IP Flow Information Export (IPFIX) Information Elements Created 2007-05-10 Last Updated 2010-02-11 This registry is also available in XML and plain text formats. Registries included below * IPFIX Information Elements * IPFIX MPLS label type (Value 46) * IPFIX Version Numbers * IPFIX Set IDs * IPFIX informationElementDataTypes * IPFIX informationElementSemantics * IPFIX informationElementUnits IPFIX Information Elements Reference [RFC5102] Range Registration Procedures Notes 0 Reserved 1-127 Expert Review Information Element identifiers compatible with NetFlow version 9 field types [RFC3954]. 128-32767 Expert Review Further Information Element identifiers. Note New assignments for IPFIX Information Elements will be administered by IANA, on a First Come First Served basis [RFC2434], subject to Expert Review [RFC2434], i.e. review by one of a group of experts designated by an IETF Operations and Management Area Director. Value Name Data Type Data Type Status Description Units Range References Requester Semantics The number of octets since the previous report (if any) in incoming 1 octetDeltaCount unsigned64 deltaCounter current packets for this Flow at the Observation Point. The number of octets octets [RFC5102] includes IP header(s) and IP payload. 2 packetDeltaCount unsigned64 deltaCounter current The number of incoming packets since the previous report (if any) for packets [RFC5102] this Flow at the Observation Point. 3 Reserved [RFC5102] The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are See [RFC791] for the specification of the IPv4 defined in the IANA Protocol Numbers registry. protocol field. See [RFC2460] for the specification of 4 protocolIdentifier unsigned8 identifier current the IPv6 protocol field. See the list of protocol [RFC5102] In Internet Protocol version 4 (IPv4), this is carried in the Protocol numbers assigned by IANA at [IANA registry field. In Internet Protocol version 6 (IPv6), this is carried in the protocol-numbers]. Next Header field in the last extension header of the packet. For IPv4 packets, this is the value of the TOS field in the IPv4 packet See [RFC1812] (Section 5.3.2) and [RFC791] for the 5 ipClassOfService unsigned8 identifier current header. For IPv6 packets, this is the value of the Traffic Class field definition of the IPv4 TOS field. See [RFC2460] for [RFC5102] in the IPv6 packet header. the definition of the IPv6 Traffic Class field. TCP control bits observed for packets of this Flow. The information is encoded in a set of bit fields. For each TCP control bit, there is a bit in this set. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. A value of 0 for a bit indicates that the corresponding bit was not set in any of the observed packets of this Flow. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ 6 tcpControlBits unsigned8 flags current | Reserved | URG | ACK | PSH | RST | SYN | FIN | See [RFC793] for the definition of the TCP control [RFC5102] +-----+-----+-----+-----+-----+-----+-----+-----+ bits in the TCP header. Reserved: Reserved for future use by TCP. Must be zero. URG: Urgent Pointer field significant ACK: Acknowledgment field significant PSH: Push Function RST: Reset the connection SYN: Synchronize sequence numbers FIN: No more data from sender See [RFC768] for the definition of the UDP source port The source port identifier in the transport header. For the transport field. See [RFC793] for the definition of the TCP protocols UDP, TCP, and SCTP, this is the source port number given in source port field. See [RFC4960] for the definition of 7 sourceTransportPort unsigned16 identifier current the respective header. This field MAY also be used for future transport SCTP. [RFC5102] protocols that have 16-bit source port identifiers. Additional information on defined UDP and TCP port numbers can be found at [IANA registry port-numbers]. 8 sourceIPv4Address ipv4Address identifier current The IPv4 source address in the IP packet header. See [RFC791] for the definition of the IPv4 source [RFC5102] address field. 9 sourceIPv4PrefixLength unsigned8 current The number of contiguous bits that are relevant in the sourceIPv4Prefix bits 0-32 [RFC5102] Information Element. The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as 10 ingressInterface unsigned32 identifier current defined in RFC 2863. Note that ifIndex values are not assigned See [RFC2863] for the definition of the ifIndex [RFC5102] statically to an interface and that the interfaces may be renumbered object. every time the device's management system is re-initialized, as specified in RFC 2863. See [RFC768] for the definition of the UDP destination The destination port identifier in the transport header. For the port field. See [RFC793] for the definition of the TCP transport protocols UDP, TCP, and SCTP, this is the destination port destination port field. See [RFC4960] for the 11 destinationTransportPort unsigned16 identifier current number given in the respective header. This field MAY also be used for definition of SCTP. [RFC5102] future transport protocols that have 16-bit destination port identifiers. Additional information on defined UDP and TCP port numbers can be found at [IANA registry port-numbers]. 12 destinationIPv4Address ipv4Address identifier current The IPv4 destination address in the IP packet header. See [RFC791] for the definition of the IPv4 [RFC5102] destination address field. 13 destinationIPv4PrefixLength unsigned8 current The number of contiguous bits that are relevant in the bits 0-32 [RFC5102] destinationIPv4Prefix Information Element. The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as 14 egressInterface unsigned32 identifier current defined in RFC 2863. Note that ifIndex values are not assigned See [RFC2863] for the definition of the ifIndex [RFC5102] statically to an interface and that the interfaces may be renumbered object. every time the device's management system is re-initialized, as specified in RFC 2863. 15 ipNextHopIPv4Address ipv4Address identifier current The IPv4 address of the next IPv4 hop. [RFC5102] The autonomous system (AS) number of the source IP address. If AS path 16 bgpSourceAsNumber unsigned32 identifier current information for this Flow is only available as an unordered AS set (and See [RFC4271] for a description of BGP-4, and see [RFC5102] not as an ordered AS sequence), then the value of this Information [RFC1930] for the definition of the AS number. Element is 0. The autonomous system (AS) number of the destination IP address. If AS 17 bgpDestinationAsNumber unsigned32 identifier current path information for this Flow is only available as an unordered AS set See [RFC4271] for a description of BGP-4, and see [RFC5102] (and not as an ordered AS sequence), then the value of this Information [RFC1930] for the definition of the AS number. Element is 0. 18 bgpNextHopIPv4Address ipv4Address identifier current The IPv4 address of the next (adjacent) BGP hop. See [RFC4271] for a description of BGP-4. [RFC5102] The number of outgoing multicast packets since the previous report (if 19 postMCastPacketDeltaCount unsigned64 deltaCounter current any) sent for packets of this Flow by a multicast daemon within the packets [RFC5102] Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon 20 postMCastOctetDeltaCount unsigned64 deltaCounter current within the Observation Domain. This property cannot necessarily be octets [RFC5102] observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload. The relative timestamp of the last packet of this Flow. It indicates 21 flowEndSysUpTime unsigned32 current the number of milliseconds since the last (re-)initialization of the milliseconds [RFC5102] IPFIX Device (sysUpTime). The relative timestamp of the first packet of this Flow. It indicates 22 flowStartSysUpTime unsigned32 current the number of milliseconds since the last (re-)initialization of the milliseconds [RFC5102] IPFIX Device (sysUpTime). The definition of this Information Element is identical to the 23 postOctetDeltaCount unsigned64 deltaCounter current definition of Information Element 'octetDeltaCount', except that it octets [RFC5102] reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The definition of this Information Element is identical to the 24 postPacketDeltaCount unsigned64 deltaCounter current definition of Information Element 'packetDeltaCount', except that it packets [RFC5102] reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. See [RFC791] for the specification of the IPv4 total 25 minimumIpTotalLength unsigned64 current Length of the smallest packet observed for this Flow. The packet length octets length. See [RFC2460] for the specification of the [RFC5102] includes the IP header(s) length and the IP payload length. IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length. See [RFC791] for the specification of the IPv4 total 26 maximumIpTotalLength unsigned64 current Length of the largest packet observed for this Flow. The packet length octets length. See [RFC2460] for the specification of the [RFC5102] includes the IP header(s) length and the IP payload length. IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length. 27 sourceIPv6Address ipv6Address identifier current The IPv6 source address in the IP packet header. See [RFC2460] for the definition of the Source Address [RFC5102] field in the IPv6 header. 28 destinationIPv6Address ipv6Address identifier current The IPv6 destination address in the IP packet header. See [RFC2460] for the definition of the Destination [RFC5102] Address field in the IPv6 header. 29 sourceIPv6PrefixLength unsigned8 current The number of contiguous bits that are relevant in the sourceIPv6Prefix bits 0-128 [RFC5102] Information Element. 30 destinationIPv6PrefixLength unsigned8 current The number of contiguous bits that are relevant in the bits 0-128 [RFC5102] destinationIPv6Prefix Information Element. 31 flowLabelIPv6 unsigned32 identifier current The value of the IPv6 Flow Label field in the IP packet header. See [RFC2460] for the definition of the Flow Label [RFC5102] field in the IPv6 packet header. 32 icmpTypeCodeIPv4 unsigned16 identifier current Type and Code of the IPv4 ICMP message. The combination of both values See [RFC792] for the definition of the IPv4 ICMP type [RFC5102] is reported as (ICMP type * 256) + ICMP code. and code fields. 33 igmpType unsigned8 identifier current The type field of the IGMP message. See [RFC3376] for the definition of the IGMP type [RFC5102] field. 34-35 Reserved [RFC5102] 36 flowActiveTimeout unsigned16 current The number of seconds after which an active Flow is timed out anyway, seconds [RFC5102] even if there is still a continuous flow of packets. A Flow is considered to be timed out if no packets belonging to the 37 flowIdleTimeout unsigned16 current Flow have been observed for the number of seconds specified by this seconds [RFC5102] field. 38-39 Reserved [RFC5102] The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX Messages that 40 exportedOctetTotalCount unsigned64 totalCounter current were successfully sent to the Collecting Process. The reported number octets [RFC5102] excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process. The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular 41 exportedMessageTotalCount unsigned64 totalCounter current Collecting Process. The reported number excludes the IPFIX Message that messages [RFC5102] carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process. The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a 42 exportedFlowRecordTotalCount unsigned64 totalCounter current particular Collecting Process. The reported number excludes Flow flows [RFC5102] Records in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process. 43 Reserved [RFC5102] 44 sourceIPv4Prefix ipv4Address current IPv4 source address prefix. [RFC5102] 45 destinationIPv4Prefix ipv4Address current IPv4 destination address prefix. [RFC5102] This field identifies the control protocol that allocated the top-of-stack label. Initial values for this field are listed below. Further values may be assigned by IANA in the MPLS label type registry. See [RFC3031] for the MPLS label structure. See [RFC4364] for the association of MPLS labels with - 0x01 TE-MIDPT: Any TE tunnel mid-point or tail label Virtual Private Networks (VPNs). See [RFC4271] for BGP 46 mplsTopLabelType unsigned8 identifier current - 0x02 Pseudowire: Any PWE3 or Cisco AToM based label and BGP routing. See [RFC5036] for Label Distribution [RFC5102] - 0x03 VPN: Any label associated with VPN Protocol (LDP). See the list of MPLS label types - 0x04 BGP: Any label associated with BGP or BGP routing assigned by IANA at [IANA registry mpls-label-values]. - 0x05 LDP: Any label associated with dynamically assigned labels using LDP 47 mplsTopLabelIPv4Address ipv4Address identifier current The IPv4 address of the system that the MPLS top label will cause this See [RFC3031] for the association between MPLS labels [RFC5102] Flow to be forwarded to. and IP addresses. 48-51 Reserved [RFC5102] See [RFC791] for the definition of the IPv4 Time to 52 minimumTTL unsigned8 current Minimum TTL value observed for any packet in this Flow. hops Live field. See [RFC2460] for the definition of the [RFC5102] IPv6 Hop Limit field. See [RFC791] for the definition of the IPv4 Time to 53 maximumTTL unsigned8 current Maximum TTL value observed for any packet in this Flow. hops Live field. See [RFC2460] for the definition of the [RFC5102] IPv6 Hop Limit field. The value of the Identification field in the IPv4 packet header or in See [RFC791] for the definition of the IPv4 54 fragmentIdentification unsigned32 identifier current the IPv6 Fragment header, respectively. The value is 0 for IPv6 if Identification field. See [RFC2460] for the definition [RFC5102] there is no fragment header. of the Identification field in the IPv6 Fragment header. The definition of this Information Element is identical to the See [RFC791] for the definition of the IPv4 TOS field. 55 postIpClassOfService unsigned8 identifier current definition of Information Element 'ipClassOfService', except that it See [RFC2460] for the definition of the IPv6 Traffic [RFC5102] reports a potentially modified value caused by a middlebox function Class field. See [RFC3234] for the definition of after the packet passed the Observation Point. middleboxes. 56 sourceMacAddress macAddress identifier current The IEEE 802 source MAC address field. See IEEE.802-3.2002. [RFC5102] The definition of this Information Element is identical to the 57 postDestinationMacAddress macAddress identifier current definition of Information Element 'destinationMacAddress', except that See IEEE.802-3.2002. [RFC5102] it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. 58 vlanId unsigned16 identifier current The IEEE 802.1Q VLAN identifier (VID) extracted from the Tag Control See IEEE.802-1Q.2003. [RFC5102] Information field that was attached to the IP packet. The definition of this Information Element is identical to the 59 postVlanId unsigned16 identifier current definition of Information Element 'vlanId', except that it reports a See IEEE.802-1Q.2003. [RFC5102] potentially modified value caused by a middlebox function after the packet passed the Observation Point. See [RFC791] for the definition of the version field in the IPv4 packet header. See [RFC2460] for the 60 ipVersion unsigned8 identifier current The IP version field in the IP packet header. definition of the version field in the IPv6 packet [RFC5102] header. Additional information on defined version numbers can be found at [IANA registry version-numbers]. The direction of the Flow observed at the Observation Point. There are only two values defined. 61 flowDirection unsigned8 identifier current [RFC5102] 0x00: ingress flow 0x01: egress flow 62 ipNextHopIPv6Address ipv6Address identifier current The IPv6 address of the next IPv6 hop. [RFC5102] 63 bgpNextHopIPv6Address ipv6Address identifier current The IPv6 address of the next (adjacent) BGP hop. See [RFC4271] for a description of BGP-4. [RFC5102] IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 option header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contained the respective IPv6 extension header, the value of the corresponding bit is 0. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | DST | HOP | Res | UNK |FRA0 | RH |FRA1 | Res | ... +-----+-----+-----+-----+-----+-----+-----+-----+ 8 9 10 11 12 13 14 15 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | Reserved | ESP | AH | PAY | ... +-----+-----+-----+-----+-----+-----+-----+-----+ See [RFC2460] for the general definition of IPv6 extension headers and for the specification of the 16 17 18 19 20 21 22 23 hop-by-hop options header, the routing header, the +-----+-----+-----+-----+-----+-----+-----+-----+ fragment header, and the destination options header. ... | Reserved | ... See [RFC4302] for the specification of the 64 ipv6ExtensionHeaders unsigned32 flags current +-----+-----+-----+-----+-----+-----+-----+-----+ authentication header. See [RFC4303] for the [RFC5102] 24 25 26 27 28 29 30 31 specification of the encapsulating security payload. +-----+-----+-----+-----+-----+-----+-----+-----+ The diagram provided in [RFC5102] is incorrect. The ... | Reserved | diagram in this registry is taken from Errata 1738. +-----+-----+-----+-----+-----+-----+-----+-----+ See [http://www.rfc-editor.org/errata_search.php?rfc=5102] Bit IPv6 Option Description 0, DST 60 Destination option header 1, HOP 0 Hop-by-hop option header 2, Res Reserved 3, UNK Unknown Layer 4 header (compressed, encrypted, not supported) 4, FRA0 44 Fragment header - first fragment 5, RH 43 Routing header 6, FRA1 44 Fragmentation header - not first fragment 7, Res Reserved 8 to 12 Reserved 13, ESP 50 Encrypted security payload 14, AH 51 Authentication Header 15, PAY 108 Payload compression header 16 to 31 Reserved 65-69 Reserved [RFC5102] The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed. The size of this Information Element is 3 octets. 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 70 mplsTopLabelStackSection octetArray identifier current +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ See [RFC3032]. [RFC5102] | Label | Exp |S| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Label: Label Value, 20 bits Exp: Experimental Use, 3 bits S: Bottom of Stack, 1 bit The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 71 mplsLabelStackSection2 octetArray identifier current mplsTopLabelStackSection. See the definition of See [RFC3032]. [RFC5102] mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 72 mplsLabelStackSection3 octetArray identifier current mplsLabelStackSection2. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 73 mplsLabelStackSection4 octetArray identifier current mplsLabelStackSection3. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 74 mplsLabelStackSection5 octetArray identifier current mplsLabelStackSection4. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 75 mplsLabelStackSection6 octetArray identifier current mplsLabelStackSection5. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 76 mplsLabelStackSection7 octetArray identifier current mplsLabelStackSection6. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 77 mplsLabelStackSection8 octetArray identifier current mplsLabelStackSection7. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 78 mplsLabelStackSection9 octetArray identifier current mplsLabelStackSection8. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by 79 mplsLabelStackSection10 octetArray identifier current mplsLabelStackSection9. See the definition of mplsTopLabelStackSection See [RFC3032]. [RFC5102] for further details. The size of this Information Element is 3 octets. 80 destinationMacAddress macAddress identifier current The IEEE 802 destination MAC address field. See IEEE.802-3.2002. [RFC5102] The definition of this Information Element is identical to the 81 postSourceMacAddress macAddress identifier current definition of Information Element 'sourceMacAddress', except that it See IEEE.802-3.2002. [RFC5102] reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. 82 interfaceName string current A short name uniquely describing an interface, eg "Eth1/0". See [RFC2863] for the definition of the ifName object. [draft-aitken-ipfix-new-infos-03] 83 interfaceDescription string current The description of an interface, eg "FastEthernet 1/0" or "ISP See [RFC2863] for the definition of the ifDescr [ipfix-iana@cisco.com] connection". object. 84 Reserved [RFC5102] The total number of octets in incoming packets for this Flow at the 85 octetTotalCount unsigned64 totalCounter current Observation Point since the Metering Process (re-)initialization for octets [RFC5102] this Observation Point. The number of octets includes IP header(s) and IP payload. The total number of incoming packets for this Flow at the Observation 86 packetTotalCount unsigned64 totalCounter current Point since the Metering Process (re-)initialization for this packets [RFC5102] Observation Point. 87 Reserved [RFC5102] The value of the IP fragment offset field in the IPv4 packet header or See [RFC791] for the specification of the fragment 88 fragmentOffset unsigned16 identifier current the IPv6 Fragment header, respectively. The value is 0 for IPv6 if offset in the IPv4 header. See [RFC2460] for the [RFC5102] there is no fragment header. specification of the fragment offset in the IPv6 Fragment header. 89 Reserved The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of See [RFC4364] for the specification of the route 90 mplsVpnRouteDistinguisher octetArray identifier current mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet distinguisher. See [RFC4382] for the specification of [RFC5102] string with flexible length was chosen for representing a VPN route the MPLS/BGP Layer 3 Virtual Private Network (VPN) distinguisher by object MplsL3VpnRouteDistinguisher. This choice was Management Information Base. made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. 91 mplsTopLabelPrefixLength unsigned8 identifier current The prefix length of the subnet of the mplsTopLabelIPv4Address that the bits 0-32 See [RFC3031] for the association between MPLS labels [draft-aitken-ipfix-new-infos-03] MPLS top label will cause the Flow to be forwarded to. and prefix lengths. 92-97 Reserved [RFC5102] See [RFC3260] for the definition of the Differentiated The definition of this Information Element is identical to the Services Field. See section 5.3.2 of [RFC1812] and 98 postIpDiffServCodePoint unsigned8 identifier current definition of Information Element 'ipDiffServCodePoint', except that it 0-63 [RFC791] for the definition of the IPv4 TOS field. See [draft-aitken-ipfix-new-infos-03] reports a potentially modified value caused by a middlebox function [RFC2460] for the definition of the IPv6 Traffic Class after the packet passed the Observation Point. field. See the IPFIX Information Model [RFC5102] for the 'ipDiffServCodePoint' specification. See [RFC1112] for the specification of reserved IPv4 99 multicastReplicationFactor current The amount of multicast replication that's applied to a traffic stream. multicast addresses. See [RFC4291] for the [draft-aitken-ipfix-new-infos-03] specification of reserved IPv6 multicast addresses. 100-127 Reserved [RFC5102] The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the 128 bgpNextAdjacentAsNumber unsigned32 identifier current destination IP address of the Flow in the BGP routing information base. See [RFC4271] for a description of BGP-4, and see [RFC5102] If AS path information for this Flow is only available as an unordered [RFC1930] for the definition of the AS number. AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS path See [RFC4271] for a description of BGP-4, and see 129 bgpPrevAdjacentAsNumber unsigned32 identifier current information for this Flow is only available as an unordered AS set (and [RFC1930] for the definition of the AS number. [RFC5102] not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value. The IPv4 address used by the Exporting Process. This is used by the 130 exporterIPv4Address ipv4Address identifier current Collector to identify the Exporter in cases where the identity of the [RFC5102] Exporter may have been obscured by the use of a proxy. The IPv6 address used by the Exporting Process. This is used by the 131 exporterIPv6Address ipv6Address identifier current Collector to identify the Exporter in cases where the identity of the [RFC5102] Exporter may have been obscured by the use of a proxy. The number of octets since the previous report (if any) in packets of 132 droppedOctetDeltaCount unsigned64 deltaCounter current this Flow dropped by packet treatment. The number of octets includes IP octets [RFC5102] header(s) and IP payload. 133 droppedPacketDeltaCount unsigned64 deltaCounter current The number of packets since the previous report (if any) of this Flow packets [RFC5102] dropped by packet treatment. The total number of octets in packets of this Flow dropped by packet 134 droppedOctetTotalCount unsigned64 totalCounter current treatment since the Metering Process (re-)initialization for this octets [RFC5102] Observation Point. The number of octets includes IP header(s) and IP payload. 135 droppedPacketTotalCount unsigned64 totalCounter current The number of packets of this Flow dropped by packet treatment since packets [RFC5102] the Metering Process (re-)initialization for this Observation Point. The reason for Flow termination. The range of values includes the following: 0x01: idle timeout The Flow was terminated because it was considered to be idle. 0x02: active timeout The Flow was terminated for reporting purposes while it was still active, for example, after the maximum lifetime of unreported Flows was reached. 0x03: end of Flow detected 136 flowEndReason unsigned8 identifier current The Flow was terminated because the Metering Process [RFC5102] detected signals indicating the end of the Flow, for example, the TCP FIN flag. 0x04: forced end The Flow was terminated because of some external event, for example, a shutdown of the Metering Process initiated by a network management application. 0x05: lack of resources The Flow was terminated because of lack of resources available to the Metering Process and/or the Exporting Process. An identifier of a set of common properties that is unique per 137 commonPropertiesId unsigned64 identifier current Observation Domain and Transport Session. Typically, this Information [RFC5102] Element is used to link to information reported in separate Data Records. An identifier of an Observation Point that is unique per Observation 138 observationPointId unsigned32 identifier current Domain. It is RECOMMENDED that this identifier is also unique per IPFIX [RFC5102] Device. Typically, this Information Element is used for limiting the scope of other Information Elements. 139 icmpTypeCodeIPv6 unsigned16 identifier current Type and Code of the IPv6 ICMP message. The combination of both values See [RFC4443] for the definition of the IPv6 ICMP type [RFC5102] is reported as (ICMP type * 256) + ICMP code. and code fields. 140 mplsTopLabelIPv6Address ipv6Address identifier current The IPv6 address of the system that the MPLS top label will cause this See [RFC3031] for the association between MPLS labels [RFC5102] Flow to be forwarded to. and IP addresses. An identifier of a line card that is unique per IPFIX Device hosting an 141 lineCardId unsigned32 identifier current Observation Point. Typically, this Information Element is used for [RFC5102] limiting the scope of other Information Elements. An identifier of a line port that is unique per IPFIX Device hosting an 142 portId unsigned32 identifier current Observation Point. Typically, this Information Element is used for [RFC5102] limiting the scope of other Information Elements. An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of 143 meteringProcessId unsigned32 identifier current other Information Elements. Note that process identifiers are typically [RFC5102] assigned dynamically. The Metering Process may be re-started with a different ID. An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of 144 exportingProcessId unsigned32 identifier current other Information Elements. Note that process identifiers are typically [RFC5102] assigned dynamically. The Exporting Process may be re-started with a different ID. An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain. Template IDs 0-255 are reserved for Template Sets, Options Template 145 templateId unsigned16 identifier current Sets, and other reserved Sets yet to be created. Template IDs of Data [RFC5102] Sets are numbered from 256 to 65535. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned. 146 wlanChannelId unsigned8 identifier current The identifier of the 802.11 (Wi-Fi) channel used. See IEEE.802-11.1999. [RFC5102] The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network 147 wlanSSID string current used. According to IEEE.802-11.1999, the SSID is encoded into a string See IEEE.802-11.1999. [RFC5102] of up to 32 characters. An identifier of a Flow that is unique within an Observation Domain. 148 flowId unsigned64 identifier current This Information Element can be used to distinguish between different [RFC5102] Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records. An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device. 149 observationDomainId unsigned32 identifier current [RFC5102] A value of 0 indicates that no specific Observation Domain is identified by this Information Element. Typically, this Information Element is used for limiting the scope of other Information Elements. 150 flowStartSeconds dateTimeSeconds current The absolute timestamp of the first packet of this Flow. seconds [RFC5102] 151 flowEndSeconds dateTimeSeconds current The absolute timestamp of the last packet of this Flow. seconds [RFC5102] 152 flowStartMilliseconds dateTimeMilliseconds current The absolute timestamp of the first packet of this Flow. milliseconds [RFC5102] 153 flowEndMilliseconds dateTimeMilliseconds current The absolute timestamp of the last packet of this Flow. milliseconds [RFC5102] 154 flowStartMicroseconds dateTimeMicroseconds current The absolute timestamp of the first packet of this Flow. microseconds [RFC5102] 155 flowEndMicroseconds dateTimeMicroseconds current The absolute timestamp of the last packet of this Flow. microseconds [RFC5102] 156 flowStartNanoseconds dateTimeNanoseconds current The absolute timestamp of the first packet of this Flow. nanoseconds [RFC5102] 157 flowEndNanoseconds dateTimeNanoseconds current The absolute timestamp of the last packet of this Flow. nanoseconds [RFC5102] This is a relative timestamp only valid within the scope of a single 158 flowStartDeltaMicroseconds unsigned32 current IPFIX Message. It contains the negative time offset of the first microseconds See the [IPFIX protocol specification] for the [RFC5102] observed packet of this Flow relative to the export time specified in definition of the IPFIX Message Header. the IPFIX Message Header. This is a relative timestamp only valid within the scope of a single 159 flowEndDeltaMicroseconds unsigned32 current IPFIX Message. It contains the negative time offset of the last microseconds See the [IPFIX protocol specification] for the [RFC5102] observed packet of this Flow relative to the export time specified in definition of the IPFIX Message Header. the IPFIX Message Header. 160 systemInitTimeMilliseconds dateTimeMilliseconds current The absolute timestamp of the last (re-)initialization of the IPFIX milliseconds [RFC5102] Device. 161 flowDurationMilliseconds unsigned32 current The difference in time between the first observed packet of this Flow milliseconds [RFC5102] and the last observed packet of this Flow. 162 flowDurationMicroseconds unsigned32 current The difference in time between the first observed packet of this Flow microseconds [RFC5102] and the last observed packet of this Flow. 163 observedFlowTotalCount unsigned64 totalCounter current The total number of Flows observed in the Observation Domain since the flows [RFC5102] Metering Process (re-)initialization for this Observation Point. 164 ignoredPacketTotalCount unsigned64 totalCounter current The total number of observed IP packets that the Metering Process did packets [RFC5102] not process since the (re-)initialization of the Metering Process. The total number of octets in observed IP packets (including the IP 165 ignoredOctetTotalCount unsigned64 totalCounter current header) that the Metering Process did not process since the octets [RFC5102] (re-)initialization of the Metering Process. The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process 166 notSentFlowTotalCount unsigned64 totalCounter current instead of being sent to the Collecting Process. There are several flows [RFC5102] potential reasons for this including resource shortage and special Flow export policies. The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the 167 notSentPacketTotalCount unsigned64 totalCounter current Exporting Process instead of being sent to the Collecting Process. packets [RFC5102] There are several potential reasons for this including resource shortage and special Flow export policies. The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process 168 notSentOctetTotalCount unsigned64 totalCounter current or by the Exporting Process instead of being sent to the Collecting octets [RFC5102] Process. There are several potential reasons for this including resource shortage and special Flow export policies. 169 destinationIPv6Prefix ipv6Address current IPv6 destination address prefix. [RFC5102] 170 sourceIPv6Prefix ipv6Address current IPv6 source address prefix. [RFC5102] The definition of this Information Element is identical to the 171 postOctetTotalCount unsigned64 totalCounter current definition of Information Element 'octetTotalCount', except that it octets [RFC5102] reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The definition of this Information Element is identical to the 172 postPacketTotalCount unsigned64 totalCounter current definition of Information Element 'packetTotalCount', except that it packets [RFC5102] reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record with the n-th bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that this is not the case. 173 flowKeyIndicator unsigned64 flags current [RFC5102] If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0. The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the 174 postMCastPacketTotalCount unsigned64 totalCounter current Metering Process (re-)initialization. This property cannot necessarily packets [RFC5102] be observed at the Observation Point, but may be retrieved by other means. The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain 175 postMCastOctetTotalCount unsigned64 totalCounter current since the Metering Process (re-)initialization. This property cannot octets [RFC5102] necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload. 176 icmpTypeIPv4 unsigned8 identifier current Type of the IPv4 ICMP message. See [RFC792] for the definition of the IPv4 ICMP type [RFC5102] field. 177 icmpCodeIPv4 unsigned8 identifier current Code of the IPv4 ICMP message. See [RFC792] for the definition of the IPv4 ICMP code [RFC5102] field. 178 icmpTypeIPv6 unsigned8 identifier current Type of the IPv6 ICMP message. See [RFC4443] for the definition of the IPv6 ICMP type [RFC5102] field. 179 icmpCodeIPv6 unsigned8 identifier current Code of the IPv6 ICMP message. See [RFC4443] for the definition of the IPv6 ICMP code [RFC5102] field. See [RFC768] for the definition of the UDP source port 180 udpSourcePort unsigned16 identifier current The source port identifier in the UDP header. field. Additional information on defined UDP port [RFC5102] numbers can be found at [IANA registry port-numbers]. See [RFC768] for the definition of the UDP destination 181 udpDestinationPort unsigned16 identifier current The destination port identifier in the UDP header. port field. Additional information on defined UDP port [RFC5102] numbers can be found at [IANA registry port-numbers]. See [RFC793] for the definition of the TCP source port 182 tcpSourcePort unsigned16 identifier current The source port identifier in the TCP header. field. Additional information on defined TCP port [RFC5102] numbers can be found at [IANA registry port-numbers]. See [RFC793] for the definition of the TCP destination 183 tcpDestinationPort unsigned16 identifier current The destination port identifier in the TCP header. port field. Additional information on defined TCP port [RFC5102] numbers can be found at [IANA registry port-numbers]. 184 tcpSequenceNumber unsigned32 current The sequence number in the TCP header. See [RFC793] for the definition of the TCP sequence [RFC5102] number. 185 tcpAcknowledgementNumber unsigned32 current The acknowledgement number in the TCP header. See [RFC793] for the definition of the TCP [RFC5102] acknowledgement number. The window field in the TCP header. If the TCP window scale is See [RFC793] for the definition of the TCP window 186 tcpWindowSize unsigned16 current supported, then TCP window scale must be known to fully interpret the field. See [RFC1323] for the definition of the TCP [RFC5102] value of this information. window scale. 187 tcpUrgentPointer unsigned16 current The urgent pointer in the TCP header. See [RFC793] for the definition of the TCP urgent [RFC5102] pointer. The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the TCP 188 tcpHeaderLength unsigned8 current header. The Data Offset field indicates the length of the TCP header in octets See [RFC793] for the definition of the TCP header. [RFC5102] units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets. 189 ipHeaderLength unsigned8 current The length of the IP header. For IPv6, the value of this Information octets See [RFC791] for the definition of the IPv4 header. [RFC5102] Element is 40. See [RFC2460] for the definition of the IPv6 header. 190 totalLengthIPv4 unsigned16 current The total length of the IPv4 packet. octets See [RFC791] for the specification of the IPv4 total [RFC5102] length. This Information Element reports the value of the Payload Length field in the IPv6 header. Note that IPv6 extension headers belong to the See [RFC2460] for the specification of the IPv6 191 payloadLengthIPv6 unsigned16 current payload. Also note that in case of a jumbo payload option the value of octets payload length. See [RFC2675] for the specification of [RFC5102] the Payload Length field in the IPv6 header is zero and so will be the the IPv6 jumbo payload option. value reported by this Information Element. For IPv4, the value of the Information Element matches the value of the See [RFC791] for the definition of the IPv4 Time to 192 ipTTL unsigned8 current Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value hops Live field. See [RFC2675] for the definition of the [RFC5102] of the Information Element matches the value of the Hop Limit field in IPv6 Hop Limit field. the IPv6 packet header. The value of the Next Header field of the IPv6 header. The value See [RFC2460] for the definition of the IPv6 Next 193 nextHeaderIPv6 unsigned8 current identifies the type of the following IPv6 extension header or of the Header field. See the list of protocol numbers [RFC5102] following IP payload. Valid values are defined in the IANA Protocol assigned by IANA at [IANA registry protocol-numbers]. Numbers registry. See [RFC3031] for the specification of MPLS packets. 194 mplsPayloadLength unsigned32 current The size of the MPLS packet without the label stack. octets See [RFC3032] for the specification of the MPLS label [RFC5102] stack. The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field spans See [RFC3260] for the definition of the Differentiated the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic Services field. See [RFC1812] (Section 5.3.2) and 195 ipDiffServCodePoint unsigned8 identifier current Class field, respectively. 0-63 [RFC791] for the definition of the IPv4 TOS field. See [RFC5102] [RFC2460] for the definition of the IPv6 Traffic Class This Information Element encodes only the 6 bits of the Differentiated field. Services field. Therefore, its value may range from 0 to 63. The value of the IP Precedence. The IP Precedence value is encoded in See [RFC1812] (Section 5.3.3) and [RFC791] for the the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, definition of the IP Precedence. See [RFC1812] 196 ipPrecedence unsigned8 identifier current respectively. 0-7 (Section 5.3.2) and [RFC791] for the definition of the [RFC5102] IPv4 TOS field. See [RFC2460] for the definition of This Information Element encodes only these 3 bits. Therefore, its the IPv6 Traffic Class field. value may range from 0 to 7. Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively. Bit 0: (RS) Reserved. The value of this bit MUST be 0 until specified otherwise. Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. Corresponds to the value of the DF flag in the IPv4 header. Will always be 0 for IPv6 unless a "don't fragment" feature is introduced to IPv6. Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. See [RFC791] for the specification of the IPv4 197 fragmentFlags unsigned8 flags current Corresponds to the MF flag in the IPv4 header fragment flags. See [RFC2460] for the specification of [RFC5102] or to the M flag in the IPv6 Fragment header, the IPv6 Fragment header. respectively. The value is 0 for IPv6 if there is no fragment header. Bits 3-7: (DC) Don't Care. The values of these bits are irrelevant. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | R | D | M | D | D | D | D | D | | S | F | F | C | C | C | C | C | +---+---+---+---+---+---+---+---+ The sum of the squared numbers of octets per incoming packet since the 198 octetDeltaSumOfSquares unsigned64 current previous report (if any) for this Flow at the Observation Point. The [RFC5102] number of octets includes IP header(s) and IP payload. The total sum of the squared numbers of octets in incoming packets for 199 octetTotalSumOfSquares unsigned64 current this Flow at the Observation Point since the Metering Process octets [RFC5102] (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. 200 mplsTopLabelTTL unsigned8 current The TTL field from the top MPLS label stack entry, i.e., the last label hops See [RFC3032] for the specification of the TTL field. [RFC5102] that was pushed. 201 mplsLabelStackLength unsigned32 current The length of the MPLS label stack in units of octets. octets See [RFC3032] for the specification of the MPLS label [RFC5102] stack. 202 mplsLabelStackDepth unsigned32 current The number of labels in the MPLS label stack. label stack See [RFC3032] for the specification of the MPLS label [RFC5102] entries stack. The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed. Bits 0-4: Don't Care, value is irrelevant. Bits 5-7: MPLS Exp field. See [RFC3032] for the specification of the Exp field. 203 mplsTopLabelExp unsigned8 flags current See [RFC3270] for usage of the Exp field. [RFC5102] 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | don't care | Exp | +---+---+---+---+---+---+---+---+ The effective length of the IP payload. For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by See [RFC791] for the specification of IPv4 packets. Information Element totalLengthIPv4) and the length of the IPv4 header See [RFC2460] for the specification of the IPv6 204 ipPayloadLength unsigned32 current (as reported by Information Element headerLengthIPv4). octets payload length. See [RFC2675] for the specification of [RFC5102] the IPv6 jumbo payload length. For IPv6, the value of the Payload Length field in the IPv6 header is reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported. 205 udpMessageLength unsigned16 current The value of the Length field in the UDP header. octets See [RFC768] for the specification of the UDP header. [RFC5102] If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero. The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0. The second and third bits of this octet are reserved for future use. See [RFC1112] for the specification of reserved IPv4 multicast addresses. See [RFC4291] for the The remaining bits of the octet are only set to values other than zero specification of reserved IPv6 multicast addresses and if the IP Destination Address is a reserved IPv6 multicast address. the definition of the T flag and the IPv6 multicast 206 isMulticast unsigned8 flags current Then the fourth bit of the octet is set to the value of the T flag in scope. The diagram provided in [RFC5102] is incorrect. [RFC5102] the IPv6 multicast address and the remaining four bits are set to the The diagram in this registry is taken from Errata value of the scope field in the IPv6 multicast address. 1736. See [http://www.rfc-editor.org/errata_search.php?rfc=5102] 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ | IPv6 multicast scope | T | RES. | RES. | MCv4 | +------+------+------+------+------+------+------+------+ Bits 0-3: set to value of multicast scope if IPv6 multicast Bit 4: set to value of T flag, if IPv6 multicast Bits 5-6: reserved for future use Bit 7: set to 1 if IPv4 multicast The value of the Internet Header Length (IHL) field in the IPv4 header. 207 ipv4IHL unsigned8 current It specifies the length of the header in units of 4 octets. Please note 4 octets See [RFC791] for the specification of the IPv4 header. [RFC5102] that its unit is different from most of the other Information Elements reporting length values. IPv4 options in packets of this Flow. The information is encoded in a set of bit fields. For each valid IPv4 option type, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv4 option type. Otherwise, if no observed packet of this Flow contained the respective IPv4 option type, the value of the corresponding bit is 0. The list of valid IPv4 options is maintained by IANA. Note that for identifying an option not just the 5-bit Option Number, but all 8 bits of the Option Type need to match one of the IPv4 options specified at http://www.iana.org/assignments/ip-parameters. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. The mapping is illustrated by the figure below. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ ... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL | +------+------+------+------+------+------+------+------+ 8 9 10 11 12 13 14 15 +------+------+------+------+------+------+------+------+ ... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ... +------+------+------+------+------+------+------+------+ 16 17 18 19 20 21 22 23 +------+------+------+------+------+------+------+------+ ... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ... +------+------+------+------+------+------+------+------+ 24 25 26 27 28 29 30 31 +------+------+------+------+------+------+------+------+ | | EXP | to be assigned by IANA | QS | UMP | ... See [RFC791] for the definition of IPv4 options. See +------+------+------+------+------+------+------+------+ the list of IPv4 option numbers assigned by IANA at [IANA registry ip-parameters]. The diagram provided in 208 ipv4Options unsigned32 flags current Type Option [RFC5102] is incorrect. The diagram in this registry [RFC5102] Bit Value Name Reference is taken from Errata 1737. See ---+-----+-------+------------------------------------ [http://www.rfc-editor.org/errata_search.php?rfc=5102] 0 7 RR Record Route, RFC 791 1 134 CIPSO Commercial Security 2 133 E-SEC Extended Security, RFC 1108 3 68 TS Time Stamp, RFC 791 4 131 LSR Loose Source Route, RFC791 5 130 SEC Security, RFC 1108 6 1 NOP No Operation, RFC 791 7 0 EOOL End of Options List, RFC 791 8 15 ENCODE 9 142 VISA Experimental Access Control 10 205 FINN Experimental Flow Control 11 12 MTUR (obsoleted) MTU Reply, RFC 1191 12 11 MTUP (obsoleted) MTU Probe, RFC 1191 13 10 ZSU Experimental Measurement 14 137 SSR Strict Source Route, RFC 791 15 136 SID Stream ID, RFC 791 16 151 DPS Dynamic Packet State 17 150 NSAPA NSAP Address 18 149 SDB Selective Directed Broadcast 19 147 ADDEXT Address Extension 20 148 RTRALT Router Alert, RFC 2113 21 82 TR Traceroute, RFC 3193 22 145 EIP Extended Internet Protocol, RFC 1385 23 144 IMITD IMI Traffic Descriptor 25 30 EXP RFC3692-style Experiment 25 94 EXP RFC3692-style Experiment 25 158 EXP RFC3692-style Experiment 25 222 EXP RFC3692-style Experiment 30 25 QS Quick-Start 31 152 UMP Upstream Multicast Pkt. ... ... ... Further options numbers may be assigned by IANA TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. TCP option numbers are maintained by IANA. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ... +-----+-----+-----+-----+-----+-----+-----+-----+ See [RFC793] for the definition of TCP options. See the list of TCP option numbers assigned by IANA at 209 tcpOptions unsigned64 flags current 8 9 10 11 12 13 14 15 [IANA registry tcp-parameters]. The diagram provided [RFC5102] +-----+-----+-----+-----+-----+-----+-----+-----+ in [RFC5102] is incorrect. The diagram in this ... | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 |... registry is taken from Errata 1739. See +-----+-----+-----+-----+-----+-----+-----+-----+ [http://www.rfc-editor.org/errata_search.php?rfc=5102] 16 17 18 19 20 21 22 23 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 |... +-----+-----+-----+-----+-----+-----+-----+-----+ . . . 56 57 58 59 60 61 62 63 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | +-----+-----+-----+-----+-----+-----+-----+-----+ 210 paddingOctets octetArray current The value of this Information Element is always a sequence of 0x00 [RFC5102] values. 211 collectorIPv4Address ipv4Address identifier current An IPv4 address to which the Exporting Process sends Flow information. [RFC5102] 212 collectorIPv6Address ipv6Address identifier current An IPv6 address to which the Exporting Process sends Flow information. [RFC5102] The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value 213 exportInterface unsigned32 identifier current matches the value of managed object 'ifIndex' as defined in RFC 2863. See [RFC2863] for the definition of the ifIndex [RFC5102] Note that ifIndex values are not assigned statically to an interface object. and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the Version See the [IPFIX protocol specification] for the 214 exportProtocolVersion unsigned8 identifier current Number field in the Message Header. definition of the IPFIX Message Header. See [RFC3954] [RFC5102] for the definition of the NetFlow version 9 message The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A header. value of 0 indicates that no export protocol is in use. The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet See [RFC791] for the specification of the IPv4 payload type. Protocol numbers are defined in the IANA Protocol Numbers protocol field. See [RFC2460] for the specification of 215 exportTransportProtocol unsigned8 identifier current registry. the IPv6 protocol field. See the list of protocol [RFC5102] numbers assigned by IANA at [IANA registry In Internet Protocol version 4 (IPv4), this is carried in the Protocol protocol-numbers]. field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. See [RFC768] for the definition of the UDP destination The destination port identifier to which the Exporting Process sends port field. See [RFC793] for the definition of the TCP Flow information. For the transport protocols UDP, TCP, and SCTP, this destination port field. See [RFC4960] for the 216 collectorTransportPort unsigned16 identifier current is the destination port number. This field MAY also be used for future definition of SCTP. [RFC5102] transport protocols that have 16-bit source port identifiers. Additional information on defined UDP and TCP port numbers can be found at [IANA registry port-numbers]. The source port identifier from which the Exporting Process sends Flow See [RFC768] for the definition of the UDP source port information. For the transport protocols UDP, TCP, and SCTP, this is field. See [RFC793] for the definition of the TCP the source port number. This field MAY also be used for future source port field. See [RFC4960] for the definition of 217 exporterTransportPort unsigned16 identifier current transport protocols that have 16-bit source port identifiers. This SCTP. [RFC5102] field may be useful for distinguishing multiple Exporting Processes that use the same IP address. Additional information on defined UDP and TCP port numbers can be found at [IANA registry port-numbers]. 218 tcpSynTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Synchronize sequence packets See [RFC793] for the definition of the TCP SYN flag. [RFC5102] numbers" (SYN) flag set. 219 tcpFinTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "No more data from packets See [RFC793] for the definition of the TCP FIN flag. [RFC5102] sender" (FIN) flag set. 220 tcpRstTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Reset the packets See [RFC793] for the definition of the TCP RST flag. [RFC5102] connection" (RST) flag set. 221 tcpPshTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Push Function" (PSH) packets See [RFC793] for the definition of the TCP PSH flag. [RFC5102] flag set. 222 tcpAckTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Acknowledgment field packets See [RFC793] for the definition of the TCP ACK flag. [RFC5102] significant" (ACK) flag set. 223 tcpUrgTotalCount unsigned64 totalCounter current The total number of packets of this Flow with TCP "Urgent Pointer field packets See [RFC793] for the definition of the TCP URG flag. [RFC5102] significant" (URG) flag set. See [RFC791] for the specification of the IPv4 total 224 ipTotalLength unsigned64 current The total length of the IP packet. octets length. See [RFC2460] for the specification of the [RFC5102] IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length. The definition of this Information Element is identical to the See [RFC791] for the definition of the IPv4 source 225 postNATSourceIPv4Address ipv4Address identifier current definition of Information Element 'sourceIPv4Address', except that it address field. See [RFC3022] for the definition of [ipfix-iana@cisco.com] reports a modified value caused by a NAT middlebox function after the NAT. See [RFC3234] for the definition of middleboxes. packet passed the Observation Point. The definition of this Information Element is identical to the See [RFC791] for the definition of the IPv4 226 postNATDestinationIPv4Address ipv4Address identifier current definition of Information Element 'destinationIPv4Address', except that destination address field. See [RFC3022] for the [ipfix-iana@cisco.com] it reports a modified value caused by a NAT middlebox function after definition of NAT. See [RFC3234] for the definition of the packet passed the Observation Point. middleboxes. See [RFC768] for the definition of the UDP source port The definition of this Information Element is identical to the field. See [RFC793] for the definition of the TCP definition of Information Element 'sourceTransportPort', except that it source port field. See [RFC4960] for the definition of 227 postNAPTSourceTransportPort unsigned16 identifier current reports a modified value caused by a Network Address Port Translation SCTP. See [RFC3022] for the definition of NAPT. See [ipfix-iana@cisco.com] (NAPT) middlebox function after the packet passed the Observation [RFC3234] for the definition of middleboxes. Point. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers. See [RFC768] for the definition of the UDP source port The definition of this Information Element is identical to the field. See [RFC793] for the definition of the TCP definition of Information Element 'destinationTransportPort', except source port field. See [RFC4960] for the definition of 228 postNAPTDestinationTransportPort unsigned16 identifier current that it reports a modified value caused by a Network Address Port SCTP. See [RFC3022] for the definition of NAPT. See [ipfix-iana@cisco.com] Translation (NAPT) middlebox function after the packet passed the [RFC3234] for the definition of middleboxes. Observation Point. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers. Indicates whether the session was created because traffic originated in the private or public address realm. postNATSourceIPv4Address, 229 natOriginatingAddressRealm unsigned8 flags current postNATDestinationIPv4Address, postNAPTSourceTransportPort, and See [RFC3022] for the definition of NAT. [ipfix-iana@cisco.com] postNAPTDestinationTransportPort are qualified with the address realm in perspective. The allowed values are: Private: 1 Public: 2 Indicates a NAT event. The allowed values are: 1 - Create event. 2 - 230 natEvent unsigned8 current Delete event. A Create event is generated when a NAT translation is See [RFC3022] for the definition of NAT. [ipfix-iana@cisco.com] created, whether dynamically or statically. A Delete event is generated when a NAT translation is deleted. The total number of layer 4 payload bytes in a flow from the initiator. 231 initiatorOctets unsigned64 current The initiator is the device which triggered the session creation, and remains the same for the life of the session. The total number of layer 4 payload bytes in a flow from the responder. 232 responderOctets unsigned64 current The responder is the device which replies to the initiator, and remains [ipfix-iana@cisco.com] the same for the life of the session. Indicates a firewall event. The allowed values are: 0 - Ignore 233 firewallEvent unsigned8 current (invalid) 1 - Flow Created 2 - Flow Deleted 3 - Flow Denied 4 - Flow [ipfix-iana@cisco.com] Alert 234 ingressVRFID unsigned32 current An unique identifier of the VRFname where the packets of this flow are [ipfix-iana@cisco.com] being received. This identifier is unique per Metering Process 235 egressVRFID unsigned32 current An unique identifier of the VRFname where the packets of this flow are [ipfix-iana@cisco.com] being sent. This identifier is unique per Metering Process 236 VRFname string current The name of a VPN Routing and Forwarding table (VRF). See [RFC4364] for the definition of VRF. [ipfix-iana@cisco.com] The definition of this Information Element is identical to the 237 postMplsTopLabelExp unsigned8 flags current definition of Information Element 'mplsTopLabelExp', except that it See [RFC3032] for the specification of the Exp field. [RFC5102] reports a potentially modified value caused by a middlebox function See [RFC3270] for usage of the Exp field. after the packet passed the Observation Point. 238 tcpWindowScale unsigned16 current The scale of the window field in the TCP header. See [RFC1323] for the definition of the TCP window [RFC5102] scale. A description of the direction assignment method used to assign the Biflow Source and Destination. This Information Element MAY be present in a Flow Data Record, or applied to all flows exported from an Exporting Process or Observation Domain using IPFIX Options. If this Information Element is not present in a Flow Record or associated with a Biflow via scope, it is assumed that the configuration of the direction assignment method is done out-of-band. Note that when using IPFIX Options to apply this Information Element to all flows within an Observation Domain or from an Exporting Process, the Option SHOULD be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information Element SHOULD appear in each Flow Record. This field may take the following values: +-------+------------------+----------------------------------------+ | Value | Name | Description | +-------+------------------+----------------------------------------+ | 0x00 | arbitrary | Direction was assigned arbitrarily. | | 0x01 | initiator | The Biflow Source is the flow | 239 biflowDirection unsigned8 identifier current | | | initiator, as determined by the | [RFC5103] | | | Metering Process' best effort to | | | | detect the initiator. | | 0x02 | reverseInitiator | The Biflow Destination is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. This value is | | | | provided for the convenience of | | | | Exporting Processes to revise an | | | | initiator estimate without re-encoding | | | | the Biflow Record. | | 0x03 | perimeter | The Biflow Source is the endpoint | | | | outside of a defined perimeter. The | | | | perimeter's definition is implicit in | | | | the set of Biflow Source and Biflow | | | | Destination addresses exported in the | | | | Biflow Records. | +-------+------------------+----------------------------------------+ The difference between the length of an Ethernet frame (minus the FCS) 240 ethernetHeaderLength unsigned8 identifier current and the length of its MAC Client Data section (including any padding) octets [IEEE.802-3.2005] [ipfix-iana@cisco.com] as defined in section 3.1 of [IEEE.802-3.2005]. It does not include the Preamble, SFD and Extension field lengths. 241 ethernetPayloadLength unsigned16 identifier current The length of the MAC Client Data section (including any padding) of a octets [IEEE.802-3.2005] [ipfix-iana@cisco.com] frame as defined in section 3.1 of [IEEE.802-3.2005]. The total length of the Ethernet frame (excluding the Preamble, SFD, 242 ethernetTotalLength unsigned16 identifier current Extension and FCS fields) as described in section 3.1 of octets [IEEE.802-3.2005] [ipfix-iana@cisco.com] [IEEE.802-3.2005]. The value of the 12-bit VLAN Identifier portion of the Tag Control Information field of an Ethernet frame as described in section 3.5.5 of [IEEE.802-3.2005]. The structure and semantics within the Tag Control 243 dot1qVlanId unsigned16 identifier current Information field are defined in IEEE P802.1Q. In case of a QinQ frame, octets [IEEE.802-3.2005] [ipfix-iana@cisco.com] it represents the outer tag's VLAN identifier and in case of an IEEE 802.1ad frame it represents the Service VLAN identifier in the S-TAG Tag Control Information (TCI) field as described in [IEEE.802-1ad.2005]. The value of the 3-bit User Priority portion of the Tag Control Information field of an Ethernet frame as described in section 3.5.5 of [IEEE.802-3.2005]. The structure and semantics within the Tag Control 244 dot1qPriority unsigned8 identifier current Information field are defined in IEEE P802.1Q. In case of a QinQ frame, [IEEE.802-3.2005] [IEEE.802-1ad.2005] [ipfix-iana@cisco.com] it represents the outer tag's 3-bit Class of Service (CoS) identifier and in case of an IEEE 802.1ad frame it represents the 3-bit Priority Code Point (PCP) portion of the S-TAG Tag Control Information (TCI) field as described in [IEEE.802-1ad.2005]. In case of a QinQ frame, it represents the inner tag's (*) VLAN identifier and in case of an IEEE 802.1ad frame it represents the 245 dot1qCustomerVlanId unsigned16 identifier current Customer VLAN identifier in the C-TAG Tag Control Information (TCI) [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] [ipfix-iana@cisco.com] field as described in [IEEE.802-1ad.2005]. (*) Note: the 801.2Q tag directly following the outer one. In case of a QinQ frame, it represents the inner tag's (*) Class of Service (CoS) identifier and in case of an IEEE 802.1ad frame it 246 dot1qCustomerPriority unsigned8 identifier current represents the 3-bit Priority Code Point (PCP) portion of the C-TAG Tag [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] [ipfix-iana@cisco.com] Control Information (TCI) field as described in [IEEE.802-1ad.2005]. (*) Note: the 801.2Q tag directly following the outer one. The EVC Service Attribute which uniquely identifies the Ethernet 247 metroEvcId string current Virtual Connection (EVC) within a Metro Ethernet Network, as defined in MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 [ipfix-iana@cisco.com] section 6.2 of MEF 10.1. The MetroEVCID is encoded in a string of up to (Ethernet Local Management Interface) 100 characters. 248 metroEvcType unsigned8 identifier current The 3-bit EVC Service Attribute which identifies the type of service MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 [ipfix-iana@cisco.com] provided by an EVC. (Ethernet Local Management Interface) A 32-bit non-zero connection identifier, which together with the 249 pseudoWireId unsigned32 identifier current pseudoWireType, identifies the Pseudo Wire (PW) as defined in RFC 4447 See [RFC4447] for pseudowire definitions. [ipfix-iana@cisco.com] [RFC4447]. The value of this information element identifies the type of MPLS See [RFC4446] for the pseudowire type definition, and 250 pseudoWireType unsigned16 identifier current Pseudo Wire (PW) as defined in RFC 4446. http://www.iana.org/assignments/pwe3-parameters for [ipfix-iana@cisco.com] the IANA Pseudowire Types Registry. 251 pseudoWireControlWord unsigned32 identifier current The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as defined in See [RFC4385] for the Pseudo Wire Control Word [ipfix-iana@cisco.com] Section 3 of . definition. 252 ingressPhysicalInterface unsigned32 identifier current The index of a networking device's physical interface (example, a See [RFC2863] for the definition of the ifIndex [ipfix-iana@cisco.com] switch port) where packets of this flow are being received. object. 253 egressPhysicalInterface unsigned32 identifier current The index of a networking device's physical interface (example, a See [RFC2863] for the definition of the ifIndex [ipfix-iana@cisco.com] switch port) where packets of this flow are being sent. object. The definition of this Information Element is identical to the 254 postDot1qVlanId unsigned16 identifier current definition of Information Element 'dot1qVlanId', except that it reports [IEEE.802-3.2005] [IEEE.802-1ad.2005] [ipfix-iana@cisco.com] a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The definition of this Information Element is identical to the 255 postDot1qCustomerVlanId unsigned16 identifier current definition of Information Element 'dot1qCustomerVlanId', except that it [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] [ipfix-iana@cisco.com] reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. The Ethernet type field of an Ethernet frame that identifies the MAC [IEEE.802-3.2005] Ethertype registry available at 256 ethernetType unsigned16 identifier current client protocol carried in the payload as defined in paragraph 1.4.349 http://standards.ieee.org/regauth/ethertype/eth.txt [ipfix-iana@cisco.com] of [IEEE.802-3.2005]. The definition of this Information Element is identical to the See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of Information Element 'ipPrecedence', except that it definition of the IP Precedence. See [RFC1812] 257 postIpPrecedence unsigned8 identifier current reports a potentially modified value caused by a middlebox function 0-7 (Section 5.3.2) and [RFC791] for the definition of the [ipfix-iana@cisco.com] after the packet passed the Observation Point. IPv4 TOS field. See [RFC2460] for the definition of the IPv6 Traffic Class field. The absolute timestamp at which the data within the scope containing this Information Element was received by a Collecting Process. This 258 collectionTimeMilliseconds dateTimeMilliseconds current Information Element SHOULD be bound to its containing IPFIX Message via [RFC5655] IPFIX Options and the messageScope Information Element, as defined below. The value of the SCTP Stream Identifier used by the Exporting Process 259 exportSctpStreamId unsigned16 identifier current for exporting IPFIX Message data. This is carried in the Stream [RFC5655] Identifier field of the header of the SCTP DATA chunk containing the IPFIX Message(s). The absolute Export Time of the latest IPFIX Message within the scope 260 maxExportSeconds dateTimeSeconds current containing this Information Element. This Information Element SHOULD be seconds [RFC5655] bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the second 261 maxFlowEndSeconds dateTimeSeconds current if necessary. This Information Element SHOULD be bound to its seconds [RFC5655] containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. The MD5 checksum of the IPFIX Message containing this record. This Information Element SHOULD be bound to its containing IPFIX Message via an options record and the messageScope Information Element, as defined below, and SHOULD appear only once in a given IPFIX Message. To calculate the value of this Information Element, first buffer the 262 messageMD5Checksum octetArray (16 current containing IPFIX Message, setting the value of this Information Element [RFC5655][RFC1321] bytes) to all zeroes. Then calculate the MD5 checksum of the resulting buffer as defined in [RFC1321], place the resulting value in this Information Element, and export the buffered message. This Information Element is intended as a simple checksum only; therefore collision resistance and algorithm agility are not required, and MD5 is an appropriate message digest. The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Message that contains them. It is defined for general purpose 263 messageScope unsigned8 current message scoping of options, and proposed specifically to allow the [RFC5655] attachment a checksum to a message via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process. The absolute Export Time of the earliest IPFIX Message within the scope 264 minExportSeconds dateTimeSeconds current containing this Information Element. This Information Element SHOULD be seconds [RFC5655] bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to 265 minFlowStartSeconds dateTimeSeconds current the second if necessary. This Information Element SHOULD be bound to seconds [RFC5655] its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element is used to encapsulate non- IPFIX data into an IPFIX Message stream, for the purpose of allowing a non-IPFIX data processor to store a data stream inline within an IPFIX File. A 266 opaqueOctets octetArray current Collecting Process or File Writer MUST NOT try to interpret this binary [RFC5655] data. This Information Element differs from paddingOctets as its contents are meaningful in some non-IPFIX context, while the contents of paddingOctets MUST be 0x00 and are intended only for Information Element alignment. The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Transport Session that contains them. Note that as all options are implicitly scoped to Transport Session and Observation Domain, this Information Element is equivalent to a "null" scope. It is 267 sessionScope unsigned8 current defined for general purpose session scoping of options, and proposed [RFC5655] specifically to allow the attachment of time window to an IPFIX File via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the microsecond if necessary. This Information Element SHOULD be bound to 268 maxFlowEndMicroseconds dateTimeMicroseconds current its containing IPFIX Transport Session via IPFIX Options and the microseconds [RFC5655] sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the millisecond if necessary. This Information Element SHOULD be bound to 269 maxFlowEndMilliseconds dateTimeMilliseconds current its containing IPFIX Transport Session via IPFIX Options and the milliseconds [RFC5655] sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements. The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element. This Information Element 270 maxFlowEndNanoseconds dateTimeNanoseconds current SHOULD be bound to its containing IPFIX Transport Session via IPFIX nanoseconds [RFC5655] Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the microsecond if necessary. This Information Element SHOULD be bound 271 minFlowStartMicroseconds dateTimeMicroseconds current to its containing IPFIX Transport Session via an options record and the microseconds [RFC5655] sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the millisecond if necessary. This Information Element SHOULD be bound 272 minFlowStartMilliseconds dateTimeMilliseconds current to its containing IPFIX Transport Session via an options record and the milliseconds [RFC5655] sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements. The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via 273 minFlowStartNanoseconds dateTimeNanoseconds current an options record and the sessionScope Information Element. This nanoseconds [RFC5655] Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements. The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This 274 collectorCertificate octetArray current Information Element SHOULD be bound to its containing IPFIX Transport [RFC5655] Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element. The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This 275 exporterCertificate octetArray current Information Element SHOULD be bound to its containing IPFIX Transport [RFC5655] Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element. The reliability of the export of Data Records, within this SCTP stream, for the element(s) in the Options Template scope, usually a templateID. A value of 'true' means that the Exporting Process MUST send any Data 276 dataRecordsReliability boolean identifier current Records associated with the element(s) reliably within this SCTP [RFC-ietf-ipfix-export-per-sctp-stream-06] stream. A value of 'false' means that the Exporting Process MAY send any Data Records associated with the element(s) unreliably within this SCTP stream. 277-300 Unassigned From all the packets observed at an Observation Point, a subset of the packets is selected by a sequence of one or more Selectors. The 301 selectionSequenceId unsigned64 identifier current selectionSequenceId is a unique value per Observation Domain, [RFC5477] specifying the Observation Point and the sequence of Selectors through which the packets are selected. 302 selectorId unsigned16 identifier current The Selector ID is the unique ID identifying a Primitive Selector. Each [RFC5477] Primitive Selector must have a unique ID in the Observation Domain. 303 informationElementId unsigned16 identifier current This Information Element contains the ID of another Information [RFC5477] Element. This Information Element identifies the packet selection methods (e.g., Filtering, Sampling) that are applied by the Selection Process. Most of these methods have parameters. Further Information Elements are needed to fully specify packet selection with these methods and all their parameters. The methods listed below are defined in [RFC5475]. For their parameters, Information Elements are defined in the information model document. The names of these Information Elements are listed for each method identifier. Further method identifiers may be added to the list below. It might be necessary to define new Information Elements to specify their parameters. The selectorAlgorithm registry is maintained by IANA. New assignments for the registry will be administered by IANA, and are subject to Expert Review [RFC5226]. The registry can be updated 304 selectorAlgorithm unsigned16 identifier current when specifications of the new method(s) and any new Information [RFC5477] Elements are provided. The group of experts must double check the selectorAlgorithm definitions and Information Elements with already defined selectorAlgorithms and Information Elements for completeness, accuracy, and redundancy. Those experts will initially be drawn from the Working Group Chairs and document editors of the IPFIX and PSAMP Working Groups. The following packet selection methods identifiers are defined here: http://www.iana.org/assignments/psamp-parameters/psamp-parameters.xhtml There is a broad variety of possible parameters that could be used for Property match Filtering (5) but currently there are no agreed parameters specified. This Information Element specifies the number of packets that are consecutively sampled. A value of 100 means that 100 consecutive 305 samplingPacketInterval unsigned32 quantity current packets are sampled. For example, this Information Element may be used packets [RFC5477] to describe the configuration of a systematic count-based Sampling Selector. This Information Element specifies the number of packets between two "samplingPacketInterval"s. A value of 100 means that the next interval 306 samplingPacketSpace unsigned32 quantity current starts 100 packets (which are not sampled) after the current packets [RFC5477] "samplingPacketInterval" is over. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector. This Information Element specifies the time interval in microseconds 307 samplingTimeInterval unsigned32 quantity current during which all arriving packets are sampled. For example, this microseconds [RFC5477] Information Element may be used to describe the configuration of a systematic time-based Sampling Selector. This Information Element specifies the time interval in microseconds between two "samplingTimeInterval"s. A value of 100 means that the next 308 samplingTimeSpace unsigned32 quantity current interval starts 100 microseconds (during which no packets are sampled) microseconds [RFC5477] after the current "samplingTimeInterval" is over. For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector. This Information Element specifies the number of elements taken from 309 samplingSize unsigned32 quantity current the parent Population for random Sampling methods. For example, this packets [RFC5477] Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector. This Information Element specifies the number of elements in the parent 310 samplingPopulation unsigned32 quantity current Population for random Sampling methods. For example, this Information packets [RFC5477] Element may be used to describe the configuration of a random n-out-of-N Sampling Selector. This Information Element specifies the probability that a packet is sampled, expressed as a value between 0 and 1. The probability is equal 311 samplingProbability float64 quantity current for every packet. A value of 0 means no packet was sampled since the [RFC5477] probability is 0. For example, this Information Element may be used to describe the configuration of a uniform probabilistic Sampling Selector. 312 Unassigned This Information Element, which may have a variable length, carries a series of octets from the start of the IP header of a sampled packet. 313 ipHeaderPacketSection octetArray current With sufficient length, this element also reports octets from the IP [RFC5477] payload, subject to [RFC2804]. See the Security Considerations section. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. This Information Element, which may have a variable length, carries a series of octets from the start of the IP payload of a sampled packet. The IPv4 payload is that part of the packet that follows the IPv4 header and any options, which [RFC0791] refers to as "data" or "data 314 ipPayloadPacketSection octetArray current octets". For example, see the examples in [RFC0791], APPENDIX A. The [RFC5477] IPv6 payload is the rest of the packet following the 40 octet IPv6 header. Note that any extension headers present are considered part of the payload. See [RFC2460] for the IPv6 specification. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. 315 Unassigned This Information Element, which may have a variable length, carries the first n octets from the MPLS label stack of a sampled packet. With sufficient length, this element also reports octets from the MPLS 316 mplsLabelStackSection octetArray current payload, subject to [RFC2804]. See the Security Considerations section. [RFC5477] See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. This Information Element, which may have a variable length, carries the first n octets from the MPLS payload of a sampled packet, being data that follows immediately after the MPLS label stack. See [RFC3031] for 317 mplsPayloadPacketSection octetArray current the specification of MPLS packets. See [RFC3032] for the specification [RFC5477] of the MPLS label stack. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. This Information Element specifies the total number of packets observed by a Selector, for a specific value of SelectorId. This Information 318 selectorIdTotalPktsObserved unsigned64 totalCounter current Element should be used in an Options Template scoped to the observation packets [RFC5477] to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. This Information Element specifies the total number of packets selected by a Selector, for a specific value of SelectorId. This Information 319 selectorIdTotalPktsSelected unsigned64 totalCounter current Element should be used in an Options Template scoped to the observation packets [RFC5477] to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. This Information Element specifies the maximum possible measurement error of the reported value for a given Information Element. The absoluteError has the same unit as the Information Element with which The units of it is associated. The real value of the metric can differ by the absoluteError (positive or negative) from the measured value. This Information 320 absoluteError float64 quantity current Information Element provides only the error for measured values. If an Element for [RFC5477] Information Element contains an estimated value (from Sampling), the which the confidence boundaries and confidence level have to be provided instead, error is using the upperCILimit, lowerCILimit, and confidenceLevel Information specified. Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. This Information Element specifies the maximum possible positive or negative error ratio for the reported value for a given Information Element as percentage of the measured value. The real value of the metric can differ by relativeError percent (positive or negative) from the measured value. This Information Element provides only the error 321 relativeError float64 quantity current for measured values. If an Information Element contains an estimated [RFC5477] value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. 322 observationTimeSeconds dateTimeSeconds quantity current This Information Element specifies the absolute time in seconds of an seconds [RFC5477] observation. 323 observationTimeMilliseconds dateTimeMilliseconds quantity current This Information Element specifies the absolute time in milliseconds of milliseconds [RFC5477] an observation. 324 observationTimeMicroseconds dateTimeMicroseconds quantity current This Information Element specifies the absolute time in microseconds of microseconds [RFC5477] an observation. 325 observationTimeNanoseconds dateTimeNanoseconds quantity current This Information Element specifies the absolute time in nanoseconds of nanoseconds [RFC5477] an observation. 326 digestHashValue unsigned64 quantity current This Information Element specifies the value from the digest hash [RFC5477] function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. This Information Element specifies the IP payload offset used by a 327 hashIPPayloadOffset unsigned64 quantity current Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5477] [RFC5475]. This Information Element specifies the IP payload size used by a 328 hashIPPayloadSize unsigned64 quantity current Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5477] [RFC5475]. This Information Element specifies the value for the beginning of a 329 hashOutputRangeMin unsigned64 quantity current hash function's potential output range. See also Sections 6.2, 3.8 and [RFC5477] 7.1 of [RFC5475]. This Information Element specifies the value for the end of a hash 330 hashOutputRangeMax unsigned64 quantity current function's potential output range. See also Sections 6.2, 3.8 and 7.1 [RFC5477] of [RFC5475]. This Information Element specifies the value for the beginning of a 331 hashSelectedRangeMin unsigned64 quantity current hash function's selected range. See also Sections 6.2, 3.8 and 7.1 of [RFC5477] [RFC5475]. This Information Element specifies the value for the end of a hash 332 hashSelectedRangeMax unsigned64 quantity current function's selected range. See also Sections 6.2, 3.8 and 7.1 of [RFC5477] [RFC5475]. This Information Element contains a boolean value that is TRUE if the 333 hashDigestOutput boolean quantity current output from this hash Selector has been configured to be included in [RFC5477] the packet report as a packet digest, else FALSE. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. 334 hashInitialiserValue unsigned64 quantity current This Information Element specifies the initialiser value to the hash [RFC5477] function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. 335 selectorName string current The name of a selector identified by a selectorID. Globally unique per [ipfix-iana@cisco.com] Metering Process. This Information Element specifies the upper limit of a confidence interval. It is used to provide an accuracy statement for an estimated value. The confidence limits define the range in which the real value is assumed to be with a certain probability p. Confidence limits always need to be associated with a confidence level that defines this probability p. Please note that a confidence interval only provides a 336 upperCILimit float64 quantity current probability that the real value lies within the limits. That means the [RFC5477] real value can lie outside the confidence limits. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. This Information Element specifies the lower limit of a confidence interval. For further information, see the description of upperCILimit. The upperCILimit, lowerCILimit, and confidenceLevel Information 337 lowerCILimit float64 quantity current Elements should all be used in an Options Template scoped to the [RFC5477] observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. This Information Element specifies the confidence level. It is used to provide an accuracy statement for estimated values. The confidence level provides the probability p with which the real value lies within a given range. A confidence level always needs to be associated with confidence limits that define the range in which the real value is 338 confidenceLevel float64 quantity current assumed to be. The upperCILimit, lowerCILimit, and confidenceLevel [RFC5477] Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. A description of the abstract data type of an IPFIX information element.These are taken from the abstract data types defined in section 3.1 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the informationElementDataType 339 informationElementDataType unsigned8 current sub-registry. These types are registered in the IANA IPFIX Information [RFC5610] Element Data Type subregistry. This subregistry is intended to assign numbers for type names, not to provide a mechanism for adding data types to the IPFIX Protocol, and as such requires a Standards Action [RFC5226] to modify. A UTF-8 [RFC3629] encoded Unicode string containing a human-readable description of an Information Element. The content of the informationElementDescription MAY be annotated with one or more language tags [RFC4646], encoded in-line [RFC2482] within the UTF-8 string, in order to specify the language in which the description is 340 informationElementDescription string current written. Description text in multiple languages MAY tag each section [RFC5610] with its own language tag; in this case, the description information in each language SHOULD have equivalent meaning. In the absence of any language tag, the "i-default" [RFC2277] language SHOULD be assumed. See the Security Considerations section for notes on string handling for Information Element type records. A UTF-8 [RFC3629] encoded Unicode string containing the name of an 341 informationElementName string current Information Element, intended as a simple identifier. See the Security [RFC5610] Considerations section for notes on string handling for Information Element type records 342 informationElementRangeBegin unsigned64 quantity current Contains the inclusive low end of the range of acceptable values for an [RFC5610] Information Element. 343 informationElementRangeEnd unsigned64 quantity current Contains the inclusive high end of the range of acceptable values for [RFC5610] an Information Element. A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in section 3.2 of the IPFIX Information Model [RFC5102]; see that section for more information on the types defined in the informationElementSemantics sub-registry. This field may take the values in Table ; the special 344 informationElementSemantics unsigned8 current value 0x00 (default) is used to note that no semantics apply to the [RFC5610] field; it cannot be manipulated by a Collecting Process or File Reader that does not understand it a priori. These semantics are registered in the IANA IPFIX Information Element Semantics subregistry. This subregistry is intended to assign numbers for semantics names, not to provide a mechanism for adding semantics to the IPFIX Protocol, and as such requires a Standards Action [RFC5226] to modify. A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in section 5 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the 345 informationElementUnits unsigned16 current informationElementsUnits sub-registry. This field may take the values [RFC5610] in Table 3 below; the special value 0x00 (none) is used to note that the field is unitless. These types are registered in the IANA IPFIX Information Element Units subregistry; new types may be added on a First Come First Served [RFC5226] basis. A private enterprise number, as assigned by IANA. Within the context of an Information Element Type record, this element can be used along with the informationElementId element to scope properties to a specific Information Element. To export type information about an IANA-assigned Information Element, set the privateEnterpriseNumber to 0, or do not 346 privateEnterpriseNumber unsigned32 identifier current export the privateEnterpriseNumber in the type record. To export type [RFC5610] information about an enterprise-specific Information Element, export the enterprise number in privateEnterpriseNumber, and export the Information Element number with the Enterprise bit cleared in informationElementId. The Enterprise bit in the associated informationElementId Information Element MUST be ignored by the Collecting Process. 347-32767 Unassigned IPFIX MPLS label type (Value 46) Reference [RFC5102] Note New assignments for MPLS label types will be administered by IANA, on a First Come First Served basis [RFC2434], subject to Expert Review [RFC2434], i.e. review by one of a group of experts designated by an IETF Operations and Management Area Director. The group of experts must double check the label type definitions with already defined label types for completeness, accuracy, and redundancy. The specification of new MPLS label types MUST be published using a well established and persistent publication medium. Registration Procedures Expert Review Value Description Reference 1 TE-MIDPT: Any TE tunnel mid-point or tail label [RFC5102] 2 Pseudowire: Any PWE3 or Cisco AToM based label [RFC5102] 3 VPN: Any label associated with VPN [RFC5102] 4 BGP: Any label associated with BGP or BGP routing [RFC5102] 5 LDP: Any label associated with dynamically assigned labels using LDP [RFC5102] 6-255 Unassigned [RFC5102] IPFIX Version Numbers Reference [RFC5101] Registration Procedures Standards Action Value Version Reference 0 Reserved 1-8 Reserved (historic) 9 Cisco Systems NetFlow Version 9 (historic) [RFC3954] 10 IPFIX as documented in RFC5101 [RFC5101] 11-65535 Unassigned IPFIX Set IDs Reference [RFC5101] Registration Procedures Standards Action Value Set Identifier Reference 0-1 Not used (historic) [RFC3954] 2 Template Set [RFC5101] 3 Option Template Set [RFC5101] 4-255 Unassigned [RFC5101] 256-65535 Reserved for Data Sets [RFC5101] IPFIX informationElementDataTypes Reference [RFC5610] Registration Procedures Standards Action Value Description Reference 0 octetArray [RFC5610] 1 unsigned8 [RFC5610] 2 unsigned16 [RFC5610] 3 unsigned32 [RFC5610] 4 unsigned64 [RFC5610] 5 signed8 [RFC5610] 6 signed16 [RFC5610] 7 signed32 [RFC5610] 8 signed64 [RFC5610] 9 float32 [RFC5610] 10 float64 [RFC5610] 11 boolean [RFC5610] 12 macAddress [RFC5610] 13 string [RFC5610] 14 dateTimeSeconds [RFC5610] 15 dateTimeMilliseconds [RFC5610] 16 dateTimeMicroseconds [RFC5610] 17 dateTimeNanoseconds [RFC5610] 18 ipv4Address [RFC5610] 19 ipv6Address [RFC5610] 20-255 Unassigned [RFC5610] IPFIX informationElementSemantics Reference [RFC5610] Registration Procedures Standards Action Value Description Reference 0 default [RFC5610] 1 quantity [RFC5610] 2 totalCounter [RFC5610] 3 deltaCounter [RFC5610] 4 identifier [RFC5610] 5 flags [RFC5610] 6-255 Unassigned [RFC5610] IPFIX informationElementUnits Reference [RFC5610] Registration Procedures Expert Review Value Name Notes Reference 0 none [RFC5610] 1 bits [RFC5610] 2 octets [RFC5610] 3 packets [RFC5610] 4 flows [RFC5610] 5 seconds [RFC5610] 6 milliseconds [RFC5610] 7 microseconds [RFC5610] 8 nanoseconds [RFC5610] 9 4-octet words for IPv4 header length [RFC5610] 10 messages for reliability reporting [RFC5610] 11 hops for TTL [RFC5610] 12 entries for MPLS label stack [RFC5610] 13-65535 Unassigned [RFC5610]