
The columns previously titled "References" and "Requester" have been 
renamed "Additional Information" and "Reference", respectively.
Available Formats

CSV
ElementID Name Abstract Data Type Data Type Semantics Status Description Units Range Additional Information Reference Revision Date
0 Reserved

[RFC5102] 2013-02-18
1 octetDeltaCount unsigned64 deltaCounter current

The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
2 packetDeltaCount unsigned64 deltaCounter current

The number of incoming packets since the previous report (if any) for this Flow at the Observation Point.

packets [RFC5102] 0 2013-02-18
3 deltaFlowCount unsigned64 deltaCounter current

The conservative count of Original Flows contributing to this Aggregated Flow; may be distributed via any of the methods expressed by the valueDistributionMethod Information Element.

flows [RFC7015] 1 2013-06-25
4 protocolIdentifier unsigned8 identifier current

The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.

In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet.

See [RFC791] for the specification of the IPv4 protocol field. See [RFC8200] for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at [https://www.iana.org/assignments/protocol-numbers].

[RFC5102] 0 2013-02-18
5 ipClassOfService unsigned8 identifier current

For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header.

See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.

[RFC5102] 0 2013-02-18
6 tcpControlBits unsigned16 flags current

TCP control bits observed for the packets of this Flow. This information is encoded as a bit field; each TCP control bit has a corresponding bit in that field. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. The bit is cleared to 0 otherwise.

Per [RFC9293], the assignment of TCP control bits is managed by IANA via the "TCP Header Flags" registry [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags]. Implementers can retrieve the current TCP control bits from that registry, which is authoritative for them.

As the most significant 4 bits of octets 12 and 13 (counting from zero) of the TCP header [RFC9293] are used to encode the TCP data offset (header length), the corresponding bits in this Information Element MUST be reported by the Exporter with a value of zero and MUST be ignored by the Collector. Use the tcpHeaderLength Information Element to encode this value.

All TCP control bits (including those unassigned) MUST be exported as observed in the TCP headers of the packets of this Flow.

If exported as a single octet with reduced-size encoding (Section 6.2 of [RFC7011]), this Information Element covers the low-order octet of this field (i.e., bit offset positions 8 to 15) [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags]. A Collector receiving this Information Element with reduced-size encoding must not assume anything about the content of the four bits with bit offset positions 4 to 7.

Exporting Processes exporting this Information Element on behalf of a Metering Process that is not capable of observing any of the flags with bit offset positions 4 to 7 SHOULD use reduced-size encoding, and only export the least significant 8 bits of this Information Element.

Note that previous revisions of this Information Element's definition specified that flags with bit offset positions 8 and 9 must be exported as zero, even if observed. Collectors should therefore not assume that a value of zero for these bits in this Information Element indicates the bits were never set in the observed traffic, especially if these bits are zero in every Flow Record sent by a given Exporter.

Note also that the "TCP Header Flags" registry [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags] indexes the bit offset from the most significant bit of octet 12 to the least significant bit of octet 13 in the TCP header, but the tcpControlBits is encoded as a regular unsigned 16-bit integer.

See the assigned TCP control bits in the "TCP Header Flags" registry [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags].

[RFC9293][RFC9565] 2 2024-01-29
7 sourceTransportPort unsigned16 identifier current

The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.

See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of SCTP.

Additional information on defined UDP and TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
8 sourceIPv4Address ipv4Address default current

The IPv4 source address in the IP packet header.

See [RFC791] for the definition of the IPv4 source address field.

[RFC5102] 1 2014-02-03
9 sourceIPv4PrefixLength unsigned8 current

The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element.

bits 0-32 [RFC5102] 0 2013-02-18
10 ingressInterface unsigned32 identifier current

The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as defined in [RFC2863]. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC2863].

See [RFC2863] for the definition of the ifIndex object.

[RFC5102] 0 2013-02-18
11 destinationTransportPort unsigned16 identifier current

The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers.

See [RFC768] for the definition of the UDP destination port field. See [RFC9293] for the definition of the TCP destination port field. See [RFC9260] for the definition of SCTP.

Additional information on defined UDP and TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
12 destinationIPv4Address ipv4Address default current

The IPv4 destination address in the IP packet header.

See [RFC791] for the definition of the IPv4 destination address field.

[RFC5102] 1 2014-02-03
13 destinationIPv4PrefixLength unsigned8 current

The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element.

bits 0-32 [RFC5102] 0 2013-02-18
14 egressInterface unsigned32 identifier current

The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as defined in [RFC2863]. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC2863].

See [RFC2863] for the definition of the ifIndex object.

[RFC5102] 0 2013-02-18
15 ipNextHopIPv4Address ipv4Address default current

The IPv4 address of the next IPv4 hop.

[RFC5102] 1 2014-02-03
16 bgpSourceAsNumber unsigned32 identifier current

The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.

See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.

[RFC5102] 0 2013-02-18
17 bgpDestinationAsNumber unsigned32 identifier current

The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.

See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.

[RFC5102] 0 2013-02-18
18 bgpNextHopIPv4Address ipv4Address default current

The IPv4 address of the next (adjacent) BGP hop.

See [RFC4271] for a description of BGP-4.

[RFC5102] 1 2014-02-03
19 postMCastPacketDeltaCount unsigned64 deltaCounter current

The number of outgoing multicast packets since the previous report (if any) sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means.

packets [RFC5102] 0 2013-02-18
20 postMCastOctetDeltaCount unsigned64 deltaCounter current

The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
21 flowEndSysUpTime unsigned32 current

The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.

milliseconds [RFC5102] 1 2014-01-11
22 flowStartSysUpTime unsigned32 current

The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.

milliseconds [RFC5102] 1 2014-01-11
23 postOctetDeltaCount unsigned64 deltaCounter current

The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

octets [RFC5102] 0 2013-02-18
24 postPacketDeltaCount unsigned64 deltaCounter current

The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

packets [RFC5102] 0 2013-02-18
25 minimumIpTotalLength unsigned64 current

Length of the smallest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length.

octets

See [RFC791] for the specification of the IPv4 total length. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.

[RFC5102] 0 2013-02-18
26 maximumIpTotalLength unsigned64 current

Length of the largest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length.

octets

See [RFC791] for the specification of the IPv4 total length. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.

[RFC5102] 0 2013-02-18
27 sourceIPv6Address ipv6Address default current

The IPv6 source address in the IP packet header.

See [RFC8200] for the definition of the Source Address field in the IPv6 header.

[RFC5102] 1 2014-02-03
28 destinationIPv6Address ipv6Address default current

The IPv6 destination address in the IP packet header.

See [RFC8200] for the definition of the Destination Address field in the IPv6 header.

[RFC5102] 1 2014-02-03
29 sourceIPv6PrefixLength unsigned8 current

The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element.

bits 0-128 [RFC5102] 0 2013-02-18
30 destinationIPv6PrefixLength unsigned8 current

The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element.

bits 0-128 [RFC5102] 0 2013-02-18
31 flowLabelIPv6 unsigned32 identifier current

The value of the IPv6 Flow Label field in the IP packet header.

0-0xFFFFF

See [RFC8200] for the definition of the Flow Label field in the IPv6 packet header.

[RFC5102] 1 2014-08-13
32 icmpTypeCodeIPv4 unsigned16 identifier current

Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.

See [RFC792] for the definition of the IPv4 ICMP type and code fields.

[RFC5102] 0 2013-02-18
33 igmpType unsigned8 identifier current

The type field of the IGMP message.

See [RFC3376] for the definition of the IGMP type field.

[RFC5102] 0 2013-02-18
34 samplingInterval unsigned32 quantity deprecated

Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled -- e.g., a value of 100 indicates that one of every 100 packets is sampled.

packets [RFC7270] 0 2014-04-04
35 samplingAlgorithm unsigned8 identifier deprecated

Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow:


1 - Deterministic Sampling,
2 - Random Sampling.

The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required; see [Packet Sampling (PSAMP) Parameters.]

[RFC7270] 0 2014-04-04
36 flowActiveTimeout unsigned16 current

The number of seconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets.

seconds [RFC5102] 0 2013-02-18
37 flowIdleTimeout unsigned16 current

A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field.

seconds [RFC5102] 0 2013-02-18
38 engineType unsigned8 identifier deprecated

Type of flow switching engine in a router/switch:

RP = 0,
VIP/Line card = 1,
PFC/DFC = 2.

Reserved for internal use on the Collector.

[RFC7270] 0 2014-04-04
39 engineId unsigned8 identifier deprecated

Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the Collector.

[RFC7270] 0 2014-04-04
40 exportedOctetTotalCount unsigned64 totalCounter current

The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX Messages that were successfully sent to the Collecting Process. The reported number excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process.

octets [RFC5102] 0 2013-02-18
41 exportedMessageTotalCount unsigned64 totalCounter current

The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process.

messages [RFC5102] 0 2013-02-18
42 exportedFlowRecordTotalCount unsigned64 totalCounter current

The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes Flow Records in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process.

flows [RFC5102] 0 2013-02-18
43 ipv4RouterSc ipv4Address default deprecated

This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching.

[CCO-MLS] describes MultiLayer Switching.

[RFC7270] 0 2014-04-04
44 sourceIPv4Prefix ipv4Address default current

IPv4 source address prefix.

[RFC5102] 0 2013-02-18
45 destinationIPv4Prefix ipv4Address default current

IPv4 destination address prefix.

[RFC5102] 0 2013-02-18
46 mplsTopLabelType unsigned8 identifier current

This field identifies the control protocol that allocated the top-of-stack label. Values for this field are listed in the MPLS label type registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-mpls-label-type]

See [RFC3031] for the MPLS label structure. See the list of MPLS label types assigned by IANA at [https://www.iana.org/assignments/mpls-label-values].

[RFC5102] 0 2013-02-18
47 mplsTopLabelIPv4Address ipv4Address default current

The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to.

See [RFC3031] for the association between MPLS labels and IP addresses.

[RFC5102] 1 2014-02-03
48 samplerId unsigned8 identifier deprecated

Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName.

[RFC7270] 0 2014-04-04
49 samplerMode unsigned8 identifier deprecated

Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 - Deterministic, 2 - Random Sampling. Use with samplerRandomInterval.

[RFC7270] 0 2014-04-04
50 samplerRandomInterval unsigned32 quantity deprecated

Deprecated in favor of 305 samplingPacketInterval. Packet interval at which to sample -- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value.

[RFC7270] 0 2014-04-04
51 classId unsigned8 identifier deprecated

Deprecated in favor of 302 selectorId. Characterizes the traffic class, i.e., QoS treatment.

[RFC7270] 0 2014-04-04
52 minimumTTL unsigned8 current

Minimum TTL value observed for any packet in this Flow.

hops

See [RFC791] for the definition of the IPv4 Time to Live field. See [RFC8200] for the definition of the IPv6 Hop Limit field.

[RFC5102] 0 2013-02-18
53 maximumTTL unsigned8 current

Maximum TTL value observed for any packet in this Flow.

hops

See [RFC791] for the definition of the IPv4 Time to Live field. See [RFC8200] for the definition of the IPv6 Hop Limit field.

[RFC5102] 0 2013-02-18
54 fragmentIdentification unsigned32 identifier current

The value of the Identification field in the IPv4 packet header or in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header.

See [RFC791] for the definition of the IPv4 Identification field. See [RFC8200] for the definition of the Identification field in the IPv6 Fragment header.

[RFC5102] 0 2013-02-18
55 postIpClassOfService unsigned8 identifier current

The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

See [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field. See [RFC3234] for the definition of middleboxes.

[RFC5102] 0 2013-02-18
56 sourceMacAddress macAddress default current

The IEEE 802 source MAC address field.

See IEEE.802-3.2002.

[RFC5102] 1 2014-02-03
57 postDestinationMacAddress macAddress default current

The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

See IEEE.802-3.2002.

[RFC5102] 1 2014-02-03
58 vlanId unsigned16 identifier current

Virtual LAN identifier associated with ingress interface. For dot1q vlans, see 243 dot1qVlanId.

See IEEE.802-1Q.2003.

[RFC5102] 0 2013-02-18
59 postVlanId unsigned16 identifier current

Virtual LAN identifier associated with egress interface. For postdot1q vlans, see 254, postDot1qVlanId.

See IEEE.802-1Q.2003.

[RFC5102] 0 2013-02-18
60 ipVersion unsigned8 identifier current

The IP version field in the IP packet header.

See [RFC791] for the definition of the version field in the IPv4 packet header. See [RFC8200] for the definition of the version field in the IPv6 packet header. Additional information on defined version numbers can be found at [https://www.iana.org/assignments/version-numbers].

[RFC5102] 0 2013-02-18
61 flowDirection unsigned8 identifier current

The direction of the Flow observed at the Observation Point. There are only two values defined.

0x00: ingress flow
0x01: egress flow
[RFC5102] 0 2013-02-18
62 ipNextHopIPv6Address ipv6Address default current

The IPv6 address of the next IPv6 hop.

[RFC5102] 1 2014-02-03
63 bgpNextHopIPv6Address ipv6Address default current

The IPv6 address of the next (adjacent) BGP hop.

See [RFC4271] for a description of BGP-4.

[RFC5102] 1 2014-02-03
64 ipv6ExtensionHeaders unsigned32 flags current

IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 option header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contained the respective IPv6 extension header, the value of the corresponding bit is 0.

        0     1     2     3     4     5     6     7
    +-----+-----+-----+-----+-----+-----+-----+-----+
    | DST | HOP | Res | UNK |FRA0 | RH  |FRA1 | Res |  ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

        8     9    10    11    12    13    14    15
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |           Reserved    | MOB | ESP | AH  | PAY | ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

       16    17    18    19    20    21    22    23
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |                  Reserved                     | ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

       24    25    26    27    28    29    30    31
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |                  Reserved                     |
    +-----+-----+-----+-----+-----+-----+-----+-----+

Bit    IPv6 Option   Description

0, DST      60       Destination option header
1, HOP       0       Hop-by-hop option header
2, Res               Reserved
3, UNK               Unknown Layer 4 header
                     (compressed, encrypted, not supported)
4, FRA0     44       Fragment header - first fragment
5, RH       43       Routing header
6, FRA1     44       Fragmentation header - not first fragment
7, Res               Reserved
8 to 11              Reserved
12, MOB     135      IPv6 mobility [RFC3775]
13, ESP      50      Encrypted security payload
14, AH       51      Authentication Header
15, PAY     108      Payload compression header
16 to 31             Reserved

See [RFC8200] for the general definition of IPv6 extension headers and for the specification of the hop-by-hop options header, the routing header, the fragment header, and the destination options header. See [RFC4302] for the specification of the authentication header. See [RFC4303] for the specification of the encapsulating security payload. The diagram provided in [RFC5102] is incorrect. The diagram in this registry is taken from Errata 1738. See [RFC Errata 1738].

[RFC5102] 0 2013-02-18
65-69 Assigned for NetFlow v9 compatibility

[RFC3954]

[RFC5102] 0 2013-02-18
70 mplsTopLabelStackSection octetArray default current

The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed.

The size of this Information Element is 3 octets.

 0                   1                   2
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                Label                  | Exp |S|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Label:  Label Value, 20 bits
Exp:    Experimental Use, 3 bits
S:      Bottom of Stack, 1 bit

See [RFC3032].

[RFC5102] 1 2014-02-03
71 mplsLabelStackSection2 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
72 mplsLabelStackSection3 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
73 mplsLabelStackSection4 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
74 mplsLabelStackSection5 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
75 mplsLabelStackSection6 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
76 mplsLabelStackSection7 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
77 mplsLabelStackSection8 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
78 mplsLabelStackSection9 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
79 mplsLabelStackSection10 octetArray default current

The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details.

The size of this Information Element is 3 octets.

See [RFC3032].

[RFC5102] 1 2014-02-03
80 destinationMacAddress macAddress default current

The IEEE 802 destination MAC address field.

See IEEE.802-3.2002.

[RFC5102] 1 2014-02-03
81 postSourceMacAddress macAddress default current

The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

See IEEE.802-3.2002.

[RFC5102] 1 2014-02-03
82 interfaceName string default current

A short name uniquely describing an interface, eg "Eth1/0".

See [RFC2863] for the definition of the ifName object.

[ipfix-iana_at_cisco.com] 0 2013-02-18
83 interfaceDescription string default current

The description of an interface, eg "FastEthernet 1/0" or "ISP connection".

See [RFC2863] for the definition of the ifDescr object.

[ipfix-iana_at_cisco.com] 0 2013-02-18
84 samplerName string deprecated

Deprecated in favor of 335 selectorName. Name of the flow sampler.

[RFC7270] 0 2014-04-04
85 octetTotalCount unsigned64 totalCounter current

The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
86 packetTotalCount unsigned64 totalCounter current

The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

packets [RFC5102] 0 2013-02-18
87 flagsAndSamplerId unsigned32 identifier deprecated

Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on the Collector.

[RFC7270] 0 2014-04-04
88 fragmentOffset unsigned16 quantity current

The value of the IP fragment offset field in the IPv4 packet header or the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header.

0-0x1FFF

See [RFC791] for the specification of the fragment offset in the IPv4 header. See [RFC8200] for the specification of the fragment offset in the IPv6 Fragment header.

[RFC5102] 1 2014-08-13
89 forwardingStatus unsigned8 identifier current

This Information Element describes the forwarding status of the flow and any attached reasons.

The layout of the encoding is as follows:

MSB  -  0   1   2   3   4   5   6   7  -  LSB
      +---+---+---+---+---+---+---+---+
      | Status|  Reason code or flags |
      +---+---+---+---+---+---+---+---+

See the Forwarding Status sub-registries at [https://www.iana.org/assignments/ipfix/ipfix.xhtml#forwarding-status].

Examples:

value : 0x40 = 64
binary: 01000000
decode: 01        -> Forward
          000000  -> No further information

value : 0x89 = 137
binary: 10001001
decode: 10        -> Drop
          001001  -> Bad TTL

See "NetFlow Version 9 Flow-Record Format" [CCO-NF9FMT].

[RFC7270][RFC Errata 5262] 2 2018-02-21
90 mplsVpnRouteDistinguisher octetArray default current

The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to [RFC4364], the size of mplsVpnRouteDistinguisher is 8 octets. However, in [RFC4382] an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets.

See [RFC4364] for the specification of the route distinguisher. See [RFC4382] for the specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN) Management Information Base.

[RFC5102] 1 2014-02-03
91 mplsTopLabelPrefixLength unsigned8 quantity current

The prefix length of the subnet of the mplsTopLabelIPv4Address that the MPLS top label will cause the Flow to be forwarded to.

bits 0-32

See [RFC3031] for the association between MPLS labels and prefix lengths.

[ipfix-iana_at_cisco.com] 1 2014-08-13
92 srcTrafficIndex unsigned32 identifier current

BGP Policy Accounting Source Traffic Index.

BGP policy accounting as described in [CCO-BGPPOL].

[RFC7270] 0 2014-04-04
93 dstTrafficIndex unsigned32 identifier current

BGP Policy Accounting Destination Traffic Index.

BGP policy accounting as described in [CCO-BGPPOL].

[RFC7270] 0 2014-04-04
94 applicationDescription string default current

Specifies the description of an application.

[RFC6759] 1 2014-02-03
95 applicationId octetArray default current

Specifies an Application ID per [RFC6759].

See section 4 of [RFC6759] for the applicationId Information Element Specification.

[RFC6759] 1 2014-02-03
96 applicationName string default current

Specifies the name of an application.

[RFC6759] 0 2013-02-18
97 Assigned for NetFlow v9 compatibility

[RFC3954]

[RFC5102] 0 2013-02-18
98 postIpDiffServCodePoint unsigned8 identifier current

The definition of this Information Element is identical to the definition of Information Element 'ipDiffServCodePoint', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

0-63

See [RFC3260] for the definition of the Differentiated Services Field. See section 5.3.2 of [RFC1812] and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field. See the IPFIX Information Model [RFC5102] for the 'ipDiffServCodePoint' specification.

[ipfix-iana_at_cisco.com] 0 2013-02-18
99 multicastReplicationFactor unsigned32 quantity current

The amount of multicast replication that's applied to a traffic stream.

See [RFC1112] for the specification of reserved IPv4 multicast addresses. See [RFC4291] for the specification of reserved IPv6 multicast addresses.

[ipfix-iana_at_cisco.com] 0 2013-02-18
100 className string deprecated

Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element.

[RFC7270] 0 2014-04-04
101 classificationEngineId unsigned8 identifier current

A unique identifier for the engine that determined the Selector ID. Thus, the Classification Engine ID defines the context for the Selector ID. The Classification Engine can be considered a specific registry for application assignments.

Values for this field are listed in the Classification Engine IDs registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#classification-engine-ids]

[RFC6759] 0 2013-02-18
102 layer2packetSectionOffset unsigned16 quantity deprecated

Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset.

[RFC7270] 0 2014-04-04
103 layer2packetSectionSize unsigned16 quantity deprecated

Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size.

[RFC7270] 0 2014-04-04
104 layer2packetSectionData octetArray deprecated

Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data.

[RFC7270] 0 2014-04-04
105-127 Assigned for NetFlow v9 compatibility

[RFC3954]

[RFC5102] 0 2013-02-18
128 bgpNextAdjacentAsNumber unsigned32 identifier current

The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.

See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.

[RFC5102] 0 2013-02-18
129 bgpPrevAdjacentAsNumber unsigned32 identifier current

The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value.

See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.

[RFC5102] 0 2013-02-18
130 exporterIPv4Address ipv4Address default current

The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.

[RFC5102] 1 2014-02-03
131 exporterIPv6Address ipv6Address default current

The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.

[RFC5102] 1 2014-02-03
132 droppedOctetDeltaCount unsigned64 deltaCounter current

The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
133 droppedPacketDeltaCount unsigned64 deltaCounter current

The number of packets since the previous report (if any) of this Flow dropped by packet treatment.

packets [RFC5102] 0 2013-02-18
134 droppedOctetTotalCount unsigned64 totalCounter current

The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
135 droppedPacketTotalCount unsigned64 totalCounter current

The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.

packets [RFC5102] 0 2013-02-18
136 flowEndReason unsigned8 identifier current

The reason for Flow termination. Values are listed in the flowEndReason registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flow-end-reason].

[RFC5102] 0 2013-02-18
137 commonPropertiesId unsigned64 identifier current

An identifier of a set of common properties that is unique per Observation Domain and Transport Session. Typically, this Information Element is used to link to information reported in separate Data Records.

[RFC5102] 0 2013-02-18
138 observationPointId unsigned64 identifier current

An identifier of an Observation Point that is unique per Observation Domain. It is RECOMMENDED that this identifier is also unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements.

[RFC5102][ipfix-iana_at_cisco.com] 1 2013-04-11
139 icmpTypeCodeIPv6 unsigned16 identifier current

Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.

See [RFC4443] for the definition of the IPv6 ICMP type and code fields.

[RFC5102] 0 2013-02-18
140 mplsTopLabelIPv6Address ipv6Address default current

The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to.

See [RFC3031] for the association between MPLS labels and IP addresses.

[RFC5102] 1 2014-02-03
141 lineCardId unsigned32 identifier current

An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements.

[RFC5102] 0 2013-02-18
142 portId unsigned32 identifier current

An identifier of a line port that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements.

[RFC5102] 0 2013-02-18
143 meteringProcessId unsigned32 identifier current

An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Metering Process may be re-started with a different ID.

[RFC5102] 0 2013-02-18
144 exportingProcessId unsigned32 identifier current

An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Exporting Process may be re-started with a different ID.

[RFC5102] 0 2013-02-18
145 templateId unsigned16 identifier current

An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain.

Template IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created. Template IDs of Data Sets are numbered from 256 to 65535.

Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned.

[RFC5102] 0 2013-02-18
146 wlanChannelId unsigned8 identifier current

The identifier of the 802.11 (Wi-Fi) channel used.

See IEEE.802-11.1999.

[RFC5102] 0 2013-02-18
147 wlanSSID string default current

The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used. According to IEEE.802-11.1999, the SSID is encoded into a string of up to 32 characters.

See IEEE.802-11.1999.

[RFC5102] 0 2013-02-18
148 flowId unsigned64 identifier current

An identifier of a Flow that is unique within an Observation Domain. This Information Element can be used to distinguish between different Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records.

[RFC5102] 0 2013-02-18
149 observationDomainId unsigned32 identifier current

An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device.

A value of 0 indicates that no specific Observation Domain is identified by this Information Element.

Typically, this Information Element is used for limiting the scope of other Information Elements.

[RFC5102] 0 2013-02-18
150 flowStartSeconds dateTimeSeconds default current

The absolute timestamp of the first packet of this Flow.

seconds [RFC5102] 0 2013-02-18
151 flowEndSeconds dateTimeSeconds default current

The absolute timestamp of the last packet of this Flow.

seconds [RFC5102] 0 2013-02-18
152 flowStartMilliseconds dateTimeMilliseconds default current

The absolute timestamp of the first packet of this Flow.

milliseconds [RFC5102] 0 2013-02-18
153 flowEndMilliseconds dateTimeMilliseconds default current

The absolute timestamp of the last packet of this Flow.

milliseconds [RFC5102] 0 2013-02-18
154 flowStartMicroseconds dateTimeMicroseconds default current

The absolute timestamp of the first packet of this Flow.

microseconds [RFC5102] 0 2013-02-18
155 flowEndMicroseconds dateTimeMicroseconds default current

The absolute timestamp of the last packet of this Flow.

microseconds [RFC5102] 0 2013-02-18
156 flowStartNanoseconds dateTimeNanoseconds default current

The absolute timestamp of the first packet of this Flow.

nanoseconds [RFC5102] 0 2013-02-18
157 flowEndNanoseconds dateTimeNanoseconds default current

The absolute timestamp of the last packet of this Flow.

nanoseconds [RFC5102] 0 2013-02-18
158 flowStartDeltaMicroseconds unsigned32 current

This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the first observed packet of this Flow relative to the export time specified in the IPFIX Message Header.

microseconds

See the [IPFIX protocol specification] for the definition of the IPFIX Message Header.

[RFC5102] 0 2013-02-18
159 flowEndDeltaMicroseconds unsigned32 current

This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the last observed packet of this Flow relative to the export time specified in the IPFIX Message Header.

microseconds

See the [IPFIX protocol specification] for the definition of the IPFIX Message Header.

[RFC5102] 0 2013-02-18
160 systemInitTimeMilliseconds dateTimeMilliseconds default current

The absolute timestamp of the last (re-)initialization of the IPFIX Device.

milliseconds [RFC5102] 0 2013-02-18
161 flowDurationMilliseconds unsigned32 current

The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.

milliseconds [RFC5102] 0 2013-02-18
162 flowDurationMicroseconds unsigned32 current

The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.

microseconds [RFC5102] 0 2013-02-18
163 observedFlowTotalCount unsigned64 totalCounter current

The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point.

flows [RFC5102] 0 2013-02-18
164 ignoredPacketTotalCount unsigned64 totalCounter current

The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process.

packets [RFC5102] 0 2013-02-18
165 ignoredOctetTotalCount unsigned64 totalCounter current

The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process.

octets [RFC5102] 0 2013-02-18
166 notSentFlowTotalCount unsigned64 totalCounter current

The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.

flows [RFC5102] 0 2013-02-18
167 notSentPacketTotalCount unsigned64 totalCounter current

The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.

packets [RFC5102] 0 2013-02-18
168 notSentOctetTotalCount unsigned64 totalCounter current

The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.

octets [RFC5102] 0 2013-02-18
169 destinationIPv6Prefix ipv6Address default current

IPv6 destination address prefix.

[RFC5102] 0 2013-02-18
170 sourceIPv6Prefix ipv6Address default current

IPv6 source address prefix.

[RFC5102] 0 2013-02-18
171 postOctetTotalCount unsigned64 totalCounter current

The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

octets [RFC5102] 0 2013-02-18
172 postPacketTotalCount unsigned64 totalCounter current

The definition of this Information Element is identical to the definition of Information Element 'packetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

packets [RFC5102] 0 2013-02-18
173 flowKeyIndicator unsigned64 flags current

This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record, with the n-th least significant bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that this is not the case.

If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0.

[RFC5102][RFC Errata 4984] 1 2017-08-01
174 postMCastPacketTotalCount unsigned64 totalCounter current

The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means.

packets [RFC5102] 0 2013-02-18
175 postMCastOctetTotalCount unsigned64 totalCounter current

The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
176 icmpTypeIPv4 unsigned8 identifier current

Type of the IPv4 ICMP message.

See [RFC792] for the definition of the IPv4 ICMP type field.

[RFC5102] 0 2013-02-18
177 icmpCodeIPv4 unsigned8 identifier current

Code of the IPv4 ICMP message.

See [RFC792] for the definition of the IPv4 ICMP code field.

[RFC5102] 0 2013-02-18
178 icmpTypeIPv6 unsigned8 identifier current

Type of the IPv6 ICMP message.

See [RFC4443] for the definition of the IPv6 ICMP type field.

[RFC5102] 0 2013-02-18
179 icmpCodeIPv6 unsigned8 identifier current

Code of the IPv6 ICMP message.

See [RFC4443] for the definition of the IPv6 ICMP code field.

[RFC5102] 0 2013-02-18
180 udpSourcePort unsigned16 identifier current

The source port identifier in the UDP header.

See [RFC768] for the definition of the UDP source port field. Additional information on defined UDP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
181 udpDestinationPort unsigned16 identifier current

The destination port identifier in the UDP header.

See [RFC768] for the definition of the UDP destination port field. Additional information on defined UDP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
182 tcpSourcePort unsigned16 identifier current

The source port identifier in the TCP header.

See [RFC9293] for the definition of the TCP source port field. Additional information on defined TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
183 tcpDestinationPort unsigned16 identifier current

The destination port identifier in the TCP header.

See [RFC9293] for the definition of the TCP destination port field. Additional information on defined TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
184 tcpSequenceNumber unsigned32 current

The sequence number in the TCP header.

See [RFC9293] for the definition of the TCP sequence number.

[RFC5102] 0 2013-02-18
185 tcpAcknowledgementNumber unsigned32 current

The acknowledgement number in the TCP header.

See [RFC9293] for the definition of the TCP acknowledgement number.

[RFC5102] 0 2013-02-18
186 tcpWindowSize unsigned16 current

The window field in the TCP header. If the TCP window scale is supported, then TCP window scale must be known to fully interpret the value of this information.

See [RFC9293] for the definition of the TCP window field. See [RFC1323] for the definition of the TCP window scale.

[RFC5102] 0 2013-02-18
187 tcpUrgentPointer unsigned16 current

The urgent pointer in the TCP header.

See [RFC9293] for the definition of the TCP urgent pointer.

[RFC5102] 0 2013-02-18
188 tcpHeaderLength unsigned8 current

The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the TCP header. The Data Offset field indicates the length of the TCP header in units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets.

octets

See [RFC9293] for the definition of the TCP header.

[RFC5102] 0 2013-02-18
189 ipHeaderLength unsigned8 current

The length of the IP header. For IPv6, the value of this Information Element is 40.

octets

See [RFC791] for the definition of the IPv4 header. See [RFC8200] for the definition of the IPv6 header.

[RFC5102] 0 2013-02-18
190 totalLengthIPv4 unsigned16 current

The total length of the IPv4 packet.

octets

See [RFC791] for the specification of the IPv4 total length.

[RFC5102] 0 2013-02-18
191 payloadLengthIPv6 unsigned16 current

This Information Element reports the value of the Payload Length field in the IPv6 header. Note that IPv6 extension headers belong to the payload. Also note that in case of a jumbo payload option the value of the Payload Length field in the IPv6 header is zero and so will be the value reported by this Information Element.

octets

See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload option.

[RFC5102] 0 2013-02-18
192 ipTTL unsigned8 current

For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value of the Information Element matches the value of the Hop Limit field in the IPv6 packet header.

hops

See [RFC791] for the definition of the IPv4 Time to Live field. See [RFC2675] for the definition of the IPv6 Hop Limit field.

[RFC5102] 0 2013-02-18
193 nextHeaderIPv6 unsigned8 current

The value of the Next Header field of the IPv6 header. The value identifies the type of the following IPv6 extension header or of the following IP payload. Valid values are defined in the IANA Protocol Numbers registry.

See [RFC8200] for the definition of the IPv6 Next Header field. See the list of protocol numbers assigned by IANA at [https://www.iana.org/assignments/protocol-numbers].

[RFC5102] 0 2013-02-18
194 mplsPayloadLength unsigned32 current

The size of the MPLS packet without the label stack.

octets

See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack.

[RFC5102] 0 2013-02-18
195 ipDiffServCodePoint unsigned8 identifier current

The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field spans the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively.

This Information Element encodes only the 6 bits of the Differentiated Services field. Therefore, its value may range from 0 to 63.

0-63

See [RFC3260] for the definition of the Differentiated Services field. See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.

[RFC5102] 0 2013-02-18
196 ipPrecedence unsigned8 identifier current

The value of the IP Precedence. The IP Precedence value is encoded in the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively.

This Information Element encodes only these 3 bits. Therefore, its value may range from 0 to 7.

0-7

See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of the IP Precedence. See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.

[RFC5102] 0 2013-02-18
197 fragmentFlags unsigned8 flags current

Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively.


Bit 0:    (RS) Reserved.
          The value of this bit MUST be 0 until specified
          otherwise.

Bit 1:    (DF) 0 = May Fragment,  1 = Don't Fragment.
          Corresponds to the value of the DF flag in the
          IPv4 header.  Will always be 0 for IPv6 unless
          a "don't fragment" feature is introduced to IPv6.

Bit 2:    (MF) 0 = Last Fragment, 1 = More Fragments.
          Corresponds to the MF flag in the IPv4 header
          or to the M flag in the IPv6 Fragment header,
          respectively.  The value is 0 for IPv6 if there
          is no fragment header.

Bits 3-7: (DC) Don't Care.
          The values of these bits are irrelevant.

     0   1   2   3   4   5   6   7
   +---+---+---+---+---+---+---+---+
   | R | D | M | D | D | D | D | D |
   | S | F | F | C | C | C | C | C |
   +---+---+---+---+---+---+---+---+

See [RFC791] for the specification of the IPv4 fragment flags. See [RFC8200] for the specification of the IPv6 Fragment header.

[RFC5102] 0 2013-02-18
198 octetDeltaSumOfSquares unsigned64 current

The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.

[RFC5102] 0 2013-02-18
199 octetTotalSumOfSquares unsigned64 current

The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.

octets [RFC5102] 0 2013-02-18
200 mplsTopLabelTTL unsigned8 current

The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed.

hops

See [RFC3032] for the specification of the TTL field.

[RFC5102] 0 2013-02-18
201 mplsLabelStackLength unsigned32 current

The length of the MPLS label stack in units of octets.

octets

See [RFC3032] for the specification of the MPLS label stack.

[RFC5102] 0 2013-02-18
202 mplsLabelStackDepth unsigned32 current

The number of labels in the MPLS label stack.

entries

See [RFC3032] for the specification of the MPLS label stack.

[RFC5102] 0 2013-02-18
203 mplsTopLabelExp unsigned8 flags current

The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed.

Bits 0-4:  Don't Care, value is irrelevant.
Bits 5-7:  MPLS Exp field.

     0   1   2   3   4   5   6   7
   +---+---+---+---+---+---+---+---+
   |     don't care    |    Exp    |
   +---+---+---+---+---+---+---+---+

See [RFC3032] for the specification of the Exp field. See [RFC3270] for usage of the Exp field.

[RFC5102] 0 2013-02-18
204 ipPayloadLength unsigned32 current

The effective length of the IP payload.

For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by Information Element totalLengthIPv4) and the length of the IPv4 header (as reported by Information Element headerLengthIPv4).

For IPv6, the value of the Payload Length field in the IPv6 header is reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported.

octets

See [RFC791] for the specification of IPv4 packets. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.

[RFC5102] 0 2013-02-18
205 udpMessageLength unsigned16 current

The value of the Length field in the UDP header.

octets

See [RFC768] for the specification of the UDP header.

[RFC5102] 0 2013-02-18
206 isMulticast unsigned8 flags current

If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero.

The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0.

The second and third bits of this octet are reserved for future use.

The remaining bits of the octet are only set to values other than zero if the IP Destination Address is a reserved IPv6 multicast address. Then the fourth bit of the octet is set to the value of the T flag in the IPv6 multicast address and the remaining four bits are set to the value of the scope field in the IPv6 multicast address.

      0      1      2      3      4      5      6      7
   +------+------+------+------+------+------+------+------+
   |   IPv6 multicast scope    |  T   | RES. | RES. | MCv4 |
   +------+------+------+------+------+------+------+------+

   Bits 0-3:  set to value of multicast scope if IPv6 multicast
   Bit  4:    set to value of T flag, if IPv6 multicast
   Bits 5-6:  reserved for future use
   Bit  7:    set to 1 if IPv4 multicast

See [RFC1112] for the specification of reserved IPv4 multicast addresses. See [RFC4291] for the specification of reserved IPv6 multicast addresses and the definition of the T flag and the IPv6 multicast scope. The diagram provided in [RFC5102] is incorrect. The diagram in this registry is taken from Errata 1736. See [RFC Errata 1736].

[RFC5102] 0 2013-02-18
207 ipv4IHL unsigned8 current

The value of the Internet Header Length (IHL) field in the IPv4 header. It specifies the length of the header in units of 4 octets. Please note that its unit is different from most of the other Information Elements reporting length values.

4-octet words

See [RFC791] for the specification of the IPv4 header.

[RFC5102] 0 2013-02-18
208 ipv4Options unsigned32 flags current

IPv4 options in packets of this Flow. The information is encoded in a set of bit fields. For each valid IPv4 option type, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv4 option type. Otherwise, if no observed packet of this Flow contained the respective IPv4 option type, the value of the corresponding bit is 0.

The list of valid IPv4 options is maintained by IANA. Note that for identifying an option not just the 5-bit Option Number, but all 8 bits of the Option Type need to match one of the IPv4 options specified at http://www.iana.org/assignments/ip-parameters.

Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. The mapping is illustrated by the figure below.

        0      1      2      3      4      5      6      7
    +------+------+------+------+------+------+------+------+
... |  RR  |CIPSO |E-SEC |  TS  | LSR  |  SEC | NOP  | EOOL |
    +------+------+------+------+------+------+------+------+

        8      9     10     11     12     13     14     15
    +------+------+------+------+------+------+------+------+
... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU  | SSR  | SID  | ...
    +------+------+------+------+------+------+------+------+

       16     17     18     19     20     21     22     23
    +------+------+------+------+------+------+------+------+
... | DPS  |NSAPA | SDB  |RTRALT|ADDEXT|  TR  | EIP  |IMITD | ...
    +------+------+------+------+------+------+------+------+

       24     25     26     27     28     29     30     31
    +------+------+------+------+------+------+------+------+
... |      | EXP  |   to be assigned by IANA  |  QS  | UMP  |
    +------+------+------+------+------+------+------+------+

       Type   Option
   Bit Value  Name    Reference
   ---+-----+-------+------------------------------------
   0      7   RR      Record Route, RFC 791
   1    134   CIPSO   Commercial Security
   2    133   E-SEC   Extended Security, RFC 1108
   3     68   TS      Time Stamp, RFC 791
   4    131   LSR     Loose Source Route, RFC791
   5    130   SEC     Security, RFC 1108
   6      1   NOP     No Operation, RFC 791
   7      0   EOOL    End of Options List, RFC 791
   8     15   ENCODE
   9    142   VISA    Experimental Access Control
   10   205   FINN    Experimental Flow Control
   11    12   MTUR    (obsoleted) MTU Reply, RFC 1191
   12    11   MTUP    (obsoleted) MTU Probe, RFC 1191
   13    10   ZSU     Experimental Measurement
   14   137   SSR     Strict Source Route, RFC 791
   15   136   SID     Stream ID, RFC 791
   16   151   DPS     Dynamic Packet State
   17   150   NSAPA   NSAP Address
   18   149   SDB     Selective Directed Broadcast
   19   147   ADDEXT  Address Extension
   20   148   RTRALT  Router Alert, RFC 2113
   21    82   TR      Traceroute, RFC 3193
   22   145   EIP     Extended Internet Protocol, RFC 1385
   23   144   IMITD   IMI Traffic Descriptor
   25    30   EXP     RFC3692-style Experiment
   25    94   EXP     RFC3692-style Experiment
   25   158   EXP     RFC3692-style Experiment
   25   222   EXP     RFC3692-style Experiment
   30    25   QS      Quick-Start
   31   152   UMP     Upstream Multicast Pkt.
   ...  ...   ...     Further options numbers
                      may be assigned by IANA

See [RFC791] for the definition of IPv4 options. See the list of IPv4 option numbers assigned by IANA at [https://www.iana.org/assignments/ip-parameters]. The diagram provided in [RFC5102] is incorrect. The diagram in this registry is taken from Errata 1737. See [RFC Errata 1737] .

[RFC5102] 0 2013-02-18
209 tcpOptions unsigned64 flags current

TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0.

Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. TCP option numbers are maintained by IANA.

        0     1     2     3     4     5     6     7
    +-----+-----+-----+-----+-----+-----+-----+-----+
    |   7 |   6 |   5 |   4 |   3 |   2 |   1 |   0 |  ...
    +-----+-----+-----+-----+-----+-----+-----+-----+

        8     9    10    11    12    13    14    15
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |  15 |  14 |  13 |  12 |  11 |  10 |   9 |   8 |...
    +-----+-----+-----+-----+-----+-----+-----+-----+

       16    17    18    19    20    21    22    23
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |  23 |  22 |  21 |  20 |  19 |  18 |  17 |  16 |...
    +-----+-----+-----+-----+-----+-----+-----+-----+

                          . . .

       56    57    58    59    60    61    62    63
    +-----+-----+-----+-----+-----+-----+-----+-----+
... |  63 |  62 |  61 |  60 |  59 |  58 |  57 |  56 |
    +-----+-----+-----+-----+-----+-----+-----+-----+

See [RFC9293] for the definition of TCP options. See the list of TCP option numbers assigned by IANA at [https://www.iana.org/assignments/tcp-parameters]. The diagram provided in [RFC5102] is incorrect. The diagram in this registry is taken from Errata 1739. See [RFC Errata 1739].

[RFC5102] 0 2013-02-18
210 paddingOctets octetArray default current

The value of this Information Element is always a sequence of 0x00 values.

[RFC5102] 0 2013-02-18
211 collectorIPv4Address ipv4Address default current

An IPv4 address to which the Exporting Process sends Flow information.

[RFC5102] 1 2014-02-03
212 collectorIPv6Address ipv6Address default current

An IPv6 address to which the Exporting Process sends Flow information.

[RFC5102] 1 2014-02-03
213 exportInterface unsigned32 identifier current

The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value matches the value of managed object 'ifIndex' as defined in [RFC2863]. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC2863].

See [RFC2863] for the definition of the ifIndex object.

[RFC5102] 0 2013-02-18
214 exportProtocolVersion unsigned8 identifier current

The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the Version Number field in the Message Header.

The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A value of 0 indicates that no export protocol is in use.

See the [IPFIX protocol specification] for the definition of the IPFIX Message Header. See [RFC3954] for the definition of the NetFlow version 9 message header.

[RFC5102] 0 2013-02-18
215 exportTransportProtocol unsigned8 identifier current

The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry.

In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet.

See [RFC791] for the specification of the IPv4 protocol field. See [RFC8200] for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at [https://www.iana.org/assignments/protocol-numbers].

[RFC5102] 0 2013-02-18
216 collectorTransportPort unsigned16 identifier current

The destination port identifier to which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the destination port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.

See [RFC768] for the definition of the UDP destination port field. See [RFC9293] for the definition of the TCP destination port field. See [RFC9260] for the definition of SCTP.

Additional information on defined UDP and TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
217 exporterTransportPort unsigned16 identifier current

The source port identifier from which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the source port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. This field may be useful for distinguishing multiple Exporting Processes that use the same IP address.

See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of SCTP.

Additional information on defined UDP and TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[RFC5102] 0 2013-02-18
218 tcpSynTotalCount unsigned64 totalCounter current

The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set.

packets

See [RFC9293] for the definition of the TCP SYN flag.

[RFC5102] 0 2013-02-18
219 tcpFinTotalCount unsigned64 totalCounter current

The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set.

packets

See [RFC9293] for the definition of the TCP FIN flag.

[RFC5102] 0 2013-02-18
220 tcpRstTotalCount unsigned64 totalCounter current

The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set.

packets

See [RFC9293] for the definition of the TCP RST flag.

[RFC5102] 0 2013-02-18
221 tcpPshTotalCount unsigned64 totalCounter current

The total number of packets of this Flow with TCP "Push Function" (PSH) flag set.

packets

See [RFC9293] for the definition of the TCP PSH flag.

[RFC5102] 0 2013-02-18
222 tcpAckTotalCount unsigned64 totalCounter current

The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set.

packets

See [RFC9293] for the definition of the TCP ACK flag.

[RFC5102] 0 2013-02-18
223 tcpUrgTotalCount unsigned64 totalCounter current

The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set.

packets

See [RFC9293] for the definition of the TCP URG flag.

[RFC5102] 0 2013-02-18
224 ipTotalLength unsigned64 current

The total length of the IP packet.

octets

See [RFC791] for the specification of the IPv4 total length. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.

[RFC5102] 0 2013-02-18
225 postNATSourceIPv4Address ipv4Address default current

The definition of this Information Element is identical to the definition of Information Element 'sourceIPv4Address', except that it reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point.

See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[ipfix-iana_at_cisco.com] 1 2014-02-03
226 postNATDestinationIPv4Address ipv4Address default current

The definition of this Information Element is identical to the definition of Information Element 'destinationIPv4Address', except that it reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point.

See [RFC791] for the definition of the IPv4 destination address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[ipfix-iana_at_cisco.com] 1 2014-02-03
227 postNAPTSourceTransportPort unsigned16 identifier current

The definition of this Information Element is identical to the definition of Information Element 'sourceTransportPort', except that it reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point.

See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of SCTP. See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers.

[ipfix-iana_at_cisco.com] 0 2013-02-18
228 postNAPTDestinationTransportPort unsigned16 identifier current

The definition of this Information Element is identical to the definition of Information Element 'destinationTransportPort', except that it reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point.

See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of SCTP. See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes. Additional information on defined UDP and TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[ipfix-iana_at_cisco.com] 0 2013-02-18
229 natOriginatingAddressRealm unsigned8 identifier current

Indicates whether the session was created because traffic originated in the private or public address realm. postNATSourceIPv4Address, postNATDestinationIPv4Address, postNAPTSourceTransportPort, and postNAPTDestinationTransportPort are qualified with the address realm in perspective.

Values are listed in the natOriginatingAddressRealm registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-originating-address-realm].

1-2

See [RFC3022] for the definition of NAT.

[ipfix-iana_at_cisco.com] 1 2014-08-13
230 natEvent unsigned8 identifier current

This Information Element identifies a NAT event. This IE identifies the type of a NAT event. Examples of NAT events include, but are not limited to, NAT translation create, NAT translation delete, Threshold Reached, or Threshold Exceeded, etc. Values for this Information Element are listed in the "NAT Event Type" registry, see [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-event-type].

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes. See [RFC8158] for the definitions of values 4-16.

[RFC8158] 2 2017-03-15
231 initiatorOctets unsigned64 deltaCounter current

The total number of layer 4 payload bytes in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session.

octets

See #298, initiatorPackets.

[ipfix-iana_at_cisco.com] 1 2014-08-13
232 responderOctets unsigned64 deltaCounter current

The total number of layer 4 payload bytes in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session.

octets

See #299, responderPackets.

[ipfix-iana_at_cisco.com] 1 2014-08-13
233 firewallEvent unsigned8 current

Indicates a firewall event. Allowed values are listed in the firewallEvent registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-firewall-event].

[ipfix-iana_at_cisco.com] 0 2013-02-18
234 ingressVRFID unsigned32 current

An unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per Metering Process

[ipfix-iana_at_cisco.com] 0 2013-02-18
235 egressVRFID unsigned32 current

An unique identifier of the VRFname where the packets of this flow are being sent. This identifier is unique per Metering Process

[ipfix-iana_at_cisco.com] 0 2013-02-18
236 VRFname string default current

The name of a VPN Routing and Forwarding table (VRF).

See [RFC4364] for the definition of VRF.

[ipfix-iana_at_cisco.com] 0 2013-02-18
237 postMplsTopLabelExp unsigned8 flags current

The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

See [RFC3032] for the specification of the Exp field. See [RFC3270] for usage of the Exp field.

[RFC5102] 0 2013-02-18
238 tcpWindowScale unsigned16 current

The scale of the window field in the TCP header.

See [RFC1323] for the definition of the TCP window scale.

[RFC5102] 0 2013-02-18
239 biflowDirection unsigned8 identifier current

A description of the direction assignment method used to assign the Biflow Source and Destination. This Information Element MAY be present in a Flow Data Record, or applied to all flows exported from an Exporting Process or Observation Domain using IPFIX Options. If this Information Element is not present in a Flow Record or associated with a Biflow via scope, it is assumed that the configuration of the direction assignment method is done out-of-band. Note that when using IPFIX Options to apply this Information Element to all flows within an Observation Domain or from an Exporting Process, the Option SHOULD be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information Element SHOULD appear in each Flow Record. Values are listed in the biflowDirection registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-biflow-direction].

[RFC5103] 0 2013-02-18
240 ethernetHeaderLength unsigned8 quantity current

The difference between the length of an Ethernet frame (minus the FCS) and the length of its MAC Client Data section (including any padding) as defined in section 3.1 of [IEEE.802-3.2005]. It does not include the Preamble, SFD and Extension field lengths.

octets

[IEEE.802-3.2005]

[ipfix-iana_at_cisco.com] 1 2014-08-13
241 ethernetPayloadLength unsigned16 quantity current

The length of the MAC Client Data section (including any padding) of a frame as defined in section 3.1 of [IEEE.802-3.2005].

octets

[IEEE.802-3.2005]

[ipfix-iana_at_cisco.com] 1 2014-08-13
242 ethernetTotalLength unsigned16 quantity current

The total length of the Ethernet frame (excluding the Preamble, SFD, Extension and FCS fields) as described in section 3.1 of [IEEE.802-3.2005].

octets

[IEEE.802-3.2005]

[ipfix-iana_at_cisco.com] 1 2014-08-13
243 dot1qVlanId unsigned16 identifier current

The value of the 12-bit VLAN Identifier portion of the Tag Control Information field of an Ethernet frame. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q]. In Provider Bridged Networks, it represents the Service VLAN identifier in the Service VLAN Tag (S-TAG) Tag Control Information (TCI) field or the Customer VLAN identifier in the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q]. In Provider Backbone Bridged Networks, it represents the Backbone VLAN identifier in the Backbone VLAN Tag (B-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q]. In a virtual link between a host system and EVB bridge, it represents the Service VLAN identifier indicating S-channel as described in [IEEE802.1Qbg].

In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG.

[IEEE802.1Q][IEEE802.1Qbg]

[ipfix-iana_at_cisco.com][RFC7133] 2 2014-01-11
244 dot1qPriority unsigned8 identifier current

The value of the 3-bit User Priority portion of the Tag Control Information field of an Ethernet frame. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q]. In the case of multi-tagged frame, it represents the 3-bit Priority Code Point (PCP) portion of the outer tag's Tag Control Information (TCI) field as described in [IEEE802.1Q], except for I-TAG.

[IEEE802.1Q]

[ipfix-iana_at_cisco.com][RFC7133] 1 2014-01-11
245 dot1qCustomerVlanId unsigned16 identifier current

The value represents the Customer VLAN identifier in the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q].

[IEEE802.1Q]

[ipfix-iana_at_cisco.com][RFC7133] 1 2014-01-11
246 dot1qCustomerPriority unsigned8 identifier current

The value represents the 3-bit Priority Code Point (PCP) portion of the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q].

[IEEE802.1Q]

[ipfix-iana_at_cisco.com][RFC7133] 1 2014-01-11
247 metroEvcId string default current

The EVC Service Attribute which uniquely identifies the Ethernet Virtual Connection (EVC) within a Metro Ethernet Network, as defined in section 6.2 of MEF 10.1. The MetroEVCID is encoded in a string of up to 100 characters.

MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 (Ethernet Local Management Interface)

[ipfix-iana_at_cisco.com] 1 2014-02-03
248 metroEvcType unsigned8 identifier current

The 3-bit EVC Service Attribute which identifies the type of service provided by an EVC.

MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 (Ethernet Local Management Interface)

[ipfix-iana_at_cisco.com] 0 2013-02-18
249 pseudoWireId unsigned32 identifier current

A 32-bit non-zero connection identifier, which together with the pseudoWireType, identifies the Pseudo Wire (PW) as defined in [RFC8077].

See [RFC8077] for pseudowire definitions.

[ipfix-iana_at_cisco.com] 0 2013-02-18
250 pseudoWireType unsigned16 identifier current

The value of this information element identifies the type of MPLS Pseudo Wire (PW) as defined in [RFC4446].

See [RFC4446] for the pseudowire type definition, and [https://www.iana.org/assignments/pwe3-parameters] for the IANA Pseudowire Types registry.

[ipfix-iana_at_cisco.com] 0 2013-02-18
251 pseudoWireControlWord unsigned32 identifier current

The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as defined in Section 3 of [RFC4385].

See [RFC4385] for the Pseudo Wire Control Word definition.

[ipfix-iana_at_cisco.com] 0 2013-02-18
252 ingressPhysicalInterface unsigned32 identifier current

The index of a networking device's physical interface (example, a switch port) where packets of this flow are being received.

See [RFC2863] for the definition of the ifIndex object.

[ipfix-iana_at_cisco.com] 0 2013-02-18
253 egressPhysicalInterface unsigned32 identifier current

The index of a networking device's physical interface (example, a switch port) where packets of this flow are being sent.

See [RFC2863] for the definition of the ifIndex object.

[ipfix-iana_at_cisco.com] 0 2013-02-18
254 postDot1qVlanId unsigned16 identifier current

The definition of this Information Element is identical to the definition of Information Element 'dot1qVlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

[IEEE.802-3.2005] [IEEE.802-1ad.2005]

[ipfix-iana_at_cisco.com] 0 2013-02-18
255 postDot1qCustomerVlanId unsigned16 identifier current

The definition of this Information Element is identical to the definition of Information Element 'dot1qCustomerVlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

[IEEE.802-1ad.2005] [IEEE.802-1Q.2003]

[ipfix-iana_at_cisco.com] 0 2013-02-18
256 ethernetType unsigned16 identifier current

The Ethernet type field of an Ethernet frame that identifies the MAC client protocol carried in the payload as defined in paragraph 1.4.349 of [IEEE.802-3.2005].

[IEEE.802-3.2005] Ethertype registry available at [http://standards.ieee.org/regauth/ethertype/eth.txt]

[ipfix-iana_at_cisco.com] 0 2013-02-18
257 postIpPrecedence unsigned8 identifier current

The definition of this Information Element is identical to the definition of Information Element 'ipPrecedence', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

0-7

See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of the IP Precedence. See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.

[ipfix-iana_at_cisco.com] 0 2013-02-18
258 collectionTimeMilliseconds dateTimeMilliseconds default current

The absolute timestamp at which the data within the scope containing this Information Element was received by a Collecting Process. This Information Element SHOULD be bound to its containing IPFIX Message via IPFIX Options and the messageScope Information Element, as defined below.

milliseconds [RFC5655][RFC Errata 3559] 1 2013-03-26
259 exportSctpStreamId unsigned16 identifier current

The value of the SCTP Stream Identifier used by the Exporting Process for exporting IPFIX Message data. This is carried in the Stream Identifier field of the header of the SCTP DATA chunk containing the IPFIX Message(s).

[RFC5655] 0 2013-02-18
260 maxExportSeconds dateTimeSeconds default current

The absolute Export Time of the latest IPFIX Message within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element.

seconds [RFC5655] 0 2013-02-18
261 maxFlowEndSeconds dateTimeSeconds default current

The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the second if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element.

seconds [RFC5655] 0 2013-02-18
262 messageMD5Checksum octetArray default current

The MD5 checksum of the IPFIX Message containing this record. This Information Element SHOULD be bound to its containing IPFIX Message via an options record and the messageScope Information Element, as defined below, and SHOULD appear only once in a given IPFIX Message. To calculate the value of this Information Element, first buffer the containing IPFIX Message, setting the value of this Information Element to all zeroes. Then calculate the MD5 checksum of the resulting buffer as defined in [RFC1321], place the resulting value in this Information Element, and export the buffered message. This Information Element is intended as a simple checksum only; therefore collision resistance and algorithm agility are not required, and MD5 is an appropriate message digest. This Information Element has a fixed length of 16 octets.

[RFC5655][RFC1321] 0 2013-02-18
263 messageScope unsigned8 current

The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Message that contains them. It is defined for general purpose message scoping of options, and proposed specifically to allow the attachment a checksum to a message via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process.

0-0 [RFC5655] 0 2013-02-18
264 minExportSeconds dateTimeSeconds default current

The absolute Export Time of the earliest IPFIX Message within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element.

seconds [RFC5655] 0 2013-02-18
265 minFlowStartSeconds dateTimeSeconds default current

The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the second if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element.

seconds [RFC5655] 0 2013-02-18
266 opaqueOctets octetArray default current

This Information Element is used to encapsulate non- IPFIX data into an IPFIX Message stream, for the purpose of allowing a non-IPFIX data processor to store a data stream inline within an IPFIX File. A Collecting Process or File Writer MUST NOT try to interpret this binary data. This Information Element differs from paddingOctets as its contents are meaningful in some non-IPFIX context, while the contents of paddingOctets MUST be 0x00 and are intended only for Information Element alignment.

[RFC5655] 0 2013-02-18
267 sessionScope unsigned8 current

The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Transport Session that contains them. Note that as all options are implicitly scoped to Transport Session and Observation Domain, this Information Element is equivalent to a "null" scope. It is defined for general purpose session scoping of options, and proposed specifically to allow the attachment of time window to an IPFIX File via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process.

0-0 [RFC5655] 0 2013-02-18
268 maxFlowEndMicroseconds dateTimeMicroseconds default current

The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the microsecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements.

microseconds [RFC5655] 0 2013-02-18
269 maxFlowEndMilliseconds dateTimeMilliseconds default current

The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the millisecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements.

milliseconds [RFC5655] 0 2013-02-18
270 maxFlowEndNanoseconds dateTimeNanoseconds default current

The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements.

nanoseconds [RFC5655] 0 2013-02-18
271 minFlowStartMicroseconds dateTimeMicroseconds default current

The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the microsecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements.

microseconds [RFC5655] 0 2013-02-18
272 minFlowStartMilliseconds dateTimeMilliseconds default current

The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the millisecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements.

milliseconds [RFC5655] 0 2013-02-18
273 minFlowStartNanoseconds dateTimeNanoseconds default current

The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements.

nanoseconds [RFC5655] 0 2013-02-18
274 collectorCertificate octetArray default current

The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element.

[RFC5655] 0 2013-02-18
275 exporterCertificate octetArray default current

The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element.

[RFC5655] 0 2013-02-18
276 dataRecordsReliability boolean default current

The export reliability of Data Records, within this SCTP stream, for the element(s) in the Options Template scope. A typical example of an element for which the export reliability will be reported is the templateID, as specified in the Data Records Reliability Options Template. A value of 'True' means that the Exporting Process MUST send any Data Records associated with the element(s) reliably within this SCTP stream. A value of 'False' means that the Exporting Process MAY send any Data Records associated with the element(s) unreliably within this SCTP stream.

[RFC6526] 1 2014-02-03
277 observationPointType unsigned8 identifier current

Type of observation point. Values are listed in the observationPointType registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-observation-point-type].

[ipfix-iana_at_cisco.com] 0 2013-02-18
278 newConnectionDeltaCount unsigned32 deltaCounter current

This information element counts the number of TCP or UDP connections which were opened during the observation period. The observation period may be specified by the flow start and end timestamps.

[ipfix-iana_at_cisco.com] 1 2014-08-13
279 connectionSumDurationSeconds unsigned64 current

This information element aggregates the total time in seconds for all of the TCP or UDP connections which were in use during the observation period. For example if there are 5 concurrent connections each for 10 seconds, the value would be 50 s.

seconds [ipfix-iana_at_cisco.com] 1 2013-06-25
280 connectionTransactionId unsigned64 identifier current

This information element identifies a transaction within a connection. A transaction is a meaningful exchange of application data between two network devices or a client and server. A transactionId is assigned the first time a flow is reported, so that later reports for the same flow will have the same transactionId. A different transactionId is used for each transaction within a TCP or UDP connection. The identifiers need not be sequential.

[ipfix-iana_at_cisco.com] 0 2013-02-18
281 postNATSourceIPv6Address ipv6Address default current

The definition of this Information Element is identical to the definition of Information Element 'sourceIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after the packet passed the Observation Point. See [RFC8200] for the definition of the Source Address field in the IPv6 header. See [RFC3234] for the definition of middleboxes. See [RFC6146] for nat64 specification.

[ipfix-iana_at_cisco.com] 0 2013-02-18
282 postNATDestinationIPv6Address ipv6Address default current

The definition of this Information Element is identical to the definition of Information Element 'destinationIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after the packet passed the Observation Point. See [RFC8200] for the definition of the Destination Address field in the IPv6 header. See [RFC3234] for the definition of middleboxes. See [RFC6146] for nat64 specification.

[ipfix-iana_at_cisco.com] 0 2013-02-18
283 natPoolId unsigned32 identifier current

Locally unique identifier of a NAT pool.

[ipfix-iana_at_cisco.com] 0 2013-02-18
284 natPoolName string default current

The name of a NAT pool identified by a natPoolID.

[ipfix-iana_at_cisco.com] 0 2013-02-18
285 anonymizationFlags unsigned16 flags current

A flag word describing specialized modifications to the anonymization policy in effect for the anonymization technique applied to a referenced Information Element within a referenced Template. When flags are clear (0), the normal policy (as described by anonymizationTechnique) applies without modification.

MSB   14  13  12  11  10   9   8   7   6   5   4   3   2   1  LSB
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|                Reserved                       |LOR|PmA|   SC  |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

anonymizationFlags IE

+--------+----------+-----------------------------------------------+
| bit(s) | name     | description                                   |
| (LSB = |          |                                               |
| 0)     |          |                                               |
+--------+----------+-----------------------------------------------+
| 0-1    | SC       | Stability Class: see the Stability Class      |
|        |          | table below, and section Section 5.1.         | 
| 2      | PmA      | Perimeter Anonymization: when set (1),        |
|        |          | source- Information Elements as described in  |
|        |          | [RFC5103] are interpreted as external         |
|        |          | addresses, and destination- Information       |
|        |          | Elements as described in [RFC5103] are        |
|        |          | interpreted as internal addresses, for the    |
|        |          | purposes of associating                       |
|        |          | anonymizationTechnique to Information         |
|        |          | Elements only; see Section 7.2.2 for details. |
|        |          | This bit MUST NOT be set when associated with |
|        |          | a non-endpoint (i.e., source- or              |
|        |          | destination-) Information Element.  SHOULD be |
|        |          | consistent within a record (i.e., if a        |
|        |          | source- Information Element has this flag     |
|        |          | set, the corresponding destination- element   |
|        |          | SHOULD have this flag set, and vice-versa.)   |
| 3      | LOR      | Low-Order Unchanged: when set (1), the        |
|        |          | low-order bits of the anonymized Information  |
|        |          | Element contain real data.  This modification |
|        |          | is intended for the anonymization of          |
|        |          | network-level addresses while leaving         |
|        |          | host-level addresses intact in order to       |
|        |          | preserve host level-structure, which could    |
|        |          | otherwise be used to reverse anonymization.   |
|        |          | MUST NOT be set when associated with a        |
|        |          | truncation-based anonymizationTechnique.      |
| 4-15   | Reserved | Reserved for future use: SHOULD be cleared    |
|        |          | (0) by the Exporting Process and MUST be      |
|        |          | ignored by the Collecting Process.            |
+--------+----------+-----------------------------------------------+

The Stability Class portion of this flags word describes the stability class of the anonymization technique applied to a referenced Information Element within a referenced Template. Stability classes refer to the stability of the parameters of the anonymization technique, and therefore the comparability of the mapping between the real and anonymized values over time. This determines which anonymized datasets may be compared with each other. Values are as follows:

+-----+-----+-------------------------------------------------------+
| Bit | Bit | Description                                           |
| 1   | 0   |                                                       |
+-----+-----+-------------------------------------------------------+
| 0   | 0   | Undefined: the Exporting Process makes no             |
|     |     | representation as to how stable the mapping is, or    |
|     |     | over what time period values of this field will       |
|     |     | remain comparable; while the Collecting Process MAY   |
|     |     | assume Session level stability, Session level         |
|     |     | stability is not guaranteed.  Processes SHOULD assume |
|     |     | this is the case in the absence of stability class    |
|     |     | information; this is the default stability class.     |
| 0   | 1   | Session: the Exporting Process will ensure that the   |
|     |     | parameters of the anonymization technique are stable  |
|     |     | during the Transport Session.  All the values of the  |
|     |     | described Information Element for each Record         |
|     |     | described by the referenced Template within the       |
|     |     | Transport Session are comparable.  The Exporting      |
|     |     | Process SHOULD endeavour to ensure at least this      |
|     |     | stability class.                                      |
| 1   | 0   | Exporter-Collector Pair: the Exporting Process will   |
|     |     | ensure that the parameters of the anonymization       |
|     |     | technique are stable across Transport Sessions over   |
|     |     | time with the given Collecting Process, but may use   |
|     |     | different parameters for different Collecting         |
|     |     | Processes.  Data exported to different Collecting     |
|     |     | Processes are not comparable.                         |
| 1   | 1   | Stable: the Exporting Process will ensure that the    |
|     |     | parameters of the anonymization technique are stable  |
|     |     | across Transport Sessions over time, regardless of    |
|     |     | the Collecting Process to which it is sent.           |
+-----+-----+-------------------------------------------------------+
[RFC6235] 0 2013-02-18
286 anonymizationTechnique unsigned16 identifier current

A description of the anonymization technique applied to a referenced Information Element within a referenced Template. Each technique may be applicable only to certain Information Elements and recommended only for certain Information Elements. Values are listed in the anonymizationTechnique registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-anonymization-technique].

[RFC6235] 0 2013-02-18
287 informationElementIndex unsigned16 identifier current

A zero-based index of an Information Element referenced by informationElementId within a Template referenced by templateId; used to disambiguate scope for templates containing multiple identical Information Elements.

[RFC6235] 0 2013-02-18
288 p2pTechnology string default current

Specifies if the Application ID is based on peer-to-peer technology.

Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }.

[RFC6759] 0 2013-02-18
289 tunnelTechnology string default current

Specifies if the Application ID is used as a tunnel technology.

Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }.

[RFC6759] 0 2013-02-18
290 encryptedTechnology string default current

Specifies if the Application ID is an encrypted networking protocol.

Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }.

[RFC6759] 0 2013-02-18
291 basicList basicList list current

Specifies a generic Information Element with a basicList abstract data type. For example, a list of port numbers, a list of interface indexes, etc.

[RFC6313] 0 2013-02-18
292 subTemplateList subTemplateList list current

Specifies a generic Information Element with a subTemplateList abstract data type.

[RFC6313] 0 2013-02-18
293 subTemplateMultiList subTemplateMultiList list current

Specifies a generic Information Element with a subTemplateMultiList abstract data type.

[RFC6313] 0 2013-02-18
294 bgpValidityState unsigned8 identifier current

This element describes the "validity state" of the BGP route correspondent source or destination IP address. If the "validity state" for this Flow is only available, then the value of this Information Element is 255.

See [RFC4271] for a description of BGP-4, [RFC6811] for the definition of "validity states" and [draft-ietf-sidr-origin-validation-signaling] for the encoding of those "validity states".

[ipfix-iana_at_cisco.com] 0 2013-02-18
295 IPSecSPI unsigned32 identifier current

IPSec Security Parameters Index (SPI).

See [RFC2401] for the definition of SPI.

[ipfix-iana_at_cisco.com] 0 2013-02-18
296 greKey unsigned32 identifier current

GRE key, which is used for identifying an individual traffic flow within a tunnel.

See [RFC1701] for the definition of GRE and the GRE Key.

[ipfix-iana_at_cisco.com] 0 2013-02-18
297 natType unsigned8 identifier current

Values are listed in the natType registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-type].

See [RFC3022] for the definition of NAT. See [RFC1631] for the definition of NAT44. See [RFC6144] for the definition of NAT64. See [RFC6146] for the definition of NAT46. See [RFC6296] for the definition of NAT66. See [RFC791] for the definition of IPv4. See [RFC8200] for the definition of IPv6.

[ipfix-iana_at_cisco.com] 0 2013-02-18
298 initiatorPackets unsigned64 deltaCounter current

The total number of layer 4 packets in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session.

packets

See #231, initiatorOctets.

[ipfix-iana_at_cisco.com] 1 2014-08-13
299 responderPackets unsigned64 deltaCounter current

The total number of layer 4 packets in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session.

packets

See #232, responderOctets.

[ipfix-iana_at_cisco.com] 1 2014-08-13
300 observationDomainName string default current

The name of an observation domain identified by an observationDomainId.

See #149, observationDomainId.

[ipfix-iana_at_cisco.com] 0 2013-02-18
301 selectionSequenceId unsigned64 identifier current

From all the packets observed at an Observation Point, a subset of the packets is selected by a sequence of one or more Selectors. The selectionSequenceId is a unique value per Observation Domain, specifying the Observation Point and the sequence of Selectors through which the packets are selected.

[RFC5477] 0 2013-02-18
302 selectorId unsigned64 identifier current

The Selector ID is the unique ID identifying a Primitive Selector. Each Primitive Selector must have a unique ID in the Observation Domain.

[RFC5477][RFC Errata 2052] 0 2013-02-18
303 informationElementId unsigned16 identifier current

This Information Element contains the ID of another Information Element.

[RFC5477] 0 2013-02-18
304 selectorAlgorithm unsigned16 identifier current

This Information Element identifies the packet selection methods (e.g., Filtering, Sampling) that are applied by the Selection Process.

Most of these methods have parameters. Further Information Elements are needed to fully specify packet selection with these methods and all their parameters.

The methods listed below are defined in [RFC5475]. For their parameters, Information Elements are defined in the information model document. The names of these Information Elements are listed for each method identifier.

Further method identifiers may be added to the list below. It might be necessary to define new Information Elements to specify their parameters.

The following packet selection methods identifiers are defined here:

[https://www.iana.org/assignments/psamp-parameters]

There is a broad variety of possible parameters that could be used for Property match Filtering (5) but currently there are no agreed parameters specified.

[RFC5477] 0 2013-02-18
305 samplingPacketInterval unsigned32 quantity current

This Information Element specifies the number of packets that are consecutively sampled. A value of 100 means that 100 consecutive packets are sampled.

For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.

packets [RFC5477] 0 2013-02-18
306 samplingPacketSpace unsigned32 quantity current

This Information Element specifies the number of packets between two "samplingPacketInterval"s. A value of 100 means that the next interval starts 100 packets (which are not sampled) after the current "samplingPacketInterval" is over.

For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.

packets [RFC5477] 0 2013-02-18
307 samplingTimeInterval unsigned32 quantity current

This Information Element specifies the time interval in microseconds during which all arriving packets are sampled.

For example, this Information Element may be used to describe the configuration of a systematic time-based Sampling Selector.

microseconds [RFC5477] 0 2013-02-18
308 samplingTimeSpace unsigned32 quantity current

This Information Element specifies the time interval in microseconds between two "samplingTimeInterval"s. A value of 100 means that the next interval starts 100 microseconds (during which no packets are sampled) after the current "samplingTimeInterval" is over.

For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector.

microseconds [RFC5477] 0 2013-02-18
309 samplingSize unsigned32 quantity current

This Information Element specifies the number of elements taken from the parent Population for random Sampling methods.

For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector.

packets [RFC5477] 0 2013-02-18
310 samplingPopulation unsigned32 quantity current

This Information Element specifies the number of elements in the parent Population for random Sampling methods.

For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector.

packets [RFC5477] 0 2013-02-18
311 samplingProbability float64 quantity current

This Information Element specifies the probability that a packet is sampled, expressed as a value between 0 and 1. The probability is equal for every packet. A value of 0 means no packet was sampled since the probability is 0.

For example, this Information Element may be used to describe the configuration of a uniform probabilistic Sampling Selector.

[RFC5477] 0 2013-02-18
312 dataLinkFrameSize unsigned16 quantity current

This Information Element specifies the length of the selected data link frame.

The data link layer is defined in [ISO/IEC.7498-1:1994].

[ISO/IEC.7498-1:1994]

[RFC7133] 1 2014-01-11
313 ipHeaderPacketSection octetArray default current

This Information Element carries a series of n octets from the IP header of a sampled packet, starting sectionOffset octets into the IP header.

However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the IP header.

With sufficient length, this element also reports octets from the IP payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC5477] and [RFC2804].

The sectionExportedOctets expresses how much data was exported, while the remainder is padding.

When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length.

When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.

[RFC2804] [RFC5477]

[RFC5477][RFC7133] 1 2014-01-11
314 ipPayloadPacketSection octetArray default current

This Information Element carries a series of n octets from the IP payload of a sampled packet, starting sectionOffset octets into the IP payload.

However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the IP payload.

The IPv4 payload is that part of the packet that follows the IPv4 header and any options, which [RFC791] refers to as "data" or "data octets". For example, see the examples in [RFC791], Appendix A.

The IPv6 payload is the rest of the packet following the 40-octet IPv6 header. Note that any extension headers present are considered part of the payload. See [RFC8200] for the IPv6 specification.

The sectionExportedOctets expresses how much data was observed, while the remainder is padding.

When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length.

When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.

[RFC791] [RFC8200]

[RFC5477][RFC7133] 1 2014-01-11
315 dataLinkFrameSection octetArray default current

This Information Element carries n octets from the data link frame of a selected frame, starting sectionOffset octets into the frame.

However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the data link frame.

The sectionExportedOctets expresses how much data was observed, while the remainder is padding.

When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length.

When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.

Further Information Elements, i.e., dataLinkFrameType and dataLinkFrameSize, are needed to specify the data link type and the size of the data link frame of this Information Element. A set of these Information Elements MAY be contained in a structured data type, as expressed in [RFC6313]. Or a set of these Information Elements MAY be contained in one Flow Record as shown in Appendix B of [RFC7133].

The data link layer is defined in [ISO/IEC.7498-1:1994].

[RFC6313] [RFC7133] [ISO/IEC.7498-1:1994]

[RFC7133] 1 2014-01-11
316 mplsLabelStackSection octetArray default current

This Information Element carries a series of n octets from the MPLS label stack of a sampled packet, starting sectionOffset octets into the MPLS label stack.

However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the head of the MPLS label stack.

With sufficient length, this element also reports octets from the MPLS payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC5477] and [RFC2804].

See [RFC3031] for the specification of MPLS packets.

See [RFC3032] for the specification of the MPLS label stack.

The sectionExportedOctets expresses how much data was observed, while the remainder is padding.

When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length.

When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.

[RFC2804] [RFC3031] [RFC3032] [RFC5477]

[RFC5477][RFC7133] 1 2014-01-11
317 mplsPayloadPacketSection octetArray default current

The mplsPayloadPacketSection carries a series of n octets from the MPLS payload of a sampled packet, starting sectionOffset octets into the MPLS payload, as it is data that follows immediately after the MPLS label stack.

However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the MPLS payload.

See [RFC3031] for the specification of MPLS packets.

See [RFC3032] for the specification of the MPLS label stack.

The sectionExportedOctets expresses how much data was observed, while the remainder is padding.

When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length.

When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.

[RFC3031] [RFC3032]

[RFC5477][RFC7133] 1 2014-01-11
318 selectorIdTotalPktsObserved unsigned64 totalCounter current

This Information Element specifies the total number of packets observed by a Selector, for a specific value of SelectorId.

This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

packets [RFC5477] 0 2013-02-18
319 selectorIdTotalPktsSelected unsigned64 totalCounter current

This Information Element specifies the total number of packets selected by a Selector, for a specific value of SelectorId.

This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

packets [RFC5477] 0 2013-02-18
320 absoluteError float64 quantity current

This Information Element specifies the maximum possible measurement error of the reported value for a given Information Element. The absoluteError has the same unit as the Information Element with which it is associated. The real value of the metric can differ by absoluteError (positive or negative) from the measured value.

This Information Element provides only the error for measured values. If an Information Element contains an estimated value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements.

This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

inferred [RFC5477] 1 2018-06-13
321 relativeError float64 quantity current

This Information Element specifies the maximum possible positive or negative error ratio for the reported value for a given Information Element as percentage of the measured value. The real value of the metric can differ by relativeError percent (positive or negative) from the measured value.

This Information Element provides only the error for measured values. If an Information Element contains an estimated value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements.

This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

[RFC5477] 0 2013-02-18
322 observationTimeSeconds dateTimeSeconds default current

This Information Element specifies the absolute time in seconds of an observation.

seconds [RFC5477] 1 2014-02-03
323 observationTimeMilliseconds dateTimeMilliseconds default current

This Information Element specifies the absolute time in milliseconds of an observation.

milliseconds [RFC5477] 1 2014-02-03
324 observationTimeMicroseconds dateTimeMicroseconds default current

This Information Element specifies the absolute time in microseconds of an observation.

microseconds [RFC5477] 1 2014-02-03
325 observationTimeNanoseconds dateTimeNanoseconds default current

This Information Element specifies the absolute time in nanoseconds of an observation.

nanoseconds [RFC5477] 1 2014-02-03
326 digestHashValue unsigned64 quantity current

This Information Element specifies the value from the digest hash function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
327 hashIPPayloadOffset unsigned64 quantity current

This Information Element specifies the IP payload offset used by a Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
328 hashIPPayloadSize unsigned64 quantity current

This Information Element specifies the IP payload size used by a Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
329 hashOutputRangeMin unsigned64 quantity current

This Information Element specifies the value for the beginning of a hash function's potential output range.

See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
330 hashOutputRangeMax unsigned64 quantity current

This Information Element specifies the value for the end of a hash function's potential output range.

See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
331 hashSelectedRangeMin unsigned64 quantity current

This Information Element specifies the value for the beginning of a hash function's selected range.

See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
332 hashSelectedRangeMax unsigned64 quantity current

This Information Element specifies the value for the end of a hash function's selected range.

See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
333 hashDigestOutput boolean default current

This Information Element contains a boolean value that is TRUE if the output from this hash Selector has been configured to be included in the packet report as a packet digest, else FALSE.

See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 1 2014-02-03
334 hashInitialiserValue unsigned64 quantity current

This Information Element specifies the initialiser value to the hash function.

See also Sections 6.2, 3.8 and 7.1 of [RFC5475].

[RFC5477] 0 2013-02-18
335 selectorName string default current

The name of a selector identified by a selectorID. Globally unique per Metering Process.

[ipfix-iana_at_cisco.com] 0 2013-02-18
336 upperCILimit float64 quantity current

This Information Element specifies the upper limit of a confidence interval. It is used to provide an accuracy statement for an estimated value. The confidence limits define the range in which the real value is assumed to be with a certain probability p. Confidence limits always need to be associated with a confidence level that defines this probability p. Please note that a confidence interval only provides a probability that the real value lies within the limits. That means the real value can lie outside the confidence limits.

The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together.

[RFC5477] 0 2013-02-18
337 lowerCILimit float64 quantity current

This Information Element specifies the lower limit of a confidence interval. For further information, see the description of upperCILimit.

The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together.

[RFC5477] 0 2013-02-18
338 confidenceLevel float64 quantity current

This Information Element specifies the confidence level. It is used to provide an accuracy statement for estimated values. The confidence level provides the probability p with which the real value lies within a given range. A confidence level always needs to be associated with confidence limits that define the range in which the real value is assumed to be.

The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together.

[RFC5477] 0 2013-02-18
339 informationElementDataType unsigned8 current

A description of the abstract data type of an IPFIX information element.These are taken from the abstract data types defined in section 3.1 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the [informationElementDataType] subregistry.

These types are registered in the IANA IPFIX Information Element Data Type subregistry. This subregistry is intended to assign numbers for type names, not to provide a mechanism for adding data types to the IPFIX Protocol, and as such requires a Standards Action [RFC8126] to modify.

[RFC5610] 0 2013-02-18
340 informationElementDescription string default current

A UTF-8 [RFC3629] encoded Unicode string containing a human-readable description of an Information Element. The content of the informationElementDescription MAY be annotated with one or more language tags [RFC4646], encoded in-line [RFC2482] within the UTF-8 string, in order to specify the language in which the description is written. Description text in multiple languages MAY tag each section with its own language tag; in this case, the description information in each language SHOULD have equivalent meaning. In the absence of any language tag, the "i-default" [RFC2277] language SHOULD be assumed. See the Security Considerations section for notes on string handling for Information Element type records.

[RFC5610] 0 2013-02-18
341 informationElementName string default current

A UTF-8 [RFC3629] encoded Unicode string containing the name of an Information Element, intended as a simple identifier. See the Security Considerations section for notes on string handling for Information Element type records

[RFC5610] 0 2013-02-18
342 informationElementRangeBegin unsigned64 quantity current

Contains the inclusive low end of the range of acceptable values for an Information Element.

[RFC5610] 0 2013-02-18
343 informationElementRangeEnd unsigned64 quantity current

Contains the inclusive high end of the range of acceptable values for an Information Element.

[RFC5610] 0 2013-02-18
344 informationElementSemantics unsigned8 current

A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in section 3.2 of the IPFIX Information Model [RFC5102]; see that section for more information on the types defined in the [IPFIX Information Element Semantics] subregistry. This field may take the values in the semantics registry; the special value 0x00 (default) is used to note that no semantics apply to the field; it cannot be manipulated by a Collecting Process or File Reader that does not understand it a priori.

These semantics are registered in the IANA IPFIX Information Element Semantics subregistry. This subregistry is intended to assign numbers for semantics names, not to provide a mechanism for adding semantics to the IPFIX Protocol, and as such requires a Standards Action [RFC8126] to modify.

[RFC5610] 0 2013-02-18
345 informationElementUnits unsigned16 current

A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in section 5 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the informationElementsUnits subregistry. This field may take the values in Table 3 below; the special value 0x00 (none) is used to note that the field is unitless.

These types are registered in the [IANA IPFIX Information Element Units] subregistry.

[RFC5610][RFC Errata 1822] 1 2020-10-01
346 privateEnterpriseNumber unsigned32 identifier current

A private enterprise number, as assigned by IANA. Within the context of an Information Element Type record, this element can be used along with the informationElementId element to scope properties to a specific Information Element. To export type information about an IANA-assigned Information Element, set the privateEnterpriseNumber to 0, or do not export the privateEnterpriseNumber in the type record. To export type information about an enterprise-specific Information Element, export the enterprise number in privateEnterpriseNumber, and export the Information Element number with the Enterprise bit cleared in informationElementId. The Enterprise bit in the associated informationElementId Information Element MUST be ignored by the Collecting Process.

[RFC5610] 0 2013-02-18
347 virtualStationInterfaceId octetArray default current

Instance Identifier of the interface to a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host.

See IEEE 802.1Qbg for the definition of Virtual Station Interface ID.

[ipfix-iana_at_cisco.com] 1 2014-02-03
348 virtualStationInterfaceName string default current

Name of the interface to a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host.

See IEEE 802.1Qbg for the definition of Virtual Station Interface.

[ipfix-iana_at_cisco.com] 1 2014-02-03
349 virtualStationUUID octetArray default current

Unique Identifier of a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host.

See IEEE 802.1Qbg for the definition of Virtual Station.

[ipfix-iana_at_cisco.com] 1 2014-02-03
350 virtualStationName string default current

Name of a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host.

See IEEE 802.1Qbg for the definition of Virtual Station.

[ipfix-iana_at_cisco.com] 0 2013-02-18
351 layer2SegmentId unsigned64 identifier current

Identifier of a layer 2 network segment in an overlay network. The most significant byte identifies the layer 2 network overlay network encapsulation type:

0x00 reserved

0x01 VxLAN

0x02 NVGRE

The three lowest significant bytes hold the value of the layer 2 overlay network segment identifier.

For example:

- a 24 bit segment ID VXLAN Network Identifier (VNI)

- a 24 bit Tenant Network Identifier (TNI) for NVGRE

See VxLAN RFC at [RFC7348]

See NVGRE RFC at [RFC7637]

[ipfix-iana_at_cisco.com] 0 2013-02-18
352 layer2OctetDeltaCount unsigned64 deltaCounter current

The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1)

octets [ipfix-iana_at_cisco.com] 1 2014-05-02
353 layer2OctetTotalCount unsigned64 totalCounter current

The total number of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetTotalCount (field #85)

octets [ipfix-iana_at_cisco.com] 1 2014-05-02
354 ingressUnicastPacketTotalCount unsigned64 totalCounter current

The total number of incoming unicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

packets

[ipfix-iana_at_cisco.com] 0 2013-02-18
355 ingressMulticastPacketTotalCount unsigned64 totalCounter current

The total number of incoming multicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

packets

[ipfix-iana_at_cisco.com] 0 2013-02-18
356 ingressBroadcastPacketTotalCount unsigned64 totalCounter current

The total number of incoming broadcast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

packets

[ipfix-iana_at_cisco.com] 0 2013-02-18
357 egressUnicastPacketTotalCount unsigned64 totalCounter current

The total number of incoming unicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

packets

[ipfix-iana_at_cisco.com] 0 2013-02-18
358 egressBroadcastPacketTotalCount unsigned64 totalCounter current

The total number of incoming broadcast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

packets

[ipfix-iana_at_cisco.com] 0 2013-02-18
359 monitoringIntervalStartMilliSeconds dateTimeMilliseconds default current

The absolute timestamp at which the monitoring interval started. A Monitoring interval is the period of time during which the Metering Process is running.

milliseconds [ipfix-iana_at_cisco.com] 0 2013-02-18
360 monitoringIntervalEndMilliSeconds dateTimeMilliseconds default current

The absolute timestamp at which the monitoring interval ended. A Monitoring interval is the period of time during which the Metering Process is running.

milliseconds [ipfix-iana_at_cisco.com] 0 2013-02-18
361 portRangeStart unsigned16 identifier current

The port number identifying the start of a range of ports. A value of zero indicates that the range start is not specified, ie the range is defined in some other way.

Additional information on defined TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[ipfix-iana_at_cisco.com] 0 2013-02-18
362 portRangeEnd unsigned16 identifier current

The port number identifying the end of a range of ports. A value of zero indicates that the range end is not specified, ie the range is defined in some other way.

Additional information on defined TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].

[ipfix-iana_at_cisco.com] 0 2013-02-18
363 portRangeStepSize unsigned16 identifier current

The step size in a port range. The default step size is 1, which indicates contiguous ports. A value of zero indicates that the step size is not specified, ie the range is defined in some other way.

[ipfix-iana_at_cisco.com] 0 2013-02-18
364 portRangeNumPorts unsigned16 identifier current

The number of ports in a port range. A value of zero indicates that the number of ports is not specified, ie the range is defined in some other way.

[ipfix-iana_at_cisco.com] 0 2013-02-18
365 staMacAddress macAddress default current

The IEEE 802 MAC address of a wireless station (STA).

See section 1.4 of [RFC5415] for the definition of STA.

[ipfix-iana_at_cisco.com] 1 2014-02-03
366 staIPv4Address ipv4Address default current

The IPv4 address of a wireless station (STA).

See section 1.4 of [RFC5415] for the definition of STA.

[ipfix-iana_at_cisco.com] 1 2014-02-03
367 wtpMacAddress macAddress default current

The IEEE 802 MAC address of a wireless access point (WTP).

See section 1.4 of [RFC5415] for the definition of WTP.

[ipfix-iana_at_cisco.com] 1 2014-02-03
368 ingressInterfaceType unsigned32 identifier current

The type of interface where packets of this Flow are being received. The value matches the value of managed object 'ifType' as defined in [https://www.iana.org/assignments/ianaiftype-mib].

[https://www.iana.org/assignments/ianaiftype-mib]

[ipfix-iana_at_cisco.com] 0 2013-02-18
369 egressInterfaceType unsigned32 identifier current

The type of interface where packets of this Flow are being sent. The value matches the value of managed object 'ifType' as defined in [https://www.iana.org/assignments/ianaiftype-mib].

[https://www.iana.org/assignments/ianaiftype-mib]

[ipfix-iana_at_cisco.com] 0 2013-02-18
370 rtpSequenceNumber unsigned16 current

The RTP sequence number per [RFC3550].

[RFC3550]

[ipfix-iana_at_cisco.com] 0 2013-02-18
371 userName string default current

User name associated with the flow.

[ipfix-iana_at_cisco.com] 0 2013-02-18
372 applicationCategoryName string default current

An attribute that provides a first level categorization for each Application ID.

[RFC6759] 0 2013-02-18
373 applicationSubCategoryName string default current

An attribute that provides a second level categorization for each Application ID.

[RFC6759] 0 2013-02-18
374 applicationGroupName string default current

An attribute that groups multiple Application IDs that belong to the same networking application.

[RFC6759] 0 2013-02-18
375 originalFlowsPresent unsigned64 deltaCounter current

The non-conservative count of Original Flows contributing to this Aggregated Flow. Non-conservative counts need not sum to the original count on re-aggregation.

flows [RFC7015] 1 2013-06-25
376 originalFlowsInitiated unsigned64 deltaCounter current

The conservative count of Original Flows whose first packet is represented within this Aggregated Flow. Conservative counts must sum to the original count on re-aggregation.

flows [RFC7015] 1 2013-06-25
377 originalFlowsCompleted unsigned64 deltaCounter current

The conservative count of Original Flows whose last packet is represented within this Aggregated Flow. Conservative counts must sum to the original count on re-aggregation.

flows [RFC7015] 1 2013-06-25
378 distinctCountOfSourceIPAddress unsigned64 totalCounter current

The count of distinct source IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP version. This Information Element is preferred to the IP-version-specific counters, unless it is important to separate the counts by version.

[RFC7015] 0 2013-02-18
379 distinctCountOfDestinationIPAddress unsigned64 totalCounter current

The count of distinct destination IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP version. This Information Element is preferred to the version-specific counters below, unless it is important to separate the counts by version.

[RFC7015] 0 2013-02-18
380 distinctCountOfSourceIPv4Address unsigned32 totalCounter current

The count of distinct source IPv4 address values for Original Flows contributing to this Aggregated Flow.

[RFC7015] 0 2013-02-18
381 distinctCountOfDestinationIPv4Address unsigned32 totalCounter current

The count of distinct destination IPv4 address values for Original Flows contributing to this Aggregated Flow.

[RFC7015] 0 2013-02-18
382 distinctCountOfSourceIPv6Address unsigned64 totalCounter current

The count of distinct source IPv6 address values for Original Flows contributing to this Aggregated Flow.

[RFC7015] 0 2013-02-18
383 distinctCountOfDestinationIPv6Address unsigned64 totalCounter current

The count of distinct destination IPv6 address values for Original Flows contributing to this Aggregated Flow.

[RFC7015] 0 2013-02-18
384 valueDistributionMethod unsigned8 current

A description of the method used to distribute the counters from Contributing Flows into the Aggregated Flow records described by an associated scope, generally a Template. The method is deemed to apply to all the non-key Information Elements in the referenced scope for which value distribution is a valid operation; if the originalFlowsInitiated and/or originalFlowsCompleted Information Elements appear in the Template, they are not subject to this distribution method, as they each infer their own distribution method. The valueDistributionMethod registry is intended to list a complete set of possible value distribution methods. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-value-distribution-method].

[RFC7015] 0 2013-02-18
385 rfc3550JitterMilliseconds unsigned32 quantity current

Interarrival jitter as defined in section 6.4.1 of [RFC3550], measured in milliseconds.

milliseconds

[RFC3550]

[ipfix-iana_at_cisco.com] 0 2013-02-18
386 rfc3550JitterMicroseconds unsigned32 quantity current

Interarrival jitter as defined in section 6.4.1 of [RFC3550], measured in microseconds.

microseconds

[RFC3550]

[ipfix-iana_at_cisco.com] 0 2013-02-18
387 rfc3550JitterNanoseconds unsigned32 quantity current

Interarrival jitter as defined in section 6.4.1 of [RFC3550], measured in nanoseconds.

nanoseconds

[RFC3550]

[ipfix-iana_at_cisco.com] 0 2013-02-18
388 dot1qDEI boolean default current

The value of the 1-bit Drop Eligible Indicator (DEI) field of the VLAN tag as described in 802.1Q-2011 subclause 9.6. In case of a QinQ frame, it represents the outer tag's DEI field and in case of an IEEE 802.1ad frame it represents the DEI field of the S-TAG. Note: in earlier versions of 802.1Q the same bit field in the incoming packet is occupied by the Canonical Format Indicator (CFI) field, except for S-TAGs.

[802.1Q-2011 subclause 9.6]

[Yaakov_J_Stein] 1 2014-02-03
389 dot1qCustomerDEI boolean default current

In case of a QinQ frame, it represents the inner tag's Drop Eligible Indicator (DEI) field and in case of an IEEE 802.1ad frame it represents the DEI field of the C-TAG.

[802.1Q-2011 subclause 9.6]

[Yaakov_J_Stein] 1 2014-02-03
390 flowSelectorAlgorithm unsigned16 identifier current

This Information Element identifies the Intermediate Flow Selection Process technique (e.g., Filtering, Sampling) that is applied by the Intermediate Flow Selection Process. Most of these techniques have parameters. Its configuration parameter(s) MUST be clearly specified. Further Information Elements are needed to fully specify packet selection with these methods and all their parameters. Further method identifiers may be added to the flowSelectorAlgorithm registry. It might be necessary to define new Information Elements to specify their parameters. Please note that the purpose of the flow selection techniques described in this document is the improvement of measurement functions as defined in the Scope (Section 1). The Intermediate Flow Selection Process Techniques identifiers are defined at [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flowselectoralgorithm].

[RFC7014] 0 2013-06-07
391 flowSelectedOctetDeltaCount unsigned64 deltaCounter current

This Information Element specifies the volume in octets of all Flows that are selected in the Intermediate Flow Selection Process since the previous report.

octets [RFC7014] 1 2014-08-13
392 flowSelectedPacketDeltaCount unsigned64 deltaCounter current

This Information Element specifies the volume in packets of all Flows that were selected in the Intermediate Flow Selection Process since the previous report.

packets [RFC7014] 1 2014-08-13
393 flowSelectedFlowDeltaCount unsigned64 deltaCounter current

This Information Element specifies the number of Flows that were selected in the Intermediate Flow Selection Process since the last report.

flows [RFC7014] 1 2014-08-13
394 selectorIDTotalFlowsObserved unsigned64 current

This Information Element specifies the total number of Flows observed by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

flows [RFC7014] 0 2013-06-07
395 selectorIDTotalFlowsSelected unsigned64 current

This Information Element specifies the total number of Flows selected by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].

flows [RFC7014] 0 2013-06-07
396 samplingFlowInterval unsigned64 current

This Information Element specifies the number of Flows that are consecutively sampled. A value of 100 means that 100 consecutive Flows are sampled. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.

flows [RFC7014] 0 2013-06-07
397 samplingFlowSpacing unsigned64 current

This Information Element specifies the number of Flows between two "samplingFlowInterval"s. A value of 100 means that the next interval starts 100 Flows (which are not sampled) after the current "samplingFlowInterval" is over. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.

flows [RFC7014] 0 2013-06-07
398 flowSamplingTimeInterval unsigned64 current

This Information Element specifies the time interval in microseconds during which all arriving Flows are sampled. For example, this Information Element may be used to describe the configuration of a systematic time-based Sampling Selector.

microseconds [RFC7014] 0 2013-06-07
399 flowSamplingTimeSpacing unsigned64 current

This Information Element specifies the time interval in microseconds between two "flowSamplingTimeInterval"s. A value of 100 means that the next interval starts 100 microseconds (during which no Flows are sampled) after the current "flowsamplingTimeInterval" is over. For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector.

microseconds [RFC7014] 0 2013-06-07
400 hashFlowDomain unsigned16 identifier current

This Information Element specifies the Information Elements that are used by the Hash-based Flow Selector as the Hash Domain.

[RFC7014] 0 2013-06-07
401 transportOctetDeltaCount unsigned64 deltaCounter current

The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).

octets [Brian_Trammell] 0 2013-08-01
402 transportPacketDeltaCount unsigned64 deltaCounter current

The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).

packets [Brian_Trammell] 0 2013-08-01
403 originalExporterIPv4Address ipv4Address current

The IPv4 address used by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX Mediator. Used to provide information about the Original Observation Points to a downstream Collector.

[RFC7119] 0 2013-12-24
404 originalExporterIPv6Address ipv6Address current

The IPv6 address used by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX Mediator. Used to provide information about the Original Observation Points to a downstream Collector.

[RFC7119] 0 2013-12-24
405 originalObservationDomainId unsigned32 identifier current

The Observation Domain ID reported by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX Mediator. Used to provide information about the Original Observation Domain to a downstream Collector. When cascading through multiple Mediators, this identifies the initial Observation Domain in the cascade.

[RFC7119] 0 2013-12-24
406 intermediateProcessId unsigned32 identifier current

Description: An identifier of an Intermediate Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers may be assigned dynamically; that is, an Intermediate Process may be restarted with a different ID.

[RFC7119] 0 2013-12-24
407 ignoredDataRecordTotalCount unsigned64 totalCounter current

Description: The total number of received Data Records that the Intermediate Process did not process since the (re-)initialization of the Intermediate Process; includes only Data Records not examined or otherwise handled by the Intermediate Process due to resource constraints, not Data Records that were examined or otherwise handled by the Intermediate Process but those that merely do not contribute to any exported Data Record due to the operations performed by the Intermediate Process.

[RFC7119] 0 2013-12-24
408 dataLinkFrameType unsigned16 flags current

This Information Element specifies the type of the selected data link frame.

Data link types are defined in the dataLinkFrameType registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-data-link-frame-type].

Further values may be assigned by IANA. Note that the assigned values are bits so that multiple observations can be OR'd together.

The data link layer is defined in [ISO/IEC.7498-1:1994].

[IEEE802.3][IEEE802.11][ISO/IEC.7498-1:1994]

[RFC7133] 0 2014-01-11
409 sectionOffset unsigned16 quantity current

This Information Element specifies the offset of the packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, and mplsPayloadPacketSection). If this Information Element is omitted, it defaults to zero (i.e., no offset).

If multiple sectionOffset Information Elements are specified within a single Template, then they apply to the packet section Information Elements in order: the first sectionOffset applies to the first packet section, the second to the second, and so on. Note that the "closest" sectionOffset and packet section Information Elements within a given Template are not necessarily related. If there are fewer sectionOffset Information Elements than packet section Information Elements, then subsequent packet section Information Elements have no offset, i.e., a sectionOffset of zero applies to those packet section Information Elements. If there are more sectionOffset Information Elements than the number of packet section Information Elements, then the additional sectionOffset Information Elements are meaningless.

[RFC7133] 0 2014-01-11
410 sectionExportedOctets unsigned16 quantity current

This Information Element specifies the observed length of the packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, and mplsPayloadPacketSection) when padding is used.

The packet section may be of a fixed size larger than the sectionExportedOctets. In this case, octets in the packet section beyond the sectionExportedOctets MUST follow the [RFC7011] rules for padding (i.e., be composed of zero (0) valued octets).

[RFC7011]

[RFC7133] 0 2014-01-11
411 dot1qServiceInstanceTag octetArray default current

This Information Element, which is 16 octets long, represents the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. It encodes the Backbone Service Instance Priority Code Point (I-PCP), Backbone Service Instance Drop Eligible Indicator (I-DEI), Use Customer Addresses (UCAs), Backbone Service Instance Identifier (I-SID), Encapsulated Customer Destination Address (C-DA), Encapsulated Customer Source Address (C-SA), and reserved fields. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q].

[IEEE802.1Q]

[RFC7133] 1 2014-05-02
412 dot1qServiceInstanceId unsigned32 identifier current

The value of the 24-bit Backbone Service Instance Identifier (I-SID) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].

0-0xFFFFFF

[IEEE802.1Q]

[RFC7133] 1 2014-05-02
413 dot1qServiceInstancePriority unsigned8 identifier current

The value of the 3-bit Backbone Service Instance Priority Code Point (I-PCP) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].

0-7

[IEEE802.1Q]

[RFC7133] 1 2014-05-02
414 dot1qCustomerSourceMacAddress macAddress default current

The value of the Encapsulated Customer Source Address (C-SA) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].

[IEEE802.1Q]

[RFC7133] 1 2014-05-02
415 dot1qCustomerDestinationMacAddress macAddress default current

The value of the Encapsulated Customer Destination Address (C-DA) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].

[IEEE802.1Q]

[RFC7133] 1 2014-05-02
416 deprecated

Duplicate of Information Element ID 352, layer2OctetDeltaCount.

[RFC5477]

2 2014-05-13
417 postLayer2OctetDeltaCount unsigned64 deltaCounter current

The definition of this Information Element is identical to the definition of the layer2OctetDeltaCount Information Element, except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

This Information Element is the layer 2 version of postOctetDeltaCount (ElementId #23).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
418 postMCastLayer2OctetDeltaCount unsigned64 deltaCounter current

The number of layer 2 octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point but may be retrieved by other means. The number of octets includes layer 2 header(s) and layer 2 payload.

This Information Element is the layer 2 version of postMCastOctetDeltaCount (ElementId #20).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
419 deprecated

Duplicate of Information Element ID 353, layer2OctetTotalCount.

[RFC5477]

2 2014-05-13
420 postLayer2OctetTotalCount unsigned64 totalCounter current

The definition of this Information Element is identical to the definition of the layer2OctetTotalCount Information Element, except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.

This Information Element is the layer 2 version of postOctetTotalCount (ElementId #171).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
421 postMCastLayer2OctetTotalCount unsigned64 totalCounter current

The total number of layer 2 octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point but may be retrieved by other means. The number of octets includes layer 2 header(s) and layer 2 payload.

This Information Element is the layer 2 version of postMCastOctetTotalCount (ElementId #175).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
422 minimumLayer2TotalLength unsigned64 current

Layer 2 length of the smallest packet observed for this Flow. The packet length includes the length of the layer 2 header(s) and the length of the layer 2 payload.

This Information Element is the layer 2 version of minimumIpTotalLength (ElementId #25).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
423 maximumLayer2TotalLength unsigned64 current

Layer 2 length of the largest packet observed for this Flow. The packet length includes the length of the layer 2 header(s) and the length of the layer 2 payload.

This Information Element is the layer 2 version of maximumIpTotalLength (ElementId #26).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
424 droppedLayer2OctetDeltaCount unsigned64 deltaCounter current

The number of layer 2 octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of octets includes layer 2 header(s) and layer 2 payload.

This Information Element is the layer 2 version of droppedOctetDeltaCount (ElementId #132).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
425 droppedLayer2OctetTotalCount unsigned64 totalCounter current

The total number of octets in observed layer 2 packets (including the layer 2 header) that were dropped by packet treatment since the (re-)initialization of the Metering Process.

This Information Element is the layer 2 version of droppedOctetTotalCount (ElementId #134).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
426 ignoredLayer2OctetTotalCount unsigned64 totalCounter current

The total number of octets in observed layer 2 packets (including the layer 2 header) that the Metering Process did not process since the (re-)initialization of the Metering Process.

This Information Element is the layer 2 version of ignoredOctetTotalCount (ElementId #165).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
427 notSentLayer2OctetTotalCount unsigned64 totalCounter current

The total number of octets in observed layer 2 packets (including the layer 2 header) that the Metering Process did not process since the (re-)initialization of the Metering Process.

This Information Element is the layer 2 version of notSentOctetTotalCount (ElementId #168).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
428 layer2OctetDeltaSumOfSquares unsigned64 deltaCounter current

The sum of the squared numbers of layer 2 octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload.

This Information Element is the layer 2 version of octetDeltaSumOfSquares (ElementId #198).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
429 layer2OctetTotalSumOfSquares unsigned64 totalCounter current

The total sum of the squared numbers of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload.

This Information Element is the layer 2 version of octetTotalSumOfSquares (ElementId #199).

octets

[RFC5477]

[RFC7133] 1 2014-05-02
430 layer2FrameDeltaCount unsigned64 deltaCounter current

The number of incoming layer 2 frames since the previous report (if any) for this Flow at the Observation Point.

frames [ipfix-iana_at_cisco.com] 0 2014-05-02
431 layer2FrameTotalCount unsigned64 totalCounter current

The total number of incoming layer 2 frames for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.

frames [ipfix-iana_at_cisco.com] 0 2014-05-02
432 pseudoWireDestinationIPv4Address ipv4Address default current

The destination IPv4 address of the PSN tunnel carrying the pseudowire.

[RFC3985]

[ipfix-iana_at_cisco.com] 0 2014-05-28
433 ignoredLayer2FrameTotalCount unsigned64 totalCounter current

The total number of observed layer 2 frames that the Metering Process did not process since the (re-)initialization of the Metering Process. This Information Element is the layer 2 version of ignoredPacketTotalCount (ElementId #164).

frames [ipfix-iana_at_cisco.com] 0 2014-06-27
434 mibObjectValueInteger signed32 quantity current

An IPFIX Information Element that denotes that the integer value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of Integer32 and INTEGER with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of signed32.

[RFC8038] 1 2017-04-30
435 mibObjectValueOctetString octetArray default current

An IPFIX Information Element that denotes that an Octet String or Opaque value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of OCTET STRING and Opaque. The value is encoded as per the standard IPFIX Abstract Data Type of octetArray.

[RFC8038] 0 2015-12-13
436 mibObjectValueOID octetArray default current

An IPFIX Information Element that denotes that an Object Identifier or OID value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of OBJECT IDENTIFIER. Note: In this case, the "mibObjectIdentifier" defines which MIB object is being exported, and the "mibObjectValueOID" field will contain the OID value of that MIB object. The mibObjectValueOID Information Element is encoded as ASN.1/BER [X.690] in an octetArray.

[RFC8038] 0 2015-12-13
437 mibObjectValueBits octetArray flags current

An IPFIX Information Element that denotes that a set of Enumerated flags or bits from a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of BITS. The flags or bits are encoded as per the standard IPFIX Abstract Data Type of octetArray, with sufficient length to accommodate the required number of bits. If the number of bits is not an integer multiple of octets, then the most significant bits at the end of the octetArray MUST be set to 0.

[RFC8038] 0 2015-12-13
438 mibObjectValueIPAddress ipv4Address default current

An IPFIX Information Element that denotes that the IPv4 address value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of IpAddress. The value is encoded as per the standard IPFIX Abstract Data Type of ipv4Address.

[RFC8038] 0 2015-12-13
439 mibObjectValueCounter unsigned64 snmpCounter current

An IPFIX Information Element that denotes that the counter value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of Counter32 or Counter64 with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned64.

[RFC8038] 0 2015-12-13
440 mibObjectValueGauge unsigned32 snmpGauge current

An IPFIX Information Element that denotes that the Gauge value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of Gauge32. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32. This value represents a non-negative integer that may increase or decrease but that shall never exceed a maximum value or fall below a minimum value.

[RFC8038] 0 2015-12-13
441 mibObjectValueTimeTicks unsigned32 quantity current

An IPFIX Information Element that denotes that the TimeTicks value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of TimeTicks. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32.

[RFC8038] 1 2017-04-30
442 mibObjectValueUnsigned unsigned32 quantity current

An IPFIX Information Element that denotes that an unsigned integer value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of unsigned32 with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32.

[RFC8038] 1 2017-04-30
443 mibObjectValueTable subTemplateList list current

An IPFIX Information Element that denotes that a complete or partial conceptual table will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with a syntax of SEQUENCE OF. This is encoded as a subTemplateList of mibObjectValue Information Elements. The Template specified in the subTemplateList MUST be an Options Template and MUST include all the objects listed in the INDEX clause as Scope Fields.

[RFC8038] 1 2017-04-30
444 mibObjectValueRow subTemplateList list current

An IPFIX Information Element that denotes that a single row of a conceptual table will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with a syntax of SEQUENCE. This is encoded as a subTemplateList of mibObjectValue Information Elements. The subTemplateList exported MUST contain exactly one row (i.e., one instance of the subTemplate). The Template specified in the subTemplateList MUST be an Options Template and MUST include all the objects listed in the INDEX clause as Scope Fields.

[RFC8038] 0 2015-12-13
445 mibObjectIdentifier octetArray default current

An IPFIX Information Element that denotes that a MIB Object Identifier (MIB OID) is exported in the (Options) Template Record. The mibObjectIdentifier Information Element contains the OID assigned to the MIB object type definition encoded as ASN.1/BER [X.690].

[RFC8038] 0 2015-12-13
446 mibSubIdentifier unsigned32 identifier current

A non-negative sub-identifier of an Object Identifier (OID).

[RFC8038] 0 2015-12-13
447 mibIndexIndicator unsigned64 flags current

A set of bit fields that is used for marking the Information Elements of a Data Record that serve as INDEX MIB objects for an indexed columnar MIB object. Each bit represents an Information Element in the Data Record, with the n-th least significant bit representing the n-th Information Element. A bit set to 1 indicates that the corresponding Information Element is an index of the columnar object represented by the mibObjectValue. A bit set to 0 indicates that this is not the case.

If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all index fields are among the first 64 Information Elements, because the mibIndexIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the extra bits in the mibIndexIndicator for which no corresponding Information Element exists MUST have the value 0 and must be disregarded by the Collector. This Information Element may be exported with IPFIX reduced-size encoding.

[RFC8038] 0 2015-12-13
448 mibCaptureTimeSemantics unsigned8 identifier current

Indicates when in the lifetime of the Flow the MIB value was retrieved from the MIB for a mibObjectIdentifier. This is used to indicate if the value exported was collected from the MIB closer to Flow creation or Flow export time and refers to the Timestamp fields included in the same Data Record. This field SHOULD be used when exporting a mibObjectValue that specifies counters or statistics.

If the MIB value was sampled by SNMP prior to the IPFIX Metering Process or Exporting Process retrieving the value (i.e., the data is already stale) and it is important to know the exact sampling time, then an additional observationTime* element should be paired with the OID using IPFIX Structured Data [RFC6313]. Similarly, if different MIB capture times apply to different mibObjectValue elements within the Data Record, then individual mibCaptureTimeSemantics Information Elements should be paired with each OID using IPFIX Structured Data.

Values are listed in the mibCaptureTimeSemantics registry. See [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-mib-capture-time-semantics].

[RFC8038] 0 2015-12-13
449 mibContextEngineID octetArray default current

A mibContextEngineID that specifies the SNMP engine ID for a MIB field being exported over IPFIX. Definition as per [RFC3411], Section 3.3.

[RFC8038] 0 2015-12-13
450 mibContextName string default current

An Information Element that denotes that a MIB context name is specified for a MIB field being exported over IPFIX. Reference [RFC3411], Section 3.3.

[RFC8038] 0 2015-12-13
451 mibObjectName string default current

The name (called a descriptor in [RFC2578] of an object type definition.

[RFC8038] 0 2015-12-13
452 mibObjectDescription string default current

The value of the DESCRIPTION clause of a MIB object type definition.

[RFC8038] 0 2015-12-13
453 mibObjectSyntax string default current

The value of the SYNTAX clause of a MIB object type definition, which may include a textual convention or sub-typing. See [RFC2578].

[RFC8038] 0 2015-12-13
454 mibModuleName string default current

The textual name of the MIB module that defines a MIB object.

[RFC8038] 0 2015-12-13
455 mobileIMSI string default current

The International Mobile Subscription Identity (IMSI). The IMSI is a decimal digit string with up to a maximum of 15 ASCII/UTF-8 encoded digits (0x30 - 0x39).

[3GPP TS 23.003] Section 3 and [ITU-T E.164].

[ipfix-iana_at_cisco.com] 0 2015-12-15
456 mobileMSISDN string default current

The Mobile Station International Subscriber Directory Number (MSISDN). The MSISDN is a decimal digit string with up to a maximum of 15 ASCII/UTF-8 encoded digits (0x30 - 0x39).

[3GPP TS 23.003] Section 3 and [ITU-T E.164].

[ipfix-iana_at_cisco.com] 0 2015-12-15
457 httpStatusCode unsigned16 identifier current

The HTTP Response Status Code, as defined in section 6 of [RFC7231], associated with a flow. Implies that the flow record represents a flow containing an HTTP Response.

0-999

[RFC7231]

[Andrew_Feren] 0 2016-04-28
458 sourceTransportPortsLimit unsigned16 quantity current

This Information Element contains the maximum number of IP source transport ports that can be used by an end user when sending IP packets; each user is associated with one or more (source) IPv4 or IPv6 addresses. This Information Element is particularly useful in address-sharing deployments that adhere to REQ-4 of [RFC6888]. Limiting the number of ports assigned to each user ensures fairness among users and mitigates the denial-of-service attack that a user could launch against other users through the address-sharing device in order to grab more ports.

ports 1-65535 [RFC8045][RFC Errata 5009] 1 2017-08-01
459 httpRequestMethod string current

The HTTP request method, as defined in section 4 of [RFC7231], associated with a flow. String with up to 8 UTF-8 characters.

[Felix_Erlacher] 0 2016-11-15
460 httpRequestHost string current

The HTTP request host, as defined in section 5.4 of [RFC7230] or, in the case of HTTP/2, the content of the :authority pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8.

[Felix_Erlacher] 0 2016-11-15
461 httpRequestTarget string current

The HTTP request target, as defined in section 2 of [RFC7231] and in section 5.3 of [RFC7230], associated with a flow. Or the HTTP/2 ":path" pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8.

[Felix_Erlacher] 0 2016-11-15
462 httpMessageVersion string current

The version of an HTTP/1.1 message as indicated by the HTTP-version field, defined in section 2.6 of [RFC7230], or the version identification of an HTTP/2 frame as defined in [RFC7240] section 3.1. The length of this field is limited to 10 characters, UTF-8 encoded.

[Felix_Erlacher] 0 2016-11-15
463 natInstanceID unsigned32 identifier current

This Information Element uniquely identifies an Instance of the NAT that runs on a NAT middlebox function after the packet passes the Observation Point. natInstanceID is defined in [RFC7659].

See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-03-15
464 internalAddressRealm octetArray identifier current

This Information Element represents the internal address realm where the packet is originated from or destined to. By definition, a NAT mapping can be created from two address realms, one from internal and one from external. Realms are implementation dependent and can represent a Virtual Routing and Forwarding (VRF) ID, a VLAN ID, or some unique identifier. Realms are optional and, when left unspecified, would mean that the external and internal realms are the same.

See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-03-15
465 externalAddressRealm octetArray identifier current

This Information Element represents the external address realm where the packet is originated from or destined to. The detailed definition is in the internal address realm as specified above.

See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-03-15
466 natQuotaExceededEvent unsigned32 identifier current

This Information Element identifies the type of a NAT Quota Exceeded event. Values for this Information Element are listed in the "NAT Quota Exceeded Event Type" registry, see [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-quota-exceeded-event].

See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-03-15
467 natThresholdEvent unsigned32 identifier current

This Information Element identifies a type of a NAT Threshold event. Values for this Information Element are listed in the "NAT Threshold Event Type" registry, see [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-threshold-event].

See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-03-15
468 httpUserAgent string default current

The HTTP User-Agent header field as defined in section 5.5.3 of [RFC7231]. Encoded in UTF-8.

[RFC7231]

[Andrew_Feren] 0 2017-04-19
469 httpContentType string default current

The HTTP Content-Type header field as defined in section 3.1.1.5 of [RFC7231]. Encoded in UTF-8.

[RFC7231]

[Andrew_Feren] 0 2017-04-19
470 httpReasonPhrase string default current

The HTTP reason phrase as defined in section 6.1 of of [RFC7231].

[RFC7231]

[Felix_Erlacher] 0 2017-06-19
471 maxSessionEntries unsigned32 identifier current

This element represents the maximum session entries that can be created by the NAT device.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
472 maxBIBEntries unsigned32 identifier current

This element represents the maximum BIB entries that can be created by the NAT device.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
473 maxEntriesPerUser unsigned32 identifier current

This element represents the maximum NAT entries that can be created per user by the NAT device.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
474 maxSubscribers unsigned32 identifier current

This element represents the maximum subscribers or maximum hosts that are allowed by the NAT device.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
475 maxFragmentsPendingReassembly unsigned32 identifier current

This element represents the maximum fragments that the NAT device can store for reassembling the packet.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
476 addressPoolHighThreshold unsigned32 identifier current

This element represents the high threshold value of the number of public IP addresses in the address pool.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
477 addressPoolLowThreshold unsigned32 identifier current

This element represents the low threshold value of the number of public IP addresses in the address pool.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
478 addressPortMappingHighThreshold unsigned32 identifier current

This element represents the high threshold value of the number of address and port mappings.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
479 addressPortMappingLowThreshold unsigned32 identifier current

This element represents the low threshold value of the number of address and port mappings.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
480 addressPortMappingPerUserHighThreshold unsigned32 identifier current

This element represents the high threshold value of the number of address and port mappings that a single user is allowed to create on a NAT device.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.

[RFC8158] 0 2017-12-01
481 globalAddressMappingHighThreshold unsigned32 identifier current

This element represents the high threshold value of the number of address and port mappings that a single user is allowed to create on a NAT device in a paired address pooling behavior.

See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes. See [RFC4787] for the definition of paired address pooling behavior.

[RFC8158] 0 2017-12-01
482 vpnIdentifier octetArray default current

VPN ID in the format specified by [RFC2685]. The size of this Information Element is 7 octets.

[RFC2685]

[ipfix-iana_at_cisco.com] 0 2018-07-10
483 bgpCommunity unsigned32 identifier current

BGP community as defined in [RFC1997]

[RFC1997]

[RFC8549] 0 2019-01-18
484 bgpSourceCommunityList basicList list current

basicList of zero or more bgpCommunity IEs, containing the BGP communities corresponding with source IP address of a specific flow

[RFC6313] [RFC1997]

[RFC8549] 0 2019-01-18
485 bgpDestinationCommunityList basicList list current

basicList of zero or more bgpCommunity IEs, containing the BGP communities corresponding with destination IP address of a specific flow

[RFC6313] [RFC1997]

[RFC8549] 0 2019-01-18
486 bgpExtendedCommunity octetArray default current

BGP Extended Community as defined in [RFC4360]; the size of this IE MUST be 8 octets

[RFC4360]

[RFC8549] 0 2019-01-18
487 bgpSourceExtendedCommunityList basicList list current

basicList of zero or more bgpExtendedCommunity IEs, containing the BGP Extended Communities corresponding with source IP address of a specific flow

[RFC6313] [RFC4360]

[RFC8549] 0 2019-01-18
488 bgpDestinationExtendedCommunityList basicList list current

basicList of zero or more bgpExtendedCommunity IEs, containing the BGP Extended Communities corresponding with destination IP address of a specific flow

[RFC6313] [RFC4360]

[RFC8549] 0 2019-01-18
489 bgpLargeCommunity octetArray default current

BGP Large Community as defined in [RFC8092]; the size of this IE MUST be 12 octets.

[RFC8092]

[RFC8549] 0 2019-01-18
490 bgpSourceLargeCommunityList basicList list current

basicList of zero or more bgpLargeCommunity IEs, containing the BGP Large Communities corresponding with source IP address of a specific flow

[RFC6313] [RFC8092]

[RFC8549] 0 2019-01-18
491 bgpDestinationLargeCommunityList basicList list current

basicList of zero or more bgpLargeCommunity IEs, containing the BGP Large Communities corresponding with destination IP address of a specific flow

[RFC6313] [RFC8092]

[RFC8549] 0 2019-01-18
492 srhFlagsIPv6 unsigned8 flags current

The 8-bit Flags field defined in the SRH (Section 2 of [RFC8754]). Assigned flags and their meanings are provided in the ["Segment Routing Header Flags"] IANA registry.

See the assignments in the "Segment Routing Header Flags" registry at [https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml#segment-routing-header-flags]. See also [RFC8754] for the SRH specification.

[RFC9487] 0 2023-06-08
493 srhTagIPv6 unsigned16 identifier current

The 16-bit Tag field defined in the SRH (Section 2 of [RFC8754]). A tag is used to mark a packet as part of a class or group of packets sharing the same set of properties.

See Section 2 of [RFC8754] for more details about the Tag.

[RFC9487] 0 2023-06-08
494 srhSegmentIPv6 ipv6Address default current

The 128-bit IPv6 address that represents an SRv6 segment.

Specified in Section 1 of [RFC8402] and mentioned in "Segment List" in Section 2 of [RFC8754].

[RFC9487] 0 2023-06-08
495 srhActiveSegmentIPv6 ipv6Address default current

The 128-bit IPv6 address that represents the active SRv6 segment.

See Section 2 of [RFC8402] for the definition of "active segment".

[RFC9487] 0 2023-06-08
496 srhSegmentIPv6BasicList basicList list current

The ordered basicList [RFC6313] of zero or more 128-bit IPv6 addresses in the SRH that represents the SRv6 Segment List. As specified in Section 2 of [RFC8754], the Segment List is encoded starting from the last segment of the SR Policy. That is, the first element of the Segment List (Segment List[0]) contains the last segment of the SR Policy, the second element contains the penultimate segment of the SR Policy, and so on.

See Section 2 of [RFC8754] for more details about the SRv6 Segment List.

[RFC9487] 0 2023-06-08
497 srhSegmentIPv6ListSection octetArray default current

The SRv6 Segment List as defined in Section 2 of [RFC8754] as a series of octets in IPFIX.

See Section 2 of [RFC8754] for more details about the SRv6 Segment List.

[RFC9487] 0 2023-06-08
498 srhSegmentsIPv6Left unsigned8 quantity current

The 8-bit unsigned integer defining the number of segments remaining to reach the end of the Segment List from the SRH.

Specified by the "Segments Left" field in Section 4.4 of [RFC8200] and mentioned in Section 2 of [RFC8754].

[RFC9487] 0 2023-06-08
499 srhIPv6Section octetArray default current

The SRH and its TLVs as defined in Section 2 of [RFC8754] as a series of octets in IPFIX.

See Section 2 of [RFC8754] for more details about the structure of an SRH.

[RFC9487] 0 2023-06-08
500 srhIPv6ActiveSegmentType unsigned8 identifier current

The designator of the routing protocol or PCEP extension where the active SRv6 segment has been learned from. Values for this Information Element are listed in the "IPFIX IPv6 SRH Segment Type (Value 500)” subregistry; see [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-ipv6-srh-segment-type].

See the assigned types in the "IPFIX IPv6 SRH Segment (Value 500)" registry at [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-ipv6-srh-segment-type].

[RFC9487] 0 2023-06-08
501 srhSegmentIPv6LocatorLength unsigned8 default current

The length of the SRH segment IPv6 locator specified as the number of significant bits. Together with srhSegmentIPv6, it enables the calculation of the SRv6 Locator.

See Section 3.1 of [RFC8986] for more details about the SID format.

[RFC9487][RFC Errata 7728] 1 2024-01-22
502 srhSegmentIPv6EndpointBehavior unsigned16 identifier current

The 16-bit unsigned integer that represents an SRv6 Endpoint behavior as per Section 4 of [RFC8986]. Assigned values and their meanings are provided in the ["SRV6 Endpoint Behaviors"] registry.

See the assigned behaviors in the "SRv6 Endpoint Behaviors" registry at [https://www.iana.org/assignments/segment-routing/segment-routing.xhtml#srv6-endpoint-behaviors]. See Section 4 of [RFC8986] for more details about the processing of endpoint behaviors.

[RFC9487] 0 2023-06-08
503-32767 Unassigned

IPFIX MPLS label type (Value 46)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7012]
Available Formats

CSV
Value Description Reference
0 Unknown: The MPLS label type is not known. [RFC3954][ipfix-iana_at_cisco.com]
1 TE-MIDPT: Any TE tunnel mid-point or tail label [RFC5102]
2 Pseudowire: Any PWE3 or Cisco AToM based label [RFC5102]
3 VPN: Any label associated with VPN [RFC5102][RFC4364]
4 BGP: Any label associated with BGP or BGP routing [RFC5102][RFC4271]
5 LDP: Any label associated with dynamically assigned labels using LDP [RFC5102][RFC5036]
6 Path Computation Element [RFC9160][RFC8664]
7 OSPFv2 Segment Routing [RFC9160][RFC8665]
8 OSPFv3 Segment Routing [RFC9160][RFC8666]
9 IS-IS Segment Routing [RFC9160][RFC8667]
10 BGP Segment Routing Prefix-SID [RFC9160][RFC8669]
11-255 Unassigned

Forwarding Status (Value 89)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7270]
Available Formats

CSV
Value Description Reference
00b Unknown [RFC7270]
01b Forwarded [RFC7270]
10b Dropped [RFC7270]
11b Consumed [RFC7270]

Status 00b: Unknown

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7270]
Available Formats

CSV
Binary Hex Description Reference
0x00-0x3F Unassigned

Status 01b: Forwarded

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7270]
Available Formats

CSV
Binary Hex Description Reference
01 000000b 0x40 Unknown [RFC7270]
01 000001b 0x41 Fragmented [RFC7270]
01 000010b 0x42 Not Fragmented [RFC7270]
01 000011b 0x43 Tunneled [Alfred_Nothaft]
0x44-0x7F Unassigned

Status 10b: Dropped

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7270]
Available Formats

CSV
Binary Hex Description Reference
10 000000b 0x80 Unknown [RFC7270]
10 000001b 0x81 ACL deny [RFC7270]
10 000010b 0x82 ACL drop [RFC7270]
10 000011b 0x83 Unroutable [RFC7270]
10 000100b 0x84 Adjacency [RFC7270]
10 000101b 0x85 Fragmentation and DF set [RFC7270]
10 000110b 0x86 Bad header checksum [RFC7270]
10 000111b 0x87 Bad total Length [RFC7270]
10 001000b 0x88 Bad header length [RFC7270]
10 001001b 0x89 bad TTL [RFC7270]
10 001010b 0x8A Policer [RFC7270]
10 001011b 0x8B WRED [RFC7270]
10 001100b 0x8C RPF [RFC7270]
10 001101b 0x8D For us [RFC7270]
10 001110b 0x8E Bad output interface [RFC7270]
10 001111b 0x8F Hardware [RFC7270]
0x90-0xBF Unassigned

Status 11b: Consumed

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7270]
Available Formats

CSV
Binary Hex Description Reference
11 000000b 0xC0 Unknown [RFC7270]
11 000001b 0xC1 Punt Adjacency [RFC7270]
11 000010b 0xC2 Incomplete Adjacency [RFC7270]
11 000011b 0xC3 For us [RFC7270]
0xC4-0xFF Unassigned

Classification Engine IDs (Value 101)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC6759]
Available Formats

CSV
Value Description Default Length Reference
0 Invalid. [RFC6759]
1 IANA-L3: The Assigned Internet Protocol Number (layer 3 (L3)) is exported in the Selector ID. See [https://www.iana.org/assignments/protocol-numbers]. 1 [RFC6759]
2 PANA-L3: Proprietary layer 3 definition. An enterprise can export its own layer 3 protocol numbers. The Selector ID has a global significance for all devices from the same enterprise. 1 [RFC6759]
3 IANA-L4: The IANA layer 4 (L4) well-known port number is exported in the Selector ID. See [https://www.iana.org/assignments/service-names-port-numbers]. Note: as an IPFIX flow is unidirectional, it contains the destination port in a flow from the client to the server. 2 [RFC6759]
4 PANA-L4: Proprietary layer 4 definition. An enterprise can export its own layer 4 port numbers. The Selector ID has global significance for devices from the same enterprise. Example: IPFIX had the port 4739 pre-assigned in the IETF draft for years. While waiting for the RFC and its associated IANA registration, the Selector ID 4739 was used with this PANA-L4. 2 [RFC6759]
5 Reserved [RFC6759]
6 USER-Defined: The Selector ID represents applications defined by the user (using CLI, GUI, etc.) based on the methods described in section 2. The Selector ID has a local significance per device. 3 [RFC6759]
7 Reserved [RFC6759]
8 Reserved [RFC6759]
9 Reserved [RFC6759]
10 Reserved [RFC6759]
11 Reserved [RFC6759]
12 PANA-L2: Proprietary layer 2 (L2) definition. An enterprise can export its own layer 2 identifiers. The Selector ID represents the enterprise's unique global layer 2 applications. The Selector ID has a global significance for all devices from the same enterprise. Examples include Cisco Subnetwork Access Protocol (SNAP). 5 [RFC6759]
13 PANA-L7: Proprietary layer 7 definition. The Selector ID represents the enterprise's unique global ID for the layer 7 applications. The Selector ID has a global significance for all devices from the same enterprise. This Classification Engine Id is used when the application registry is owned by the Exporter manufacturer (referred to as the "enterprise" in this document). 3 [RFC6759]
14 Reserved [RFC6759]
15 Reserved [RFC6759]
16 Reserved [RFC6759]
17 Reserved [RFC6759]
18 ETHERTYPE: The Selector ID represents the well- known Ethertype. See [http://standards.ieee.org/develop/regauth/ethertype/eth.txt]. Note that the Ethertype is usually expressed in hexadecimal. However, the corresponding decimal value is used in this Selector ID. 2 [RFC6759]
19 LLC: The Selector ID represents the well-known IEEE 802.2 Link Layer Control (LLC) Destination Service Access Point (DSAP). See [http://standards.ieee.org/develop/regauth/llc/public.html]. Note that LLC DSAP is usually expressed in hexadecimal. However, the corresponding decimal value is used in this Selector ID. 1 [RFC6759]
20 PANA-L7-PEN: Proprietary layer 7 definition, including a Private Enterprise Number (PEN) [https://www.iana.org/assignments/enterprise-numbers] to identify that the application registry being used is not owned by the Exporter manufacturer or to identify the original enterprise in the case of a mediator or 3rd party device. The Selector ID represents the enterprise unique global ID for the layer 7 applications. The Selector ID has a global significance for all devices from the same enterprise. 3 [RFC6759]
21 The Selector ID contains an application ID from the Qosmos ixEngine. 4 [Paul_Aitken][Qosmos]
22 The Selector ID contains a protocol from the ntop nDPI engine. 2 [Paul_Aitken][https://www.ntop.org/products/deep-packet-inspection/ndpi]
23 R&S ipoque DPI PACE2 engine 2 [Tim_Kittel][https://www.ipoque.com/products/dpi-engine-rs-pace-2-for-application-awareness]
24 R&S ipoque DPI vPACE engine 2 [Tim_Kittel][https://www.ipoque.com/products/dpi-engine-rs-pace-2-for-application-awareness]

flowEndReason (Value 136)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC5102]
Available Formats

CSV
Value Name Description Reference
0x00 Reserved [RFC5102]
0x01 idle timeout The Flow was terminated because it was considered to be idle. [RFC5102]
0x02 active timeout The Flow was terminated for reporting purposes while it was still active, for example, after the maximum lifetime of unreported Flows was reached. [RFC5102]
0x03 end of Flow detected The Flow was terminated because the Metering Process detected signals indicating the end of the Flow, for example, the TCP FIN flag. [RFC5102]
0x04 forced end The Flow was terminated because of some external event, for example, a shutdown of the Metering Process initiated by a network management application. [RFC5102]
0x05 lack of resources The Flow was terminated because of lack of resources available to the Metering Process and/or the Exporting Process. [RFC5102]
0x06-0xFF Unassigned

natOriginatingAddressRealm (Value 229)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[ipfix-iana_at_cisco.com]
Available Formats

CSV
Value Description Reference
1 Private [ipfix-iana_at_cisco.com]
2 Private [ipfix-iana_at_cisco.com]
3-255 Unassigned

NAT Event Type (Value 230)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC8158]
Available Formats

CSV
Value Event Name Reference
0 Reserved [RFC8158]
1 NAT translation create (Historic) [RFC8158]
2 NAT translation delete (Historic) [RFC8158]
3 NAT Addresses exhausted [RFC8158]
4 NAT44 session create [RFC8158]
5 NAT44 session delete [RFC8158]
6 NAT64 session create [RFC8158]
7 NAT64 session delete [RFC8158]
8 NAT44 BIB create [RFC8158]
9 NAT44 BIB delete [RFC8158]
10 NAT64 BIB create [RFC8158]
11 NAT64 BIB delete [RFC8158]
12 NAT ports exhausted [RFC8158]
13 Quota Exceeded [RFC8158]
14 Address binding create [RFC8158]
15 Address binding delete [RFC8158]
16 Port block allocation [RFC8158]
17 Port block de-allocation [RFC8158]
18 Threshold Reached [RFC8158]

firewallEvent (Value 233)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[ipfix-iana_at_cisco.com]
Available Formats

CSV
Value Description Reference
0 Ignore (invalid) [ipfix-iana_at_cisco.com]
1 Flow Created [ipfix-iana_at_cisco.com]
2 Flow Deleted [ipfix-iana_at_cisco.com]
3 Flow Denied [ipfix-iana_at_cisco.com]
4 Flow Alert [ipfix-iana_at_cisco.com]
5 Flow Update [ipfix-iana_at_cisco.com]
6-255 Unassigned

biflowDirection (Value 239)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC5103]
Available Formats

CSV
Value Name Description Reference
0x00 arbitrary Direction was assigned arbitrarily. [RFC5103]
0x01 initiator The Biflow Source is the flow initiator, as determined by the Metering Process' best effort to detect the initiator. [RFC5103]
0x02 reverseInitiator The Biflow Destination is the flow initiator, as determined by the Metering Process' best effort to detect the initiator. This value is provided for the convenience of Exporting Processes to revise an initiator estimate without re-encoding the Biflow Record. [RFC5103]
0x03 perimeter The Biflow Source is the endpoint outside of a defined perimeter. The perimeter's definition is implicit in the set of Biflow Source and Biflow Destination addresses exported in the Biflow Records. [RFC5103]
0x04-0xFF Unassigned

observationPointType (Value 277)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[ipfix-iana_at_cisco.com]
Available Formats

CSV
Value Description Reference
1 Physical port [ipfix-iana_at_cisco.com]
2 Port channel [ipfix-iana_at_cisco.com]
3 Vlan [ipfix-iana_at_cisco.com]
4-255 Unassigned

anonymizationTechnique (Value 286)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC6235]
Available Formats

CSV
Value Name Description Applicable to Recommended for Reference
0 Undefined The Exporting Process makes no representation as to whether the defined field is anonymized or not. While the Collecting Process MAY assume that the field is not anonymized, it is not guaranteed not to be. This is the default anonymization technique. all all [RFC6235]
1 None The values exported are real. all all [RFC6235]
2 Precision Degradation/Truncation The values exported are anonymized using simple precision degradation or truncation. The new precision or number of truncated bits is implicit in the exported data, and can be deduced by the Collecting Process. all all [RFC6235]
3 Binning The values exported are anonymized into bins. all all [RFC6235]
4 Enumeration The values exported are anonymized by enumeration. all timestamps [RFC6235]
5 Permutation The values exported are anonymized by permutation. all identifiers [RFC6235]
6 Structured Permutation The values exported are anonymized by permutation, preserving bit-level structure as appropriate; this represents prefix-preserving IP address anonymization or structured MAC address anonymization. all [RFC6235]
7 Reverse Truncation The values exported are anonymized using reverse truncation. The number of truncated bits is implicit in the exported data, and can be deduced by the Collecting Process. all [RFC6235]
8 Noise The values exported are anonymized by adding random noise to each value. non-identifiers counters [RFC6235]
9 Offset The values exported are anonymized by adding a single offset to all values. all timestamps [RFC6235]
10-65535 Unassigned

natType (Value 297)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[ipfix-iana_at_cisco.com]
Available Formats

CSV
Value Description Reference
0 unknown [ipfix-iana_at_cisco.com]
1 NAT44 translated [ipfix-iana_at_cisco.com]
2 NAT64 translated [ipfix-iana_at_cisco.com]
3 NAT46 translated [ipfix-iana_at_cisco.com]
4 IPv4-->IPv4 (no NAT) [ipfix-iana_at_cisco.com]
5 NAT66 translated [ipfix-iana_at_cisco.com]
6 IPv6-->IPv6 (no NAT) [ipfix-iana_at_cisco.com]
7-255 Unassigned

valueDistributionMethod (Value 384)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7015]
Available Formats

CSV
Value Name Description Reference
0 Unspecified The counters for an Original Flow are explicitly not distributed according to any other method defined for this Information Element; use for arbitrary distribution, or distribution algorithms not described by any other codepoint. [RFC7015]
1 Start Interval The counters for an Original Flow are added to the counters of the appropriate Aggregated Flow containing the start time of the Original Flow. This should be assumed the default if value distribution information is not available at a Collecting Process for an Aggregated Flow. [RFC7015]
2 End Interval The counters for an Original Flow are added to the counters of the appropriate Aggregated Flow containing the end time of the Original Flow. [RFC7015]
3 Mid Interval The counters for an Original Flow are added to the counters of a single appropriate Aggregated Flow containing some timestamp between start and end time of the Original Flow. [RFC7015]
4 Simple Uniform Distribution Each counter for an Original Flow is divided by the number of time intervals the Original Flow covers (i.e., of appropriate Aggregated Flows sharing the same Flow Key), and this number is added to each corresponding counter in each Aggregated Flow. [RFC7015]
5 Proportional Uniform Distribution Each counter for an Original Flow is divided by the number of time units the Original Flow covers, to derive a mean count rate. This mean count rate is then multiplied by the number of time units in the intersection of the duration of the Original Flow and the time interval of each Aggregated Flow. This is like simple uniform distribution, but accounts for the fractional portions of a time interval covered by an Original Flow in the first and last time interval. [RFC7015]
6 Simulated Process Each counter of the Original Flow is distributed among the intervals of the Aggregated Flows according to some function the Intermediate Aggregation Process uses based upon properties of Flows presumed to be like the Original Flow. This is essentially an assertion that the Intermediate Aggregation Process has no direct packet timing information but is nevertheless not using one of the other simpler distribution methods. The Intermediate Aggregation Process specifically makes no assertion as to the correctness of the simulation. [RFC7015]
7 Direct The Intermediate Aggregation Process has access to the original packet timings from the packets making up the Original Flow, and uses these to distribute or recalculate the counters. [RFC7015]
8-255 Unassigned

flowSelectorAlgorithm (Value 390)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7014]
Available Formats

CSV
ID Technique Parameters Reference
0 Unassigned
1 Systematic count-based Sampling flowSamplingInterval, flowSamplingSpacing [RFC7014]
2 Systematic time-based Sampling flowSamplingTimeInterval, flowSamplingTimeSpacing [RFC7014]
3 Random n-out-of-N Sampling samplingSize, samplingPopulation [RFC7014]
4 Uniform probabilistic Sampling samplingProbability [RFC7014]
5 Property Match Filtering Information Element Value Range [RFC7014]
6 Hash-based Filtering using BOB hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, hashSelectedRangeMax, hashOutputRangeMin, hashOutputRangeMax [RFC7014]
7 Hash-based Filtering using IPSX hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, hashSelectedRangeMax, hashOutputRangeMin, hashOutputRangeMax [RFC7014]
8 Hash-based Filtering using CRC hashInitialiserValue, hashFlowDomain, hashSelectedRangeMin, hashSelectedRangeMax, hashOutputRangeMin, hashOutputRangeMax [RFC7014]
9 Flow-state Dependent Intermediate Flow Selection Process No agreed Parameters [RFC7014]

dataLinkFrameType (Value 408)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC7133]
Available Formats

CSV

mibCaptureTimeSemantics (Value 448)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC8038]
Available Formats

CSV
Value Name Description Reference
0 undefined [RFC8038]
1 begin The value for the MIB object is captured from the MIB when the Flow is first observed [RFC8038]
2 end The value for the MIB object is captured from the MIB when the Flow ends [RFC8038]
3 export The value for the MIB object is captured from the MIB at export time [RFC8038]
4 average The value for the MIB object is an average of multiple captures from the MIB over the observed life of the Flow [RFC8038]
5-255 Unassigned

NAT Quota Exceeded Event Type (Value 466)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC8158]
Available Formats

CSV
Value Quota Exceeded Event Name Reference
0 Reserved [RFC8158]
1 Maximum session entries [RFC8158]
2 Maximum BIB entries [RFC8158]
3 Maximum entries per user [RFC8158]
4 Maximum active hosts or subscribers [RFC8158]
5 Maximum fragments pending reassembly [RFC8158]

NAT Threshold Event Type (Value 467)

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC8158]
Available Formats

CSV
Value Threshold Exceeded Event Name Reference
0 Reserved [RFC8158]
1 Address pool high threshold event [RFC8158]
2 Address pool low threshold event [RFC8158]
3 Address and port mapping high threshold event [RFC8158]
4 Address and port mapping per user high threshold event [RFC8158]
5 Global Address mapping high threshold event [RFC8158]

IPFIX IPv6 SRH Segment Type (Value 500)

Registration Procedure(s)
Expert Review
Expert(s)
Thomas Graf, Pierre Francois, IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC9487]
Available Formats

CSV
Value Description Reference
0 Unknown [RFC9487]
1 Segment Routing Policy [RFC9487][RFC9256]
2 Path Computation Element [RFC9487][draft-ietf-pce-segment-routing-ipv6-16]
3 OSPFv3 Segment Routing [RFC9487][draft-ietf-lsr-ospfv3-srv6-extensions-14]
4 IS-IS Segment Routing [RFC9487][RFC9352]
5 BGP Segment Routing Prefix-SID [RFC9487][RFC8669]
6-255 Unassigned

IPFIX Version Numbers

Registration Procedure(s)
Standards Action
Reference
[RFC7011]
Available Formats

CSV
Value Version Reference
0 Reserved
1-8 Reserved (historic)
9 Cisco Systems NetFlow Version 9 (historic) [RFC3954]
10 IPFIX [RFC7011]
11-65535 Unassigned

IPFIX Set IDs

Registration Procedure(s)
Standards Action
Reference
[RFC7011]
Available Formats

CSV
Value Set Identifier Reference
0-1 Not used (historic) [RFC3954]
2 Template Set [RFC7011]
3 Options Template Set [RFC7011][RFC Errata 1818]
4-255 Unassigned
256-65535 Reserved for Data Sets [RFC7011]

IPFIX Information Element Data Types

Registration Procedure(s)
Standards Action
Reference
[RFC5610]
Available Formats

CSV
Value Description Reference
0 octetArray [RFC5102][RFC7011]
1 unsigned8 [RFC5102][RFC7011]
2 unsigned16 [RFC5102][RFC7011]
3 unsigned32 [RFC5102][RFC7011]
4 unsigned64 [RFC5102][RFC7011]
5 signed8 [RFC5102][RFC7011]
6 signed16 [RFC5102][RFC7011]
7 signed32 [RFC5102][RFC7011]
8 signed64 [RFC5102][RFC7011]
9 float32 [RFC5102][RFC7011]
10 float64 [RFC5102][RFC7011]
11 boolean [RFC5102][RFC7011]
12 macAddress [RFC5102][RFC7011]
13 string [RFC5102][RFC7011]
14 dateTimeSeconds [RFC5102][RFC7011]
15 dateTimeMilliseconds [RFC5102][RFC7011]
16 dateTimeMicroseconds [RFC5102][RFC7011]
17 dateTimeNanoseconds [RFC5102][RFC7011]
18 ipv4Address [RFC5102][RFC7011]
19 ipv6Address [RFC5102][RFC7011]
20 basicList [RFC6313][RFC7011]
21 subTemplateList [RFC6313][RFC7011]
22 subTemplateMultiList [RFC6313][RFC7011]
23-255 Unassigned

IPFIX Information Element Semantics

Registration Procedure(s)
Standards Action
Reference
[RFC5610]
Available Formats

CSV
Value Description Reference
0 default [RFC5610]
1 quantity [RFC5610]
2 totalCounter [RFC5610]
3 deltaCounter [RFC5610]
4 identifier [RFC5610]
5 flags [RFC5610]
6 list [RFC6313]
7 snmpCounter [RFC8038]
8 snmpGauge [RFC8038]
9-255 Unassigned

IPFIX Information Element Units

Registration Procedure(s)
Expert Review
Expert(s)
IE Doctors (Andrew Feren, Brian Trammell, Nevil Brownlee, Paul Aitken)
Reference
[RFC5610][RFC Errata 1822]
Available Formats

CSV
Value Name Notes Reference
0 none [RFC5610]
1 bits [RFC5610]
2 octets [RFC5610]
3 packets [RFC5610]
4 flows [RFC5610]
5 seconds [RFC5610]
6 milliseconds [RFC5610]
7 microseconds [RFC5610]
8 nanoseconds [RFC5610]
9 4-octet words For example, for IPv4 header length [RFC5610]
10 messages For example, for reliability reporting [RFC5610]
11 hops For example, for TTL [RFC5610]
12 entries For example, for MPLS label stack [RFC5610]
13 frames For example, Layer 2 frames [ipfix-iana_at_cisco.com]
14 ports [RFC8045]
15 inferred The units of the inferred Information Element [RFC5477]
16-65535 Unassigned

IPFIX Structured Data Types Semantics

Registration Procedure(s)
Standards Action
Reference
[RFC6313]
Available Formats

CSV
Value Name Description Reference
0x00 noneOf The "noneOf" structured data type semantic specifies that none of the elements are actual properties of the Data Record. [RFC6313]
0x01 exactlyOneOf The "exactlyOneOf" structured data type semantic specifies that only a single element from the structured data is an actual property of the Data Record. This is equivalent to a logical XOR operation. [RFC6313]
0x02 oneOrMoreOf The "oneOrMoreOf" structured data type semantic specifies that one or more elements from the list in the structured data are actual properties of the Data Record. This is equivalent to a logical OR operation. [RFC6313]
0x03 allOf The "allOf" structured data type semantic specifies that all of the list elements from the structured data are actual properties of the Data Record. [RFC6313]
0x04 ordered The "ordered" structured data type semantic specifies that elements from the list in the structured data are ordered. [RFC6313]
0x05-0xFE unassigned
0xFF undefined The "undefined" structured data type semantic specifies that the semantic of the list elements is not specified and that, if a semantic exists, then it is up to the Collecting Process to draw its own conclusions. The "undefined" structured data type semantic is the default structured data type semantic. [RFC6313]

Contact Information

ID Name Contact URI Last Updated
[Alfred_Nothaft] Alfred Nothaft mailto:alfred.nothaft&nokia.com 2018-02-12
[Andrew_Feren] Andrew Feren mailto:andrew.feren&plixer.com 2017-04-19
[Brian_Trammell] Brian Trammell mailto:brian&trammell.ch 2013-08-01
[Felix_Erlacher] Felix Erlacher mailto:felix.erlacher&ccs-labs.org 2017-06-19
[ipfix-iana_at_cisco.com] ipfix-iana at cisco.com mailto:ipfix-iana&cisco.com 2013-04-11
[Paul_Aitken] Paul Aitken mailto:paul.aitken&att.com 2018-02-12
[Qosmos] Qosmos http://www.qosmos.com 2017-02-21
[Tim_Kittel] Tim Kittel mailto:tim.kittel&rohde-schwarz.com 2022-02-04
[Yaakov_J_Stein] Yaakov (J) Stein mailto:yaakov_s&rad.com 2013-04-11