2007-05-10 2012-12-05 For the IPFIX schema, please see . Expert Review Primary expert - Nevil Brownlee and Secondary expert - Juergen Quittek Values 0-127: NFv9-compatible Reserved 0 current octetDeltaCount unsigned64 flowCounter deltaCounter 1 data current The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload. octets packetDeltaCount unsigned64 flowCounter deltaCounter 2 data current The number of incoming packets since the previous report (if any) for this Flow at the Observation Point. packets deltaFlowCount unsigned64 deltaCounter 3 current The conservative count of Original Flows contributing to this Aggregated Flow; may be distributed via any of the methods expressed by the valueDistributionMethod Information Element. protocolIdentifier unsigned8 ipHeader identifier 4 all current The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. See for the specification of the IPv4 protocol field. See for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at . ipClassOfService unsigned8 ipHeader identifier 5 all current For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header. See (Section 5.3.2) and for the definition of the IPv4 TOS field. See for the definition of the IPv6 Traffic Class field. tcpControlBits unsigned8 minMax flags 6 all current TCP control bits observed for packets of this Flow. The information is encoded in a set of bit fields. For each TCP control bit, there is a bit in this set. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. A value of 0 for a bit indicates that the corresponding bit was not set in any of the observed packets of this Flow. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | Reserved | URG | ACK | PSH | RST | SYN | FIN | +-----+-----+-----+-----+-----+-----+-----+-----+ Reserved: Reserved for future use by TCP. Must be zero. URG: Urgent Pointer field significant ACK: Acknowledgment field significant PSH: Push Function RST: Reset the connection SYN: Synchronize sequence numbers FIN: No more data from sender See for the definition of the TCP control bits in the TCP header. sourceTransportPort unsigned16 transportHeader identifier 7 all current The source port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. See for the definition of the UDP source port field. See for the definition of the TCP source port field. See for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at . sourceIPv4Address ipv4Address ipHeader identifier 8 all current The IPv4 source address in the IP packet header. See for the definition of the IPv4 source address field. sourceIPv4PrefixLength unsigned8 ipHeader 9 option current The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element. bits 0-32 ingressInterface unsigned32 scope identifier 10 all current The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. See for the definition of the ifIndex object. destinationTransportPort unsigned16 transportHeader identifier 11 all current The destination port identifier in the transport header. For the transport protocols UDP, TCP, and SCTP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers. See for the definition of the UDP destination port field. See for the definition of the TCP destination port field. See for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at . destinationIPv4Address ipv4Address ipHeader identifier 12 all current The IPv4 destination address in the IP packet header. See for the definition of the IPv4 destination address field. destinationIPv4PrefixLength unsigned8 ipHeader 13 option current The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element. bits 0-32 egressInterface unsigned32 scope identifier 14 all current The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. See for the definition of the ifIndex object. ipNextHopIPv4Address ipv4Address derived identifier 15 data current The IPv4 address of the next IPv4 hop. bgpSourceAsNumber unsigned32 derived identifier 16 all current The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. See for a description of BGP-4, and see for the definition of the AS number. bgpDestinationAsNumber unsigned32 derived identifier 17 all current The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. See for a description of BGP-4, and see for the definition of the AS number. bgpNextHopIPv4Address ipv4Address derived identifier 18 all current The IPv4 address of the next (adjacent) BGP hop. See for a description of BGP-4. postMCastPacketDeltaCount unsigned64 flowCounter deltaCounter 19 data current The number of outgoing multicast packets since the previous report (if any) sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. packets postMCastOctetDeltaCount unsigned64 flowCounter deltaCounter 20 data current The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload. octets flowEndSysUpTime unsigned32 timestamp 21 data current The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). milliseconds flowStartSysUpTime unsigned32 timestamp 22 data current The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). milliseconds postOctetDeltaCount unsigned64 flowCounter deltaCounter 23 data current The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. octets postPacketDeltaCount unsigned64 flowCounter deltaCounter 24 data current The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. packets minimumIpTotalLength unsigned64 minMax 25 all current Length of the smallest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length. octets See for the specification of the IPv4 total length. See for the specification of the IPv6 payload length. See for the specification of the IPv6 jumbo payload length. maximumIpTotalLength unsigned64 minMax 26 all current Length of the largest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length. octets See for the specification of the IPv4 total length. See for the specification of the IPv6 payload length. See for the specification of the IPv6 jumbo payload length. sourceIPv6Address ipv6Address ipHeader identifier 27 all current The IPv6 source address in the IP packet header. See for the definition of the Source Address field in the IPv6 header. destinationIPv6Address ipv6Address ipHeader identifier 28 all current The IPv6 destination address in the IP packet header. See for the definition of the Destination Address field in the IPv6 header. sourceIPv6PrefixLength unsigned8 ipHeader 29 option current The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element. bits 0-128 destinationIPv6PrefixLength unsigned8 ipHeader 30 option current The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element. bits 0-128 flowLabelIPv6 unsigned32 ipHeader identifier 31 all current The value of the IPv6 Flow Label field in the IP packet header. See for the definition of the Flow Label field in the IPv6 packet header. icmpTypeCodeIPv4 unsigned16 transportHeader identifier 32 all current Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. See for the definition of the IPv4 ICMP type and code fields. igmpType unsigned8 transportHeader identifier 33 all current The type field of the IGMP message. See for the definition of the IGMP type field. 34-35 flowActiveTimeout unsigned16 misc 36 all current The number of seconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets. seconds flowIdleTimeout unsigned16 misc 37 all current A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field. seconds 38-39 exportedOctetTotalCount unsigned64 processCounter totalCounter 40 data current The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX Messages that were successfully sent to the Collecting Process. The reported number excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process. octets exportedMessageTotalCount unsigned64 processCounter totalCounter 41 data current The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process. messages exportedFlowRecordTotalCount unsigned64 processCounter totalCounter 42 data current The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes Flow Records in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process. flows 43 sourceIPv4Prefix ipv4Address ipHeader 44 data current IPv4 source address prefix. destinationIPv4Prefix ipv4Address ipHeader 45 data current IPv4 destination address prefix. mplsTopLabelType unsigned8 derived identifier 46 data current This field identifies the control protocol that allocated the top-of-stack label. Values for this field are listed in the MPLS label type registry. See See for the MPLS label structure. See for the association of MPLS labels with Virtual Private Networks (VPNs). See for BGP and BGP routing. See for Label Distribution Protocol (LDP). See the list of MPLS label types assigned by IANA at . mplsTopLabelIPv4Address ipv4Address derived identifier 47 data current The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to. See for the association between MPLS labels and IP addresses. 48-51 minimumTTL unsigned8 minMax 52 data current Minimum TTL value observed for any packet in this Flow. hops See for the definition of the IPv4 Time to Live field. See for the definition of the IPv6 Hop Limit field. maximumTTL unsigned8 minMax 53 data current Maximum TTL value observed for any packet in this Flow. hops See for the definition of the IPv4 Time to Live field. See for the definition of the IPv6 Hop Limit field. fragmentIdentification unsigned32 ipHeader identifier 54 data current The value of the Identification field in the IPv4 packet header or in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header. See for the definition of the IPv4 Identification field. See for the definition of the Identification field in the IPv6 Fragment header. postIpClassOfService unsigned8 ipHeader identifier 55 all current The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. See for the definition of the IPv4 TOS field. See for the definition of the IPv6 Traffic Class field. See for the definition of middleboxes. sourceMacAddress macAddress subIpHeader identifier 56 data current The IEEE 802 source MAC address field. See IEEE.802-3.2002. postDestinationMacAddress macAddress subIpHeader identifier 57 data current The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. See IEEE.802-3.2002. vlanId unsigned16 subIpHeader identifier 58 data current Virtual LAN identifier associated with ingress interface. For dot1q vlans, see 243 dot1qVlanId. See IEEE.802-1Q.2003. postVlanId unsigned16 subIpHeader identifier 59 data current Virtual LAN identifier associated with egress interface. For postdot1q vlans, see 254 postDot1qVlanId. See IEEE.802-1Q.2003. ipVersion unsigned8 ipHeader identifier 60 all current The IP version field in the IP packet header. See for the definition of the version field in the IPv4 packet header. See for the definition of the version field in the IPv6 packet header. Additional information on defined version numbers can be found at . flowDirection unsigned8 misc identifier 61 data current The direction of the Flow observed at the Observation Point. There are only two values defined. 0x00: ingress flow 0x01: egress flow ipNextHopIPv6Address ipv6Address derived identifier 62 data current The IPv6 address of the next IPv6 hop. bgpNextHopIPv6Address ipv6Address derived identifier 63 all current The IPv6 address of the next (adjacent) BGP hop. See for a description of BGP-4. ipv6ExtensionHeaders unsigned32 minMax flags 64 all current IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 option header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contained the respective IPv6 extension header, the value of the corresponding bit is 0. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | DST | HOP | Res | UNK |FRA0 | RH |FRA1 | Res | ... +-----+-----+-----+-----+-----+-----+-----+-----+ 8 9 10 11 12 13 14 15 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | Reserved | MOB | ESP | AH | PAY | ... +-----+-----+-----+-----+-----+-----+-----+-----+ 16 17 18 19 20 21 22 23 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | Reserved | ... +-----+-----+-----+-----+-----+-----+-----+-----+ 24 25 26 27 28 29 30 31 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | Reserved | +-----+-----+-----+-----+-----+-----+-----+-----+ Bit IPv6 Option Description 0, DST 60 Destination option header 1, HOP 0 Hop-by-hop option header 2, Res Reserved 3, UNK Unknown Layer 4 header (compressed, encrypted, not supported) 4, FRA0 44 Fragment header - first fragment 5, RH 43 Routing header 6, FRA1 44 Fragmentation header - not first fragment 7, Res Reserved 8 to 11 Reserved 12, MOB 135 IPv6 mobility [RFC3775] 13, ESP 50 Encrypted security payload 14, AH 51 Authentication Header 15, PAY 108 Payload compression header 16 to 31 Reserved See for the general definition of IPv6 extension headers and for the specification of the hop-by-hop options header, the routing header, the fragment header, and the destination options header. See for the specification of the authentication header. See for the specification of the encapsulating security payload. The diagram provided in is incorrect. The diagram in this registry is taken from Errata 1738. See 65-69 mplsTopLabelStackSection octetArray subIpHeader identifier 70 all current The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed. The size of this Information Element is 3 octets. 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label | Exp |S| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Label: Label Value, 20 bits Exp: Experimental Use, 3 bits S: Bottom of Stack, 1 bit See . mplsLabelStackSection2 octetArray subIpHeader identifier 71 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection3 octetArray subIpHeader identifier 72 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection4 octetArray subIpHeader identifier 73 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection5 octetArray subIpHeader identifier 74 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection6 octetArray subIpHeader identifier 75 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection7 octetArray subIpHeader identifier 76 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection8 octetArray subIpHeader identifier 77 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection9 octetArray subIpHeader identifier 78 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . mplsLabelStackSection10 octetArray subIpHeader identifier 79 all current The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets. See . destinationMacAddress macAddress subIpHeader identifier 80 data current The IEEE 802 destination MAC address field. See IEEE.802-3.2002. postSourceMacAddress macAddress subIpHeader identifier 81 data current The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. See IEEE.802-3.2002. interfaceName string 82 current A short name uniquely describing an interface, eg "Eth1/0". See for the definition of the ifName object. interfaceDescription string 83 current The description of an interface, eg "FastEthernet 1/0" or "ISP connection". See for the definition of the ifDescr object. 84 octetTotalCount unsigned64 flowCounter totalCounter 85 all current The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. octets packetTotalCount unsigned64 flowCounter totalCounter 86 all current The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. packets 87 fragmentOffset unsigned16 ipHeader identifier 88 all current The value of the IP fragment offset field in the IPv4 packet header or the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header. See for the specification of the fragment offset in the IPv4 header. See for the specification of the fragment offset in the IPv6 Fragment header. 89 mplsVpnRouteDistinguisher octetArray derived identifier 90 all current The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to RFC 4364, the size of mplsVpnRouteDistinguisher is 8 octets. However, in RFC 4382 an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets. See for the specification of the route distinguisher. See for the specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN) Management Information Base. mplsTopLabelPrefixLength unsigned8 identifier 91 current The prefix length of the subnet of the mplsTopLabelIPv4Address that the MPLS top label will cause the Flow to be forwarded to. bits 0-32 See for the association between MPLS labels and prefix lengths. 92-93 applicationDescription string 94 current Specifies the description of an application. applicationId octetArray identifier 95 current Specifies an Application ID per . See section 4 of for the applicationId Information Element Specification. applicationName string 96 current Specifies the name of an application. 97 postIpDiffServCodePoint unsigned8 identifier 98 current The definition of this Information Element is identical to the definition of Information Element 'ipDiffServCodePoint', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. 0-63 See for the definition of the Differentiated Services Field. See section 5.3.2 of and for the definition of the IPv4 TOS field. See for the definition of the IPv6 Traffic Class field. See the IPFIX Information Model for the 'ipDiffServCodePoint' specification. multicastReplicationFactor unsigned32 quantity 99 current The amount of multicast replication that's applied to a traffic stream. See for the specification of reserved IPv4 multicast addresses. See for the specification of reserved IPv6 multicast addresses. 100 classificationEngineId unsigned8 identifier 101 current A unique identifier for the engine that determined the Selector ID. Thus, the Classification Engine ID defines the context for the Selector ID. The Classification Engine can be considered a specific registry for application assignments. Values for this field are listed in the Classification Engine IDs registry. See 102-127 bgpNextAdjacentAsNumber unsigned32 derived identifier 128 all current The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. See for a description of BGP-4, and see for the definition of the AS number. bgpPrevAdjacentAsNumber unsigned32 derived identifier 129 all current The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value. See for a description of BGP-4, and see for the definition of the AS number. exporterIPv4Address ipv4Address config identifier 130 all current The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. exporterIPv6Address ipv6Address config identifier 131 all current The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy. droppedOctetDeltaCount unsigned64 flowCounter deltaCounter 132 data current The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of octets includes IP header(s) and IP payload. octets droppedPacketDeltaCount unsigned64 flowCounter deltaCounter 133 data current The number of packets since the previous report (if any) of this Flow dropped by packet treatment. packets droppedOctetTotalCount unsigned64 flowCounter totalCounter 134 data current The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. octets droppedPacketTotalCount unsigned64 flowCounter totalCounter 135 data current The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point. packets flowEndReason unsigned8 misc identifier 136 data current The reason for Flow termination. The range of values includes the following: 0x01: idle timeout The Flow was terminated because it was considered to be idle. 0x02: active timeout The Flow was terminated for reporting purposes while it was still active, for example, after the maximum lifetime of unreported Flows was reached. 0x03: end of Flow detected The Flow was terminated because the Metering Process detected signals indicating the end of the Flow, for example, the TCP FIN flag. 0x04: forced end The Flow was terminated because of some external event, for example, a shutdown of the Metering Process initiated by a network management application. 0x05: lack of resources The Flow was terminated because of lack of resources available to the Metering Process and/or the Exporting Process. commonPropertiesId unsigned64 scope identifier 137 option current An identifier of a set of common properties that is unique per Observation Domain and Transport Session. Typically, this Information Element is used to link to information reported in separate Data Records. observationPointId unsigned32 scope identifier 138 option current An identifier of an Observation Point that is unique per Observation Domain. It is RECOMMENDED that this identifier is also unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. icmpTypeCodeIPv6 unsigned16 transportHeader identifier 139 all current Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code. See for the definition of the IPv6 ICMP type and code fields. mplsTopLabelIPv6Address ipv6Address derived identifier 140 data current The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to. See for the association between MPLS labels and IP addresses. lineCardId unsigned32 scope identifier 141 option current An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements. portId unsigned32 scope identifier 142 option current An identifier of a line port that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements. meteringProcessId unsigned32 scope identifier 143 option current An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Metering Process may be re-started with a different ID. exportingProcessId unsigned32 scope identifier 144 option current An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Exporting Process may be re-started with a different ID. templateId unsigned16 scope identifier 145 option current An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain. Template IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created. Template IDs of Data Sets are numbered from 256 to 65535. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned. wlanChannelId unsigned8 subIpHeader identifier 146 data current The identifier of the 802.11 (Wi-Fi) channel used. See IEEE.802-11.1999. wlanSSID string subIpHeader 147 data current The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used. According to IEEE.802-11.1999, the SSID is encoded into a string of up to 32 characters. See IEEE.802-11.1999. flowId unsigned64 scope identifier 148 option current An identifier of a Flow that is unique within an Observation Domain. This Information Element can be used to distinguish between different Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records. observationDomainId unsigned32 scope identifier 149 option current An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device. A value of 0 indicates that no specific Observation Domain is identified by this Information Element. Typically, this Information Element is used for limiting the scope of other Information Elements. flowStartSeconds dateTimeSeconds timestamp 150 data current The absolute timestamp of the first packet of this Flow. seconds flowEndSeconds dateTimeSeconds timestamp 151 data current The absolute timestamp of the last packet of this Flow. seconds flowStartMilliseconds dateTimeMilliseconds timestamp 152 data current The absolute timestamp of the first packet of this Flow. milliseconds flowEndMilliseconds dateTimeMilliseconds timestamp 153 data current The absolute timestamp of the last packet of this Flow. milliseconds flowStartMicroseconds dateTimeMicroseconds timestamp 154 data current The absolute timestamp of the first packet of this Flow. microseconds flowEndMicroseconds dateTimeMicroseconds timestamp 155 data current The absolute timestamp of the last packet of this Flow. microseconds flowStartNanoseconds dateTimeNanoseconds timestamp 156 data current The absolute timestamp of the first packet of this Flow. nanoseconds flowEndNanoseconds dateTimeNanoseconds timestamp 157 data current The absolute timestamp of the last packet of this Flow. nanoseconds flowStartDeltaMicroseconds unsigned32 timestamp 158 data current This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the first observed packet of this Flow relative to the export time specified in the IPFIX Message Header. microseconds See the IPFIX protocol specification for the definition of the IPFIX Message Header. flowEndDeltaMicroseconds unsigned32 timestamp 159 data current This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the last observed packet of this Flow relative to the export time specified in the IPFIX Message Header. microseconds See the IPFIX protocol specification for the definition of the IPFIX Message Header. systemInitTimeMilliseconds dateTimeMilliseconds timestamp 160 data current The absolute timestamp of the last (re-)initialization of the IPFIX Device. milliseconds flowDurationMilliseconds unsigned32 misc 161 data current The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. milliseconds flowDurationMicroseconds unsigned32 misc 162 data current The difference in time between the first observed packet of this Flow and the last observed packet of this Flow. microseconds observedFlowTotalCount unsigned64 processCounter totalCounter 163 data current The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point. flows ignoredPacketTotalCount unsigned64 processCounter totalCounter 164 data current The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process. packets ignoredOctetTotalCount unsigned64 processCounter totalCounter 165 data current The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process. octets notSentFlowTotalCount unsigned64 processCounter totalCounter 166 data current The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies. flows notSentPacketTotalCount unsigned64 processCounter totalCounter 167 data current The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies. packets notSentOctetTotalCount unsigned64 processCounter totalCounter 168 data current The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies. octets destinationIPv6Prefix ipv6Address ipHeader 169 data current IPv6 destination address prefix. sourceIPv6Prefix ipv6Address ipHeader 170 data current IPv6 source address prefix. postOctetTotalCount unsigned64 flowCounter totalCounter 171 all current The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. octets postPacketTotalCount unsigned64 flowCounter totalCounter 172 all current The definition of this Information Element is identical to the definition of Information Element 'packetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. packets flowKeyIndicator unsigned64 config flags 173 all current This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record with the n-th bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that this is not the case. If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0. postMCastPacketTotalCount unsigned64 flowCounter totalCounter 174 data current The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. packets postMCastOctetTotalCount unsigned64 flowCounter totalCounter 175 data current The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload. octets icmpTypeIPv4 unsigned8 transportHeader identifier 176 all current Type of the IPv4 ICMP message. See for the definition of the IPv4 ICMP type field. icmpCodeIPv4 unsigned8 transportHeader identifier 177 all current Code of the IPv4 ICMP message. See for the definition of the IPv4 ICMP code field. icmpTypeIPv6 unsigned8 transportHeader identifier 178 all current Type of the IPv6 ICMP message. See for the definition of the IPv6 ICMP type field. icmpCodeIPv6 unsigned8 transportHeader identifier 179 all current Code of the IPv6 ICMP message. See for the definition of the IPv6 ICMP code field. udpSourcePort unsigned16 transportHeader identifier 180 all current The source port identifier in the UDP header. See for the definition of the UDP source port field. Additional information on defined UDP port numbers can be found at . udpDestinationPort unsigned16 transportHeader identifier 181 all current The destination port identifier in the UDP header. See for the definition of the UDP destination port field. Additional information on defined UDP port numbers can be found at . tcpSourcePort unsigned16 transportHeader identifier 182 all current The source port identifier in the TCP header. See for the definition of the TCP source port field. Additional information on defined TCP port numbers can be found at . tcpDestinationPort unsigned16 transportHeader identifier 183 all current The destination port identifier in the TCP header. See for the definition of the TCP destination port field. Additional information on defined TCP port numbers can be found at . tcpSequenceNumber unsigned32 transportHeader 184 all current The sequence number in the TCP header. See for the definition of the TCP sequence number. tcpAcknowledgementNumber unsigned32 transportHeader 185 all current The acknowledgement number in the TCP header. See for the definition of the TCP acknowledgement number. tcpWindowSize unsigned16 transportHeader 186 all current The window field in the TCP header. If the TCP window scale is supported, then TCP window scale must be known to fully interpret the value of this information. See for the definition of the TCP window field. See for the definition of the TCP window scale. tcpUrgentPointer unsigned16 transportHeader 187 all current The urgent pointer in the TCP header. See for the definition of the TCP urgent pointer. tcpHeaderLength unsigned8 transportHeader 188 all current The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the TCP header. The Data Offset field indicates the length of the TCP header in units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets. octets See for the definition of the TCP header. ipHeaderLength unsigned8 ipHeader 189 all current The length of the IP header. For IPv6, the value of this Information Element is 40. octets See for the definition of the IPv4 header. See for the definition of the IPv6 header. totalLengthIPv4 unsigned16 ipHeader 190 all current The total length of the IPv4 packet. octets See for the specification of the IPv4 total length. payloadLengthIPv6 unsigned16 ipHeader 191 all current This Information Element reports the value of the Payload Length field in the IPv6 header. Note that IPv6 extension headers belong to the payload. Also note that in case of a jumbo payload option the value of the Payload Length field in the IPv6 header is zero and so will be the value reported by this Information Element. octets See for the specification of the IPv6 payload length. See for the specification of the IPv6 jumbo payload option. ipTTL unsigned8 ipHeader 192 all current For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value of the Information Element matches the value of the Hop Limit field in the IPv6 packet header. hops See for the definition of the IPv4 Time to Live field. See for the definition of the IPv6 Hop Limit field. nextHeaderIPv6 unsigned8 ipHeader 193 all current The value of the Next Header field of the IPv6 header. The value identifies the type of the following IPv6 extension header or of the following IP payload. Valid values are defined in the IANA Protocol Numbers registry. See for the definition of the IPv6 Next Header field. See the list of protocol numbers assigned by IANA at . mplsPayloadLength unsigned32 subIpHeader 194 all current The size of the MPLS packet without the label stack. octets See for the specification of MPLS packets. See for the specification of the MPLS label stack. ipDiffServCodePoint unsigned8 ipHeader identifier 195 all current The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field spans the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively. This Information Element encodes only the 6 bits of the Differentiated Services field. Therefore, its value may range from 0 to 63. 0-63 See for the definition of the Differentiated Services field. See (Section 5.3.2) and for the definition of the IPv4 TOS field. See for the definition of the IPv6 Traffic Class field. ipPrecedence unsigned8 ipHeader identifier 196 all current The value of the IP Precedence. The IP Precedence value is encoded in the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively. This Information Element encodes only these 3 bits. Therefore, its value may range from 0 to 7. 0-7 See (Section 5.3.3) and for the definition of the IP Precedence. See (Section 5.3.2) and for the definition of the IPv4 TOS field. See for the definition of the IPv6 Traffic Class field. fragmentFlags unsigned8 ipHeader flags 197 all current Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively. Bit 0: (RS) Reserved. The value of this bit MUST be 0 until specified otherwise. Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. Corresponds to the value of the DF flag in the IPv4 header. Will always be 0 for IPv6 unless a "don't fragment" feature is introduced to IPv6. Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. Corresponds to the MF flag in the IPv4 header or to the M flag in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header. Bits 3-7: (DC) Don't Care. The values of these bits are irrelevant. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | R | D | M | D | D | D | D | D | | S | F | F | C | C | C | C | C | +---+---+---+---+---+---+---+---+ See for the specification of the IPv4 fragment flags. See for the specification of the IPv6 Fragment header. octetDeltaSumOfSquares unsigned64 flowCounter 198 data current The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload. octetTotalSumOfSquares unsigned64 flowCounter 199 all current The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload. octets mplsTopLabelTTL unsigned8 subIpHeader 200 all current The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed. hops See for the specification of the TTL field. mplsLabelStackLength unsigned32 subIpHeader 201 all current The length of the MPLS label stack in units of octets. octets See for the specification of the MPLS label stack. mplsLabelStackDepth unsigned32 subIpHeader 202 all current The number of labels in the MPLS label stack. label stack entries See for the specification of the MPLS label stack. mplsTopLabelExp unsigned8 subIpHeader flags 203 all current The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed. Bits 0-4: Don't Care, value is irrelevant. Bits 5-7: MPLS Exp field. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | don't care | Exp | +---+---+---+---+---+---+---+---+ See for the specification of the Exp field. See for usage of the Exp field. ipPayloadLength unsigned32 derived 204 all current The effective length of the IP payload. For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by Information Element totalLengthIPv4) and the length of the IPv4 header (as reported by Information Element headerLengthIPv4). For IPv6, the value of the Payload Length field in the IPv6 header is reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported. octets See for the specification of IPv4 packets. See for the specification of the IPv6 payload length. See for the specification of the IPv6 jumbo payload length. udpMessageLength unsigned16 transportHeader 205 all current The value of the Length field in the UDP header. octets See for the specification of the UDP header. isMulticast unsigned8 ipHeader flags 206 data current If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero. The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0. The second and third bits of this octet are reserved for future use. The remaining bits of the octet are only set to values other than zero if the IP Destination Address is a reserved IPv6 multicast address. Then the fourth bit of the octet is set to the value of the T flag in the IPv6 multicast address and the remaining four bits are set to the value of the scope field in the IPv6 multicast address. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ | IPv6 multicast scope | T | RES. | RES. | MCv4 | +------+------+------+------+------+------+------+------+ Bits 0-3: set to value of multicast scope if IPv6 multicast Bit 4: set to value of T flag, if IPv6 multicast Bits 5-6: reserved for future use Bit 7: set to 1 if IPv4 multicast See for the specification of reserved IPv4 multicast addresses. See for the specification of reserved IPv6 multicast addresses and the definition of the T flag and the IPv6 multicast scope. The diagram provided in is incorrect. The diagram in this registry is taken from Errata 1736. See ipv4IHL unsigned8 ipHeader 207 all current The value of the Internet Header Length (IHL) field in the IPv4 header. It specifies the length of the header in units of 4 octets. Please note that its unit is different from most of the other Information Elements reporting length values. 4 octets See for the specification of the IPv4 header. ipv4Options unsigned32 minMax flags 208 all current IPv4 options in packets of this Flow. The information is encoded in a set of bit fields. For each valid IPv4 option type, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv4 option type. Otherwise, if no observed packet of this Flow contained the respective IPv4 option type, the value of the corresponding bit is 0. The list of valid IPv4 options is maintained by IANA. Note that for identifying an option not just the 5-bit Option Number, but all 8 bits of the Option Type need to match one of the IPv4 options specified at http://www.iana.org/assignments/ip-parameters. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. The mapping is illustrated by the figure below. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ ... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL | +------+------+------+------+------+------+------+------+ 8 9 10 11 12 13 14 15 +------+------+------+------+------+------+------+------+ ... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ... +------+------+------+------+------+------+------+------+ 16 17 18 19 20 21 22 23 +------+------+------+------+------+------+------+------+ ... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ... +------+------+------+------+------+------+------+------+ 24 25 26 27 28 29 30 31 +------+------+------+------+------+------+------+------+ | | EXP | to be assigned by IANA | QS | UMP | ... +------+------+------+------+------+------+------+------+ Type Option Bit Value Name Reference ---+-----+-------+------------------------------------ 0 7 RR Record Route, RFC 791 1 134 CIPSO Commercial Security 2 133 E-SEC Extended Security, RFC 1108 3 68 TS Time Stamp, RFC 791 4 131 LSR Loose Source Route, RFC791 5 130 SEC Security, RFC 1108 6 1 NOP No Operation, RFC 791 7 0 EOOL End of Options List, RFC 791 8 15 ENCODE 9 142 VISA Experimental Access Control 10 205 FINN Experimental Flow Control 11 12 MTUR (obsoleted) MTU Reply, RFC 1191 12 11 MTUP (obsoleted) MTU Probe, RFC 1191 13 10 ZSU Experimental Measurement 14 137 SSR Strict Source Route, RFC 791 15 136 SID Stream ID, RFC 791 16 151 DPS Dynamic Packet State 17 150 NSAPA NSAP Address 18 149 SDB Selective Directed Broadcast 19 147 ADDEXT Address Extension 20 148 RTRALT Router Alert, RFC 2113 21 82 TR Traceroute, RFC 3193 22 145 EIP Extended Internet Protocol, RFC 1385 23 144 IMITD IMI Traffic Descriptor 25 30 EXP RFC3692-style Experiment 25 94 EXP RFC3692-style Experiment 25 158 EXP RFC3692-style Experiment 25 222 EXP RFC3692-style Experiment 30 25 QS Quick-Start 31 152 UMP Upstream Multicast Pkt. ... ... ... Further options numbers may be assigned by IANA See for the definition of IPv4 options. See the list of IPv4 option numbers assigned by IANA at . The diagram provided in is incorrect. The diagram in this registry is taken from Errata 1737. See tcpOptions unsigned64 minMax flags 209 all current TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. TCP option numbers are maintained by IANA. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ... +-----+-----+-----+-----+-----+-----+-----+-----+ 8 9 10 11 12 13 14 15 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 |... +-----+-----+-----+-----+-----+-----+-----+-----+ 16 17 18 19 20 21 22 23 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 |... +-----+-----+-----+-----+-----+-----+-----+-----+ . . . 56 57 58 59 60 61 62 63 +-----+-----+-----+-----+-----+-----+-----+-----+ ... | 63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | +-----+-----+-----+-----+-----+-----+-----+-----+ See for the definition of TCP options. See the list of TCP option numbers assigned by IANA at . The diagram provided in is incorrect. The diagram in this registry is taken from Errata 1739. See paddingOctets octetArray padding 210 option current The value of this Information Element is always a sequence of 0x00 values. collectorIPv4Address ipv4Address config identifier 211 all current An IPv4 address to which the Exporting Process sends Flow information. collectorIPv6Address ipv6Address config identifier 212 all current An IPv6 address to which the Exporting Process sends Flow information. exportInterface unsigned32 config identifier 213 all current The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value matches the value of managed object 'ifIndex' as defined in RFC 2863. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in RFC 2863. See for the definition of the ifIndex object. exportProtocolVersion unsigned8 config identifier 214 all current The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the Version Number field in the Message Header. The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A value of 0 indicates that no export protocol is in use. See the IPFIX protocol specification for the definition of the IPFIX Message Header. See for the definition of the NetFlow version 9 message header. exportTransportProtocol unsigned8 config identifier 215 all current The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet. See for the specification of the IPv4 protocol field. See for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at . collectorTransportPort unsigned16 config identifier 216 all current The destination port identifier to which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the destination port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. See for the definition of the UDP destination port field. See for the definition of the TCP destination port field. See for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at . exporterTransportPort unsigned16 config identifier 217 all current The source port identifier from which the Exporting Process sends Flow information. For the transport protocols UDP, TCP, and SCTP, this is the source port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers. This field may be useful for distinguishing multiple Exporting Processes that use the same IP address. See for the definition of the UDP source port field. See for the definition of the TCP source port field. See for the definition of SCTP. Additional information on defined UDP and TCP port numbers can be found at . tcpSynTotalCount unsigned64 flowCounter totalCounter 218 data current The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set. packets See for the definition of the TCP SYN flag. tcpFinTotalCount unsigned64 flowCounter totalCounter 219 data current The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set. packets See for the definition of the TCP FIN flag. tcpRstTotalCount unsigned64 flowCounter totalCounter 220 data current The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set. packets See for the definition of the TCP RST flag. tcpPshTotalCount unsigned64 flowCounter totalCounter 221 data current The total number of packets of this Flow with TCP "Push Function" (PSH) flag set. packets See for the definition of the TCP PSH flag. tcpAckTotalCount unsigned64 flowCounter totalCounter 222 data current The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set. packets See for the definition of the TCP ACK flag. tcpUrgTotalCount unsigned64 flowCounter totalCounter 223 data current The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set. packets See for the definition of the TCP URG flag. ipTotalLength unsigned64 ipHeader 224 all current The total length of the IP packet. octets See for the specification of the IPv4 total length. See for the specification of the IPv6 payload length. See for the specification of the IPv6 jumbo payload length. postNATSourceIPv4Address ipv4Address identifier 225 current The definition of this Information Element is identical to the definition of Information Element 'sourceIPv4Address', except that it reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point. See for the definition of the IPv4 source address field. See for the definition of NAT. See for the definition of middleboxes. postNATDestinationIPv4Address ipv4Address identifier 226 current The definition of this Information Element is identical to the definition of Information Element 'destinationIPv4Address', except that it reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point. See for the definition of the IPv4 destination address field. See for the definition of NAT. See for the definition of middleboxes. postNAPTSourceTransportPort unsigned16 identifier 227 current The definition of this Information Element is identical to the definition of Information Element 'sourceTransportPort', except that it reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point. See for the definition of the UDP source port field. See for the definition of the TCP source port field. See for the definition of SCTP. See for the definition of NAPT. See for the definition of middleboxes. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers. postNAPTDestinationTransportPort unsigned16 identifier 228 current The definition of this Information Element is identical to the definition of Information Element 'destinationTransportPort', except that it reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point. See for the definition of the UDP source port field. See for the definition of the TCP source port field. See for the definition of SCTP. See for the definition of NAPT. See for the definition of middleboxes. Additional information on defined UDP and TCP port numbers can be found at http://www.iana.org/assignments/port-numbers. natOriginatingAddressRealm unsigned8 flags 229 current Indicates whether the session was created because traffic originated in the private or public address realm. postNATSourceIPv4Address, postNATDestinationIPv4Address, postNAPTSourceTransportPort, and postNAPTDestinationTransportPort are qualified with the address realm in perspective. The allowed values are: Private: 1 Public: 2 See for the definition of NAT. natEvent unsigned8 230 current Indicates a NAT event. The allowed values are: 1 - Create event. 2 - Delete event. 3 - Pool exhausted. A Create event is generated when a NAT translation is created, whether dynamically or statically. A Delete event is generated when a NAT translation is deleted. See for the definition of NAT. initiatorOctets unsigned64 231 current The total number of layer 4 payload bytes in a flow from the initiator. The initiator is the device which triggered the session creation, and remains the same for the life of the session. octets See #298, initiatorPackets. responderOctets unsigned64 232 current The total number of layer 4 payload bytes in a flow from the responder. The responder is the device which replies to the initiator, and remains the same for the life of the session. octets See #299, responderPackets. firewallEvent unsigned8 233 current Indicates a firewall event. The allowed values are: 0 - Ignore (invalid) 1 - Flow Created 2 - Flow Deleted 3 - Flow Denied 4 - Flow Alert 5 - Flow Update ingressVRFID unsigned32 234 current An unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per Metering Process egressVRFID unsigned32 235 current An unique identifier of the VRFname where the packets of this flow are being sent. This identifier is unique per Metering Process VRFname string 236 current The name of a VPN Routing and Forwarding table (VRF). See for the definition of VRF. postMplsTopLabelExp unsigned8 subIpHeader flags 237 all current The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. See for the specification of the Exp field. See for usage of the Exp field. tcpWindowScale unsigned16 transportHeader 238 all current The scale of the window field in the TCP header. See for the definition of the TCP window scale. biflowDirection unsigned8 misc identifier 239 all current A description of the direction assignment method used to assign the Biflow Source and Destination. This Information Element MAY be present in a Flow Data Record, or applied to all flows exported from an Exporting Process or Observation Domain using IPFIX Options. If this Information Element is not present in a Flow Record or associated with a Biflow via scope, it is assumed that the configuration of the direction assignment method is done out-of-band. Note that when using IPFIX Options to apply this Information Element to all flows within an Observation Domain or from an Exporting Process, the Option SHOULD be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information Element SHOULD appear in each Flow Record. This field may take the following values: +-------+------------------+----------------------------------------+ | Value | Name | Description | +-------+------------------+----------------------------------------+ | 0x00 | arbitrary | Direction was assigned arbitrarily. | | 0x01 | initiator | The Biflow Source is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. | | 0x02 | reverseInitiator | The Biflow Destination is the flow | | | | initiator, as determined by the | | | | Metering Process' best effort to | | | | detect the initiator. This value is | | | | provided for the convenience of | | | | Exporting Processes to revise an | | | | initiator estimate without re-encoding | | | | the Biflow Record. | | 0x03 | perimeter | The Biflow Source is the endpoint | | | | outside of a defined perimeter. The | | | | perimeter's definition is implicit in | | | | the set of Biflow Source and Biflow | | | | Destination addresses exported in the | | | | Biflow Records. | +-------+------------------+----------------------------------------+ ethernetHeaderLength unsigned8 identifier 240 current The difference between the length of an Ethernet frame (minus the FCS) and the length of its MAC Client Data section (including any padding) as defined in section 3.1 of [IEEE.802-3.2005]. It does not include the Preamble, SFD and Extension field lengths. octets [IEEE.802-3.2005] ethernetPayloadLength unsigned16 identifier 241 current The length of the MAC Client Data section (including any padding) of a frame as defined in section 3.1 of [IEEE.802-3.2005]. octets [IEEE.802-3.2005] ethernetTotalLength unsigned16 identifier 242 current The total length of the Ethernet frame (excluding the Preamble, SFD, Extension and FCS fields) as described in section 3.1 of [IEEE.802-3.2005]. octets [IEEE.802-3.2005] dot1qVlanId unsigned16 identifier 243 current The value of the 12-bit VLAN Identifier portion of the Tag Control Information field of an Ethernet frame as described in section 3.5.5 of [IEEE.802-3.2005]. The structure and semantics within the Tag Control Information field are defined in IEEE P802.1Q. In case of a QinQ frame, it represents the outer tag's VLAN identifier and in case of an IEEE 802.1ad frame it represents the Service VLAN identifier in the S-TAG Tag Control Information (TCI) field as described in [IEEE.802-1ad.2005]. octets [IEEE.802-3.2005] dot1qPriority unsigned8 identifier 244 current The value of the 3-bit User Priority portion of the Tag Control Information field of an Ethernet frame as described in section 3.5.5 of [IEEE.802-3.2005]. The structure and semantics within the Tag Control Information field are defined in IEEE P802.1Q. In case of a QinQ frame, it represents the outer tag's 3-bit Class of Service (CoS) identifier and in case of an IEEE 802.1ad frame it represents the 3-bit Priority Code Point (PCP) portion of the S-TAG Tag Control Information (TCI) field as described in [IEEE.802-1ad.2005]. [IEEE.802-3.2005] [IEEE.802-1ad.2005] dot1qCustomerVlanId unsigned16 identifier 245 current In case of a QinQ frame, it represents the inner tag's (*) VLAN identifier and in case of an IEEE 802.1ad frame it represents the Customer VLAN identifier in the C-TAG Tag Control Information (TCI) field as described in [IEEE.802-1ad.2005]. (*) Note: the 801.2Q tag directly following the outer one. [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] dot1qCustomerPriority unsigned8 identifier 246 current In case of a QinQ frame, it represents the inner tag's (*) Class of Service (CoS) identifier and in case of an IEEE 802.1ad frame it represents the 3-bit Priority Code Point (PCP) portion of the C-TAG Tag Control Information (TCI) field as described in [IEEE.802-1ad.2005]. (*) Note: the 801.2Q tag directly following the outer one. [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] metroEvcId string 247 current The EVC Service Attribute which uniquely identifies the Ethernet Virtual Connection (EVC) within a Metro Ethernet Network, as defined in section 6.2 of MEF 10.1. The MetroEVCID is encoded in a string of up to 100 characters. MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 (Ethernet Local Management Interface) metroEvcType unsigned8 identifier 248 current The 3-bit EVC Service Attribute which identifies the type of service provided by an EVC. MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 (Ethernet Local Management Interface) pseudoWireId unsigned32 identifier 249 current A 32-bit non-zero connection identifier, which together with the pseudoWireType, identifies the Pseudo Wire (PW) as defined in RFC 4447 [RFC4447]. See for pseudowire definitions. pseudoWireType unsigned16 identifier 250 current The value of this information element identifies the type of MPLS Pseudo Wire (PW) as defined in RFC 4446. See for the pseudowire type definition, and http://www.iana.org/assignments/pwe3-parameters for the IANA Pseudowire Types Registry. pseudoWireControlWord unsigned32 identifier 251 current The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as defined in Section 3 of . See for the Pseudo Wire Control Word definition. ingressPhysicalInterface unsigned32 identifier 252 current The index of a networking device's physical interface (example, a switch port) where packets of this flow are being received. See for the definition of the ifIndex object. egressPhysicalInterface unsigned32 identifier 253 current The index of a networking device's physical interface (example, a switch port) where packets of this flow are being sent. See for the definition of the ifIndex object. postDot1qVlanId unsigned16 identifier 254 current The definition of this Information Element is identical to the definition of Information Element 'dot1qVlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. [IEEE.802-3.2005] [IEEE.802-1ad.2005] postDot1qCustomerVlanId unsigned16 identifier 255 current The definition of this Information Element is identical to the definition of Information Element 'dot1qCustomerVlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. [IEEE.802-1ad.2005] [IEEE.802-1Q.2003] ethernetType unsigned16 identifier 256 current The Ethernet type field of an Ethernet frame that identifies the MAC client protocol carried in the payload as defined in paragraph 1.4.349 of [IEEE.802-3.2005]. [IEEE.802-3.2005] Ethertype registry available at http://standards.ieee.org/regauth/ethertype/eth.txt postIpPrecedence unsigned8 identifier 257 current The definition of this Information Element is identical to the definition of Information Element 'ipPrecedence', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. 0-7 See (Section 5.3.3) and for the definition of the IP Precedence. See (Section 5.3.2) and for the definition of the IPv4 TOS field. See for the definition of the IPv6 Traffic Class field. collectionTimeMilliseconds dateTimeMilliseconds 258 current The absolute timestamp at which the data within the scope containing this Information Element was received by a Collecting Process. This Information Element SHOULD be bound to its containing IPFIX Message via IPFIX Options and the messageScope Information Element, as defined below. exportSctpStreamId unsigned16 identifier 259 current The value of the SCTP Stream Identifier used by the Exporting Process for exporting IPFIX Message data. This is carried in the Stream Identifier field of the header of the SCTP DATA chunk containing the IPFIX Message(s). maxExportSeconds dateTimeSeconds 260 current The absolute Export Time of the latest IPFIX Message within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. seconds maxFlowEndSeconds dateTimeSeconds 261 current The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the second if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. seconds messageMD5Checksum octetArray 262 current The MD5 checksum of the IPFIX Message containing this record. This Information Element SHOULD be bound to its containing IPFIX Message via an options record and the messageScope Information Element, as defined below, and SHOULD appear only once in a given IPFIX Message. To calculate the value of this Information Element, first buffer the containing IPFIX Message, setting the value of this Information Element to all zeroes. Then calculate the MD5 checksum of the resulting buffer as defined in [RFC1321], place the resulting value in this Information Element, and export the buffered message. This Information Element is intended as a simple checksum only; therefore collision resistance and algorithm agility are not required, and MD5 is an appropriate message digest. This Information Element has a fixed length of 16 octets. messageScope unsigned8 263 current The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Message that contains them. It is defined for general purpose message scoping of options, and proposed specifically to allow the attachment a checksum to a message via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process. minExportSeconds dateTimeSeconds 264 current The absolute Export Time of the earliest IPFIX Message within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. seconds minFlowStartSeconds dateTimeSeconds 265 current The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the second if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. seconds opaqueOctets octetArray 266 current This Information Element is used to encapsulate non- IPFIX data into an IPFIX Message stream, for the purpose of allowing a non-IPFIX data processor to store a data stream inline within an IPFIX File. A Collecting Process or File Writer MUST NOT try to interpret this binary data. This Information Element differs from paddingOctets as its contents are meaningful in some non-IPFIX context, while the contents of paddingOctets MUST be 0x00 and are intended only for Information Element alignment. sessionScope unsigned8 267 current The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Transport Session that contains them. Note that as all options are implicitly scoped to Transport Session and Observation Domain, this Information Element is equivalent to a "null" scope. It is defined for general purpose session scoping of options, and proposed specifically to allow the attachment of time window to an IPFIX File via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process. maxFlowEndMicroseconds dateTimeMicroseconds 268 current The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the microsecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements. microseconds maxFlowEndMilliseconds dateTimeMilliseconds 269 current The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the millisecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements. milliseconds maxFlowEndNanoseconds dateTimeNanoseconds 270 current The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements. nanoseconds minFlowStartMicroseconds dateTimeMicroseconds 271 current The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the microsecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements. microseconds minFlowStartMilliseconds dateTimeMilliseconds 272 current The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the millisecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements. milliseconds minFlowStartNanoseconds dateTimeNanoseconds 273 current The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements. nanoseconds collectorCertificate octetArray 274 current The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element. exporterCertificate octetArray 275 current The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element. dataRecordsReliability boolean identifier 276 current The export reliability of Data Records, within this SCTP stream, for the element(s) in the Options Template scope. A typical example of an element for which the export reliability will be reported is the templateID, as specified in the Data Records Reliability Options Template. A value of 'True' means that the Exporting Process MUST send any Data Records associated with the element(s) reliably within this SCTP stream. A value of 'False' means that the Exporting Process MAY send any Data Records associated with the element(s) unreliably within this SCTP stream. observationPointType unsigned8 identifier 277 current Type of observation point. Values assigned to date are: 1. Physical port 2. Port channel 3. Vlan. connectionCountNew unsigned32 deltaCounter 278 current This information element counts the number of TCP or UDP connections which were opened during the observation period. The observation period may be specified by the flow start and end timestamps. connectionSumDuration unsigned64 279 current This information element aggregates the total time in seconds for all of the TCP or UDP connections which were in use during the observation period. For example if there are 5 concurrent connections each for 10 seconds, the value would be 50 s. connectionTransactionId unsigned64 identifier 280 current This information element identifies a transaction within a connection. A transaction is a meaningful exchange of application data between two network devices or a client and server. A transactionId is assigned the first time a flow is reported, so that later reports for the same flow will have the same transactionId. A different transactionId is used for each transaction within a TCP or UDP connection. The identifiers need not be sequential. postNATSourceIPv6Address ipv6Address 281 current The definition of this Information Element is identical to the definition of Information Element 'sourceIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after the packet passed the Observation Point. See [RFC2460] for the definition of the Source Address field in the IPv6 header. See [RFC3234] for the definition of middleboxes. See http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful-12 for nat64 specification. postNATDestinationIPv6Address ipv6Address 282 current The definition of this Information Element is identical to the definition of Information Element 'destinationIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after the packet passed the Observation Point. See [RFC2460] for the definition of the Destination Address field in the IPv6 header. See [RFC3234] for the definition of middleboxes. See http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful-12 for nat64 specification. natPoolId unsigned32 identifier 283 current Locally unique identifier of a NAT pool. natPoolName string 284 current The name of a NAT pool identified by a natPoolID. anonymizationFlags unsigned16 flags 285 current A flag word describing specialized modifications to the anonymization policy in effect for the anonymization technique applied to a referenced Information Element within a referenced Template. When flags are clear (0), the normal policy (as described by anonymizationTechnique) applies without modification. MSB 14 13 12 11 10 9 8 7 6 5 4 3 2 1 LSB +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ | Reserved |LOR|PmA| SC | +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ anonymizationFlags IE +--------+----------+-----------------------------------------------+ | bit(s) | name | description | | (LSB = | | | | 0) | | | +--------+----------+-----------------------------------------------+ | 0-1 | SC | Stability Class: see the Stability Class | | | | table below, and section Section 5.1. | | 2 | PmA | Perimeter Anonymization: when set (1), | | | | source- Information Elements as described in | | | | [RFC5103] are interpreted as external | | | | addresses, and destination- Information | | | | Elements as described in [RFC5103] are | | | | interpreted as internal addresses, for the | | | | purposes of associating | | | | anonymizationTechnique to Information | | | | Elements only; see Section 7.2.2 for details. | | | | This bit MUST NOT be set when associated with | | | | a non-endpoint (i.e., source- or | | | | destination-) Information Element. SHOULD be | | | | consistent within a record (i.e., if a | | | | source- Information Element has this flag | | | | set, the corresponding destination- element | | | | SHOULD have this flag set, and vice-versa.) | | 3 | LOR | Low-Order Unchanged: when set (1), the | | | | low-order bits of the anonymized Information | | | | Element contain real data. This modification | | | | is intended for the anonymization of | | | | network-level addresses while leaving | | | | host-level addresses intact in order to | | | | preserve host level-structure, which could | | | | otherwise be used to reverse anonymization. | | | | MUST NOT be set when associated with a | | | | truncation-based anonymizationTechnique. | | 4-15 | Reserved | Reserved for future use: SHOULD be cleared | | | | (0) by the Exporting Process and MUST be | | | | ignored by the Collecting Process. | +--------+----------+-----------------------------------------------+ The Stability Class portion of this flags word describes the stability class of the anonymization technique applied to a referenced Information Element within a referenced Template. Stability classes refer to the stability of the parameters of the anonymization technique, and therefore the comparability of the mapping between the real and anonymized values over time. This determines which anonymized datasets may be compared with each other. Values are as follows: +-----+-----+-------------------------------------------------------+ | Bit | Bit | Description | | 1 | 0 | | +-----+-----+-------------------------------------------------------+ | 0 | 0 | Undefined: the Exporting Process makes no | | | | representation as to how stable the mapping is, or | | | | over what time period values of this field will | | | | remain comparable; while the Collecting Process MAY | | | | assume Session level stability, Session level | | | | stability is not guaranteed. Processes SHOULD assume | | | | this is the case in the absence of stability class | | | | information; this is the default stability class. | | 0 | 1 | Session: the Exporting Process will ensure that the | | | | parameters of the anonymization technique are stable | | | | during the Transport Session. All the values of the | | | | described Information Element for each Record | | | | described by the referenced Template within the | | | | Transport Session are comparable. The Exporting | | | | Process SHOULD endeavour to ensure at least this | | | | stability class. | | 1 | 0 | Exporter-Collector Pair: the Exporting Process will | | | | ensure that the parameters of the anonymization | | | | technique are stable across Transport Sessions over | | | | time with the given Collecting Process, but may use | | | | different parameters for different Collecting | | | | Processes. Data exported to different Collecting | | | | Processes are not comparable. | | 1 | 1 | Stable: the Exporting Process will ensure that the | | | | parameters of the anonymization technique are stable | | | | across Transport Sessions over time, regardless of | | | | the Collecting Process to which it is sent. | +-----+-----+-------------------------------------------------------+ anonymizationTechnique unsigned16 identifier 286 current A description of the anonymization technique applied to a referenced Information Element within a referenced Template. Each technique may be applicable only to certain Information Elements and recommended only for certain Infomation Elements; these restrictions are noted in the table below. +-------+---------------------------+-----------------+-------------+ | Value | Description | Applicable to | Recommended | | | | | for | +-------+---------------------------+-----------------+-------------+ | 0 | Undefined: the Exporting | all | all | | | Process makes no | | | | | representation as to | | | | | whether the defined field | | | | | is anonymized or not. | | | | | While the Collecting | | | | | Process MAY assume that | | | | | the field is not | | | | | anonymized, it is not | | | | | guaranteed not to be. | | | | | This is the default | | | | | anonymization technique. | | | | 1 | None: the values exported | all | all | | | are real. | | | | 2 | Precision | all | all | | | Degradation/Truncation: | | | | | the values exported are | | | | | anonymized using simple | | | | | precision degradation or | | | | | truncation. The new | | | | | precision or number of | | | | | truncated bits is | | | | | implicit in the exported | | | | | data, and can be deduced | | | | | by the Collecting | | | | | Process. | | | | 3 | Binning: the values | all | all | | | exported are anonymized | | | | | into bins. | | | | 4 | Enumeration: the values | all | timestamps | | | exported are anonymized | | | | | by enumeration. | | | | 5 | Permutation: the values | all | identifiers | | | exported are anonymized | | | | | by permutation. | | | | 6 | Structured Permutation: | addresses | | | | the values exported are | | | | | anonymized by | | | | | permutation, preserving | | | | | bit-level structure as | | | | | appropriate; this | | | | | represents | | | | | prefix-preserving IP | | | | | address anonymization or | | | | | structured MAC address | | | | | anonymization. | | | | 7 | Reverse Truncation: the | addresses | | | | values exported are | | | | | anonymized using reverse | | | | | truncation. The number | | | | | of truncated bits is | | | | | implicit in the exported | | | | | data, and can be deduced | | | | | by the Collecting | | | | | Process. | | | | 8 | Noise: the values | non-identifiers | counters | | | exported are anonymized | | | | | by adding random noise to | | | | | each value. | | | | 9 | Offset: the values | all | timestamps | | | exported are anonymized | | | | | by adding a single offset | | | | | to all values. | | | +-------+---------------------------+-----------------+-------------+ informationElementIndex unsigned16 identifier 287 current A zero-based index of an Information Element referenced by informationElementId within a Template referenced by templateId; used to disambiguate scope for templates containing multiple identical Information Elements. p2pTechnology string 288 current Specifies if the Application ID is based on peer-to-peer technology. Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }. tunnelTechnology string 289 current Specifies if the Application ID is used as a tunnel technology. Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }. encryptedTechnology string 290 current Specifies if the Application ID is an encrypted networking protocol. Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }. basicList basicList list 291 current Specifies a generic Information Element with a basicList abstract data type. For example, a list of port numbers, a list of interface indexes, etc. subTemplateList subTemplateList list 292 current Specifies a generic Information Element with a subTemplateList abstract data type. subTemplateMultiList subTemplateMultiList list 293 current Specifies a generic Information Element with a subTemplateMultiList abstract data type. bgpValidityState unsigned8 identifier 294 current This element describes the "validity state" of the BGP route correspondent source or destination IP address. If the "validity state" for this Flow is only available, then the value of this Information Element is 255. See for a description of BGP-4, for the definition of "validity states" and for the encoding of those "validity states". IPSecSPI unsigned32 identifier 295 current IPSec Security Parameters Index (SPI). 0x0-0xFFFFFFFF See for the definition of SPI. greKey unsigned32 identifier 296 current GRE key, which is used for identifying an individual traffic flow within a tunnel. 0x0-0xFFFFFFFF See for the definition of GRE and the GRE Key. natType unsigned8 identifier 297 current The type of NAT treatment: 0 unknown 1 NAT44 translated 2 NAT64 translated 3 NAT46 translated 4 IPv4-->IPv4 (no NAT) 5 NAT66 translated 6 IPv6-->IPv6 (no NAT) See for the definition of NAT. See for the definition of NAT44. See for the definition of NAT64. See for the definition of NAT46. See for the definition of NAT66. See for the definition of IPv4. See for the definition of IPv6. initiatorPackets unsigned64 identifier 298 current The total number of layer 4 packets in a flow from the initiator. The initiator is the device which triggered the session creation, and remains the same for the life of the session. packets See #231, initiatorOctets. responderPackets unsigned64 identifier 299 current The total number of layer 4 packets in a flow from the responder. The responder is the device which replies to the initiator, and remains the same for the life of the session. packets See #232, responderOctets. observationDomainName string 300 current The name of an observation domain identified by an observationDomainId. See #149, observationDomainId. selectionSequenceId unsigned64 identifier 301 current From all the packets observed at an Observation Point, a subset of the packets is selected by a sequence of one or more Selectors. The selectionSequenceId is a unique value per Observation Domain, specifying the Observation Point and the sequence of Selectors through which the packets are selected. selectorId unsigned64 identifier 302 current The Selector ID is the unique ID identifying a Primitive Selector. Each Primitive Selector must have a unique ID in the Observation Domain. informationElementId unsigned16 identifier 303 current This Information Element contains the ID of another Information Element. selectorAlgorithm unsigned16 identifier 304 current This Information Element identifies the packet selection methods (e.g., Filtering, Sampling) that are applied by the Selection Process. Most of these methods have parameters. Further Information Elements are needed to fully specify packet selection with these methods and all their parameters. The methods listed below are defined in [RFC5475]. For their parameters, Information Elements are defined in the information model document. The names of these Information Elements are listed for each method identifier. Further method identifiers may be added to the list below. It might be necessary to define new Information Elements to specify their parameters. The selectorAlgorithm registry is maintained by IANA. New assignments for the registry will be administered by IANA, and are subject to Expert Review [RFC5226]. The registry can be updated when specifications of the new method(s) and any new Information Elements are provided. The group of experts must double check the selectorAlgorithm definitions and Information Elements with already defined selectorAlgorithms and Information Elements for completeness, accuracy, and redundancy. Those experts will initially be drawn from the Working Group Chairs and document editors of the IPFIX and PSAMP Working Groups. The following packet selection methods identifiers are defined here: http://www.iana.org/assignments/psamp-parameters/psamp-parameters.xhtml There is a broad variety of possible parameters that could be used for Property match Filtering (5) but currently there are no agreed parameters specified. samplingPacketInterval unsigned32 quantity 305 current This Information Element specifies the number of packets that are consecutively sampled. A value of 100 means that 100 consecutive packets are sampled. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector. packets samplingPacketSpace unsigned32 quantity 306 current This Information Element specifies the number of packets between two "samplingPacketInterval"s. A value of 100 means that the next interval starts 100 packets (which are not sampled) after the current "samplingPacketInterval" is over. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector. packets samplingTimeInterval unsigned32 quantity 307 current This Information Element specifies the time interval in microseconds during which all arriving packets are sampled. For example, this Information Element may be used to describe the configuration of a systematic time-based Sampling Selector. microseconds samplingTimeSpace unsigned32 quantity 308 current This Information Element specifies the time interval in microseconds between two "samplingTimeInterval"s. A value of 100 means that the next interval starts 100 microseconds (during which no packets are sampled) after the current "samplingTimeInterval" is over. For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector. microseconds samplingSize unsigned32 quantity 309 current This Information Element specifies the number of elements taken from the parent Population for random Sampling methods. For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector. packets samplingPopulation unsigned32 quantity 310 current This Information Element specifies the number of elements in the parent Population for random Sampling methods. For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector. packets samplingProbability float64 quantity 311 current This Information Element specifies the probability that a packet is sampled, expressed as a value between 0 and 1. The probability is equal for every packet. A value of 0 means no packet was sampled since the probability is 0. For example, this Information Element may be used to describe the configuration of a uniform probabilistic Sampling Selector. dataLinkFrameSize unsigned16 312 current This Information Element specifies the length of the selected data link frame. The data link layer is defined in [ISO/IEC 7498-1:1994]. ipHeaderPacketSection octetArray 313 current This Information Element, which may have a variable length, carries a series of octets from the start of the IP header of a sampled packet. With sufficient length, this element also reports octets from the IP payload, subject to [RFC2804]. See the Security Considerations section. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. ipPayloadPacketSection octetArray 314 current This Information Element, which may have a variable length, carries a series of octets from the start of the IP payload of a sampled packet. The IPv4 payload is that part of the packet that follows the IPv4 header and any options, which [RFC0791] refers to as "data" or "data octets". For example, see the examples in [RFC0791], APPENDIX A. The IPv6 payload is the rest of the packet following the 40 octet IPv6 header. Note that any extension headers present are considered part of the payload. See [RFC2460] for the IPv6 specification. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. dataLinkFrameSection octetArray 315 current This Information Element carries n octets from the data link frame of a selected frame, starting sectionOffset octets into the frame. The sectionObservedOctets expresses how much data was observed, while the remainder is padding. When the sectionObservedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. When the sectionObservedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. Further Information Elements, i.e., dataLinkFrameType and dataLinkFrameSize are needed to specify the data link type and the size of the data link frame of this Information Element. A set of these Information Elements MAY be contained in a structured data type, as expressed in . Or a set of these Information Elements MAY be contained in one Flow Record as shown in Appendix C of . The data link layer is defined in [ISO/IEC 7498-1:1994]. mplsLabelStackSection octetArray 316 current This Information Element, which may have a variable length, carries the first n octets from the MPLS label stack of a sampled packet. With sufficient length, this element also reports octets from the MPLS payload, subject to [RFC2804]. See the Security Considerations section. See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. mplsPayloadPacketSection octetArray 317 current This Information Element, which may have a variable length, carries the first n octets from the MPLS payload of a sampled packet, being data that follows immediately after the MPLS label stack. See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack. The size of the exported section may be constrained due to limitations in the IPFIX protocol. The data for this field MUST NOT be padded. selectorIdTotalPktsObserved unsigned64 totalCounter 318 current This Information Element specifies the total number of packets observed by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. packets selectorIdTotalPktsSelected unsigned64 totalCounter 319 current This Information Element specifies the total number of packets selected by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. packets absoluteError float64 quantity 320 current This Information Element specifies the maximum possible measurement error of the reported value for a given Information Element. The absoluteError has the same unit as the Information Element with which it is associated. The real value of the metric can differ by absoluteError (positive or negative) from the measured value. This Information Element provides only the error for measured values. If an Information Element contains an estimated value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. The units of the Information Element for which the error is specified. relativeError float64 quantity 321 current This Information Element specifies the maximum possible positive or negative error ratio for the reported value for a given Information Element as percentage of the measured value. The real value of the metric can differ by relativeError percent (positive or negative) from the measured value. This Information Element provides only the error for measured values. If an Information Element contains an estimated value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. observationTimeSeconds dateTimeSeconds quantity 322 current This Information Element specifies the absolute time in seconds of an observation. seconds observationTimeMilliseconds dateTimeMilliseconds quantity 323 current This Information Element specifies the absolute time in milliseconds of an observation. milliseconds observationTimeMicroseconds dateTimeMicroseconds quantity 324 current This Information Element specifies the absolute time in microseconds of an observation. microseconds observationTimeNanoseconds dateTimeNanoseconds quantity 325 current This Information Element specifies the absolute time in nanoseconds of an observation. nanoseconds digestHashValue unsigned64 quantity 326 current This Information Element specifies the value from the digest hash function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashIPPayloadOffset unsigned64 quantity 327 current This Information Element specifies the IP payload offset used by a Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashIPPayloadSize unsigned64 quantity 328 current This Information Element specifies the IP payload size used by a Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashOutputRangeMin unsigned64 quantity 329 current This Information Element specifies the value for the beginning of a hash function's potential output range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashOutputRangeMax unsigned64 quantity 330 current This Information Element specifies the value for the end of a hash function's potential output range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashSelectedRangeMin unsigned64 quantity 331 current This Information Element specifies the value for the beginning of a hash function's selected range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashSelectedRangeMax unsigned64 quantity 332 current This Information Element specifies the value for the end of a hash function's selected range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashDigestOutput boolean quantity 333 current This Information Element contains a boolean value that is TRUE if the output from this hash Selector has been configured to be included in the packet report as a packet digest, else FALSE. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. hashInitialiserValue unsigned64 quantity 334 current This Information Element specifies the initialiser value to the hash function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475]. selectorName string 335 current The name of a selector identified by a selectorID. Globally unique per Metering Process. upperCILimit float64 quantity 336 current This Information Element specifies the upper limit of a confidence interval. It is used to provide an accuracy statement for an estimated value. The confidence limits define the range in which the real value is assumed to be with a certain probability p. Confidence limits always need to be associated with a confidence level that defines this probability p. Please note that a confidence interval only provides a probability that the real value lies within the limits. That means the real value can lie outside the confidence limits. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. lowerCILimit float64 quantity 337 current This Information Element specifies the lower limit of a confidence interval. For further information, see the description of upperCILimit. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. confidenceLevel float64 quantity 338 current This Information Element specifies the confidence level. It is used to provide an accuracy statement for estimated values. The confidence level provides the probability p with which the real value lies within a given range. A confidence level always needs to be associated with confidence limits that define the range in which the real value is assumed to be. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC5101]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together. informationElementDataType unsigned8 339 current A description of the abstract data type of an IPFIX information element.These are taken from the abstract data types defined in section 3.1 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the informationElementDataType sub-registry. These types are registered in the IANA IPFIX Information Element Data Type subregistry. This subregistry is intended to assign numbers for type names, not to provide a mechanism for adding data types to the IPFIX Protocol, and as such requires a Standards Action [RFC5226] to modify. informationElementDescription string 340 current A UTF-8 [RFC3629] encoded Unicode string containing a human-readable description of an Information Element. The content of the informationElementDescription MAY be annotated with one or more language tags [RFC4646], encoded in-line [RFC2482] within the UTF-8 string, in order to specify the language in which the description is written. Description text in multiple languages MAY tag each section with its own language tag; in this case, the description information in each language SHOULD have equivalent meaning. In the absence of any language tag, the "i-default" [RFC2277] language SHOULD be assumed. See the Security Considerations section for notes on string handling for Information Element type records. informationElementName string 341 current A UTF-8 [RFC3629] encoded Unicode string containing the name of an Information Element, intended as a simple identifier. See the Security Considerations section for notes on string handling for Information Element type records informationElementRangeBegin unsigned64 quantity 342 current Contains the inclusive low end of the range of acceptable values for an Information Element. informationElementRangeEnd unsigned64 quantity 343 current Contains the inclusive high end of the range of acceptable values for an Information Element. informationElementSemantics unsigned8 344 current A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in section 3.2 of the IPFIX Information Model [RFC5102]; see that section for more information on the types defined in the informationElementSemantics sub-registry. This field may take the values in Table ; the special value 0x00 (default) is used to note that no semantics apply to the field; it cannot be manipulated by a Collecting Process or File Reader that does not understand it a priori. These semantics are registered in the IANA IPFIX Information Element Semantics subregistry. This subregistry is intended to assign numbers for semantics names, not to provide a mechanism for adding semantics to the IPFIX Protocol, and as such requires a Standards Action [RFC5226] to modify. informationElementUnits unsigned16 345 current A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in section 5 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the informationElementsUnits sub-registry. This field may take the values in Table 3 below; the special value 0x00 (none) is used to note that the field is unitless. These types are registered in the IANA IPFIX Information Element Units subregistry; new types may be added on a First Come First Served [RFC5226] basis. privateEnterpriseNumber unsigned32 identifier 346 current A private enterprise number, as assigned by IANA. Within the context of an Information Element Type record, this element can be used along with the informationElementId element to scope properties to a specific Information Element. To export type information about an IANA-assigned Information Element, set the privateEnterpriseNumber to 0, or do not export the privateEnterpriseNumber in the type record. To export type information about an enterprise-specific Information Element, export the enterprise number in privateEnterpriseNumber, and export the Information Element number with the Enterprise bit cleared in informationElementId. The Enterprise bit in the associated informationElementId Information Element MUST be ignored by the Collecting Process. virtualStationInterfaceId octetArray identifier 347 current Instance Identifier of the interface to a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host. See IEEE 802.1Qbg for the definition of Virtual Station Interface ID. virtualStationInterfaceName string 348 current Name of the interface to a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host. See IEEE 802.1Qbg for the definition of Virtual Station Interface. virtualStationUUID octetArray identifier 349 current Unique Identifier of a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host. See IEEE 802.1Qbg for the definition of Virtual Station. virtualStationName string 350 current Name of a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host. See IEEE 802.1Qbg for the definition of Virtual Station. layer2SegmentId unsigned64 identifier 351 current Identifier of a layer 2 network segment in an overlay network. The most significant byte identifies the layer 2 network overlay network encapsulation type: 0x00 reserved 0x01 VxLAN 0x02 NVGRE The three lowest significant bytes hold the value of the layer 2 overlay network segment identifier. For example: - a 24 bit segment ID VXLAN Network Identifier (VNI) - a 24 bit Tenant Network Identifier (TNI) for NVGRE See VxLAN RFC at http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-00 See NVGRE RFC at http://tools.ietf.org/html/draft-sridharan-virtualization-nvgre-00 layer2OctetDeltaCount unsigned64 deltaCounter 352 current The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1) octets layer2OctetTotalCount unsigned64 totalCounter 353 current The total number of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetTotalCount (field #85) octets ingressUnicastPacketTotalCount unsigned64 totalCounter 354 current The total number of incoming unicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point. packets ingressMulticastPacketTotalCount unsigned64 totalCounter 355 current The total number of incoming multicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point. packets ingressBroadcastPacketTotalCount unsigned64 totalCounter 356 current The total number of incoming broadcast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point. packets egressUnicastPacketTotalCount unsigned64 totalCounter 357 current The total number of incoming unicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point. packets egressBroadcastPacketTotalCount unsigned64 totalCounter 358 current The total number of incoming broadcast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point. packets monitoringIntervalStartMilliSeconds dateTimeMilliseconds 359 current The absolute timestamp at which the monitoring interval started. A Monitoring interval is the period of time during which the Metering Process is running. milliseconds monitoringIntervalEndMilliSeconds dateTimeMilliseconds 360 current The absolute timestamp at which the monitoring interval ended. A Monitoring interval is the period of time during which the Metering Process is running. milliseconds portRangeStart unsigned16 identifier 361 current The port number identifying the start of a range of ports. A value of zero indicates that the range start is not specified, ie the range is defined in some other way. Additional information on defined TCP port numbers can be found at http://www.iana.org/assignments/service-names-port-numbers. portRangeEnd unsigned16 identifier 362 current The port number identifying the end of a range of ports. A value of zero indicates that the range end is not specified, ie the range is defined in some other way. Additional information on defined TCP port numbers can be found at http://www.iana.org/assignments/service-names-port-numbers. portRangeStepSize unsigned16 identifier 363 current The step size in a port range. The default step size is 1, which indicates contiguous ports. A value of zero indicates that the step size is not specified, ie the range is defined in some other way. portRangeNumPorts unsigned16 identifier 364 current The number of ports in a port range. A value of zero indicates that the number of ports is not specified, ie the range is defined in some other way. staMacAddress macAddress identifier 365 current The IEEE 802 MAC address of a wireless station (STA). See section 1.4 of RFC5415 for the definition of STA. staIPv4Address ipv4Address identifier 366 current The IPv4 address of a wireless station (STA). See section 1.4 of RFC5415 for the definition of STA. wtpMacAddress macAddress identifier 367 current The IEEE 802 MAC address of a wireless access point (WTP). See section 1.4 of RFC5415 for the definition of WTP. ingressInterfaceType unsigned32 identifier 368 current The type of interface where packets of this Flow are being received. The value matches the value of managed object 'ifType' as defined in http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib egressInterfaceType unsigned32 identifier 369 current The type of interface where packets of this Flow are being sent. The value matches the value of managed object 'ifType' as defined in http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib rtpSequenceNumber unsigned16 370 current The RTP sequence number per RFC3550. userName string 371 current User name associated with the flow. applicationCategoryName string 372 current An attribute that provides a first level categorization for each Application ID. applicationSubCategoryName string 373 current An attribute that provides a second level categorization for each Application ID. applicationGroupName string 374 current An attribute that groups multiple Application IDs that belong to the same networking application. originalFlowsPresent unsigned64 deltaCounter 375 current The non-conservative count of Original Flows contributing to this Aggregated Flow. Non-conservative counts need not sum to the original count on re-aggregation. originalFlowsInitiated unsigned64 deltaCounter 376 current The conservative count of Original Flows whose first packet is represented within this Aggregated Flow. Conservative counts must sum to the original count on re-aggregation. originalFlowsCompleted unsigned64 deltaCounter 377 current The conservative count of Original Flows whose last packet is represented within this Aggregated Flow. Conservative counts must sum to the original count on re-aggregation. distinctCountOfSourceIPAddress unsigned64 totalCounter 378 current The count of distinct source IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP version. This Information Element is preferred to the IP-version-specific counters, unless it is important to separate the counts by version. distinctCountOfDestinationIPAddress unsigned64 totalCounter 379 current The count of distinct destination IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP version. This Information Element is preferred to the version-specific counters below, unless it is important to separate the counts by version. distinctCountOfSourceIPv4Address unsigned32 totalCounter 380 current The count of distinct source IPv4 address values for Original Flows contributing to this Aggregated Flow. distinctCountOfDestinationIPv4Address unsigned32 totalCounter 381 current The count of distinct destination IPv4 address values for Original Flows contributing to this Aggregated Flow. distinctCountOfSourceIPv6Address unsigned64 totalCounter 382 current The count of distinct source IPv6 address values for Original Flows contributing to this Aggregated Flow. distinctCountOfDestinationIPv6Address unsigned64 totalCounter 383 current The count of distinct destination IPv6 address values for Original Flows contributing to this Aggregated Flow. valueDistributionMethod unsigned8 384 current A description of the method used to distribute the counters from Contributing Flows into the Aggregated Flow records described by an associated scope, generally a Template. The method is deemed to apply to all the non-key Information Elements in the referenced scope for which value distribution is a valid operation; if the originalFlowsInitiated and/or originalFlowsCompleted Information Elements appear in the Template, they are not subject to this distribution method, as they each infer their own distribution method. This is intended to be a complete set of possible value distribution methods; it is encoded as follows: +-------+-----------------------------------------------------------+ | Value | Description | +-------+-----------------------------------------------------------+ | 0 | Unspecified: The counters for an Original Flow are | | | explicitly not distributed according to any other method | | | defined for this Information Element; use for arbitrary | | | distribution, or distribution algorithms not described by | | | any other codepoint. | | | --------------------------------------------------------- | | | | | 1 | Start Interval: The counters for an Original Flow are | | | added to the counters of the appropriate Aggregated Flow | | | containing the start time of the Original Flow. This | | | should be assumed the default if value distribution | | | information is not available at a Collecting Process for | | | an Aggregated Flow. | | | --------------------------------------------------------- | | | | | 2 | End Interval: The counters for an Original Flow are added | | | to the counters of the appropriate Aggregated Flow | | | containing the end time of the Original Flow. | | | --------------------------------------------------------- | | | | | 3 | Mid Interval: The counters for an Original Flow are added | | | to the counters of a single appropriate Aggregated Flow | | | containing some timestamp between start and end time of | | | the Original Flow. | | | --------------------------------------------------------- | | | | | 4 | Simple Uniform Distribution: Each counter for an Original | | | Flow is divided by the number of time intervals the | | | Original Flow covers (i.e., of appropriate Aggregated | | | Flows sharing the same Flow Key), and this number is | | | added to each corresponding counter in each Aggregated | | | Flow. | | | --------------------------------------------------------- | | | | | 5 | Proportional Uniform Distribution: Each counter for an | | | Original Flow is divided by the number of time units the | | | Original Flow covers, to derive a mean count rate. This | | | mean count rate is then multiplied by the number of time | | | units in the intersection of the duration of the Original | | | Flow and the time interval of each Aggregated Flow. This | | | is like simple uniform distribution, but accounts for the | | | fractional portions of a time interval covered by an | | | Original Flow in the first and last time interval. | | | --------------------------------------------------------- | | | | | 6 | Simulated Process: Each counter of the Original Flow is | | | distributed among the intervals of the Aggregated Flows | | | according to some function the Intermediate Aggregation | | | Process uses based upon properties of Flows presumed to | | | be like the Original Flow. This is essentially an | | | assertion that the Intermediate Aggregation Process has | | | no direct packet timing information but is nevertheless | | | not using one of the other simpler distribution methods. | | | The Intermediate Aggregation Process specifically makes | | | no assertion as to the correctness of the simulation. | | | --------------------------------------------------------- | | | | | 7 | Direct: The Intermediate Aggregation Process has access | | | to the original packet timings from the packets making up | | | the Original Flow, and uses these to distribute or | | | recalculate the counters. | +-------+-----------------------------------------------------------+ rfc3550JitterMeanMilliseconds unsigned32 quantity 385 current Interarrival jitter as defined in section 6.4.1 of , measured in milliseconds. milliseconds rfc3550JitterMeanMicroseconds unsigned32 quantity 386 current Interarrival jitter as defined in section 6.4.1 of , measured in microseconds. microseconds rfc3550JitterMeanNanoseconds unsigned32 quantity 387 current Interarrival jitter as defined in section 6.4.1 of , measured in nanoseconds. nanoseconds 388-32767 Expert Review Primary expert - Nevil Brownlee and Secondary expert - Juergen Quittek 1 TE-MIDPT: Any TE tunnel mid-point or tail label 2 Pseudowire: Any PWE3 or Cisco AToM based label 3 VPN: Any label associated with VPN 4 BGP: Any label associated with BGP or BGP routing 5 LDP: Any label associated with dynamically assigned labels using LDP 6-255 Unassigned Expert Review Primary expert - Nevil Brownlee and Secondary expert - Juergen Quittek 0 Invalid. 1 IANA-L3: The Assigned Internet Protocol Number (layer 3 (L3)) is exported in the Selector ID. See http://www.iana.org/assignments/protocol-numbers. 1 2 PANA-L3: Proprietary layer 3 definition. An enterprise can export its own layer 3 protocol numbers. The Selector ID has a global significance for all devices from the same enterprise. 1 3 IANA-L4: The IANA layer 4 (L4) well-known port number is exported in the Selector ID. See [http://www.iana.org/assignments/service-names-port-numbers]. Note: as an IPFIX flow is unidirectional, it contains the destination port in a flow from the client to the server. 2 4 PANA-L4: Proprietary layer 4 definition. An enterprise can export its own layer 4 port numbers. The Selector ID has global significance for devices from the same enterprise. Example: IPFIX had the port 4739 pre-assigned in the IETF draft for years. While waiting for the RFC and its associated IANA registration, the Selector ID 4739 was used with this PANA-L4. 2 5 Reserved 6 USER-Defined: The Selector ID represents applications defined by the user (using CLI, GUI, etc.) based on the methods described in section 2. The Selector ID has a local significance per device. 3 7 Reserved 8 Reserved 9 Reserved 10 Reserved 11 Reserved 12 PANA-L2: Proprietary layer 2 (L2) definition. An enterprise can export its own layer 2 identifiers. The Selector ID represents the enterprise's unique global layer 2 applications. The Selector ID has a global significance for all devices from the same enterprise. Examples include Cisco Subnetwork Access Protocol (SNAP). 5 13 PANA-L7: Proprietary layer 7 definition. The Selector ID represents the enterprise's unique global ID for the layer 7 applications. The Selector ID has a global significance for all devices from the same enterprise. This Classification Engine Id is used when the application registry is owned by the Exporter manufacturer (referred to as the "enterprise" in this document). 3 14 Reserved 15 Reserved 16 Reserved 17 Reserved 18 ETHERTYPE: The Selector ID represents the well- known Ethertype. See http://standards.ieee.org/develop/regauth/ethertype/eth.txt. Note that the Ethertype is usually expressed in hexadecimal. However, the corresponding decimal value is used in this Selector ID. 2 19 LLC: The Selector ID represents the well-known IEEE 802.2 Link Layer Control (LLC) Destination Service Access Point (DSAP). See http://standards.ieee.org/develop/regauth/llc/public.html. Note that LLC DSAP is usually expressed in hexadecimal. However, the corresponding decimal value is used in this Selector ID. 1 20 PANA-L7-PEN: Proprietary layer 7 definition, including a Private Enterprise Number (PEN) [http://www.iana.org/assignments/enterprise-numbers] to identify that the application registry being used is not owned by the Exporter manufacturer or to identify the original enterprise in the case of a mediator or 3rd party device. The Selector ID represents the enterprise unique global ID for the layer 7 applications. The Selector ID has a global significance for all devices from the same enterprise. 3 Standards Action 0 Reserved 1-8 Reserved (historic) 9 Cisco Systems NetFlow Version 9 (historic) 10 IPFIX as documented in RFC5101 11-65535 Unassigned Standards Action 0-1 Not used (historic) 2 Template Set 3 Option Template Set 4-255 Unassigned 256-65535 Reserved for Data Sets Standards Action 0 octetArray 1 unsigned8 2 unsigned16 3 unsigned32 4 unsigned64 5 signed8 6 signed16 7 signed32 8 signed64 9 float32 10 float64 11 boolean 12 macAddress 13 string 14 dateTimeSeconds 15 dateTimeMilliseconds 16 dateTimeMicroseconds 17 dateTimeNanoseconds 18 ipv4Address 19 ipv6Address 20 basicList 21 subTemplateList 22 subTemplateMultiList 23-255 Unassigned Standards Action 0 default 1 quantity 2 totalCounter 3 deltaCounter 4 identifier 5 flags 6 list 7-255 Unassigned Expert Review 0 none 1 bits 2 octets 3 packets 4 flows 5 seconds 6 milliseconds 7 microseconds 8 nanoseconds 9 4-octet words for IPv4 header length 10 messages for reliability reporting 11 hops for TTL 12 entries for MPLS label stack 13-65535 Unassigned Standards Action 0x00 noneOf The "noneOf" structured data type semantic specifies that none of the elements are actual properties of the Data Record. 0x01 exactlyOneOf The "exactlyOneOf" structured data type semantic specifies that only a single element from the structured data is an actual property of the Data Record. This is equivalent to a logical XOR operation. 0x02 oneOrMoreOf The "oneOrMoreOf" structured data type semantic specifies that one or more elements from the list in the structured data are actual properties of the Data Record. This is equivalent to a logical OR operation. 0x03 allOf The "allOf" structured data type semantic specifies that all of the list elements from the structured data are actual properties of the Data Record. 0x04 ordered The "ordered" structured data type semantic specifies that elements from the list in the structured data are ordered. 0x05-0xFE unassigned 0xFF undefined The "undefined" structured data type semantic specifies that the semantic of the list elements is not specified and that, if a semantic exists, then it is up to the Collecting Process to draw its own conclusions. The "undefined" structured data type semantic is the default structured data type semantic. ipfix-iana at cisco.com mailto:ipfix-iana&cisco.com 2012-09-20