3365 lines
181 KiB
Plaintext
3365 lines
181 KiB
Plaintext
ElementID,Name,Data Type,Data Type Semantics,Status,Description,Units,Range,References,Requester,Revision,Date
|
|
0,Reserved,,,,,,,,[RFC5102],,2013-02-18
|
|
1,octetDeltaCount,unsigned64,deltaCounter,current,"The number of octets since the previous report (if any)
|
|
in incoming packets for this Flow at the Observation Point.
|
|
The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
|
|
2,packetDeltaCount,unsigned64,deltaCounter,current,"The number of incoming packets since the previous report
|
|
(if any) for this Flow at the Observation Point.",packets,,,[RFC5102],0,2013-02-18
|
|
3,deltaFlowCount,unsigned64,deltaCounter,current,"The conservative count of Original Flows contributing
|
|
to this Aggregated Flow; may be distributed via any of the methods
|
|
expressed by the valueDistributionMethod Information Element.",flows,,,[RFC7015],1,2013-06-25
|
|
4,protocolIdentifier,unsigned8,identifier,current,"The value of the protocol number in the IP packet header.
|
|
The protocol number identifies the IP packet payload type.
|
|
Protocol numbers are defined in the IANA Protocol Numbers
|
|
registry.
|
|
|
|
|
|
|
|
|
|
In Internet Protocol version 4 (IPv4), this is carried in the
|
|
Protocol field. In Internet Protocol version 6 (IPv6), this
|
|
is carried in the Next Header field in the last extension
|
|
header of the packet.",,,"See [RFC791] for the specification of the IPv4
|
|
protocol field.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 protocol field.
|
|
See the list of protocol numbers assigned by IANA at [IANA registry protocol-numbers].",[RFC5102],0,2013-02-18
|
|
5,ipClassOfService,unsigned8,identifier,current,"For IPv4 packets, this is the value of the TOS field in
|
|
the IPv4 packet header. For IPv6 packets, this is the
|
|
value of the Traffic Class field in the IPv6 packet header.",,,"See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field.
|
|
See [RFC2460] for the definition of the IPv6
|
|
Traffic Class field.",[RFC5102],0,2013-02-18
|
|
6,tcpControlBits,unsigned16,flags,current,"TCP control bits observed for the packets of this Flow.
|
|
This information is encoded as a bit field; for each TCP control
|
|
bit, there is a bit in this set. The bit is set to 1 if any
|
|
observed packet of this Flow has the corresponding TCP control bit
|
|
set to 1. The bit is cleared to 0 otherwise.
|
|
|
|
|
|
|
|
|
|
The values of each bit are shown below, per the definition of the
|
|
bits in the TCP header [RFC793][RFC3168][RFC3540]:
|
|
|
|
|
|
|
|
MSb LSb
|
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
|
|
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|
|
| | | N | C | E | U | A | P | R | S | F |
|
|
| Zero | Future | S | W | C | R | C | S | S | Y | I |
|
|
| (Data Offset) | Use | | R | E | G | K | H | T | N | N |
|
|
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|
|
|
|
bit flag
|
|
value name description
|
|
------+-----+-------------------------------------
|
|
0x8000 Zero (see tcpHeaderLength)
|
|
0x4000 Zero (see tcpHeaderLength)
|
|
0x2000 Zero (see tcpHeaderLength)
|
|
0x1000 Zero (see tcpHeaderLength)
|
|
0x0800 Future Use
|
|
0x0400 Future Use
|
|
0x0200 Future Use
|
|
0x0100 NS ECN Nonce Sum
|
|
0x0080 CWR Congestion Window Reduced
|
|
0x0040 ECE ECN Echo
|
|
0x0020 URG Urgent Pointer field significant
|
|
0x0010 ACK Acknowledgment field significant
|
|
0x0008 PSH Push Function
|
|
0x0004 RST Reset the connection
|
|
0x0002 SYN Synchronize sequence numbers
|
|
0x0001 FIN No more data from sender
|
|
|
|
|
|
|
|
As the most significant 4 bits of octets 12 and 13 (counting from
|
|
zero) of the TCP header [RFC793] are used to encode the TCP data
|
|
offset (header length), the corresponding bits in this Information
|
|
Element MUST be exported as zero and MUST be ignored by the
|
|
collector. Use the tcpHeaderLength Information Element to encode
|
|
this value.
|
|
|
|
|
|
|
|
|
|
Each of the 3 bits (0x800, 0x400, and 0x200), which are reserved
|
|
for future use in [RFC793], SHOULD be exported as observed in the
|
|
TCP headers of the packets of this Flow.
|
|
|
|
|
|
|
|
|
|
If exported as a single octet with reduced-size encoding, this
|
|
Information Element covers the low-order octet of this field (i.e,
|
|
bits 0x80 to 0x01), omitting the ECN Nonce Sum and the three
|
|
Future Use bits. A collector receiving this Information Element
|
|
with reduced-size encoding must not assume anything about the
|
|
content of these four bits.
|
|
|
|
|
|
|
|
|
|
Exporting Processes exporting this Information Element on behalf
|
|
of a Metering Process that is not capable of observing any of the
|
|
ECN Nonce Sum or Future Use bits SHOULD use reduced-size encoding,
|
|
and only export the least significant 8 bits of this Information
|
|
Element.
|
|
|
|
|
|
|
|
|
|
Note that previous revisions of this Information Element's
|
|
definition specified that the CWR and ECE bits must be exported as
|
|
zero, even if observed. Collectors should therefore not assume
|
|
that a value of zero for these bits in this Information Element
|
|
indicates the bits were never set in the observed traffic,
|
|
especially if these bits are zero in every Flow Record sent by a
|
|
given exporter.",,,[RFC793][RFC3168][RFC3540],[RFC7125],1,2014-01-03
|
|
7,sourceTransportPort,unsigned16,identifier,current,"The source port identifier in the transport header.
|
|
For the transport protocols UDP, TCP, and SCTP, this is the
|
|
source port number given in the respective header. This
|
|
field MAY also be used for future transport protocols that
|
|
have 16-bit source port identifiers.",,,"See [RFC768] for the definition of the UDP
|
|
source port field.
|
|
See [RFC793] for the definition of the TCP
|
|
source port field.
|
|
See [RFC4960] for the definition of SCTP.
|
|
|
|
|
|
|
|
|
|
Additional information on defined UDP and TCP port numbers can be
|
|
found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
8,sourceIPv4Address,ipv4Address,default,current,The IPv4 source address in the IP packet header.,,,"See [RFC791] for the definition of the IPv4
|
|
source address field.",[RFC5102],1,2014-02-03
|
|
9,sourceIPv4PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
|
|
sourceIPv4Prefix Information Element.",bits,0-32,,[RFC5102],0,2013-02-18
|
|
10,ingressInterface,unsigned32,identifier,current,"The index of the IP interface where packets of this Flow
|
|
are being received. The value matches the value of managed
|
|
object 'ifIndex' as defined in [RFC2863].
|
|
Note that ifIndex values are not assigned statically to an
|
|
interface and that the interfaces may be renumbered every
|
|
time the device's management system is re-initialized, as
|
|
specified in [RFC2863].",,,"See [RFC2863] for the definition of the
|
|
ifIndex object.",[RFC5102],0,2013-02-18
|
|
11,destinationTransportPort,unsigned16,identifier,current,"The destination port identifier in the transport header.
|
|
For the transport protocols UDP, TCP, and SCTP, this is the
|
|
destination port number given in the respective header.
|
|
This field MAY also be used for future transport protocols
|
|
that have 16-bit destination port identifiers.",,,"See [RFC768] for the definition of the UDP
|
|
destination port field.
|
|
See [RFC793] for the definition of the TCP
|
|
destination port field.
|
|
See [RFC4960] for the definition of SCTP.
|
|
|
|
|
|
|
|
|
|
Additional information on defined UDP and TCP port numbers can be
|
|
found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
12,destinationIPv4Address,ipv4Address,default,current,The IPv4 destination address in the IP packet header.,,,"See [RFC791] for the definition of the IPv4
|
|
destination address field.",[RFC5102],1,2014-02-03
|
|
13,destinationIPv4PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
|
|
destinationIPv4Prefix Information Element.",bits,0-32,,[RFC5102],0,2013-02-18
|
|
14,egressInterface,unsigned32,identifier,current,"The index of the IP interface where packets of
|
|
this Flow are being sent. The value matches the value of
|
|
managed object 'ifIndex' as defined in [RFC2863].
|
|
Note that ifIndex values are not assigned statically to an
|
|
interface and that the interfaces may be renumbered every
|
|
time the device's management system is re-initialized, as
|
|
specified in [RFC2863].",,,"See [RFC2863] for the definition of the
|
|
ifIndex object.",[RFC5102],0,2013-02-18
|
|
15,ipNextHopIPv4Address,ipv4Address,default,current,The IPv4 address of the next IPv4 hop.,,,,[RFC5102],1,2014-02-03
|
|
16,bgpSourceAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the source IP address.
|
|
If AS path information for this Flow is only available as
|
|
an unordered AS set (and not as an ordered AS sequence),
|
|
then the value of this Information Element is 0.",,,"See [RFC4271] for a description of BGP-4, and
|
|
see [RFC1930] for the definition of the AS
|
|
number.",[RFC5102],0,2013-02-18
|
|
17,bgpDestinationAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the destination IP
|
|
address. If AS path information for this Flow is only
|
|
available as an unordered AS set (and not as an ordered AS
|
|
sequence), then the value of this Information Element is 0.",,,"See [RFC4271] for a description of BGP-4, and
|
|
see [RFC1930] for the definition of the AS
|
|
number.",[RFC5102],0,2013-02-18
|
|
18,bgpNextHopIPv4Address,ipv4Address,default,current,The IPv4 address of the next (adjacent) BGP hop.,,,See [RFC4271] for a description of BGP-4.,[RFC5102],1,2014-02-03
|
|
19,postMCastPacketDeltaCount,unsigned64,deltaCounter,current,"The number of outgoing multicast packets since the
|
|
previous report (if any) sent for packets of this Flow
|
|
by a multicast daemon within the Observation Domain.
|
|
This property cannot necessarily be observed at the
|
|
Observation Point, but may be retrieved by other means.",packets,,,[RFC5102],0,2013-02-18
|
|
20,postMCastOctetDeltaCount,unsigned64,deltaCounter,current,"The number of octets since the previous report (if any)
|
|
in outgoing multicast packets sent for packets of this
|
|
Flow by a multicast daemon within the Observation Domain.
|
|
This property cannot necessarily be observed at the
|
|
Observation Point, but may be retrieved by other means.
|
|
The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
|
|
21,flowEndSysUpTime,unsigned32,,current,"The relative timestamp of the last packet of this Flow. It indicates the
|
|
number of milliseconds since the last (re-)initialization of the IPFIX
|
|
Device (sysUpTime). sysUpTime can be calculated from
|
|
systemInitTimeMilliseconds.",milliseconds,,,[RFC5102],1,2014-01-11
|
|
22,flowStartSysUpTime,unsigned32,,current,"The relative timestamp of the first packet of this Flow. It indicates
|
|
the number of milliseconds since the last (re-)initialization of the
|
|
IPFIX Device (sysUpTime). sysUpTime can be calculated from
|
|
systemInitTimeMilliseconds.",milliseconds,,,[RFC5102],1,2014-01-11
|
|
23,postOctetDeltaCount,unsigned64,deltaCounter,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'octetDeltaCount', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",octets,,,[RFC5102],0,2013-02-18
|
|
24,postPacketDeltaCount,unsigned64,deltaCounter,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'packetDeltaCount', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",packets,,,[RFC5102],0,2013-02-18
|
|
25,minimumIpTotalLength,unsigned64,,current,"Length of the smallest packet observed for this Flow.
|
|
The packet length includes the IP header(s) length and
|
|
the IP payload length.",octets,,"See [RFC791] for the specification of the IPv4
|
|
total length.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 payload length.
|
|
See [RFC2675] for the specification of the
|
|
IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
|
|
26,maximumIpTotalLength,unsigned64,,current,"Length of the largest packet observed for this Flow.
|
|
The packet length includes the IP header(s) length and
|
|
the IP payload length.",octets,,"See [RFC791] for the specification of the IPv4
|
|
total length.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 payload length.
|
|
See [RFC2675] for the specification of the
|
|
IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
|
|
27,sourceIPv6Address,ipv6Address,default,current,The IPv6 source address in the IP packet header.,,,"See [RFC2460] for the definition of the Source
|
|
Address field in the IPv6 header.",[RFC5102],1,2014-02-03
|
|
28,destinationIPv6Address,ipv6Address,default,current,The IPv6 destination address in the IP packet header.,,,"See [RFC2460] for the definition of the
|
|
Destination Address field in the IPv6 header.",[RFC5102],1,2014-02-03
|
|
29,sourceIPv6PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
|
|
sourceIPv6Prefix Information Element.",bits,0-128,,[RFC5102],0,2013-02-18
|
|
30,destinationIPv6PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
|
|
destinationIPv6Prefix Information Element.",bits,0-128,,[RFC5102],0,2013-02-18
|
|
31,flowLabelIPv6,unsigned32,identifier,current,The value of the IPv6 Flow Label field in the IP packet header.,,0-0xFFFFF,"See [RFC2460] for the definition of the
|
|
Flow Label field in the IPv6 packet header.",[RFC5102],1,2014-08-13
|
|
32,icmpTypeCodeIPv4,unsigned16,identifier,current,"Type and Code of the IPv4 ICMP message. The combination of
|
|
both values is reported as (ICMP type * 256) + ICMP code.",,,"See [RFC792] for the definition of the IPv4
|
|
ICMP type and code fields.",[RFC5102],0,2013-02-18
|
|
33,igmpType,unsigned8,identifier,current,The type field of the IGMP message.,,,"See [RFC3376] for the definition of the IGMP
|
|
type field.",[RFC5102],0,2013-02-18
|
|
34,samplingInterval,unsigned32,quantity,deprecated,"Deprecated in favor of 305 samplingPacketInterval. When using
|
|
sampled NetFlow, the rate at which packets are sampled -- e.g., a
|
|
value of 100 indicates that one of every 100 packets is sampled.",packets,,,[RFC7270],0,2014-04-04
|
|
35,samplingAlgorithm,unsigned8,identifier,deprecated,"Deprecated in favor of 304 selectorAlgorithm. The type of
|
|
algorithm used for sampled NetFlow:
|
|
|
|
|
|
|
|
|
|
1 - Deterministic Sampling,
|
|
2 - Random Sampling.
|
|
|
|
|
|
|
|
|
|
The values are not compatible with the selectorAlgorithm IE, where
|
|
""Deterministic"" has been replaced by ""Systematic count-based"" (1)
|
|
or ""Systematic time-based"" (2), and ""Random"" is (3). Conversion
|
|
is required; see [Packet Sampling (PSAMP) Parameters.]",,,,[RFC7270],0,2014-04-04
|
|
36,flowActiveTimeout,unsigned16,,current,"The number of seconds after which an active Flow is timed out
|
|
anyway, even if there is still a continuous flow of packets.",seconds,,,[RFC5102],0,2013-02-18
|
|
37,flowIdleTimeout,unsigned16,,current,"A Flow is considered to be timed out if no packets belonging
|
|
to the Flow have been observed for the number of seconds
|
|
specified by this field.",seconds,,,[RFC5102],0,2013-02-18
|
|
38,engineType,unsigned8,identifier,deprecated,"Type of flow switching engine in a router/switch:
|
|
|
|
|
|
|
|
RP = 0,
|
|
VIP/Line card = 1,
|
|
PFC/DFC = 2.
|
|
|
|
|
|
|
|
Reserved for internal use on the Collector.",,,,[RFC7270],0,2014-04-04
|
|
39,engineId,unsigned8,identifier,deprecated,"Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a
|
|
router/switch. Reserved for internal use on the Collector.",,,,[RFC7270],0,2014-04-04
|
|
40,exportedOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets that the Exporting Process
|
|
has sent since the Exporting Process (re-)initialization
|
|
to a particular Collecting Process.
|
|
The value of this Information Element is calculated by
|
|
summing up the IPFIX Message Header length values of all
|
|
IPFIX Messages that were successfully sent to the Collecting
|
|
Process. The reported number excludes octets in the IPFIX
|
|
Message that carries the counter value.
|
|
If this Information Element is sent to a particular
|
|
Collecting Process, then by default it specifies the number
|
|
of octets sent to this Collecting Process.",octets,,,[RFC5102],0,2013-02-18
|
|
41,exportedMessageTotalCount,unsigned64,totalCounter,current,"The total number of IPFIX Messages that the Exporting Process
|
|
has sent since the Exporting Process (re-)initialization to
|
|
a particular Collecting Process.
|
|
The reported number excludes the IPFIX Message that carries
|
|
the counter value.
|
|
If this Information Element is sent to a particular
|
|
Collecting Process, then by default it specifies the number
|
|
of IPFIX Messages sent to this Collecting Process.",messages,,,[RFC5102],0,2013-02-18
|
|
42,exportedFlowRecordTotalCount,unsigned64,totalCounter,current,"The total number of Flow Records that the Exporting
|
|
Process has sent as Data Records since the Exporting
|
|
Process (re-)initialization to a particular Collecting
|
|
Process. The reported number excludes Flow Records in
|
|
the IPFIX Message that carries the counter value.
|
|
If this Information Element is sent to a particular
|
|
Collecting Process, then by default it specifies the number
|
|
of Flow Records sent to this process.",flows,,,[RFC5102],0,2013-02-18
|
|
43,ipv4RouterSc,ipv4Address,default,deprecated,"This is a platform-specific field for the Catalyst 5000/Catalyst 6000
|
|
family. It is used to store the address of a router that is being
|
|
shortcut when performing MultiLayer Switching.",,,[CCO-MLS] describes MultiLayer Switching.,[RFC7270],0,2014-04-04
|
|
44,sourceIPv4Prefix,ipv4Address,default,current,IPv4 source address prefix.,,,,[RFC5102],0,2013-02-18
|
|
45,destinationIPv4Prefix,ipv4Address,default,current,IPv4 destination address prefix.,,,,[RFC5102],0,2013-02-18
|
|
46,mplsTopLabelType,unsigned8,identifier,current,"This field identifies the control protocol that allocated the
|
|
top-of-stack label. Values for this field are listed in the
|
|
MPLS label type registry. See
|
|
[http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-mpls-label-type]",,,"See [RFC3031] for the MPLS label structure.
|
|
See [RFC4364] for the association of MPLS
|
|
labels with Virtual Private Networks (VPNs).
|
|
See [RFC4271] for BGP and BGP routing.
|
|
See [RFC5036] for Label Distribution Protocol
|
|
(LDP).
|
|
See the list of MPLS label types assigned by IANA at [IANA registry mpls-label-values].",[RFC5102],0,2013-02-18
|
|
47,mplsTopLabelIPv4Address,ipv4Address,default,current,"The IPv4 address of the system that the MPLS top label will
|
|
cause this Flow to be forwarded to.",,,"See [RFC3031] for the association between MPLS
|
|
labels and IP addresses.",[RFC5102],1,2014-02-03
|
|
48,samplerId,unsigned8,identifier,deprecated,"Deprecated in favor of 302 selectorId. The unique identifier
|
|
associated with samplerName.",,,,[RFC7270],0,2014-04-04
|
|
49,samplerMode,unsigned8,identifier,deprecated,"Deprecated in favor of 304 selectorAlgorithm. The values are not
|
|
compatible: selectorAlgorithm=3 is random sampling. The type of
|
|
algorithm used for sampling data: 1 - Deterministic, 2 - Random
|
|
Sampling. Use with samplerRandomInterval.",,,,[RFC7270],0,2014-04-04
|
|
50,samplerRandomInterval,unsigned32,quantity,deprecated,"Deprecated in favor of 305 samplingPacketInterval. Packet
|
|
interval at which to sample -- in case of random sampling. Used in
|
|
connection with the samplerMode 0x02 (random sampling) value.",,,,[RFC7270],0,2014-04-04
|
|
51,classId,unsigned8,identifier,deprecated,"Deprecated in favor of 302 selectorId. Characterizes the traffic
|
|
class, i.e., QoS treatment.",,,,[RFC7270],0,2014-04-04
|
|
52,minimumTTL,unsigned8,,current,Minimum TTL value observed for any packet in this Flow.,hops,,"See [RFC791] for the definition of the IPv4
|
|
Time to Live field.
|
|
See [RFC2460] for the definition of the IPv6
|
|
Hop Limit field.",[RFC5102],0,2013-02-18
|
|
53,maximumTTL,unsigned8,,current,Maximum TTL value observed for any packet in this Flow.,hops,,"See [RFC791] for the definition of the IPv4
|
|
Time to Live field.
|
|
See [RFC2460] for the definition of the IPv6
|
|
Hop Limit field.",[RFC5102],0,2013-02-18
|
|
54,fragmentIdentification,unsigned32,identifier,current,"The value of the Identification field
|
|
in the IPv4 packet header or in the IPv6 Fragment header,
|
|
respectively. The value is 0 for IPv6 if there is
|
|
no fragment header.",,,"See [RFC791] for the definition of the IPv4
|
|
Identification field.
|
|
See [RFC2460] for the definition of the
|
|
Identification field in the IPv6 Fragment header.",[RFC5102],0,2013-02-18
|
|
55,postIpClassOfService,unsigned8,identifier,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'ipClassOfService', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",,,"See [RFC791] for the definition of the IPv4
|
|
TOS field.
|
|
See [RFC2460] for the definition of the IPv6
|
|
Traffic Class field.
|
|
See [RFC3234] for the definition of
|
|
middleboxes.",[RFC5102],0,2013-02-18
|
|
56,sourceMacAddress,macAddress,default,current,The IEEE 802 source MAC address field.,,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
|
|
57,postDestinationMacAddress,macAddress,default,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'destinationMacAddress', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
|
|
58,vlanId,unsigned16,identifier,current,"Virtual LAN identifier associated with ingress interface. For dot1q vlans, see 243
|
|
dot1qVlanId.",,,See IEEE.802-1Q.2003.,[RFC5102],0,2013-02-18
|
|
59,postVlanId,unsigned16,identifier,current,"Virtual LAN identifier associated with egress interface. For postdot1q vlans, see 254, postDot1qVlanId.",,,See IEEE.802-1Q.2003.,[RFC5102],0,2013-02-18
|
|
60,ipVersion,unsigned8,identifier,current,The IP version field in the IP packet header.,,,"See [RFC791] for the definition of the version
|
|
field in the IPv4 packet header.
|
|
See [RFC2460] for the definition of the
|
|
version field in the IPv6 packet header.
|
|
Additional information on defined version numbers can be found at
|
|
[IANA registry version-numbers].",[RFC5102],0,2013-02-18
|
|
61,flowDirection,unsigned8,identifier,current,"The direction of the Flow observed at the Observation
|
|
Point. There are only two values defined.
|
|
|
|
|
|
|
|
0x00: ingress flow
|
|
0x01: egress flow",,,,[RFC5102],0,2013-02-18
|
|
62,ipNextHopIPv6Address,ipv6Address,default,current,The IPv6 address of the next IPv6 hop.,,,,[RFC5102],1,2014-02-03
|
|
63,bgpNextHopIPv6Address,ipv6Address,default,current,The IPv6 address of the next (adjacent) BGP hop.,,,See [RFC4271] for a description of BGP-4.,[RFC5102],1,2014-02-03
|
|
64,ipv6ExtensionHeaders,unsigned32,flags,current,"IPv6 extension headers observed in packets of this Flow.
|
|
The information is encoded in a set of bit fields. For
|
|
each IPv6 option header, there is a bit in this set.
|
|
The bit is set to 1 if any observed packet of this Flow
|
|
contains the corresponding IPv6 extension header.
|
|
Otherwise, if no observed packet of this Flow contained
|
|
the respective IPv6 extension header, the value of the
|
|
corresponding bit is 0.
|
|
|
|
|
|
|
|
0 1 2 3 4 5 6 7
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
| DST | HOP | Res | UNK |FRA0 | RH |FRA1 | Res | ...
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
|
|
8 9 10 11 12 13 14 15
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
... | Reserved | MOB | ESP | AH | PAY | ...
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
|
|
16 17 18 19 20 21 22 23
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
... | Reserved | ...
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
24 25 26 27 28 29 30 31
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
... | Reserved |
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
|
|
Bit IPv6 Option Description
|
|
0, DST 60 Destination option header
|
|
1, HOP 0 Hop-by-hop option header
|
|
2, Res Reserved
|
|
3, UNK Unknown Layer 4 header
|
|
(compressed, encrypted, not supported)
|
|
4, FRA0 44 Fragment header - first fragment
|
|
5, RH 43 Routing header
|
|
6, FRA1 44 Fragmentation header - not first fragment
|
|
7, Res Reserved
|
|
8 to 11 Reserved
|
|
12, MOB 135 IPv6 mobility [RFC3775]
|
|
13, ESP 50 Encrypted security payload
|
|
14, AH 51 Authentication Header
|
|
15, PAY 108 Payload compression header
|
|
16 to 31 Reserved",,,"See [RFC2460] for the general definition of
|
|
IPv6 extension headers and for the specification of the hop-by-hop
|
|
options header, the routing header, the fragment header, and the
|
|
destination options header.
|
|
See [RFC4302] for the specification of the
|
|
authentication header.
|
|
See [RFC4303] for the specification of the
|
|
encapsulating security payload.
|
|
|
|
The diagram provided in [RFC5102] is incorrect.
|
|
The diagram in this registry is taken from Errata 1738. See [RFC Errata
|
|
1738]",[RFC5102],0,2013-02-18
|
|
65-69,Assigned for NetFlow v9 compatibility,,,,,,,[RFC3954],[RFC5102],0,2013-02-18
|
|
70,mplsTopLabelStackSection,octetArray,default,current,"The Label, Exp, and S fields from the top MPLS label
|
|
stack entry, i.e., from the last label that was pushed.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.
|
|
|
|
|
|
|
|
0 1 2
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
| Label | Exp |S|
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
|
|
Label: Label Value, 20 bits
|
|
Exp: Experimental Use, 3 bits
|
|
S: Bottom of Stack, 1 bit",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
71,mplsLabelStackSection2,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsTopLabelStackSection. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
72,mplsLabelStackSection3,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection2. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
73,mplsLabelStackSection4,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection3. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
74,mplsLabelStackSection5,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection4. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
75,mplsLabelStackSection6,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection5. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
76,mplsLabelStackSection7,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection6. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
77,mplsLabelStackSection8,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection7. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
78,mplsLabelStackSection9,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection8. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
79,mplsLabelStackSection10,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
|
|
was pushed immediately before the label stack entry that would
|
|
be reported by mplsLabelStackSection9. See the definition of
|
|
mplsTopLabelStackSection for further details.
|
|
|
|
|
|
|
|
|
|
The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
|
|
80,destinationMacAddress,macAddress,default,current,The IEEE 802 destination MAC address field.,,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
|
|
81,postSourceMacAddress,macAddress,default,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'sourceMacAddress', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
|
|
82,interfaceName,string,default,current,"A short name uniquely describing an interface, eg ""Eth1/0"".",,,See [RFC2863] for the definition of the ifName object.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
83,interfaceDescription,string,default,current,"The description of an interface, eg ""FastEthernet 1/0"" or ""ISP
|
|
connection"".",,,See [RFC2863] for the definition of the ifDescr object.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
84,samplerName,string,,deprecated,"Deprecated in favor of 335 selectorName. Name of the flow
|
|
sampler.",,,,[RFC7270],0,2014-04-04
|
|
85,octetTotalCount,unsigned64,totalCounter,current,"The total number of octets in incoming packets
|
|
for this Flow at the Observation Point since the Metering
|
|
Process (re-)initialization for this Observation Point. The
|
|
number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
|
|
86,packetTotalCount,unsigned64,totalCounter,current,"The total number of incoming packets for this Flow
|
|
at the Observation Point since the Metering Process
|
|
(re-)initialization for this Observation Point.",packets,,,[RFC5102],0,2013-02-18
|
|
87,flagsAndSamplerId,unsigned32,identifier,deprecated,"Flow flags and the value of the sampler ID (samplerId) combined in
|
|
one bitmapped field. Reserved for internal use on the Collector.",,,,[RFC7270],0,2014-04-04
|
|
88,fragmentOffset,unsigned16,quantity,current,"The value of the IP fragment offset field in the
|
|
IPv4 packet header or the IPv6 Fragment header,
|
|
respectively. The value is 0 for IPv6 if there is
|
|
no fragment header.",,0-0x1FFF,"See [RFC791] for the specification of the
|
|
fragment offset in the IPv4 header.
|
|
See [RFC2460] for the specification of the
|
|
fragment offset in the IPv6 Fragment header.",[RFC5102],1,2014-08-13
|
|
89,forwardingStatus,unsigned32,identifier,current,"This Information Element describes the forwarding status of the
|
|
flow and any attached reasons. The reduced-size encoding rules as
|
|
per [RFC7011] apply.
|
|
|
|
|
|
|
|
|
|
The basic encoding is 8 bits. The future extensions
|
|
could add one or three bytes. The layout of the basic
|
|
encoding is as follows:
|
|
|
|
|
|
|
|
MSB - 0 1 2 3 4 5 6 7 - LSB
|
|
+---+---+---+---+---+---+---+---+
|
|
| Status| Reason code or flags |
|
|
+---+---+---+---+---+---+---+---+
|
|
|
|
Status:
|
|
|
|
00b = Unknown
|
|
01b = Forwarded
|
|
10b = Dropped
|
|
11b = Consumed
|
|
|
|
|
|
Reason Code (status = 01b, Forwarded)
|
|
|
|
01 000000b = 64 = Unknown
|
|
01 000001b = 65 = Fragmented
|
|
01 000010b = 66 = Not Fragmented
|
|
|
|
Reason Code (status = 10b, Dropped)
|
|
|
|
10 000000b = 128 = Unknown
|
|
10 000001b = 129 = ACL deny
|
|
10 000010b = 130 = ACL drop
|
|
10 000011b = 131 = Unroutable
|
|
10 000100b = 132 = Adjacency
|
|
10 000101b = 133 = Fragmentation and DF set
|
|
10 000110b = 134 = Bad header checksum
|
|
10 000111b = 135 = Bad total Length
|
|
10 001000b = 136 = Bad header length
|
|
10 001001b = 137 = bad TTL
|
|
10 001010b = 138 = Policer
|
|
10 001011b = 139 = WRED
|
|
10 001100b = 140 = RPF
|
|
10 001101b = 141 = For us
|
|
10 001110b = 142 = Bad output interface
|
|
10 001111b = 143 = Hardware
|
|
|
|
Reason Code (status = 11b, Consumed)
|
|
|
|
11 000000b = 192 = Unknown
|
|
11 000001b = 193 = Punt Adjacency
|
|
11 000010b = 194 = Incomplete Adjacency
|
|
11 000011b = 195 = For us
|
|
|
|
Examples:
|
|
|
|
value : 0x40 = 64
|
|
binary: 01000000
|
|
decode: 01 -> Forward
|
|
000000 -> No further information
|
|
|
|
value : 0x89 = 137
|
|
binary: 10001001
|
|
decode: 10 -> Drop
|
|
001001 -> Fragmentation and DF set",,,"See ""NetFlow Version 9 Flow-Record Format"" [CCO-NF9FMT].",[RFC7270],0,2014-04-04
|
|
90,mplsVpnRouteDistinguisher,octetArray,default,current,"The value of the VPN route distinguisher of a corresponding
|
|
entry in a VPN routing and forwarding table. Route
|
|
distinguisher ensures that the same address can be used in
|
|
several different MPLS VPNs and that it is possible for BGP to
|
|
carry several completely different routes to that address, one
|
|
for each VPN. According to [RFC4364], the size of
|
|
mplsVpnRouteDistinguisher is 8 octets. However, in [RFC4382] an
|
|
octet string with flexible length was chosen for representing a
|
|
VPN route distinguisher by object MplsL3VpnRouteDistinguisher.
|
|
This choice was made in order to be open to future changes of
|
|
the size. This idea was adopted when choosing octetArray as
|
|
abstract data type for this Information Element. The maximum
|
|
length of this Information Element is 256 octets.",,,"See [RFC4364] for the specification of the
|
|
route distinguisher. See [RFC4382] for the
|
|
specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN)
|
|
Management Information Base.",[RFC5102],1,2014-02-03
|
|
91,mplsTopLabelPrefixLength,unsigned8,quantity,current,"The prefix length of the subnet of the mplsTopLabelIPv4Address that
|
|
the MPLS top label will cause the Flow to be forwarded to.",bits,0-32,"See [RFC3031] for the association between
|
|
MPLS labels and prefix lengths.",[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
92,srcTrafficIndex,unsigned32,identifier,current,BGP Policy Accounting Source Traffic Index.,,,BGP policy accounting as described in [CCO-BGPPOL].,[RFC7270],0,2014-04-04
|
|
93,dstTrafficIndex,unsigned32,identifier,current,BGP Policy Accounting Destination Traffic Index.,,,BGP policy accounting as described in [CCO-BGPPOL].,[RFC7270],0,2014-04-04
|
|
94,applicationDescription,string,default,current,Specifies the description of an application.,,,,[RFC6759],1,2014-02-03
|
|
95,applicationId,octetArray,default,current,Specifies an Application ID per [RFC6759].,,,See section 4 of [RFC6759] for the applicationId Information Element Specification.,[RFC6759],1,2014-02-03
|
|
96,applicationName,string,default,current,Specifies the name of an application.,,,,[RFC6759],0,2013-02-18
|
|
97,Assigned for NetFlow v9 compatibility,,,,,,,[RFC3954],[RFC5102],0,2013-02-18
|
|
98,postIpDiffServCodePoint,unsigned8,identifier,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'ipDiffServCodePoint', except
|
|
that it reports a potentially modified value caused by a
|
|
middlebox function after the packet passed the Observation
|
|
Point.",,0-63,"See [RFC3260] for the definition of the Differentiated
|
|
Services Field. See section 5.3.2 of [RFC1812] and
|
|
[RFC791] for the definition of the IPv4 TOS field. See
|
|
[RFC2460] for the definition of the IPv6 Traffic Class
|
|
field. See the IPFIX Information Model [RFC5102] for the
|
|
'ipDiffServCodePoint' specification.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
99,multicastReplicationFactor,unsigned32,quantity,current,"The amount of multicast replication that's applied to a traffic
|
|
stream.",,,"See [RFC1112] for the specification of reserved IPv4
|
|
multicast addresses. See [RFC4291] for the
|
|
specification of reserved IPv6 multicast addresses.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
100,className,string,,deprecated,"Deprecated in favor of 335 selectorName. Traffic Class Name,
|
|
associated with the classId Information Element.",,,,[RFC7270],0,2014-04-04
|
|
101,classificationEngineId,unsigned8,identifier,current,"A unique identifier for the engine that determined the
|
|
Selector ID. Thus, the Classification Engine ID defines
|
|
the context for the Selector ID. The Classification
|
|
Engine can be considered a specific registry for
|
|
application assignments.
|
|
|
|
|
|
|
|
|
|
Values for this field are listed in the Classification
|
|
Engine IDs registry. See
|
|
[http://www.iana.org/assignments/ipfix/ipfix.xml#classification-engine-ids]",,,,[RFC6759],0,2013-02-18
|
|
102,layer2packetSectionOffset,unsigned16,quantity,deprecated,"Deprecated in favor of 409 sectionOffset. Layer 2 packet
|
|
section offset. Potentially a generic packet section offset.",,,,[RFC7270],0,2014-04-04
|
|
103,layer2packetSectionSize,unsigned16,quantity,deprecated,"Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet
|
|
section size. Potentially a generic packet section size.",,,,[RFC7270],0,2014-04-04
|
|
104,layer2packetSectionData,octetArray,,deprecated,"Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet
|
|
section data.",,,,[RFC7270],0,2014-04-04
|
|
105-127,Assigned for NetFlow v9 compatibility,,,,,,,[RFC3954],[RFC5102],0,2013-02-18
|
|
128,bgpNextAdjacentAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the first AS in the AS
|
|
path to the destination IP address. The path is deduced
|
|
by looking up the destination IP address of the Flow in the
|
|
BGP routing information base. If AS path information for
|
|
this Flow is only available as an unordered AS set (and not
|
|
as an ordered AS sequence), then the value of this Information
|
|
Element is 0.",,,"See [RFC4271] for a description of BGP-4, and
|
|
see [RFC1930] for the definition of the AS
|
|
number.",[RFC5102],0,2013-02-18
|
|
129,bgpPrevAdjacentAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the last AS in the AS
|
|
path from the source IP address. The path is deduced
|
|
by looking up the source IP address of the Flow in the BGP
|
|
routing information base. If AS path information for this
|
|
Flow is only available as an unordered AS set (and not as
|
|
an ordered AS sequence), then the value of this Information
|
|
Element is 0. In case of BGP asymmetry, the
|
|
bgpPrevAdjacentAsNumber might not be able to report the correct
|
|
value.",,,"See [RFC4271] for a description of BGP-4, and
|
|
see [RFC1930] for the definition of the AS
|
|
number.",[RFC5102],0,2013-02-18
|
|
130,exporterIPv4Address,ipv4Address,default,current,"The IPv4 address used by the Exporting Process. This is used
|
|
by the Collector to identify the Exporter in cases where the
|
|
identity of the Exporter may have been obscured by the use of
|
|
a proxy.",,,,[RFC5102],1,2014-02-03
|
|
131,exporterIPv6Address,ipv6Address,default,current,"The IPv6 address used by the Exporting Process. This is used
|
|
by the Collector to identify the Exporter in cases where the
|
|
identity of the Exporter may have been obscured by the use of
|
|
a proxy.",,,,[RFC5102],1,2014-02-03
|
|
132,droppedOctetDeltaCount,unsigned64,deltaCounter,current,"The number of octets since the previous report (if any)
|
|
in packets of this Flow dropped by packet treatment.
|
|
The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
|
|
133,droppedPacketDeltaCount,unsigned64,deltaCounter,current,"The number of packets since the previous report (if any)
|
|
of this Flow dropped by packet treatment.",packets,,,[RFC5102],0,2013-02-18
|
|
134,droppedOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in packets of this Flow dropped
|
|
by packet treatment since the Metering Process
|
|
(re-)initialization for this Observation Point.
|
|
The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
|
|
135,droppedPacketTotalCount,unsigned64,totalCounter,current,"The number of packets of this Flow dropped by packet
|
|
treatment since the Metering Process
|
|
(re-)initialization for this Observation Point.",packets,,,[RFC5102],0,2013-02-18
|
|
136,flowEndReason,unsigned8,identifier,current,"The reason for Flow termination. The range of values includes
|
|
the following:
|
|
|
|
|
|
|
|
0x01: idle timeout
|
|
The Flow was terminated because it was considered to be
|
|
idle.
|
|
0x02: active timeout
|
|
The Flow was terminated for reporting purposes while it was
|
|
still active, for example, after the maximum lifetime of
|
|
unreported Flows was reached.
|
|
0x03: end of Flow detected
|
|
The Flow was terminated because the Metering Process
|
|
detected signals indicating the end of the Flow,
|
|
for example, the TCP FIN flag.
|
|
0x04: forced end
|
|
The Flow was terminated because of some external event,
|
|
for example, a shutdown of the Metering Process initiated
|
|
by a network management application.
|
|
0x05: lack of resources
|
|
The Flow was terminated because of lack of resources
|
|
available to the Metering Process and/or the Exporting
|
|
Process.",,,,[RFC5102],0,2013-02-18
|
|
137,commonPropertiesId,unsigned64,identifier,current,"An identifier of a set of common properties that is
|
|
unique per Observation Domain and Transport Session.
|
|
Typically, this Information Element is used to link to
|
|
information reported in separate Data Records.",,,,[RFC5102],0,2013-02-18
|
|
138,observationPointId,unsigned64,identifier,current,"An identifier of an Observation Point that is unique per
|
|
Observation Domain. It is RECOMMENDED that this identifier is
|
|
also unique per IPFIX Device. Typically, this Information
|
|
Element is used for limiting the scope of other Information
|
|
Elements.",,,,[RFC5102][ipfix-iana_at_cisco.com],1,2013-04-11
|
|
139,icmpTypeCodeIPv6,unsigned16,identifier,current,"Type and Code of the IPv6 ICMP message. The combination of
|
|
both values is reported as (ICMP type * 256) + ICMP code.",,,"See [RFC4443] for the definition of the IPv6
|
|
ICMP type and code fields.",[RFC5102],0,2013-02-18
|
|
140,mplsTopLabelIPv6Address,ipv6Address,default,current,"The IPv6 address of the system that the MPLS top label will
|
|
cause this Flow to be forwarded to.",,,"See [RFC3031] for the association between MPLS
|
|
labels and IP addresses.",[RFC5102],1,2014-02-03
|
|
141,lineCardId,unsigned32,identifier,current,"An identifier of a line card that is unique per IPFIX
|
|
Device hosting an Observation Point. Typically, this
|
|
Information Element is used for limiting the scope
|
|
of other Information Elements.",,,,[RFC5102],0,2013-02-18
|
|
142,portId,unsigned32,identifier,current,"An identifier of a line port that is unique per IPFIX
|
|
Device hosting an Observation Point. Typically, this
|
|
Information Element is used for limiting the scope
|
|
of other Information Elements.",,,,[RFC5102],0,2013-02-18
|
|
143,meteringProcessId,unsigned32,identifier,current,"An identifier of a Metering Process that is unique per
|
|
IPFIX Device. Typically, this Information Element is used
|
|
for limiting the scope of other Information Elements.
|
|
Note that process identifiers are typically assigned
|
|
dynamically.
|
|
The Metering Process may be re-started with a different ID.",,,,[RFC5102],0,2013-02-18
|
|
144,exportingProcessId,unsigned32,identifier,current,"An identifier of an Exporting Process that is unique per
|
|
IPFIX Device. Typically, this Information Element is used
|
|
for limiting the scope of other Information Elements.
|
|
Note that process identifiers are typically assigned
|
|
dynamically. The Exporting Process may be re-started
|
|
with a different ID.",,,,[RFC5102],0,2013-02-18
|
|
145,templateId,unsigned16,identifier,current,"An identifier of a Template that is locally unique within a
|
|
combination of a Transport session and an Observation Domain.
|
|
|
|
|
|
|
|
|
|
Template IDs 0-255 are reserved for Template Sets, Options
|
|
Template Sets, and other reserved Sets yet to be created.
|
|
Template IDs of Data Sets are numbered from 256 to 65535.
|
|
|
|
|
|
|
|
|
|
Typically, this Information Element is used for limiting
|
|
the scope of other Information Elements.
|
|
Note that after a re-start of the Exporting Process Template
|
|
identifiers may be re-assigned.",,,,[RFC5102],0,2013-02-18
|
|
146,wlanChannelId,unsigned8,identifier,current,The identifier of the 802.11 (Wi-Fi) channel used.,,,See IEEE.802-11.1999.,[RFC5102],0,2013-02-18
|
|
147,wlanSSID,string,default,current,"The Service Set IDentifier (SSID) identifying an 802.11
|
|
(Wi-Fi) network used. According to IEEE.802-11.1999, the
|
|
SSID is encoded into a string of up to 32 characters.",,,See IEEE.802-11.1999.,[RFC5102],0,2013-02-18
|
|
148,flowId,unsigned64,identifier,current,"An identifier of a Flow that is unique within an Observation
|
|
Domain. This Information Element can be used to distinguish
|
|
between different Flows if Flow Keys such as IP addresses and
|
|
port numbers are not reported or are reported in separate
|
|
records.",,,,[RFC5102],0,2013-02-18
|
|
149,observationDomainId,unsigned32,identifier,current,"An identifier of an Observation Domain that is locally
|
|
unique to an Exporting Process. The Exporting Process uses
|
|
the Observation Domain ID to uniquely identify to the
|
|
Collecting Process the Observation Domain where Flows
|
|
were metered. It is RECOMMENDED that this identifier is
|
|
also unique per IPFIX Device.
|
|
|
|
|
|
|
|
|
|
A value of 0 indicates that no specific Observation Domain
|
|
is identified by this Information Element.
|
|
|
|
|
|
|
|
|
|
Typically, this Information Element is used for limiting
|
|
the scope of other Information Elements.",,,,[RFC5102],0,2013-02-18
|
|
150,flowStartSeconds,dateTimeSeconds,default,current,The absolute timestamp of the first packet of this Flow.,seconds,,,[RFC5102],0,2013-02-18
|
|
151,flowEndSeconds,dateTimeSeconds,default,current,The absolute timestamp of the last packet of this Flow.,seconds,,,[RFC5102],0,2013-02-18
|
|
152,flowStartMilliseconds,dateTimeMilliseconds,default,current,The absolute timestamp of the first packet of this Flow.,milliseconds,,,[RFC5102],0,2013-02-18
|
|
153,flowEndMilliseconds,dateTimeMilliseconds,default,current,The absolute timestamp of the last packet of this Flow.,milliseconds,,,[RFC5102],0,2013-02-18
|
|
154,flowStartMicroseconds,dateTimeMicroseconds,default,current,The absolute timestamp of the first packet of this Flow.,microseconds,,,[RFC5102],0,2013-02-18
|
|
155,flowEndMicroseconds,dateTimeMicroseconds,default,current,The absolute timestamp of the last packet of this Flow.,microseconds,,,[RFC5102],0,2013-02-18
|
|
156,flowStartNanoseconds,dateTimeNanoseconds,default,current,The absolute timestamp of the first packet of this Flow.,nanoseconds,,,[RFC5102],0,2013-02-18
|
|
157,flowEndNanoseconds,dateTimeNanoseconds,default,current,The absolute timestamp of the last packet of this Flow.,nanoseconds,,,[RFC5102],0,2013-02-18
|
|
158,flowStartDeltaMicroseconds,unsigned32,,current,"This is a relative timestamp only valid within the scope
|
|
of a single IPFIX Message. It contains the negative time
|
|
offset of the first observed packet of this Flow relative
|
|
to the export time specified in the IPFIX Message Header.",microseconds,,"See the [IPFIX protocol
|
|
specification] for the definition of the IPFIX Message Header.",[RFC5102],0,2013-02-18
|
|
159,flowEndDeltaMicroseconds,unsigned32,,current,"This is a relative timestamp only valid within the scope
|
|
of a single IPFIX Message. It contains the negative time
|
|
offset of the last observed packet of this Flow relative
|
|
to the export time specified in the IPFIX Message Header.",microseconds,,"See the [IPFIX protocol
|
|
specification] for the definition of the IPFIX Message Header.",[RFC5102],0,2013-02-18
|
|
160,systemInitTimeMilliseconds,dateTimeMilliseconds,default,current,"The absolute timestamp of the last (re-)initialization of the
|
|
IPFIX Device.",milliseconds,,,[RFC5102],0,2013-02-18
|
|
161,flowDurationMilliseconds,unsigned32,,current,"The difference in time between the first observed packet
|
|
of this Flow and the last observed packet of this Flow.",milliseconds,,,[RFC5102],0,2013-02-18
|
|
162,flowDurationMicroseconds,unsigned32,,current,"The difference in time between the first observed packet
|
|
of this Flow and the last observed packet of this Flow.",microseconds,,,[RFC5102],0,2013-02-18
|
|
163,observedFlowTotalCount,unsigned64,totalCounter,current,"The total number of Flows observed in the Observation Domain
|
|
since the Metering Process (re-)initialization for this
|
|
Observation Point.",flows,,,[RFC5102],0,2013-02-18
|
|
164,ignoredPacketTotalCount,unsigned64,totalCounter,current,"The total number of observed IP packets that the
|
|
Metering Process did not process since the
|
|
(re-)initialization of the Metering Process.",packets,,,[RFC5102],0,2013-02-18
|
|
165,ignoredOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed IP packets
|
|
(including the IP header) that the Metering Process
|
|
did not process since the (re-)initialization of the
|
|
Metering Process.",octets,,,[RFC5102],0,2013-02-18
|
|
166,notSentFlowTotalCount,unsigned64,totalCounter,current,"The total number of Flow Records that were generated by the
|
|
Metering Process and dropped by the Metering Process or
|
|
by the Exporting Process instead of being sent to the
|
|
Collecting Process. There are several potential reasons for
|
|
this including resource shortage and special Flow export
|
|
policies.",flows,,,[RFC5102],0,2013-02-18
|
|
167,notSentPacketTotalCount,unsigned64,totalCounter,current,"The total number of packets in Flow Records that were
|
|
generated by the Metering Process and dropped
|
|
by the Metering Process or by the Exporting Process
|
|
instead of being sent to the Collecting Process.
|
|
There are several potential reasons for this including
|
|
resource shortage and special Flow export policies.",packets,,,[RFC5102],0,2013-02-18
|
|
168,notSentOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in packets in Flow Records
|
|
that were generated by the Metering Process and
|
|
dropped by the Metering Process or by the Exporting
|
|
Process instead of being sent to the Collecting Process.
|
|
There are several potential reasons for this including
|
|
resource shortage and special Flow export policies.",octets,,,[RFC5102],0,2013-02-18
|
|
169,destinationIPv6Prefix,ipv6Address,default,current,IPv6 destination address prefix.,,,,[RFC5102],0,2013-02-18
|
|
170,sourceIPv6Prefix,ipv6Address,default,current,IPv6 source address prefix.,,,,[RFC5102],0,2013-02-18
|
|
171,postOctetTotalCount,unsigned64,totalCounter,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'octetTotalCount', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",octets,,,[RFC5102],0,2013-02-18
|
|
172,postPacketTotalCount,unsigned64,totalCounter,current,"The definition of this Information Element is identical
|
|
to the definition of Information Element
|
|
'packetTotalCount', except that it reports a
|
|
potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",packets,,,[RFC5102],0,2013-02-18
|
|
173,flowKeyIndicator,unsigned64,flags,current,"This set of bit fields is used for marking the Information
|
|
Elements of a Data Record that serve as Flow Key. Each bit
|
|
represents an Information Element in the Data Record with
|
|
the n-th bit representing the n-th Information Element.
|
|
A bit set to value 1 indicates that the corresponding
|
|
Information Element is a Flow Key of the reported Flow.
|
|
A bit set to value 0 indicates that this is not the case.
|
|
|
|
|
|
|
|
|
|
If the Data Record contains more than 64 Information Elements,
|
|
the corresponding Template SHOULD be designed such that all
|
|
Flow Keys are among the first 64 Information Elements, because
|
|
the flowKeyIndicator only contains 64 bits. If the Data Record
|
|
contains less than 64 Information Elements, then the bits in
|
|
the flowKeyIndicator for which no corresponding Information
|
|
Element exists MUST have the value 0.",,,,[RFC5102],0,2013-02-18
|
|
174,postMCastPacketTotalCount,unsigned64,totalCounter,current,"The total number of outgoing multicast packets sent for
|
|
packets of this Flow by a multicast daemon within the
|
|
Observation Domain since the Metering Process
|
|
(re-)initialization. This property cannot necessarily
|
|
be observed at the Observation Point, but may be retrieved
|
|
by other means.",packets,,,[RFC5102],0,2013-02-18
|
|
175,postMCastOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in outgoing multicast packets
|
|
sent for packets of this Flow by a multicast daemon in the
|
|
Observation Domain since the Metering Process
|
|
(re-)initialization. This property cannot necessarily be
|
|
observed at the Observation Point, but may be retrieved by
|
|
other means.
|
|
The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
|
|
176,icmpTypeIPv4,unsigned8,identifier,current,Type of the IPv4 ICMP message.,,,"See [RFC792] for the definition of the IPv4
|
|
ICMP type field.",[RFC5102],0,2013-02-18
|
|
177,icmpCodeIPv4,unsigned8,identifier,current,Code of the IPv4 ICMP message.,,,"See [RFC792] for the definition of the IPv4
|
|
ICMP code field.",[RFC5102],0,2013-02-18
|
|
178,icmpTypeIPv6,unsigned8,identifier,current,Type of the IPv6 ICMP message.,,,"See [RFC4443] for the definition of the IPv6
|
|
ICMP type field.",[RFC5102],0,2013-02-18
|
|
179,icmpCodeIPv6,unsigned8,identifier,current,Code of the IPv6 ICMP message.,,,"See [RFC4443] for the definition of the IPv6
|
|
ICMP code field.",[RFC5102],0,2013-02-18
|
|
180,udpSourcePort,unsigned16,identifier,current,The source port identifier in the UDP header.,,,"See [RFC768] for the definition of the UDP
|
|
source port field.
|
|
Additional information on defined UDP port numbers can be found at
|
|
[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
181,udpDestinationPort,unsigned16,identifier,current,The destination port identifier in the UDP header.,,,"See [RFC768] for the definition of the UDP
|
|
destination port field.
|
|
Additional information on defined UDP port numbers can be found at
|
|
[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
182,tcpSourcePort,unsigned16,identifier,current,The source port identifier in the TCP header.,,,"See [RFC793] for the definition of the TCP
|
|
source port field.
|
|
Additional information on defined TCP port numbers can be found at
|
|
[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
183,tcpDestinationPort,unsigned16,identifier,current,The destination port identifier in the TCP header.,,,"See [RFC793] for the definition of the TCP
|
|
destination port field.
|
|
Additional information on defined TCP port numbers can be found at
|
|
[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
184,tcpSequenceNumber,unsigned32,,current,The sequence number in the TCP header.,,,"See [RFC793] for the definition of the TCP
|
|
sequence number.",[RFC5102],0,2013-02-18
|
|
185,tcpAcknowledgementNumber,unsigned32,,current,The acknowledgement number in the TCP header.,,,"See [RFC793] for the definition of the TCP
|
|
acknowledgement number.",[RFC5102],0,2013-02-18
|
|
186,tcpWindowSize,unsigned16,,current,"The window field in the TCP header.
|
|
If the TCP window scale is supported,
|
|
then TCP window scale must be known
|
|
to fully interpret the value of this information.",,,"See [RFC793] for the definition of the TCP
|
|
window field.
|
|
See [RFC1323] for the definition of the TCP
|
|
window scale.",[RFC5102],0,2013-02-18
|
|
187,tcpUrgentPointer,unsigned16,,current,The urgent pointer in the TCP header.,,,"See [RFC793] for the definition of the TCP
|
|
urgent pointer.",[RFC5102],0,2013-02-18
|
|
188,tcpHeaderLength,unsigned8,,current,"The length of the TCP header. Note that the value of this
|
|
Information Element is different from the value of the Data
|
|
Offset field in the TCP header. The Data Offset field
|
|
indicates the length of the TCP header in units of 4 octets.
|
|
This Information Elements specifies the length of the TCP
|
|
header in units of octets.",octets,,"See [RFC793] for the definition of the TCP
|
|
header.",[RFC5102],0,2013-02-18
|
|
189,ipHeaderLength,unsigned8,,current,"The length of the IP header. For IPv6, the value of this
|
|
Information Element is 40.",octets,,"See [RFC791] for the definition of the IPv4
|
|
header.
|
|
See [RFC2460] for the definition of the IPv6
|
|
header.",[RFC5102],0,2013-02-18
|
|
190,totalLengthIPv4,unsigned16,,current,The total length of the IPv4 packet.,octets,,"See [RFC791] for the specification of the IPv4
|
|
total length.",[RFC5102],0,2013-02-18
|
|
191,payloadLengthIPv6,unsigned16,,current,"This Information Element reports the value of the Payload
|
|
Length field in the IPv6 header. Note that IPv6 extension
|
|
headers belong to the payload. Also note that in case of a
|
|
jumbo payload option the value of the Payload Length field in
|
|
the IPv6 header is zero and so will be the value reported
|
|
by this Information Element.",octets,,"See [RFC2460] for the specification of the IPv6
|
|
payload length.
|
|
See [RFC2675] for the specification of the IPv6
|
|
jumbo payload option.",[RFC5102],0,2013-02-18
|
|
192,ipTTL,unsigned8,,current,"For IPv4, the value of the Information Element matches
|
|
the value of the Time to Live (TTL) field in the IPv4 packet
|
|
header. For IPv6, the value of the Information Element
|
|
matches the value of the Hop Limit field in the IPv6
|
|
packet header.",hops,,"See [RFC791] for the definition of the IPv4
|
|
Time to Live field.
|
|
See [RFC2675] for the definition of the IPv6
|
|
Hop Limit field.",[RFC5102],0,2013-02-18
|
|
193,nextHeaderIPv6,unsigned8,,current,"The value of the Next Header field of the IPv6 header.
|
|
The value identifies the type of the following IPv6
|
|
extension header or of the following IP payload.
|
|
Valid values are defined in the IANA
|
|
Protocol Numbers registry.",,,"See [RFC2460] for the definition of the IPv6
|
|
Next Header field.
|
|
See the list of protocol numbers assigned by IANA at [IANA registry protocol-numbers].",[RFC5102],0,2013-02-18
|
|
194,mplsPayloadLength,unsigned32,,current,The size of the MPLS packet without the label stack.,octets,,"See [RFC3031] for the specification of MPLS
|
|
packets.
|
|
See [RFC3032] for the specification of the
|
|
MPLS label stack.",[RFC5102],0,2013-02-18
|
|
195,ipDiffServCodePoint,unsigned8,identifier,current,"The value of a Differentiated Services Code Point (DSCP)
|
|
encoded in the Differentiated Services field. The
|
|
Differentiated Services field spans the most significant
|
|
6 bits of the IPv4 TOS field or the IPv6 Traffic Class
|
|
field, respectively.
|
|
|
|
|
|
|
|
|
|
This Information Element encodes only the 6 bits of the
|
|
Differentiated Services field. Therefore, its value may
|
|
range from 0 to 63.",,0-63,"See [RFC3260] for the definition of the
|
|
Differentiated Services field.
|
|
See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field.
|
|
See [RFC2460] for the definition of the IPv6
|
|
Traffic Class field.",[RFC5102],0,2013-02-18
|
|
196,ipPrecedence,unsigned8,identifier,current,"The value of the IP Precedence. The IP Precedence value
|
|
is encoded in the first 3 bits of the IPv4 TOS field
|
|
or the IPv6 Traffic Class field, respectively.
|
|
|
|
|
|
|
|
|
|
This Information Element encodes only these 3 bits.
|
|
Therefore, its value may range from 0 to 7.",,0-7,"See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of the IP Precedence.
|
|
See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field.
|
|
See [RFC2460] for the definition of the IPv6
|
|
Traffic Class field.",[RFC5102],0,2013-02-18
|
|
197,fragmentFlags,unsigned8,flags,current,"Fragmentation properties indicated by flags in the IPv4
|
|
packet header or the IPv6 Fragment header, respectively.
|
|
|
|
|
|
|
|
|
|
Bit 0: (RS) Reserved.
|
|
The value of this bit MUST be 0 until specified
|
|
otherwise.
|
|
Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment.
|
|
Corresponds to the value of the DF flag in the
|
|
IPv4 header. Will always be 0 for IPv6 unless
|
|
a ""don't fragment"" feature is introduced to IPv6.
|
|
Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments.
|
|
Corresponds to the MF flag in the IPv4 header
|
|
or to the M flag in the IPv6 Fragment header,
|
|
respectively. The value is 0 for IPv6 if there
|
|
is no fragment header.
|
|
Bits 3-7: (DC) Don't Care.
|
|
The values of these bits are irrelevant.
|
|
|
|
0 1 2 3 4 5 6 7
|
|
+---+---+---+---+---+---+---+---+
|
|
| R | D | M | D | D | D | D | D |
|
|
| S | F | F | C | C | C | C | C |
|
|
+---+---+---+---+---+---+---+---+",,,"See [RFC791] for the specification of the IPv4
|
|
fragment flags.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 Fragment header.",[RFC5102],0,2013-02-18
|
|
198,octetDeltaSumOfSquares,unsigned64,,current,"The sum of the squared numbers of octets per incoming
|
|
packet since the previous report (if any) for this
|
|
Flow at the Observation Point.
|
|
The number of octets includes IP header(s) and IP payload.",,,,[RFC5102],0,2013-02-18
|
|
199,octetTotalSumOfSquares,unsigned64,,current,"The total sum of the squared numbers of octets in incoming
|
|
packets for this Flow at the Observation Point since the
|
|
Metering Process (re-)initialization for this Observation
|
|
Point. The number of octets includes IP header(s) and IP
|
|
payload.",octets,,,[RFC5102],0,2013-02-18
|
|
200,mplsTopLabelTTL,unsigned8,,current,"The TTL field from the top MPLS label stack entry,
|
|
i.e., the last label that was pushed.",hops,,"See [RFC3032] for the specification of the TTL
|
|
field.",[RFC5102],0,2013-02-18
|
|
201,mplsLabelStackLength,unsigned32,,current,The length of the MPLS label stack in units of octets.,octets,,"See [RFC3032] for the specification of the
|
|
MPLS label stack.",[RFC5102],0,2013-02-18
|
|
202,mplsLabelStackDepth,unsigned32,,current,The number of labels in the MPLS label stack.,label stack entries,,"See [RFC3032] for the specification of the
|
|
MPLS label stack.",[RFC5102],0,2013-02-18
|
|
203,mplsTopLabelExp,unsigned8,flags,current,"The Exp field from the top MPLS label stack entry,
|
|
i.e., the last label that was pushed.
|
|
|
|
|
|
|
|
Bits 0-4: Don't Care, value is irrelevant.
|
|
Bits 5-7: MPLS Exp field.
|
|
|
|
0 1 2 3 4 5 6 7
|
|
+---+---+---+---+---+---+---+---+
|
|
| don't care | Exp |
|
|
+---+---+---+---+---+---+---+---+",,,"See [RFC3032] for the specification of the
|
|
Exp field.
|
|
See [RFC3270] for usage of the Exp field.",[RFC5102],0,2013-02-18
|
|
204,ipPayloadLength,unsigned32,,current,"The effective length of the IP payload.
|
|
|
|
|
|
|
|
|
|
For IPv4 packets, the value of this Information Element is
|
|
the difference between the total length of the IPv4 packet
|
|
(as reported by Information Element totalLengthIPv4) and the
|
|
length of the IPv4 header (as reported by Information Element
|
|
headerLengthIPv4).
|
|
|
|
|
|
|
|
|
|
For IPv6, the value of the Payload Length field
|
|
in the IPv6 header is reported except in the case that
|
|
the value of this field is zero and that there is a valid
|
|
jumbo payload option. In this case, the value of the
|
|
Jumbo Payload Length field in the jumbo payload option
|
|
is reported.",octets,,"See [RFC791] for the specification of IPv4
|
|
packets.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 payload length.
|
|
See [RFC2675] for the specification of the
|
|
IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
|
|
205,udpMessageLength,unsigned16,,current,The value of the Length field in the UDP header.,octets,,"See [RFC768] for the specification of the UDP
|
|
header.",[RFC5102],0,2013-02-18
|
|
206,isMulticast,unsigned8,flags,current,"If the IP destination address is not a reserved multicast
|
|
address, then the value of all bits of the octet (including
|
|
the reserved ones) is zero.
|
|
|
|
|
|
|
|
|
|
The first bit of this octet is set to 1 if the Version
|
|
field of the IP header has the value 4 and if the
|
|
Destination Address field contains a reserved multicast
|
|
address in the range from 224.0.0.0 to 239.255.255.255.
|
|
Otherwise, this bit is set to 0.
|
|
|
|
|
|
|
|
|
|
The second and third bits of this octet are reserved for
|
|
future use.
|
|
|
|
|
|
|
|
|
|
The remaining bits of the octet are only set to values
|
|
other than zero if the IP Destination Address is a
|
|
reserved IPv6 multicast address. Then the fourth bit
|
|
of the octet is set to the value of the T flag in the
|
|
IPv6 multicast address and the remaining four bits are
|
|
set to the value of the scope field in the IPv6
|
|
multicast address.
|
|
|
|
|
|
|
|
0 1 2 3 4 5 6 7
|
|
+------+------+------+------+------+------+------+------+
|
|
| IPv6 multicast scope | T | RES. | RES. | MCv4 |
|
|
+------+------+------+------+------+------+------+------+
|
|
|
|
Bits 0-3: set to value of multicast scope if IPv6 multicast
|
|
Bit 4: set to value of T flag, if IPv6 multicast
|
|
Bits 5-6: reserved for future use
|
|
Bit 7: set to 1 if IPv4 multicast",,,"See [RFC1112] for the specification of
|
|
reserved IPv4 multicast addresses.
|
|
See [RFC4291] for the specification of
|
|
reserved IPv6 multicast addresses and the definition of the T flag and
|
|
the IPv6 multicast scope.
|
|
The diagram provided in [RFC5102] is incorrect.
|
|
The diagram in this registry is taken from Errata 1736. See [RFC Errata
|
|
1736]",[RFC5102],0,2013-02-18
|
|
207,ipv4IHL,unsigned8,,current,"The value of the Internet Header Length (IHL) field in
|
|
the IPv4 header. It specifies the length of the header
|
|
in units of 4 octets. Please note that its unit is
|
|
different from most of the other Information Elements
|
|
reporting length values.",4 octets,,"See [RFC791] for the specification of the IPv4
|
|
header.",[RFC5102],0,2013-02-18
|
|
208,ipv4Options,unsigned32,flags,current,"IPv4 options in packets of this Flow.
|
|
The information is encoded in a set of bit fields. For
|
|
each valid IPv4 option type, there is a bit in this set.
|
|
The bit is set to 1 if any observed packet of this Flow
|
|
contains the corresponding IPv4 option type. Otherwise,
|
|
if no observed packet of this Flow contained the
|
|
respective IPv4 option type, the value of the
|
|
corresponding bit is 0.
|
|
|
|
|
|
|
|
|
|
The list of valid IPv4 options is maintained by IANA.
|
|
Note that for identifying an option not just the 5-bit
|
|
Option Number, but all 8 bits of the Option Type need to
|
|
match one of the IPv4 options specified at
|
|
http://www.iana.org/assignments/ip-parameters.
|
|
|
|
|
|
|
|
|
|
Options are mapped to bits according to their option numbers.
|
|
Option number X is mapped to bit X.
|
|
The mapping is illustrated by the figure below.
|
|
|
|
|
|
|
|
0 1 2 3 4 5 6 7
|
|
+------+------+------+------+------+------+------+------+
|
|
... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL |
|
|
+------+------+------+------+------+------+------+------+
|
|
|
|
8 9 10 11 12 13 14 15
|
|
+------+------+------+------+------+------+------+------+
|
|
... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ...
|
|
+------+------+------+------+------+------+------+------+
|
|
|
|
16 17 18 19 20 21 22 23
|
|
+------+------+------+------+------+------+------+------+
|
|
... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ...
|
|
+------+------+------+------+------+------+------+------+
|
|
|
|
24 25 26 27 28 29 30 31
|
|
+------+------+------+------+------+------+------+------+
|
|
| | EXP | to be assigned by IANA | QS | UMP | ...
|
|
+------+------+------+------+------+------+------+------+
|
|
|
|
Type Option
|
|
Bit Value Name Reference
|
|
---+-----+-------+------------------------------------
|
|
0 7 RR Record Route, RFC 791
|
|
1 134 CIPSO Commercial Security
|
|
2 133 E-SEC Extended Security, RFC 1108
|
|
3 68 TS Time Stamp, RFC 791
|
|
4 131 LSR Loose Source Route, RFC791
|
|
5 130 SEC Security, RFC 1108
|
|
6 1 NOP No Operation, RFC 791
|
|
7 0 EOOL End of Options List, RFC 791
|
|
8 15 ENCODE
|
|
9 142 VISA Experimental Access Control
|
|
10 205 FINN Experimental Flow Control
|
|
11 12 MTUR (obsoleted) MTU Reply, RFC 1191
|
|
12 11 MTUP (obsoleted) MTU Probe, RFC 1191
|
|
13 10 ZSU Experimental Measurement
|
|
14 137 SSR Strict Source Route, RFC 791
|
|
15 136 SID Stream ID, RFC 791
|
|
16 151 DPS Dynamic Packet State
|
|
17 150 NSAPA NSAP Address
|
|
18 149 SDB Selective Directed Broadcast
|
|
19 147 ADDEXT Address Extension
|
|
20 148 RTRALT Router Alert, RFC 2113
|
|
21 82 TR Traceroute, RFC 3193
|
|
22 145 EIP Extended Internet Protocol, RFC 1385
|
|
23 144 IMITD IMI Traffic Descriptor
|
|
25 30 EXP RFC3692-style Experiment
|
|
25 94 EXP RFC3692-style Experiment
|
|
25 158 EXP RFC3692-style Experiment
|
|
25 222 EXP RFC3692-style Experiment
|
|
30 25 QS Quick-Start
|
|
31 152 UMP Upstream Multicast Pkt.
|
|
... ... ... Further options numbers
|
|
may be assigned by IANA",,,"See [RFC791] for the definition of IPv4
|
|
options.
|
|
See the list of IPv4 option numbers assigned by IANA at [IANA registry ip-parameters].
|
|
The diagram provided in [RFC5102] is incorrect.
|
|
The diagram in this registry is taken from Errata 1737. See [RFC Errata
|
|
1737]",[RFC5102],0,2013-02-18
|
|
209,tcpOptions,unsigned64,flags,current,"TCP options in packets of this Flow.
|
|
The information is encoded in a set of bit fields. For
|
|
each TCP option, there is a bit in this set.
|
|
The bit is set to 1 if any observed packet of this Flow
|
|
contains the corresponding TCP option.
|
|
Otherwise, if no observed packet of this Flow contained
|
|
the respective TCP option, the value of the
|
|
corresponding bit is 0.
|
|
|
|
|
|
|
|
|
|
Options are mapped to bits according to their option
|
|
numbers. Option number X is mapped to bit X.
|
|
TCP option numbers are maintained by IANA.
|
|
|
|
|
|
|
|
0 1 2 3 4 5 6 7
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
| 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ...
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
|
|
8 9 10 11 12 13 14 15
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
... | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 |...
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
|
|
16 17 18 19 20 21 22 23
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
... | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 |...
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
|
|
. . .
|
|
|
|
56 57 58 59 60 61 62 63
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+
|
|
... | 63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 |
|
|
+-----+-----+-----+-----+-----+-----+-----+-----+",,,"See [RFC793] for the definition of TCP
|
|
options.
|
|
See the list of TCP option numbers assigned by IANA at [IANA registry tcp-parameters].
|
|
The diagram provided in [RFC5102] is incorrect.
|
|
The diagram in this registry is taken from Errata 1739. See [RFC Errata
|
|
1739]",[RFC5102],0,2013-02-18
|
|
210,paddingOctets,octetArray,default,current,"The value of this Information Element is always a sequence of
|
|
0x00 values.",,,,[RFC5102],0,2013-02-18
|
|
211,collectorIPv4Address,ipv4Address,default,current,"An IPv4 address to which the Exporting Process sends Flow
|
|
information.",,,,[RFC5102],1,2014-02-03
|
|
212,collectorIPv6Address,ipv6Address,default,current,"An IPv6 address to which the Exporting Process sends Flow
|
|
information.",,,,[RFC5102],1,2014-02-03
|
|
213,exportInterface,unsigned32,identifier,current,"The index of the interface from which IPFIX Messages sent
|
|
by the Exporting Process to a Collector leave the IPFIX
|
|
Device. The value matches the value of
|
|
managed object 'ifIndex' as defined in [RFC2863].
|
|
Note that ifIndex values are not assigned statically to an
|
|
interface and that the interfaces may be renumbered every
|
|
time the device's management system is re-initialized, as
|
|
specified in [RFC2863].",,,"See [RFC2863] for the definition of the
|
|
ifIndex object.",[RFC5102],0,2013-02-18
|
|
214,exportProtocolVersion,unsigned8,identifier,current,"The protocol version used by the Exporting Process for
|
|
sending Flow information. The protocol version is given
|
|
by the value of the Version Number field in the Message
|
|
Header.
|
|
|
|
|
|
|
|
|
|
The protocol version is 10 for IPFIX and 9 for NetFlow
|
|
version 9.
|
|
A value of 0 indicates that no export protocol is in use.",,,"See the [IPFIX protocol
|
|
specification] for the definition of the IPFIX Message Header.
|
|
See [RFC3954] for the definition of the
|
|
NetFlow version 9 message header.",[RFC5102],0,2013-02-18
|
|
215,exportTransportProtocol,unsigned8,identifier,current,"The value of the protocol number used by the Exporting Process
|
|
for sending Flow information.
|
|
The protocol number identifies the IP packet payload type.
|
|
Protocol numbers are defined in the IANA Protocol Numbers
|
|
registry.
|
|
|
|
|
|
|
|
|
|
In Internet Protocol version 4 (IPv4), this is carried in the
|
|
Protocol field. In Internet Protocol version 6 (IPv6), this
|
|
is carried in the Next Header field in the last extension
|
|
header of the packet.",,,"See [RFC791] for the specification of the IPv4
|
|
protocol field.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 protocol field.
|
|
See the list of protocol numbers assigned by IANA at [IANA registry protocol-numbers].",[RFC5102],0,2013-02-18
|
|
216,collectorTransportPort,unsigned16,identifier,current,"The destination port identifier to which the Exporting
|
|
Process sends Flow information. For the transport protocols
|
|
UDP, TCP, and SCTP, this is the destination port number.
|
|
This field MAY also be used for future transport protocols
|
|
that have 16-bit source port identifiers.",,,"See [RFC768] for the definition of the UDP
|
|
destination port field.
|
|
See [RFC793] for the definition of the TCP
|
|
destination port field.
|
|
See [RFC4960] for the definition of SCTP.
|
|
|
|
|
|
|
|
|
|
Additional information on defined UDP and TCP port numbers can be
|
|
found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
217,exporterTransportPort,unsigned16,identifier,current,"The source port identifier from which the Exporting
|
|
Process sends Flow information. For the transport protocols
|
|
UDP, TCP, and SCTP, this is the source port number.
|
|
This field MAY also be used for future transport protocols
|
|
that have 16-bit source port identifiers. This field may
|
|
be useful for distinguishing multiple Exporting Processes
|
|
that use the same IP address.",,,"See [RFC768] for the definition of the UDP
|
|
source port field.
|
|
See [RFC793] for the definition of the TCP
|
|
source port field.
|
|
See [RFC4960] for the definition of SCTP.
|
|
|
|
|
|
|
|
|
|
Additional information on defined UDP and TCP port numbers can be
|
|
found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
|
|
218,tcpSynTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
|
|
TCP ""Synchronize sequence numbers"" (SYN) flag set.",packets,,"See [RFC793] for the definition of the TCP SYN
|
|
flag.",[RFC5102],0,2013-02-18
|
|
219,tcpFinTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
|
|
TCP ""No more data from sender"" (FIN) flag set.",packets,,"See [RFC793] for the definition of the TCP FIN
|
|
flag.",[RFC5102],0,2013-02-18
|
|
220,tcpRstTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
|
|
TCP ""Reset the connection"" (RST) flag set.",packets,,"See [RFC793] for the definition of the TCP RST
|
|
flag.",[RFC5102],0,2013-02-18
|
|
221,tcpPshTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
|
|
TCP ""Push Function"" (PSH) flag set.",packets,,"See [RFC793] for the definition of the TCP PSH
|
|
flag.",[RFC5102],0,2013-02-18
|
|
222,tcpAckTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
|
|
TCP ""Acknowledgment field significant"" (ACK) flag set.",packets,,"See [RFC793] for the definition of the TCP ACK
|
|
flag.",[RFC5102],0,2013-02-18
|
|
223,tcpUrgTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
|
|
TCP ""Urgent Pointer field significant"" (URG) flag set.",packets,,"See [RFC793] for the definition of the TCP URG
|
|
flag.",[RFC5102],0,2013-02-18
|
|
224,ipTotalLength,unsigned64,,current,The total length of the IP packet.,octets,,"See [RFC791] for the specification of the IPv4
|
|
total length.
|
|
See [RFC2460] for the specification of the
|
|
IPv6 payload length.
|
|
See [RFC2675] for the specification of the
|
|
IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
|
|
225,postNATSourceIPv4Address,ipv4Address,default,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'sourceIPv4Address', except
|
|
that it reports a modified value caused by a NAT middlebox
|
|
function after the packet passed the Observation Point.",,,"See [RFC791] for the definition of the IPv4 source
|
|
address field. See [RFC3022] for the definition of
|
|
NAT. See [RFC3234] for the definition of middleboxes.",[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
226,postNATDestinationIPv4Address,ipv4Address,default,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'destinationIPv4Address',
|
|
except that it reports a modified value caused by a NAT
|
|
middlebox function after the packet passed the Observation
|
|
Point.",,,"See [RFC791] for the definition of the IPv4 destination
|
|
address field. See [RFC3022] for the definition of
|
|
NAT. See [RFC3234] for the definition of middleboxes.",[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
227,postNAPTSourceTransportPort,unsigned16,identifier,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'sourceTransportPort', except
|
|
that it reports a modified value caused by a Network Address
|
|
Port Translation (NAPT) middlebox function after the packet
|
|
passed the Observation Point.",,,"See [RFC768] for the definition of the UDP source port
|
|
field. See [RFC793] for the definition of the TCP
|
|
source port field. See [RFC4960] for the definition of
|
|
SCTP.
|
|
See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes.
|
|
Additional information on defined UDP and TCP port numbers can
|
|
be found at http://www.iana.org/assignments/port-numbers.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
228,postNAPTDestinationTransportPort,unsigned16,identifier,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'destinationTransportPort',
|
|
except that it reports a modified value caused by a Network
|
|
Address Port Translation (NAPT) middlebox function after the
|
|
packet passed the Observation Point.",,,"See [RFC768] for the definition of the UDP source port
|
|
field. See [RFC793] for the definition of the TCP
|
|
source port field. See [RFC4960] for the definition of
|
|
SCTP.
|
|
See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes.
|
|
Additional information on defined UDP and TCP port numbers can
|
|
be found at [IANA registry service-names-port-numbers].",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
229,natOriginatingAddressRealm,unsigned8,identifier,current,"Indicates whether the session was created because traffic
|
|
originated in the private or public address realm.
|
|
postNATSourceIPv4Address, postNATDestinationIPv4Address,
|
|
postNAPTSourceTransportPort, and
|
|
postNAPTDestinationTransportPort are qualified with the address
|
|
realm in perspective.
|
|
|
|
|
|
|
|
|
|
The allowed values are:
|
|
|
|
|
|
|
|
|
|
Private: 1
|
|
|
|
|
|
|
|
|
|
Public: 2",,1-2,See [RFC3022] for the definition of NAT.,[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
230,natEvent,unsigned8,identifier,current,"Indicates a NAT event. The allowed values are:
|
|
|
|
|
|
|
|
|
|
1 - Create event.
|
|
|
|
|
|
|
|
|
|
2 - Delete event.
|
|
|
|
|
|
|
|
|
|
3 - Pool exhausted.
|
|
|
|
|
|
|
|
|
|
A Create event is generated when a NAT translation is created,
|
|
whether dynamically or statically. A Delete event is generated
|
|
when a NAT translation is deleted.",,1-2,See [RFC3022] for the definition of NAT.,[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
231,initiatorOctets,unsigned64,deltaCounter,current,"The total number of layer 4 payload bytes in a flow from the
|
|
initiator. The initiator is the device which triggered the
|
|
session creation, and remains the same for the life of the
|
|
session.",octets,,"See #298, initiatorPackets.",[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
232,responderOctets,unsigned64,deltaCounter,current,"The total number of layer 4 payload bytes in a flow from the
|
|
responder. The responder is the device which replies to the
|
|
initiator, and remains the same for the life of the session.",octets,,"See #299, responderPackets.",[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
233,firewallEvent,unsigned8,,current,"Indicates a firewall event. The allowed values are:
|
|
|
|
|
|
|
|
|
|
0 - Ignore (invalid)
|
|
|
|
|
|
|
|
|
|
1 - Flow Created
|
|
|
|
|
|
|
|
|
|
2 - Flow Deleted
|
|
|
|
|
|
|
|
|
|
3 - Flow Denied
|
|
|
|
|
|
|
|
|
|
4 - Flow Alert
|
|
|
|
|
|
|
|
|
|
5 - Flow Update",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
234,ingressVRFID,unsigned32,,current,"An unique identifier of the VRFname where the packets of this
|
|
flow are being received. This identifier is unique per Metering
|
|
Process",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
235,egressVRFID,unsigned32,,current,"An unique identifier of the VRFname where the packets of this
|
|
flow are being sent. This identifier is unique per Metering
|
|
Process",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
236,VRFname,string,default,current,The name of a VPN Routing and Forwarding table (VRF).,,,See [RFC4364] for the definition of VRF.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
237,postMplsTopLabelExp,unsigned8,flags,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'mplsTopLabelExp', except
|
|
that it reports a potentially modified value caused by a
|
|
middlebox function after the packet passed the Observation
|
|
Point.",,,"See [RFC3032] for the specification of the Exp
|
|
field.
|
|
See [RFC3270] for usage of the Exp field.",[RFC5102],0,2013-02-18
|
|
238,tcpWindowScale,unsigned16,,current,The scale of the window field in the TCP header.,,,"See [RFC1323] for the definition of the TCP
|
|
window scale.",[RFC5102],0,2013-02-18
|
|
239,biflowDirection,unsigned8,identifier,current,"A description of the direction assignment method used to
|
|
assign the Biflow Source and Destination. This Information Element
|
|
MAY be present in a Flow Data Record, or applied to all flows exported
|
|
from an Exporting Process or Observation Domain using IPFIX Options.
|
|
If this Information Element is not present in a Flow Record or
|
|
associated with a Biflow via scope, it is assumed that the
|
|
configuration of the direction assignment method is done out-of-band.
|
|
Note that when using IPFIX Options to apply this Information Element
|
|
to all flows within an Observation Domain or from an Exporting
|
|
Process, the Option SHOULD be sent reliably. If reliable transport is
|
|
not available (i.e., when using UDP), this Information Element SHOULD
|
|
appear in each Flow Record. This field may take the following
|
|
values:
|
|
|
|
|
|
+-------+------------------+----------------------------------------+
|
|
| Value | Name | Description |
|
|
+-------+------------------+----------------------------------------+
|
|
| 0x00 | arbitrary | Direction was assigned arbitrarily. |
|
|
| 0x01 | initiator | The Biflow Source is the flow |
|
|
| | | initiator, as determined by the |
|
|
| | | Metering Process' best effort to |
|
|
| | | detect the initiator. |
|
|
| 0x02 | reverseInitiator | The Biflow Destination is the flow |
|
|
| | | initiator, as determined by the |
|
|
| | | Metering Process' best effort to |
|
|
| | | detect the initiator. This value is |
|
|
| | | provided for the convenience of |
|
|
| | | Exporting Processes to revise an |
|
|
| | | initiator estimate without re-encoding |
|
|
| | | the Biflow Record. |
|
|
| 0x03 | perimeter | The Biflow Source is the endpoint |
|
|
| | | outside of a defined perimeter. The |
|
|
| | | perimeter's definition is implicit in |
|
|
| | | the set of Biflow Source and Biflow |
|
|
| | | Destination addresses exported in the |
|
|
| | | Biflow Records. |
|
|
+-------+------------------+----------------------------------------+",,,,[RFC5103],0,2013-02-18
|
|
240,ethernetHeaderLength,unsigned8,quantity,current,"The difference between the length of an Ethernet frame (minus the
|
|
FCS) and the length of its MAC Client Data section (including any
|
|
padding) as defined in section 3.1 of [IEEE.802-3.2005]. It does
|
|
not include the Preamble, SFD and Extension field lengths.",octets,,[IEEE.802-3.2005],[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
241,ethernetPayloadLength,unsigned16,quantity,current,"The length of the MAC Client Data section (including any padding)
|
|
of a frame as defined in section 3.1 of [IEEE.802-3.2005].",octets,,[IEEE.802-3.2005],[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
242,ethernetTotalLength,unsigned16,quantity,current,"The total length of the Ethernet frame (excluding the Preamble,
|
|
SFD, Extension and FCS fields) as described in section 3.1 of
|
|
[IEEE.802-3.2005].",octets,,[IEEE.802-3.2005],[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
243,dot1qVlanId,unsigned16,identifier,current,"The value of the 12-bit VLAN Identifier portion of the Tag Control
|
|
Information field of an Ethernet frame. The structure and
|
|
semantics within the Tag Control Information field are defined in
|
|
[IEEE802.1Q]. In Provider Bridged Networks, it represents the
|
|
Service VLAN identifier in the Service VLAN Tag (S-TAG) Tag
|
|
Control Information (TCI) field or the Customer VLAN identifier in
|
|
the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field
|
|
as described in [IEEE802.1Q]. In Provider Backbone Bridged
|
|
Networks, it represents the Backbone VLAN identifier in the
|
|
Backbone VLAN Tag (B-TAG) Tag Control Information (TCI) field as
|
|
described in [IEEE802.1Q]. In a virtual link between a host
|
|
system and EVB bridge, it represents the Service VLAN identifier
|
|
indicating S-channel as described in [IEEE802.1Qbg].
|
|
|
|
|
|
|
|
|
|
In the case of a multi-tagged frame, it represents the outer tag's
|
|
VLAN identifier, except for I-TAG.",,,[IEEE802.1Q][IEEE802.1Qbg],[ipfix-iana_at_cisco.com][RFC7133],2,2014-01-11
|
|
244,dot1qPriority,unsigned8,identifier,current,"The value of the 3-bit User Priority portion of the Tag Control
|
|
Information field of an Ethernet frame. The structure and
|
|
semantics within the Tag Control Information field are defined in
|
|
[IEEE802.1Q]. In the case of multi-tagged frame, it represents
|
|
the 3-bit Priority Code Point (PCP) portion of the outer tag's Tag
|
|
Control Information (TCI) field as described in [IEEE802.1Q],
|
|
except for I-TAG.",,,[IEEE802.1Q],[ipfix-iana_at_cisco.com][RFC7133],1,2014-01-11
|
|
245,dot1qCustomerVlanId,unsigned16,identifier,current,"The value represents the Customer VLAN identifier in the Customer
|
|
VLAN Tag (C-TAG) Tag Control Information (TCI) field as described
|
|
in [IEEE802.1Q].",,,[IEEE802.1Q],[ipfix-iana_at_cisco.com][RFC7133],1,2014-01-11
|
|
246,dot1qCustomerPriority,unsigned8,identifier,current,"The value represents the 3-bit Priority Code Point (PCP) portion
|
|
of the Customer VLAN Tag (C-TAG) Tag Control Information (TCI)
|
|
field as described in [IEEE802.1Q].",,,[IEEE802.1Q],[ipfix-iana_at_cisco.com][RFC7133],1,2014-01-11
|
|
247,metroEvcId,string,default,current,"The EVC Service Attribute which uniquely identifies the Ethernet
|
|
Virtual Connection (EVC) within a Metro Ethernet Network, as
|
|
defined in section 6.2 of MEF 10.1. The MetroEVCID is encoded in
|
|
a string of up to 100 characters.",,,"MEF 10.1 (Ethernet Services Attributes Phase 2)
|
|
MEF16 (Ethernet Local Management Interface)",[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
248,metroEvcType,unsigned8,identifier,current,"The 3-bit EVC Service Attribute which identifies the type of
|
|
service provided by an EVC.",,,"MEF 10.1 (Ethernet Services Attributes Phase 2)
|
|
MEF16 (Ethernet Local Management Interface)",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
249,pseudoWireId,unsigned32,identifier,current,"A 32-bit non-zero connection identifier, which together with the
|
|
pseudoWireType, identifies the Pseudo Wire (PW) as defined in [RFC4447].",,,See [RFC4447] for pseudowire definitions.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
250,pseudoWireType,unsigned16,identifier,current,"The value of this information element identifies the type of MPLS
|
|
Pseudo Wire (PW) as defined in [RFC4446].",,,"See [RFC4446] for the pseudowire type definition, and
|
|
http://www.iana.org/assignments/pwe3-parameters for the IANA
|
|
Pseudowire Types Registry.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
251,pseudoWireControlWord,unsigned32,identifier,current,"The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as
|
|
defined in Section 3 of [RFC4385].",,,"See [RFC4385] for the Pseudo Wire Control Word
|
|
definition.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
252,ingressPhysicalInterface,unsigned32,identifier,current,"The index of a networking device's physical interface (example, a
|
|
switch port) where packets of this flow are being received.",,,See [RFC2863] for the definition of the ifIndex object.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
253,egressPhysicalInterface,unsigned32,identifier,current,"The index of a networking device's physical interface (example, a
|
|
switch port) where packets of this flow are being sent.",,,See [RFC2863] for the definition of the ifIndex object.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
254,postDot1qVlanId,unsigned16,identifier,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'dot1qVlanId', except that it
|
|
reports a potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",,,"[IEEE.802-3.2005]
|
|
[IEEE.802-1ad.2005]",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
255,postDot1qCustomerVlanId,unsigned16,identifier,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'dot1qCustomerVlanId', except
|
|
that it reports a potentially modified value caused by a
|
|
middlebox function after the packet passed the Observation Point.",,,"[IEEE.802-1ad.2005]
|
|
[IEEE.802-1Q.2003]",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
256,ethernetType,unsigned16,identifier,current,"The Ethernet type field of an Ethernet frame that identifies the
|
|
MAC client protocol carried in the payload as defined in
|
|
paragraph 1.4.349 of [IEEE.802-3.2005].",,,"[IEEE.802-3.2005]
|
|
Ethertype registry available at
|
|
[http://standards.ieee.org/regauth/ethertype/eth.txt]",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
257,postIpPrecedence,unsigned8,identifier,current,"The definition of this Information Element is identical to the
|
|
definition of Information Element 'ipPrecedence', except that
|
|
it reports a potentially modified value caused by a middlebox
|
|
function after the packet passed the Observation Point.",,0-7,"See [RFC1812] (Section 5.3.3) and
|
|
[RFC791] for the definition of the
|
|
IP Precedence. See [RFC1812]
|
|
(Section 5.3.2) and [RFC791] for the
|
|
definition of the IPv4 TOS field. See
|
|
[RFC2460] for the definition of the
|
|
IPv6 Traffic Class field.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
258,collectionTimeMilliseconds,dateTimeMilliseconds,default,current,"The absolute timestamp at which the data within the
|
|
scope containing this Information Element was received by a
|
|
Collecting Process. This Information Element SHOULD be bound to
|
|
its containing IPFIX Message via IPFIX Options and the
|
|
messageScope Information Element, as defined below.",milliseconds,,,"[RFC5655][RFC Errata
|
|
3559]",1,2013-03-26
|
|
259,exportSctpStreamId,unsigned16,identifier,current,"The value of the SCTP Stream Identifier used by the
|
|
Exporting Process for exporting IPFIX Message data. This is
|
|
carried in the Stream Identifier field of the header of the SCTP
|
|
DATA chunk containing the IPFIX Message(s).",,,,[RFC5655],0,2013-02-18
|
|
260,maxExportSeconds,dateTimeSeconds,default,current,"The absolute Export Time of the latest IPFIX Message
|
|
within the scope containing this Information Element. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via IPFIX Options and the sessionScope
|
|
Information Element.",seconds,,,[RFC5655],0,2013-02-18
|
|
261,maxFlowEndSeconds,dateTimeSeconds,default,current,"The latest absolute timestamp of the last packet
|
|
within any Flow within the scope containing this Information
|
|
Element, rounded up to the second if necessary. This Information
|
|
Element SHOULD be bound to its containing IPFIX Transport Session
|
|
via IPFIX Options and the sessionScope Information Element.",seconds,,,[RFC5655],0,2013-02-18
|
|
262,messageMD5Checksum,octetArray,default,current,"The MD5 checksum of the IPFIX Message containing this
|
|
record. This Information Element SHOULD be bound to its
|
|
containing IPFIX Message via an options record and the
|
|
messageScope Information Element, as defined below, and SHOULD
|
|
appear only once in a given IPFIX Message. To calculate the value
|
|
of this Information Element, first buffer the containing IPFIX
|
|
Message, setting the value of this Information Element to all
|
|
zeroes. Then calculate the MD5 checksum of the resulting buffer
|
|
as defined in [RFC1321], place the resulting value in this
|
|
Information Element, and export the buffered message. This
|
|
Information Element is intended as a simple checksum only;
|
|
therefore collision resistance and algorithm agility are not
|
|
required, and MD5 is an appropriate message digest.
|
|
|
|
This Information Element has a fixed length of 16 octets.",,,,[RFC5655][RFC1321],0,2013-02-18
|
|
263,messageScope,unsigned8,,current,"The presence of this Information Element as scope in
|
|
an Options Template signifies that the options described by the
|
|
Template apply to the IPFIX Message that contains them. It is
|
|
defined for general purpose message scoping of options, and
|
|
proposed specifically to allow the attachment a checksum to a
|
|
message via IPFIX Options. The value of this Information Element
|
|
MUST be written as 0 by the File Writer or Exporting Process. The
|
|
value of this Information Element MUST be ignored by the File
|
|
Reader or the Collecting Process.",,0-0,,[RFC5655],0,2013-02-18
|
|
264,minExportSeconds,dateTimeSeconds,default,current,"The absolute Export Time of the earliest IPFIX Message
|
|
within the scope containing this Information Element. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via an options record and the sessionScope
|
|
Information Element.",seconds,,,[RFC5655],0,2013-02-18
|
|
265,minFlowStartSeconds,dateTimeSeconds,default,current,"The earliest absolute timestamp of the first packet
|
|
within any Flow within the scope containing this Information
|
|
Element, rounded down to the second if necessary. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via an options record and the sessionScope
|
|
Information Element.",seconds,,,[RFC5655],0,2013-02-18
|
|
266,opaqueOctets,octetArray,default,current,"This Information Element is used to encapsulate non-
|
|
IPFIX data into an IPFIX Message stream, for the purpose of
|
|
allowing a non-IPFIX data processor to store a data stream inline
|
|
within an IPFIX File. A Collecting Process or File Writer MUST
|
|
NOT try to interpret this binary data. This Information Element
|
|
differs from paddingOctets as its contents are meaningful in some
|
|
non-IPFIX context, while the contents of paddingOctets MUST be
|
|
0x00 and are intended only for Information Element alignment.",,,,[RFC5655],0,2013-02-18
|
|
267,sessionScope,unsigned8,,current,"The presence of this Information Element as scope in
|
|
an Options Template signifies that the options described by the
|
|
Template apply to the IPFIX Transport Session that contains them.
|
|
Note that as all options are implicitly scoped to Transport
|
|
Session and Observation Domain, this Information Element is
|
|
equivalent to a ""null"" scope. It is defined for general purpose
|
|
session scoping of options, and proposed specifically to allow the
|
|
attachment of time window to an IPFIX File via IPFIX Options. The
|
|
value of this Information Element MUST be written as 0 by the File
|
|
Writer or Exporting Process. The value of this Information
|
|
Element MUST be ignored by the File Reader or the Collecting
|
|
Process.",,0-0,,[RFC5655],0,2013-02-18
|
|
268,maxFlowEndMicroseconds,dateTimeMicroseconds,default,current,"The latest absolute timestamp of the last packet
|
|
within any Flow within the scope containing this Information
|
|
Element, rounded up to the microsecond if necessary. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via IPFIX Options and the sessionScope
|
|
Information Element. This Information Element SHOULD be used only
|
|
in Transport Sessions containing Flow Records with microsecond-
|
|
precision (or better) timestamp Information Elements.",microseconds,,,[RFC5655],0,2013-02-18
|
|
269,maxFlowEndMilliseconds,dateTimeMilliseconds,default,current,"The latest absolute timestamp of the last packet
|
|
within any Flow within the scope containing this Information
|
|
Element, rounded up to the millisecond if necessary. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via IPFIX Options and the sessionScope
|
|
Information Element. This Information Element SHOULD be used only
|
|
in Transport Sessions containing Flow Records with millisecond-
|
|
precision (or better) timestamp Information Elements.",milliseconds,,,[RFC5655],0,2013-02-18
|
|
270,maxFlowEndNanoseconds,dateTimeNanoseconds,default,current,"The latest absolute timestamp of the last packet
|
|
within any Flow within the scope containing this Information
|
|
Element. This Information Element SHOULD be bound to its
|
|
containing IPFIX Transport Session via IPFIX Options and the
|
|
sessionScope Information Element. This Information Element SHOULD
|
|
be used only in Transport Sessions containing Flow Records with
|
|
nanosecond-precision timestamp Information Elements.",nanoseconds,,,[RFC5655],0,2013-02-18
|
|
271,minFlowStartMicroseconds,dateTimeMicroseconds,default,current,"The earliest absolute timestamp of the first packet
|
|
within any Flow within the scope containing this Information
|
|
Element, rounded down to the microsecond if necessary. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via an options record and the sessionScope
|
|
Information Element. This Information Element SHOULD be used only
|
|
in Transport Sessions containing Flow Records with microsecond-
|
|
precision (or better) timestamp Information Elements.",microseconds,,,[RFC5655],0,2013-02-18
|
|
272,minFlowStartMilliseconds,dateTimeMilliseconds,default,current,"The earliest absolute timestamp of the first packet
|
|
within any Flow within the scope containing this Information
|
|
Element, rounded down to the millisecond if necessary. This
|
|
Information Element SHOULD be bound to its containing IPFIX
|
|
Transport Session via an options record and the sessionScope
|
|
Information Element. This Information Element SHOULD be used only
|
|
in Transport Sessions containing Flow Records with millisecond-
|
|
precision (or better) timestamp Information Elements.",milliseconds,,,[RFC5655],0,2013-02-18
|
|
273,minFlowStartNanoseconds,dateTimeNanoseconds,default,current,"The earliest absolute timestamp of the first packet
|
|
within any Flow within the scope containing this Information
|
|
Element. This Information Element SHOULD be bound to its
|
|
containing IPFIX Transport Session via an options record and the
|
|
sessionScope Information Element. This Information Element SHOULD
|
|
be used only in Transport Sessions containing Flow Records with
|
|
nanosecond-precision timestamp Information Elements.",nanoseconds,,,[RFC5655],0,2013-02-18
|
|
274,collectorCertificate,octetArray,default,current,"The full X.509 certificate, encoded in ASN.1 DER
|
|
format, used by the Collector when IPFIX Messages were transmitted
|
|
using TLS or DTLS. This Information Element SHOULD be bound to
|
|
its containing IPFIX Transport Session via an options record and
|
|
the sessionScope Information Element, or to its containing IPFIX
|
|
Message via an options record and the messageScope Information
|
|
Element.",,,,[RFC5655],0,2013-02-18
|
|
275,exporterCertificate,octetArray,default,current,"The full X.509 certificate, encoded in ASN.1 DER
|
|
format, used by the Collector when IPFIX Messages were transmitted
|
|
using TLS or DTLS. This Information Element SHOULD be bound to
|
|
its containing IPFIX Transport Session via an options record and
|
|
the sessionScope Information Element, or to its containing IPFIX
|
|
Message via an options record and the messageScope Information
|
|
Element.",,,,[RFC5655],0,2013-02-18
|
|
276,dataRecordsReliability,boolean,default,current,"The export reliability of Data Records, within this SCTP
|
|
stream, for the element(s) in the Options Template
|
|
scope. A typical example of an element for which the
|
|
export reliability will be reported is the templateID,
|
|
as specified in the Data Records Reliability Options
|
|
Template. A value of 'True' means that the Exporting
|
|
Process MUST send any Data Records associated with the
|
|
element(s) reliably within this SCTP stream. A value of
|
|
'False' means that the Exporting Process MAY send any
|
|
Data Records associated with the element(s) unreliably
|
|
within this SCTP stream.",,,,[RFC6526],1,2014-02-03
|
|
277,observationPointType,unsigned8,identifier,current,"Type of observation point. Values assigned to date are:
|
|
|
|
|
|
|
|
|
|
1. Physical port
|
|
|
|
|
|
|
|
|
|
2. Port channel
|
|
|
|
|
|
|
|
|
|
3. Vlan.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
278,newConnectionDeltaCount,unsigned32,deltaCounter,current,"This information element counts the number of TCP or UDP
|
|
connections which were opened during the observation period. The
|
|
observation period may be specified by the flow start and end timestamps.",,,,[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
279,connectionSumDurationSeconds,unsigned64,,current,"This information element aggregates the total time in
|
|
seconds for all of the TCP or UDP connections which were in use during
|
|
the observation period. For example if there are 5 concurrent
|
|
connections each for 10 seconds, the value would be 50 s.",seconds,,,[ipfix-iana_at_cisco.com],1,2013-06-25
|
|
280,connectionTransactionId,unsigned64,identifier,current,"This information element identifies a transaction within a
|
|
connection. A transaction is a meaningful exchange of application data
|
|
between two network devices or a client and server. A transactionId is
|
|
assigned the first time a flow is reported, so that later reports for
|
|
the same flow will have the same transactionId. A different
|
|
transactionId is used for each transaction within a TCP or UDP
|
|
connection. The identifiers need not be sequential.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
281,postNATSourceIPv6Address,ipv6Address,default,current,"The definition of this Information Element is identical to
|
|
the definition of Information Element 'sourceIPv6Address', except that
|
|
it reports a modified value caused by a NAT64 middlebox function after
|
|
the packet passed the Observation Point.
|
|
|
|
See [RFC2460] for the definition of the Source Address field in the IPv6
|
|
header. See [RFC3234] for the definition of middleboxes. See
|
|
[RFC6146] for nat64 specification.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
282,postNATDestinationIPv6Address,ipv6Address,default,current,"The definition of this Information Element is identical to
|
|
the definition of Information Element 'destinationIPv6Address', except
|
|
that it reports a modified value caused by a NAT64 middlebox function
|
|
after the packet passed the Observation Point.
|
|
|
|
See [RFC2460] for the definition of the Destination Address field in the
|
|
IPv6 header. See [RFC3234] for the definition of middleboxes. See
|
|
[RFC6146] for nat64 specification.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
283,natPoolId,unsigned32,identifier,current,Locally unique identifier of a NAT pool.,,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
284,natPoolName,string,default,current,The name of a NAT pool identified by a natPoolID.,,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
285,anonymizationFlags,unsigned16,flags,current,"A flag word describing specialized modifications to
|
|
the anonymization policy in effect for the anonymization technique
|
|
applied to a referenced Information Element within a referenced
|
|
Template. When flags are clear (0), the normal policy (as
|
|
described by anonymizationTechnique) applies without modification.
|
|
|
|
|
|
|
|
MSB 14 13 12 11 10 9 8 7 6 5 4 3 2 1 LSB
|
|
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|
|
| Reserved |LOR|PmA| SC |
|
|
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|
|
|
|
anonymizationFlags IE
|
|
|
|
+--------+----------+-----------------------------------------------+
|
|
| bit(s) | name | description |
|
|
| (LSB = | | |
|
|
| 0) | | |
|
|
+--------+----------+-----------------------------------------------+
|
|
| 0-1 | SC | Stability Class: see the Stability Class |
|
|
| | | table below, and section Section 5.1. |
|
|
| 2 | PmA | Perimeter Anonymization: when set (1), |
|
|
| | | source- Information Elements as described in |
|
|
| | | [RFC5103] are interpreted as external |
|
|
| | | addresses, and destination- Information |
|
|
| | | Elements as described in [RFC5103] are |
|
|
| | | interpreted as internal addresses, for the |
|
|
| | | purposes of associating |
|
|
| | | anonymizationTechnique to Information |
|
|
| | | Elements only; see Section 7.2.2 for details. |
|
|
| | | This bit MUST NOT be set when associated with |
|
|
| | | a non-endpoint (i.e., source- or |
|
|
| | | destination-) Information Element. SHOULD be |
|
|
| | | consistent within a record (i.e., if a |
|
|
| | | source- Information Element has this flag |
|
|
| | | set, the corresponding destination- element |
|
|
| | | SHOULD have this flag set, and vice-versa.) |
|
|
| 3 | LOR | Low-Order Unchanged: when set (1), the |
|
|
| | | low-order bits of the anonymized Information |
|
|
| | | Element contain real data. This modification |
|
|
| | | is intended for the anonymization of |
|
|
| | | network-level addresses while leaving |
|
|
| | | host-level addresses intact in order to |
|
|
| | | preserve host level-structure, which could |
|
|
| | | otherwise be used to reverse anonymization. |
|
|
| | | MUST NOT be set when associated with a |
|
|
| | | truncation-based anonymizationTechnique. |
|
|
| 4-15 | Reserved | Reserved for future use: SHOULD be cleared |
|
|
| | | (0) by the Exporting Process and MUST be |
|
|
| | | ignored by the Collecting Process. |
|
|
+--------+----------+-----------------------------------------------+
|
|
|
|
|
|
|
|
The Stability Class portion of this flags word describes the
|
|
stability class of the anonymization technique applied to a
|
|
referenced Information Element within a referenced Template.
|
|
Stability classes refer to the stability of the parameters of the
|
|
anonymization technique, and therefore the comparability of the
|
|
mapping between the real and anonymized values over time. This
|
|
determines which anonymized datasets may be compared with each
|
|
other. Values are as follows:
|
|
|
|
|
|
|
|
+-----+-----+-------------------------------------------------------+
|
|
| Bit | Bit | Description |
|
|
| 1 | 0 | |
|
|
+-----+-----+-------------------------------------------------------+
|
|
| 0 | 0 | Undefined: the Exporting Process makes no |
|
|
| | | representation as to how stable the mapping is, or |
|
|
| | | over what time period values of this field will |
|
|
| | | remain comparable; while the Collecting Process MAY |
|
|
| | | assume Session level stability, Session level |
|
|
| | | stability is not guaranteed. Processes SHOULD assume |
|
|
| | | this is the case in the absence of stability class |
|
|
| | | information; this is the default stability class. |
|
|
| 0 | 1 | Session: the Exporting Process will ensure that the |
|
|
| | | parameters of the anonymization technique are stable |
|
|
| | | during the Transport Session. All the values of the |
|
|
| | | described Information Element for each Record |
|
|
| | | described by the referenced Template within the |
|
|
| | | Transport Session are comparable. The Exporting |
|
|
| | | Process SHOULD endeavour to ensure at least this |
|
|
| | | stability class. |
|
|
| 1 | 0 | Exporter-Collector Pair: the Exporting Process will |
|
|
| | | ensure that the parameters of the anonymization |
|
|
| | | technique are stable across Transport Sessions over |
|
|
| | | time with the given Collecting Process, but may use |
|
|
| | | different parameters for different Collecting |
|
|
| | | Processes. Data exported to different Collecting |
|
|
| | | Processes are not comparable. |
|
|
| 1 | 1 | Stable: the Exporting Process will ensure that the |
|
|
| | | parameters of the anonymization technique are stable |
|
|
| | | across Transport Sessions over time, regardless of |
|
|
| | | the Collecting Process to which it is sent. |
|
|
+-----+-----+-------------------------------------------------------+",,,,[RFC6235],0,2013-02-18
|
|
286,anonymizationTechnique,unsigned16,identifier,current,"A description of the anonymization technique applied
|
|
to a referenced Information Element within a referenced Template.
|
|
Each technique may be applicable only to certain Information
|
|
Elements and recommended only for certain Infomation Elements;
|
|
these restrictions are noted in the table below.
|
|
|
|
|
|
|
|
+-------+---------------------------+-----------------+-------------+
|
|
| Value | Description | Applicable to | Recommended |
|
|
| | | | for |
|
|
+-------+---------------------------+-----------------+-------------+
|
|
| 0 | Undefined: the Exporting | all | all |
|
|
| | Process makes no | | |
|
|
| | representation as to | | |
|
|
| | whether the defined field | | |
|
|
| | is anonymized or not. | | |
|
|
| | While the Collecting | | |
|
|
| | Process MAY assume that | | |
|
|
| | the field is not | | |
|
|
| | anonymized, it is not | | |
|
|
| | guaranteed not to be. | | |
|
|
| | This is the default | | |
|
|
| | anonymization technique. | | |
|
|
| 1 | None: the values exported | all | all |
|
|
| | are real. | | |
|
|
| 2 | Precision | all | all |
|
|
| | Degradation/Truncation: | | |
|
|
| | the values exported are | | |
|
|
| | anonymized using simple | | |
|
|
| | precision degradation or | | |
|
|
| | truncation. The new | | |
|
|
| | precision or number of | | |
|
|
| | truncated bits is | | |
|
|
| | implicit in the exported | | |
|
|
| | data, and can be deduced | | |
|
|
| | by the Collecting | | |
|
|
| | Process. | | |
|
|
| 3 | Binning: the values | all | all |
|
|
| | exported are anonymized | | |
|
|
| | into bins. | | |
|
|
| 4 | Enumeration: the values | all | timestamps |
|
|
| | exported are anonymized | | |
|
|
| | by enumeration. | | |
|
|
| 5 | Permutation: the values | all | identifiers |
|
|
| | exported are anonymized | | |
|
|
| | by permutation. | | |
|
|
| 6 | Structured Permutation: | addresses | |
|
|
| | the values exported are | | |
|
|
| | anonymized by | | |
|
|
| | permutation, preserving | | |
|
|
| | bit-level structure as | | |
|
|
| | appropriate; this | | |
|
|
| | represents | | |
|
|
| | prefix-preserving IP | | |
|
|
| | address anonymization or | | |
|
|
| | structured MAC address | | |
|
|
| | anonymization. | | |
|
|
| 7 | Reverse Truncation: the | addresses | |
|
|
| | values exported are | | |
|
|
| | anonymized using reverse | | |
|
|
| | truncation. The number | | |
|
|
| | of truncated bits is | | |
|
|
| | implicit in the exported | | |
|
|
| | data, and can be deduced | | |
|
|
| | by the Collecting | | |
|
|
| | Process. | | |
|
|
| 8 | Noise: the values | non-identifiers | counters |
|
|
| | exported are anonymized | | |
|
|
| | by adding random noise to | | |
|
|
| | each value. | | |
|
|
| 9 | Offset: the values | all | timestamps |
|
|
| | exported are anonymized | | |
|
|
| | by adding a single offset | | |
|
|
| | to all values. | | |
|
|
+-------+---------------------------+-----------------+-------------+",,,,[RFC6235],0,2013-02-18
|
|
287,informationElementIndex,unsigned16,identifier,current,"A zero-based index of an Information Element
|
|
referenced by informationElementId within a Template referenced by
|
|
templateId; used to disambiguate scope for templates containing
|
|
multiple identical Information Elements.",,,,[RFC6235],0,2013-02-18
|
|
288,p2pTechnology,string,default,current,"Specifies if the Application ID is based on peer-to-peer
|
|
technology.
|
|
|
|
|
|
|
|
|
|
Possible values are: { ""yes"", ""y"", 1 },
|
|
{ ""no"", ""n"", 2 } and { ""unassigned"", ""u"", 0 }.",,,,[RFC6759],0,2013-02-18
|
|
289,tunnelTechnology,string,default,current,"Specifies if the Application ID is used as a tunnel technology.
|
|
|
|
|
|
|
|
|
|
Possible values are: { ""yes"", ""y"", 1 }, { ""no"", ""n"", 2 } and
|
|
{ ""unassigned"", ""u"", 0 }.",,,,[RFC6759],0,2013-02-18
|
|
290,encryptedTechnology,string,default,current,"Specifies if the Application ID is an encrypted networking
|
|
protocol.
|
|
|
|
|
|
|
|
Possible values are: { ""yes"", ""y"", 1 },
|
|
{ ""no"", ""n"", 2 } and { ""unassigned"", ""u"", 0 }.",,,,[RFC6759],0,2013-02-18
|
|
291,basicList,basicList,list,current,"Specifies a generic Information Element with a basicList abstract
|
|
data type. For example, a list of port numbers, a list of
|
|
interface indexes, etc.",,,,[RFC6313],0,2013-02-18
|
|
292,subTemplateList,subTemplateList,list,current,"Specifies a generic Information Element with a subTemplateList
|
|
abstract data type.",,,,[RFC6313],0,2013-02-18
|
|
293,subTemplateMultiList,subTemplateMultiList,list,current,"Specifies a generic Information Element with a
|
|
subTemplateMultiList abstract data type.",,,,[RFC6313],0,2013-02-18
|
|
294,bgpValidityState,unsigned8,identifier,current,"This element describes the ""validity state"" of the BGP route correspondent source or destination IP address. If the ""validity state"" for this Flow is only available, then the value of this Information Element is 255.",,,"See [RFC4271] for a description of BGP-4,
|
|
[RFC6811] for the
|
|
definition of ""validity states"" and
|
|
[draft-ietf-sidr-origin-validation-signaling]
|
|
for the encoding of those ""validity states"".",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
295,IPSecSPI,unsigned32,identifier,current,IPSec Security Parameters Index (SPI).,,,See [RFC2401] for the definition of SPI.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
296,greKey,unsigned32,identifier,current,"GRE key, which is used for identifying an individual traffic flow within a tunnel.",,,See [RFC1701] for the definition of GRE and the GRE Key.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
297,natType,unsigned8,identifier,current,"The type of NAT treatment:
|
|
|
|
|
|
|
|
|
|
0 unknown
|
|
|
|
|
|
|
|
|
|
1 NAT44 translated
|
|
|
|
|
|
|
|
|
|
2 NAT64 translated
|
|
|
|
|
|
|
|
|
|
3 NAT46 translated
|
|
|
|
|
|
|
|
|
|
4 IPv4-->IPv4 (no NAT)
|
|
|
|
|
|
|
|
|
|
5 NAT66 translated
|
|
|
|
|
|
|
|
|
|
6 IPv6-->IPv6 (no NAT)",,,"See [RFC3022] for the definition of NAT.
|
|
See [RFC1631] for the definition of NAT44.
|
|
See [RFC6144] for the definition of NAT64.
|
|
See [RFC6146] for the definition of NAT46.
|
|
See [RFC6296] for the definition of NAT66.
|
|
See [RFC791] for the definition of IPv4.
|
|
See [RFC2460] for the definition of IPv6.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
298,initiatorPackets,unsigned64,deltaCounter,current,"The total number of layer 4 packets in a flow from the
|
|
initiator. The initiator is the device which triggered the
|
|
session creation, and remains the same for the life of the
|
|
session.",packets,,"See #231, initiatorOctets.",[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
299,responderPackets,unsigned64,deltaCounter,current,"The total number of layer 4 packets in a flow from the
|
|
responder. The responder is the device which replies to the
|
|
initiator, and remains the same for the life of the session.",packets,,"See #232, responderOctets.",[ipfix-iana_at_cisco.com],1,2014-08-13
|
|
300,observationDomainName,string,default,current,"The name of an observation domain identified by an
|
|
observationDomainId.",,,"See #149, observationDomainId.",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
301,selectionSequenceId,unsigned64,identifier,current,"From all the packets observed at an Observation Point, a subset of
|
|
the packets is selected by a sequence of one or more Selectors.
|
|
The selectionSequenceId is a unique value per Observation Domain,
|
|
specifying the Observation Point and the sequence of Selectors
|
|
through which the packets are selected.",,,,[RFC5477],0,2013-02-18
|
|
302,selectorId,unsigned64,identifier,current,"The Selector ID is the unique ID identifying a Primitive Selector.
|
|
Each Primitive Selector must have a unique ID in the Observation
|
|
Domain.",,,,"[RFC5477][RFC Errata
|
|
2052]",0,2013-02-18
|
|
303,informationElementId,unsigned16,identifier,current,"This Information Element contains the ID of another Information
|
|
Element.",,,,[RFC5477],0,2013-02-18
|
|
304,selectorAlgorithm,unsigned16,identifier,current,"This Information Element identifies the packet selection methods
|
|
(e.g., Filtering, Sampling) that are applied by the Selection
|
|
Process.
|
|
|
|
|
|
|
|
|
|
Most of these methods have parameters. Further Information
|
|
Elements are needed to fully specify packet selection with these
|
|
methods and all their parameters.
|
|
|
|
|
|
|
|
|
|
The methods listed below are defined in [RFC5475]. For their parameters, Information Elements are defined in
|
|
the information model document. The names of these Information
|
|
Elements are listed for each method identifier.
|
|
|
|
|
|
|
|
|
|
Further method identifiers may be added to the list below. It
|
|
might be necessary to define new Information Elements to specify
|
|
their parameters.
|
|
|
|
|
|
|
|
|
|
The selectorAlgorithm registry is maintained by IANA. New
|
|
assignments for the registry will be administered by IANA, and
|
|
are subject to Expert Review [RFC5226].
|
|
|
|
|
|
|
|
|
|
The registry can be updated when specifications of the new
|
|
method(s) and any new Information Elements are provided.
|
|
|
|
|
|
|
|
|
|
The group of experts must double check the selectorAlgorithm
|
|
definitions and Information Elements with already defined
|
|
selectorAlgorithms and Information Elements for completeness,
|
|
accuracy, and redundancy. Those experts will initially be drawn
|
|
from the Working Group Chairs and document editors of the IPFIX
|
|
and PSAMP Working Groups.
|
|
|
|
|
|
|
|
|
|
The following packet selection methods identifiers are defined
|
|
here:
|
|
|
|
|
|
|
|
|
|
[IANA registry psamp-parameters]
|
|
|
|
|
|
|
|
|
|
There is a broad variety of possible parameters that could be used
|
|
for Property match Filtering (5) but currently there are no agreed
|
|
parameters specified.",,,,[RFC5477],0,2013-02-18
|
|
305,samplingPacketInterval,unsigned32,quantity,current,"This Information Element specifies the number of packets that are
|
|
consecutively sampled. A value of 100 means that 100
|
|
consecutive packets are sampled.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may be used to describe the
|
|
configuration of a systematic count-based Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
|
|
306,samplingPacketSpace,unsigned32,quantity,current,"This Information Element specifies the number of packets between
|
|
two ""samplingPacketInterval""s. A value of 100 means that the next
|
|
interval starts 100 packets (which are not sampled) after the
|
|
current ""samplingPacketInterval"" is over.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may be used to describe the
|
|
configuration of a systematic count-based Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
|
|
307,samplingTimeInterval,unsigned32,quantity,current,"This Information Element specifies the time interval in
|
|
microseconds during which all arriving packets are sampled.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may be used to describe the
|
|
configuration of a systematic time-based Sampling Selector.",microseconds,,,[RFC5477],0,2013-02-18
|
|
308,samplingTimeSpace,unsigned32,quantity,current,"This Information Element specifies the time interval in
|
|
microseconds between two ""samplingTimeInterval""s. A value of 100
|
|
means that the next interval starts 100 microseconds (during which
|
|
no packets are sampled) after the current ""samplingTimeInterval""
|
|
is over.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may used to describe the
|
|
configuration of a systematic time-based Sampling Selector.",microseconds,,,[RFC5477],0,2013-02-18
|
|
309,samplingSize,unsigned32,quantity,current,"This Information Element specifies the number of elements taken
|
|
from the parent Population for random Sampling methods.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may be used to describe the
|
|
configuration of a random n-out-of-N Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
|
|
310,samplingPopulation,unsigned32,quantity,current,"This Information Element specifies the number of elements in the
|
|
parent Population for random Sampling methods.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may be used to describe the
|
|
configuration of a random n-out-of-N Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
|
|
311,samplingProbability,float64,quantity,current,"This Information Element specifies the probability that a packet
|
|
is sampled, expressed as a value between 0 and 1. The probability
|
|
is equal for every packet. A value of 0 means no packet was
|
|
sampled since the probability is 0.
|
|
|
|
|
|
|
|
|
|
For example, this Information Element may be used to describe the
|
|
configuration of a uniform probabilistic Sampling Selector.",,,,[RFC5477],0,2013-02-18
|
|
312,dataLinkFrameSize,unsigned16,quantity,current,"This Information Element specifies the length of the selected data
|
|
link frame.
|
|
|
|
|
|
|
|
|
|
The data link layer is defined in [ISO/IEC.7498-1:1994].",,,[ISO/IEC.7498-1:1994],[RFC7133],1,2014-01-11
|
|
313,ipHeaderPacketSection,octetArray,default,current,"This Information Element carries a series of n octets from the IP
|
|
header of a sampled packet, starting sectionOffset octets into the
|
|
IP header.
|
|
|
|
|
|
|
|
|
|
However, if no sectionOffset field corresponding to this
|
|
Information Element is present, then a sectionOffset of zero
|
|
applies, and the octets MUST be from the start of the IP header.
|
|
|
|
|
|
|
|
|
|
With sufficient length, this element also reports octets from the
|
|
IP payload. However, full packet capture of arbitrary packet
|
|
streams is explicitly out of scope per the Security Considerations
|
|
sections of [RFC5477] and [RFC2804].
|
|
|
|
|
|
|
|
|
|
The sectionExportedOctets expresses how much data was exported,
|
|
while the remainder is padding.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element exists, this Information Element MAY have a
|
|
fixed length and MAY be padded, or it MAY have a variable length.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element does not exist, this Information Element
|
|
SHOULD have a variable length and MUST NOT be padded. In this
|
|
case, the size of the exported section may be constrained due to
|
|
limitations in the IPFIX protocol.",,,"[RFC2804]
|
|
[RFC5477]",[RFC5477][RFC7133],1,2014-01-11
|
|
314,ipPayloadPacketSection,octetArray,default,current,"This Information Element carries a series of n octets from the IP
|
|
payload of a sampled packet, starting sectionOffset octets into
|
|
the IP payload.
|
|
|
|
|
|
|
|
|
|
However, if no sectionOffset field corresponding to this
|
|
Information Element is present, then a sectionOffset of zero
|
|
applies, and the octets MUST be from the start of the IP payload.
|
|
|
|
|
|
|
|
|
|
The IPv4 payload is that part of the packet that follows the IPv4
|
|
header and any options, which [RFC791] refers to as ""data"" or
|
|
""data octets"". For example, see the examples in [RFC791],
|
|
Appendix A.
|
|
|
|
|
|
|
|
|
|
The IPv6 payload is the rest of the packet following the 40-octet
|
|
IPv6 header. Note that any extension headers present are
|
|
considered part of the payload. See [RFC2460] for the IPv6
|
|
specification.
|
|
|
|
|
|
|
|
|
|
The sectionExportedOctets expresses how much data was observed,
|
|
while the remainder is padding.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element exists, this Information Element MAY have a
|
|
fixed length and MAY be padded, or MAY have a variable length.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element does not exist, this Information Element
|
|
SHOULD have a variable length and MUST NOT be padded. In this
|
|
case, the size of the exported section may be constrained due to
|
|
limitations in the IPFIX protocol.",,,"[RFC791]
|
|
[RFC2460]",[RFC5477][RFC7133],1,2014-01-11
|
|
315,dataLinkFrameSection,octetArray,default,current,"This Information Element carries n octets from the data link frame
|
|
of a selected frame, starting sectionOffset octets into the frame.
|
|
|
|
|
|
|
|
|
|
However, if no sectionOffset field corresponding to this
|
|
Information Element is present, then a sectionOffset of zero
|
|
applies, and the octets MUST be from the start of the data link
|
|
frame.
|
|
|
|
|
|
|
|
|
|
The sectionExportedOctets expresses how much data was observed,
|
|
while the remainder is padding.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element exists, this Information Element MAY have a
|
|
fixed length and MAY be padded, or MAY have a variable length.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element does not exist, this Information Element
|
|
SHOULD have a variable length and MUST NOT be padded. In this
|
|
case, the size of the exported section may be constrained due to
|
|
limitations in the IPFIX protocol.
|
|
|
|
|
|
|
|
|
|
Further Information Elements, i.e., dataLinkFrameType and
|
|
dataLinkFrameSize, are needed to specify the data link type and the
|
|
size of the data link frame of this Information Element. A set of
|
|
these Information Elements MAY be contained in a structured data
|
|
type, as expressed in [RFC6313]. Or a set of these Information
|
|
Elements MAY be contained in one Flow Record as shown in Appendix
|
|
B of [RFC7133].
|
|
|
|
|
|
|
|
|
|
The data link layer is defined in [ISO/IEC.7498-1:1994].",,,"[RFC6313]
|
|
[RFC7133]
|
|
[ISO/IEC.7498-1:1994]",[RFC7133],1,2014-01-11
|
|
316,mplsLabelStackSection,octetArray,default,current,"This Information Element carries a series of n octets from the
|
|
MPLS label stack of a sampled packet, starting sectionOffset
|
|
octets into the MPLS label stack.
|
|
|
|
|
|
|
|
|
|
However, if no sectionOffset field corresponding to this
|
|
Information Element is present, then a sectionOffset of zero
|
|
applies, and the octets MUST be from the head of the MPLS label
|
|
stack.
|
|
|
|
|
|
|
|
|
|
With sufficient length, this element also reports octets from the
|
|
MPLS payload. However, full packet capture of arbitrary packet
|
|
streams is explicitly out of scope per the Security Considerations
|
|
sections of [RFC5477] and [RFC2804].
|
|
|
|
|
|
|
|
|
|
See [RFC3031] for the specification of MPLS packets.
|
|
|
|
|
|
|
|
|
|
See [RFC3032] for the specification of the MPLS label stack.
|
|
|
|
|
|
|
|
|
|
The sectionExportedOctets expresses how much data was observed,
|
|
while the remainder is padding.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element exists, this Information Element MAY have a
|
|
fixed length and MAY be padded, or MAY have a variable length.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element does not exist, this Information Element
|
|
SHOULD have a variable length and MUST NOT be padded. In this
|
|
case, the size of the exported section may be constrained due to
|
|
limitations in the IPFIX protocol.",,,"[RFC2804]
|
|
[RFC3031]
|
|
[RFC3032]
|
|
[RFC5477]",[RFC5477][RFC7133],1,2014-01-11
|
|
317,mplsPayloadPacketSection,octetArray,default,current,"The mplsPayloadPacketSection carries a series of n octets from the
|
|
MPLS payload of a sampled packet, starting sectionOffset octets
|
|
into the MPLS payload, as it is data that follows immediately after
|
|
the MPLS label stack.
|
|
|
|
|
|
|
|
|
|
However, if no sectionOffset field corresponding to this
|
|
Information Element is present, then a sectionOffset of zero
|
|
applies, and the octets MUST be from the start of the MPLS
|
|
payload.
|
|
|
|
|
|
|
|
|
|
See [RFC3031] for the specification of MPLS packets.
|
|
|
|
|
|
|
|
|
|
See [RFC3032] for the specification of the MPLS label stack.
|
|
|
|
|
|
|
|
|
|
The sectionExportedOctets expresses how much data was observed,
|
|
while the remainder is padding.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element exists, this Information Element MAY have a
|
|
fixed length and MAY be padded, or it MAY have a variable length.
|
|
|
|
|
|
|
|
|
|
When the sectionExportedOctets field corresponding to this
|
|
Information Element does not exist, this Information Element
|
|
SHOULD have a variable length and MUST NOT be padded. In this
|
|
case, the size of the exported section may be constrained due to
|
|
limitations in the IPFIX protocol.",,,"[RFC3031]
|
|
[RFC3032]",[RFC5477][RFC7133],1,2014-01-11
|
|
318,selectorIdTotalPktsObserved,unsigned64,totalCounter,current,"This Information Element specifies the total number of packets
|
|
observed by a Selector, for a specific value of SelectorId.
|
|
|
|
|
|
|
|
|
|
This Information Element should be used in an Options Template
|
|
scoped to the observation to which it refers. See Section 3.4.2.1
|
|
of the IPFIX protocol document [RFC7011].",packets,,,[RFC5477],0,2013-02-18
|
|
319,selectorIdTotalPktsSelected,unsigned64,totalCounter,current,"This Information Element specifies the total number of packets
|
|
selected by a Selector, for a specific value of SelectorId.
|
|
|
|
|
|
|
|
|
|
This Information Element should be used in an Options Template
|
|
scoped to the observation to which it refers. See Section 3.4.2.1
|
|
of the IPFIX protocol document [RFC7011].",packets,,,[RFC5477],0,2013-02-18
|
|
320,absoluteError,float64,quantity,current,"This Information Element specifies the maximum possible
|
|
measurement error of the reported value for a given Information
|
|
Element. The absoluteError has the same unit as the Information
|
|
Element with which it is associated. The real value of the metric can
|
|
differ by absoluteError (positive or negative) from the measured
|
|
value.
|
|
|
|
|
|
|
|
|
|
This Information Element provides only the error for measured
|
|
values. If an Information Element contains an estimated value
|
|
(from Sampling), the confidence boundaries and confidence level
|
|
have to be provided instead, using the upperCILimit, lowerCILimit,
|
|
and confidenceLevel Information Elements.
|
|
|
|
|
|
|
|
|
|
This Information Element should be used in an Options Template
|
|
scoped to the observation to which it refers. See Section 3.4.2.1
|
|
of the IPFIX protocol document [RFC7011].",The units of the Information Element for which the error is specified.,,,[RFC5477],0,2013-02-18
|
|
321,relativeError,float64,quantity,current,"This Information Element specifies the maximum possible positive
|
|
or negative error ratio for the reported value for a given
|
|
Information Element as percentage of the measured value. The real
|
|
value of the metric can differ by relativeError percent (positive
|
|
or negative) from the measured value.
|
|
|
|
|
|
|
|
|
|
This Information Element provides only the error for measured
|
|
values. If an Information Element contains an estimated value
|
|
(from Sampling), the confidence boundaries and confidence level
|
|
have to be provided instead, using the upperCILimit, lowerCILimit,
|
|
and confidenceLevel Information Elements.
|
|
|
|
|
|
|
|
|
|
This Information Element should be used in an Options Template
|
|
scoped to the observation to which it refers. See Section 3.4.2.1
|
|
of the IPFIX protocol document [RFC7011].",,,,[RFC5477],0,2013-02-18
|
|
322,observationTimeSeconds,dateTimeSeconds,default,current,"This Information Element specifies the absolute time in seconds of
|
|
an observation.",seconds,,,[RFC5477],1,2014-02-03
|
|
323,observationTimeMilliseconds,dateTimeMilliseconds,default,current,"This Information Element specifies the absolute time in
|
|
milliseconds of an observation.",milliseconds,,,[RFC5477],1,2014-02-03
|
|
324,observationTimeMicroseconds,dateTimeMicroseconds,default,current,"This Information Element specifies the absolute time in
|
|
microseconds of an observation.",microseconds,,,[RFC5477],1,2014-02-03
|
|
325,observationTimeNanoseconds,dateTimeNanoseconds,default,current,"This Information Element specifies the absolute time in
|
|
nanoseconds of an observation.",nanoseconds,,,[RFC5477],1,2014-02-03
|
|
326,digestHashValue,unsigned64,quantity,current,"This Information Element specifies the value from the digest hash
|
|
function.
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
327,hashIPPayloadOffset,unsigned64,quantity,current,"This Information Element specifies the IP payload offset used by a
|
|
Hash-based Selection Selector.
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
328,hashIPPayloadSize,unsigned64,quantity,current,"This Information Element specifies the IP payload size used by a
|
|
Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of
|
|
[RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
329,hashOutputRangeMin,unsigned64,quantity,current,"This Information Element specifies the value for the beginning of
|
|
a hash function's potential output range.
|
|
|
|
|
|
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
330,hashOutputRangeMax,unsigned64,quantity,current,"This Information Element specifies the value for the end of a hash
|
|
function's potential output range.
|
|
|
|
|
|
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
331,hashSelectedRangeMin,unsigned64,quantity,current,"This Information Element specifies the value for the beginning of
|
|
a hash function's selected range.
|
|
|
|
|
|
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
332,hashSelectedRangeMax,unsigned64,quantity,current,"This Information Element specifies the value for the end of a hash
|
|
function's selected range.
|
|
|
|
|
|
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
333,hashDigestOutput,boolean,default,current,"This Information Element contains a boolean value that is TRUE if
|
|
the output from this hash Selector has been configured to be
|
|
included in the packet report as a packet digest, else FALSE.
|
|
|
|
|
|
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],1,2014-02-03
|
|
334,hashInitialiserValue,unsigned64,quantity,current,"This Information Element specifies the initialiser value to the
|
|
hash function.
|
|
|
|
|
|
|
|
|
|
See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
|
|
335,selectorName,string,default,current,"The name of a selector identified by a selectorID. Globally
|
|
unique per Metering Process.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
336,upperCILimit,float64,quantity,current,"This Information Element specifies the upper limit of a confidence
|
|
interval. It is used to provide an accuracy statement for an
|
|
estimated value. The confidence limits define the range in which
|
|
the real value is assumed to be with a certain probability p.
|
|
Confidence limits always need to be associated with a confidence
|
|
level that defines this probability p. Please note that a
|
|
confidence interval only provides a probability that the real
|
|
value lies within the limits. That means the real value can lie
|
|
outside the confidence limits.
|
|
|
|
|
|
|
|
|
|
The upperCILimit, lowerCILimit, and confidenceLevel Information
|
|
Elements should all be used in an Options Template scoped to the
|
|
observation to which they refer. See Section 3.4.2.1 of the IPFIX
|
|
protocol document [RFC7011].
|
|
|
|
|
|
|
|
|
|
Note that the upperCILimit, lowerCILimit, and confidenceLevel are
|
|
all required to specify confidence, and should be disregarded
|
|
unless all three are specified together.",,,,[RFC5477],0,2013-02-18
|
|
337,lowerCILimit,float64,quantity,current,"This Information Element specifies the lower limit of a confidence
|
|
interval. For further information, see the description of
|
|
upperCILimit.
|
|
|
|
|
|
|
|
|
|
The upperCILimit, lowerCILimit, and confidenceLevel Information
|
|
Elements should all be used in an Options Template scoped to the
|
|
observation to which they refer. See Section 3.4.2.1 of the IPFIX
|
|
protocol document [RFC7011].
|
|
|
|
|
|
|
|
|
|
Note that the upperCILimit, lowerCILimit, and confidenceLevel are
|
|
all required to specify confidence, and should be disregarded
|
|
unless all three are specified together.",,,,[RFC5477],0,2013-02-18
|
|
338,confidenceLevel,float64,quantity,current,"This Information Element specifies the confidence level. It is
|
|
used to provide an accuracy statement for estimated values. The
|
|
confidence level provides the probability p with which the real
|
|
value lies within a given range. A confidence level always needs
|
|
to be associated with confidence limits that define the range in
|
|
which the real value is assumed to be.
|
|
|
|
|
|
|
|
|
|
The upperCILimit, lowerCILimit, and confidenceLevel Information
|
|
Elements should all be used in an Options Template scoped to the
|
|
observation to which they refer. See Section 3.4.2.1 of the IPFIX
|
|
protocol document [RFC7011].
|
|
|
|
|
|
|
|
|
|
Note that the upperCILimit, lowerCILimit, and confidenceLevel are
|
|
all required to specify confidence, and should be disregarded
|
|
unless all three are specified together.",,,,[RFC5477],0,2013-02-18
|
|
339,informationElementDataType,unsigned8,,current,"A description of the abstract data type of an IPFIX
|
|
information element.These are taken from the abstract data types
|
|
defined in section 3.1 of the IPFIX Information Model [RFC5102];
|
|
see that section for more information on the types described
|
|
in the informationElementDataType sub-registry.
|
|
|
|
|
|
|
|
|
|
These types are registered in the IANA IPFIX Information Element
|
|
Data Type subregistry. This subregistry is intended to assign
|
|
numbers for type names, not to provide a mechanism for adding data
|
|
types to the IPFIX Protocol, and as such requires a Standards
|
|
Action [RFC5226] to modify.",,,,[RFC5610],0,2013-02-18
|
|
340,informationElementDescription,string,default,current,"A UTF-8 [RFC3629] encoded Unicode string containing a
|
|
human-readable description of an Information Element. The content
|
|
of the informationElementDescription MAY be annotated with one or
|
|
more language tags [RFC4646], encoded in-line [RFC2482] within the
|
|
UTF-8 string, in order to specify the language in which the
|
|
description is written. Description text in multiple languages
|
|
MAY tag each section with its own language tag; in this case, the
|
|
description information in each language SHOULD have equivalent
|
|
meaning. In the absence of any language tag, the ""i-default""
|
|
[RFC2277] language SHOULD be assumed. See the Security
|
|
Considerations section for notes on string handling for
|
|
Information Element type records.",,,,[RFC5610],0,2013-02-18
|
|
341,informationElementName,string,default,current,"A UTF-8 [RFC3629] encoded Unicode string containing
|
|
the name of an Information Element, intended as a simple
|
|
identifier. See the Security Considerations section for notes on
|
|
string handling for Information Element type records",,,,[RFC5610],0,2013-02-18
|
|
342,informationElementRangeBegin,unsigned64,quantity,current,"Contains the inclusive low end of the range of
|
|
acceptable values for an Information Element.",,,,[RFC5610],0,2013-02-18
|
|
343,informationElementRangeEnd,unsigned64,quantity,current,"Contains the inclusive high end of the range of
|
|
acceptable values for an Information Element.",,,,[RFC5610],0,2013-02-18
|
|
344,informationElementSemantics,unsigned8,,current,"A description of the semantics of an IPFIX Information
|
|
Element. These are taken from the data type semantics defined in
|
|
section 3.2 of the IPFIX Information Model [RFC5102]; see that
|
|
section for more information on the types defined in the informationElementSemantics sub-registry. This
|
|
field may take the values in Table ; the special value 0x00
|
|
(default) is used to note that no semantics apply to the field; it
|
|
cannot be manipulated by a Collecting Process or File Reader that
|
|
does not understand it a priori.
|
|
|
|
|
|
|
|
|
|
These semantics are registered in the IANA IPFIX Information
|
|
Element Semantics subregistry. This subregistry is intended to
|
|
assign numbers for semantics names, not to provide a mechanism for
|
|
adding semantics to the IPFIX Protocol, and as such requires a
|
|
Standards Action [RFC5226] to modify.",,,,[RFC5610],0,2013-02-18
|
|
345,informationElementUnits,unsigned16,,current,"A description of the units of an IPFIX Information
|
|
Element. These correspond to the units implicitly defined in the
|
|
Information Element definitions in section 5 of the IPFIX
|
|
Information Model [RFC5102]; see that section for more information
|
|
on the types described in the informationElementsUnits sub-registry. This field may take the values in
|
|
Table 3 below; the special value 0x00 (none) is used to note that
|
|
the field is unitless.
|
|
|
|
|
|
|
|
|
|
These types are registered in the IANA IPFIX Information Element
|
|
Units subregistry; new types may be added on a First Come First
|
|
Served [RFC5226] basis.",,,,[RFC5610],0,2013-02-18
|
|
346,privateEnterpriseNumber,unsigned32,identifier,current,"A private enterprise number, as assigned by IANA.
|
|
Within the context of an Information Element Type record, this
|
|
element can be used along with the informationElementId element to
|
|
scope properties to a specific Information Element. To export
|
|
type information about an IANA-assigned Information Element, set
|
|
the privateEnterpriseNumber to 0, or do not export the
|
|
privateEnterpriseNumber in the type record. To export type
|
|
information about an enterprise-specific Information Element,
|
|
export the enterprise number in privateEnterpriseNumber, and
|
|
export the Information Element number with the Enterprise bit
|
|
cleared in informationElementId. The Enterprise bit in the
|
|
associated informationElementId Information Element MUST be
|
|
ignored by the Collecting Process.",,,,[RFC5610],0,2013-02-18
|
|
347,virtualStationInterfaceId,octetArray,default,current,"Instance Identifier of the interface to a Virtual Station. A Virtual
|
|
Station is an end station instance: it can be a virtual machine or a
|
|
physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station Interface ID.,[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
348,virtualStationInterfaceName,string,default,current,"Name of the interface to a Virtual Station. A Virtual Station is an end station
|
|
instance: it can be a virtual machine or a physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station Interface.,[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
349,virtualStationUUID,octetArray,default,current,"Unique Identifier of a Virtual Station. A Virtual Station is an end station
|
|
instance: it can be a virtual machine or a physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station.,[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
350,virtualStationName,string,default,current,"Name of a Virtual Station. A Virtual Station is an end station
|
|
instance: it can be a virtual machine or a physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station.,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
351,layer2SegmentId,unsigned64,identifier,current,"Identifier of a layer 2 network segment in an overlay network.
|
|
The most significant byte identifies the layer 2 network
|
|
overlay network encapsulation type:
|
|
|
|
|
|
|
|
|
|
0x00 reserved
|
|
|
|
|
|
|
|
|
|
0x01 VxLAN
|
|
|
|
|
|
|
|
|
|
0x02 NVGRE
|
|
|
|
|
|
|
|
|
|
The three lowest significant bytes
|
|
hold the value of the layer 2
|
|
overlay network segment identifier.
|
|
|
|
|
|
|
|
|
|
For example:
|
|
|
|
|
|
|
|
|
|
- a 24 bit segment ID VXLAN Network
|
|
Identifier (VNI)
|
|
|
|
|
|
|
|
|
|
- a 24 bit Tenant Network Identifier
|
|
(TNI) for NVGRE",,,"See VxLAN RFC at [draft-mahalingam-dutt-dcops-vxlan]
|
|
|
|
|
|
|
|
|
|
See NVGRE RFC at [draft-sridharan-virtualization-nvgre]",[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
352,layer2OctetDeltaCount,unsigned64,deltaCounter,current,"The number of layer 2 octets since the previous report (if any) in
|
|
incoming packets for this Flow at the Observation Point. The
|
|
number of octets includes layer 2 header(s) and layer 2 payload.
|
|
# memo: layer 2 version of octetDeltaCount (field #1)",octets,,,[ipfix-iana_at_cisco.com],1,2014-05-02
|
|
353,layer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of layer 2 octets in incoming packets for this
|
|
Flow at the Observation Point since the Metering Process
|
|
(re-)initialization for this Observation Point. The number of
|
|
octets includes layer 2 header(s) and layer 2 payload.
|
|
# memo: layer 2 version of octetTotalCount (field #85)",octets,,,[ipfix-iana_at_cisco.com],1,2014-05-02
|
|
354,ingressUnicastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming unicast packets metered at the
|
|
Observation Point since the Metering Process (re-)initialization
|
|
for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
355,ingressMulticastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming multicast packets metered at the
|
|
Observation Point since the Metering Process (re-)initialization
|
|
for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
356,ingressBroadcastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming broadcast packets metered at the
|
|
Observation Point since the Metering Process (re-)initialization
|
|
for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
357,egressUnicastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming unicast packets metered at the
|
|
Observation Point since the Metering Process (re-)initialization
|
|
for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
358,egressBroadcastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming broadcast packets metered at the
|
|
Observation Point since the Metering Process (re-)initialization
|
|
for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
359,monitoringIntervalStartMilliSeconds,dateTimeMilliseconds,default,current,"The absolute timestamp at which the monitoring interval
|
|
started.
|
|
A Monitoring interval is the period of time during which the Metering
|
|
Process is running.",milliseconds,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
360,monitoringIntervalEndMilliSeconds,dateTimeMilliseconds,default,current,"The absolute timestamp at which the monitoring interval ended.
|
|
A Monitoring interval is the period of time during which the Metering
|
|
Process is running.",milliseconds,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
361,portRangeStart,unsigned16,identifier,current,"The port number identifying the start of a range of ports. A value
|
|
of zero indicates that the range start is not specified, ie the
|
|
range is defined in some other way.
|
|
|
|
|
|
|
|
|
|
Additional information on defined TCP port numbers can be found at
|
|
[IANA registry service-names-port-numbers].",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
362,portRangeEnd,unsigned16,identifier,current,"The port number identifying the end of a range of ports. A value
|
|
of zero indicates that the range end is not specified, ie the
|
|
range is defined in some other way.
|
|
|
|
|
|
|
|
|
|
Additional information on defined TCP port numbers can be found at
|
|
[IANA registry service-names-port-numbers].",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
363,portRangeStepSize,unsigned16,identifier,current,"The step size in a port range. The default step size is 1,
|
|
which indicates contiguous ports. A value of zero indicates
|
|
that the step size is not specified, ie the range is defined
|
|
in some other way.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
364,portRangeNumPorts,unsigned16,identifier,current,"The number of ports in a port range. A value of zero indicates
|
|
that the number of ports is not specified, ie the range is defined
|
|
in some other way.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
365,staMacAddress,macAddress,default,current,The IEEE 802 MAC address of a wireless station (STA).,,,See section 1.4 of [RFC5415] for the definition of STA.,[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
366,staIPv4Address,ipv4Address,default,current,The IPv4 address of a wireless station (STA).,,,See section 1.4 of [RFC5415] for the definition of STA.,[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
367,wtpMacAddress,macAddress,default,current,The IEEE 802 MAC address of a wireless access point (WTP).,,,See section 1.4 of [RFC5415] for the definition of WTP.,[ipfix-iana_at_cisco.com],1,2014-02-03
|
|
368,ingressInterfaceType,unsigned32,identifier,current,"The type of interface where packets of this Flow are being received.
|
|
The value matches the value of managed object 'ifType' as defined in
|
|
[IANA registry ianaiftype-mib].",,,[IANA registry ianaiftype-mib],[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
369,egressInterfaceType,unsigned32,identifier,current,"The type of interface where packets of this Flow are being sent.
|
|
The value matches the value of managed object 'ifType' as defined in
|
|
[IANA registry ianaiftype-mib].",,,[IANA registry ianaiftype-mib],[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
370,rtpSequenceNumber,unsigned16,,current,The RTP sequence number per [RFC3550].,,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
371,userName,string,default,current,User name associated with the flow.,,,,[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
372,applicationCategoryName,string,default,current,"An attribute that provides a first level categorization for
|
|
each Application ID.",,,,[RFC6759],0,2013-02-18
|
|
373,applicationSubCategoryName,string,default,current,"An attribute that provides a second level categorization
|
|
for each Application ID.",,,,[RFC6759],0,2013-02-18
|
|
374,applicationGroupName,string,default,current,"An attribute that groups multiple Application IDs that
|
|
belong to the same networking application.",,,,[RFC6759],0,2013-02-18
|
|
375,originalFlowsPresent,unsigned64,deltaCounter,current,"The non-conservative count of Original Flows
|
|
contributing to this Aggregated Flow. Non-conservative counts
|
|
need not sum to the original count on re-aggregation.",flows,,,[RFC7015],1,2013-06-25
|
|
376,originalFlowsInitiated,unsigned64,deltaCounter,current,"The conservative count of Original Flows whose first
|
|
packet is represented within this Aggregated Flow. Conservative
|
|
counts must sum to the original count on re-aggregation.",flows,,,[RFC7015],1,2013-06-25
|
|
377,originalFlowsCompleted,unsigned64,deltaCounter,current,"The conservative count of Original Flows whose last
|
|
packet is represented within this Aggregated Flow. Conservative
|
|
counts must sum to the original count on re-aggregation.",flows,,,[RFC7015],1,2013-06-25
|
|
378,distinctCountOfSourceIPAddress,unsigned64,totalCounter,current,"The count of distinct source IP address values for
|
|
Original Flows contributing to this Aggregated Flow, without
|
|
regard to IP version. This Information Element is preferred to
|
|
the IP-version-specific counters, unless it is important to
|
|
separate the counts by version.",,,,[RFC7015],0,2013-02-18
|
|
379,distinctCountOfDestinationIPAddress,unsigned64,totalCounter,current,"The count of distinct destination IP address values
|
|
for Original Flows contributing to this Aggregated Flow, without
|
|
regard to IP version. This Information Element is preferred to
|
|
the version-specific counters below, unless it is important to
|
|
separate the counts by version.",,,,[RFC7015],0,2013-02-18
|
|
380,distinctCountOfSourceIPv4Address,unsigned32,totalCounter,current,"The count of distinct source IPv4 address values for
|
|
Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
|
|
381,distinctCountOfDestinationIPv4Address,unsigned32,totalCounter,current,"The count of distinct destination IPv4 address values
|
|
for Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
|
|
382,distinctCountOfSourceIPv6Address,unsigned64,totalCounter,current,"The count of distinct source IPv6 address values for
|
|
Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
|
|
383,distinctCountOfDestinationIPv6Address,unsigned64,totalCounter,current,"The count of distinct destination IPv6 address values
|
|
for Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
|
|
384,valueDistributionMethod,unsigned8,,current,"A description of the method used to distribute the
|
|
counters from Contributing Flows into the Aggregated Flow records
|
|
described by an associated scope, generally a Template. The
|
|
method is deemed to apply to all the non-key Information Elements
|
|
in the referenced scope for which value distribution is a valid
|
|
operation; if the originalFlowsInitiated and/or
|
|
originalFlowsCompleted Information Elements appear in the
|
|
Template, they are not subject to this distribution method, as
|
|
they each infer their own distribution method. This is intended
|
|
to be a complete set of possible value distribution methods; it is
|
|
encoded as follows:
|
|
|
|
|
|
|
|
+-------+-----------------------------------------------------------+
|
|
| Value | Description |
|
|
+-------+-----------------------------------------------------------+
|
|
| 0 | Unspecified: The counters for an Original Flow are |
|
|
| | explicitly not distributed according to any other method |
|
|
| | defined for this Information Element; use for arbitrary |
|
|
| | distribution, or distribution algorithms not described by |
|
|
| | any other codepoint. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 1 | Start Interval: The counters for an Original Flow are |
|
|
| | added to the counters of the appropriate Aggregated Flow |
|
|
| | containing the start time of the Original Flow. This |
|
|
| | should be assumed the default if value distribution |
|
|
| | information is not available at a Collecting Process for |
|
|
| | an Aggregated Flow. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 2 | End Interval: The counters for an Original Flow are added |
|
|
| | to the counters of the appropriate Aggregated Flow |
|
|
| | containing the end time of the Original Flow. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 3 | Mid Interval: The counters for an Original Flow are added |
|
|
| | to the counters of a single appropriate Aggregated Flow |
|
|
| | containing some timestamp between start and end time of |
|
|
| | the Original Flow. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 4 | Simple Uniform Distribution: Each counter for an Original |
|
|
| | Flow is divided by the number of time intervals the |
|
|
| | Original Flow covers (i.e., of appropriate Aggregated |
|
|
| | Flows sharing the same Flow Key), and this number is |
|
|
| | added to each corresponding counter in each Aggregated |
|
|
| | Flow. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 5 | Proportional Uniform Distribution: Each counter for an |
|
|
| | Original Flow is divided by the number of time units the |
|
|
| | Original Flow covers, to derive a mean count rate. This |
|
|
| | mean count rate is then multiplied by the number of time |
|
|
| | units in the intersection of the duration of the Original |
|
|
| | Flow and the time interval of each Aggregated Flow. This |
|
|
| | is like simple uniform distribution, but accounts for the |
|
|
| | fractional portions of a time interval covered by an |
|
|
| | Original Flow in the first and last time interval. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 6 | Simulated Process: Each counter of the Original Flow is |
|
|
| | distributed among the intervals of the Aggregated Flows |
|
|
| | according to some function the Intermediate Aggregation |
|
|
| | Process uses based upon properties of Flows presumed to |
|
|
| | be like the Original Flow. This is essentially an |
|
|
| | assertion that the Intermediate Aggregation Process has |
|
|
| | no direct packet timing information but is nevertheless |
|
|
| | not using one of the other simpler distribution methods. |
|
|
| | The Intermediate Aggregation Process specifically makes |
|
|
| | no assertion as to the correctness of the simulation. |
|
|
| | --------------------------------------------------------- |
|
|
| | |
|
|
| 7 | Direct: The Intermediate Aggregation Process has access |
|
|
| | to the original packet timings from the packets making up |
|
|
| | the Original Flow, and uses these to distribute or |
|
|
| | recalculate the counters. |
|
|
+-------+-----------------------------------------------------------+",,,,[RFC7015],0,2013-02-18
|
|
385,rfc3550JitterMilliseconds,unsigned32,quantity,current,"Interarrival jitter as defined in section 6.4.1 of [RFC3550],
|
|
measured in milliseconds.",milliseconds,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
386,rfc3550JitterMicroseconds,unsigned32,quantity,current,"Interarrival jitter as defined in section 6.4.1 of [RFC3550],
|
|
measured in microseconds.",microseconds,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
387,rfc3550JitterNanoseconds,unsigned32,quantity,current,"Interarrival jitter as defined in section 6.4.1 of [RFC3550],
|
|
measured in nanoseconds.",nanoseconds,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
|
|
388,dot1qDEI,boolean,default,current,"The value of the 1-bit Drop Eligible Indicator (DEI) field of the VLAN tag as
|
|
described in 802.1Q-2011 subclause 9.6. In case of a QinQ frame, it represents
|
|
the outer tag's DEI field and in case of an IEEE 802.1ad frame it represents
|
|
the DEI field of the S-TAG. Note: in earlier versions of 802.1Q the same bit
|
|
field in the incoming packet is occupied by the Canonical Format Indicator
|
|
(CFI) field, except for S-TAGs.",,,[802.1Q-2011 subclause 9.6],[Yaakov_J_Stein],1,2014-02-03
|
|
389,dot1qCustomerDEI,boolean,default,current,"In case of a QinQ frame, it represents the inner tag's Drop Eligible Indicator
|
|
(DEI) field and in case of an IEEE 802.1ad frame it represents the DEI field of
|
|
the C-TAG.",,,[802.1Q-2011 subclause 9.6],[Yaakov_J_Stein],1,2014-02-03
|
|
390,flowSelectorAlgorithm,unsigned16,identifier,current,"This Information Element identifies the Intermediate Flow
|
|
Selection Process technique (e.g., Filtering, Sampling) that is
|
|
applied by the Intermediate Flow Selection Process. Most of these
|
|
techniques have parameters. Its configuration parameter(s) MUST
|
|
be clearly specified. Further Information Elements are needed to
|
|
fully specify packet selection with these methods and all their
|
|
parameters. Further method identifiers may be added to the
|
|
flowSelectorAlgorithm registry. It might be necessary to define new Information Elements
|
|
to specify their parameters. The flowSelectorAlgorithm registry
|
|
is maintained by IANA. New assignments for the registry will be
|
|
administered by IANA, on a First Come First Served basis
|
|
[RFC5226], subject to Expert Review [RFC5226]. Please note that
|
|
the purpose of the flow selection techniques described in this
|
|
document is the improvement of measurement functions as defined in
|
|
the Scope (Section 1). Before adding new flow selector algorithms
|
|
it should be checked what is their intended purpose and especially
|
|
if those contradict with policies defined in [RFC2804]. The
|
|
designated expert(s) should consult with the community if a
|
|
request is received that runs counter to [RFC2804]. The registry
|
|
can be updated when specifications of the new method(s) and any
|
|
new Information Elements are provided. The group of experts must
|
|
double check the flowSelectorAlgorithm definitions and Information
|
|
Elements with already defined flowSelectorAlgorithm and
|
|
Information Elements for completeness, accuracy, and redundancy.
|
|
Those experts will initially be drawn from the Working Group
|
|
Chairs and document editors of the IPFIX and PSAMP Working Groups.
|
|
The Intermediate Flow Selection Process Techniques
|
|
identifiers are defined at [http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-flowselectoralgorithm].",,,,[RFC7014],0,2013-06-07
|
|
391,flowSelectedOctetDeltaCount,unsigned64,deltaCounter,current,"This Information Element specifies the volume in octets of all
|
|
Flows that are selected in the Intermediate Flow Selection Process
|
|
since the previous report.",octets,,,[RFC7014],1,2014-08-13
|
|
392,flowSelectedPacketDeltaCount,unsigned64,deltaCounter,current,"This Information Element specifies the volume in packets of all
|
|
Flows that were selected in the Intermediate Flow Selection
|
|
Process since the previous report.",packets,,,[RFC7014],1,2014-08-13
|
|
393,flowSelectedFlowDeltaCount,unsigned64,deltaCounter,current,"This Information Element specifies the number of Flows that were
|
|
selected in the Intermediate Flow Selection Process since the last
|
|
report.",flows,,,[RFC7014],1,2014-08-13
|
|
394,selectorIDTotalFlowsObserved,unsigned64,,current,"This Information Element specifies the total number of Flows
|
|
observed by a Selector, for a specific value of SelectorId. This
|
|
Information Element should be used in an Options Template scoped
|
|
to the observation to which it refers. See Section 3.4.2.1 of the
|
|
IPFIX protocol document [RFC7011].",flows,,,[RFC7014],0,2013-06-07
|
|
395,selectorIDTotalFlowsSelected,unsigned64,,current,"This Information Element specifies the total number of Flows
|
|
selected by a Selector, for a specific value of SelectorId. This
|
|
Information Element should be used in an Options Template scoped
|
|
to the observation to which it refers. See Section 3.4.2.1 of the
|
|
IPFIX protocol document [RFC7011].",flows,,,[RFC7014],0,2013-06-07
|
|
396,samplingFlowInterval,unsigned64,,current,"This Information Element specifies the number of Flows that are
|
|
consecutively sampled. A value of 100 means that 100 consecutive
|
|
Flows are sampled. For example, this Information Element may be
|
|
used to describe the configuration of a systematic count-based
|
|
Sampling Selector.",flows,,,[RFC7014],0,2013-06-07
|
|
397,samplingFlowSpacing,unsigned64,,current,"This Information Element specifies the number of Flows between two
|
|
""samplingFlowInterval""s. A value of 100 means that the next
|
|
interval starts 100 Flows (which are not sampled) after the
|
|
current ""samplingFlowInterval"" is over. For example, this
|
|
Information Element may be used to describe the configuration of a
|
|
systematic count-based Sampling Selector.",flows,,,[RFC7014],0,2013-06-07
|
|
398,flowSamplingTimeInterval,unsigned64,,current,"This Information Element specifies the time interval in
|
|
microseconds during which all arriving Flows are sampled. For
|
|
example, this Information Element may be used to describe the
|
|
configuration of a systematic time-based Sampling Selector.",microseconds,,,[RFC7014],0,2013-06-07
|
|
399,flowSamplingTimeSpacing,unsigned64,,current,"This Information Element specifies the time interval in
|
|
microseconds between two ""flowSamplingTimeInterval""s. A value of
|
|
100 means that the next interval starts 100 microseconds (during
|
|
which no Flows are sampled) after the current
|
|
""flowsamplingTimeInterval"" is over. For example, this Information
|
|
Element may used to describe the configuration of a systematic
|
|
time-based Sampling Selector.",microseconds,,,[RFC7014],0,2013-06-07
|
|
400,hashFlowDomain,unsigned16,identifier,current,"This Information Element specifies the Information Elements that
|
|
are used by the Hash-based Flow Selector as the Hash Domain.",,,,[RFC7014],0,2013-06-07
|
|
401,transportOctetDeltaCount,unsigned64,deltaCounter,current,"The number of octets, excluding IP header(s) and Layer 4 transport
|
|
protocol header(s), observed for this Flow at the Observation Point
|
|
since the previous report (if any).",octets,,,[Brian_Trammell],0,2013-08-01
|
|
402,transportPacketDeltaCount,unsigned64,deltaCounter,current,"The number of packets containing at least one octet beyond the IP header(s) and
|
|
Layer 4 transport protocol header(s), observed for this Flow at the Observation
|
|
Point since the previous report (if any).",packets,,,[Brian_Trammell],0,2013-08-01
|
|
403,originalExporterIPv4Address,ipv4Address,,current,"The IPv4 address used by the Exporting Process on an
|
|
Original Exporter, as seen by the Collecting Process on an IPFIX
|
|
Mediator. Used to provide information about the Original
|
|
Observation Points to a downstream Collector.",,,,[RFC7119],0,2013-12-24
|
|
404,originalExporterIPv6Address,ipv6Address,,current,"The IPv6 address used by the Exporting Process on an
|
|
Original Exporter, as seen by the Collecting Process on an IPFIX
|
|
Mediator. Used to provide information about the Original
|
|
Observation Points to a downstream Collector.",,,,[RFC7119],0,2013-12-24
|
|
405,originalObservationDomainId,unsigned32,identifier,current,"The Observation Domain ID reported by the Exporting
|
|
Process on an Original Exporter, as seen by the Collecting Process
|
|
on an IPFIX Mediator. Used to provide information about the
|
|
Original Observation Domain to a downstream Collector. When
|
|
cascading through multiple Mediators, this identifies the initial
|
|
Observation Domain in the cascade.",,,,[RFC7119],0,2013-12-24
|
|
406,intermediateProcessId,unsigned32,identifier,current,"Description: An identifier of an Intermediate Process that is
|
|
unique per IPFIX Device. Typically, this Information Element is
|
|
used for limiting the scope of other Information Elements. Note
|
|
that process identifiers may be assigned dynamically; that is, an
|
|
Intermediate Process may be restarted with a different ID.",,,,[RFC7119],0,2013-12-24
|
|
407,ignoredDataRecordTotalCount,unsigned64,totalCounter,current,"Description: The total number of received Data Records that the
|
|
Intermediate Process did not process since the (re-)initialization
|
|
of the Intermediate Process; includes only Data Records not
|
|
examined or otherwise handled by the Intermediate Process due to
|
|
resource constraints, not Data Records that were examined or
|
|
otherwise handled by the Intermediate Process but those that
|
|
merely do not contribute to any exported Data Record due to the
|
|
operations performed by the Intermediate Process.",,,,[RFC7119],0,2013-12-24
|
|
408,dataLinkFrameType,unsigned16,flags,current,"This Information Element specifies the type of the selected data
|
|
link frame.
|
|
|
|
|
|
|
|
|
|
The following data link types are defined here:
|
|
|
|
|
|
|
|
|
|
- 0x01 IEEE802.3 ETHERNET [IEEE802.3]
|
|
|
|
|
|
|
|
|
|
- 0x02 IEEE802.11 MAC Frame format [IEEE802.11]
|
|
|
|
|
|
|
|
|
|
Further values may be assigned by IANA. Note that the assigned
|
|
values are bits so that multiple observations can be OR'd
|
|
together.
|
|
|
|
|
|
|
|
|
|
The data link layer is defined in [ISO/IEC.7498-1:1994].",,,[IEEE802.3][IEEE802.11][ISO/IEC.7498-1:1994],[RFC7133],0,2014-01-11
|
|
409,sectionOffset,unsigned16,quantity,current,"This Information Element specifies the offset of the packet
|
|
section (e.g., dataLinkFrameSection, ipHeaderPacketSection,
|
|
ipPayloadPacketSection, mplsLabelStackSection, and
|
|
mplsPayloadPacketSection). If this Information Element is
|
|
omitted, it defaults to zero (i.e., no offset).
|
|
|
|
|
|
|
|
|
|
If multiple sectionOffset Information Elements are specified
|
|
within a single Template, then they apply to the packet section
|
|
Information Elements in order: the first sectionOffset applies to
|
|
the first packet section, the second to the second, and so on.
|
|
Note that the ""closest"" sectionOffset and packet section
|
|
Information Elements within a given Template are not necessarily
|
|
related. If there are fewer sectionOffset Information Elements
|
|
than packet section Information Elements, then subsequent packet
|
|
section Information Elements have no offset, i.e., a sectionOffset
|
|
of zero applies to those packet section Information Elements. If
|
|
there are more sectionOffset Information Elements than the number
|
|
of packet section Information Elements, then the additional
|
|
sectionOffset Information Elements are meaningless.",,,,[RFC7133],0,2014-01-11
|
|
410,sectionExportedOctets,unsigned16,quantity,current,"This Information Element specifies the observed length of the
|
|
packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection,
|
|
ipPayloadPacketSection, mplsLabelStackSection, and
|
|
mplsPayloadPacketSection) when padding is used.
|
|
|
|
|
|
|
|
|
|
The packet section may be of a fixed size larger than the
|
|
sectionExportedOctets. In this case, octets in the packet section
|
|
beyond the sectionExportedOctets MUST follow the [RFC7011] rules
|
|
for padding (i.e., be composed of zero (0) valued octets).",,,[RFC7011],[RFC7133],0,2014-01-11
|
|
411,dot1qServiceInstanceTag,octetArray,default,current,"This Information Element, which is 16 octets long, represents the
|
|
Backbone Service Instance Tag (I-TAG) Tag Control Information
|
|
(TCI) field of an Ethernet frame as described in [IEEE802.1Q]. It
|
|
encodes the Backbone Service Instance Priority Code Point (I-PCP),
|
|
Backbone Service Instance Drop Eligible Indicator (I-DEI), Use Customer Addresses (UCAs),
|
|
Backbone Service Instance Identifier (I-SID), Encapsulated
|
|
Customer Destination Address (C-DA), Encapsulated Customer Source
|
|
Address (C-SA), and reserved fields. The structure and semantics
|
|
within the Tag Control Information field are defined in
|
|
[IEEE802.1Q].",,,[IEEE802.1Q],[RFC7133],1,2014-05-02
|
|
412,dot1qServiceInstanceId,unsigned32,identifier,current,"The value of the 24-bit Backbone Service Instance Identifier
|
|
(I-SID) portion of the Backbone Service Instance Tag (I-TAG) Tag
|
|
Control Information (TCI) field of an Ethernet frame as described
|
|
in [IEEE802.1Q].",,"The valid range is 0 - 16777215 (i.e., 24 bits).",[IEEE802.1Q],[RFC7133],1,2014-05-02
|
|
413,dot1qServiceInstancePriority,unsigned8,identifier,current,"The value of the 3-bit Backbone Service Instance Priority Code
|
|
Point (I-PCP) portion of the Backbone Service Instance Tag (I-TAG)
|
|
Tag Control Information (TCI) field of an Ethernet frame as
|
|
described in [IEEE802.1Q].",,The valid range is 0-7.,[IEEE802.1Q],[RFC7133],1,2014-05-02
|
|
414,dot1qCustomerSourceMacAddress,macAddress,default,current,"The value of the Encapsulated Customer Source Address (C-SA)
|
|
portion of the Backbone Service Instance Tag (I-TAG) Tag Control
|
|
Information (TCI) field of an Ethernet frame as described in
|
|
[IEEE802.1Q].",,,[IEEE802.1Q],[RFC7133],1,2014-05-02
|
|
415,dot1qCustomerDestinationMacAddress,macAddress,default,current,"The value of the Encapsulated Customer Destination Address (C-DA)
|
|
portion of the Backbone Service Instance Tag (I-TAG) Tag Control
|
|
Information (TCI) field of an Ethernet frame as described in
|
|
[IEEE802.1Q].",,,[IEEE802.1Q],[RFC7133],1,2014-05-02
|
|
416,,,,deprecated,"Duplicate of Information Element ID 352, layer2OctetDeltaCount.",,,[RFC5477],,2,2014-05-13
|
|
417,postLayer2OctetDeltaCount,unsigned64,deltaCounter,current,"The definition of this Information Element is identical to the
|
|
definition of the layer2OctetDeltaCount Information Element,
|
|
except that it reports a potentially modified value caused by a
|
|
middlebox function after the packet passed the Observation Point.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
postOctetDeltaCount (ElementId #23).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
418,postMCastLayer2OctetDeltaCount,unsigned64,deltaCounter,current,"The number of layer 2 octets since the previous report (if any) in
|
|
outgoing multicast packets sent for packets of this Flow by a
|
|
multicast daemon within the Observation Domain. This property
|
|
cannot necessarily be observed at the Observation Point but may
|
|
be retrieved by other means. The number of octets includes layer
|
|
2 header(s) and layer 2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
postMCastOctetDeltaCount (ElementId #20).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
419,,,,deprecated,"Duplicate of Information Element ID 353, layer2OctetTotalCount.",,,[RFC5477],,2,2014-05-13
|
|
420,postLayer2OctetTotalCount,unsigned64,totalCounter,current,"The definition of this Information Element is identical to the
|
|
definition of the layer2OctetTotalCount Information Element,
|
|
except that it reports a potentially modified value caused by a
|
|
middlebox function after the packet passed the Observation Point.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
postOctetTotalCount (ElementId #171).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
421,postMCastLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of layer 2 octets in outgoing multicast packets
|
|
sent for packets of this Flow by a multicast daemon in the
|
|
Observation Domain since the Metering Process (re-)initialization.
|
|
This property cannot necessarily be observed at the Observation
|
|
Point but may be retrieved by other means. The number of octets
|
|
includes layer 2 header(s) and layer 2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
postMCastOctetTotalCount (ElementId #175).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
422,minimumLayer2TotalLength,unsigned64,,current,"Layer 2 length of the smallest packet observed for this Flow. The
|
|
packet length includes the length of the layer 2 header(s) and the
|
|
length of the layer 2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
minimumIpTotalLength (ElementId #25).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
423,maximumLayer2TotalLength,unsigned64,,current,"Layer 2 length of the largest packet observed for this Flow. The
|
|
packet length includes the length of the layer 2 header(s) and the length of the layer
|
|
2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
maximumIpTotalLength (ElementId #26).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
424,droppedLayer2OctetDeltaCount,unsigned64,deltaCounter,current,"The number of layer 2 octets since the previous report (if any) in
|
|
packets of this Flow dropped by packet treatment. The number of
|
|
octets includes layer 2 header(s) and layer 2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
droppedOctetDeltaCount (ElementId #132).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
425,droppedLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed layer 2 packets (including
|
|
the layer 2 header) that were dropped by packet treatment since
|
|
the (re-)initialization of the Metering Process.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
droppedOctetTotalCount (ElementId #134).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
426,ignoredLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed layer 2 packets (including
|
|
the layer 2 header) that the Metering Process did not process
|
|
since the (re-)initialization of the Metering Process.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
ignoredOctetTotalCount (ElementId #165).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
427,notSentLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed layer 2 packets (including
|
|
the layer 2 header) that the Metering Process did not process
|
|
since the (re-)initialization of the Metering Process.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
notSentOctetTotalCount (ElementId #168).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
428,layer2OctetDeltaSumOfSquares,unsigned64,deltaCounter,current,"The sum of the squared numbers of layer 2 octets per incoming
|
|
packet since the previous report (if any) for this Flow at the
|
|
Observation Point. The number of octets includes layer 2
|
|
header(s) and layer 2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
octetDeltaSumOfSquares (ElementId #198).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
429,layer2OctetTotalSumOfSquares,unsigned64,totalCounter,current,"The total sum of the squared numbers of layer 2 octets in incoming
|
|
packets for this Flow at the Observation Point since the Metering
|
|
Process (re-)initialization for this Observation Point. The
|
|
number of octets includes layer 2 header(s) and layer 2 payload.
|
|
|
|
|
|
|
|
|
|
This Information Element is the layer 2 version of
|
|
octetTotalSumOfSquares (ElementId #199).",octets,,[RFC5477],[RFC7133],1,2014-05-02
|
|
430,layer2FrameDeltaCount,unsigned64,deltaCounter,current,"The number of incoming layer 2 frames since the
|
|
previous report (if any) for this Flow at the
|
|
Observation Point.",frames,,,[ipfix-iana_at_cisco.com],0,2014-05-02
|
|
431,layer2FrameTotalCount,unsigned64,totalCounter,current,"The total number of incoming layer 2 frames
|
|
for this Flow at the Observation Point since
|
|
the Metering Process (re-)initialization for
|
|
this Observation Point.",frames,,,[ipfix-iana_at_cisco.com],0,2014-05-02
|
|
432,pseudoWireDestinationIPv4Address,ipv4Address,default,current,The destination IPv4 address of the PSN tunnel carrying the pseudowire.,,,[RFC3985],[ipfix-iana_at_cisco.com],0,2014-05-28
|
|
433,ignoredLayer2FrameTotalCount,unsigned64,totalCounter,current,"The total number of observed layer 2 frames that the Metering Process
|
|
did not process since the (re-)initialization of the Metering Process.
|
|
This Information Element is the layer 2 version of ignoredPacketTotalCount (ElementId #164).",frames,,,[ipfix-iana_at_cisco.com],0,2014-06-27
|
|
433-32767,Unassigned,,,,,,,,,,
|