These docs are for Cribl Stream 4.10 and are no longer actively maintained.
See the latest version (4.13).
ipfix-information-elements.yml
ipfix-information-elements.yml contains predefined IPFIX fields derived from the IANA IPFIX Information Elements list. This file ensures that Cribl Stream can handle and decode IPFIX fields effectively from the NetFlow & IPFIX Source.
$CRIBL_HOME/default/cribl/ipfix-information-elements.yml
iana:
description: List of Information Elements published by IANA at https://www.iana.org/assignments/ipfix/ipfix.xhtml
elements:
- elementId: 1
name: octetDeltaCount
type: unsigned64
status: current
description: The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: octets
references:
- RFC5102
- elementId: 2
name: packetDeltaCount
type: unsigned64
status: current
description: The number of incoming packets since the previous report (if any) for this Flow at the Observation Point.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: packets
references:
- RFC5102
- elementId: 3
name: deltaFlowCount
type: unsigned64
status: current
description: The conservative count of Original Flows contributing to this Aggregated Flow; may be distributed via any of the methods expressed by the valueDistributionMethod Information Element.
revision: 1
date: 2013-06-25
semantics: deltaCounter
units: flows
references:
- RFC7015
- elementId: 4
name: protocolIdentifier
type: unsigned8
status: current
description: The value of the protocol number in the IP packet header. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC791] for the specification of the IPv4 protocol field. See [RFC8200] for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at [https://www.iana.org/assignments/protocol-numbers].
references:
- RFC5102
- elementId: 5
name: ipClassOfService
type: unsigned8
status: current
description: For IPv4 packets, this is the value of the TOS field in the IPv4 packet header. For IPv6 packets, this is the value of the Traffic Class field in the IPv6 packet header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.
references:
- RFC5102
- elementId: 6
name: tcpControlBits
type: unsigned16
status: current
description: TCP control bits observed for the packets of this Flow. This information is encoded as a bit field; each TCP control bit has a corresponding bit in that field. A bit is set to 1 if any observed packet of this Flow has the corresponding TCP control bit set to 1. The bit is cleared to 0 otherwise. Per [RFC9293], the assignment of TCP control bits is managed by IANA via the "TCP Header Flags" registry [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags]. Implementers can retrieve the current TCP control bits from that registry, which is authoritative for them. As the most significant 4 bits of octets 12 and 13 (counting from zero) of the TCP header [RFC9293] are used to encode the TCP data offset (header length), the corresponding bits in this Information Element MUST be reported by the Exporter with a value of zero and MUST be ignored by the Collector. Use the tcpHeaderLength Information Element to encode this value. All TCP control bits (including those unassigned) MUST be exported as observed in the TCP headers of the packets of this Flow. If exported as a single octet with reduced-size encoding (Section 6.2 of [RFC7011]), this Information Element covers the low-order octet of this field (i.e., bit offset positions 8 to 15) [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags]. A Collector receiving this Information Element with reduced-size encoding must not assume anything about the content of the four bits with bit offset positions 4 to 7. Exporting Processes exporting this Information Element on behalf of a Metering Process that is not capable of observing any of the flags with bit offset positions 4 to 7 SHOULD use reduced-size encoding, and only export the least significant 8 bits of this Information Element. Note that previous revisions of this Information Element's definition specified that flags with bit offset positions 8 and 9 must be exported as zero, even if observed. Collectors should therefore not assume that a value of zero for these bits in this Information Element indicates the bits were never set in the observed traffic, especially if these bits are zero in every Flow Record sent by a given Exporter. Note also that the "TCP Header Flags" registry [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags] indexes the bit offset from the most significant bit of octet 12 to the least significant bit of octet 13 in the TCP header, but the tcpControlBits is encoded as a regular unsigned 16-bit integer.
revision: 2
date: 2024-01-29
semantics: flags
additionalInformation: See the assigned TCP control bits in the "TCP Header Flags" registry [https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-header-flags].
references:
- RFC9293
- RFC9565
- elementId: 7
name: sourceTransportPort
type: unsigned16
status: current
description: The source port identifier in the transport protocol header. For transport protocols such as UDP, TCP, SCTP, and DCCP, this is the source port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of the SCTP source port number field. See [RFC4340] for the definition of the DCCP source port field. See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 8
name: sourceIPv4Address
type: ipv4Address
status: current
description: The IPv4 source address in the IP packet header.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC791] for the definition of the IPv4 source address field.
references:
- RFC5102
- elementId: 9
name: sourceIPv4PrefixLength
type: unsigned8
status: current
description: The number of contiguous bits that are relevant in the sourceIPv4Prefix Information Element.
revision: 0
date: 2013-02-18
units: bits
range:
start: 0
end: 32
references:
- RFC5102
- elementId: 10
name: ingressInterface
type: unsigned32
status: current
description: The index of the IP interface where packets of this Flow are being received. The value matches the value of managed object 'ifIndex' as defined in [RFC2863]. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC2863].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC2863] for the definition of the ifIndex object.
references:
- RFC5102
- elementId: 11
name: destinationTransportPort
type: unsigned16
status: current
description: The destination port identifier in the transport protocol header. For transport protocols such as UDP, TCP, SCTP, and DCCP, this is the destination port number given in the respective header. This field MAY also be used for future transport protocols that have 16-bit destination port identifiers.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP destination port field. See [RFC9293] for the definition of the TCP destination port field. See [RFC9260] for the definition of the SCTP destination port number field. See [RFC4340] for the definition of the DCCP destination port field. See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 12
name: destinationIPv4Address
type: ipv4Address
status: current
description: The IPv4 destination address in the IP packet header.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC791] for the definition of the IPv4 destination address field.
references:
- RFC5102
- elementId: 13
name: destinationIPv4PrefixLength
type: unsigned8
status: current
description: The number of contiguous bits that are relevant in the destinationIPv4Prefix Information Element.
revision: 0
date: 2013-02-18
units: bits
range:
start: 0
end: 32
references:
- RFC5102
- elementId: 14
name: egressInterface
type: unsigned32
status: current
description: The index of the IP interface where packets of this Flow are being sent. The value matches the value of managed object 'ifIndex' as defined in [RFC2863]. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC2863].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC2863] for the definition of the ifIndex object.
references:
- RFC5102
- elementId: 15
name: ipNextHopIPv4Address
type: ipv4Address
status: current
description: The IPv4 address of the next IPv4 hop.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5102
- elementId: 16
name: bgpSourceAsNumber
type: unsigned32
status: current
description: The autonomous system (AS) number of the source IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.
references:
- RFC5102
- elementId: 17
name: bgpDestinationAsNumber
type: unsigned32
status: current
description: The autonomous system (AS) number of the destination IP address. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.
references:
- RFC5102
- elementId: 18
name: bgpNextHopIPv4Address
type: ipv4Address
status: current
description: The IPv4 address of the next (adjacent) BGP hop.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC4271] for a description of BGP-4.
references:
- RFC5102
- elementId: 19
name: postMCastPacketDeltaCount
type: unsigned64
status: current
description: The number of outgoing multicast packets since the previous report (if any) sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: packets
references:
- RFC5102
- elementId: 20
name: postMCastOctetDeltaCount
type: unsigned64
status: current
description: The number of octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: octets
references:
- RFC5102
- elementId: 21
name: flowEndSysUpTime
type: unsigned32
status: current
description: The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.
revision: 1
date: 2014-01-11
units: milliseconds
references:
- RFC5102
- elementId: 22
name: flowStartSysUpTime
type: unsigned32
status: current
description: The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.
revision: 1
date: 2014-01-11
units: milliseconds
references:
- RFC5102
- elementId: 23
name: postOctetDeltaCount
type: unsigned64
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'octetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: octets
references:
- RFC5102
- elementId: 24
name: postPacketDeltaCount
type: unsigned64
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'packetDeltaCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: packets
references:
- RFC5102
- elementId: 25
name: minimumIpTotalLength
type: unsigned64
status: current
description: Length of the smallest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC791] for the specification of the IPv4 total length. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.
references:
- RFC5102
- elementId: 26
name: maximumIpTotalLength
type: unsigned64
status: current
description: Length of the largest packet observed for this Flow. The packet length includes the IP header(s) length and the IP payload length.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC791] for the specification of the IPv4 total length. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.
references:
- RFC5102
- elementId: 27
name: sourceIPv6Address
type: ipv6Address
status: current
description: The IPv6 source address in the IP packet header.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC8200] for the definition of the Source Address field in the IPv6 header.
references:
- RFC5102
- elementId: 28
name: destinationIPv6Address
type: ipv6Address
status: current
description: The IPv6 destination address in the IP packet header.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC8200] for the definition of the Destination Address field in the IPv6 header.
references:
- RFC5102
- elementId: 29
name: sourceIPv6PrefixLength
type: unsigned8
status: current
description: The number of contiguous bits that are relevant in the sourceIPv6Prefix Information Element.
revision: 0
date: 2013-02-18
units: bits
range:
start: 0
end: 128
references:
- RFC5102
- elementId: 30
name: destinationIPv6PrefixLength
type: unsigned8
status: current
description: The number of contiguous bits that are relevant in the destinationIPv6Prefix Information Element.
revision: 0
date: 2013-02-18
units: bits
range:
start: 0
end: 128
references:
- RFC5102
- elementId: 31
name: flowLabelIPv6
type: unsigned32
status: current
description: The value of the IPv6 Flow Label field in the IP packet header.
revision: 1
date: 2014-08-13
semantics: identifier
range:
start: 0
end: 1048575
additionalInformation: See [RFC8200] for the definition of the Flow Label field in the IPv6 packet header.
references:
- RFC5102
- elementId: 32
name: icmpTypeCodeIPv4
type: unsigned16
status: current
description: Type and Code of the IPv4 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned ICMP types at [https://www.iana.org/assignments/icmp-parameters]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 33
name: igmpType
type: unsigned8
status: current
description: The type field of the IGMP message.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned IGMP type numbers at [https://www.iana.org/assignments/igmp-type-numbers/igmp-type-numbers.xhtml#igmp-type-numbers-1]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 34
name: samplingInterval
type: unsigned32
status: deprecated
description: Deprecated in favor of 305 samplingPacketInterval. When using sampled NetFlow, the rate at which packets are sampled -- e.g., a value of 100 indicates that one of every 100 packets is sampled.
revision: 0
date: 2014-04-04
semantics: quantity
units: packets
references:
- RFC7270
- elementId: 35
name: samplingAlgorithm
type: unsigned8
status: deprecated
description: 'Deprecated in favor of 304 selectorAlgorithm. The type of algorithm used for sampled NetFlow: 1 - Deterministic Sampling, 2 - Random Sampling. The values are not compatible with the selectorAlgorithm IE, where "Deterministic" has been replaced by "Systematic count-based" (1) or "Systematic time-based" (2), and "Random" is (3). Conversion is required; see [Packet Sampling (PSAMP) Parameters.]'
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 36
name: flowActiveTimeout
type: unsigned16
status: current
description: The number of seconds after which an active Flow is timed out anyway, even if there is still a continuous flow of packets.
revision: 0
date: 2013-02-18
units: seconds
references:
- RFC5102
- elementId: 37
name: flowIdleTimeout
type: unsigned16
status: current
description: A Flow is considered to be timed out if no packets belonging to the Flow have been observed for the number of seconds specified by this field.
revision: 0
date: 2013-02-18
units: seconds
references:
- RFC5102
- elementId: 38
name: engineType
type: unsigned8
status: deprecated
description: "Type of flow switching engine in a router/switch: RP = 0, VIP/Line card = 1, PFC/DFC = 2. Reserved for internal use on the Collector."
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 39
name: engineId
type: unsigned8
status: deprecated
description: Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a router/switch. Reserved for internal use on the Collector.
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 40
name: exportedOctetTotalCount
type: unsigned64
status: current
description: The total number of octets that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The value of this Information Element is calculated by summing up the IPFIX Message Header length values of all IPFIX Messages that were successfully sent to the Collecting Process. The reported number excludes octets in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of octets sent to this Collecting Process.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 41
name: exportedMessageTotalCount
type: unsigned64
status: current
description: The total number of IPFIX Messages that the Exporting Process has sent since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of IPFIX Messages sent to this Collecting Process.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: messages
references:
- RFC5102
- elementId: 42
name: exportedFlowRecordTotalCount
type: unsigned64
status: current
description: The total number of Flow Records that the Exporting Process has sent as Data Records since the Exporting Process (re-)initialization to a particular Collecting Process. The reported number excludes Flow Records in the IPFIX Message that carries the counter value. If this Information Element is sent to a particular Collecting Process, then by default it specifies the number of Flow Records sent to this process.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: flows
references:
- RFC5102
- elementId: 43
name: ipv4RouterSc
type: ipv4Address
status: deprecated
description: This is a platform-specific field for the Catalyst 5000/Catalyst 6000 family. It is used to store the address of a router that is being shortcut when performing MultiLayer Switching.
revision: 0
date: 2014-04-04
semantics: default
additionalInformation: "[CCO-MLS] describes MultiLayer Switching."
references:
- RFC7270
- elementId: 44
name: sourceIPv4Prefix
type: ipv4Address
status: current
description: IPv4 source address prefix.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5102
- elementId: 45
name: destinationIPv4Prefix
type: ipv4Address
status: current
description: IPv4 destination address prefix.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5102
- elementId: 46
name: mplsTopLabelType
type: unsigned8
status: current
description: This field identifies the control protocol that allocated the top-of-stack label. Values for this field are listed in the MPLS label type registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the IPFIX MPLS label type registry [https://www.iana.org/assignments/mpls-label-values]. See [RFC3031] for the MPLS label structure.
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 47
name: mplsTopLabelIPv4Address
type: ipv4Address
status: current
description: The IPv4 address of the system that the MPLS top label will cause this Flow to be forwarded to.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3031] for the association between MPLS labels and IP addresses.
references:
- RFC5102
- elementId: 48
name: samplerId
type: unsigned8
status: deprecated
description: Deprecated in favor of 302 selectorId. The unique identifier associated with samplerName.
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 49
name: samplerMode
type: unsigned8
status: deprecated
description: "Deprecated in favor of 304 selectorAlgorithm. The values are not compatible: selectorAlgorithm=3 is random sampling. The type of algorithm used for sampling data: 1 - Deterministic, 2 - Random Sampling. Use with samplerRandomInterval."
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 50
name: samplerRandomInterval
type: unsigned32
status: deprecated
description: Deprecated in favor of 305 samplingPacketInterval. Packet interval at which to sample -- in case of random sampling. Used in connection with the samplerMode 0x02 (random sampling) value.
revision: 0
date: 2014-04-04
semantics: quantity
references:
- RFC7270
- elementId: 51
name: classId
type: unsigned8
status: deprecated
description: Deprecated in favor of 302 selectorId. Characterizes the traffic class, i.e., QoS treatment.
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 52
name: minimumTTL
type: unsigned8
status: current
description: Minimum TTL value observed for any packet in this Flow.
revision: 0
date: 2013-02-18
units: hops
additionalInformation: See [RFC791] for the definition of the IPv4 Time to Live field. See [RFC8200] for the definition of the IPv6 Hop Limit field.
references:
- RFC5102
- elementId: 53
name: maximumTTL
type: unsigned8
status: current
description: Maximum TTL value observed for any packet in this Flow.
revision: 0
date: 2013-02-18
units: hops
additionalInformation: See [RFC791] for the definition of the IPv4 Time to Live field. See [RFC8200] for the definition of the IPv6 Hop Limit field.
references:
- RFC5102
- elementId: 54
name: fragmentIdentification
type: unsigned32
status: current
description: The value of the Identification field in the IPv4 packet header or in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC791] for the definition of the IPv4 Identification field. See [RFC8200] for the definition of the Identification field in the IPv6 Fragment header.
references:
- RFC5102
- elementId: 55
name: postIpClassOfService
type: unsigned8
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'ipClassOfService', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field. See [RFC3234] for the definition of middleboxes.
references:
- RFC5102
- elementId: 56
name: sourceMacAddress
type: macAddress
status: current
description: The IEEE 802 source MAC address field.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE.802-3.2002.
references:
- RFC5102
- elementId: 57
name: postDestinationMacAddress
type: macAddress
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'destinationMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE.802-3.2002.
references:
- RFC5102
- elementId: 58
name: vlanId
type: unsigned16
status: current
description: Virtual LAN identifier associated with ingress interface. For dot1q vlans, see 243 dot1qVlanId.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See IEEE.802-1Q.2003.
references:
- RFC5102
- elementId: 59
name: postVlanId
type: unsigned16
status: current
description: Virtual LAN identifier associated with egress interface. For postdot1q vlans, see 254, postDot1qVlanId.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See IEEE.802-1Q.2003.
references:
- RFC5102
- elementId: 60
name: ipVersion
type: unsigned8
status: current
description: The IP version field in the IP packet header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC791] for the definition of the version field in the IPv4 packet header. See [RFC8200] for the definition of the version field in the IPv6 packet header. Additional information on defined version numbers can be found at [https://www.iana.org/assignments/version-numbers].
references:
- RFC5102
- elementId: 61
name: flowDirection
type: unsigned8
status: current
description: "The direction of the Flow observed at the Observation Point. There are only two values defined. 0x00: ingress flow 0x01: egress flow"
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 62
name: ipNextHopIPv6Address
type: ipv6Address
status: current
description: The IPv6 address of the next IPv6 hop.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5102
- elementId: 63
name: bgpNextHopIPv6Address
type: ipv6Address
status: current
description: The IPv6 address of the next (adjacent) BGP hop.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC4271] for a description of BGP-4.
references:
- RFC5102
- elementId: 64
name: ipv6ExtensionHeaders
type: unsigned32
status: deprecated
description: Deprecated in favor of the ipv6ExtensionHeadersFull IE.
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: This Information Element was initially specified in [RFC5102]. [RFC7012] has obsoleted [RFC5102] and specifies that [IANA-IPFIX] is the normative reference for this Information Element. The diagram provided in [RFC5102] is incorrect; see [RFC Errata 1738].
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 70
name: mplsTopLabelStackSection
type: octetArray
status: current
description: "The Label, Exp, and S fields from the top MPLS label stack entry, i.e., from the last label that was pushed. The size of this Information Element is 3 octets. 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label | Exp |S| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Label: Label Value, 20 bits Exp: Experimental Use, 3 bits S: Bottom of Stack, 1 bit"
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 71
name: mplsLabelStackSection2
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsTopLabelStackSection. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 72
name: mplsLabelStackSection3
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection2. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 73
name: mplsLabelStackSection4
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection3. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 74
name: mplsLabelStackSection5
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection4. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 75
name: mplsLabelStackSection6
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection5. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 76
name: mplsLabelStackSection7
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection6. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 77
name: mplsLabelStackSection8
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection7. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 78
name: mplsLabelStackSection9
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection8. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 79
name: mplsLabelStackSection10
type: octetArray
status: current
description: The Label, Exp, and S fields from the label stack entry that was pushed immediately before the label stack entry that would be reported by mplsLabelStackSection9. See the definition of mplsTopLabelStackSection for further details. The size of this Information Element is 3 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3032].
references:
- RFC5102
- elementId: 80
name: destinationMacAddress
type: macAddress
status: current
description: The IEEE 802 destination MAC address field.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE.802-3.2002.
references:
- RFC5102
- elementId: 81
name: postSourceMacAddress
type: macAddress
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'sourceMacAddress', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE.802-3.2002.
references:
- RFC5102
- elementId: 82
name: interfaceName
type: string
status: current
description: A short name uniquely describing an interface, eg "Eth1/0".
revision: 0
date: 2013-02-18
semantics: default
additionalInformation: See [RFC2863] for the definition of the ifName object.
references:
- ipfix-iana_at_cisco.com
- elementId: 83
name: interfaceDescription
type: string
status: current
description: The description of an interface, eg "FastEthernet 1/0" or "ISP connection".
revision: 0
date: 2013-02-18
semantics: default
additionalInformation: See [RFC2863] for the definition of the ifDescr object.
references:
- ipfix-iana_at_cisco.com
- elementId: 84
name: samplerName
type: string
status: deprecated
description: Deprecated in favor of 335 selectorName. Name of the flow sampler.
revision: 0
date: 2014-04-04
references:
- RFC7270
- elementId: 85
name: octetTotalCount
type: unsigned64
status: current
description: The total number of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 86
name: packetTotalCount
type: unsigned64
status: current
description: The total number of incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5102
- elementId: 87
name: flagsAndSamplerId
type: unsigned32
status: deprecated
description: Flow flags and the value of the sampler ID (samplerId) combined in one bitmapped field. Reserved for internal use on the Collector.
revision: 0
date: 2014-04-04
semantics: identifier
references:
- RFC7270
- elementId: 88
name: fragmentOffset
type: unsigned16
status: current
description: The value of the IP fragment offset field in the IPv4 packet header or the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header.
revision: 1
date: 2014-08-13
semantics: quantity
range:
start: 0
end: 8191
additionalInformation: See [RFC791] for the specification of the fragment offset in the IPv4 header. See [RFC8200] for the specification of the fragment offset in the IPv6 Fragment header.
references:
- RFC5102
- elementId: 89
name: forwardingStatus
type: unsigned32
status: current
description: "This Information Element describes the forwarding status of the flow and any attached reasons. IPFIX reduced-size encoding is used as required. A structure is currently associated with the least-significant byte. Future versions may be defined to associate meanings with the remaining bits. The current version of the Information Element should be exported as unsigned8. The layout of the encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +---+---+---+---+---+---+---+---+ | Status| Reason code or flags | +---+---+---+---+---+---+---+---+ Examples: value : 0x40 = 64 binary: 01000000 decode: 01 -> Forward 000000 -> No further information value : 0x89 = 137 binary: 10001001 decode: 10 -> Drop 001001 -> Bad TTL"
revision: 2
date: 2018-02-21
semantics: identifier
additionalInformation: See "NetFlow Version 9 Flow-Record Format" [CCO-NF9FMT]. See the Forwarding Status sub-registries at [https://www.iana.org/assignments/ipfix/ipfix.xhtml#forwarding-status].
references:
- RFC Errata 5262
- RFC7270
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 90
name: mplsVpnRouteDistinguisher
type: octetArray
status: current
description: The value of the VPN route distinguisher of a corresponding entry in a VPN routing and forwarding table. Route distinguisher ensures that the same address can be used in several different MPLS VPNs and that it is possible for BGP to carry several completely different routes to that address, one for each VPN. According to [RFC4364], the size of mplsVpnRouteDistinguisher is 8 octets. However, in [RFC4382] an octet string with flexible length was chosen for representing a VPN route distinguisher by object MplsL3VpnRouteDistinguisher. This choice was made in order to be open to future changes of the size. This idea was adopted when choosing octetArray as abstract data type for this Information Element. The maximum length of this Information Element is 256 octets.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC4364] for the specification of the route distinguisher. See [RFC4382] for the specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN) Management Information Base.
references:
- RFC5102
- elementId: 91
name: mplsTopLabelPrefixLength
type: unsigned8
status: current
description: The prefix length of the subnet of the mplsTopLabelIPv4Address or mplsTopLabelIPv6Address that the MPLS top label will cause the Flow to be forwarded to.
revision: 2
date: 2014-08-13
semantics: quantity
units: bits
range:
start: 0
end: 32
additionalInformation: See [RFC3031] for the association between MPLS labels and prefix lengths.
references:
- ipfix-iana_at_cisco.com
- elementId: 92
name: srcTrafficIndex
type: unsigned32
status: current
description: BGP Policy Accounting Source Traffic Index.
revision: 0
date: 2014-04-04
semantics: identifier
additionalInformation: BGP policy accounting as described in [CCO-BGPPOL].
references:
- RFC7270
- elementId: 93
name: dstTrafficIndex
type: unsigned32
status: current
description: BGP Policy Accounting Destination Traffic Index.
revision: 0
date: 2014-04-04
semantics: identifier
additionalInformation: BGP policy accounting as described in [CCO-BGPPOL].
references:
- RFC7270
- elementId: 94
name: applicationDescription
type: string
status: current
description: Specifies the description of an application.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC6759
- elementId: 95
name: applicationId
type: octetArray
status: current
description: Specifies an Application ID per [RFC6759].
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See section 4 of [RFC6759] for the applicationId Information Element Specification.
references:
- RFC6759
- elementId: 96
name: applicationName
type: string
status: current
description: Specifies the name of an application.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 98
name: postIpDiffServCodePoint
type: unsigned8
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'ipDiffServCodePoint', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
range:
start: 0
end: 63
additionalInformation: See [RFC3260] for the definition of the Differentiated Services Field. See section 5.3.2 of [RFC1812] and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field. See the IPFIX Information Model [RFC5102] for the 'ipDiffServCodePoint' specification.
references:
- ipfix-iana_at_cisco.com
- elementId: 99
name: multicastReplicationFactor
type: unsigned32
status: current
description: The amount of multicast replication that's applied to a traffic stream.
revision: 0
date: 2013-02-18
semantics: quantity
additionalInformation: See [RFC1112] for the specification of reserved IPv4 multicast addresses. See [RFC4291] for the specification of reserved IPv6 multicast addresses.
references:
- ipfix-iana_at_cisco.com
- elementId: 100
name: className
type: string
status: deprecated
description: Deprecated in favor of 335 selectorName. Traffic Class Name, associated with the classId Information Element.
revision: 0
date: 2014-04-04
references:
- RFC7270
- elementId: 101
name: classificationEngineId
type: unsigned8
status: current
description: A unique identifier for the engine that determined the Selector ID. Thus, the Classification Engine ID defines the context for the Selector ID. The Classification Engine can be considered a specific registry for application assignments. Values for this field are listed in the Classification Engine IDs registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the Classification Engine IDs registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#classification-engine-ids]
references:
- RFC6759
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 102
name: layer2packetSectionOffset
type: unsigned16
status: deprecated
description: Deprecated in favor of 409 sectionOffset. Layer 2 packet section offset. Potentially a generic packet section offset.
revision: 0
date: 2014-04-04
semantics: quantity
references:
- RFC7270
- elementId: 103
name: layer2packetSectionSize
type: unsigned16
status: deprecated
description: Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet section size. Potentially a generic packet section size.
revision: 0
date: 2014-04-04
semantics: quantity
references:
- RFC7270
- elementId: 104
name: layer2packetSectionData
type: octetArray
status: deprecated
description: Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet section data.
revision: 0
date: 2014-04-04
references:
- RFC7270
- elementId: 128
name: bgpNextAdjacentAsNumber
type: unsigned32
status: current
description: The autonomous system (AS) number of the first AS in the AS path to the destination IP address. The path is deduced by looking up the destination IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.
references:
- RFC5102
- elementId: 129
name: bgpPrevAdjacentAsNumber
type: unsigned32
status: current
description: The autonomous system (AS) number of the last AS in the AS path from the source IP address. The path is deduced by looking up the source IP address of the Flow in the BGP routing information base. If AS path information for this Flow is only available as an unordered AS set (and not as an ordered AS sequence), then the value of this Information Element is 0. In case of BGP asymmetry, the bgpPrevAdjacentAsNumber might not be able to report the correct value.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.
references:
- RFC5102
- elementId: 130
name: exporterIPv4Address
type: ipv4Address
status: current
description: The IPv4 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5102
- elementId: 131
name: exporterIPv6Address
type: ipv6Address
status: current
description: The IPv6 address used by the Exporting Process. This is used by the Collector to identify the Exporter in cases where the identity of the Exporter may have been obscured by the use of a proxy.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5102
- elementId: 132
name: droppedOctetDeltaCount
type: unsigned64
status: current
description: The number of octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: octets
references:
- RFC5102
- elementId: 133
name: droppedPacketDeltaCount
type: unsigned64
status: current
description: The number of packets since the previous report (if any) of this Flow dropped by packet treatment.
revision: 0
date: 2013-02-18
semantics: deltaCounter
units: packets
references:
- RFC5102
- elementId: 134
name: droppedOctetTotalCount
type: unsigned64
status: current
description: The total number of octets in packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 135
name: droppedPacketTotalCount
type: unsigned64
status: current
description: The number of packets of this Flow dropped by packet treatment since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5102
- elementId: 136
name: flowEndReason
type: unsigned8
status: current
description: The reason for Flow termination. Values are listed in the flowEndReason registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the flowEndReason registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flow-end-reason].
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 137
name: commonPropertiesId
type: unsigned64
status: current
description: An identifier of a set of common properties that is unique per Observation Domain and Transport Session. Typically, this Information Element is used to link to information reported in separate Data Records.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 138
name: observationPointId
type: unsigned64
status: current
description: An identifier of an Observation Point that is unique per Observation Domain. It is RECOMMENDED that this identifier is also unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements.
revision: 1
date: 2013-04-11
semantics: identifier
references:
- RFC5102
- ipfix-iana_at_cisco.com
- elementId: 139
name: icmpTypeCodeIPv6
type: unsigned16
status: current
description: Type and Code of the IPv6 ICMP message. The combination of both values is reported as (ICMP type * 256) + ICMP code.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned ICMPv6 types and codes at [https://www.iana.org/assignments/icmpv6-parameters]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 140
name: mplsTopLabelIPv6Address
type: ipv6Address
status: current
description: The IPv6 address of the system that the MPLS top label will cause this Flow to be forwarded to.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC3031] for the association between MPLS labels and IP addresses.
references:
- RFC5102
- elementId: 141
name: lineCardId
type: unsigned32
status: current
description: An identifier of a line card that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 142
name: portId
type: unsigned32
status: current
description: An identifier of a line port that is unique per IPFIX Device hosting an Observation Point. Typically, this Information Element is used for limiting the scope of other Information Elements.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 143
name: meteringProcessId
type: unsigned32
status: current
description: An identifier of a Metering Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Metering Process may be re-started with a different ID.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 144
name: exportingProcessId
type: unsigned32
status: current
description: An identifier of an Exporting Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers are typically assigned dynamically. The Exporting Process may be re-started with a different ID.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 145
name: templateId
type: unsigned16
status: current
description: An identifier of a Template that is locally unique within a combination of a Transport session and an Observation Domain. Template IDs 0-255 are reserved for Template Sets, Options Template Sets, and other reserved Sets yet to be created. Template IDs of Data Sets are numbered from 256 to 65535. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that after a re-start of the Exporting Process Template identifiers may be re-assigned.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 146
name: wlanChannelId
type: unsigned8
status: current
description: The identifier of the 802.11 (Wi-Fi) channel used.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See IEEE.802-11.1999.
references:
- RFC5102
- elementId: 147
name: wlanSSID
type: string
status: current
description: The Service Set IDentifier (SSID) identifying an 802.11 (Wi-Fi) network used. According to IEEE.802-11.1999, the SSID is encoded into a string of up to 32 characters.
revision: 0
date: 2013-02-18
semantics: default
additionalInformation: See IEEE.802-11.1999.
references:
- RFC5102
- elementId: 148
name: flowId
type: unsigned64
status: current
description: An identifier of a Flow that is unique within an Observation Domain. This Information Element can be used to distinguish between different Flows if Flow Keys such as IP addresses and port numbers are not reported or are reported in separate records.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 149
name: observationDomainId
type: unsigned32
status: current
description: An identifier of an Observation Domain that is locally unique to an Exporting Process. The Exporting Process uses the Observation Domain ID to uniquely identify to the Collecting Process the Observation Domain where Flows were metered. It is RECOMMENDED that this identifier is also unique per IPFIX Device. A value of 0 indicates that no specific Observation Domain is identified by this Information Element. Typically, this Information Element is used for limiting the scope of other Information Elements.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5102
- elementId: 150
name: flowStartSeconds
type: dateTimeSeconds
status: current
description: The absolute timestamp of the first packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: seconds
references:
- RFC5102
- elementId: 151
name: flowEndSeconds
type: dateTimeSeconds
status: current
description: The absolute timestamp of the last packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: seconds
references:
- RFC5102
- elementId: 152
name: flowStartMilliseconds
type: dateTimeMilliseconds
status: current
description: The absolute timestamp of the first packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- RFC5102
- elementId: 153
name: flowEndMilliseconds
type: dateTimeMilliseconds
status: current
description: The absolute timestamp of the last packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- RFC5102
- elementId: 154
name: flowStartMicroseconds
type: dateTimeMicroseconds
status: current
description: The absolute timestamp of the first packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: microseconds
references:
- RFC5102
- elementId: 155
name: flowEndMicroseconds
type: dateTimeMicroseconds
status: current
description: The absolute timestamp of the last packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: microseconds
references:
- RFC5102
- elementId: 156
name: flowStartNanoseconds
type: dateTimeNanoseconds
status: current
description: The absolute timestamp of the first packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: nanoseconds
references:
- RFC5102
- elementId: 157
name: flowEndNanoseconds
type: dateTimeNanoseconds
status: current
description: The absolute timestamp of the last packet of this Flow.
revision: 0
date: 2013-02-18
semantics: default
units: nanoseconds
references:
- RFC5102
- elementId: 158
name: flowStartDeltaMicroseconds
type: unsigned32
status: current
description: This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the first observed packet of this Flow relative to the export time specified in the IPFIX Message Header.
revision: 0
date: 2013-02-18
units: microseconds
additionalInformation: See the [IPFIX protocol specification] for the definition of the IPFIX Message Header.
references:
- RFC5102
- elementId: 159
name: flowEndDeltaMicroseconds
type: unsigned32
status: current
description: This is a relative timestamp only valid within the scope of a single IPFIX Message. It contains the negative time offset of the last observed packet of this Flow relative to the export time specified in the IPFIX Message Header.
revision: 0
date: 2013-02-18
units: microseconds
additionalInformation: See the [IPFIX protocol specification] for the definition of the IPFIX Message Header.
references:
- RFC5102
- elementId: 160
name: systemInitTimeMilliseconds
type: dateTimeMilliseconds
status: current
description: The absolute timestamp of the last (re-)initialization of the IPFIX Device.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- RFC5102
- elementId: 161
name: flowDurationMilliseconds
type: unsigned32
status: current
description: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.
revision: 0
date: 2013-02-18
units: milliseconds
references:
- RFC5102
- elementId: 162
name: flowDurationMicroseconds
type: unsigned32
status: current
description: The difference in time between the first observed packet of this Flow and the last observed packet of this Flow.
revision: 0
date: 2013-02-18
units: microseconds
references:
- RFC5102
- elementId: 163
name: observedFlowTotalCount
type: unsigned64
status: current
description: The total number of Flows observed in the Observation Domain since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: flows
references:
- RFC5102
- elementId: 164
name: ignoredPacketTotalCount
type: unsigned64
status: current
description: The total number of observed IP packets that the Metering Process did not process since the (re-)initialization of the Metering Process.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5102
- elementId: 165
name: ignoredOctetTotalCount
type: unsigned64
status: current
description: The total number of octets in observed IP packets (including the IP header) that the Metering Process did not process since the (re-)initialization of the Metering Process.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 166
name: notSentFlowTotalCount
type: unsigned64
status: current
description: The total number of Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: flows
references:
- RFC5102
- elementId: 167
name: notSentPacketTotalCount
type: unsigned64
status: current
description: The total number of packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5102
- elementId: 168
name: notSentOctetTotalCount
type: unsigned64
status: current
description: The total number of octets in packets in Flow Records that were generated by the Metering Process and dropped by the Metering Process or by the Exporting Process instead of being sent to the Collecting Process. There are several potential reasons for this including resource shortage and special Flow export policies.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 169
name: destinationIPv6Prefix
type: ipv6Address
status: current
description: IPv6 destination address prefix.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5102
- elementId: 170
name: sourceIPv6Prefix
type: ipv6Address
status: current
description: IPv6 source address prefix.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5102
- elementId: 171
name: postOctetTotalCount
type: unsigned64
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'octetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 172
name: postPacketTotalCount
type: unsigned64
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'packetTotalCount', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5102
- elementId: 173
name: flowKeyIndicator
type: unsigned64
status: current
description: This set of bit fields is used for marking the Information Elements of a Data Record that serve as Flow Key. Each bit represents an Information Element in the Data Record, with the n-th least significant bit representing the n-th Information Element. A bit set to value 1 indicates that the corresponding Information Element is a Flow Key of the reported Flow. A bit set to value 0 indicates that this is not the case. If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all Flow Keys are among the first 64 Information Elements, because the flowKeyIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the bits in the flowKeyIndicator for which no corresponding Information Element exists MUST have the value 0.
revision: 1
date: 2017-08-01
semantics: flags
references:
- RFC5102
- RFC Errata 4984
- elementId: 174
name: postMCastPacketTotalCount
type: unsigned64
status: current
description: The total number of outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5102
- elementId: 175
name: postMCastOctetTotalCount
type: unsigned64
status: current
description: The total number of octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point, but may be retrieved by other means. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: octets
references:
- RFC5102
- elementId: 176
name: icmpTypeIPv4
type: unsigned8
status: current
description: Type of the IPv4 ICMP message.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned ICMP types at [https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-types]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 177
name: icmpCodeIPv4
type: unsigned8
status: current
description: Code of the IPv4 ICMP message.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned ICMP codes at [https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-codes]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 178
name: icmpTypeIPv6
type: unsigned8
status: current
description: Type of the IPv6 ICMP message.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned ICMPv6 types at [https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-2]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 179
name: icmpCodeIPv6
type: unsigned8
status: current
description: Code of the IPv6 ICMP message.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned ICMPv6 codes at [https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-3]
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 180
name: udpSourcePort
type: unsigned16
status: current
description: The source port identifier in the UDP header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP source port field. Additional information on defined UDP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- elementId: 181
name: udpDestinationPort
type: unsigned16
status: current
description: The destination port identifier in the UDP header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP destination port field. Additional information on defined UDP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- elementId: 182
name: tcpSourcePort
type: unsigned16
status: current
description: The source port identifier in the TCP header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC9293] for the definition of the TCP source port field. Additional information on defined TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- elementId: 183
name: tcpDestinationPort
type: unsigned16
status: current
description: The destination port identifier in the TCP header.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC9293] for the definition of the TCP destination port field. Additional information on defined TCP port numbers can be found at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- elementId: 184
name: tcpSequenceNumber
type: unsigned32
status: current
description: The sequence number in the TCP header.
revision: 0
date: 2013-02-18
additionalInformation: See [RFC9293] for the definition of the TCP sequence number.
references:
- RFC5102
- elementId: 185
name: tcpAcknowledgementNumber
type: unsigned32
status: current
description: The acknowledgement number in the TCP header.
revision: 0
date: 2013-02-18
additionalInformation: See [RFC9293] for the definition of the TCP acknowledgement number.
references:
- RFC5102
- elementId: 186
name: tcpWindowSize
type: unsigned16
status: current
description: The window field in the TCP header. If the TCP window scale is supported, then TCP window scale must be known to fully interpret the value of this information.
revision: 0
date: 2013-02-18
additionalInformation: See [RFC9293] for the definition of the TCP window field. See [RFC1323] for the definition of the TCP window scale.
references:
- RFC5102
- elementId: 187
name: tcpUrgentPointer
type: unsigned16
status: current
description: The urgent pointer in the TCP header.
revision: 0
date: 2013-02-18
additionalInformation: See [RFC9293] for the definition of the TCP urgent pointer.
references:
- RFC5102
- elementId: 188
name: tcpHeaderLength
type: unsigned8
status: current
description: The length of the TCP header. Note that the value of this Information Element is different from the value of the Data Offset field in the TCP header. The Data Offset field indicates the length of the TCP header in units of 4 octets. This Information Elements specifies the length of the TCP header in units of octets.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC9293] for the definition of the TCP header.
references:
- RFC5102
- elementId: 189
name: ipHeaderLength
type: unsigned8
status: current
description: The length of the IP header. For IPv6, the value of this Information Element is 40.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC791] for the definition of the IPv4 header. See [RFC8200] for the definition of the IPv6 header.
references:
- RFC5102
- elementId: 190
name: totalLengthIPv4
type: unsigned16
status: current
description: The total length of the IPv4 packet.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC791] for the specification of the IPv4 total length.
references:
- RFC5102
- elementId: 191
name: payloadLengthIPv6
type: unsigned16
status: current
description: This Information Element reports the value of the Payload Length field in the IPv6 header. Note that IPv6 extension headers belong to the payload. Also note that in case of a jumbo payload option the value of the Payload Length field in the IPv6 header is zero and so will be the value reported by this Information Element.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload option.
references:
- RFC5102
- elementId: 192
name: ipTTL
type: unsigned8
status: current
description: For IPv4, the value of the Information Element matches the value of the Time to Live (TTL) field in the IPv4 packet header. For IPv6, the value of the Information Element matches the value of the Hop Limit field in the IPv6 packet header.
revision: 0
date: 2013-02-18
units: hops
additionalInformation: See [RFC791] for the definition of the IPv4 Time to Live field. See [RFC2675] for the definition of the IPv6 Hop Limit field.
references:
- RFC5102
- elementId: 193
name: nextHeaderIPv6
type: unsigned8
status: current
description: The value of the Next Header field of the IPv6 header. The value identifies the type of the following IPv6 extension header or of the following IP payload. Valid values are defined in the IANA Protocol Numbers registry.
revision: 0
date: 2013-02-18
additionalInformation: See [RFC8200] for the definition of the IPv6 Next Header field. See the list of protocol numbers assigned by IANA at [https://www.iana.org/assignments/protocol-numbers].
references:
- RFC5102
- elementId: 194
name: mplsPayloadLength
type: unsigned32
status: current
description: The size of the MPLS packet without the label stack.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack.
references:
- RFC5102
- elementId: 195
name: ipDiffServCodePoint
type: unsigned8
status: current
description: The value of a Differentiated Services Code Point (DSCP) encoded in the Differentiated Services field. The Differentiated Services field spans the most significant 6 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively. This Information Element encodes only the 6 bits of the Differentiated Services field. Therefore, its value may range from 0 to 63.
revision: 0
date: 2013-02-18
semantics: identifier
range:
start: 0
end: 63
additionalInformation: See [RFC3260] for the definition of the Differentiated Services field. See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.
references:
- RFC5102
- elementId: 196
name: ipPrecedence
type: unsigned8
status: current
description: The value of the IP Precedence. The IP Precedence value is encoded in the first 3 bits of the IPv4 TOS field or the IPv6 Traffic Class field, respectively. This Information Element encodes only these 3 bits. Therefore, its value may range from 0 to 7.
revision: 0
date: 2013-02-18
semantics: identifier
range:
start: 0
end: 7
additionalInformation: See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of the IP Precedence. See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.
references:
- RFC5102
- elementId: 197
name: fragmentFlags
type: unsigned8
status: current
description: "Fragmentation properties indicated by flags in the IPv4 packet header or the IPv6 Fragment header, respectively. Bit 0: (RS) Reserved. The value of this bit MUST be 0 until specified otherwise. Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. Corresponds to the value of the DF flag in the IPv4 header. Will always be 0 for IPv6 unless a \"don't fragment\" feature is introduced to IPv6. Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. Corresponds to the MF flag in the IPv4 header or to the M flag in the IPv6 Fragment header, respectively. The value is 0 for IPv6 if there is no fragment header. Bits 3-7: (DC) Don't Care. The values of these bits are irrelevant. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | R | D | M | D | D | D | D | D | | S | F | F | C | C | C | C | C | +---+---+---+---+---+---+---+---+"
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: See [RFC791] for the specification of the IPv4 fragment flags. See [RFC8200] for the specification of the IPv6 Fragment header.
references:
- RFC5102
- elementId: 198
name: octetDeltaSumOfSquares
type: unsigned64
status: current
description: The sum of the squared numbers of octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
references:
- RFC5102
- elementId: 199
name: octetTotalSumOfSquares
type: unsigned64
status: current
description: The total sum of the squared numbers of octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes IP header(s) and IP payload.
revision: 0
date: 2013-02-18
units: octets
references:
- RFC5102
- elementId: 200
name: mplsTopLabelTTL
type: unsigned8
status: current
description: The TTL field from the top MPLS label stack entry, i.e., the last label that was pushed.
revision: 0
date: 2013-02-18
units: hops
additionalInformation: See [RFC3032] for the specification of the TTL field.
references:
- RFC5102
- elementId: 201
name: mplsLabelStackLength
type: unsigned32
status: current
description: The length of the MPLS label stack in units of octets.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC3032] for the specification of the MPLS label stack.
references:
- RFC5102
- elementId: 202
name: mplsLabelStackDepth
type: unsigned32
status: current
description: The number of labels in the MPLS label stack.
revision: 0
date: 2013-02-18
units: entries
additionalInformation: See [RFC3032] for the specification of the MPLS label stack.
references:
- RFC5102
- elementId: 203
name: mplsTopLabelExp
type: unsigned8
status: current
description: "The Exp field from the top MPLS label stack entry, i.e., the last label that was pushed. Bits 0-4: Don't Care, value is irrelevant. Bits 5-7: MPLS Exp field. 0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | don't care | Exp | +---+---+---+---+---+---+---+---+"
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: See [RFC3032] for the specification of the Exp field. See [RFC3270] for usage of the Exp field.
references:
- RFC5102
- elementId: 204
name: ipPayloadLength
type: unsigned32
status: current
description: The effective length of the IP payload. For IPv4 packets, the value of this Information Element is the difference between the total length of the IPv4 packet (as reported by Information Element totalLengthIPv4) and the length of the IPv4 header (as reported by Information Element headerLengthIPv4). For IPv6, the value of the Payload Length field in the IPv6 header is reported except in the case that the value of this field is zero and that there is a valid jumbo payload option. In this case, the value of the Jumbo Payload Length field in the jumbo payload option is reported.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC791] for the specification of IPv4 packets. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.
references:
- RFC5102
- elementId: 205
name: udpMessageLength
type: unsigned16
status: current
description: The value of the Length field in the UDP header.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC768] for the specification of the UDP header.
references:
- RFC5102
- elementId: 206
name: isMulticast
type: unsigned8
status: current
description: "If the IP destination address is not a reserved multicast address, then the value of all bits of the octet (including the reserved ones) is zero. The first bit of this octet is set to 1 if the Version field of the IP header has the value 4 and if the Destination Address field contains a reserved multicast address in the range from 224.0.0.0 to 239.255.255.255. Otherwise, this bit is set to 0. The second and third bits of this octet are reserved for future use. The remaining bits of the octet are only set to values other than zero if the IP Destination Address is a reserved IPv6 multicast address. Then the fourth bit of the octet is set to the value of the T flag in the IPv6 multicast address and the remaining four bits are set to the value of the scope field in the IPv6 multicast address. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ | IPv6 multicast scope | T | RES. | RES. | MCv4 | +------+------+------+------+------+------+------+------+ Bits 0-3: set to value of multicast scope if IPv6 multicast Bit 4: set to value of T flag, if IPv6 multicast Bits 5-6: reserved for future use Bit 7: set to 1 if IPv4 multicast"
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: See [RFC1112] for the specification of reserved IPv4 multicast addresses. See [RFC4291] for the specification of reserved IPv6 multicast addresses and the definition of the T flag and the IPv6 multicast scope. The diagram provided in [RFC5102] is incorrect. The diagram in this registry is taken from Errata 1736. See [RFC Errata 1736].
references:
- RFC5102
- elementId: 207
name: ipv4IHL
type: unsigned8
status: current
description: The value of the Internet Header Length (IHL) field in the IPv4 header. It specifies the length of the header in units of 4 octets. Please note that its unit is different from most of the other Information Elements reporting length values.
revision: 0
date: 2013-02-18
units: 4-octet words
additionalInformation: See [RFC791] for the specification of the IPv4 header.
references:
- RFC5102
- elementId: 208
name: ipv4Options
type: unsigned32
status: current
description: IPv4 options in packets of this Flow. The information is encoded in a set of bit fields. For each valid IPv4 option type, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv4 option type. Otherwise, if no observed packet of this Flow contained the respective IPv4 option type, the value of the corresponding bit is 0. The list of valid IPv4 options is maintained by IANA. Note that for identifying an option not just the 5-bit Option Number, but all 8 bits of the Option Type need to match one of the IPv4 options specified at http://www.iana.org/assignments/ip-parameters. Options are mapped to bits according to their option numbers. Option number X is mapped to bit X. The mapping is illustrated by the figure below. 0 1 2 3 4 5 6 7 +------+------+------+------+------+------+------+------+ ... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL | +------+------+------+------+------+------+------+------+ 8 9 10 11 12 13 14 15 +------+------+------+------+------+------+------+------+ ... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ... +------+------+------+------+------+------+------+------+ 16 17 18 19 20 21 22 23 +------+------+------+------+------+------+------+------+ ... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ... +------+------+------+------+------+------+------+------+ 24 25 26 27 28 29 30 31 +------+------+------+------+------+------+------+------+ ... | | EXP | to be assigned by IANA | QS | UMP | +------+------+------+------+------+------+------+------+ Type Option Bit Value Name Reference ---+-----+-------+------------------------------------ 0 7 RR Record Route, RFC 791 1 134 CIPSO Commercial Security 2 133 E-SEC Extended Security, RFC 1108 3 68 TS Time Stamp, RFC 791 4 131 LSR Loose Source Route, RFC791 5 130 SEC Security, RFC 1108 6 1 NOP No Operation, RFC 791 7 0 EOOL End of Options List, RFC 791 8 15 ENCODE 9 142 VISA Experimental Access Control 10 205 FINN Experimental Flow Control 11 12 MTUR (obsoleted) MTU Reply, RFC 1191 12 11 MTUP (obsoleted) MTU Probe, RFC 1191 13 10 ZSU Experimental Measurement 14 137 SSR Strict Source Route, RFC 791 15 136 SID Stream ID, RFC 791 16 151 DPS Dynamic Packet State 17 150 NSAPA NSAP Address 18 149 SDB Selective Directed Broadcast 19 147 ADDEXT Address Extension 20 148 RTRALT Router Alert, RFC 2113 21 82 TR Traceroute, RFC 3193 22 145 EIP Extended Internet Protocol, RFC 1385 23 144 IMITD IMI Traffic Descriptor 25 30 EXP RFC3692-style Experiment 25 94 EXP RFC3692-style Experiment 25 158 EXP RFC3692-style Experiment 25 222 EXP RFC3692-style Experiment 30 25 QS Quick-Start 31 152 UMP Upstream Multicast Pkt. ... ... ... Further options numbers may be assigned by IANA
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: See [RFC791] for the definition of IPv4 options. See the list of IPv4 option numbers assigned by IANA at [https://www.iana.org/assignments/ip-parameters]. The diagram provided in [RFC5102] is incorrect. The diagram in this registry is taken from Errata 1737. See [RFC Errata 1737] .
references:
- RFC5102
- elementId: 209
name: tcpOptions
type: unsigned64
status: deprecated
description: Deprecated in favor of the tcpOptionsFull IE.
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: This Information Element was initially specified in [RFC5102]. [RFC7012] has obsoleted [RFC5102] and specifies that [IANA-IPFIX] is the normative reference for this Information Element. The diagram provided in [RFC5102] is incorrect; see [RFC Errata 1739].
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 210
name: paddingOctets
type: octetArray
status: current
description: The value of this Information Element is always a sequence of 0x00 values.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5102
- elementId: 211
name: collectorIPv4Address
type: ipv4Address
status: current
description: An IPv4 address to which the Exporting Process sends Flow information.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5102
- elementId: 212
name: collectorIPv6Address
type: ipv6Address
status: current
description: An IPv6 address to which the Exporting Process sends Flow information.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5102
- elementId: 213
name: exportInterface
type: unsigned32
status: current
description: The index of the interface from which IPFIX Messages sent by the Exporting Process to a Collector leave the IPFIX Device. The value matches the value of managed object 'ifIndex' as defined in [RFC2863]. Note that ifIndex values are not assigned statically to an interface and that the interfaces may be renumbered every time the device's management system is re-initialized, as specified in [RFC2863].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC2863] for the definition of the ifIndex object.
references:
- RFC5102
- elementId: 214
name: exportProtocolVersion
type: unsigned8
status: current
description: The protocol version used by the Exporting Process for sending Flow information. The protocol version is given by the value of the Version Number field in the Message Header. The protocol version is 10 for IPFIX and 9 for NetFlow version 9. A value of 0 indicates that no export protocol is in use.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the [IPFIX protocol specification] for the definition of the IPFIX Message Header. See [RFC3954] for the definition of the NetFlow version 9 message header.
references:
- RFC5102
- elementId: 215
name: exportTransportProtocol
type: unsigned8
status: current
description: The value of the protocol number used by the Exporting Process for sending Flow information. The protocol number identifies the IP packet payload type. Protocol numbers are defined in the IANA Protocol Numbers registry. In Internet Protocol version 4 (IPv4), this is carried in the Protocol field. In Internet Protocol version 6 (IPv6), this is carried in the Next Header field in the last extension header of the packet.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC791] for the specification of the IPv4 protocol field. See [RFC8200] for the specification of the IPv6 protocol field. See the list of protocol numbers assigned by IANA at [https://www.iana.org/assignments/protocol-numbers].
references:
- RFC5102
- elementId: 216
name: collectorTransportPort
type: unsigned16
status: current
description: The destination port identifier to which the Exporting Process sends Flow information. For transport protocols such as UDP, TCP, and SCTP, this is the destination port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP destination port field. See [RFC9293] for the definition of the TCP destination port field. See [RFC9260] for the definition of the SCTP destination port number field. See the assigned transport protocol (e.g., UDP, TCP, and SCTP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 217
name: exporterTransportPort
type: unsigned16
status: current
description: The source port identifier from which the Exporting Process sends Flow information. For transport protocols such as UDP, TCP, and SCTP, this is the source port number. This field MAY also be used for future transport protocols that have 16-bit source port identifiers.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of the SCTP source port number field. See the assigned transport protocol (e.g., UDP, TCP, and SCTP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- RFC5102
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 218
name: tcpSynTotalCount
type: unsigned64
status: current
description: The total number of packets of this Flow with TCP "Synchronize sequence numbers" (SYN) flag set.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
additionalInformation: See [RFC9293] for the definition of the TCP SYN flag.
references:
- RFC5102
- elementId: 219
name: tcpFinTotalCount
type: unsigned64
status: current
description: The total number of packets of this Flow with TCP "No more data from sender" (FIN) flag set.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
additionalInformation: See [RFC9293] for the definition of the TCP FIN flag.
references:
- RFC5102
- elementId: 220
name: tcpRstTotalCount
type: unsigned64
status: current
description: The total number of packets of this Flow with TCP "Reset the connection" (RST) flag set.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
additionalInformation: See [RFC9293] for the definition of the TCP RST flag.
references:
- RFC5102
- elementId: 221
name: tcpPshTotalCount
type: unsigned64
status: current
description: The total number of packets of this Flow with TCP "Push Function" (PSH) flag set.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
additionalInformation: See [RFC9293] for the definition of the TCP PSH flag.
references:
- RFC5102
- elementId: 222
name: tcpAckTotalCount
type: unsigned64
status: current
description: The total number of packets of this Flow with TCP "Acknowledgment field significant" (ACK) flag set.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
additionalInformation: See [RFC9293] for the definition of the TCP ACK flag.
references:
- RFC5102
- elementId: 223
name: tcpUrgTotalCount
type: unsigned64
status: current
description: The total number of packets of this Flow with TCP "Urgent Pointer field significant" (URG) flag set.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
additionalInformation: See [RFC9293] for the definition of the TCP URG flag.
references:
- RFC5102
- elementId: 224
name: ipTotalLength
type: unsigned64
status: current
description: The total length of the IP packet.
revision: 0
date: 2013-02-18
units: octets
additionalInformation: See [RFC791] for the specification of the IPv4 total length. See [RFC8200] for the specification of the IPv6 payload length. See [RFC2675] for the specification of the IPv6 jumbo payload length.
references:
- RFC5102
- elementId: 225
name: postNATSourceIPv4Address
type: ipv4Address
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'sourceIPv4Address', except that it reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- ipfix-iana_at_cisco.com
- elementId: 226
name: postNATDestinationIPv4Address
type: ipv4Address
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'destinationIPv4Address', except that it reports a modified value caused by a NAT middlebox function after the packet passed the Observation Point.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See [RFC791] for the definition of the IPv4 destination address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- ipfix-iana_at_cisco.com
- elementId: 227
name: postNAPTSourceTransportPort
type: unsigned16
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'sourceTransportPort', except that it reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of SCTP. See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes. See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- ipfix-iana_at_cisco.com
- elementId: 228
name: postNAPTDestinationTransportPort
type: unsigned16
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'destinationTransportPort', except that it reports a modified value caused by a Network Address Port Translation (NAPT) middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC768] for the definition of the UDP source port field. See [RFC9293] for the definition of the TCP source port field. See [RFC9260] for the definition of SCTP. See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes. See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- ipfix-iana_at_cisco.com
- elementId: 229
name: natOriginatingAddressRealm
type: unsigned8
status: current
description: Indicates whether the session was created because traffic originated in the private or public address realm. postNATSourceIPv4Address, postNATDestinationIPv4Address, postNAPTSourceTransportPort, and postNAPTDestinationTransportPort are qualified with the address realm in perspective. Values are listed in the natOriginatingAddressRealm registry.
revision: 1
date: 2014-08-13
semantics: identifier
range:
start: 1
end: 2
additionalInformation: See the natOriginatingAddressRealm registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-originating-address-realm]. See [RFC3022] for the definition of NAT.
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 230
name: natEvent
type: unsigned8
status: current
description: This Information Element identifies a NAT event. This IE identifies the type of a NAT event. Examples of NAT events include, but are not limited to, NAT translation create, NAT translation delete, Threshold Reached, or Threshold Exceeded, etc. Values for this Information Element are listed in the "NAT Event Type" registry.
revision: 2
date: 2017-03-15
semantics: identifier
additionalInformation: See the NAT Event Type registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-event-type]. See [RFC3022] for the definition of NAT. See [RFC8158] for the definitions of values 4-16.
references:
- RFC8158
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 231
name: initiatorOctets
type: unsigned64
status: current
description: The total number of layer 4 payload bytes in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: octets
additionalInformation: "See #298, initiatorPackets."
references:
- ipfix-iana_at_cisco.com
- elementId: 232
name: responderOctets
type: unsigned64
status: current
description: The total number of layer 4 payload bytes in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: octets
additionalInformation: "See #299, responderPackets."
references:
- ipfix-iana_at_cisco.com
- elementId: 233
name: firewallEvent
type: unsigned8
status: current
description: Indicates a firewall event. Allowed values are listed in the firewallEvent registry.
revision: 0
date: 2013-02-18
additionalInformation: See the firewallEvent registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-firewall-event].
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 234
name: ingressVRFID
type: unsigned32
status: current
description: An unique identifier of the VRFname where the packets of this flow are being received. This identifier is unique per Metering Process
revision: 0
date: 2013-02-18
references:
- ipfix-iana_at_cisco.com
- elementId: 235
name: egressVRFID
type: unsigned32
status: current
description: An unique identifier of the VRFname where the packets of this flow are being sent. This identifier is unique per Metering Process
revision: 0
date: 2013-02-18
references:
- ipfix-iana_at_cisco.com
- elementId: 236
name: VRFname
type: string
status: current
description: The name of a VPN Routing and Forwarding table (VRF).
revision: 0
date: 2013-02-18
semantics: default
additionalInformation: See [RFC4364] for the definition of VRF.
references:
- ipfix-iana_at_cisco.com
- elementId: 237
name: postMplsTopLabelExp
type: unsigned8
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'mplsTopLabelExp', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: flags
additionalInformation: See [RFC3032] for the specification of the Exp field. See [RFC3270] for usage of the Exp field.
references:
- RFC5102
- elementId: 238
name: tcpWindowScale
type: unsigned16
status: current
description: The scale of the window field in the TCP header.
revision: 0
date: 2013-02-18
additionalInformation: See [RFC1323] for the definition of the TCP window scale.
references:
- RFC5102
- elementId: 239
name: biflowDirection
type: unsigned8
status: current
description: A description of the direction assignment method used to assign the Biflow Source and Destination. This Information Element MAY be present in a Flow Data Record, or applied to all flows exported from an Exporting Process or Observation Domain using IPFIX Options. If this Information Element is not present in a Flow Record or associated with a Biflow via scope, it is assumed that the configuration of the direction assignment method is done out-of-band. Note that when using IPFIX Options to apply this Information Element to all flows within an Observation Domain or from an Exporting Process, the Option SHOULD be sent reliably. If reliable transport is not available (i.e., when using UDP), this Information Element SHOULD appear in each Flow Record. Values are listed in the biflowDirection registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the biflowDirection registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-biflow-direction].
references:
- RFC5103
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 240
name: ethernetHeaderLength
type: unsigned8
status: current
description: The difference between the length of an Ethernet frame (minus the FCS) and the length of its MAC Client Data section (including any padding) as defined in section 3.1 of [IEEE.802-3.2005]. It does not include the Preamble, SFD and Extension field lengths.
revision: 1
date: 2014-08-13
semantics: quantity
units: octets
additionalInformation: "[IEEE.802-3.2005]"
references:
- ipfix-iana_at_cisco.com
- elementId: 241
name: ethernetPayloadLength
type: unsigned16
status: current
description: The length of the MAC Client Data section (including any padding) of a frame as defined in section 3.1 of [IEEE.802-3.2005].
revision: 1
date: 2014-08-13
semantics: quantity
units: octets
additionalInformation: "[IEEE.802-3.2005]"
references:
- ipfix-iana_at_cisco.com
- elementId: 242
name: ethernetTotalLength
type: unsigned16
status: current
description: The total length of the Ethernet frame (excluding the Preamble, SFD, Extension and FCS fields) as described in section 3.1 of [IEEE.802-3.2005].
revision: 1
date: 2014-08-13
semantics: quantity
units: octets
additionalInformation: "[IEEE.802-3.2005]"
references:
- ipfix-iana_at_cisco.com
- elementId: 243
name: dot1qVlanId
type: unsigned16
status: current
description: The value of the 12-bit VLAN Identifier portion of the Tag Control Information field of an Ethernet frame. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q]. In Provider Bridged Networks, it represents the Service VLAN identifier in the Service VLAN Tag (S-TAG) Tag Control Information (TCI) field or the Customer VLAN identifier in the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q]. In Provider Backbone Bridged Networks, it represents the Backbone VLAN identifier in the Backbone VLAN Tag (B-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q]. In a virtual link between a host system and EVB bridge, it represents the Service VLAN identifier indicating S-channel as described in [IEEE802.1Qbg]. In the case of a multi-tagged frame, it represents the outer tag's VLAN identifier, except for I-TAG.
revision: 2
date: 2014-01-11
semantics: identifier
additionalInformation: "[IEEE802.1Q][IEEE802.1Qbg]"
references:
- ipfix-iana_at_cisco.com
- RFC7133
- elementId: 244
name: dot1qPriority
type: unsigned8
status: current
description: The value of the 3-bit User Priority portion of the Tag Control Information field of an Ethernet frame. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q]. In the case of multi-tagged frame, it represents the 3-bit Priority Code Point (PCP) portion of the outer tag's Tag Control Information (TCI) field as described in [IEEE802.1Q], except for I-TAG.
revision: 1
date: 2014-01-11
semantics: identifier
additionalInformation: "[IEEE802.1Q]"
references:
- ipfix-iana_at_cisco.com
- RFC7133
- elementId: 245
name: dot1qCustomerVlanId
type: unsigned16
status: current
description: The value represents the Customer VLAN identifier in the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q].
revision: 1
date: 2014-01-11
semantics: identifier
additionalInformation: "[IEEE802.1Q]"
references:
- ipfix-iana_at_cisco.com
- RFC7133
- elementId: 246
name: dot1qCustomerPriority
type: unsigned8
status: current
description: The value represents the 3-bit Priority Code Point (PCP) portion of the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field as described in [IEEE802.1Q].
revision: 1
date: 2014-01-11
semantics: identifier
additionalInformation: "[IEEE802.1Q]"
references:
- ipfix-iana_at_cisco.com
- RFC7133
- elementId: 247
name: metroEvcId
type: string
status: current
description: The EVC Service Attribute which uniquely identifies the Ethernet Virtual Connection (EVC) within a Metro Ethernet Network, as defined in section 6.2 of MEF 10.1. The MetroEVCID is encoded in a string of up to 100 characters.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 (Ethernet Local Management Interface)
references:
- ipfix-iana_at_cisco.com
- elementId: 248
name: metroEvcType
type: unsigned8
status: current
description: The 3-bit EVC Service Attribute which identifies the type of service provided by an EVC.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: MEF 10.1 (Ethernet Services Attributes Phase 2) MEF16 (Ethernet Local Management Interface)
references:
- ipfix-iana_at_cisco.com
- elementId: 249
name: pseudoWireId
type: unsigned32
status: current
description: A 32-bit non-zero connection identifier, which together with the pseudoWireType, identifies the Pseudo Wire (PW) as defined in [RFC8077].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC8077] for pseudowire definitions.
references:
- ipfix-iana_at_cisco.com
- elementId: 250
name: pseudoWireType
type: unsigned16
status: current
description: The value of this information element identifies the type of MPLS Pseudo Wire (PW) as defined in [RFC4446].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4446] for the pseudowire type definition, and [https://www.iana.org/assignments/pwe3-parameters] for the IANA Pseudowire Types registry.
references:
- ipfix-iana_at_cisco.com
- elementId: 251
name: pseudoWireControlWord
type: unsigned32
status: current
description: The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as defined in Section 3 of [RFC4385].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4385] for the Pseudo Wire Control Word definition.
references:
- ipfix-iana_at_cisco.com
- elementId: 252
name: ingressPhysicalInterface
type: unsigned32
status: current
description: The index of a networking device's physical interface (example, a switch port) where packets of this flow are being received.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC2863] for the definition of the ifIndex object.
references:
- ipfix-iana_at_cisco.com
- elementId: 253
name: egressPhysicalInterface
type: unsigned32
status: current
description: The index of a networking device's physical interface (example, a switch port) where packets of this flow are being sent.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC2863] for the definition of the ifIndex object.
references:
- ipfix-iana_at_cisco.com
- elementId: 254
name: postDot1qVlanId
type: unsigned16
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'dot1qVlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: "[IEEE.802-3.2005] [IEEE.802-1ad.2005]"
references:
- ipfix-iana_at_cisco.com
- elementId: 255
name: postDot1qCustomerVlanId
type: unsigned16
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'dot1qCustomerVlanId', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: "[IEEE.802-1ad.2005] [IEEE.802-1Q.2003]"
references:
- ipfix-iana_at_cisco.com
- elementId: 256
name: ethernetType
type: unsigned16
status: current
description: The Ethernet type field of an Ethernet frame that identifies the MAC client protocol carried in the payload as defined in paragraph 1.4.349 of [IEEE.802-3.2005].
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: "[IEEE.802-3.2005] Ethertype registry available at [http://standards.ieee.org/regauth/ethertype/eth.txt]"
references:
- ipfix-iana_at_cisco.com
- elementId: 257
name: postIpPrecedence
type: unsigned8
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'ipPrecedence', except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.
revision: 0
date: 2013-02-18
semantics: identifier
range:
start: 0
end: 7
additionalInformation: See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of the IP Precedence. See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field. See [RFC8200] for the definition of the IPv6 Traffic Class field.
references:
- ipfix-iana_at_cisco.com
- elementId: 258
name: collectionTimeMilliseconds
type: dateTimeMilliseconds
status: current
description: The absolute timestamp at which the data within the scope containing this Information Element was received by a Collecting Process. This Information Element SHOULD be bound to its containing IPFIX Message via IPFIX Options and the messageScope Information Element.
revision: 1
date: 2013-03-26
semantics: default
units: milliseconds
references:
- RFC5655
- RFC Errata 3559
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 259
name: exportSctpStreamId
type: unsigned16
status: current
description: The value of the SCTP Stream Identifier used by the Exporting Process for exporting IPFIX Message data. This is carried in the Stream Identifier field of the header of the SCTP DATA chunk containing the IPFIX Message(s).
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5655
- elementId: 260
name: maxExportSeconds
type: dateTimeSeconds
status: current
description: The absolute Export Time of the latest IPFIX Message within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element.
revision: 0
date: 2013-02-18
semantics: default
units: seconds
references:
- RFC5655
- elementId: 261
name: maxFlowEndSeconds
type: dateTimeSeconds
status: current
description: The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the second if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element.
revision: 0
date: 2013-02-18
semantics: default
units: seconds
references:
- RFC5655
- elementId: 262
name: messageMD5Checksum
type: octetArray
status: current
description: The MD5 checksum of the IPFIX Message containing this record. This Information Element SHOULD be bound to its containing IPFIX Message via an options record and the messageScope Information lement, and SHOULD appear only once in a given IPFIX Message. To calculate the value of this Information Element, first buffer the containing IPFIX Message, setting the value of this Information Element to all zeroes. Then calculate the MD5 checksum of the resulting buffer as defined in [RFC1321], place the resulting value in this Information Element, and export the buffered message. This Information Element is intended as a simple checksum only; therefore collision resistance and algorithm agility are not required, and MD5 is an appropriate message digest. This Information Element has a fixed length of 16 octets.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5655
- RFC1321
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 263
name: messageScope
type: unsigned8
status: current
description: The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Message that contains them. It is defined for general purpose message scoping of options, and proposed specifically to allow the attachment a checksum to a message via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process.
revision: 0
date: 2013-02-18
range:
start: 0
end: 0
references:
- RFC5655
- elementId: 264
name: minExportSeconds
type: dateTimeSeconds
status: current
description: The absolute Export Time of the earliest IPFIX Message within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element.
revision: 0
date: 2013-02-18
semantics: default
units: seconds
references:
- RFC5655
- elementId: 265
name: minFlowStartSeconds
type: dateTimeSeconds
status: current
description: The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the second if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element.
revision: 0
date: 2013-02-18
semantics: default
units: seconds
references:
- RFC5655
- elementId: 266
name: opaqueOctets
type: octetArray
status: current
description: This Information Element is used to encapsulate non- IPFIX data into an IPFIX Message stream, for the purpose of allowing a non-IPFIX data processor to store a data stream inline within an IPFIX File. A Collecting Process or File Writer MUST NOT try to interpret this binary data. This Information Element differs from paddingOctets as its contents are meaningful in some non-IPFIX context, while the contents of paddingOctets MUST be 0x00 and are intended only for Information Element alignment.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5655
- elementId: 267
name: sessionScope
type: unsigned8
status: current
description: The presence of this Information Element as scope in an Options Template signifies that the options described by the Template apply to the IPFIX Transport Session that contains them. Note that as all options are implicitly scoped to Transport Session and Observation Domain, this Information Element is equivalent to a "null" scope. It is defined for general purpose session scoping of options, and proposed specifically to allow the attachment of time window to an IPFIX File via IPFIX Options. The value of this Information Element MUST be written as 0 by the File Writer or Exporting Process. The value of this Information Element MUST be ignored by the File Reader or the Collecting Process.
revision: 0
date: 2013-02-18
range:
start: 0
end: 0
references:
- RFC5655
- elementId: 268
name: maxFlowEndMicroseconds
type: dateTimeMicroseconds
status: current
description: The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the microsecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements.
revision: 0
date: 2013-02-18
semantics: default
units: microseconds
references:
- RFC5655
- elementId: 269
name: maxFlowEndMilliseconds
type: dateTimeMilliseconds
status: current
description: The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element, rounded up to the millisecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- RFC5655
- elementId: 270
name: maxFlowEndNanoseconds
type: dateTimeNanoseconds
status: current
description: The latest absolute timestamp of the last packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via IPFIX Options and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements.
revision: 0
date: 2013-02-18
semantics: default
units: nanoseconds
references:
- RFC5655
- elementId: 271
name: minFlowStartMicroseconds
type: dateTimeMicroseconds
status: current
description: The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the microsecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with microsecond- precision (or better) timestamp Information Elements.
revision: 0
date: 2013-02-18
semantics: default
units: microseconds
references:
- RFC5655
- elementId: 272
name: minFlowStartMilliseconds
type: dateTimeMilliseconds
status: current
description: The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element, rounded down to the millisecond if necessary. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with millisecond- precision (or better) timestamp Information Elements.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- RFC5655
- elementId: 273
name: minFlowStartNanoseconds
type: dateTimeNanoseconds
status: current
description: The earliest absolute timestamp of the first packet within any Flow within the scope containing this Information Element. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element. This Information Element SHOULD be used only in Transport Sessions containing Flow Records with nanosecond-precision timestamp Information Elements.
revision: 0
date: 2013-02-18
semantics: default
units: nanoseconds
references:
- RFC5655
- elementId: 274
name: collectorCertificate
type: octetArray
status: current
description: The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5655
- elementId: 275
name: exporterCertificate
type: octetArray
status: current
description: The full X.509 certificate, encoded in ASN.1 DER format, used by the Collector when IPFIX Messages were transmitted using TLS or DTLS. This Information Element SHOULD be bound to its containing IPFIX Transport Session via an options record and the sessionScope Information Element, or to its containing IPFIX Message via an options record and the messageScope Information Element.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5655
- elementId: 276
name: dataRecordsReliability
type: boolean
status: current
description: The export reliability of Data Records, within this SCTP stream, for the element(s) in the Options Template scope. A typical example of an element for which the export reliability will be reported is the templateID, as specified in the Data Records Reliability Options Template. A value of 'True' means that the Exporting Process MUST send any Data Records associated with the element(s) reliably within this SCTP stream. A value of 'False' means that the Exporting Process MAY send any Data Records associated with the element(s) unreliably within this SCTP stream.
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC6526
- elementId: 277
name: observationPointType
type: unsigned8
status: current
description: Type of observation point. Values are listed in the observationPointType registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the observationPointType registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-observation-point-type].
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 278
name: newConnectionDeltaCount
type: unsigned32
status: current
description: This information element counts the number of TCP or UDP connections which were opened during the observation period. The observation period may be specified by the flow start and end timestamps.
revision: 1
date: 2014-08-13
semantics: deltaCounter
references:
- ipfix-iana_at_cisco.com
- elementId: 279
name: connectionSumDurationSeconds
type: unsigned64
status: current
description: This information element aggregates the total time in seconds for all of the TCP or UDP connections which were in use during the observation period. For example if there are 5 concurrent connections each for 10 seconds, the value would be 50 s.
revision: 1
date: 2013-06-25
units: seconds
references:
- ipfix-iana_at_cisco.com
- elementId: 280
name: connectionTransactionId
type: unsigned64
status: current
description: This information element identifies a transaction within a connection. A transaction is a meaningful exchange of application data between two network devices or a client and server. A transactionId is assigned the first time a flow is reported, so that later reports for the same flow will have the same transactionId. A different transactionId is used for each transaction within a TCP or UDP connection. The identifiers need not be sequential.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- ipfix-iana_at_cisco.com
- elementId: 281
name: postNATSourceIPv6Address
type: ipv6Address
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'sourceIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after the packet passed the Observation Point. See [RFC8200] for the definition of the Source Address field in the IPv6 header. See [RFC3234] for the definition of middleboxes. See [RFC6146] for nat64 specification.
revision: 0
date: 2013-02-18
semantics: default
references:
- ipfix-iana_at_cisco.com
- elementId: 282
name: postNATDestinationIPv6Address
type: ipv6Address
status: current
description: The definition of this Information Element is identical to the definition of Information Element 'destinationIPv6Address', except that it reports a modified value caused by a NAT64 middlebox function after the packet passed the Observation Point. See [RFC8200] for the definition of the Destination Address field in the IPv6 header. See [RFC3234] for the definition of middleboxes. See [RFC6146] for nat64 specification.
revision: 0
date: 2013-02-18
semantics: default
references:
- ipfix-iana_at_cisco.com
- elementId: 283
name: natPoolId
type: unsigned32
status: current
description: Locally unique identifier of a NAT pool.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- ipfix-iana_at_cisco.com
- elementId: 284
name: natPoolName
type: string
status: current
description: The name of a NAT pool identified by a natPoolID.
revision: 0
date: 2013-02-18
semantics: default
references:
- ipfix-iana_at_cisco.com
- elementId: 285
name: anonymizationFlags
type: unsigned16
status: current
description: "A flag word describing specialized modifications to the anonymization policy in effect for the anonymization technique applied to a referenced Information Element within a referenced Template. When flags are clear (0), the normal policy (as described by anonymizationTechnique) applies without modification. MSB 14 13 12 11 10 9 8 7 6 5 4 3 2 1 LSB +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ | Reserved |LOR|PmA| SC | +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ anonymizationFlags IE +--------+----------+-----------------------------------------------+ | bit(s) | name | description | | (LSB = | | | | 0) | | | +--------+----------+-----------------------------------------------+ | 0-1 | SC | Stability Class: see the Stability Class | | | | table below, and Section 5.1 of [RFC6235]. | | 2 | PmA | Perimeter Anonymization: when set (1), | | | | source- Information Elements as described in | | | | [RFC5103] are interpreted as external | | | | addresses, and destination- Information | | | | Elements as described in [RFC5103] are | | | | interpreted as internal addresses, for the | | | | purposes of associating | | | | anonymizationTechnique to Information | | | | Elements only; see Section 7.2.2 of [RFC6235] | | | | for details. | | | | This bit MUST NOT be set when associated with | | | | a non-endpoint (i.e., source- or | | | | destination-) Information Element. SHOULD be | | | | consistent within a record (i.e., if a | | | | source- Information Element has this flag | | | | set, the corresponding destination- element | | | | SHOULD have this flag set, and vice versa.) | | 3 | LOR | Low-Order Unchanged: when set (1), the | | | | low-order bits of the anonymized Information | | | | Element contain real data. This modification | | | | is intended for the anonymization of | | | | network-level addresses while leaving | | | | host-level addresses intact in order to | | | | preserve host level-structure, which could | | | | otherwise be used to reverse anonymization. | | | | MUST NOT be set when associated with a | | | | truncation-based anonymizationTechnique. | | 4-15 | Reserved | Reserved for future use: SHOULD be cleared | | | | (0) by the Exporting Process and MUST be | | | | ignored by the Collecting Process. | +--------+----------+-----------------------------------------------+ The Stability Class portion of this flags word describes the stability class of the anonymization technique applied to a referenced Information Element within a referenced Template. Stability classes refer to the stability of the parameters of the anonymization technique, and therefore the comparability of the mapping between the real and anonymized values over time. This determines which anonymized datasets may be compared with each other. Values are as follows: +-----+-----+-------------------------------------------------------+ | Bit | Bit | Description | | 1 | 0 | | +-----+-----+-------------------------------------------------------+ | 0 | 0 | Undefined: the Exporting Process makes no | | | | representation as to how stable the mapping is, or | | | | over what time period values of this field will | | | | remain comparable; while the Collecting Process MAY | | | | assume Session level stability, Session level | | | | stability is not guaranteed. Processes SHOULD assume | | | | this is the case in the absence of stability class | | | | information; this is the default stability class. | | 0 | 1 | Session: the Exporting Process will ensure that the | | | | parameters of the anonymization technique are stable | | | | during the Transport Session. All the values of the | | | | described Information Element for each Record | | | | described by the referenced Template within the | | | | Transport Session are comparable. The Exporting | | | | Process SHOULD endeavour to ensure at least this | | | | stability class. | | 1 | 0 | Exporter-Collector Pair: the Exporting Process will | | | | ensure that the parameters of the anonymization | | | | technique are stable across Transport Sessions over | | | | time with the given Collecting Process, but may use | | | | different parameters for different Collecting | | | | Processes. Data exported to different Collecting | | | | Processes are not comparable. | | 1 | 1 | Stable: the Exporting Process will ensure that the | | | | parameters of the anonymization technique are stable | | | | across Transport Sessions over time, regardless of | | | | the Collecting Process to which it is sent. | +-----+-----+-------------------------------------------------------+"
revision: 0
date: 2013-02-18
semantics: flags
references:
- RFC6235
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 286
name: anonymizationTechnique
type: unsigned16
status: current
description: A description of the anonymization technique applied to a referenced Information Element within a referenced Template. Each technique may be applicable only to certain Information Elements and recommended only for certain Information Elements. Values are listed in the anonymizationTechnique registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the anonymizationTechnique registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-anonymization-technique].
references:
- RFC6235
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 287
name: informationElementIndex
type: unsigned16
status: current
description: A zero-based index of an Information Element referenced by informationElementId within a Template referenced by templateId; used to disambiguate scope for templates containing multiple identical Information Elements.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC6235
- elementId: 288
name: p2pTechnology
type: string
status: current
description: 'Specifies if the Application ID is based on peer-to-peer technology. Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }.'
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 289
name: tunnelTechnology
type: string
status: current
description: 'Specifies if the Application ID is used as a tunnel technology. Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }.'
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 290
name: encryptedTechnology
type: string
status: current
description: 'Specifies if the Application ID is an encrypted networking protocol. Possible values are: { "yes", "y", 1 }, { "no", "n", 2 } and { "unassigned", "u", 0 }.'
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 291
name: basicList
type: basicList
status: current
description: Specifies a generic Information Element with a basicList abstract data type. For example, a list of port numbers, a list of interface indexes, etc.
revision: 0
date: 2013-02-18
semantics: list
references:
- RFC6313
- elementId: 292
name: subTemplateList
type: subTemplateList
status: current
description: Specifies a generic Information Element with a subTemplateList abstract data type.
revision: 0
date: 2013-02-18
semantics: list
references:
- RFC6313
- elementId: 293
name: subTemplateMultiList
type: subTemplateMultiList
status: current
description: Specifies a generic Information Element with a subTemplateMultiList abstract data type.
revision: 0
date: 2013-02-18
semantics: list
references:
- RFC6313
- elementId: 294
name: bgpValidityState
type: unsigned8
status: current
description: This element describes the "validity state" of the BGP route correspondent source or destination IP address. If the "validity state" for this Flow is only available, then the value of this Information Element is 255.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC4271] for a description of BGP-4, [RFC6811] for the definition of "validity states" and [draft-ietf-sidr-origin-validation-signaling] for the encoding of those "validity states".
references:
- ipfix-iana_at_cisco.com
- elementId: 295
name: IPSecSPI
type: unsigned32
status: current
description: IPSec Security Parameters Index (SPI).
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC2401] for the definition of SPI.
references:
- ipfix-iana_at_cisco.com
- elementId: 296
name: greKey
type: unsigned32
status: current
description: GRE key, which is used for identifying an individual traffic flow within a tunnel.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See [RFC1701] for the definition of GRE and the GRE Key.
references:
- ipfix-iana_at_cisco.com
- elementId: 297
name: natType
type: unsigned8
status: current
description: This Information Element identifies the NAT type applied to packets of the Flow. Values are listed in the natType registry.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the natType registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-type]. See [RFC3022] for the definition of NAT (commonly named NAT44). See [RFC6144] for the definition of NAT46. See [RFC6146] for the definition of NAT64. See [RFC6296] for the definition of NPTv6. See [RFC791] for the definition of IPv4. See [RFC8200] for the definition of IPv6.
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 298
name: initiatorPackets
type: unsigned64
status: current
description: The total number of layer 4 packets in a flow from the initiator since the previous report. The initiator is the device which triggered the session creation, and remains the same for the life of the session.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: packets
additionalInformation: "See #231, initiatorOctets."
references:
- ipfix-iana_at_cisco.com
- elementId: 299
name: responderPackets
type: unsigned64
status: current
description: The total number of layer 4 packets in a flow from the responder since the previous report. The responder is the device which replies to the initiator, and remains the same for the life of the session.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: packets
additionalInformation: "See #232, responderOctets."
references:
- ipfix-iana_at_cisco.com
- elementId: 300
name: observationDomainName
type: string
status: current
description: The name of an observation domain identified by an observationDomainId.
revision: 0
date: 2013-02-18
semantics: default
additionalInformation: "See #149, observationDomainId."
references:
- ipfix-iana_at_cisco.com
- elementId: 301
name: selectionSequenceId
type: unsigned64
status: current
description: From all the packets observed at an Observation Point, a subset of the packets is selected by a sequence of one or more Selectors. The selectionSequenceId is a unique value per Observation Domain, specifying the Observation Point and the sequence of Selectors through which the packets are selected.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5477
- elementId: 302
name: selectorId
type: unsigned64
status: current
description: The Selector ID is the unique ID identifying a Primitive Selector. Each Primitive Selector must have a unique ID in the Observation Domain.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5477
- RFC Errata 2052
- elementId: 303
name: informationElementId
type: unsigned16
status: current
description: This Information Element contains the ID of another Information Element.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- RFC5477
- elementId: 304
name: selectorAlgorithm
type: unsigned16
status: current
description: This Information Element identifies the packet selection methods (e.g., Filtering, Sampling) that are applied by the Selection Process. Most of these methods have parameters. Further Information Elements are needed to fully specify packet selection with these methods and all their parameters. For the methods parameters, Information Elements are defined in the IPFIX IANA registry [IANA-IPFIX]. he names of these Information Elements are listed for each method identifier. Further method identifiers may be added to the list. It might be necessary to define new Information Elements to specify their parameters. There is a broad variety of possible parameters that could be used for Property match Filtering (5) but currently there are no agreed parameters specified.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the Packet Sampling (PSAMP) Parameters registry [https://www.iana.org/assignments/psamp-parameters]
references:
- RFC5477
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 305
name: samplingPacketInterval
type: unsigned32
status: current
description: This Information Element specifies the number of packets that are consecutively sampled. A value of 100 means that 100 consecutive packets are sampled. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
units: packets
references:
- RFC5477
- elementId: 306
name: samplingPacketSpace
type: unsigned32
status: current
description: This Information Element specifies the number of packets between two "samplingPacketInterval"s. A value of 100 means that the next interval starts 100 packets (which are not sampled) after the current "samplingPacketInterval" is over. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
units: packets
references:
- RFC5477
- elementId: 307
name: samplingTimeInterval
type: unsigned32
status: current
description: This Information Element specifies the time interval in microseconds during which all arriving packets are sampled. For example, this Information Element may be used to describe the configuration of a systematic time-based Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
units: microseconds
references:
- RFC5477
- elementId: 308
name: samplingTimeSpace
type: unsigned32
status: current
description: This Information Element specifies the time interval in microseconds between two "samplingTimeInterval"s. A value of 100 means that the next interval starts 100 microseconds (during which no packets are sampled) after the current "samplingTimeInterval" is over. For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
units: microseconds
references:
- RFC5477
- elementId: 309
name: samplingSize
type: unsigned32
status: current
description: This Information Element specifies the number of elements taken from the parent Population for random Sampling methods. For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
units: packets
references:
- RFC5477
- elementId: 310
name: samplingPopulation
type: unsigned32
status: current
description: This Information Element specifies the number of elements in the parent Population for random Sampling methods. For example, this Information Element may be used to describe the configuration of a random n-out-of-N Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
units: packets
references:
- RFC5477
- elementId: 311
name: samplingProbability
type: float64
status: current
description: This Information Element specifies the probability that a packet is sampled, expressed as a value between 0 and 1. The probability is equal for every packet. A value of 0 means no packet was sampled since the probability is 0. For example, this Information Element may be used to describe the configuration of a uniform probabilistic Sampling Selector.
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 312
name: dataLinkFrameSize
type: unsigned16
status: current
description: This Information Element specifies the length of the selected data link frame. The data link layer is defined in [ISO/IEC.7498-1:1994].
revision: 1
date: 2014-01-11
semantics: quantity
additionalInformation: "[ISO/IEC.7498-1:1994]"
references:
- RFC7133
- elementId: 313
name: ipHeaderPacketSection
type: octetArray
status: current
description: This Information Element carries a series of n octets from the IP header of a sampled packet, starting sectionOffset octets into the IP header. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the IP header. With sufficient length, this element also reports octets from the IP payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC5477] and [RFC2804]. The sectionExportedOctets expresses how much data was exported, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.
revision: 1
date: 2014-01-11
semantics: default
additionalInformation: "[RFC2804] [RFC5477]"
references:
- RFC5477
- RFC7133
- elementId: 314
name: ipPayloadPacketSection
type: octetArray
status: current
description: This Information Element carries a series of n octets from the IP payload of a sampled packet, starting sectionOffset octets into the IP payload. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the IP payload. The IPv4 payload is that part of the packet that follows the IPv4 header and any options, which [RFC791] refers to as "data" or "data octets". For example, see the examples in [RFC791], Appendix A. The IPv6 payload is the rest of the packet following the 40-octet IPv6 header. Note that any extension headers present are considered part of the payload. See [RFC8200] for the IPv6 specification. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.
revision: 1
date: 2014-01-11
semantics: default
additionalInformation: "[RFC791] [RFC8200]"
references:
- RFC5477
- RFC7133
- elementId: 315
name: dataLinkFrameSection
type: octetArray
status: current
description: This Information Element carries n octets from the data link frame of a selected frame, starting sectionOffset octets into the frame. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the data link frame. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol. Further Information Elements, i.e., dataLinkFrameType and dataLinkFrameSize, are needed to specify the data link type and the size of the data link frame of this Information Element. A set of these Information Elements MAY be contained in a structured data type, as expressed in [RFC6313]. Or a set of these Information Elements MAY be contained in one Flow Record as shown in Appendix B of [RFC7133]. The data link layer is defined in [ISO/IEC.7498-1:1994].
revision: 1
date: 2014-01-11
semantics: default
additionalInformation: "[RFC6313] [RFC7133] [ISO/IEC.7498-1:1994]"
references:
- RFC7133
- elementId: 316
name: mplsLabelStackSection
type: octetArray
status: current
description: This Information Element carries a series of n octets from the MPLS label stack of a sampled packet, starting sectionOffset octets into the MPLS label stack. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the head of the MPLS label stack. With sufficient length, this element also reports octets from the MPLS payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC5477] and [RFC2804]. See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.
revision: 1
date: 2014-01-11
semantics: default
additionalInformation: "[RFC2804] [RFC3031] [RFC3032] [RFC5477]"
references:
- RFC5477
- RFC7133
- elementId: 317
name: mplsPayloadPacketSection
type: octetArray
status: current
description: The mplsPayloadPacketSection carries a series of n octets from the MPLS payload of a sampled packet, starting sectionOffset octets into the MPLS payload, as it is data that follows immediately after the MPLS label stack. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the MPLS payload. See [RFC3031] for the specification of MPLS packets. See [RFC3032] for the specification of the MPLS label stack. The sectionExportedOctets expresses how much data was observed, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.
revision: 1
date: 2014-01-11
semantics: default
additionalInformation: "[RFC3031] [RFC3032]"
references:
- RFC5477
- RFC7133
- elementId: 318
name: selectorIdTotalPktsObserved
type: unsigned64
status: current
description: This Information Element specifies the total number of packets observed by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5477
- elementId: 319
name: selectorIdTotalPktsSelected
type: unsigned64
status: current
description: This Information Element specifies the total number of packets selected by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- RFC5477
- elementId: 320
name: absoluteError
type: float64
status: current
description: This Information Element specifies the maximum possible measurement error of the reported value for a given Information Element. The absoluteError has the same unit as the Information Element with which it is associated. The real value of the metric can differ by absoluteError (positive or negative) from the measured value. This Information Element provides only the error for measured values. If an Information Element contains an estimated value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].
revision: 1
date: 2018-06-13
semantics: quantity
units: inferred
references:
- RFC5477
- elementId: 321
name: relativeError
type: float64
status: current
description: This Information Element specifies the maximum possible positive or negative error ratio for the reported value for a given Information Element as percentage of the measured value. The real value of the metric can differ by relativeError percent (positive or negative) from the measured value. This Information Element provides only the error for measured values. If an Information Element contains an estimated value (from Sampling), the confidence boundaries and confidence level have to be provided instead, using the upperCILimit, lowerCILimit, and confidenceLevel Information Elements. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 322
name: observationTimeSeconds
type: dateTimeSeconds
status: current
description: This Information Element specifies the absolute time in seconds of an observation.
revision: 1
date: 2014-02-03
semantics: default
units: seconds
references:
- RFC5477
- elementId: 323
name: observationTimeMilliseconds
type: dateTimeMilliseconds
status: current
description: This Information Element specifies the absolute time in milliseconds of an observation.
revision: 1
date: 2014-02-03
semantics: default
units: milliseconds
references:
- RFC5477
- elementId: 324
name: observationTimeMicroseconds
type: dateTimeMicroseconds
status: current
description: This Information Element specifies the absolute time in microseconds of an observation.
revision: 1
date: 2014-02-03
semantics: default
units: microseconds
references:
- RFC5477
- elementId: 325
name: observationTimeNanoseconds
type: dateTimeNanoseconds
status: current
description: This Information Element specifies the absolute time in nanoseconds of an observation.
revision: 1
date: 2014-02-03
semantics: default
units: nanoseconds
references:
- RFC5477
- elementId: 326
name: digestHashValue
type: unsigned64
status: current
description: This Information Element specifies the value from the digest hash function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 327
name: hashIPPayloadOffset
type: unsigned64
status: current
description: This Information Element specifies the IP payload offset used by a Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 328
name: hashIPPayloadSize
type: unsigned64
status: current
description: This Information Element specifies the IP payload size used by a Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 329
name: hashOutputRangeMin
type: unsigned64
status: current
description: This Information Element specifies the value for the beginning of a hash function's potential output range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 330
name: hashOutputRangeMax
type: unsigned64
status: current
description: This Information Element specifies the value for the end of a hash function's potential output range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 331
name: hashSelectedRangeMin
type: unsigned64
status: current
description: This Information Element specifies the value for the beginning of a hash function's selected range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 332
name: hashSelectedRangeMax
type: unsigned64
status: current
description: This Information Element specifies the value for the end of a hash function's selected range. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 333
name: hashDigestOutput
type: boolean
status: current
description: This Information Element contains a boolean value that is TRUE if the output from this hash Selector has been configured to be included in the packet report as a packet digest, else FALSE. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 1
date: 2014-02-03
semantics: default
references:
- RFC5477
- elementId: 334
name: hashInitialiserValue
type: unsigned64
status: current
description: This Information Element specifies the initialiser value to the hash function. See also Sections 6.2, 3.8 and 7.1 of [RFC5475].
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 335
name: selectorName
type: string
status: current
description: The name of a selector identified by a selectorID. Globally unique per Metering Process.
revision: 0
date: 2013-02-18
semantics: default
references:
- ipfix-iana_at_cisco.com
- elementId: 336
name: upperCILimit
type: float64
status: current
description: This Information Element specifies the upper limit of a confidence interval. It is used to provide an accuracy statement for an estimated value. The confidence limits define the range in which the real value is assumed to be with a certain probability p. Confidence limits always need to be associated with a confidence level that defines this probability p. Please note that a confidence interval only provides a probability that the real value lies within the limits. That means the real value can lie outside the confidence limits. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together.
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 337
name: lowerCILimit
type: float64
status: current
description: This Information Element specifies the lower limit of a confidence interval. For further information, see the description of upperCILimit. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together.
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 338
name: confidenceLevel
type: float64
status: current
description: This Information Element specifies the confidence level. It is used to provide an accuracy statement for estimated values. The confidence level provides the probability p with which the real value lies within a given range. A confidence level always needs to be associated with confidence limits that define the range in which the real value is assumed to be. The upperCILimit, lowerCILimit, and confidenceLevel Information Elements should all be used in an Options Template scoped to the observation to which they refer. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011]. Note that the upperCILimit, lowerCILimit, and confidenceLevel are all required to specify confidence, and should be disregarded unless all three are specified together.
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5477
- elementId: 339
name: informationElementDataType
type: unsigned8
status: current
description: A description of the abstract data type of an IPFIX information element. These are taken from the abstract data types defined in Section 3.1 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the [informationElementDataType] subregistry. These types are registered in the IANA IPFIX Information Element Data Type subregistry. The [informationElementDataType] subregistry is intended to assign numbers for type names, not to provide a mechanism for adding data types to the IPFIX Protocol, and as such requires a Standards Action [RFC8126] to modify.
revision: 0
date: 2013-02-18
additionalInformation: See the IPFIX Information Element Data Types registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-data-types]
references:
- RFC5610
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 340
name: informationElementDescription
type: string
status: current
description: A UTF-8 [RFC3629] encoded Unicode string containing a human-readable description of an Information Element. The content of the informationElementDescription MAY be annotated with one or more language tags [RFC4646], encoded in-line [RFC2482] within the UTF-8 string, in order to specify the language in which the description is written. Description text in multiple languages MAY tag each section with its ownlanguage tag; in this case, the description information in each language SHOULD have equivalent meaning. In the absence of any language tag, the "i-default" [RFC2277] language SHOULD be assumed. See the Security Considerations Section of [RFC5610] for notes on string handling for Information Element type records.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5610
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 341
name: informationElementName
type: string
status: current
description: A UTF-8 [RFC3629] encoded Unicode string containing the name of an Information Element, intended as a simple identifier. See the Security Considerations section for notes on string handling for Information Element type records
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC5610
- elementId: 342
name: informationElementRangeBegin
type: unsigned64
status: current
description: Contains the inclusive low end of the range of acceptable values for an Information Element.
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5610
- elementId: 343
name: informationElementRangeEnd
type: unsigned64
status: current
description: Contains the inclusive high end of the range of acceptable values for an Information Element.
revision: 0
date: 2013-02-18
semantics: quantity
references:
- RFC5610
- elementId: 344
name: informationElementSemantics
type: unsigned8
status: current
description: A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in Section 3.2 of the IPFIX Information Model [RFC5102]; see that section for more information on the types defined in the [IPFIX Information Element Semantics] subregistry. This field may take the values in the [IPFIX Information Element Semantics] subregistry. The special value 0x00 (default) is used to note that no semantics apply to the field; it cannot be manipulated by a Collecting Process or File Reader that does not understand it a priori. The [IPFIX Information Element Semantics] subregistry is intended to assign numbers for semantics names, not to provide a mechanism for adding semantics to the IPFIX Protocol, and as such requires a Standards Action [RFC8126] to modify.
revision: 0
date: 2013-02-18
additionalInformation: See the IP Flow Information Export (IPFIX) Entities registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-semantic]
references:
- RFC5610
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 345
name: informationElementUnits
type: unsigned16
status: current
description: A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in Section 5 of the IPFIX Information Model [RFC5102]; see that section for more information on the types described in the informationElementsUnits subregistry. These types can take the values in the [IANA IPFIX Information Element Units] subregistry. The special value 0x00 (none) is used to note that the field is unitless. These types are registered in the [IANA IPFIX Information Element Units] subregistry.
revision: 1
date: 2020-10-01
additionalInformation: See the IPFIX Information Element Units registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-units]
references:
- RFC5610
- RFC Errata 1822
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 346
name: privateEnterpriseNumber
type: unsigned32
status: current
description: A private enterprise number, as assigned by IANA. Within the context of an Information Element Type record, this element can be used along with the informationElementId element to scope properties to a specific Information Element. To export type information about an IANA-assigned Information Element, set the privateEnterpriseNumber to 0, or do not export the privateEnterpriseNumber in the type record. To export type information about an enterprise-specific Information Element, export the enterprise number in privateEnterpriseNumber, and export the Information Element number with the Enterprise bit cleared in informationElementId. The Enterprise bit in the associated informationElementId Information Element MUST be ignored by the Collecting Process.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the registered PENs at [https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers]
references:
- RFC5610
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 347
name: virtualStationInterfaceId
type: octetArray
status: current
description: "Instance Identifier of the interface to a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host."
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE 802.1Qbg for the definition of Virtual Station Interface ID.
references:
- ipfix-iana_at_cisco.com
- elementId: 348
name: virtualStationInterfaceName
type: string
status: current
description: "Name of the interface to a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host."
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE 802.1Qbg for the definition of Virtual Station Interface.
references:
- ipfix-iana_at_cisco.com
- elementId: 349
name: virtualStationUUID
type: octetArray
status: current
description: "Unique Identifier of a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host."
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See IEEE 802.1Qbg for the definition of Virtual Station.
references:
- ipfix-iana_at_cisco.com
- elementId: 350
name: virtualStationName
type: string
status: current
description: "Name of a Virtual Station. A Virtual Station is an end station instance: it can be a virtual machine or a physical host."
revision: 0
date: 2013-02-18
semantics: default
additionalInformation: See IEEE 802.1Qbg for the definition of Virtual Station.
references:
- ipfix-iana_at_cisco.com
- elementId: 351
name: layer2SegmentId
type: unsigned64
status: current
description: "Identifier of a layer 2 network segment in an overlay network. The most significant byte identifies the layer 2 network overlay network encapsulation type: 0x00 reserved 0x01 VxLAN 0x02 NVGRE The three lowest significant bytes hold the value of the layer 2 overlay network segment identifier. For example: - a 24 bit segment ID VXLAN Network Identifier (VNI) - a 24 bit Tenant Network Identifier (TNI) for NVGRE"
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See VxLAN RFC at [RFC7348] See NVGRE RFC at [RFC7637]
references:
- ipfix-iana_at_cisco.com
- elementId: 352
name: layer2OctetDeltaCount
type: unsigned64
status: current
description: "The number of layer 2 octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetDeltaCount (field #1)"
revision: 1
date: 2014-05-02
semantics: deltaCounter
units: octets
references:
- ipfix-iana_at_cisco.com
- elementId: 353
name: layer2OctetTotalCount
type: unsigned64
status: current
description: "The total number of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. # memo: layer 2 version of octetTotalCount (field #85)"
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
references:
- ipfix-iana_at_cisco.com
- elementId: 354
name: ingressUnicastPacketTotalCount
type: unsigned64
status: current
description: The total number of incoming unicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- ipfix-iana_at_cisco.com
- elementId: 355
name: ingressMulticastPacketTotalCount
type: unsigned64
status: current
description: The total number of incoming multicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- ipfix-iana_at_cisco.com
- elementId: 356
name: ingressBroadcastPacketTotalCount
type: unsigned64
status: current
description: The total number of incoming broadcast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- ipfix-iana_at_cisco.com
- elementId: 357
name: egressUnicastPacketTotalCount
type: unsigned64
status: current
description: The total number of incoming unicast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- ipfix-iana_at_cisco.com
- elementId: 358
name: egressBroadcastPacketTotalCount
type: unsigned64
status: current
description: The total number of incoming broadcast packets metered at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2013-02-18
semantics: totalCounter
units: packets
references:
- ipfix-iana_at_cisco.com
- elementId: 359
name: monitoringIntervalStartMilliSeconds
type: dateTimeMilliseconds
status: current
description: The absolute timestamp at which the monitoring interval started. A Monitoring interval is the period of time during which the Metering Process is running.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- ipfix-iana_at_cisco.com
- elementId: 360
name: monitoringIntervalEndMilliSeconds
type: dateTimeMilliseconds
status: current
description: The absolute timestamp at which the monitoring interval ended. A Monitoring interval is the period of time during which the Metering Process is running.
revision: 0
date: 2013-02-18
semantics: default
units: milliseconds
references:
- ipfix-iana_at_cisco.com
- elementId: 361
name: portRangeStart
type: unsigned16
status: current
description: The port number identifying the start of a range of port numbers. A value of zero indicates that the range start is not specified, i.e., the range is defined in some other way.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 362
name: portRangeEnd
type: unsigned16
status: current
description: The port number identifying the end of a range of port numbers. A value of zero indicates that the range end is not specified, i.e., the range is defined in some other way.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the assigned transport protocol (e.g., UDP, TCP, SCTP, and DCCP) port numbers at [https://www.iana.org/assignments/service-names-port-numbers].
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 363
name: portRangeStepSize
type: unsigned16
status: current
description: The step size in a port range. The default step size is 1, which indicates contiguous ports. A value of zero indicates that the step size is not specified, ie the range is defined in some other way.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- ipfix-iana_at_cisco.com
- elementId: 364
name: portRangeNumPorts
type: unsigned16
status: current
description: The number of ports in a port range. A value of zero indicates that the number of ports is not specified, ie the range is defined in some other way.
revision: 0
date: 2013-02-18
semantics: identifier
references:
- ipfix-iana_at_cisco.com
- elementId: 365
name: staMacAddress
type: macAddress
status: current
description: The IEEE 802 MAC address of a wireless station (STA).
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See section 1.4 of [RFC5415] for the definition of STA.
references:
- ipfix-iana_at_cisco.com
- elementId: 366
name: staIPv4Address
type: ipv4Address
status: current
description: The IPv4 address of a wireless station (STA).
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See section 1.4 of [RFC5415] for the definition of STA.
references:
- ipfix-iana_at_cisco.com
- elementId: 367
name: wtpMacAddress
type: macAddress
status: current
description: The IEEE 802 MAC address of a wireless access point (WTP).
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: See section 1.4 of [RFC5415] for the definition of WTP.
references:
- ipfix-iana_at_cisco.com
- elementId: 368
name: ingressInterfaceType
type: unsigned32
status: current
description: The type of interface where packets of this Flow are being received. The value matches the value of managed object 'ifType'.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the IANAifType-MIB registry [https://www.iana.org/assignments/ianaiftype-mib]
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 369
name: egressInterfaceType
type: unsigned32
status: current
description: The type of interface where packets of this Flow are being sent. The value matches the value of managed object 'ifType'.
revision: 0
date: 2013-02-18
semantics: identifier
additionalInformation: See the IANAifType-MIB registry [https://www.iana.org/assignments/ianaiftype-mib]
references:
- ipfix-iana_at_cisco.com
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 370
name: rtpSequenceNumber
type: unsigned16
status: current
description: The RTP sequence number per [RFC3550].
revision: 0
date: 2013-02-18
additionalInformation: "[RFC3550]"
references:
- ipfix-iana_at_cisco.com
- elementId: 371
name: userName
type: string
status: current
description: User name associated with the flow.
revision: 0
date: 2013-02-18
semantics: default
references:
- ipfix-iana_at_cisco.com
- elementId: 372
name: applicationCategoryName
type: string
status: current
description: An attribute that provides a first level categorization for each Application ID.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 373
name: applicationSubCategoryName
type: string
status: current
description: An attribute that provides a second level categorization for each Application ID.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 374
name: applicationGroupName
type: string
status: current
description: An attribute that groups multiple Application IDs that belong to the same networking application.
revision: 0
date: 2013-02-18
semantics: default
references:
- RFC6759
- elementId: 375
name: originalFlowsPresent
type: unsigned64
status: current
description: The non-conservative count of Original Flows contributing to this Aggregated Flow. Non-conservative counts need not sum to the original count on re-aggregation.
revision: 1
date: 2013-06-25
semantics: deltaCounter
units: flows
references:
- RFC7015
- elementId: 376
name: originalFlowsInitiated
type: unsigned64
status: current
description: The conservative count of Original Flows whose first packet is represented within this Aggregated Flow. Conservative counts must sum to the original count on re-aggregation.
revision: 1
date: 2013-06-25
semantics: deltaCounter
units: flows
references:
- RFC7015
- elementId: 377
name: originalFlowsCompleted
type: unsigned64
status: current
description: The conservative count of Original Flows whose last packet is represented within this Aggregated Flow. Conservative counts must sum to the original count on re-aggregation.
revision: 1
date: 2013-06-25
semantics: deltaCounter
units: flows
references:
- RFC7015
- elementId: 378
name: distinctCountOfSourceIPAddress
type: unsigned64
status: current
description: The count of distinct source IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP version. This Information Element is preferred to the IP-version-specific counters, unless it is important to separate the counts by version.
revision: 0
date: 2013-02-18
semantics: totalCounter
references:
- RFC7015
- elementId: 379
name: distinctCountOfDestinationIPAddress
type: unsigned64
status: current
description: The count of distinct destination IP address values for Original Flows contributing to this Aggregated Flow, without regard to IP version. This Information Element is preferred to the version-specific counters, unless it is important to separate the counts by version.
revision: 0
date: 2013-02-18
semantics: totalCounter
references:
- RFC7015
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 380
name: distinctCountOfSourceIPv4Address
type: unsigned32
status: current
description: The count of distinct source IPv4 address values for Original Flows contributing to this Aggregated Flow.
revision: 0
date: 2013-02-18
semantics: totalCounter
references:
- RFC7015
- elementId: 381
name: distinctCountOfDestinationIPv4Address
type: unsigned32
status: current
description: The count of distinct destination IPv4 address values for Original Flows contributing to this Aggregated Flow.
revision: 0
date: 2013-02-18
semantics: totalCounter
references:
- RFC7015
- elementId: 382
name: distinctCountOfSourceIPv6Address
type: unsigned64
status: current
description: The count of distinct source IPv6 address values for Original Flows contributing to this Aggregated Flow.
revision: 0
date: 2013-02-18
semantics: totalCounter
references:
- RFC7015
- elementId: 383
name: distinctCountOfDestinationIPv6Address
type: unsigned64
status: current
description: The count of distinct destination IPv6 address values for Original Flows contributing to this Aggregated Flow.
revision: 0
date: 2013-02-18
semantics: totalCounter
references:
- RFC7015
- elementId: 384
name: valueDistributionMethod
type: unsigned8
status: current
description: A description of the method used to distribute the counters from Contributing Flows into the Aggregated Flow records described by an associated scope, generally a Template. The method is deemed to apply to all the non-key Information Elements in the referenced scope for which value distribution is a valid operation; if the originalFlowsInitiated and/or originalFlowsCompleted Information Elements appear in the Template, they are not subject to this distribution method, as they each infer their own distribution method. The valueDistributionMethod registry is intended to list a complete set of possible value distribution methods.
revision: 0
date: 2013-02-18
additionalInformation: See the valueDistributionMethod registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-value-distribution-method].
references:
- RFC7015
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 385
name: rfc3550JitterMilliseconds
type: unsigned32
status: current
description: Interarrival jitter as defined in section 6.4.1 of [RFC3550], measured in milliseconds.
revision: 0
date: 2013-02-18
semantics: quantity
units: milliseconds
additionalInformation: "[RFC3550]"
references:
- ipfix-iana_at_cisco.com
- elementId: 386
name: rfc3550JitterMicroseconds
type: unsigned32
status: current
description: Interarrival jitter as defined in section 6.4.1 of [RFC3550], measured in microseconds.
revision: 0
date: 2013-02-18
semantics: quantity
units: microseconds
additionalInformation: "[RFC3550]"
references:
- ipfix-iana_at_cisco.com
- elementId: 387
name: rfc3550JitterNanoseconds
type: unsigned32
status: current
description: Interarrival jitter as defined in section 6.4.1 of [RFC3550], measured in nanoseconds.
revision: 0
date: 2013-02-18
semantics: quantity
units: nanoseconds
additionalInformation: "[RFC3550]"
references:
- ipfix-iana_at_cisco.com
- elementId: 388
name: dot1qDEI
type: boolean
status: current
description: "The value of the 1-bit Drop Eligible Indicator (DEI) field of the VLAN tag as described in 802.1Q-2011 subclause 9.6. In case of a QinQ frame, it represents the outer tag's DEI field and in case of an IEEE 802.1ad frame it represents the DEI field of the S-TAG. Note: in earlier versions of 802.1Q the same bit field in the incoming packet is occupied by the Canonical Format Indicator (CFI) field, except for S-TAGs."
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: "[802.1Q-2011 subclause 9.6]"
references:
- Yaakov_J_Stein
- elementId: 389
name: dot1qCustomerDEI
type: boolean
status: current
description: In case of a QinQ frame, it represents the inner tag's Drop Eligible Indicator (DEI) field and in case of an IEEE 802.1ad frame it represents the DEI field of the C-TAG.
revision: 1
date: 2014-02-03
semantics: default
additionalInformation: "[802.1Q-2011 subclause 9.6]"
references:
- Yaakov_J_Stein
- elementId: 390
name: flowSelectorAlgorithm
type: unsigned16
status: current
description: This Information Element identifies the Intermediate Flow Selection Process technique (e.g., Filtering, Sampling) that is applied by the Intermediate Flow Selection Process. Most of these techniques have parameters. Its configuration parameter(s) MUST be clearly specified. Further Information Elements are needed to fully specify packet selection with these methods and all their parameters. Further method identifiers may be added to the flowSelectorAlgorithm registry. It might be necessary to define new Information Elements to specify their parameters.
revision: 0
date: 2013-06-07
semantics: identifier
additionalInformation: See the flowSelectorAlgorithm registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flowselectoralgorithm].
references:
- RFC7014
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 391
name: flowSelectedOctetDeltaCount
type: unsigned64
status: current
description: This Information Element specifies the volume in octets of all Flows that are selected in the Intermediate Flow Selection Process since the previous report.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: octets
references:
- RFC7014
- elementId: 392
name: flowSelectedPacketDeltaCount
type: unsigned64
status: current
description: This Information Element specifies the volume in packets of all Flows that were selected in the Intermediate Flow Selection Process since the previous report.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: packets
references:
- RFC7014
- elementId: 393
name: flowSelectedFlowDeltaCount
type: unsigned64
status: current
description: This Information Element specifies the number of Flows that were selected in the Intermediate Flow Selection Process since the last report.
revision: 1
date: 2014-08-13
semantics: deltaCounter
units: flows
references:
- RFC7014
- elementId: 394
name: selectorIDTotalFlowsObserved
type: unsigned64
status: current
description: This Information Element specifies the total number of Flows observed by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].
revision: 0
date: 2013-06-07
units: flows
references:
- RFC7014
- elementId: 395
name: selectorIDTotalFlowsSelected
type: unsigned64
status: current
description: This Information Element specifies the total number of Flows selected by a Selector, for a specific value of SelectorId. This Information Element should be used in an Options Template scoped to the observation to which it refers. See Section 3.4.2.1 of the IPFIX protocol document [RFC7011].
revision: 0
date: 2013-06-07
units: flows
references:
- RFC7014
- elementId: 396
name: samplingFlowInterval
type: unsigned64
status: current
description: This Information Element specifies the number of Flows that are consecutively sampled. A value of 100 means that 100 consecutive Flows are sampled. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.
revision: 0
date: 2013-06-07
units: flows
references:
- RFC7014
- elementId: 397
name: samplingFlowSpacing
type: unsigned64
status: current
description: This Information Element specifies the number of Flows between two "samplingFlowInterval"s. A value of 100 means that the next interval starts 100 Flows (which are not sampled) after the current "samplingFlowInterval" is over. For example, this Information Element may be used to describe the configuration of a systematic count-based Sampling Selector.
revision: 0
date: 2013-06-07
units: flows
references:
- RFC7014
- elementId: 398
name: flowSamplingTimeInterval
type: unsigned64
status: current
description: This Information Element specifies the time interval in microseconds during which all arriving Flows are sampled. For example, this Information Element may be used to describe the configuration of a systematic time-based Sampling Selector.
revision: 0
date: 2013-06-07
units: microseconds
references:
- RFC7014
- elementId: 399
name: flowSamplingTimeSpacing
type: unsigned64
status: current
description: This Information Element specifies the time interval in microseconds between two "flowSamplingTimeInterval"s. A value of 100 means that the next interval starts 100 microseconds (during which no Flows are sampled) after the current "flowsamplingTimeInterval" is over. For example, this Information Element may used to describe the configuration of a systematic time-based Sampling Selector.
revision: 0
date: 2013-06-07
units: microseconds
references:
- RFC7014
- elementId: 400
name: hashFlowDomain
type: unsigned16
status: current
description: This Information Element specifies the Information Elements that are used by the Hash-based Flow Selector as the Hash Domain.
revision: 0
date: 2013-06-07
semantics: identifier
references:
- RFC7014
- elementId: 401
name: transportOctetDeltaCount
type: unsigned64
status: current
description: The number of octets, excluding IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
revision: 0
date: 2013-08-01
semantics: deltaCounter
units: octets
references:
- Brian_Trammell
- elementId: 402
name: transportPacketDeltaCount
type: unsigned64
status: current
description: The number of packets containing at least one octet beyond the IP header(s) and Layer 4 transport protocol header(s), observed for this Flow at the Observation Point since the previous report (if any).
revision: 0
date: 2013-08-01
semantics: deltaCounter
units: packets
references:
- Brian_Trammell
- elementId: 403
name: originalExporterIPv4Address
type: ipv4Address
status: current
description: The IPv4 address used by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX Mediator. Used to provide information about the Original Observation Points to a downstream Collector.
revision: 0
date: 2013-12-24
references:
- RFC7119
- elementId: 404
name: originalExporterIPv6Address
type: ipv6Address
status: current
description: The IPv6 address used by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX Mediator. Used to provide information about the Original Observation Points to a downstream Collector.
revision: 0
date: 2013-12-24
references:
- RFC7119
- elementId: 405
name: originalObservationDomainId
type: unsigned32
status: current
description: The Observation Domain ID reported by the Exporting Process on an Original Exporter, as seen by the Collecting Process on an IPFIX Mediator. Used to provide information about the Original Observation Domain to a downstream Collector. When cascading through multiple Mediators, this identifies the initial Observation Domain in the cascade.
revision: 0
date: 2013-12-24
semantics: identifier
references:
- RFC7119
- elementId: 406
name: intermediateProcessId
type: unsigned32
status: current
description: "Description: An identifier of an Intermediate Process that is unique per IPFIX Device. Typically, this Information Element is used for limiting the scope of other Information Elements. Note that process identifiers may be assigned dynamically; that is, an Intermediate Process may be restarted with a different ID."
revision: 0
date: 2013-12-24
semantics: identifier
references:
- RFC7119
- elementId: 407
name: ignoredDataRecordTotalCount
type: unsigned64
status: current
description: "Description: The total number of received Data Records that the Intermediate Process did not process since the (re-)initialization of the Intermediate Process; includes only Data Records not examined or otherwise handled by the Intermediate Process due to resource constraints, not Data Records that were examined or otherwise handled by the Intermediate Process but those that merely do not contribute to any exported Data Record due to the operations performed by the Intermediate Process."
revision: 0
date: 2013-12-24
semantics: totalCounter
references:
- RFC7119
- elementId: 408
name: dataLinkFrameType
type: unsigned16
status: current
description: This Information Element specifies the type of the selected data link frame. Data link types are defined in the dataLinkFrameType registry. Further values may be assigned by IANA. Note that the assigned values are bits so that multiple observations can be OR'd together.
revision: 0
date: 2014-01-11
semantics: flags
additionalInformation: See the dataLinkFrameType registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-data-link-frame-type]. More information about the data link layer can be found in (IEEE802.3)(IEEE802.11)(ISO/IEC.7498-1:1994).
references:
- RFC7133
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 409
name: sectionOffset
type: unsigned16
status: current
description: 'This Information Element specifies the offset of the packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, and mplsPayloadPacketSection). If this Information Element is omitted, it defaults to zero (i.e., no offset). If multiple sectionOffset Information Elements are specified within a single Template, then they apply to the packet section Information Elements in order: the first sectionOffset applies to the first packet section, the second to the second, and so on. Note that the "closest" sectionOffset and packet section Information Elements within a given Template are not necessarily related. If there are fewer sectionOffset Information Elements than packet section Information Elements, then subsequent packet section Information Elements have no offset, i.e., a sectionOffset of zero applies to those packet section Information Elements. If there are more sectionOffset Information Elements than the number of packet section Information Elements, then the additional sectionOffset Information Elements are meaningless.'
revision: 0
date: 2014-01-11
semantics: quantity
references:
- RFC7133
- elementId: 410
name: sectionExportedOctets
type: unsigned16
status: current
description: This Information Element specifies the observed length of the packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection, ipPayloadPacketSection, mplsLabelStackSection, and mplsPayloadPacketSection) when padding is used. The packet section may be of a fixed size larger than the sectionExportedOctets. In this case, octets in the packet section beyond the sectionExportedOctets MUST follow the [RFC7011] rules for padding (i.e., be composed of zero (0) valued octets).
revision: 0
date: 2014-01-11
semantics: quantity
additionalInformation: "[RFC7011]"
references:
- RFC7133
- elementId: 411
name: dot1qServiceInstanceTag
type: octetArray
status: current
description: This Information Element, which is 16 octets long, represents the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q]. It encodes the Backbone Service Instance Priority Code Point (I-PCP), Backbone Service Instance Drop Eligible Indicator (I-DEI), Use Customer Addresses (UCAs), Backbone Service Instance Identifier (I-SID), Encapsulated Customer Destination Address (C-DA), Encapsulated Customer Source Address (C-SA), and reserved fields. The structure and semantics within the Tag Control Information field are defined in [IEEE802.1Q].
revision: 1
date: 2014-05-02
semantics: default
additionalInformation: "[IEEE802.1Q]"
references:
- RFC7133
- elementId: 412
name: dot1qServiceInstanceId
type: unsigned32
status: current
description: The value of the 24-bit Backbone Service Instance Identifier (I-SID) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].
revision: 1
date: 2014-05-02
semantics: identifier
range:
start: 0
end: 16777215
additionalInformation: "[IEEE802.1Q]"
references:
- RFC7133
- elementId: 413
name: dot1qServiceInstancePriority
type: unsigned8
status: current
description: The value of the 3-bit Backbone Service Instance Priority Code Point (I-PCP) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].
revision: 1
date: 2014-05-02
semantics: identifier
range:
start: 0
end: 7
additionalInformation: "[IEEE802.1Q]"
references:
- RFC7133
- elementId: 414
name: dot1qCustomerSourceMacAddress
type: macAddress
status: current
description: The value of the Encapsulated Customer Source Address (C-SA) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].
revision: 1
date: 2014-05-02
semantics: default
additionalInformation: "[IEEE802.1Q]"
references:
- RFC7133
- elementId: 415
name: dot1qCustomerDestinationMacAddress
type: macAddress
status: current
description: The value of the Encapsulated Customer Destination Address (C-DA) portion of the Backbone Service Instance Tag (I-TAG) Tag Control Information (TCI) field of an Ethernet frame as described in [IEEE802.1Q].
revision: 1
date: 2014-05-02
semantics: default
additionalInformation: "[IEEE802.1Q]"
references:
- RFC7133
- elementId: 417
name: postLayer2OctetDeltaCount
type: unsigned64
status: current
description: "The definition of this Information Element is identical to the definition of the layer2OctetDeltaCount Information Element, except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. This Information Element is the layer 2 version of postOctetDeltaCount (ElementId #23)."
revision: 1
date: 2014-05-02
semantics: deltaCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 418
name: postMCastLayer2OctetDeltaCount
type: unsigned64
status: current
description: "The number of layer 2 octets since the previous report (if any) in outgoing multicast packets sent for packets of this Flow by a multicast daemon within the Observation Domain. This property cannot necessarily be observed at the Observation Point but may be retrieved by other means. The number of octets includes layer 2 header(s) and layer 2 payload. This Information Element is the layer 2 version of postMCastOctetDeltaCount (ElementId #20)."
revision: 1
date: 2014-05-02
semantics: deltaCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 420
name: postLayer2OctetTotalCount
type: unsigned64
status: current
description: "The definition of this Information Element is identical to the definition of the layer2OctetTotalCount Information Element, except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point. This Information Element is the layer 2 version of postOctetTotalCount (ElementId #171)."
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 421
name: postMCastLayer2OctetTotalCount
type: unsigned64
status: current
description: "The total number of layer 2 octets in outgoing multicast packets sent for packets of this Flow by a multicast daemon in the Observation Domain since the Metering Process (re-)initialization. This property cannot necessarily be observed at the Observation Point but may be retrieved by other means. The number of octets includes layer 2 header(s) and layer 2 payload. This Information Element is the layer 2 version of postMCastOctetTotalCount (ElementId #175)."
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 422
name: minimumLayer2TotalLength
type: unsigned64
status: current
description: "Layer 2 length of the smallest packet observed for this Flow. The packet length includes the length of the layer 2 header(s) and the length of the layer 2 payload. This Information Element is the layer 2 version of minimumIpTotalLength (ElementId #25)."
revision: 1
date: 2014-05-02
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 423
name: maximumLayer2TotalLength
type: unsigned64
status: current
description: "Layer 2 length of the largest packet observed for this Flow. The packet length includes the length of the layer 2 header(s) and the length of the layer 2 payload. This Information Element is the layer 2 version of maximumIpTotalLength (ElementId #26)."
revision: 1
date: 2014-05-02
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 424
name: droppedLayer2OctetDeltaCount
type: unsigned64
status: current
description: "The number of layer 2 octets since the previous report (if any) in packets of this Flow dropped by packet treatment. The number of octets includes layer 2 header(s) and layer 2 payload. This Information Element is the layer 2 version of droppedOctetDeltaCount (ElementId #132)."
revision: 1
date: 2014-05-02
semantics: deltaCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 425
name: droppedLayer2OctetTotalCount
type: unsigned64
status: current
description: "The total number of octets in observed layer 2 packets (including the layer 2 header) that were dropped by packet treatment since the (re-)initialization of the Metering Process. This Information Element is the layer 2 version of droppedOctetTotalCount (ElementId #134)."
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 426
name: ignoredLayer2OctetTotalCount
type: unsigned64
status: current
description: "The total number of octets in observed layer 2 packets (including the layer 2 header) that the Metering Process did not process since the (re-)initialization of the Metering Process. This Information Element is the layer 2 version of ignoredOctetTotalCount (ElementId #165)."
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 427
name: notSentLayer2OctetTotalCount
type: unsigned64
status: current
description: "The total number of octets in observed layer 2 packets (including the layer 2 header) that the Metering Process did not process since the (re-)initialization of the Metering Process. This Information Element is the layer 2 version of notSentOctetTotalCount (ElementId #168)."
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 428
name: layer2OctetDeltaSumOfSquares
type: unsigned64
status: current
description: "The sum of the squared numbers of layer 2 octets per incoming packet since the previous report (if any) for this Flow at the Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. This Information Element is the layer 2 version of octetDeltaSumOfSquares (ElementId #198)."
revision: 1
date: 2014-05-02
semantics: deltaCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 429
name: layer2OctetTotalSumOfSquares
type: unsigned64
status: current
description: "The total sum of the squared numbers of layer 2 octets in incoming packets for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point. The number of octets includes layer 2 header(s) and layer 2 payload. This Information Element is the layer 2 version of octetTotalSumOfSquares (ElementId #199)."
revision: 1
date: 2014-05-02
semantics: totalCounter
units: octets
additionalInformation: "[RFC5477]"
references:
- RFC7133
- elementId: 430
name: layer2FrameDeltaCount
type: unsigned64
status: current
description: The number of incoming layer 2 frames since the previous report (if any) for this Flow at the Observation Point.
revision: 0
date: 2014-05-02
semantics: deltaCounter
units: frames
references:
- ipfix-iana_at_cisco.com
- elementId: 431
name: layer2FrameTotalCount
type: unsigned64
status: current
description: The total number of incoming layer 2 frames for this Flow at the Observation Point since the Metering Process (re-)initialization for this Observation Point.
revision: 0
date: 2014-05-02
semantics: totalCounter
units: frames
references:
- ipfix-iana_at_cisco.com
- elementId: 432
name: pseudoWireDestinationIPv4Address
type: ipv4Address
status: current
description: The destination IPv4 address of the PSN tunnel carrying the pseudowire.
revision: 0
date: 2014-05-28
semantics: default
additionalInformation: "[RFC3985]"
references:
- ipfix-iana_at_cisco.com
- elementId: 433
name: ignoredLayer2FrameTotalCount
type: unsigned64
status: current
description: "The total number of observed layer 2 frames that the Metering Process did not process since the (re-)initialization of the Metering Process. This Information Element is the layer 2 version of ignoredPacketTotalCount (ElementId #164)."
revision: 0
date: 2014-06-27
semantics: totalCounter
units: frames
references:
- ipfix-iana_at_cisco.com
- elementId: 434
name: mibObjectValueInteger
type: signed32
status: current
description: An IPFIX Information Element that denotes that the integer value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of Integer32 and INTEGER with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of signed32.
revision: 1
date: 2017-04-30
semantics: quantity
references:
- RFC8038
- elementId: 435
name: mibObjectValueOctetString
type: octetArray
status: current
description: An IPFIX Information Element that denotes that an Octet String or Opaque value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of OCTET STRING and Opaque. The value is encoded as per the standard IPFIX Abstract Data Type of octetArray.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 436
name: mibObjectValueOID
type: octetArray
status: current
description: 'An IPFIX Information Element that denotes that an Object Identifier or OID value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of OBJECT IDENTIFIER. Note: In this case, the "mibObjectIdentifier" defines which MIB object is being exported, and the "mibObjectValueOID" field will contain the OID value of that MIB object. The mibObjectValueOID Information Element is encoded as ASN.1/BER [X.690] in an octetArray.'
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 437
name: mibObjectValueBits
type: octetArray
status: current
description: An IPFIX Information Element that denotes that a set of Enumerated flags or bits from a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of BITS. The flags or bits are encoded as per the standard IPFIX Abstract Data Type of octetArray, with sufficient length to accommodate the required number of bits. If the number of bits is not an integer multiple of octets, then the most significant bits at the end of the octetArray MUST be set to 0.
revision: 0
date: 2015-12-13
semantics: flags
references:
- RFC8038
- elementId: 438
name: mibObjectValueIPAddress
type: ipv4Address
status: current
description: An IPFIX Information Element that denotes that the IPv4 address value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of IpAddress. The value is encoded as per the standard IPFIX Abstract Data Type of ipv4Address.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 439
name: mibObjectValueCounter
type: unsigned64
status: current
description: An IPFIX Information Element that denotes that the counter value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of Counter32 or Counter64 with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned64.
revision: 0
date: 2015-12-13
semantics: snmpCounter
references:
- RFC8038
- elementId: 440
name: mibObjectValueGauge
type: unsigned32
status: current
description: An IPFIX Information Element that denotes that the Gauge value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of Gauge32. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32. This value represents a non-negative integer that may increase or decrease but that shall never exceed a maximum value or fall below a minimum value.
revision: 0
date: 2015-12-13
semantics: snmpGauge
references:
- RFC8038
- elementId: 441
name: mibObjectValueTimeTicks
type: unsigned32
status: current
description: An IPFIX Information Element that denotes that the TimeTicks value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of TimeTicks. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32.
revision: 1
date: 2017-04-30
semantics: quantity
references:
- RFC8038
- elementId: 442
name: mibObjectValueUnsigned
type: unsigned32
status: current
description: An IPFIX Information Element that denotes that an unsigned integer value of a MIB object will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with the Base syntax of unsigned32 with IPFIX reduced-size encoding used as required. The value is encoded as per the standard IPFIX Abstract Data Type of unsigned32.
revision: 1
date: 2017-04-30
semantics: quantity
references:
- RFC8038
- elementId: 443
name: mibObjectValueTable
type: subTemplateList
status: current
description: An IPFIX Information Element that denotes that a complete or partial conceptual table will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with a syntax of SEQUENCE OF. This is encoded as a subTemplateList of mibObjectValue Information Elements. The Template specified in the subTemplateList MUST be an Options Template and MUST include all the objects listed in the INDEX clause as Scope Fields.
revision: 1
date: 2017-04-30
semantics: list
references:
- RFC8038
- elementId: 444
name: mibObjectValueRow
type: subTemplateList
status: current
description: An IPFIX Information Element that denotes that a single row of a conceptual table will be exported. The MIB Object Identifier ("mibObjectIdentifier") for this field MUST be exported in a MIB Field Option or via another means. This Information Element is used for MIB objects with a syntax of SEQUENCE. This is encoded as a subTemplateList of mibObjectValue Information Elements. The subTemplateList exported MUST contain exactly one row (i.e., one instance of the subTemplate). The Template specified in the subTemplateList MUST be an Options Template and MUST include all the objects listed in the INDEX clause as Scope Fields.
revision: 0
date: 2015-12-13
semantics: list
references:
- RFC8038
- elementId: 445
name: mibObjectIdentifier
type: octetArray
status: current
description: An IPFIX Information Element that denotes that a MIB Object Identifier (MIB OID) is exported in the (Options) Template Record. The mibObjectIdentifier Information Element contains the OID assigned to the MIB object type definition encoded as ASN.1/BER [X.690].
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 446
name: mibSubIdentifier
type: unsigned32
status: current
description: A non-negative sub-identifier of an Object Identifier (OID).
revision: 0
date: 2015-12-13
semantics: identifier
references:
- RFC8038
- elementId: 447
name: mibIndexIndicator
type: unsigned64
status: current
description: A set of bit fields that is used for marking the Information Elements of a Data Record that serve as INDEX MIB objects for an indexed columnar MIB object. Each bit represents an Information Element in the Data Record, with the n-th least significant bit representing the n-th Information Element. A bit set to 1 indicates that the corresponding Information Element is an index of the columnar object represented by the mibObjectValue. A bit set to 0 indicates that this is not the case. If the Data Record contains more than 64 Information Elements, the corresponding Template SHOULD be designed such that all index fields are among the first 64 Information Elements, because the mibIndexIndicator only contains 64 bits. If the Data Record contains less than 64 Information Elements, then the extra bits in the mibIndexIndicator for which no corresponding Information Element exists MUST have the value 0 and must be disregarded by the Collector. This Information Element may be exported with IPFIX reduced-size encoding.
revision: 0
date: 2015-12-13
semantics: flags
references:
- RFC8038
- elementId: 448
name: mibCaptureTimeSemantics
type: unsigned8
status: current
description: Indicates when in the lifetime of the Flow the MIB value was retrieved from the MIB for a mibObjectIdentifier. This is used to indicate if the value exported was collected from the MIB closer to Flow creation or Flow export time and refers to the Timestamp fields included in the same Data Record. This field SHOULD be used when exporting a mibObjectValue that specifies counters or statistics. If the MIB value was sampled by SNMP prior to the IPFIX Metering Process or Exporting Process retrieving the value (i.e., the data is already stale) and it is important to know the exact sampling time, then an additional observationTime* element should be paired with the OID using IPFIX Structured Data [RFC6313]. Similarly, if different MIB capture times apply to different mibObjectValue elements within the Data Record, then individual mibCaptureTimeSemantics Information Elements should be paired with each OID using IPFIX Structured Data. Values are listed in the mibCaptureTimeSemantics registry.
revision: 0
date: 2015-12-13
semantics: identifier
additionalInformation: See the mibCaptureTimeSemantics registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-mib-capture-time-semantics].
references:
- RFC8038
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 449
name: mibContextEngineID
type: octetArray
status: current
description: A mibContextEngineID that specifies the SNMP engine ID for a MIB field being exported over IPFIX. Definition as per [RFC3411], Section 3.3.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 450
name: mibContextName
type: string
status: current
description: An Information Element that denotes that a MIB context name is specified for a MIB field being exported over IPFIX. Reference [RFC3411], Section 3.3.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 451
name: mibObjectName
type: string
status: current
description: The name (called a descriptor in [RFC2578] of an object type definition.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 452
name: mibObjectDescription
type: string
status: current
description: The value of the DESCRIPTION clause of a MIB object type definition.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 453
name: mibObjectSyntax
type: string
status: current
description: The value of the SYNTAX clause of a MIB object type definition, which may include a textual convention or sub-typing. See [RFC2578].
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 454
name: mibModuleName
type: string
status: current
description: The textual name of the MIB module that defines a MIB object.
revision: 0
date: 2015-12-13
semantics: default
references:
- RFC8038
- elementId: 455
name: mobileIMSI
type: string
status: current
description: The International Mobile Subscription Identity (IMSI). The IMSI is a decimal digit string with up to a maximum of 15 ASCII/UTF-8 encoded digits (0x30 - 0x39).
revision: 0
date: 2015-12-15
semantics: default
additionalInformation: "[3GPP TS 23.003] Section 3 and [ITU-T E.164]."
references:
- ipfix-iana_at_cisco.com
- elementId: 456
name: mobileMSISDN
type: string
status: current
description: The Mobile Station International Subscriber Directory Number (MSISDN). The MSISDN is a decimal digit string with up to a maximum of 15 ASCII/UTF-8 encoded digits (0x30 - 0x39).
revision: 0
date: 2015-12-15
semantics: default
additionalInformation: "[3GPP TS 23.003] Section 3 and [ITU-T E.164]."
references:
- ipfix-iana_at_cisco.com
- elementId: 457
name: httpStatusCode
type: unsigned16
status: current
description: The HTTP Response Status Code, as defined in section 6 of [RFC7231], associated with a flow. Implies that the flow record represents a flow containing an HTTP Response.
revision: 0
date: 2016-04-28
semantics: identifier
range:
start: 0
end: 999
additionalInformation: "[RFC7231]"
references:
- Andrew_Feren
- elementId: 458
name: sourceTransportPortsLimit
type: unsigned16
status: current
description: This Information Element contains the maximum number of IP source transport ports that can be used by an end user when sending IP packets; each user is associated with one or more (source) IPv4 or IPv6 addresses. This Information Element is particularly useful in address-sharing deployments that adhere to REQ-4 of [RFC6888]. Limiting the number of ports assigned to each user ensures fairness among users and mitigates the denial-of-service attack that a user could launch against other users through the address-sharing device in order to grab more ports.
revision: 1
date: 2017-08-01
semantics: quantity
units: ports
range:
start: 1
end: 65535
references:
- RFC8045
- RFC Errata 5009
- elementId: 459
name: httpRequestMethod
type: string
status: current
description: The HTTP request method, as defined in section 4 of [RFC7231], associated with a flow. String with up to 8 UTF-8 characters.
revision: 0
date: 2016-11-15
references:
- Felix_Erlacher
- elementId: 460
name: httpRequestHost
type: string
status: current
description: The HTTP request host, as defined in section 5.4 of [RFC7230] or, in the case of HTTP/2, the content of the :authority pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8.
revision: 0
date: 2016-11-15
references:
- Felix_Erlacher
- elementId: 461
name: httpRequestTarget
type: string
status: current
description: The HTTP request target, as defined in section 2 of [RFC7231] and in section 5.3 of [RFC7230], associated with a flow. Or the HTTP/2 ":path" pseudo-header field as defined in section 8.1.2.3 of [RFC7240]. Encoded in UTF-8.
revision: 0
date: 2016-11-15
references:
- Felix_Erlacher
- elementId: 462
name: httpMessageVersion
type: string
status: current
description: The version of an HTTP/1.1 message as indicated by the HTTP-version field, defined in section 2.6 of [RFC7230], or the version identification of an HTTP/2 frame as defined in [RFC7240] section 3.1. The length of this field is limited to 10 characters, UTF-8 encoded.
revision: 0
date: 2016-11-15
references:
- Felix_Erlacher
- elementId: 463
name: natInstanceID
type: unsigned32
status: current
description: This Information Element uniquely identifies an Instance of the NAT that runs on a NAT middlebox function after the packet passes the Observation Point. natInstanceID is defined in [RFC7659].
revision: 0
date: 2017-03-15
semantics: identifier
additionalInformation: See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 464
name: internalAddressRealm
type: octetArray
status: current
description: This Information Element represents the internal address realm where the packet is originated from or destined to. By definition, a NAT mapping can be created from two address realms, one from internal and one from external. Realms are implementation dependent and can represent a Virtual Routing and Forwarding (VRF) ID, a VLAN ID, or some unique identifier. Realms are optional and, when left unspecified, would mean that the external and internal realms are the same.
revision: 0
date: 2017-03-15
semantics: identifier
additionalInformation: See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 465
name: externalAddressRealm
type: octetArray
status: current
description: This Information Element represents the external address realm where the packet is originated from or destined to. See the internalAddressRealm IE for the detailed definition.
revision: 0
date: 2017-03-15
semantics: identifier
additionalInformation: See [RFC791] for the definition of the IPv4 source address field. See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 466
name: natQuotaExceededEvent
type: unsigned32
status: current
description: This Information Element identifies the type of a NAT Quota Exceeded event. Values for this Information Element are listed in the "NAT Quota Exceeded Event Type" registry.
revision: 0
date: 2017-03-15
semantics: identifier
additionalInformation: See the NAT Quota Exceeded Event Type registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-quota-exceeded-event]. See [RFC3022] for the definition of NAT.
references:
- RFC8158
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 467
name: natThresholdEvent
type: unsigned32
status: current
description: This Information Element identifies a type of a NAT Threshold event. Values for this Information Element are listed in the "NAT Threshold Event Type" registry.
revision: 0
date: 2017-03-15
semantics: identifier
additionalInformation: See the NAT Threshold Event Type registry [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-threshold-event]. See [RFC3022] for the definition of NAT.
references:
- RFC8158
- RFC-ietf-opsawg-ipfix-fixes-12
- elementId: 468
name: httpUserAgent
type: string
status: current
description: The HTTP User-Agent header field as defined in section 5.5.3 of [RFC7231]. Encoded in UTF-8.
revision: 0
date: 2017-04-19
semantics: default
additionalInformation: "[RFC7231]"
references:
- Andrew_Feren
- elementId: 469
name: httpContentType
type: string
status: current
description: The HTTP Content-Type header field as defined in section 3.1.1.5 of [RFC7231]. Encoded in UTF-8.
revision: 0
date: 2017-04-19
semantics: default
additionalInformation: "[RFC7231]"
references:
- Andrew_Feren
- elementId: 470
name: httpReasonPhrase
type: string
status: current
description: The HTTP reason phrase as defined in section 6.1 of of [RFC7231].
revision: 0
date: 2017-06-19
semantics: default
additionalInformation: "[RFC7231]"
references:
- Felix_Erlacher
- elementId: 471
name: maxSessionEntries
type: unsigned32
status: current
description: This element represents the maximum session entries that can be created by the NAT device.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 472
name: maxBIBEntries
type: unsigned32
status: current
description: This element represents the maximum BIB entries that can be created by the NAT device.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 473
name: maxEntriesPerUser
type: unsigned32
status: current
description: This element represents the maximum NAT entries that can be created per user by the NAT device.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 474
name: maxSubscribers
type: unsigned32
status: current
description: This element represents the maximum subscribers or maximum hosts that are allowed by the NAT device.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 475
name: maxFragmentsPendingReassembly
type: unsigned32
status: current
description: This element represents the maximum fragments that the NAT device can store for reassembling the packet.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 476
name: addressPoolHighThreshold
type: unsigned32
status: current
description: This element represents the high threshold value of the number of public IP addresses in the address pool.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 477
name: addressPoolLowThreshold
type: unsigned32
status: current
description: This element represents the low threshold value of the number of public IP addresses in the address pool.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 478
name: addressPortMappingHighThreshold
type: unsigned32
status: current
description: This element represents the high threshold value of the number of address and port mappings.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 479
name: addressPortMappingLowThreshold
type: unsigned32
status: current
description: This element represents the low threshold value of the number of address and port mappings.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 480
name: addressPortMappingPerUserHighThreshold
type: unsigned32
status: current
description: This element represents the high threshold value of the number of address and port mappings that a single user is allowed to create on a NAT device.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes.
references:
- RFC8158
- elementId: 481
name: globalAddressMappingHighThreshold
type: unsigned32
status: current
description: This element represents the high threshold value of the number of address and port mappings that a single user is allowed to create on a NAT device in a paired address pooling behavior.
revision: 0
date: 2017-12-01
semantics: identifier
additionalInformation: See [RFC3022] for the definition of NAT. See [RFC3234] for the definition of middleboxes. See [RFC4787] for the definition of paired address pooling behavior.
references:
- RFC8158
- elementId: 482
name: vpnIdentifier
type: octetArray
status: current
description: VPN ID in the format specified by [RFC2685]. The size of this Information Element is 7 octets.
revision: 0
date: 2018-07-10
semantics: default
additionalInformation: "[RFC2685]"
references:
- ipfix-iana_at_cisco.com
- elementId: 483
name: bgpCommunity
type: unsigned32
status: current
description: BGP community as defined in [RFC1997]
revision: 0
date: 2019-01-18
semantics: identifier
additionalInformation: "[RFC1997]"
references:
- RFC8549
- elementId: 484
name: bgpSourceCommunityList
type: basicList
status: current
description: basicList of zero or more bgpCommunity IEs, containing the BGP communities corresponding with source IP address of a specific flow
revision: 0
date: 2019-01-18
semantics: list
additionalInformation: "[RFC6313] [RFC1997]"
references:
- RFC8549
- elementId: 485
name: bgpDestinationCommunityList
type: basicList
status: current
description: basicList of zero or more bgpCommunity IEs, containing the BGP communities corresponding with destination IP address of a specific flow
revision: 0
date: 2019-01-18
semantics: list
additionalInformation: "[RFC6313] [RFC1997]"
references:
- RFC8549
- elementId: 486
name: bgpExtendedCommunity
type: octetArray
status: current
description: BGP Extended Community as defined in [RFC4360]; the size of this IE MUST be 8 octets
revision: 0
date: 2019-01-18
semantics: default
additionalInformation: "[RFC4360]"
references:
- RFC8549
- elementId: 487
name: bgpSourceExtendedCommunityList
type: basicList
status: current
description: basicList of zero or more bgpExtendedCommunity IEs, containing the BGP Extended Communities corresponding with source IP address of a specific flow
revision: 0
date: 2019-01-18
semantics: list
additionalInformation: "[RFC6313] [RFC4360]"
references:
- RFC8549
- elementId: 488
name: bgpDestinationExtendedCommunityList
type: basicList
status: current
description: basicList of zero or more bgpExtendedCommunity IEs, containing the BGP Extended Communities corresponding with destination IP address of a specific flow
revision: 0
date: 2019-01-18
semantics: list
additionalInformation: "[RFC6313] [RFC4360]"
references:
- RFC8549
- elementId: 489
name: bgpLargeCommunity
type: octetArray
status: current
description: BGP Large Community as defined in [RFC8092]; the size of this IE MUST be 12 octets.
revision: 0
date: 2019-01-18
semantics: default
additionalInformation: "[RFC8092]"
references:
- RFC8549
- elementId: 490
name: bgpSourceLargeCommunityList
type: basicList
status: current
description: basicList of zero or more bgpLargeCommunity IEs, containing the BGP Large Communities corresponding with source IP address of a specific flow
revision: 0
date: 2019-01-18
semantics: list
additionalInformation: "[RFC6313] [RFC8092]"
references:
- RFC8549
- elementId: 491
name: bgpDestinationLargeCommunityList
type: basicList
status: current
description: basicList of zero or more bgpLargeCommunity IEs, containing the BGP Large Communities corresponding with destination IP address of a specific flow
revision: 0
date: 2019-01-18
semantics: list
additionalInformation: "[RFC6313] [RFC8092]"
references:
- RFC8549
- elementId: 492
name: srhFlagsIPv6
type: unsigned8
status: current
description: The 8-bit Flags field defined in the SRH (Section 2 of [RFC8754]). Assigned flags and their meanings are provided in the ["Segment Routing Header Flags"] IANA registry.
revision: 0
date: 2023-06-08
semantics: flags
additionalInformation: See the assignments in the "Segment Routing Header Flags" registry at [https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml#segment-routing-header-flags]. See also [RFC8754] for the SRH specification.
references:
- RFC9487
- elementId: 493
name: srhTagIPv6
type: unsigned16
status: current
description: The 16-bit Tag field defined in the SRH (Section 2 of [RFC8754]). A tag is used to mark a packet as part of a class or group of packets sharing the same set of properties.
revision: 0
date: 2023-06-08
semantics: identifier
additionalInformation: See Section 2 of [RFC8754] for more details about the Tag.
references:
- RFC9487
- elementId: 494
name: srhSegmentIPv6
type: ipv6Address
status: current
description: The 128-bit IPv6 address that represents an SRv6 segment.
revision: 0
date: 2023-06-08
semantics: default
additionalInformation: Specified in Section 1 of [RFC8402] and mentioned in "Segment List" in Section 2 of [RFC8754].
references:
- RFC9487
- elementId: 495
name: srhActiveSegmentIPv6
type: ipv6Address
status: current
description: The 128-bit IPv6 address that represents the active SRv6 segment.
revision: 0
date: 2023-06-08
semantics: default
additionalInformation: See Section 2 of [RFC8402] for the definition of "active segment".
references:
- RFC9487
- elementId: 496
name: srhSegmentIPv6BasicList
type: basicList
status: current
description: The ordered basicList [RFC6313] of zero or more 128-bit IPv6 addresses in the SRH that represents the SRv6 Segment List. As specified in Section 2 of [RFC8754], the Segment List is encoded starting from the last segment of the SR Policy. That is, the first element of the Segment List (Segment List[0]) contains the last segment of the SR Policy, the second element contains the penultimate segment of the SR Policy, and so on.
revision: 0
date: 2023-06-08
semantics: list
additionalInformation: See Section 2 of [RFC8754] for more details about the SRv6 Segment List.
references:
- RFC9487
- elementId: 497
name: srhSegmentIPv6ListSection
type: octetArray
status: current
description: The SRv6 Segment List as defined in Section 2 of [RFC8754] as a series of octets in IPFIX.
revision: 0
date: 2023-06-08
semantics: default
additionalInformation: See Section 2 of [RFC8754] for more details about the SRv6 Segment List.
references:
- RFC9487
- elementId: 498
name: srhSegmentsIPv6Left
type: unsigned8
status: current
description: The 8-bit unsigned integer defining the number of segments remaining to reach the end of the Segment List from the SRH.
revision: 0
date: 2023-06-08
semantics: quantity
additionalInformation: Specified by the "Segments Left" field in Section 4.4 of [RFC8200] and mentioned in Section 2 of [RFC8754].
references:
- RFC9487
- elementId: 499
name: srhIPv6Section
type: octetArray
status: current
description: The SRH and its TLVs as defined in Section 2 of [RFC8754] as a series of octets in IPFIX.
revision: 0
date: 2023-06-08
semantics: default
additionalInformation: See Section 2 of [RFC8754] for more details about the structure of an SRH.
references:
- RFC9487
- elementId: 500
name: srhIPv6ActiveSegmentType
type: unsigned8
status: current
description: The designator of the routing protocol or PCEP extension where the active SRv6 segment has been learned from. Values for this Information Element are listed in the "IPFIX IPv6 SRH Segment Type (Value 500)†subregistry; see [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-ipv6-srh-segment-type].
revision: 0
date: 2023-06-08
semantics: identifier
additionalInformation: See the assigned types in the "IPFIX IPv6 SRH Segment (Value 500)" registry at [https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-ipv6-srh-segment-type].
references:
- RFC9487
- elementId: 501
name: srhSegmentIPv6LocatorLength
type: unsigned8
status: current
description: The length of the SRH segment IPv6 locator specified as the number of significant bits. Together with srhSegmentIPv6, it enables the calculation of the SRv6 Locator.
revision: 1
date: 2024-01-22
semantics: default
additionalInformation: See Section 3.1 of [RFC8986] for more details about the SID format.
references:
- RFC9487
- RFC Errata 7728
- elementId: 502
name: srhSegmentIPv6EndpointBehavior
type: unsigned16
status: current
description: The 16-bit unsigned integer that represents an SRv6 Endpoint behavior as per Section 4 of [RFC8986]. Assigned values and their meanings are provided in the ["SRV6 Endpoint Behaviors"] registry.
revision: 0
date: 2023-06-08
semantics: identifier
additionalInformation: See the assigned behaviors in the "SRv6 Endpoint Behaviors" registry at [https://www.iana.org/assignments/segment-routing/segment-routing.xhtml#srv6-endpoint-behaviors]. See Section 4 of [RFC8986] for more details about the processing of endpoint behaviors.
references:
- RFC9487
- elementId: 503
name: transportChecksum
type: unsigned16
status: current
description: The checksum in the transport header. For the transport protocols UDP and TCP, this is the checksum given in the respective header. This field MAY also be used for future transport protocols that have 16-bit checksum values.
revision: 0
date: 2024-03-27
semantics: default
additionalInformation: See [RFC768] for the definition of the UDP checksum field. See [RFC9293] for the definition of the TCP checksum field.
references:
- ipfix-iana_at_cisco.com
- elementId: 504
name: icmpHeaderPacketSection
type: octetArray
status: current
description: This Information Element carries a series of n octets from the ICMP header of a sampled packet, starting sectionOffset octets into the ICMP header. However, if no sectionOffset field corresponding to this Information Element is present, then a sectionOffset of zero applies, and the octets MUST be from the start of the ICMP header. With sufficient length, this element also reports octets from the ICMP payload. However, full packet capture of arbitrary packet streams is explicitly out of scope per the Security Considerations sections of [RFC5477] and [RFC2804]. The sectionExportedOctets expresses how much data was exported, while the remainder is padding. When the sectionExportedOctets field corresponding to this Information Element exists, this Information Element MAY have a fixed length and MAY be padded, or it MAY have a variable length. When the sectionExportedOctets field corresponding to this Information Element does not exist, this Information Element SHOULD have a variable length and MUST NOT be padded. In this case, the size of the exported section may be constrained due to limitations in the IPFIX protocol.
revision: 0
date: 2024-03-27
semantics: default
additionalInformation: See [RFC792] for the definition of the IPv4 ICMP header. See [RFC4443] for the definition of the IPv6 ICMP header.
references:
- ipfix-iana_at_cisco.com
- elementId: 505
name: gtpuFlags
type: unsigned8
status: current
description: 8-bit flags field indicating the version of GTP-U protocol, protocol type and presence of extension header, sequence number and N-PDU number defined in Section 5.1 of the 3GPP specification [TS.29281].
revision: 0
date: 2024-04-12
semantics: flags
additionalInformation: Refer to section 5.1 of the 3GPP specification [TS.29281].
references:
- draft-voyersriram-opsawg-ipfix-gtpu-05
- elementId: 506
name: gtpuMsgType
type: unsigned8
status: current
description: 8-bit Message type field indicating the type of GTP-U message defined in section 5.1 of the 3GPP specification [TS.29281].
revision: 0
date: 2024-04-12
semantics: identifier
additionalInformation: Refer to section 5.1 of the 3GPP specification [TS.29281].
references:
- draft-voyersriram-opsawg-ipfix-gtpu-05
- elementId: 507
name: gtpuTEid
type: unsigned32
status: current
description: 32-bit tunnel endpoint identifier field defined in section 5.1 of the 3GPP specification [TS.29281]. This field unambiguously identifies a tunnel endpoint in the receiving GTP-U protocol entity for a given UDP/IP endpoint. The receiving side of a GTP tunnel locally assigns the TEID value the transmitting side has to use. The TEID values are exchanged between tunnel endpoints using control plane messages.
revision: 0
date: 2024-04-12
semantics: identifier
additionalInformation: Refer to section 5.1 of the 3GPP specification [TS.29281].
references:
- draft-voyersriram-opsawg-ipfix-gtpu-05
- elementId: 508
name: gtpuSequenceNum
type: unsigned16
status: current
description: 16-bit sequence number field defined in section 5.1 (Optional Fields) of the 3GPP specification [TS.29281].
revision: 0
date: 2024-04-12
semantics: identifier
additionalInformation: Refer to section 5.1 of the 3GPP specification [TS.29281].
references:
- draft-voyersriram-opsawg-ipfix-gtpu-05
- elementId: 509
name: gtpuQFI
type: unsigned8
status: current
description: "6-bit QoS flow identifier field defined in PDU Session Container extension header of GTP-U. This is defined in section 5.5.3.3 of the 3GPP specification [TS.38415]. This is used to determine the QoS flow and QoS profile which are associated with the received packet. The basic encoding is 8 bits. The layout of basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +----+----+----+----+----+----+----+----+ |Reserved | 6 bit QFI value | +----+----+----+----+----+----+----+----+ Examples: value : 0x08 binary: 00001000 decode: 001000 - QFI value value : 0x3e binary: 00111110 decode: 111110 - QFI value"
revision: 0
date: 2024-04-12
semantics: identifier
additionalInformation: Refer to section 5.5.3.3 of the 3GPP specification [TS.38415] and section 5.7.1.1 from 3GPP specification [TS.23501] for additional details.
references:
- draft-voyersriram-opsawg-ipfix-gtpu-05
- elementId: 510
name: gtpuPduType
type: unsigned8
status: current
description: "4-bit PDU type field defined in PDU Session Container extension header of GTP-U. This is defined in section 5.5.3 of the 3GPP specification [TS.38415]. This field indicates the structure of the PDU session user plane frame. The basic encoding is 8 bits. The layout of basic encoding is as follows: MSB - 0 1 2 3 4 5 6 7 - LSB +----+----+----+----+----+----+----+----+ | Reserved | 4 bit PDU Type | +----+----+----+----+----+----+----+----+ Examples: value : 0x01 binary: 00000001 decode: 0001 - PDU Type value"
revision: 0
date: 2024-04-12
semantics: identifier
additionalInformation: Refer to section 5.5.3 of the 3GPP specification [TS.38415].
references:
- draft-voyersriram-opsawg-ipfix-gtpu-05
- elementId: 511
name: bgpSourceAsPathList
type: basicList
status: current
description: Ordered basicList [RFC6313] of zero or more bgpSourceAsNumber elements, containing the BGP as-path corresponding with the source IP address of a specific flow.
revision: 0
date: 2024-05-24
semantics: list
additionalInformation: See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.
references:
- ipfix-iana_at_cisco.com
- elementId: 512
name: bgpDestinationAsPathList
type: basicList
status: current
description: Ordered basicList [RFC6313] of zero or more bgpDestinationAsNumber elements, containing the BGP as-path corresponding with the destination IP address of a specific flow.
revision: 0
date: 2024-05-24
semantics: list
additionalInformation: See [RFC4271] for a description of BGP-4, and see [RFC1930] for the definition of the AS number.
references:
- ipfix-iana_at_cisco.com
- elementId: 513
name: ipv6ExtensionHeaderType
type: unsigned8
status: current
description: Type of an IPv6 extension header observed in at least one packet of this Flow.
revision: 0
date: 2024-10-07
semantics: identifier
additionalInformation: See the IPv6 Extension Header Types registry at [IANA-EH]. See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 514
name: ipv6ExtensionHeaderCount
type: unsigned8
status: current
description: The number of consecutive occurrences of the same extension header type in a Flow. This IE is reported, e.g., in the ipv6ExtensionHeaderTypeCountList IE. The type of the extension header is provided in the ipv6ExtensionHeaderType IE.
revision: 0
date: 2024-10-07
semantics: totalCounter
additionalInformation: See the IPv6 Extension Header Types registry at [IANA-EH]. See Section 4 of [RFC8200] for the general definition of IPv6 extension headers.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 515
name: ipv6ExtensionHeadersFull
type: unsigned256
status: current
description: IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 extension header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contains the respective IPv6 extension header, the value of the corresponding bit is 0. The IPv6 extension header associated with each bit is provided in [IANA-IPFIX-IPv6EH]. Bit 0 corresponds to the least-significant bit in the ipv6ExtensionHeadersFull IE while bit 255 corresponds to the most-significant bit of the IE. In doing so, few octets will be needed to encode common IPv6 extension headers when observed in a Flow. The "No Next Header" (bit 2) value (Section 4.7 of [RFC8200]) is used if there is no upper-layer header in an IPv6 packet. Even if the value is not considered as an extension header as such, the corresponding bit is set in the ipv6ExtensionHeadersFull IE whenever that value is encountered in the Flow. Extension headers observed in a Flow with varying extension header chain MUST NOT be grouped in the ipv6ExtensionHeadersFull IE if the ipv6ExtensionHeaderChainLengthList IE is also present. If the ipv6ExtensionHeaderChainLengthList IE is not present, then extension headers observed in a Flow with varying extension header chain MAY be grouped in one single ipv6ExtensionHeadersFull IE or be exported in separate ipv6ExtensionHeadersFull IEs, one for each extension header chain. The ipv6ExtensionHeadersFull IE MUST NOT be exported if ipv6ExtensionHeaderTypeCountList IE is also present because of the overlapping scopes between these two IEs. The value of ipv6ExtensionHeadersFull IE may be encoded in fewer octets per the guidelines in Section 6.2 of [RFC7011]
revision: 0
date: 2024-10-07
semantics: flags
additionalInformation: See the IPv6 Extension Header Types registry at [IANA-EH]. See Section 4 of [RFC8200] for the general definition of IPv6 extension headers. The ipv6ExtensionHeadersFull IE deprecates the ipv6ExtensionHeaders IE (64) that was initially defined in [RFC5102]. [RFC7012] obsoletes [RFC5102] and specifies that [IANA-IPFIX] is the normative reference for the ipv6ExtensionHeaders IE (64).
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 516
name: ipv6ExtensionHeaderTypeCountList
type: subTemplateList
status: current
description: "As per Section 4.1 of [RFC8200], IPv6 nodes must accept and attempt to process extension headers occurring any number of times in the same packet. This IE echoes the order of extension headers and number of onsecutive occurrences of the same extension header type in a Flow. This IE is a subTemplateList of ipv6ExtensionHeaderType and ipv6ExtensionHeaderCount IEs. Each header chain in Flow with varying extension header chain MUST be exported in a separate IE. The same extension header type may appear several times in an ipv6ExtensionHeaderTypeCountList IE. For example, if an IPv6 packet of a Flow includes a Hop-by-Hop Options header, a Destination Options header, a Fragment header, and Destination Options header, the ipv6ExtensionHeaderTypeCountList IE will report: * the count of Hop-by-Hop Options headers, * the occurrences of the Destination Options headers that are observed before a Fragment header, * the occurrences of the Fragment headers, and * the occurrences of the Destination Options headers that are observed right after a Fragment header. If an implementation determines that an observed packet of a Flow includes an extension header (including an extension header that it does not support), then the exact observed code of that extension header MUST be echoed in the ipv6ExtensionHeaderTypeCountList IE. How an implementation disambiguates between unknown upper-layer protocols vs. extension headers is not IPFIX-specific. Refer, for example, to Section 2.2 of [RFC8883] for a behavior of an intermediate node that encounters an unknown Next Header type."
revision: 0
date: 2024-10-07
semantics: list
additionalInformation: See the IPv6 Extension Header Types registry at [IANA-EH]. See [RFC8200] for the general definition of IPv6 extension headers.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 517
name: ipv6ExtensionHeadersLimit
type: boolean
status: current
description: When set to "false", this IE indicates that the exported extension headers information (e.g., ipv6ExtensionHeadersFull or ipv6ExtensionHeaderTypeCountList) does not match the full enclosed extension headers, but only up to a limit that is typically set by hardware or software. When set to "true", this IE indicates that the exported extension header information matches the full enclosed extension headers.
revision: 0
date: 2024-10-07
semantics: default
additionalInformation: See Section 4 of [RFC8200] for the general definition of IPv6 extension headers. See [RFC8883] for an example of IPv6 packet processing due to limits on extension headers.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 518
name: ipv6ExtensionHeadersChainLength
type: unsigned32
status: current
description: In theory, there are no limits on the number of IPv6 extension headers that may be present in a packet other than the path MTU. However, it was regularly reported that IPv6 packets with extension headers are often dropped in the Internet (e.g., [RFC7872]). As discussed in Section 1.2 of [RFC8883], some hardware devices implement a parsing buffer of a fixed size to process packets, including all the headers. When the aggregate length of headers of an IPv6 packet exceeds that size, the packet will be discarded or deferred to a slow path. The ipv6ExtensionHeadersChainLength IE is used to report, in octets, the length of an extension header chain observed in a Flow. The length is the sum of the length of all extension headers of the chain. Exporting such information might help identifying root causes of performance degradation, including packet drops. Each header chain length of a Flow with varying extension header chain MUST be exported in a separate ipv6ExtensionHeadersChainLength IE.
revision: 0
date: 2024-10-07
semantics: identifier
additionalInformation: See Section 4 of [RFC8200] for the general definition of IPv6 extension headers. See [RFC9098] for an overview of operational implications of IPv6 packets with extension headers.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 519
name: ipv6ExtensionHeaderChainLengthList
type: subTemplateList
status: current
description: This IE is used to report the chains and their length as observed in a Flow with varying extension header chain. This IE is a subTemplateList of ipv6ExtensionHeadersFull and ipv6ExtensionHeadersChainLength IEs. If several extension header chains are observed in a Flow, each header chain MUST be exported in a separate ipv6ExtensionHeaderChainLengthList IE.
revision: 0
date: 2024-10-07
semantics: list
additionalInformation: See the IPv6 Extension Header Types registry at [IANA-EH]. See [RFC8200] for the general definition of IPv6 extension headers.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 520
name: tcpOptionsFull
type: unsigned256
status: current
description: TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contains the respective TCP option, the value of the corresponding bit is 0. Options are mapped to bits according to their option numbers. TCP option Kind 0 corresponds to the least-significant bit in the tcpOptionsFull IE while Kind 255 corresponds to the most-significant bit of the IE. This approach allows an observer to export any observed TCP option even if it does not support that option and without requiring updating a mapping table. The value of tcpOptionsFull IE may be encoded in fewer octets per the guidelines in Section 6.2 of [RFC7011]. The presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs is an indication that a shared TCP option (Kind=253 or 254) is observed in a Flow. The presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs takes precedence over setting the corresponding bits in the tcpOptionsFull IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of tcpSharedOptionExID16List or tcpSharedOptionExID32List IEs, the Exporter MUST NOT set to 1 the shared TCP options (Kind=253 or 254) flags of the tcpOptionsFull IE that is reported for the same Flow.
revision: 0
date: 2024-10-07
semantics: flags
additionalInformation: See the TCP Option Kind Numbers registry at [IANA-TCP]. See [RFC9293] for the general definition of TCP options. The tcpOptionsFull IE deprecates the tcpOptions IE (209) that was initially defined in [RFC5102]. [RFC7012] obsoletes [RFC5102] and specifies that [IANA-IPFIX] is the normative reference for the tcpOptions IE (209).
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 521
name: tcpSharedOptionExID16
type: unsigned16
status: current
description: Reports an observed 2-byte ExID in a shared TCP option (Kind=253 or 254) in a Flow. A basicList of tcpSharedOptionExID16 is used to report tcpSharedOptionExID16List values.
revision: 0
date: 2024-10-07
semantics: identifier
additionalInformation: See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs]. See [RFC9293] for the general definition of TCP options. See [RFC6994] for the shared use of experimental TCP Options.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 522
name: tcpSharedOptionExID32
type: unsigned32
status: current
description: Reports an observed 4-byte ExID in a shared TCP option (Kind=253 or 254) in a Flow. A basicList of tcpSharedOptionExID32 is used to report tcpSharedOptionExID32List values.
revision: 0
date: 2024-10-07
semantics: identifier
additionalInformation: See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs]. See [RFC9293] for the general definition of TCP options. See [RFC6994] for the shared use of experimental TCP Options.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 523
name: tcpSharedOptionExID16List
type: basicList
status: current
description: Reports observed 2-byte ExIDs in shared TCP options (Kind=253 or 254) in a Flow. A basicList of tcpSharedOptionExID16 IEs in which each tcpSharedOptionExID16 IE carries an observed 2-byte ExID in a shared option.
revision: 0
date: 2024-10-07
semantics: list
additionalInformation: See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs]. See [RFC9293] for the general definition of TCP options. See [RFC6994] for the shared use of experimental TCP Options.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 524
name: tcpSharedOptionExID32List
type: basicList
status: current
description: Reports observed 4-byte ExIDs in shared TCP options (Kind=253 or 254) in a Flow. A basicList of tcpSharedOptionExID32 IEs in which each tcpSharedOptionExID32 IE carries an observed 4-byte ExID in a shared option.
revision: 0
date: 2024-10-07
semantics: list
additionalInformation: See the TCP Experimental Option Experiment Identifiers (TCP ExIDs) registry at [IANA-TCP-EXIDs]. See [RFC9293] for the general definition of TCP options. See [RFC6994] for the shared use of experimental TCP Options.
references:
- RFC-ietf-opsawg-ipfix-tcpo-v6eh-18
- elementId: 525
name: udpSafeOptions
type: unsigned256
status: current
description: Observed SAFE UDP options in a Flow. The information is encoded in a set of bit fields. Options are mapped to bits according to their option numbers. UDP option Kind 0 corresponds to the least-significant bit in the udpSafeOptions IE while Kind 191 corresponds to the 65th most-significant bit of the IE. The bit is set to 1 if the corresponding SAFE UDP option is observed at least once in the Flow. The bit is set to 0 if the option is never observed in the Flow. The 64 most-significant bits MUST be set to 0. The reduced-size encoding per Section 6.2 of [RFC7011] is followed whenever fewer octets are needed to report observed SAFE UDP options. For example, if only option Kinds <= 31 are observed, then the value of the udpSafeOptions IE can be encoded as unsigned32, or if only option Kinds <= 63 are observed, then the value of the udpSafeOptions IE can be encoded as unsigned64. The presence of udpSafeExIDList is an indication that the SAFE Experimental option is observed in a Flow. The presence of udpSafeExIDList takes precedence over setting the corresponding bit in the udpSafeOptions IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of udpSafeExIDList IE, the Exporter MUST NOT set to 1 the EXP flag of the udpSafeOptions IE that is reported for the same Flow.
revision: 0
date: 2024-10-23
semantics: flags
references:
- RFC-ietf-opsawg-tsvwg-udp-ipfix-14
- elementId: 526
name: udpUnsafeOptions
type: unsigned64
status: current
description: Observed UNSAFE UDP options in a Flow. The information is encoded in a set of bit fields. Options are mapped to bits according to their option numbers. UDP option Kind 192 corresponds to the least-significant bit in the udpUnsafeOptions IE while Kind 255 corresponds to the most-significant bit of the IE. The bit is set to 1 if the corresponding UNSAFE UDP option is observed at least once in the Flow. The bit is set to 0 if the option is never observed in the Flow. The reduced-size encoding per Section 6.2 of [RFC7011] is followed whenever fewer octets are needed to report observed UNSAFE UDP options. The presence of udpUnsafeExIDList is an indication that the UNSAFE Experimental option is observed in a Flow. The presence of udpUnsafeExIDList takes precedence over setting the corresponding bit in the udpUnsafeOptions IE for the same Flow. In order to optimize the use of the reduced-size encoding in the presence of udpUnsafeExIDList IE, the Exporter MUST NOT set to 1 the UEXP flag of the udpUnsafeOptions IE that is reported for the same Flow.
revision: 0
date: 2024-10-23
semantics: flags
references:
- RFC-ietf-opsawg-tsvwg-udp-ipfix-14
- elementId: 527
name: udpExID
type: unsigned16
status: current
description: Observed ExID in an Experimental option (EXP, Kind=127) or an UNSAFE Experimental option (UEXP, Kind=254). A basicList of udpExID is used to report udpSafeExIDList and udpUnsafeExIDList values.
revision: 0
date: 2024-10-23
semantics: identifier
references:
- RFC-ietf-opsawg-tsvwg-udp-ipfix-14
- elementId: 528
name: udpSafeExIDList
type: basicList
status: current
description: Observed ExIDs in the Experimental option (EXP, Kind=127). A basicList of udpExID Information Elements in which each udpExID Information Element carries the ExID observed in an EXP option.
revision: 0
date: 2024-10-23
semantics: list
references:
- RFC-ietf-opsawg-tsvwg-udp-ipfix-14
- elementId: 529
name: udpUnsafeExIDList
type: basicList
status: current
description: Observed ExIDs in the UNSAFE Experimental option (UEXP, Kind=254). A basicList of udpExID Information Elements in which each udpExID Information Element carries the ExID observed in an UEXP option.
revision: 0
date: 2024-10-23
semantics: list
references:
- RFC-ietf-opsawg-tsvwg-udp-ipfix-14