· 8 years ago · Dec 01, 2017, 11:28 PM
1ElementID,Name,Abstract Data Type,Data Type Semantics,Status,Description,Units,Range,References,Requester,Revision,Date
20,Reserved,,,,,,,,[RFC5102],,2013-02-18
31,octetDeltaCount,unsigned64,deltaCounter,current,"The number of octets since the previous report (if any)
4in incoming packets for this Flow at the Observation Point.
5The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
62,packetDeltaCount,unsigned64,deltaCounter,current,"The number of incoming packets since the previous report
7(if any) for this Flow at the Observation Point.",packets,,,[RFC5102],0,2013-02-18
83,deltaFlowCount,unsigned64,deltaCounter,current,"The conservative count of Original Flows contributing
9to this Aggregated Flow; may be distributed via any of the methods
10expressed by the valueDistributionMethod Information Element.",flows,,,[RFC7015],1,2013-06-25
114,protocolIdentifier,unsigned8,identifier,current,"The value of the protocol number in the IP packet header.
12The protocol number identifies the IP packet payload type.
13Protocol numbers are defined in the IANA Protocol Numbers
14registry.
15
16
17
18
19In Internet Protocol version 4 (IPv4), this is carried in the
20Protocol field. In Internet Protocol version 6 (IPv6), this
21is carried in the Next Header field in the last extension
22header of the packet.",,,"See [RFC791] for the specification of the IPv4
23protocol field.
24See [RFC8200] for the specification of the
25IPv6 protocol field.
26See the list of protocol numbers assigned by IANA at [IANA registry protocol-numbers].",[RFC5102],0,2013-02-18
275,ipClassOfService,unsigned8,identifier,current,"For IPv4 packets, this is the value of the TOS field in
28the IPv4 packet header. For IPv6 packets, this is the
29value of the Traffic Class field in the IPv6 packet header.",,,"See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field.
30See [RFC8200] for the definition of the IPv6
31Traffic Class field.",[RFC5102],0,2013-02-18
326,tcpControlBits,unsigned16,flags,current,"TCP control bits observed for the packets of this Flow.
33This information is encoded as a bit field; for each TCP control
34bit, there is a bit in this set. The bit is set to 1 if any
35observed packet of this Flow has the corresponding TCP control bit
36set to 1. The bit is cleared to 0 otherwise.
37
38
39
40
41The values of each bit are shown below, per the definition of the
42bits in the TCP header [RFC793][RFC3168][RFC3540]:
43
44
45
46 MSb LSb
47 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
48+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
49| | | N | C | E | U | A | P | R | S | F |
50| Zero | Future | S | W | C | R | C | S | S | Y | I |
51| (Data Offset) | Use | | R | E | G | K | H | T | N | N |
52+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
53
54bit flag
55value name description
56------+-----+-------------------------------------
570x8000 Zero (see tcpHeaderLength)
580x4000 Zero (see tcpHeaderLength)
590x2000 Zero (see tcpHeaderLength)
600x1000 Zero (see tcpHeaderLength)
610x0800 Future Use
620x0400 Future Use
630x0200 Future Use
640x0100 NS ECN Nonce Sum
650x0080 CWR Congestion Window Reduced
660x0040 ECE ECN Echo
670x0020 URG Urgent Pointer field significant
680x0010 ACK Acknowledgment field significant
690x0008 PSH Push Function
700x0004 RST Reset the connection
710x0002 SYN Synchronize sequence numbers
720x0001 FIN No more data from sender
73
74
75
76As the most significant 4 bits of octets 12 and 13 (counting from
77zero) of the TCP header [RFC793] are used to encode the TCP data
78offset (header length), the corresponding bits in this Information
79Element MUST be exported as zero and MUST be ignored by the
80collector. Use the tcpHeaderLength Information Element to encode
81this value.
82
83
84
85
86Each of the 3 bits (0x800, 0x400, and 0x200), which are reserved
87for future use in [RFC793], SHOULD be exported as observed in the
88TCP headers of the packets of this Flow.
89
90
91
92
93If exported as a single octet with reduced-size encoding, this
94Information Element covers the low-order octet of this field (i.e,
95bits 0x80 to 0x01), omitting the ECN Nonce Sum and the three
96Future Use bits. A collector receiving this Information Element
97with reduced-size encoding must not assume anything about the
98content of these four bits.
99
100
101
102
103Exporting Processes exporting this Information Element on behalf
104of a Metering Process that is not capable of observing any of the
105ECN Nonce Sum or Future Use bits SHOULD use reduced-size encoding,
106and only export the least significant 8 bits of this Information
107Element.
108
109
110
111
112Note that previous revisions of this Information Element's
113definition specified that the CWR and ECE bits must be exported as
114zero, even if observed. Collectors should therefore not assume
115that a value of zero for these bits in this Information Element
116indicates the bits were never set in the observed traffic,
117especially if these bits are zero in every Flow Record sent by a
118given exporter.",,,[RFC793][RFC3168][RFC3540],[RFC7125],1,2014-01-03
1197,sourceTransportPort,unsigned16,identifier,current,"The source port identifier in the transport header.
120For the transport protocols UDP, TCP, and SCTP, this is the
121source port number given in the respective header. This
122field MAY also be used for future transport protocols that
123have 16-bit source port identifiers.",,,"See [RFC768] for the definition of the UDP
124source port field.
125See [RFC793] for the definition of the TCP
126source port field.
127See [RFC4960] for the definition of SCTP.
128
129
130
131
132Additional information on defined UDP and TCP port numbers can be
133found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
1348,sourceIPv4Address,ipv4Address,default,current,The IPv4 source address in the IP packet header.,,,"See [RFC791] for the definition of the IPv4
135source address field.",[RFC5102],1,2014-02-03
1369,sourceIPv4PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
137sourceIPv4Prefix Information Element.",bits,0-32,,[RFC5102],0,2013-02-18
13810,ingressInterface,unsigned32,identifier,current,"The index of the IP interface where packets of this Flow
139are being received. The value matches the value of managed
140object 'ifIndex' as defined in [RFC2863].
141Note that ifIndex values are not assigned statically to an
142interface and that the interfaces may be renumbered every
143time the device's management system is re-initialized, as
144specified in [RFC2863].",,,"See [RFC2863] for the definition of the
145ifIndex object.",[RFC5102],0,2013-02-18
14611,destinationTransportPort,unsigned16,identifier,current,"The destination port identifier in the transport header.
147For the transport protocols UDP, TCP, and SCTP, this is the
148destination port number given in the respective header.
149This field MAY also be used for future transport protocols
150that have 16-bit destination port identifiers.",,,"See [RFC768] for the definition of the UDP
151destination port field.
152See [RFC793] for the definition of the TCP
153destination port field.
154See [RFC4960] for the definition of SCTP.
155
156
157
158
159Additional information on defined UDP and TCP port numbers can be
160found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
16112,destinationIPv4Address,ipv4Address,default,current,The IPv4 destination address in the IP packet header.,,,"See [RFC791] for the definition of the IPv4
162destination address field.",[RFC5102],1,2014-02-03
16313,destinationIPv4PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
164destinationIPv4Prefix Information Element.",bits,0-32,,[RFC5102],0,2013-02-18
16514,egressInterface,unsigned32,identifier,current,"The index of the IP interface where packets of
166this Flow are being sent. The value matches the value of
167managed object 'ifIndex' as defined in [RFC2863].
168Note that ifIndex values are not assigned statically to an
169interface and that the interfaces may be renumbered every
170time the device's management system is re-initialized, as
171specified in [RFC2863].",,,"See [RFC2863] for the definition of the
172ifIndex object.",[RFC5102],0,2013-02-18
17315,ipNextHopIPv4Address,ipv4Address,default,current,The IPv4 address of the next IPv4 hop.,,,,[RFC5102],1,2014-02-03
17416,bgpSourceAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the source IP address.
175If AS path information for this Flow is only available as
176an unordered AS set (and not as an ordered AS sequence),
177then the value of this Information Element is 0.",,,"See [RFC4271] for a description of BGP-4, and
178see [RFC1930] for the definition of the AS
179number.",[RFC5102],0,2013-02-18
18017,bgpDestinationAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the destination IP
181address. If AS path information for this Flow is only
182available as an unordered AS set (and not as an ordered AS
183sequence), then the value of this Information Element is 0.",,,"See [RFC4271] for a description of BGP-4, and
184see [RFC1930] for the definition of the AS
185number.",[RFC5102],0,2013-02-18
18618,bgpNextHopIPv4Address,ipv4Address,default,current,The IPv4 address of the next (adjacent) BGP hop.,,,See [RFC4271] for a description of BGP-4.,[RFC5102],1,2014-02-03
18719,postMCastPacketDeltaCount,unsigned64,deltaCounter,current,"The number of outgoing multicast packets since the
188previous report (if any) sent for packets of this Flow
189by a multicast daemon within the Observation Domain.
190This property cannot necessarily be observed at the
191Observation Point, but may be retrieved by other means.",packets,,,[RFC5102],0,2013-02-18
19220,postMCastOctetDeltaCount,unsigned64,deltaCounter,current,"The number of octets since the previous report (if any)
193in outgoing multicast packets sent for packets of this
194Flow by a multicast daemon within the Observation Domain.
195This property cannot necessarily be observed at the
196Observation Point, but may be retrieved by other means.
197The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
19821,flowEndSysUpTime,unsigned32,,current,"The relative timestamp of the last packet of this Flow. It indicates the
199number of milliseconds since the last (re-)initialization of the IPFIX
200Device (sysUpTime). sysUpTime can be calculated from
201systemInitTimeMilliseconds.",milliseconds,,,[RFC5102],1,2014-01-11
20222,flowStartSysUpTime,unsigned32,,current,"The relative timestamp of the first packet of this Flow. It indicates
203the number of milliseconds since the last (re-)initialization of the
204IPFIX Device (sysUpTime). sysUpTime can be calculated from
205systemInitTimeMilliseconds.",milliseconds,,,[RFC5102],1,2014-01-11
20623,postOctetDeltaCount,unsigned64,deltaCounter,current,"The definition of this Information Element is identical
207to the definition of Information Element
208'octetDeltaCount', except that it reports a
209potentially modified value caused by a middlebox
210function after the packet passed the Observation Point.",octets,,,[RFC5102],0,2013-02-18
21124,postPacketDeltaCount,unsigned64,deltaCounter,current,"The definition of this Information Element is identical
212to the definition of Information Element
213'packetDeltaCount', except that it reports a
214potentially modified value caused by a middlebox
215function after the packet passed the Observation Point.",packets,,,[RFC5102],0,2013-02-18
21625,minimumIpTotalLength,unsigned64,,current,"Length of the smallest packet observed for this Flow.
217The packet length includes the IP header(s) length and
218the IP payload length.",octets,,"See [RFC791] for the specification of the IPv4
219total length.
220See [RFC8200] for the specification of the
221IPv6 payload length.
222See [RFC2675] for the specification of the
223IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
22426,maximumIpTotalLength,unsigned64,,current,"Length of the largest packet observed for this Flow.
225The packet length includes the IP header(s) length and
226the IP payload length.",octets,,"See [RFC791] for the specification of the IPv4
227total length.
228See [RFC8200] for the specification of the
229IPv6 payload length.
230See [RFC2675] for the specification of the
231IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
23227,sourceIPv6Address,ipv6Address,default,current,The IPv6 source address in the IP packet header.,,,"See [RFC8200] for the definition of the Source
233Address field in the IPv6 header.",[RFC5102],1,2014-02-03
23428,destinationIPv6Address,ipv6Address,default,current,The IPv6 destination address in the IP packet header.,,,"See [RFC8200] for the definition of the
235Destination Address field in the IPv6 header.",[RFC5102],1,2014-02-03
23629,sourceIPv6PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
237sourceIPv6Prefix Information Element.",bits,0-128,,[RFC5102],0,2013-02-18
23830,destinationIPv6PrefixLength,unsigned8,,current,"The number of contiguous bits that are relevant in the
239destinationIPv6Prefix Information Element.",bits,0-128,,[RFC5102],0,2013-02-18
24031,flowLabelIPv6,unsigned32,identifier,current,The value of the IPv6 Flow Label field in the IP packet header.,,0-0xFFFFF,"See [RFC8200] for the definition of the
241Flow Label field in the IPv6 packet header.",[RFC5102],1,2014-08-13
24232,icmpTypeCodeIPv4,unsigned16,identifier,current,"Type and Code of the IPv4 ICMP message. The combination of
243both values is reported as (ICMP type * 256) + ICMP code.",,,"See [RFC792] for the definition of the IPv4
244ICMP type and code fields.",[RFC5102],0,2013-02-18
24533,igmpType,unsigned8,identifier,current,The type field of the IGMP message.,,,"See [RFC3376] for the definition of the IGMP
246type field.",[RFC5102],0,2013-02-18
24734,samplingInterval,unsigned32,quantity,deprecated,"Deprecated in favor of 305 samplingPacketInterval. When using
248sampled NetFlow, the rate at which packets are sampled -- e.g., a
249value of 100 indicates that one of every 100 packets is sampled.",packets,,,[RFC7270],0,2014-04-04
25035,samplingAlgorithm,unsigned8,identifier,deprecated,"Deprecated in favor of 304 selectorAlgorithm. The type of
251algorithm used for sampled NetFlow:
252
253
254
255
256 1 - Deterministic Sampling,
257 2 - Random Sampling.
258
259
260
261
262The values are not compatible with the selectorAlgorithm IE, where
263""Deterministic"" has been replaced by ""Systematic count-based"" (1)
264or ""Systematic time-based"" (2), and ""Random"" is (3). Conversion
265is required; see [Packet Sampling (PSAMP) Parameters.]",,,,[RFC7270],0,2014-04-04
26636,flowActiveTimeout,unsigned16,,current,"The number of seconds after which an active Flow is timed out
267anyway, even if there is still a continuous flow of packets.",seconds,,,[RFC5102],0,2013-02-18
26837,flowIdleTimeout,unsigned16,,current,"A Flow is considered to be timed out if no packets belonging
269to the Flow have been observed for the number of seconds
270specified by this field.",seconds,,,[RFC5102],0,2013-02-18
27138,engineType,unsigned8,identifier,deprecated,"Type of flow switching engine in a router/switch:
272
273
274
275 RP = 0,
276 VIP/Line card = 1,
277 PFC/DFC = 2.
278
279
280
281Reserved for internal use on the Collector.",,,,[RFC7270],0,2014-04-04
28239,engineId,unsigned8,identifier,deprecated,"Versatile Interface Processor (VIP) or line card slot number of the flow switching engine in a
283router/switch. Reserved for internal use on the Collector.",,,,[RFC7270],0,2014-04-04
28440,exportedOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets that the Exporting Process
285has sent since the Exporting Process (re-)initialization
286to a particular Collecting Process.
287The value of this Information Element is calculated by
288summing up the IPFIX Message Header length values of all
289IPFIX Messages that were successfully sent to the Collecting
290Process. The reported number excludes octets in the IPFIX
291Message that carries the counter value.
292If this Information Element is sent to a particular
293Collecting Process, then by default it specifies the number
294of octets sent to this Collecting Process.",octets,,,[RFC5102],0,2013-02-18
29541,exportedMessageTotalCount,unsigned64,totalCounter,current,"The total number of IPFIX Messages that the Exporting Process
296has sent since the Exporting Process (re-)initialization to
297a particular Collecting Process.
298The reported number excludes the IPFIX Message that carries
299the counter value.
300If this Information Element is sent to a particular
301Collecting Process, then by default it specifies the number
302of IPFIX Messages sent to this Collecting Process.",messages,,,[RFC5102],0,2013-02-18
30342,exportedFlowRecordTotalCount,unsigned64,totalCounter,current,"The total number of Flow Records that the Exporting
304Process has sent as Data Records since the Exporting
305Process (re-)initialization to a particular Collecting
306Process. The reported number excludes Flow Records in
307the IPFIX Message that carries the counter value.
308If this Information Element is sent to a particular
309Collecting Process, then by default it specifies the number
310of Flow Records sent to this process.",flows,,,[RFC5102],0,2013-02-18
31143,ipv4RouterSc,ipv4Address,default,deprecated,"This is a platform-specific field for the Catalyst 5000/Catalyst 6000
312family. It is used to store the address of a router that is being
313shortcut when performing MultiLayer Switching.",,,[CCO-MLS] describes MultiLayer Switching.,[RFC7270],0,2014-04-04
31444,sourceIPv4Prefix,ipv4Address,default,current,IPv4 source address prefix.,,,,[RFC5102],0,2013-02-18
31545,destinationIPv4Prefix,ipv4Address,default,current,IPv4 destination address prefix.,,,,[RFC5102],0,2013-02-18
31646,mplsTopLabelType,unsigned8,identifier,current,"This field identifies the control protocol that allocated the
317top-of-stack label. Values for this field are listed in the
318MPLS label type registry. See
319[http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-mpls-label-type]",,,"See [RFC3031] for the MPLS label structure.
320See [RFC4364] for the association of MPLS
321labels with Virtual Private Networks (VPNs).
322See [RFC4271] for BGP and BGP routing.
323See [RFC5036] for Label Distribution Protocol
324(LDP).
325See the list of MPLS label types assigned by IANA at [IANA registry mpls-label-values].",[RFC5102],0,2013-02-18
32647,mplsTopLabelIPv4Address,ipv4Address,default,current,"The IPv4 address of the system that the MPLS top label will
327cause this Flow to be forwarded to.",,,"See [RFC3031] for the association between MPLS
328labels and IP addresses.",[RFC5102],1,2014-02-03
32948,samplerId,unsigned8,identifier,deprecated,"Deprecated in favor of 302 selectorId. The unique identifier
330associated with samplerName.",,,,[RFC7270],0,2014-04-04
33149,samplerMode,unsigned8,identifier,deprecated,"Deprecated in favor of 304 selectorAlgorithm. The values are not
332compatible: selectorAlgorithm=3 is random sampling. The type of
333algorithm used for sampling data: 1 - Deterministic, 2 - Random
334Sampling. Use with samplerRandomInterval.",,,,[RFC7270],0,2014-04-04
33550,samplerRandomInterval,unsigned32,quantity,deprecated,"Deprecated in favor of 305 samplingPacketInterval. Packet
336interval at which to sample -- in case of random sampling. Used in
337connection with the samplerMode 0x02 (random sampling) value.",,,,[RFC7270],0,2014-04-04
33851,classId,unsigned8,identifier,deprecated,"Deprecated in favor of 302 selectorId. Characterizes the traffic
339class, i.e., QoS treatment.",,,,[RFC7270],0,2014-04-04
34052,minimumTTL,unsigned8,,current,Minimum TTL value observed for any packet in this Flow.,hops,,"See [RFC791] for the definition of the IPv4
341Time to Live field.
342See [RFC8200] for the definition of the IPv6
343Hop Limit field.",[RFC5102],0,2013-02-18
34453,maximumTTL,unsigned8,,current,Maximum TTL value observed for any packet in this Flow.,hops,,"See [RFC791] for the definition of the IPv4
345Time to Live field.
346See [RFC8200] for the definition of the IPv6
347Hop Limit field.",[RFC5102],0,2013-02-18
34854,fragmentIdentification,unsigned32,identifier,current,"The value of the Identification field
349in the IPv4 packet header or in the IPv6 Fragment header,
350respectively. The value is 0 for IPv6 if there is
351no fragment header.",,,"See [RFC791] for the definition of the IPv4
352Identification field.
353See [RFC8200] for the definition of the
354Identification field in the IPv6 Fragment header.",[RFC5102],0,2013-02-18
35555,postIpClassOfService,unsigned8,identifier,current,"The definition of this Information Element is identical
356to the definition of Information Element
357'ipClassOfService', except that it reports a
358potentially modified value caused by a middlebox
359function after the packet passed the Observation Point.",,,"See [RFC791] for the definition of the IPv4
360TOS field.
361See [RFC8200] for the definition of the IPv6
362Traffic Class field.
363See [RFC3234] for the definition of
364middleboxes.",[RFC5102],0,2013-02-18
36556,sourceMacAddress,macAddress,default,current,The IEEE 802 source MAC address field.,,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
36657,postDestinationMacAddress,macAddress,default,current,"The definition of this Information Element is identical
367to the definition of Information Element
368'destinationMacAddress', except that it reports a
369potentially modified value caused by a middlebox
370function after the packet passed the Observation Point.",,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
37158,vlanId,unsigned16,identifier,current,"Virtual LAN identifier associated with ingress interface. For dot1q vlans, see 243
372dot1qVlanId.",,,See IEEE.802-1Q.2003.,[RFC5102],0,2013-02-18
37359,postVlanId,unsigned16,identifier,current,"Virtual LAN identifier associated with egress interface. For postdot1q vlans, see 254, postDot1qVlanId.",,,See IEEE.802-1Q.2003.,[RFC5102],0,2013-02-18
37460,ipVersion,unsigned8,identifier,current,The IP version field in the IP packet header.,,,"See [RFC791] for the definition of the version
375field in the IPv4 packet header.
376See [RFC8200] for the definition of the
377version field in the IPv6 packet header.
378Additional information on defined version numbers can be found at
379[IANA registry version-numbers].",[RFC5102],0,2013-02-18
38061,flowDirection,unsigned8,identifier,current,"The direction of the Flow observed at the Observation
381Point. There are only two values defined.
382
383
384
3850x00: ingress flow
3860x01: egress flow",,,,[RFC5102],0,2013-02-18
38762,ipNextHopIPv6Address,ipv6Address,default,current,The IPv6 address of the next IPv6 hop.,,,,[RFC5102],1,2014-02-03
38863,bgpNextHopIPv6Address,ipv6Address,default,current,The IPv6 address of the next (adjacent) BGP hop.,,,See [RFC4271] for a description of BGP-4.,[RFC5102],1,2014-02-03
38964,ipv6ExtensionHeaders,unsigned32,flags,current,"IPv6 extension headers observed in packets of this Flow.
390The information is encoded in a set of bit fields. For
391each IPv6 option header, there is a bit in this set.
392The bit is set to 1 if any observed packet of this Flow
393contains the corresponding IPv6 extension header.
394Otherwise, if no observed packet of this Flow contained
395the respective IPv6 extension header, the value of the
396corresponding bit is 0.
397
398
399
4000 1 2 3 4 5 6 7
401+-----+-----+-----+-----+-----+-----+-----+-----+
402| DST | HOP | Res | UNK |FRA0 | RH |FRA1 | Res | ...
403+-----+-----+-----+-----+-----+-----+-----+-----+
404
4058 9 10 11 12 13 14 15
406+-----+-----+-----+-----+-----+-----+-----+-----+
407... | Reserved | MOB | ESP | AH | PAY | ...
408+-----+-----+-----+-----+-----+-----+-----+-----+
409
41016 17 18 19 20 21 22 23
411+-----+-----+-----+-----+-----+-----+-----+-----+
412... | Reserved | ...
413+-----+-----+-----+-----+-----+-----+-----+-----+
41424 25 26 27 28 29 30 31
415+-----+-----+-----+-----+-----+-----+-----+-----+
416... | Reserved |
417+-----+-----+-----+-----+-----+-----+-----+-----+
418
419Bit IPv6 Option Description
4200, DST 60 Destination option header
4211, HOP 0 Hop-by-hop option header
4222, Res Reserved
4233, UNK Unknown Layer 4 header
424(compressed, encrypted, not supported)
4254, FRA0 44 Fragment header - first fragment
4265, RH 43 Routing header
4276, FRA1 44 Fragmentation header - not first fragment
4287, Res Reserved
4298 to 11 Reserved
43012, MOB 135 IPv6 mobility [RFC3775]
43113, ESP 50 Encrypted security payload
43214, AH 51 Authentication Header
43315, PAY 108 Payload compression header
43416 to 31 Reserved",,,"See [RFC8200] for the general definition of
435IPv6 extension headers and for the specification of the hop-by-hop
436options header, the routing header, the fragment header, and the
437destination options header.
438See [RFC4302] for the specification of the
439authentication header.
440See [RFC4303] for the specification of the
441encapsulating security payload.
442
443The diagram provided in [RFC5102] is incorrect.
444The diagram in this registry is taken from Errata 1738. See [RFC Errata 1738]",[RFC5102],0,2013-02-18
44570,mplsTopLabelStackSection,octetArray,default,current,"The Label, Exp, and S fields from the top MPLS label
446stack entry, i.e., from the last label that was pushed.
447
448
449
450
451The size of this Information Element is 3 octets.
452
453
454
4550 1 2
4560 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
457+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
458| Label | Exp |S|
459+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
460
461Label: Label Value, 20 bits
462Exp: Experimental Use, 3 bits
463S: Bottom of Stack, 1 bit",,,See [RFC3032].,[RFC5102],1,2014-02-03
46471,mplsLabelStackSection2,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
465was pushed immediately before the label stack entry that would
466be reported by mplsTopLabelStackSection. See the definition of
467mplsTopLabelStackSection for further details.
468
469
470
471
472The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
47372,mplsLabelStackSection3,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
474was pushed immediately before the label stack entry that would
475be reported by mplsLabelStackSection2. See the definition of
476mplsTopLabelStackSection for further details.
477
478
479
480
481The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
48273,mplsLabelStackSection4,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
483was pushed immediately before the label stack entry that would
484be reported by mplsLabelStackSection3. See the definition of
485mplsTopLabelStackSection for further details.
486
487
488
489
490The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
49174,mplsLabelStackSection5,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
492was pushed immediately before the label stack entry that would
493be reported by mplsLabelStackSection4. See the definition of
494mplsTopLabelStackSection for further details.
495
496
497
498
499The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
50075,mplsLabelStackSection6,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
501was pushed immediately before the label stack entry that would
502be reported by mplsLabelStackSection5. See the definition of
503mplsTopLabelStackSection for further details.
504
505
506
507
508The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
50976,mplsLabelStackSection7,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
510was pushed immediately before the label stack entry that would
511be reported by mplsLabelStackSection6. See the definition of
512mplsTopLabelStackSection for further details.
513
514
515
516
517The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
51877,mplsLabelStackSection8,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
519was pushed immediately before the label stack entry that would
520be reported by mplsLabelStackSection7. See the definition of
521mplsTopLabelStackSection for further details.
522
523
524
525
526The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
52778,mplsLabelStackSection9,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
528was pushed immediately before the label stack entry that would
529be reported by mplsLabelStackSection8. See the definition of
530mplsTopLabelStackSection for further details.
531
532
533
534
535The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
53679,mplsLabelStackSection10,octetArray,default,current,"The Label, Exp, and S fields from the label stack entry that
537was pushed immediately before the label stack entry that would
538be reported by mplsLabelStackSection9. See the definition of
539mplsTopLabelStackSection for further details.
540
541
542
543
544The size of this Information Element is 3 octets.",,,See [RFC3032].,[RFC5102],1,2014-02-03
54580,destinationMacAddress,macAddress,default,current,The IEEE 802 destination MAC address field.,,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
54681,postSourceMacAddress,macAddress,default,current,"The definition of this Information Element is identical
547to the definition of Information Element
548'sourceMacAddress', except that it reports a
549potentially modified value caused by a middlebox
550function after the packet passed the Observation Point.",,,See IEEE.802-3.2002.,[RFC5102],1,2014-02-03
55182,interfaceName,string,default,current,"A short name uniquely describing an interface, eg ""Eth1/0"".",,,See [RFC2863] for the definition of the ifName object.,[ipfix-iana_at_cisco.com],0,2013-02-18
55283,interfaceDescription,string,default,current,"The description of an interface, eg ""FastEthernet 1/0"" or ""ISP
553connection"".",,,See [RFC2863] for the definition of the ifDescr object.,[ipfix-iana_at_cisco.com],0,2013-02-18
55484,samplerName,string,,deprecated,"Deprecated in favor of 335 selectorName. Name of the flow
555sampler.",,,,[RFC7270],0,2014-04-04
55685,octetTotalCount,unsigned64,totalCounter,current,"The total number of octets in incoming packets
557for this Flow at the Observation Point since the Metering
558Process (re-)initialization for this Observation Point. The
559number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
56086,packetTotalCount,unsigned64,totalCounter,current,"The total number of incoming packets for this Flow
561at the Observation Point since the Metering Process
562(re-)initialization for this Observation Point.",packets,,,[RFC5102],0,2013-02-18
56387,flagsAndSamplerId,unsigned32,identifier,deprecated,"Flow flags and the value of the sampler ID (samplerId) combined in
564one bitmapped field. Reserved for internal use on the Collector.",,,,[RFC7270],0,2014-04-04
56588,fragmentOffset,unsigned16,quantity,current,"The value of the IP fragment offset field in the
566IPv4 packet header or the IPv6 Fragment header,
567respectively. The value is 0 for IPv6 if there is
568no fragment header.",,0-0x1FFF,"See [RFC791] for the specification of the
569fragment offset in the IPv4 header.
570See [RFC8200] for the specification of the
571fragment offset in the IPv6 Fragment header.",[RFC5102],1,2014-08-13
57289,forwardingStatus,unsigned32,identifier,current,"This Information Element describes the forwarding status of the
573flow and any attached reasons. The reduced-size encoding rules as
574per [RFC7011] apply.
575
576
577
578
579The basic encoding is 8 bits. The future extensions
580could add one or three bytes. The layout of the basic
581encoding is as follows:
582
583
584
585 MSB - 0 1 2 3 4 5 6 7 - LSB
586 +---+---+---+---+---+---+---+---+
587 | Status| Reason code or flags |
588 +---+---+---+---+---+---+---+---+
589
590Status:
591
59200b = Unknown
59301b = Forwarded
59410b = Dropped
59511b = Consumed
596
597
598Reason Code (status = 01b, Forwarded)
599
60001 000000b = 64 = Unknown
60101 000001b = 65 = Fragmented
60201 000010b = 66 = Not Fragmented
603
604Reason Code (status = 10b, Dropped)
605
60610 000000b = 128 = Unknown
60710 000001b = 129 = ACL deny
60810 000010b = 130 = ACL drop
60910 000011b = 131 = Unroutable
61010 000100b = 132 = Adjacency
61110 000101b = 133 = Fragmentation and DF set
61210 000110b = 134 = Bad header checksum
61310 000111b = 135 = Bad total Length
61410 001000b = 136 = Bad header length
61510 001001b = 137 = bad TTL
61610 001010b = 138 = Policer
61710 001011b = 139 = WRED
61810 001100b = 140 = RPF
61910 001101b = 141 = For us
62010 001110b = 142 = Bad output interface
62110 001111b = 143 = Hardware
622
623Reason Code (status = 11b, Consumed)
624
62511 000000b = 192 = Unknown
62611 000001b = 193 = Punt Adjacency
62711 000010b = 194 = Incomplete Adjacency
62811 000011b = 195 = For us
629
630Examples:
631
632 value : 0x40 = 64
633 binary: 01000000
634 decode: 01 -> Forward
635 000000 -> No further information
636
637 value : 0x89 = 137
638 binary: 10001001
639 decode: 10 -> Drop
640 001001 -> Fragmentation and DF set",,,"See ""NetFlow Version 9 Flow-Record Format"" [CCO-NF9FMT].",[RFC7270],0,2014-04-04
64190,mplsVpnRouteDistinguisher,octetArray,default,current,"The value of the VPN route distinguisher of a corresponding
642entry in a VPN routing and forwarding table. Route
643distinguisher ensures that the same address can be used in
644several different MPLS VPNs and that it is possible for BGP to
645carry several completely different routes to that address, one
646for each VPN. According to [RFC4364], the size of
647mplsVpnRouteDistinguisher is 8 octets. However, in [RFC4382] an
648octet string with flexible length was chosen for representing a
649VPN route distinguisher by object MplsL3VpnRouteDistinguisher.
650This choice was made in order to be open to future changes of
651the size. This idea was adopted when choosing octetArray as
652abstract data type for this Information Element. The maximum
653length of this Information Element is 256 octets.",,,"See [RFC4364] for the specification of the
654route distinguisher. See [RFC4382] for the
655specification of the MPLS/BGP Layer 3 Virtual Private Network (VPN)
656Management Information Base.",[RFC5102],1,2014-02-03
65791,mplsTopLabelPrefixLength,unsigned8,quantity,current,"The prefix length of the subnet of the mplsTopLabelIPv4Address that
658the MPLS top label will cause the Flow to be forwarded to.",bits,0-32,"See [RFC3031] for the association between
659MPLS labels and prefix lengths.",[ipfix-iana_at_cisco.com],1,2014-08-13
66092,srcTrafficIndex,unsigned32,identifier,current,BGP Policy Accounting Source Traffic Index.,,,BGP policy accounting as described in [CCO-BGPPOL].,[RFC7270],0,2014-04-04
66193,dstTrafficIndex,unsigned32,identifier,current,BGP Policy Accounting Destination Traffic Index.,,,BGP policy accounting as described in [CCO-BGPPOL].,[RFC7270],0,2014-04-04
66294,applicationDescription,string,default,current,Specifies the description of an application.,,,,[RFC6759],1,2014-02-03
66395,applicationId,octetArray,default,current,Specifies an Application ID per [RFC6759].,,,See section 4 of [RFC6759] for the applicationId Information Element Specification.,[RFC6759],1,2014-02-03
66496,applicationName,string,default,current,Specifies the name of an application.,,,,[RFC6759],0,2013-02-18
66597,Assigned for NetFlow v9 compatibility,,,,,,,[RFC3954],[RFC5102],0,2013-02-18
66698,postIpDiffServCodePoint,unsigned8,identifier,current,"The definition of this Information Element is identical to the
667definition of Information Element 'ipDiffServCodePoint', except
668that it reports a potentially modified value caused by a
669middlebox function after the packet passed the Observation
670Point.",,0-63,"See [RFC3260] for the definition of the Differentiated
671Services Field. See section 5.3.2 of [RFC1812] and
672[RFC791] for the definition of the IPv4 TOS field. See
673[RFC8200] for the definition of the IPv6 Traffic Class
674field. See the IPFIX Information Model [RFC5102] for the
675'ipDiffServCodePoint' specification.",[ipfix-iana_at_cisco.com],0,2013-02-18
67699,multicastReplicationFactor,unsigned32,quantity,current,"The amount of multicast replication that's applied to a traffic
677stream.",,,"See [RFC1112] for the specification of reserved IPv4
678multicast addresses. See [RFC4291] for the
679specification of reserved IPv6 multicast addresses.",[ipfix-iana_at_cisco.com],0,2013-02-18
680100,className,string,,deprecated,"Deprecated in favor of 335 selectorName. Traffic Class Name,
681associated with the classId Information Element.",,,,[RFC7270],0,2014-04-04
682101,classificationEngineId,unsigned8,identifier,current,"A unique identifier for the engine that determined the
683Selector ID. Thus, the Classification Engine ID defines
684the context for the Selector ID. The Classification
685Engine can be considered a specific registry for
686application assignments.
687
688
689
690
691Values for this field are listed in the Classification
692Engine IDs registry. See
693[http://www.iana.org/assignments/ipfix/ipfix.xml#classification-engine-ids]",,,,[RFC6759],0,2013-02-18
694102,layer2packetSectionOffset,unsigned16,quantity,deprecated,"Deprecated in favor of 409 sectionOffset. Layer 2 packet
695section offset. Potentially a generic packet section offset.",,,,[RFC7270],0,2014-04-04
696103,layer2packetSectionSize,unsigned16,quantity,deprecated,"Deprecated in favor of 312 dataLinkFrameSize. Layer 2 packet
697section size. Potentially a generic packet section size.",,,,[RFC7270],0,2014-04-04
698104,layer2packetSectionData,octetArray,,deprecated,"Deprecated in favor of 315 dataLinkFrameSection. Layer 2 packet
699section data.",,,,[RFC7270],0,2014-04-04
700128,bgpNextAdjacentAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the first AS in the AS
701path to the destination IP address. The path is deduced
702by looking up the destination IP address of the Flow in the
703BGP routing information base. If AS path information for
704this Flow is only available as an unordered AS set (and not
705as an ordered AS sequence), then the value of this Information
706Element is 0.",,,"See [RFC4271] for a description of BGP-4, and
707see [RFC1930] for the definition of the AS
708number.",[RFC5102],0,2013-02-18
709129,bgpPrevAdjacentAsNumber,unsigned32,identifier,current,"The autonomous system (AS) number of the last AS in the AS
710path from the source IP address. The path is deduced
711by looking up the source IP address of the Flow in the BGP
712routing information base. If AS path information for this
713Flow is only available as an unordered AS set (and not as
714an ordered AS sequence), then the value of this Information
715Element is 0. In case of BGP asymmetry, the
716bgpPrevAdjacentAsNumber might not be able to report the correct
717value.",,,"See [RFC4271] for a description of BGP-4, and
718see [RFC1930] for the definition of the AS
719number.",[RFC5102],0,2013-02-18
720130,exporterIPv4Address,ipv4Address,default,current,"The IPv4 address used by the Exporting Process. This is used
721by the Collector to identify the Exporter in cases where the
722identity of the Exporter may have been obscured by the use of
723a proxy.",,,,[RFC5102],1,2014-02-03
724131,exporterIPv6Address,ipv6Address,default,current,"The IPv6 address used by the Exporting Process. This is used
725by the Collector to identify the Exporter in cases where the
726identity of the Exporter may have been obscured by the use of
727a proxy.",,,,[RFC5102],1,2014-02-03
728132,droppedOctetDeltaCount,unsigned64,deltaCounter,current,"The number of octets since the previous report (if any)
729in packets of this Flow dropped by packet treatment.
730The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
731133,droppedPacketDeltaCount,unsigned64,deltaCounter,current,"The number of packets since the previous report (if any)
732of this Flow dropped by packet treatment.",packets,,,[RFC5102],0,2013-02-18
733134,droppedOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in packets of this Flow dropped
734by packet treatment since the Metering Process
735(re-)initialization for this Observation Point.
736The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
737135,droppedPacketTotalCount,unsigned64,totalCounter,current,"The number of packets of this Flow dropped by packet
738treatment since the Metering Process
739(re-)initialization for this Observation Point.",packets,,,[RFC5102],0,2013-02-18
740136,flowEndReason,unsigned8,identifier,current,"The reason for Flow termination. The range of values includes
741the following:
742
743
744
7450x01: idle timeout
746The Flow was terminated because it was considered to be
747idle.
7480x02: active timeout
749The Flow was terminated for reporting purposes while it was
750still active, for example, after the maximum lifetime of
751unreported Flows was reached.
7520x03: end of Flow detected
753The Flow was terminated because the Metering Process
754detected signals indicating the end of the Flow,
755for example, the TCP FIN flag.
7560x04: forced end
757The Flow was terminated because of some external event,
758for example, a shutdown of the Metering Process initiated
759by a network management application.
7600x05: lack of resources
761The Flow was terminated because of lack of resources
762available to the Metering Process and/or the Exporting
763Process.",,,,[RFC5102],0,2013-02-18
764137,commonPropertiesId,unsigned64,identifier,current,"An identifier of a set of common properties that is
765unique per Observation Domain and Transport Session.
766Typically, this Information Element is used to link to
767information reported in separate Data Records.",,,,[RFC5102],0,2013-02-18
768138,observationPointId,unsigned64,identifier,current,"An identifier of an Observation Point that is unique per
769Observation Domain. It is RECOMMENDED that this identifier is
770also unique per IPFIX Device. Typically, this Information
771Element is used for limiting the scope of other Information
772Elements.",,,,[RFC5102][ipfix-iana_at_cisco.com],1,2013-04-11
773139,icmpTypeCodeIPv6,unsigned16,identifier,current,"Type and Code of the IPv6 ICMP message. The combination of
774both values is reported as (ICMP type * 256) + ICMP code.",,,"See [RFC4443] for the definition of the IPv6
775ICMP type and code fields.",[RFC5102],0,2013-02-18
776140,mplsTopLabelIPv6Address,ipv6Address,default,current,"The IPv6 address of the system that the MPLS top label will
777cause this Flow to be forwarded to.",,,"See [RFC3031] for the association between MPLS
778labels and IP addresses.",[RFC5102],1,2014-02-03
779141,lineCardId,unsigned32,identifier,current,"An identifier of a line card that is unique per IPFIX
780Device hosting an Observation Point. Typically, this
781Information Element is used for limiting the scope
782of other Information Elements.",,,,[RFC5102],0,2013-02-18
783142,portId,unsigned32,identifier,current,"An identifier of a line port that is unique per IPFIX
784Device hosting an Observation Point. Typically, this
785Information Element is used for limiting the scope
786of other Information Elements.",,,,[RFC5102],0,2013-02-18
787143,meteringProcessId,unsigned32,identifier,current,"An identifier of a Metering Process that is unique per
788IPFIX Device. Typically, this Information Element is used
789for limiting the scope of other Information Elements.
790Note that process identifiers are typically assigned
791dynamically.
792The Metering Process may be re-started with a different ID.",,,,[RFC5102],0,2013-02-18
793144,exportingProcessId,unsigned32,identifier,current,"An identifier of an Exporting Process that is unique per
794IPFIX Device. Typically, this Information Element is used
795for limiting the scope of other Information Elements.
796Note that process identifiers are typically assigned
797dynamically. The Exporting Process may be re-started
798with a different ID.",,,,[RFC5102],0,2013-02-18
799145,templateId,unsigned16,identifier,current,"An identifier of a Template that is locally unique within a
800combination of a Transport session and an Observation Domain.
801
802
803
804
805Template IDs 0-255 are reserved for Template Sets, Options
806Template Sets, and other reserved Sets yet to be created.
807Template IDs of Data Sets are numbered from 256 to 65535.
808
809
810
811
812Typically, this Information Element is used for limiting
813the scope of other Information Elements.
814Note that after a re-start of the Exporting Process Template
815identifiers may be re-assigned.",,,,[RFC5102],0,2013-02-18
816146,wlanChannelId,unsigned8,identifier,current,The identifier of the 802.11 (Wi-Fi) channel used.,,,See IEEE.802-11.1999.,[RFC5102],0,2013-02-18
817147,wlanSSID,string,default,current,"The Service Set IDentifier (SSID) identifying an 802.11
818(Wi-Fi) network used. According to IEEE.802-11.1999, the
819SSID is encoded into a string of up to 32 characters.",,,See IEEE.802-11.1999.,[RFC5102],0,2013-02-18
820148,flowId,unsigned64,identifier,current,"An identifier of a Flow that is unique within an Observation
821Domain. This Information Element can be used to distinguish
822between different Flows if Flow Keys such as IP addresses and
823port numbers are not reported or are reported in separate
824records.",,,,[RFC5102],0,2013-02-18
825149,observationDomainId,unsigned32,identifier,current,"An identifier of an Observation Domain that is locally
826unique to an Exporting Process. The Exporting Process uses
827the Observation Domain ID to uniquely identify to the
828Collecting Process the Observation Domain where Flows
829were metered. It is RECOMMENDED that this identifier is
830also unique per IPFIX Device.
831
832
833
834
835A value of 0 indicates that no specific Observation Domain
836is identified by this Information Element.
837
838
839
840
841Typically, this Information Element is used for limiting
842the scope of other Information Elements.",,,,[RFC5102],0,2013-02-18
843150,flowStartSeconds,dateTimeSeconds,default,current,The absolute timestamp of the first packet of this Flow.,seconds,,,[RFC5102],0,2013-02-18
844151,flowEndSeconds,dateTimeSeconds,default,current,The absolute timestamp of the last packet of this Flow.,seconds,,,[RFC5102],0,2013-02-18
845152,flowStartMilliseconds,dateTimeMilliseconds,default,current,The absolute timestamp of the first packet of this Flow.,milliseconds,,,[RFC5102],0,2013-02-18
846153,flowEndMilliseconds,dateTimeMilliseconds,default,current,The absolute timestamp of the last packet of this Flow.,milliseconds,,,[RFC5102],0,2013-02-18
847154,flowStartMicroseconds,dateTimeMicroseconds,default,current,The absolute timestamp of the first packet of this Flow.,microseconds,,,[RFC5102],0,2013-02-18
848155,flowEndMicroseconds,dateTimeMicroseconds,default,current,The absolute timestamp of the last packet of this Flow.,microseconds,,,[RFC5102],0,2013-02-18
849156,flowStartNanoseconds,dateTimeNanoseconds,default,current,The absolute timestamp of the first packet of this Flow.,nanoseconds,,,[RFC5102],0,2013-02-18
850157,flowEndNanoseconds,dateTimeNanoseconds,default,current,The absolute timestamp of the last packet of this Flow.,nanoseconds,,,[RFC5102],0,2013-02-18
851158,flowStartDeltaMicroseconds,unsigned32,,current,"This is a relative timestamp only valid within the scope
852of a single IPFIX Message. It contains the negative time
853offset of the first observed packet of this Flow relative
854to the export time specified in the IPFIX Message Header.",microseconds,,"See the [IPFIX protocol
855specification] for the definition of the IPFIX Message Header.",[RFC5102],0,2013-02-18
856159,flowEndDeltaMicroseconds,unsigned32,,current,"This is a relative timestamp only valid within the scope
857of a single IPFIX Message. It contains the negative time
858offset of the last observed packet of this Flow relative
859to the export time specified in the IPFIX Message Header.",microseconds,,"See the [IPFIX protocol
860specification] for the definition of the IPFIX Message Header.",[RFC5102],0,2013-02-18
861160,systemInitTimeMilliseconds,dateTimeMilliseconds,default,current,"The absolute timestamp of the last (re-)initialization of the
862IPFIX Device.",milliseconds,,,[RFC5102],0,2013-02-18
863161,flowDurationMilliseconds,unsigned32,,current,"The difference in time between the first observed packet
864of this Flow and the last observed packet of this Flow.",milliseconds,,,[RFC5102],0,2013-02-18
865162,flowDurationMicroseconds,unsigned32,,current,"The difference in time between the first observed packet
866of this Flow and the last observed packet of this Flow.",microseconds,,,[RFC5102],0,2013-02-18
867163,observedFlowTotalCount,unsigned64,totalCounter,current,"The total number of Flows observed in the Observation Domain
868since the Metering Process (re-)initialization for this
869Observation Point.",flows,,,[RFC5102],0,2013-02-18
870164,ignoredPacketTotalCount,unsigned64,totalCounter,current,"The total number of observed IP packets that the
871Metering Process did not process since the
872(re-)initialization of the Metering Process.",packets,,,[RFC5102],0,2013-02-18
873165,ignoredOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed IP packets
874(including the IP header) that the Metering Process
875did not process since the (re-)initialization of the
876Metering Process.",octets,,,[RFC5102],0,2013-02-18
877166,notSentFlowTotalCount,unsigned64,totalCounter,current,"The total number of Flow Records that were generated by the
878Metering Process and dropped by the Metering Process or
879by the Exporting Process instead of being sent to the
880Collecting Process. There are several potential reasons for
881this including resource shortage and special Flow export
882policies.",flows,,,[RFC5102],0,2013-02-18
883167,notSentPacketTotalCount,unsigned64,totalCounter,current,"The total number of packets in Flow Records that were
884generated by the Metering Process and dropped
885by the Metering Process or by the Exporting Process
886instead of being sent to the Collecting Process.
887There are several potential reasons for this including
888resource shortage and special Flow export policies.",packets,,,[RFC5102],0,2013-02-18
889168,notSentOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in packets in Flow Records
890that were generated by the Metering Process and
891dropped by the Metering Process or by the Exporting
892Process instead of being sent to the Collecting Process.
893There are several potential reasons for this including
894resource shortage and special Flow export policies.",octets,,,[RFC5102],0,2013-02-18
895169,destinationIPv6Prefix,ipv6Address,default,current,IPv6 destination address prefix.,,,,[RFC5102],0,2013-02-18
896170,sourceIPv6Prefix,ipv6Address,default,current,IPv6 source address prefix.,,,,[RFC5102],0,2013-02-18
897171,postOctetTotalCount,unsigned64,totalCounter,current,"The definition of this Information Element is identical
898to the definition of Information Element
899'octetTotalCount', except that it reports a
900potentially modified value caused by a middlebox
901function after the packet passed the Observation Point.",octets,,,[RFC5102],0,2013-02-18
902172,postPacketTotalCount,unsigned64,totalCounter,current,"The definition of this Information Element is identical
903to the definition of Information Element
904'packetTotalCount', except that it reports a
905potentially modified value caused by a middlebox
906function after the packet passed the Observation Point.",packets,,,[RFC5102],0,2013-02-18
907173,flowKeyIndicator,unsigned64,flags,current,"This set of bit fields is used for marking the Information
908Elements of a Data Record that serve as Flow Key. Each bit
909represents an Information Element in the Data Record, with
910the n-th least significant bit representing the n-th Information
911Element.
912A bit set to value 1 indicates that the corresponding
913Information Element is a Flow Key of the reported Flow.
914A bit set to value 0 indicates that this is not the case.
915
916
917
918
919If the Data Record contains more than 64 Information Elements,
920the corresponding Template SHOULD be designed such that all
921Flow Keys are among the first 64 Information Elements, because
922the flowKeyIndicator only contains 64 bits. If the Data Record
923contains less than 64 Information Elements, then the bits in
924the flowKeyIndicator for which no corresponding Information
925Element exists MUST have the value 0.",,,,[RFC5102][RFC Errata 4984],1,2017-08-01
926174,postMCastPacketTotalCount,unsigned64,totalCounter,current,"The total number of outgoing multicast packets sent for
927packets of this Flow by a multicast daemon within the
928Observation Domain since the Metering Process
929(re-)initialization. This property cannot necessarily
930be observed at the Observation Point, but may be retrieved
931by other means.",packets,,,[RFC5102],0,2013-02-18
932175,postMCastOctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in outgoing multicast packets
933sent for packets of this Flow by a multicast daemon in the
934Observation Domain since the Metering Process
935(re-)initialization. This property cannot necessarily be
936observed at the Observation Point, but may be retrieved by
937other means.
938The number of octets includes IP header(s) and IP payload.",octets,,,[RFC5102],0,2013-02-18
939176,icmpTypeIPv4,unsigned8,identifier,current,Type of the IPv4 ICMP message.,,,"See [RFC792] for the definition of the IPv4
940ICMP type field.",[RFC5102],0,2013-02-18
941177,icmpCodeIPv4,unsigned8,identifier,current,Code of the IPv4 ICMP message.,,,"See [RFC792] for the definition of the IPv4
942ICMP code field.",[RFC5102],0,2013-02-18
943178,icmpTypeIPv6,unsigned8,identifier,current,Type of the IPv6 ICMP message.,,,"See [RFC4443] for the definition of the IPv6
944ICMP type field.",[RFC5102],0,2013-02-18
945179,icmpCodeIPv6,unsigned8,identifier,current,Code of the IPv6 ICMP message.,,,"See [RFC4443] for the definition of the IPv6
946ICMP code field.",[RFC5102],0,2013-02-18
947180,udpSourcePort,unsigned16,identifier,current,The source port identifier in the UDP header.,,,"See [RFC768] for the definition of the UDP
948source port field.
949Additional information on defined UDP port numbers can be found at
950[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
951181,udpDestinationPort,unsigned16,identifier,current,The destination port identifier in the UDP header.,,,"See [RFC768] for the definition of the UDP
952destination port field.
953Additional information on defined UDP port numbers can be found at
954[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
955182,tcpSourcePort,unsigned16,identifier,current,The source port identifier in the TCP header.,,,"See [RFC793] for the definition of the TCP
956source port field.
957Additional information on defined TCP port numbers can be found at
958[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
959183,tcpDestinationPort,unsigned16,identifier,current,The destination port identifier in the TCP header.,,,"See [RFC793] for the definition of the TCP
960destination port field.
961Additional information on defined TCP port numbers can be found at
962[IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
963184,tcpSequenceNumber,unsigned32,,current,The sequence number in the TCP header.,,,"See [RFC793] for the definition of the TCP
964sequence number.",[RFC5102],0,2013-02-18
965185,tcpAcknowledgementNumber,unsigned32,,current,The acknowledgement number in the TCP header.,,,"See [RFC793] for the definition of the TCP
966acknowledgement number.",[RFC5102],0,2013-02-18
967186,tcpWindowSize,unsigned16,,current,"The window field in the TCP header.
968If the TCP window scale is supported,
969then TCP window scale must be known
970to fully interpret the value of this information.",,,"See [RFC793] for the definition of the TCP
971window field.
972See [RFC1323] for the definition of the TCP
973window scale.",[RFC5102],0,2013-02-18
974187,tcpUrgentPointer,unsigned16,,current,The urgent pointer in the TCP header.,,,"See [RFC793] for the definition of the TCP
975urgent pointer.",[RFC5102],0,2013-02-18
976188,tcpHeaderLength,unsigned8,,current,"The length of the TCP header. Note that the value of this
977Information Element is different from the value of the Data
978Offset field in the TCP header. The Data Offset field
979indicates the length of the TCP header in units of 4 octets.
980This Information Elements specifies the length of the TCP
981header in units of octets.",octets,,"See [RFC793] for the definition of the TCP
982header.",[RFC5102],0,2013-02-18
983189,ipHeaderLength,unsigned8,,current,"The length of the IP header. For IPv6, the value of this
984Information Element is 40.",octets,,"See [RFC791] for the definition of the IPv4
985header.
986See [RFC8200] for the definition of the IPv6
987header.",[RFC5102],0,2013-02-18
988190,totalLengthIPv4,unsigned16,,current,The total length of the IPv4 packet.,octets,,"See [RFC791] for the specification of the IPv4
989total length.",[RFC5102],0,2013-02-18
990191,payloadLengthIPv6,unsigned16,,current,"This Information Element reports the value of the Payload
991Length field in the IPv6 header. Note that IPv6 extension
992headers belong to the payload. Also note that in case of a
993jumbo payload option the value of the Payload Length field in
994the IPv6 header is zero and so will be the value reported
995by this Information Element.",octets,,"See [RFC8200] for the specification of the IPv6
996payload length.
997See [RFC2675] for the specification of the IPv6
998jumbo payload option.",[RFC5102],0,2013-02-18
999192,ipTTL,unsigned8,,current,"For IPv4, the value of the Information Element matches
1000the value of the Time to Live (TTL) field in the IPv4 packet
1001header. For IPv6, the value of the Information Element
1002matches the value of the Hop Limit field in the IPv6
1003packet header.",hops,,"See [RFC791] for the definition of the IPv4
1004Time to Live field.
1005See [RFC2675] for the definition of the IPv6
1006Hop Limit field.",[RFC5102],0,2013-02-18
1007193,nextHeaderIPv6,unsigned8,,current,"The value of the Next Header field of the IPv6 header.
1008The value identifies the type of the following IPv6
1009extension header or of the following IP payload.
1010Valid values are defined in the IANA
1011Protocol Numbers registry.",,,"See [RFC8200] for the definition of the IPv6
1012Next Header field.
1013See the list of protocol numbers assigned by IANA at [IANA registry protocol-numbers].",[RFC5102],0,2013-02-18
1014194,mplsPayloadLength,unsigned32,,current,The size of the MPLS packet without the label stack.,octets,,"See [RFC3031] for the specification of MPLS
1015packets.
1016See [RFC3032] for the specification of the
1017MPLS label stack.",[RFC5102],0,2013-02-18
1018195,ipDiffServCodePoint,unsigned8,identifier,current,"The value of a Differentiated Services Code Point (DSCP)
1019encoded in the Differentiated Services field. The
1020Differentiated Services field spans the most significant
10216 bits of the IPv4 TOS field or the IPv6 Traffic Class
1022field, respectively.
1023
1024
1025
1026
1027This Information Element encodes only the 6 bits of the
1028Differentiated Services field. Therefore, its value may
1029range from 0 to 63.",,0-63,"See [RFC3260] for the definition of the
1030Differentiated Services field.
1031See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field.
1032See [RFC8200] for the definition of the IPv6
1033Traffic Class field.",[RFC5102],0,2013-02-18
1034196,ipPrecedence,unsigned8,identifier,current,"The value of the IP Precedence. The IP Precedence value
1035is encoded in the first 3 bits of the IPv4 TOS field
1036or the IPv6 Traffic Class field, respectively.
1037
1038
1039
1040
1041This Information Element encodes only these 3 bits.
1042Therefore, its value may range from 0 to 7.",,0-7,"See [RFC1812] (Section 5.3.3) and [RFC791] for the definition of the IP Precedence.
1043See [RFC1812] (Section 5.3.2) and [RFC791] for the definition of the IPv4 TOS field.
1044See [RFC8200] for the definition of the IPv6
1045Traffic Class field.",[RFC5102],0,2013-02-18
1046197,fragmentFlags,unsigned8,flags,current,"Fragmentation properties indicated by flags in the IPv4
1047packet header or the IPv6 Fragment header, respectively.
1048
1049
1050
1051
1052Bit 0: (RS) Reserved.
1053The value of this bit MUST be 0 until specified
1054otherwise.
1055Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment.
1056Corresponds to the value of the DF flag in the
1057IPv4 header. Will always be 0 for IPv6 unless
1058a ""don't fragment"" feature is introduced to IPv6.
1059Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments.
1060Corresponds to the MF flag in the IPv4 header
1061or to the M flag in the IPv6 Fragment header,
1062respectively. The value is 0 for IPv6 if there
1063is no fragment header.
1064Bits 3-7: (DC) Don't Care.
1065The values of these bits are irrelevant.
1066
10670 1 2 3 4 5 6 7
1068+---+---+---+---+---+---+---+---+
1069| R | D | M | D | D | D | D | D |
1070| S | F | F | C | C | C | C | C |
1071+---+---+---+---+---+---+---+---+",,,"See [RFC791] for the specification of the IPv4
1072fragment flags.
1073See [RFC8200] for the specification of the
1074IPv6 Fragment header.",[RFC5102],0,2013-02-18
1075198,octetDeltaSumOfSquares,unsigned64,,current,"The sum of the squared numbers of octets per incoming
1076packet since the previous report (if any) for this
1077Flow at the Observation Point.
1078The number of octets includes IP header(s) and IP payload.",,,,[RFC5102],0,2013-02-18
1079199,octetTotalSumOfSquares,unsigned64,,current,"The total sum of the squared numbers of octets in incoming
1080packets for this Flow at the Observation Point since the
1081Metering Process (re-)initialization for this Observation
1082Point. The number of octets includes IP header(s) and IP
1083payload.",octets,,,[RFC5102],0,2013-02-18
1084200,mplsTopLabelTTL,unsigned8,,current,"The TTL field from the top MPLS label stack entry,
1085i.e., the last label that was pushed.",hops,,"See [RFC3032] for the specification of the TTL
1086field.",[RFC5102],0,2013-02-18
1087201,mplsLabelStackLength,unsigned32,,current,The length of the MPLS label stack in units of octets.,octets,,"See [RFC3032] for the specification of the
1088MPLS label stack.",[RFC5102],0,2013-02-18
1089202,mplsLabelStackDepth,unsigned32,,current,The number of labels in the MPLS label stack.,label stack entries,,"See [RFC3032] for the specification of the
1090MPLS label stack.",[RFC5102],0,2013-02-18
1091203,mplsTopLabelExp,unsigned8,flags,current,"The Exp field from the top MPLS label stack entry,
1092i.e., the last label that was pushed.
1093
1094
1095
1096Bits 0-4: Don't Care, value is irrelevant.
1097Bits 5-7: MPLS Exp field.
1098
10990 1 2 3 4 5 6 7
1100+---+---+---+---+---+---+---+---+
1101| don't care | Exp |
1102+---+---+---+---+---+---+---+---+",,,"See [RFC3032] for the specification of the
1103Exp field.
1104See [RFC3270] for usage of the Exp field.",[RFC5102],0,2013-02-18
1105204,ipPayloadLength,unsigned32,,current,"The effective length of the IP payload.
1106
1107
1108
1109
1110For IPv4 packets, the value of this Information Element is
1111the difference between the total length of the IPv4 packet
1112(as reported by Information Element totalLengthIPv4) and the
1113length of the IPv4 header (as reported by Information Element
1114headerLengthIPv4).
1115
1116
1117
1118
1119For IPv6, the value of the Payload Length field
1120in the IPv6 header is reported except in the case that
1121the value of this field is zero and that there is a valid
1122jumbo payload option. In this case, the value of the
1123Jumbo Payload Length field in the jumbo payload option
1124is reported.",octets,,"See [RFC791] for the specification of IPv4
1125packets.
1126See [RFC8200] for the specification of the
1127IPv6 payload length.
1128See [RFC2675] for the specification of the
1129IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
1130205,udpMessageLength,unsigned16,,current,The value of the Length field in the UDP header.,octets,,"See [RFC768] for the specification of the UDP
1131header.",[RFC5102],0,2013-02-18
1132206,isMulticast,unsigned8,flags,current,"If the IP destination address is not a reserved multicast
1133address, then the value of all bits of the octet (including
1134the reserved ones) is zero.
1135
1136
1137
1138
1139The first bit of this octet is set to 1 if the Version
1140field of the IP header has the value 4 and if the
1141Destination Address field contains a reserved multicast
1142address in the range from 224.0.0.0 to 239.255.255.255.
1143Otherwise, this bit is set to 0.
1144
1145
1146
1147
1148The second and third bits of this octet are reserved for
1149future use.
1150
1151
1152
1153
1154The remaining bits of the octet are only set to values
1155other than zero if the IP Destination Address is a
1156reserved IPv6 multicast address. Then the fourth bit
1157of the octet is set to the value of the T flag in the
1158IPv6 multicast address and the remaining four bits are
1159set to the value of the scope field in the IPv6
1160multicast address.
1161
1162
1163
11640 1 2 3 4 5 6 7
1165+------+------+------+------+------+------+------+------+
1166| IPv6 multicast scope | T | RES. | RES. | MCv4 |
1167+------+------+------+------+------+------+------+------+
1168
1169Bits 0-3: set to value of multicast scope if IPv6 multicast
1170Bit 4: set to value of T flag, if IPv6 multicast
1171Bits 5-6: reserved for future use
1172Bit 7: set to 1 if IPv4 multicast",,,"See [RFC1112] for the specification of
1173reserved IPv4 multicast addresses.
1174See [RFC4291] for the specification of
1175reserved IPv6 multicast addresses and the definition of the T flag and
1176the IPv6 multicast scope.
1177The diagram provided in [RFC5102] is incorrect.
1178The diagram in this registry is taken from Errata 1736. See [RFC Errata 1736]",[RFC5102],0,2013-02-18
1179207,ipv4IHL,unsigned8,,current,"The value of the Internet Header Length (IHL) field in
1180the IPv4 header. It specifies the length of the header
1181in units of 4 octets. Please note that its unit is
1182different from most of the other Information Elements
1183reporting length values.",4 octets,,"See [RFC791] for the specification of the IPv4
1184header.",[RFC5102],0,2013-02-18
1185208,ipv4Options,unsigned32,flags,current,"IPv4 options in packets of this Flow.
1186The information is encoded in a set of bit fields. For
1187each valid IPv4 option type, there is a bit in this set.
1188The bit is set to 1 if any observed packet of this Flow
1189contains the corresponding IPv4 option type. Otherwise,
1190if no observed packet of this Flow contained the
1191respective IPv4 option type, the value of the
1192corresponding bit is 0.
1193
1194
1195
1196
1197The list of valid IPv4 options is maintained by IANA.
1198Note that for identifying an option not just the 5-bit
1199Option Number, but all 8 bits of the Option Type need to
1200match one of the IPv4 options specified at
1201http://www.iana.org/assignments/ip-parameters.
1202
1203
1204
1205
1206Options are mapped to bits according to their option numbers.
1207Option number X is mapped to bit X.
1208The mapping is illustrated by the figure below.
1209
1210
1211
12120 1 2 3 4 5 6 7
1213+------+------+------+------+------+------+------+------+
1214... | RR |CIPSO |E-SEC | TS | LSR | SEC | NOP | EOOL |
1215+------+------+------+------+------+------+------+------+
1216
12178 9 10 11 12 13 14 15
1218+------+------+------+------+------+------+------+------+
1219... |ENCODE| VISA | FINN | MTUR | MTUP | ZSU | SSR | SID | ...
1220+------+------+------+------+------+------+------+------+
1221
122216 17 18 19 20 21 22 23
1223+------+------+------+------+------+------+------+------+
1224... | DPS |NSAPA | SDB |RTRALT|ADDEXT| TR | EIP |IMITD | ...
1225+------+------+------+------+------+------+------+------+
1226
122724 25 26 27 28 29 30 31
1228+------+------+------+------+------+------+------+------+
1229| | EXP | to be assigned by IANA | QS | UMP | ...
1230+------+------+------+------+------+------+------+------+
1231
1232Type Option
1233Bit Value Name Reference
1234---+-----+-------+------------------------------------
12350 7 RR Record Route, RFC 791
12361 134 CIPSO Commercial Security
12372 133 E-SEC Extended Security, RFC 1108
12383 68 TS Time Stamp, RFC 791
12394 131 LSR Loose Source Route, RFC791
12405 130 SEC Security, RFC 1108
12416 1 NOP No Operation, RFC 791
12427 0 EOOL End of Options List, RFC 791
12438 15 ENCODE
12449 142 VISA Experimental Access Control
124510 205 FINN Experimental Flow Control
124611 12 MTUR (obsoleted) MTU Reply, RFC 1191
124712 11 MTUP (obsoleted) MTU Probe, RFC 1191
124813 10 ZSU Experimental Measurement
124914 137 SSR Strict Source Route, RFC 791
125015 136 SID Stream ID, RFC 791
125116 151 DPS Dynamic Packet State
125217 150 NSAPA NSAP Address
125318 149 SDB Selective Directed Broadcast
125419 147 ADDEXT Address Extension
125520 148 RTRALT Router Alert, RFC 2113
125621 82 TR Traceroute, RFC 3193
125722 145 EIP Extended Internet Protocol, RFC 1385
125823 144 IMITD IMI Traffic Descriptor
125925 30 EXP RFC3692-style Experiment
126025 94 EXP RFC3692-style Experiment
126125 158 EXP RFC3692-style Experiment
126225 222 EXP RFC3692-style Experiment
126330 25 QS Quick-Start
126431 152 UMP Upstream Multicast Pkt.
1265... ... ... Further options numbers
1266may be assigned by IANA",,,"See [RFC791] for the definition of IPv4
1267options.
1268See the list of IPv4 option numbers assigned by IANA at [IANA registry ip-parameters].
1269The diagram provided in [RFC5102] is incorrect.
1270The diagram in this registry is taken from Errata 1737. See [RFC Errata 1737]",[RFC5102],0,2013-02-18
1271209,tcpOptions,unsigned64,flags,current,"TCP options in packets of this Flow.
1272The information is encoded in a set of bit fields. For
1273each TCP option, there is a bit in this set.
1274The bit is set to 1 if any observed packet of this Flow
1275contains the corresponding TCP option.
1276Otherwise, if no observed packet of this Flow contained
1277the respective TCP option, the value of the
1278corresponding bit is 0.
1279
1280
1281
1282
1283Options are mapped to bits according to their option
1284numbers. Option number X is mapped to bit X.
1285TCP option numbers are maintained by IANA.
1286
1287
1288
12890 1 2 3 4 5 6 7
1290+-----+-----+-----+-----+-----+-----+-----+-----+
1291| 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ...
1292+-----+-----+-----+-----+-----+-----+-----+-----+
1293
12948 9 10 11 12 13 14 15
1295+-----+-----+-----+-----+-----+-----+-----+-----+
1296... | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 |...
1297+-----+-----+-----+-----+-----+-----+-----+-----+
1298
129916 17 18 19 20 21 22 23
1300+-----+-----+-----+-----+-----+-----+-----+-----+
1301... | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 |...
1302+-----+-----+-----+-----+-----+-----+-----+-----+
1303
1304. . .
1305
130656 57 58 59 60 61 62 63
1307+-----+-----+-----+-----+-----+-----+-----+-----+
1308... | 63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 |
1309+-----+-----+-----+-----+-----+-----+-----+-----+",,,"See [RFC793] for the definition of TCP
1310options.
1311See the list of TCP option numbers assigned by IANA at [IANA registry tcp-parameters].
1312The diagram provided in [RFC5102] is incorrect.
1313The diagram in this registry is taken from Errata 1739. See [RFC Errata 1739]",[RFC5102],0,2013-02-18
1314210,paddingOctets,octetArray,default,current,"The value of this Information Element is always a sequence of
13150x00 values.",,,,[RFC5102],0,2013-02-18
1316211,collectorIPv4Address,ipv4Address,default,current,"An IPv4 address to which the Exporting Process sends Flow
1317information.",,,,[RFC5102],1,2014-02-03
1318212,collectorIPv6Address,ipv6Address,default,current,"An IPv6 address to which the Exporting Process sends Flow
1319information.",,,,[RFC5102],1,2014-02-03
1320213,exportInterface,unsigned32,identifier,current,"The index of the interface from which IPFIX Messages sent
1321by the Exporting Process to a Collector leave the IPFIX
1322Device. The value matches the value of
1323managed object 'ifIndex' as defined in [RFC2863].
1324Note that ifIndex values are not assigned statically to an
1325interface and that the interfaces may be renumbered every
1326time the device's management system is re-initialized, as
1327specified in [RFC2863].",,,"See [RFC2863] for the definition of the
1328ifIndex object.",[RFC5102],0,2013-02-18
1329214,exportProtocolVersion,unsigned8,identifier,current,"The protocol version used by the Exporting Process for
1330sending Flow information. The protocol version is given
1331by the value of the Version Number field in the Message
1332Header.
1333
1334
1335
1336
1337The protocol version is 10 for IPFIX and 9 for NetFlow
1338version 9.
1339A value of 0 indicates that no export protocol is in use.",,,"See the [IPFIX protocol
1340specification] for the definition of the IPFIX Message Header.
1341See [RFC3954] for the definition of the
1342NetFlow version 9 message header.",[RFC5102],0,2013-02-18
1343215,exportTransportProtocol,unsigned8,identifier,current,"The value of the protocol number used by the Exporting Process
1344for sending Flow information.
1345The protocol number identifies the IP packet payload type.
1346Protocol numbers are defined in the IANA Protocol Numbers
1347registry.
1348
1349
1350
1351
1352In Internet Protocol version 4 (IPv4), this is carried in the
1353Protocol field. In Internet Protocol version 6 (IPv6), this
1354is carried in the Next Header field in the last extension
1355header of the packet.",,,"See [RFC791] for the specification of the IPv4
1356protocol field.
1357See [RFC8200] for the specification of the
1358IPv6 protocol field.
1359See the list of protocol numbers assigned by IANA at [IANA registry protocol-numbers].",[RFC5102],0,2013-02-18
1360216,collectorTransportPort,unsigned16,identifier,current,"The destination port identifier to which the Exporting
1361Process sends Flow information. For the transport protocols
1362UDP, TCP, and SCTP, this is the destination port number.
1363This field MAY also be used for future transport protocols
1364that have 16-bit source port identifiers.",,,"See [RFC768] for the definition of the UDP
1365destination port field.
1366See [RFC793] for the definition of the TCP
1367destination port field.
1368See [RFC4960] for the definition of SCTP.
1369
1370
1371
1372
1373Additional information on defined UDP and TCP port numbers can be
1374found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
1375217,exporterTransportPort,unsigned16,identifier,current,"The source port identifier from which the Exporting
1376Process sends Flow information. For the transport protocols
1377UDP, TCP, and SCTP, this is the source port number.
1378This field MAY also be used for future transport protocols
1379that have 16-bit source port identifiers. This field may
1380be useful for distinguishing multiple Exporting Processes
1381that use the same IP address.",,,"See [RFC768] for the definition of the UDP
1382source port field.
1383See [RFC793] for the definition of the TCP
1384source port field.
1385See [RFC4960] for the definition of SCTP.
1386
1387
1388
1389
1390Additional information on defined UDP and TCP port numbers can be
1391found at [IANA registry service-names-port-numbers].",[RFC5102],0,2013-02-18
1392218,tcpSynTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
1393TCP ""Synchronize sequence numbers"" (SYN) flag set.",packets,,"See [RFC793] for the definition of the TCP SYN
1394flag.",[RFC5102],0,2013-02-18
1395219,tcpFinTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
1396TCP ""No more data from sender"" (FIN) flag set.",packets,,"See [RFC793] for the definition of the TCP FIN
1397flag.",[RFC5102],0,2013-02-18
1398220,tcpRstTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
1399TCP ""Reset the connection"" (RST) flag set.",packets,,"See [RFC793] for the definition of the TCP RST
1400flag.",[RFC5102],0,2013-02-18
1401221,tcpPshTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
1402TCP ""Push Function"" (PSH) flag set.",packets,,"See [RFC793] for the definition of the TCP PSH
1403flag.",[RFC5102],0,2013-02-18
1404222,tcpAckTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
1405TCP ""Acknowledgment field significant"" (ACK) flag set.",packets,,"See [RFC793] for the definition of the TCP ACK
1406flag.",[RFC5102],0,2013-02-18
1407223,tcpUrgTotalCount,unsigned64,totalCounter,current,"The total number of packets of this Flow with
1408TCP ""Urgent Pointer field significant"" (URG) flag set.",packets,,"See [RFC793] for the definition of the TCP URG
1409flag.",[RFC5102],0,2013-02-18
1410224,ipTotalLength,unsigned64,,current,The total length of the IP packet.,octets,,"See [RFC791] for the specification of the IPv4
1411total length.
1412See [RFC8200] for the specification of the
1413IPv6 payload length.
1414See [RFC2675] for the specification of the
1415IPv6 jumbo payload length.",[RFC5102],0,2013-02-18
1416225,postNATSourceIPv4Address,ipv4Address,default,current,"The definition of this Information Element is identical to the
1417definition of Information Element 'sourceIPv4Address', except
1418that it reports a modified value caused by a NAT middlebox
1419function after the packet passed the Observation Point.",,,"See [RFC791] for the definition of the IPv4 source
1420address field. See [RFC3022] for the definition of
1421NAT. See [RFC3234] for the definition of middleboxes.",[ipfix-iana_at_cisco.com],1,2014-02-03
1422226,postNATDestinationIPv4Address,ipv4Address,default,current,"The definition of this Information Element is identical to the
1423definition of Information Element 'destinationIPv4Address',
1424except that it reports a modified value caused by a NAT
1425middlebox function after the packet passed the Observation
1426Point.",,,"See [RFC791] for the definition of the IPv4 destination
1427address field. See [RFC3022] for the definition of
1428NAT. See [RFC3234] for the definition of middleboxes.",[ipfix-iana_at_cisco.com],1,2014-02-03
1429227,postNAPTSourceTransportPort,unsigned16,identifier,current,"The definition of this Information Element is identical to the
1430definition of Information Element 'sourceTransportPort', except
1431that it reports a modified value caused by a Network Address
1432Port Translation (NAPT) middlebox function after the packet
1433passed the Observation Point.",,,"See [RFC768] for the definition of the UDP source port
1434field. See [RFC793] for the definition of the TCP
1435source port field. See [RFC4960] for the definition of
1436SCTP.
1437See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes.
1438Additional information on defined UDP and TCP port numbers can
1439be found at http://www.iana.org/assignments/port-numbers.",[ipfix-iana_at_cisco.com],0,2013-02-18
1440228,postNAPTDestinationTransportPort,unsigned16,identifier,current,"The definition of this Information Element is identical to the
1441definition of Information Element 'destinationTransportPort',
1442except that it reports a modified value caused by a Network
1443Address Port Translation (NAPT) middlebox function after the
1444packet passed the Observation Point.",,,"See [RFC768] for the definition of the UDP source port
1445field. See [RFC793] for the definition of the TCP
1446source port field. See [RFC4960] for the definition of
1447SCTP.
1448See [RFC3022] for the definition of NAPT. See [RFC3234] for the definition of middleboxes.
1449Additional information on defined UDP and TCP port numbers can
1450be found at [IANA registry service-names-port-numbers].",[ipfix-iana_at_cisco.com],0,2013-02-18
1451229,natOriginatingAddressRealm,unsigned8,identifier,current,"Indicates whether the session was created because traffic
1452originated in the private or public address realm.
1453postNATSourceIPv4Address, postNATDestinationIPv4Address,
1454postNAPTSourceTransportPort, and
1455postNAPTDestinationTransportPort are qualified with the address
1456realm in perspective.
1457
1458
1459
1460
1461The allowed values are:
1462
1463
1464
1465
1466Private: 1
1467
1468
1469
1470
1471Public: 2",,1-2,See [RFC3022] for the definition of NAT.,[ipfix-iana_at_cisco.com],1,2014-08-13
1472230,natEvent,unsigned8,identifier,current,"This Information Element identifies a NAT event. This
1473 IE identifies the type of a NAT event. Examples of NAT events
1474 include, but are not limited to, NAT translation create, NAT
1475 translation delete, Threshold Reached, or Threshold Exceeded, etc.
1476 Values for this Information Element are listed in the NAT Event Type
1477 registry, see [http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-nat-event-type].
1478 New assignments of values will be administered by IANA and are subject to
1479 Expert Review [RFC8126]. Experts need to check definitions of new
1480 values for completeness, accuracy, and redundancy.",,,"See [RFC3022] for the definition of NAT. See
1481[RFC3234] for the definition of middleboxes.
1482See [RFC-ietf-behave-ipfix-nat-logging-13]
1483for the definitions of values 4-16.",[RFC-ietf-behave-ipfix-nat-logging-13],2,2017-03-15
1484231,initiatorOctets,unsigned64,deltaCounter,current,"The total number of layer 4 payload bytes in a flow from the
1485initiator. The initiator is the device which triggered the
1486session creation, and remains the same for the life of the
1487session.",octets,,"See #298, initiatorPackets.",[ipfix-iana_at_cisco.com],1,2014-08-13
1488232,responderOctets,unsigned64,deltaCounter,current,"The total number of layer 4 payload bytes in a flow from the
1489responder. The responder is the device which replies to the
1490initiator, and remains the same for the life of the session.",octets,,"See #299, responderPackets.",[ipfix-iana_at_cisco.com],1,2014-08-13
1491233,firewallEvent,unsigned8,,current,"Indicates a firewall event. The allowed values are:
1492
1493
1494
1495
14960 - Ignore (invalid)
1497
1498
1499
1500
15011 - Flow Created
1502
1503
1504
1505
15062 - Flow Deleted
1507
1508
1509
1510
15113 - Flow Denied
1512
1513
1514
1515
15164 - Flow Alert
1517
1518
1519
1520
15215 - Flow Update",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1522234,ingressVRFID,unsigned32,,current,"An unique identifier of the VRFname where the packets of this
1523flow are being received. This identifier is unique per Metering
1524Process",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1525235,egressVRFID,unsigned32,,current,"An unique identifier of the VRFname where the packets of this
1526flow are being sent. This identifier is unique per Metering
1527Process",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1528236,VRFname,string,default,current,The name of a VPN Routing and Forwarding table (VRF).,,,See [RFC4364] for the definition of VRF.,[ipfix-iana_at_cisco.com],0,2013-02-18
1529237,postMplsTopLabelExp,unsigned8,flags,current,"The definition of this Information Element is identical to the
1530definition of Information Element 'mplsTopLabelExp', except
1531that it reports a potentially modified value caused by a
1532middlebox function after the packet passed the Observation
1533Point.",,,"See [RFC3032] for the specification of the Exp
1534field.
1535See [RFC3270] for usage of the Exp field.",[RFC5102],0,2013-02-18
1536238,tcpWindowScale,unsigned16,,current,The scale of the window field in the TCP header.,,,"See [RFC1323] for the definition of the TCP
1537window scale.",[RFC5102],0,2013-02-18
1538239,biflowDirection,unsigned8,identifier,current,"A description of the direction assignment method used to
1539assign the Biflow Source and Destination. This Information Element
1540MAY be present in a Flow Data Record, or applied to all flows exported
1541from an Exporting Process or Observation Domain using IPFIX Options.
1542If this Information Element is not present in a Flow Record or
1543associated with a Biflow via scope, it is assumed that the
1544configuration of the direction assignment method is done out-of-band.
1545Note that when using IPFIX Options to apply this Information Element
1546to all flows within an Observation Domain or from an Exporting
1547Process, the Option SHOULD be sent reliably. If reliable transport is
1548not available (i.e., when using UDP), this Information Element SHOULD
1549appear in each Flow Record. This field may take the following
1550values:
1551
1552
1553+-------+------------------+----------------------------------------+
1554| Value | Name | Description |
1555+-------+------------------+----------------------------------------+
1556| 0x00 | arbitrary | Direction was assigned arbitrarily. |
1557| 0x01 | initiator | The Biflow Source is the flow |
1558| | | initiator, as determined by the |
1559| | | Metering Process' best effort to |
1560| | | detect the initiator. |
1561| 0x02 | reverseInitiator | The Biflow Destination is the flow |
1562| | | initiator, as determined by the |
1563| | | Metering Process' best effort to |
1564| | | detect the initiator. This value is |
1565| | | provided for the convenience of |
1566| | | Exporting Processes to revise an |
1567| | | initiator estimate without re-encoding |
1568| | | the Biflow Record. |
1569| 0x03 | perimeter | The Biflow Source is the endpoint |
1570| | | outside of a defined perimeter. The |
1571| | | perimeter's definition is implicit in |
1572| | | the set of Biflow Source and Biflow |
1573| | | Destination addresses exported in the |
1574| | | Biflow Records. |
1575+-------+------------------+----------------------------------------+",,,,[RFC5103],0,2013-02-18
1576240,ethernetHeaderLength,unsigned8,quantity,current,"The difference between the length of an Ethernet frame (minus the
1577FCS) and the length of its MAC Client Data section (including any
1578padding) as defined in section 3.1 of [IEEE.802-3.2005]. It does
1579not include the Preamble, SFD and Extension field lengths.",octets,,[IEEE.802-3.2005],[ipfix-iana_at_cisco.com],1,2014-08-13
1580241,ethernetPayloadLength,unsigned16,quantity,current,"The length of the MAC Client Data section (including any padding)
1581of a frame as defined in section 3.1 of [IEEE.802-3.2005].",octets,,[IEEE.802-3.2005],[ipfix-iana_at_cisco.com],1,2014-08-13
1582242,ethernetTotalLength,unsigned16,quantity,current,"The total length of the Ethernet frame (excluding the Preamble,
1583SFD, Extension and FCS fields) as described in section 3.1 of
1584[IEEE.802-3.2005].",octets,,[IEEE.802-3.2005],[ipfix-iana_at_cisco.com],1,2014-08-13
1585243,dot1qVlanId,unsigned16,identifier,current,"The value of the 12-bit VLAN Identifier portion of the Tag Control
1586Information field of an Ethernet frame. The structure and
1587semantics within the Tag Control Information field are defined in
1588[IEEE802.1Q]. In Provider Bridged Networks, it represents the
1589Service VLAN identifier in the Service VLAN Tag (S-TAG) Tag
1590Control Information (TCI) field or the Customer VLAN identifier in
1591the Customer VLAN Tag (C-TAG) Tag Control Information (TCI) field
1592as described in [IEEE802.1Q]. In Provider Backbone Bridged
1593Networks, it represents the Backbone VLAN identifier in the
1594Backbone VLAN Tag (B-TAG) Tag Control Information (TCI) field as
1595described in [IEEE802.1Q]. In a virtual link between a host
1596system and EVB bridge, it represents the Service VLAN identifier
1597indicating S-channel as described in [IEEE802.1Qbg].
1598
1599
1600
1601
1602In the case of a multi-tagged frame, it represents the outer tag's
1603VLAN identifier, except for I-TAG.",,,[IEEE802.1Q][IEEE802.1Qbg],[ipfix-iana_at_cisco.com][RFC7133],2,2014-01-11
1604244,dot1qPriority,unsigned8,identifier,current,"The value of the 3-bit User Priority portion of the Tag Control
1605Information field of an Ethernet frame. The structure and
1606semantics within the Tag Control Information field are defined in
1607[IEEE802.1Q]. In the case of multi-tagged frame, it represents
1608the 3-bit Priority Code Point (PCP) portion of the outer tag's Tag
1609Control Information (TCI) field as described in [IEEE802.1Q],
1610except for I-TAG.",,,[IEEE802.1Q],[ipfix-iana_at_cisco.com][RFC7133],1,2014-01-11
1611245,dot1qCustomerVlanId,unsigned16,identifier,current,"The value represents the Customer VLAN identifier in the Customer
1612VLAN Tag (C-TAG) Tag Control Information (TCI) field as described
1613in [IEEE802.1Q].",,,[IEEE802.1Q],[ipfix-iana_at_cisco.com][RFC7133],1,2014-01-11
1614246,dot1qCustomerPriority,unsigned8,identifier,current,"The value represents the 3-bit Priority Code Point (PCP) portion
1615of the Customer VLAN Tag (C-TAG) Tag Control Information (TCI)
1616field as described in [IEEE802.1Q].",,,[IEEE802.1Q],[ipfix-iana_at_cisco.com][RFC7133],1,2014-01-11
1617247,metroEvcId,string,default,current,"The EVC Service Attribute which uniquely identifies the Ethernet
1618Virtual Connection (EVC) within a Metro Ethernet Network, as
1619defined in section 6.2 of MEF 10.1. The MetroEVCID is encoded in
1620a string of up to 100 characters.",,,"MEF 10.1 (Ethernet Services Attributes Phase 2)
1621MEF16 (Ethernet Local Management Interface)",[ipfix-iana_at_cisco.com],1,2014-02-03
1622248,metroEvcType,unsigned8,identifier,current,"The 3-bit EVC Service Attribute which identifies the type of
1623service provided by an EVC.",,,"MEF 10.1 (Ethernet Services Attributes Phase 2)
1624MEF16 (Ethernet Local Management Interface)",[ipfix-iana_at_cisco.com],0,2013-02-18
1625249,pseudoWireId,unsigned32,identifier,current,"A 32-bit non-zero connection identifier, which together with the
1626pseudoWireType, identifies the Pseudo Wire (PW) as defined in [RFC8077].",,,See [RFC8077] for pseudowire definitions.,[ipfix-iana_at_cisco.com],0,2013-02-18
1627250,pseudoWireType,unsigned16,identifier,current,"The value of this information element identifies the type of MPLS
1628Pseudo Wire (PW) as defined in [RFC4446].",,,"See [RFC4446] for the pseudowire type definition, and
1629http://www.iana.org/assignments/pwe3-parameters for the IANA
1630Pseudowire Types Registry.",[ipfix-iana_at_cisco.com],0,2013-02-18
1631251,pseudoWireControlWord,unsigned32,identifier,current,"The 32-bit Preferred Pseudo Wire (PW) MPLS Control Word as
1632defined in Section 3 of [RFC4385].",,,"See [RFC4385] for the Pseudo Wire Control Word
1633definition.",[ipfix-iana_at_cisco.com],0,2013-02-18
1634252,ingressPhysicalInterface,unsigned32,identifier,current,"The index of a networking device's physical interface (example, a
1635switch port) where packets of this flow are being received.",,,See [RFC2863] for the definition of the ifIndex object.,[ipfix-iana_at_cisco.com],0,2013-02-18
1636253,egressPhysicalInterface,unsigned32,identifier,current,"The index of a networking device's physical interface (example, a
1637switch port) where packets of this flow are being sent.",,,See [RFC2863] for the definition of the ifIndex object.,[ipfix-iana_at_cisco.com],0,2013-02-18
1638254,postDot1qVlanId,unsigned16,identifier,current,"The definition of this Information Element is identical to the
1639definition of Information Element 'dot1qVlanId', except that it
1640reports a potentially modified value caused by a middlebox
1641function after the packet passed the Observation Point.",,,"[IEEE.802-3.2005]
1642[IEEE.802-1ad.2005]",[ipfix-iana_at_cisco.com],0,2013-02-18
1643255,postDot1qCustomerVlanId,unsigned16,identifier,current,"The definition of this Information Element is identical to the
1644definition of Information Element 'dot1qCustomerVlanId', except
1645that it reports a potentially modified value caused by a
1646middlebox function after the packet passed the Observation Point.",,,"[IEEE.802-1ad.2005]
1647[IEEE.802-1Q.2003]",[ipfix-iana_at_cisco.com],0,2013-02-18
1648256,ethernetType,unsigned16,identifier,current,"The Ethernet type field of an Ethernet frame that identifies the
1649MAC client protocol carried in the payload as defined in
1650paragraph 1.4.349 of [IEEE.802-3.2005].",,,"[IEEE.802-3.2005]
1651Ethertype registry available at
1652[http://standards.ieee.org/regauth/ethertype/eth.txt]",[ipfix-iana_at_cisco.com],0,2013-02-18
1653257,postIpPrecedence,unsigned8,identifier,current,"The definition of this Information Element is identical to the
1654definition of Information Element 'ipPrecedence', except that
1655it reports a potentially modified value caused by a middlebox
1656function after the packet passed the Observation Point.",,0-7,"See [RFC1812] (Section 5.3.3) and
1657[RFC791] for the definition of the
1658IP Precedence. See [RFC1812]
1659(Section 5.3.2) and [RFC791] for the
1660definition of the IPv4 TOS field. See
1661[RFC8200] for the definition of the
1662IPv6 Traffic Class field.",[ipfix-iana_at_cisco.com],0,2013-02-18
1663258,collectionTimeMilliseconds,dateTimeMilliseconds,default,current,"The absolute timestamp at which the data within the
1664scope containing this Information Element was received by a
1665Collecting Process. This Information Element SHOULD be bound to
1666its containing IPFIX Message via IPFIX Options and the
1667messageScope Information Element, as defined below.",milliseconds,,,[RFC5655][RFC Errata 3559],1,2013-03-26
1668259,exportSctpStreamId,unsigned16,identifier,current,"The value of the SCTP Stream Identifier used by the
1669Exporting Process for exporting IPFIX Message data. This is
1670carried in the Stream Identifier field of the header of the SCTP
1671DATA chunk containing the IPFIX Message(s).",,,,[RFC5655],0,2013-02-18
1672260,maxExportSeconds,dateTimeSeconds,default,current,"The absolute Export Time of the latest IPFIX Message
1673within the scope containing this Information Element. This
1674Information Element SHOULD be bound to its containing IPFIX
1675Transport Session via IPFIX Options and the sessionScope
1676Information Element.",seconds,,,[RFC5655],0,2013-02-18
1677261,maxFlowEndSeconds,dateTimeSeconds,default,current,"The latest absolute timestamp of the last packet
1678within any Flow within the scope containing this Information
1679Element, rounded up to the second if necessary. This Information
1680Element SHOULD be bound to its containing IPFIX Transport Session
1681via IPFIX Options and the sessionScope Information Element.",seconds,,,[RFC5655],0,2013-02-18
1682262,messageMD5Checksum,octetArray,default,current,"The MD5 checksum of the IPFIX Message containing this
1683record. This Information Element SHOULD be bound to its
1684containing IPFIX Message via an options record and the
1685messageScope Information Element, as defined below, and SHOULD
1686appear only once in a given IPFIX Message. To calculate the value
1687of this Information Element, first buffer the containing IPFIX
1688Message, setting the value of this Information Element to all
1689zeroes. Then calculate the MD5 checksum of the resulting buffer
1690as defined in [RFC1321], place the resulting value in this
1691Information Element, and export the buffered message. This
1692Information Element is intended as a simple checksum only;
1693therefore collision resistance and algorithm agility are not
1694required, and MD5 is an appropriate message digest.
1695
1696This Information Element has a fixed length of 16 octets.",,,,[RFC5655][RFC1321],0,2013-02-18
1697263,messageScope,unsigned8,,current,"The presence of this Information Element as scope in
1698an Options Template signifies that the options described by the
1699Template apply to the IPFIX Message that contains them. It is
1700defined for general purpose message scoping of options, and
1701proposed specifically to allow the attachment a checksum to a
1702message via IPFIX Options. The value of this Information Element
1703MUST be written as 0 by the File Writer or Exporting Process. The
1704value of this Information Element MUST be ignored by the File
1705Reader or the Collecting Process.",,0-0,,[RFC5655],0,2013-02-18
1706264,minExportSeconds,dateTimeSeconds,default,current,"The absolute Export Time of the earliest IPFIX Message
1707within the scope containing this Information Element. This
1708Information Element SHOULD be bound to its containing IPFIX
1709Transport Session via an options record and the sessionScope
1710Information Element.",seconds,,,[RFC5655],0,2013-02-18
1711265,minFlowStartSeconds,dateTimeSeconds,default,current,"The earliest absolute timestamp of the first packet
1712within any Flow within the scope containing this Information
1713Element, rounded down to the second if necessary. This
1714Information Element SHOULD be bound to its containing IPFIX
1715Transport Session via an options record and the sessionScope
1716Information Element.",seconds,,,[RFC5655],0,2013-02-18
1717266,opaqueOctets,octetArray,default,current,"This Information Element is used to encapsulate non-
1718IPFIX data into an IPFIX Message stream, for the purpose of
1719allowing a non-IPFIX data processor to store a data stream inline
1720within an IPFIX File. A Collecting Process or File Writer MUST
1721NOT try to interpret this binary data. This Information Element
1722differs from paddingOctets as its contents are meaningful in some
1723non-IPFIX context, while the contents of paddingOctets MUST be
17240x00 and are intended only for Information Element alignment.",,,,[RFC5655],0,2013-02-18
1725267,sessionScope,unsigned8,,current,"The presence of this Information Element as scope in
1726an Options Template signifies that the options described by the
1727Template apply to the IPFIX Transport Session that contains them.
1728Note that as all options are implicitly scoped to Transport
1729Session and Observation Domain, this Information Element is
1730equivalent to a ""null"" scope. It is defined for general purpose
1731session scoping of options, and proposed specifically to allow the
1732attachment of time window to an IPFIX File via IPFIX Options. The
1733value of this Information Element MUST be written as 0 by the File
1734Writer or Exporting Process. The value of this Information
1735Element MUST be ignored by the File Reader or the Collecting
1736Process.",,0-0,,[RFC5655],0,2013-02-18
1737268,maxFlowEndMicroseconds,dateTimeMicroseconds,default,current,"The latest absolute timestamp of the last packet
1738within any Flow within the scope containing this Information
1739Element, rounded up to the microsecond if necessary. This
1740Information Element SHOULD be bound to its containing IPFIX
1741Transport Session via IPFIX Options and the sessionScope
1742Information Element. This Information Element SHOULD be used only
1743in Transport Sessions containing Flow Records with microsecond-
1744precision (or better) timestamp Information Elements.",microseconds,,,[RFC5655],0,2013-02-18
1745269,maxFlowEndMilliseconds,dateTimeMilliseconds,default,current,"The latest absolute timestamp of the last packet
1746within any Flow within the scope containing this Information
1747Element, rounded up to the millisecond if necessary. This
1748Information Element SHOULD be bound to its containing IPFIX
1749Transport Session via IPFIX Options and the sessionScope
1750Information Element. This Information Element SHOULD be used only
1751in Transport Sessions containing Flow Records with millisecond-
1752precision (or better) timestamp Information Elements.",milliseconds,,,[RFC5655],0,2013-02-18
1753270,maxFlowEndNanoseconds,dateTimeNanoseconds,default,current,"The latest absolute timestamp of the last packet
1754within any Flow within the scope containing this Information
1755Element. This Information Element SHOULD be bound to its
1756containing IPFIX Transport Session via IPFIX Options and the
1757sessionScope Information Element. This Information Element SHOULD
1758be used only in Transport Sessions containing Flow Records with
1759nanosecond-precision timestamp Information Elements.",nanoseconds,,,[RFC5655],0,2013-02-18
1760271,minFlowStartMicroseconds,dateTimeMicroseconds,default,current,"The earliest absolute timestamp of the first packet
1761within any Flow within the scope containing this Information
1762Element, rounded down to the microsecond if necessary. This
1763Information Element SHOULD be bound to its containing IPFIX
1764Transport Session via an options record and the sessionScope
1765Information Element. This Information Element SHOULD be used only
1766in Transport Sessions containing Flow Records with microsecond-
1767precision (or better) timestamp Information Elements.",microseconds,,,[RFC5655],0,2013-02-18
1768272,minFlowStartMilliseconds,dateTimeMilliseconds,default,current,"The earliest absolute timestamp of the first packet
1769within any Flow within the scope containing this Information
1770Element, rounded down to the millisecond if necessary. This
1771Information Element SHOULD be bound to its containing IPFIX
1772Transport Session via an options record and the sessionScope
1773Information Element. This Information Element SHOULD be used only
1774in Transport Sessions containing Flow Records with millisecond-
1775precision (or better) timestamp Information Elements.",milliseconds,,,[RFC5655],0,2013-02-18
1776273,minFlowStartNanoseconds,dateTimeNanoseconds,default,current,"The earliest absolute timestamp of the first packet
1777within any Flow within the scope containing this Information
1778Element. This Information Element SHOULD be bound to its
1779containing IPFIX Transport Session via an options record and the
1780sessionScope Information Element. This Information Element SHOULD
1781be used only in Transport Sessions containing Flow Records with
1782nanosecond-precision timestamp Information Elements.",nanoseconds,,,[RFC5655],0,2013-02-18
1783274,collectorCertificate,octetArray,default,current,"The full X.509 certificate, encoded in ASN.1 DER
1784format, used by the Collector when IPFIX Messages were transmitted
1785using TLS or DTLS. This Information Element SHOULD be bound to
1786its containing IPFIX Transport Session via an options record and
1787the sessionScope Information Element, or to its containing IPFIX
1788Message via an options record and the messageScope Information
1789Element.",,,,[RFC5655],0,2013-02-18
1790275,exporterCertificate,octetArray,default,current,"The full X.509 certificate, encoded in ASN.1 DER
1791format, used by the Collector when IPFIX Messages were transmitted
1792using TLS or DTLS. This Information Element SHOULD be bound to
1793its containing IPFIX Transport Session via an options record and
1794the sessionScope Information Element, or to its containing IPFIX
1795Message via an options record and the messageScope Information
1796Element.",,,,[RFC5655],0,2013-02-18
1797276,dataRecordsReliability,boolean,default,current,"The export reliability of Data Records, within this SCTP
1798stream, for the element(s) in the Options Template
1799scope. A typical example of an element for which the
1800export reliability will be reported is the templateID,
1801as specified in the Data Records Reliability Options
1802Template. A value of 'True' means that the Exporting
1803Process MUST send any Data Records associated with the
1804element(s) reliably within this SCTP stream. A value of
1805'False' means that the Exporting Process MAY send any
1806Data Records associated with the element(s) unreliably
1807within this SCTP stream.",,,,[RFC6526],1,2014-02-03
1808277,observationPointType,unsigned8,identifier,current,"Type of observation point. Values assigned to date are:
1809
1810
1811
1812
18131. Physical port
1814
1815
1816
1817
18182. Port channel
1819
1820
1821
1822
18233. Vlan.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1824278,newConnectionDeltaCount,unsigned32,deltaCounter,current,"This information element counts the number of TCP or UDP
1825connections which were opened during the observation period. The
1826observation period may be specified by the flow start and end timestamps.",,,,[ipfix-iana_at_cisco.com],1,2014-08-13
1827279,connectionSumDurationSeconds,unsigned64,,current,"This information element aggregates the total time in
1828seconds for all of the TCP or UDP connections which were in use during
1829the observation period. For example if there are 5 concurrent
1830connections each for 10 seconds, the value would be 50 s.",seconds,,,[ipfix-iana_at_cisco.com],1,2013-06-25
1831280,connectionTransactionId,unsigned64,identifier,current,"This information element identifies a transaction within a
1832connection. A transaction is a meaningful exchange of application data
1833between two network devices or a client and server. A transactionId is
1834assigned the first time a flow is reported, so that later reports for
1835the same flow will have the same transactionId. A different
1836transactionId is used for each transaction within a TCP or UDP
1837connection. The identifiers need not be sequential.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1838281,postNATSourceIPv6Address,ipv6Address,default,current,"The definition of this Information Element is identical to
1839the definition of Information Element 'sourceIPv6Address', except that
1840it reports a modified value caused by a NAT64 middlebox function after
1841the packet passed the Observation Point.
1842
1843See [RFC8200] for the definition of the Source Address field in the IPv6
1844header. See [RFC3234] for the definition of middleboxes. See
1845[RFC6146] for nat64 specification.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1846282,postNATDestinationIPv6Address,ipv6Address,default,current,"The definition of this Information Element is identical to
1847the definition of Information Element 'destinationIPv6Address', except
1848that it reports a modified value caused by a NAT64 middlebox function
1849after the packet passed the Observation Point.
1850
1851See [RFC8200] for the definition of the Destination Address field in the
1852IPv6 header. See [RFC3234] for the definition of middleboxes. See
1853[RFC6146] for nat64 specification.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1854283,natPoolId,unsigned32,identifier,current,Locally unique identifier of a NAT pool.,,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1855284,natPoolName,string,default,current,The name of a NAT pool identified by a natPoolID.,,,,[ipfix-iana_at_cisco.com],0,2013-02-18
1856285,anonymizationFlags,unsigned16,flags,current,"A flag word describing specialized modifications to
1857the anonymization policy in effect for the anonymization technique
1858applied to a referenced Information Element within a referenced
1859Template. When flags are clear (0), the normal policy (as
1860described by anonymizationTechnique) applies without modification.
1861
1862
1863
1864MSB 14 13 12 11 10 9 8 7 6 5 4 3 2 1 LSB
1865+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
1866| Reserved |LOR|PmA| SC |
1867+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
1868
1869anonymizationFlags IE
1870
1871+--------+----------+-----------------------------------------------+
1872| bit(s) | name | description |
1873| (LSB = | | |
1874| 0) | | |
1875+--------+----------+-----------------------------------------------+
1876| 0-1 | SC | Stability Class: see the Stability Class |
1877| | | table below, and section Section 5.1. |
1878| 2 | PmA | Perimeter Anonymization: when set (1), |
1879| | | source- Information Elements as described in |
1880| | | [RFC5103] are interpreted as external |
1881| | | addresses, and destination- Information |
1882| | | Elements as described in [RFC5103] are |
1883| | | interpreted as internal addresses, for the |
1884| | | purposes of associating |
1885| | | anonymizationTechnique to Information |
1886| | | Elements only; see Section 7.2.2 for details. |
1887| | | This bit MUST NOT be set when associated with |
1888| | | a non-endpoint (i.e., source- or |
1889| | | destination-) Information Element. SHOULD be |
1890| | | consistent within a record (i.e., if a |
1891| | | source- Information Element has this flag |
1892| | | set, the corresponding destination- element |
1893| | | SHOULD have this flag set, and vice-versa.) |
1894| 3 | LOR | Low-Order Unchanged: when set (1), the |
1895| | | low-order bits of the anonymized Information |
1896| | | Element contain real data. This modification |
1897| | | is intended for the anonymization of |
1898| | | network-level addresses while leaving |
1899| | | host-level addresses intact in order to |
1900| | | preserve host level-structure, which could |
1901| | | otherwise be used to reverse anonymization. |
1902| | | MUST NOT be set when associated with a |
1903| | | truncation-based anonymizationTechnique. |
1904| 4-15 | Reserved | Reserved for future use: SHOULD be cleared |
1905| | | (0) by the Exporting Process and MUST be |
1906| | | ignored by the Collecting Process. |
1907+--------+----------+-----------------------------------------------+
1908
1909
1910
1911The Stability Class portion of this flags word describes the
1912stability class of the anonymization technique applied to a
1913referenced Information Element within a referenced Template.
1914Stability classes refer to the stability of the parameters of the
1915anonymization technique, and therefore the comparability of the
1916mapping between the real and anonymized values over time. This
1917determines which anonymized datasets may be compared with each
1918other. Values are as follows:
1919
1920
1921
1922+-----+-----+-------------------------------------------------------+
1923| Bit | Bit | Description |
1924| 1 | 0 | |
1925+-----+-----+-------------------------------------------------------+
1926| 0 | 0 | Undefined: the Exporting Process makes no |
1927| | | representation as to how stable the mapping is, or |
1928| | | over what time period values of this field will |
1929| | | remain comparable; while the Collecting Process MAY |
1930| | | assume Session level stability, Session level |
1931| | | stability is not guaranteed. Processes SHOULD assume |
1932| | | this is the case in the absence of stability class |
1933| | | information; this is the default stability class. |
1934| 0 | 1 | Session: the Exporting Process will ensure that the |
1935| | | parameters of the anonymization technique are stable |
1936| | | during the Transport Session. All the values of the |
1937| | | described Information Element for each Record |
1938| | | described by the referenced Template within the |
1939| | | Transport Session are comparable. The Exporting |
1940| | | Process SHOULD endeavour to ensure at least this |
1941| | | stability class. |
1942| 1 | 0 | Exporter-Collector Pair: the Exporting Process will |
1943| | | ensure that the parameters of the anonymization |
1944| | | technique are stable across Transport Sessions over |
1945| | | time with the given Collecting Process, but may use |
1946| | | different parameters for different Collecting |
1947| | | Processes. Data exported to different Collecting |
1948| | | Processes are not comparable. |
1949| 1 | 1 | Stable: the Exporting Process will ensure that the |
1950| | | parameters of the anonymization technique are stable |
1951| | | across Transport Sessions over time, regardless of |
1952| | | the Collecting Process to which it is sent. |
1953+-----+-----+-------------------------------------------------------+",,,,[RFC6235],0,2013-02-18
1954286,anonymizationTechnique,unsigned16,identifier,current,"A description of the anonymization technique applied
1955to a referenced Information Element within a referenced Template.
1956Each technique may be applicable only to certain Information
1957Elements and recommended only for certain Infomation Elements;
1958these restrictions are noted in the table below.
1959
1960
1961
1962+-------+---------------------------+-----------------+-------------+
1963| Value | Description | Applicable to | Recommended |
1964| | | | for |
1965+-------+---------------------------+-----------------+-------------+
1966| 0 | Undefined: the Exporting | all | all |
1967| | Process makes no | | |
1968| | representation as to | | |
1969| | whether the defined field | | |
1970| | is anonymized or not. | | |
1971| | While the Collecting | | |
1972| | Process MAY assume that | | |
1973| | the field is not | | |
1974| | anonymized, it is not | | |
1975| | guaranteed not to be. | | |
1976| | This is the default | | |
1977| | anonymization technique. | | |
1978| 1 | None: the values exported | all | all |
1979| | are real. | | |
1980| 2 | Precision | all | all |
1981| | Degradation/Truncation: | | |
1982| | the values exported are | | |
1983| | anonymized using simple | | |
1984| | precision degradation or | | |
1985| | truncation. The new | | |
1986| | precision or number of | | |
1987| | truncated bits is | | |
1988| | implicit in the exported | | |
1989| | data, and can be deduced | | |
1990| | by the Collecting | | |
1991| | Process. | | |
1992| 3 | Binning: the values | all | all |
1993| | exported are anonymized | | |
1994| | into bins. | | |
1995| 4 | Enumeration: the values | all | timestamps |
1996| | exported are anonymized | | |
1997| | by enumeration. | | |
1998| 5 | Permutation: the values | all | identifiers |
1999| | exported are anonymized | | |
2000| | by permutation. | | |
2001| 6 | Structured Permutation: | addresses | |
2002| | the values exported are | | |
2003| | anonymized by | | |
2004| | permutation, preserving | | |
2005| | bit-level structure as | | |
2006| | appropriate; this | | |
2007| | represents | | |
2008| | prefix-preserving IP | | |
2009| | address anonymization or | | |
2010| | structured MAC address | | |
2011| | anonymization. | | |
2012| 7 | Reverse Truncation: the | addresses | |
2013| | values exported are | | |
2014| | anonymized using reverse | | |
2015| | truncation. The number | | |
2016| | of truncated bits is | | |
2017| | implicit in the exported | | |
2018| | data, and can be deduced | | |
2019| | by the Collecting | | |
2020| | Process. | | |
2021| 8 | Noise: the values | non-identifiers | counters |
2022| | exported are anonymized | | |
2023| | by adding random noise to | | |
2024| | each value. | | |
2025| 9 | Offset: the values | all | timestamps |
2026| | exported are anonymized | | |
2027| | by adding a single offset | | |
2028| | to all values. | | |
2029+-------+---------------------------+-----------------+-------------+",,,,[RFC6235],0,2013-02-18
2030287,informationElementIndex,unsigned16,identifier,current,"A zero-based index of an Information Element
2031referenced by informationElementId within a Template referenced by
2032templateId; used to disambiguate scope for templates containing
2033multiple identical Information Elements.",,,,[RFC6235],0,2013-02-18
2034288,p2pTechnology,string,default,current,"Specifies if the Application ID is based on peer-to-peer
2035technology.
2036
2037
2038
2039
2040Possible values are: { ""yes"", ""y"", 1 },
2041{ ""no"", ""n"", 2 } and { ""unassigned"", ""u"", 0 }.",,,,[RFC6759],0,2013-02-18
2042289,tunnelTechnology,string,default,current,"Specifies if the Application ID is used as a tunnel technology.
2043
2044
2045
2046
2047Possible values are: { ""yes"", ""y"", 1 }, { ""no"", ""n"", 2 } and
2048{ ""unassigned"", ""u"", 0 }.",,,,[RFC6759],0,2013-02-18
2049290,encryptedTechnology,string,default,current,"Specifies if the Application ID is an encrypted networking
2050protocol.
2051
2052
2053
2054 Possible values are: { ""yes"", ""y"", 1 },
2055{ ""no"", ""n"", 2 } and { ""unassigned"", ""u"", 0 }.",,,,[RFC6759],0,2013-02-18
2056291,basicList,basicList,list,current,"Specifies a generic Information Element with a basicList abstract
2057data type. For example, a list of port numbers, a list of
2058interface indexes, etc.",,,,[RFC6313],0,2013-02-18
2059292,subTemplateList,subTemplateList,list,current,"Specifies a generic Information Element with a subTemplateList
2060abstract data type.",,,,[RFC6313],0,2013-02-18
2061293,subTemplateMultiList,subTemplateMultiList,list,current,"Specifies a generic Information Element with a
2062subTemplateMultiList abstract data type.",,,,[RFC6313],0,2013-02-18
2063294,bgpValidityState,unsigned8,identifier,current,"This element describes the ""validity state"" of the BGP route correspondent source or destination IP address. If the ""validity state"" for this Flow is only available, then the value of this Information Element is 255.",,,"See [RFC4271] for a description of BGP-4,
2064[RFC6811] for the
2065definition of ""validity states"" and
2066[draft-ietf-sidr-origin-validation-signaling]
2067for the encoding of those ""validity states"".",[ipfix-iana_at_cisco.com],0,2013-02-18
2068295,IPSecSPI,unsigned32,identifier,current,IPSec Security Parameters Index (SPI).,,,See [RFC2401] for the definition of SPI.,[ipfix-iana_at_cisco.com],0,2013-02-18
2069296,greKey,unsigned32,identifier,current,"GRE key, which is used for identifying an individual traffic flow within a tunnel.",,,See [RFC1701] for the definition of GRE and the GRE Key.,[ipfix-iana_at_cisco.com],0,2013-02-18
2070297,natType,unsigned8,identifier,current,"The type of NAT treatment:
2071
2072
2073
2074
20750 unknown
2076
2077
2078
2079
20801 NAT44 translated
2081
2082
2083
2084
20852 NAT64 translated
2086
2087
2088
2089
20903 NAT46 translated
2091
2092
2093
2094
20954 IPv4-->IPv4 (no NAT)
2096
2097
2098
2099
21005 NAT66 translated
2101
2102
2103
2104
21056 IPv6-->IPv6 (no NAT)",,,"See [RFC3022] for the definition of NAT.
2106See [RFC1631] for the definition of NAT44.
2107See [RFC6144] for the definition of NAT64.
2108See [RFC6146] for the definition of NAT46.
2109See [RFC6296] for the definition of NAT66.
2110See [RFC791] for the definition of IPv4.
2111See [RFC8200] for the definition of IPv6.",[ipfix-iana_at_cisco.com],0,2013-02-18
2112298,initiatorPackets,unsigned64,deltaCounter,current,"The total number of layer 4 packets in a flow from the
2113initiator. The initiator is the device which triggered the
2114session creation, and remains the same for the life of the
2115session.",packets,,"See #231, initiatorOctets.",[ipfix-iana_at_cisco.com],1,2014-08-13
2116299,responderPackets,unsigned64,deltaCounter,current,"The total number of layer 4 packets in a flow from the
2117responder. The responder is the device which replies to the
2118initiator, and remains the same for the life of the session.",packets,,"See #232, responderOctets.",[ipfix-iana_at_cisco.com],1,2014-08-13
2119300,observationDomainName,string,default,current,"The name of an observation domain identified by an
2120observationDomainId.",,,"See #149, observationDomainId.",[ipfix-iana_at_cisco.com],0,2013-02-18
2121301,selectionSequenceId,unsigned64,identifier,current,"From all the packets observed at an Observation Point, a subset of
2122the packets is selected by a sequence of one or more Selectors.
2123The selectionSequenceId is a unique value per Observation Domain,
2124specifying the Observation Point and the sequence of Selectors
2125through which the packets are selected.",,,,[RFC5477],0,2013-02-18
2126302,selectorId,unsigned64,identifier,current,"The Selector ID is the unique ID identifying a Primitive Selector.
2127Each Primitive Selector must have a unique ID in the Observation
2128Domain.",,,,[RFC5477][RFC Errata 2052],0,2013-02-18
2129303,informationElementId,unsigned16,identifier,current,"This Information Element contains the ID of another Information
2130Element.",,,,[RFC5477],0,2013-02-18
2131304,selectorAlgorithm,unsigned16,identifier,current,"This Information Element identifies the packet selection methods
2132(e.g., Filtering, Sampling) that are applied by the Selection
2133Process.
2134
2135
2136
2137
2138Most of these methods have parameters. Further Information
2139Elements are needed to fully specify packet selection with these
2140methods and all their parameters.
2141
2142
2143
2144
2145The methods listed below are defined in [RFC5475]. For their parameters, Information Elements are defined in
2146the information model document. The names of these Information
2147Elements are listed for each method identifier.
2148
2149
2150
2151
2152Further method identifiers may be added to the list below. It
2153might be necessary to define new Information Elements to specify
2154their parameters.
2155
2156
2157
2158
2159The selectorAlgorithm registry is maintained by IANA. New
2160assignments for the registry will be administered by IANA, and
2161are subject to Expert Review [RFC8126].
2162
2163
2164
2165
2166The registry can be updated when specifications of the new
2167method(s) and any new Information Elements are provided.
2168
2169
2170
2171
2172The group of experts must double check the selectorAlgorithm
2173definitions and Information Elements with already defined
2174selectorAlgorithms and Information Elements for completeness,
2175accuracy, and redundancy. Those experts will initially be drawn
2176from the Working Group Chairs and document editors of the IPFIX
2177and PSAMP Working Groups.
2178
2179
2180
2181
2182The following packet selection methods identifiers are defined
2183here:
2184
2185
2186
2187
2188[IANA registry psamp-parameters]
2189
2190
2191
2192
2193There is a broad variety of possible parameters that could be used
2194for Property match Filtering (5) but currently there are no agreed
2195parameters specified.",,,,[RFC5477],0,2013-02-18
2196305,samplingPacketInterval,unsigned32,quantity,current,"This Information Element specifies the number of packets that are
2197consecutively sampled. A value of 100 means that 100
2198consecutive packets are sampled.
2199
2200
2201
2202
2203For example, this Information Element may be used to describe the
2204configuration of a systematic count-based Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
2205306,samplingPacketSpace,unsigned32,quantity,current,"This Information Element specifies the number of packets between
2206two ""samplingPacketInterval""s. A value of 100 means that the next
2207interval starts 100 packets (which are not sampled) after the
2208current ""samplingPacketInterval"" is over.
2209
2210
2211
2212
2213For example, this Information Element may be used to describe the
2214configuration of a systematic count-based Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
2215307,samplingTimeInterval,unsigned32,quantity,current,"This Information Element specifies the time interval in
2216microseconds during which all arriving packets are sampled.
2217
2218
2219
2220
2221For example, this Information Element may be used to describe the
2222configuration of a systematic time-based Sampling Selector.",microseconds,,,[RFC5477],0,2013-02-18
2223308,samplingTimeSpace,unsigned32,quantity,current,"This Information Element specifies the time interval in
2224microseconds between two ""samplingTimeInterval""s. A value of 100
2225means that the next interval starts 100 microseconds (during which
2226no packets are sampled) after the current ""samplingTimeInterval""
2227is over.
2228
2229
2230
2231
2232For example, this Information Element may used to describe the
2233configuration of a systematic time-based Sampling Selector.",microseconds,,,[RFC5477],0,2013-02-18
2234309,samplingSize,unsigned32,quantity,current,"This Information Element specifies the number of elements taken
2235from the parent Population for random Sampling methods.
2236
2237
2238
2239
2240For example, this Information Element may be used to describe the
2241configuration of a random n-out-of-N Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
2242310,samplingPopulation,unsigned32,quantity,current,"This Information Element specifies the number of elements in the
2243parent Population for random Sampling methods.
2244
2245
2246
2247
2248For example, this Information Element may be used to describe the
2249configuration of a random n-out-of-N Sampling Selector.",packets,,,[RFC5477],0,2013-02-18
2250311,samplingProbability,float64,quantity,current,"This Information Element specifies the probability that a packet
2251is sampled, expressed as a value between 0 and 1. The probability
2252is equal for every packet. A value of 0 means no packet was
2253sampled since the probability is 0.
2254
2255
2256
2257
2258For example, this Information Element may be used to describe the
2259configuration of a uniform probabilistic Sampling Selector.",,,,[RFC5477],0,2013-02-18
2260312,dataLinkFrameSize,unsigned16,quantity,current,"This Information Element specifies the length of the selected data
2261link frame.
2262
2263
2264
2265
2266The data link layer is defined in [ISO/IEC.7498-1:1994].",,,[ISO/IEC.7498-1:1994],[RFC7133],1,2014-01-11
2267313,ipHeaderPacketSection,octetArray,default,current,"This Information Element carries a series of n octets from the IP
2268header of a sampled packet, starting sectionOffset octets into the
2269IP header.
2270
2271
2272
2273
2274However, if no sectionOffset field corresponding to this
2275Information Element is present, then a sectionOffset of zero
2276applies, and the octets MUST be from the start of the IP header.
2277
2278
2279
2280
2281With sufficient length, this element also reports octets from the
2282IP payload. However, full packet capture of arbitrary packet
2283streams is explicitly out of scope per the Security Considerations
2284sections of [RFC5477] and [RFC2804].
2285
2286
2287
2288
2289The sectionExportedOctets expresses how much data was exported,
2290while the remainder is padding.
2291
2292
2293
2294
2295When the sectionExportedOctets field corresponding to this
2296Information Element exists, this Information Element MAY have a
2297fixed length and MAY be padded, or it MAY have a variable length.
2298
2299
2300
2301
2302When the sectionExportedOctets field corresponding to this
2303Information Element does not exist, this Information Element
2304SHOULD have a variable length and MUST NOT be padded. In this
2305case, the size of the exported section may be constrained due to
2306limitations in the IPFIX protocol.",,,"[RFC2804]
2307[RFC5477]",[RFC5477][RFC7133],1,2014-01-11
2308314,ipPayloadPacketSection,octetArray,default,current,"This Information Element carries a series of n octets from the IP
2309payload of a sampled packet, starting sectionOffset octets into
2310the IP payload.
2311
2312
2313
2314
2315However, if no sectionOffset field corresponding to this
2316Information Element is present, then a sectionOffset of zero
2317applies, and the octets MUST be from the start of the IP payload.
2318
2319
2320
2321
2322The IPv4 payload is that part of the packet that follows the IPv4
2323header and any options, which [RFC791] refers to as ""data"" or
2324""data octets"". For example, see the examples in [RFC791],
2325Appendix A.
2326
2327
2328
2329
2330The IPv6 payload is the rest of the packet following the 40-octet
2331IPv6 header. Note that any extension headers present are
2332considered part of the payload. See [RFC8200] for the IPv6
2333specification.
2334
2335
2336
2337
2338The sectionExportedOctets expresses how much data was observed,
2339while the remainder is padding.
2340
2341
2342
2343
2344When the sectionExportedOctets field corresponding to this
2345Information Element exists, this Information Element MAY have a
2346fixed length and MAY be padded, or MAY have a variable length.
2347
2348
2349
2350
2351When the sectionExportedOctets field corresponding to this
2352Information Element does not exist, this Information Element
2353SHOULD have a variable length and MUST NOT be padded. In this
2354case, the size of the exported section may be constrained due to
2355limitations in the IPFIX protocol.",,,"[RFC791]
2356[RFC8200]",[RFC5477][RFC7133],1,2014-01-11
2357315,dataLinkFrameSection,octetArray,default,current,"This Information Element carries n octets from the data link frame
2358of a selected frame, starting sectionOffset octets into the frame.
2359
2360
2361
2362
2363However, if no sectionOffset field corresponding to this
2364Information Element is present, then a sectionOffset of zero
2365applies, and the octets MUST be from the start of the data link
2366frame.
2367
2368
2369
2370
2371The sectionExportedOctets expresses how much data was observed,
2372while the remainder is padding.
2373
2374
2375
2376
2377When the sectionExportedOctets field corresponding to this
2378Information Element exists, this Information Element MAY have a
2379fixed length and MAY be padded, or MAY have a variable length.
2380
2381
2382
2383
2384When the sectionExportedOctets field corresponding to this
2385Information Element does not exist, this Information Element
2386SHOULD have a variable length and MUST NOT be padded. In this
2387case, the size of the exported section may be constrained due to
2388limitations in the IPFIX protocol.
2389
2390
2391
2392
2393Further Information Elements, i.e., dataLinkFrameType and
2394dataLinkFrameSize, are needed to specify the data link type and the
2395size of the data link frame of this Information Element. A set of
2396these Information Elements MAY be contained in a structured data
2397type, as expressed in [RFC6313]. Or a set of these Information
2398Elements MAY be contained in one Flow Record as shown in Appendix
2399B of [RFC7133].
2400
2401
2402
2403
2404The data link layer is defined in [ISO/IEC.7498-1:1994].",,,"[RFC6313]
2405[RFC7133]
2406[ISO/IEC.7498-1:1994]",[RFC7133],1,2014-01-11
2407316,mplsLabelStackSection,octetArray,default,current,"This Information Element carries a series of n octets from the
2408MPLS label stack of a sampled packet, starting sectionOffset
2409octets into the MPLS label stack.
2410
2411
2412
2413
2414However, if no sectionOffset field corresponding to this
2415Information Element is present, then a sectionOffset of zero
2416applies, and the octets MUST be from the head of the MPLS label
2417stack.
2418
2419
2420
2421
2422With sufficient length, this element also reports octets from the
2423MPLS payload. However, full packet capture of arbitrary packet
2424streams is explicitly out of scope per the Security Considerations
2425sections of [RFC5477] and [RFC2804].
2426
2427
2428
2429
2430See [RFC3031] for the specification of MPLS packets.
2431
2432
2433
2434
2435See [RFC3032] for the specification of the MPLS label stack.
2436
2437
2438
2439
2440The sectionExportedOctets expresses how much data was observed,
2441while the remainder is padding.
2442
2443
2444
2445
2446When the sectionExportedOctets field corresponding to this
2447Information Element exists, this Information Element MAY have a
2448fixed length and MAY be padded, or MAY have a variable length.
2449
2450
2451
2452
2453When the sectionExportedOctets field corresponding to this
2454Information Element does not exist, this Information Element
2455SHOULD have a variable length and MUST NOT be padded. In this
2456case, the size of the exported section may be constrained due to
2457limitations in the IPFIX protocol.",,,"[RFC2804]
2458[RFC3031]
2459[RFC3032]
2460[RFC5477]",[RFC5477][RFC7133],1,2014-01-11
2461317,mplsPayloadPacketSection,octetArray,default,current,"The mplsPayloadPacketSection carries a series of n octets from the
2462MPLS payload of a sampled packet, starting sectionOffset octets
2463into the MPLS payload, as it is data that follows immediately after
2464the MPLS label stack.
2465
2466
2467
2468
2469However, if no sectionOffset field corresponding to this
2470Information Element is present, then a sectionOffset of zero
2471applies, and the octets MUST be from the start of the MPLS
2472payload.
2473
2474
2475
2476
2477See [RFC3031] for the specification of MPLS packets.
2478
2479
2480
2481
2482See [RFC3032] for the specification of the MPLS label stack.
2483
2484
2485
2486
2487The sectionExportedOctets expresses how much data was observed,
2488while the remainder is padding.
2489
2490
2491
2492
2493When the sectionExportedOctets field corresponding to this
2494Information Element exists, this Information Element MAY have a
2495fixed length and MAY be padded, or it MAY have a variable length.
2496
2497
2498
2499
2500When the sectionExportedOctets field corresponding to this
2501Information Element does not exist, this Information Element
2502SHOULD have a variable length and MUST NOT be padded. In this
2503case, the size of the exported section may be constrained due to
2504limitations in the IPFIX protocol.",,,"[RFC3031]
2505[RFC3032]",[RFC5477][RFC7133],1,2014-01-11
2506318,selectorIdTotalPktsObserved,unsigned64,totalCounter,current,"This Information Element specifies the total number of packets
2507observed by a Selector, for a specific value of SelectorId.
2508
2509
2510
2511
2512This Information Element should be used in an Options Template
2513scoped to the observation to which it refers. See Section 3.4.2.1
2514of the IPFIX protocol document [RFC7011].",packets,,,[RFC5477],0,2013-02-18
2515319,selectorIdTotalPktsSelected,unsigned64,totalCounter,current,"This Information Element specifies the total number of packets
2516selected by a Selector, for a specific value of SelectorId.
2517
2518
2519
2520
2521This Information Element should be used in an Options Template
2522scoped to the observation to which it refers. See Section 3.4.2.1
2523of the IPFIX protocol document [RFC7011].",packets,,,[RFC5477],0,2013-02-18
2524320,absoluteError,float64,quantity,current,"This Information Element specifies the maximum possible
2525measurement error of the reported value for a given Information
2526Element. The absoluteError has the same unit as the Information
2527Element with which it is associated. The real value of the metric can
2528differ by absoluteError (positive or negative) from the measured
2529value.
2530
2531
2532
2533
2534This Information Element provides only the error for measured
2535values. If an Information Element contains an estimated value
2536(from Sampling), the confidence boundaries and confidence level
2537have to be provided instead, using the upperCILimit, lowerCILimit,
2538and confidenceLevel Information Elements.
2539
2540
2541
2542
2543This Information Element should be used in an Options Template
2544scoped to the observation to which it refers. See Section 3.4.2.1
2545of the IPFIX protocol document [RFC7011].",The units of the Information Element for which the error is specified.,,,[RFC5477],0,2013-02-18
2546321,relativeError,float64,quantity,current,"This Information Element specifies the maximum possible positive
2547or negative error ratio for the reported value for a given
2548Information Element as percentage of the measured value. The real
2549value of the metric can differ by relativeError percent (positive
2550or negative) from the measured value.
2551
2552
2553
2554
2555This Information Element provides only the error for measured
2556values. If an Information Element contains an estimated value
2557(from Sampling), the confidence boundaries and confidence level
2558have to be provided instead, using the upperCILimit, lowerCILimit,
2559and confidenceLevel Information Elements.
2560
2561
2562
2563
2564This Information Element should be used in an Options Template
2565scoped to the observation to which it refers. See Section 3.4.2.1
2566of the IPFIX protocol document [RFC7011].",,,,[RFC5477],0,2013-02-18
2567322,observationTimeSeconds,dateTimeSeconds,default,current,"This Information Element specifies the absolute time in seconds of
2568an observation.",seconds,,,[RFC5477],1,2014-02-03
2569323,observationTimeMilliseconds,dateTimeMilliseconds,default,current,"This Information Element specifies the absolute time in
2570milliseconds of an observation.",milliseconds,,,[RFC5477],1,2014-02-03
2571324,observationTimeMicroseconds,dateTimeMicroseconds,default,current,"This Information Element specifies the absolute time in
2572microseconds of an observation.",microseconds,,,[RFC5477],1,2014-02-03
2573325,observationTimeNanoseconds,dateTimeNanoseconds,default,current,"This Information Element specifies the absolute time in
2574nanoseconds of an observation.",nanoseconds,,,[RFC5477],1,2014-02-03
2575326,digestHashValue,unsigned64,quantity,current,"This Information Element specifies the value from the digest hash
2576function.
2577
2578See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2579327,hashIPPayloadOffset,unsigned64,quantity,current,"This Information Element specifies the IP payload offset used by a
2580Hash-based Selection Selector.
2581
2582See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2583328,hashIPPayloadSize,unsigned64,quantity,current,"This Information Element specifies the IP payload size used by a
2584Hash-based Selection Selector. See also Sections 6.2, 3.8 and 7.1 of
2585[RFC5475].",,,,[RFC5477],0,2013-02-18
2586329,hashOutputRangeMin,unsigned64,quantity,current,"This Information Element specifies the value for the beginning of
2587a hash function's potential output range.
2588
2589
2590
2591
2592See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2593330,hashOutputRangeMax,unsigned64,quantity,current,"This Information Element specifies the value for the end of a hash
2594function's potential output range.
2595
2596
2597
2598
2599See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2600331,hashSelectedRangeMin,unsigned64,quantity,current,"This Information Element specifies the value for the beginning of
2601a hash function's selected range.
2602
2603
2604
2605
2606See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2607332,hashSelectedRangeMax,unsigned64,quantity,current,"This Information Element specifies the value for the end of a hash
2608function's selected range.
2609
2610
2611
2612
2613See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2614333,hashDigestOutput,boolean,default,current,"This Information Element contains a boolean value that is TRUE if
2615the output from this hash Selector has been configured to be
2616included in the packet report as a packet digest, else FALSE.
2617
2618
2619
2620
2621See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],1,2014-02-03
2622334,hashInitialiserValue,unsigned64,quantity,current,"This Information Element specifies the initialiser value to the
2623hash function.
2624
2625
2626
2627
2628See also Sections 6.2, 3.8 and 7.1 of [RFC5475].",,,,[RFC5477],0,2013-02-18
2629335,selectorName,string,default,current,"The name of a selector identified by a selectorID. Globally
2630unique per Metering Process.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2631336,upperCILimit,float64,quantity,current,"This Information Element specifies the upper limit of a confidence
2632interval. It is used to provide an accuracy statement for an
2633estimated value. The confidence limits define the range in which
2634the real value is assumed to be with a certain probability p.
2635Confidence limits always need to be associated with a confidence
2636level that defines this probability p. Please note that a
2637confidence interval only provides a probability that the real
2638value lies within the limits. That means the real value can lie
2639outside the confidence limits.
2640
2641
2642
2643
2644The upperCILimit, lowerCILimit, and confidenceLevel Information
2645Elements should all be used in an Options Template scoped to the
2646observation to which they refer. See Section 3.4.2.1 of the IPFIX
2647protocol document [RFC7011].
2648
2649
2650
2651
2652Note that the upperCILimit, lowerCILimit, and confidenceLevel are
2653all required to specify confidence, and should be disregarded
2654unless all three are specified together.",,,,[RFC5477],0,2013-02-18
2655337,lowerCILimit,float64,quantity,current,"This Information Element specifies the lower limit of a confidence
2656interval. For further information, see the description of
2657upperCILimit.
2658
2659
2660
2661
2662The upperCILimit, lowerCILimit, and confidenceLevel Information
2663Elements should all be used in an Options Template scoped to the
2664observation to which they refer. See Section 3.4.2.1 of the IPFIX
2665protocol document [RFC7011].
2666
2667
2668
2669
2670Note that the upperCILimit, lowerCILimit, and confidenceLevel are
2671all required to specify confidence, and should be disregarded
2672unless all three are specified together.",,,,[RFC5477],0,2013-02-18
2673338,confidenceLevel,float64,quantity,current,"This Information Element specifies the confidence level. It is
2674used to provide an accuracy statement for estimated values. The
2675confidence level provides the probability p with which the real
2676value lies within a given range. A confidence level always needs
2677to be associated with confidence limits that define the range in
2678which the real value is assumed to be.
2679
2680
2681
2682
2683The upperCILimit, lowerCILimit, and confidenceLevel Information
2684Elements should all be used in an Options Template scoped to the
2685observation to which they refer. See Section 3.4.2.1 of the IPFIX
2686protocol document [RFC7011].
2687
2688
2689
2690
2691Note that the upperCILimit, lowerCILimit, and confidenceLevel are
2692all required to specify confidence, and should be disregarded
2693unless all three are specified together.",,,,[RFC5477],0,2013-02-18
2694339,informationElementDataType,unsigned8,,current,"A description of the abstract data type of an IPFIX
2695information element.These are taken from the abstract data types
2696defined in section 3.1 of the IPFIX Information Model [RFC5102];
2697see that section for more information on the types described
2698in the informationElementDataType sub-registry.
2699
2700
2701
2702
2703These types are registered in the IANA IPFIX Information Element
2704Data Type subregistry. This subregistry is intended to assign
2705numbers for type names, not to provide a mechanism for adding data
2706types to the IPFIX Protocol, and as such requires a Standards
2707Action [RFC8126] to modify.",,,,[RFC5610],0,2013-02-18
2708340,informationElementDescription,string,default,current,"A UTF-8 [RFC3629] encoded Unicode string containing a
2709human-readable description of an Information Element. The content
2710of the informationElementDescription MAY be annotated with one or
2711more language tags [RFC4646], encoded in-line [RFC2482] within the
2712UTF-8 string, in order to specify the language in which the
2713description is written. Description text in multiple languages
2714MAY tag each section with its own language tag; in this case, the
2715description information in each language SHOULD have equivalent
2716meaning. In the absence of any language tag, the ""i-default""
2717[RFC2277] language SHOULD be assumed. See the Security
2718Considerations section for notes on string handling for
2719Information Element type records.",,,,[RFC5610],0,2013-02-18
2720341,informationElementName,string,default,current,"A UTF-8 [RFC3629] encoded Unicode string containing
2721the name of an Information Element, intended as a simple
2722identifier. See the Security Considerations section for notes on
2723string handling for Information Element type records",,,,[RFC5610],0,2013-02-18
2724342,informationElementRangeBegin,unsigned64,quantity,current,"Contains the inclusive low end of the range of
2725acceptable values for an Information Element.",,,,[RFC5610],0,2013-02-18
2726343,informationElementRangeEnd,unsigned64,quantity,current,"Contains the inclusive high end of the range of
2727acceptable values for an Information Element.",,,,[RFC5610],0,2013-02-18
2728344,informationElementSemantics,unsigned8,,current,"A description of the semantics of an IPFIX Information
2729Element. These are taken from the data type semantics defined in
2730section 3.2 of the IPFIX Information Model [RFC5102]; see that
2731section for more information on the types defined in the informationElementSemantics sub-registry. This
2732field may take the values in Table ; the special value 0x00
2733(default) is used to note that no semantics apply to the field; it
2734cannot be manipulated by a Collecting Process or File Reader that
2735does not understand it a priori.
2736
2737
2738
2739
2740These semantics are registered in the IANA IPFIX Information
2741Element Semantics subregistry. This subregistry is intended to
2742assign numbers for semantics names, not to provide a mechanism for
2743adding semantics to the IPFIX Protocol, and as such requires a
2744Standards Action [RFC8126] to modify.",,,,[RFC5610],0,2013-02-18
2745345,informationElementUnits,unsigned16,,current,"A description of the units of an IPFIX Information
2746Element. These correspond to the units implicitly defined in the
2747Information Element definitions in section 5 of the IPFIX
2748Information Model [RFC5102]; see that section for more information
2749on the types described in the informationElementsUnits sub-registry. This field may take the values in
2750Table 3 below; the special value 0x00 (none) is used to note that
2751the field is unitless.
2752
2753
2754
2755
2756These types are registered in the IANA IPFIX Information Element
2757Units subregistry; new types may be added on a First Come First
2758Served [RFC8126] basis.",,,,[RFC5610],0,2013-02-18
2759346,privateEnterpriseNumber,unsigned32,identifier,current,"A private enterprise number, as assigned by IANA.
2760Within the context of an Information Element Type record, this
2761element can be used along with the informationElementId element to
2762scope properties to a specific Information Element. To export
2763type information about an IANA-assigned Information Element, set
2764the privateEnterpriseNumber to 0, or do not export the
2765privateEnterpriseNumber in the type record. To export type
2766information about an enterprise-specific Information Element,
2767export the enterprise number in privateEnterpriseNumber, and
2768export the Information Element number with the Enterprise bit
2769cleared in informationElementId. The Enterprise bit in the
2770associated informationElementId Information Element MUST be
2771ignored by the Collecting Process.",,,,[RFC5610],0,2013-02-18
2772347,virtualStationInterfaceId,octetArray,default,current,"Instance Identifier of the interface to a Virtual Station. A Virtual
2773Station is an end station instance: it can be a virtual machine or a
2774physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station Interface ID.,[ipfix-iana_at_cisco.com],1,2014-02-03
2775348,virtualStationInterfaceName,string,default,current,"Name of the interface to a Virtual Station. A Virtual Station is an end station
2776instance: it can be a virtual machine or a physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station Interface.,[ipfix-iana_at_cisco.com],1,2014-02-03
2777349,virtualStationUUID,octetArray,default,current,"Unique Identifier of a Virtual Station. A Virtual Station is an end station
2778instance: it can be a virtual machine or a physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station.,[ipfix-iana_at_cisco.com],1,2014-02-03
2779350,virtualStationName,string,default,current,"Name of a Virtual Station. A Virtual Station is an end station
2780instance: it can be a virtual machine or a physical host.",,,See IEEE 802.1Qbg for the definition of Virtual Station.,[ipfix-iana_at_cisco.com],0,2013-02-18
2781351,layer2SegmentId,unsigned64,identifier,current,"Identifier of a layer 2 network segment in an overlay network.
2782The most significant byte identifies the layer 2 network
2783overlay network encapsulation type:
2784
2785
2786
2787
27880x00 reserved
2789
2790
2791
2792
27930x01 VxLAN
2794
2795
2796
2797
27980x02 NVGRE
2799
2800
2801
2802
2803The three lowest significant bytes
2804hold the value of the layer 2
2805overlay network segment identifier.
2806
2807
2808
2809
2810For example:
2811
2812
2813
2814
2815- a 24 bit segment ID VXLAN Network
2816Identifier (VNI)
2817
2818
2819
2820
2821- a 24 bit Tenant Network Identifier
2822(TNI) for NVGRE",,,"See VxLAN RFC at [RFC7348]
2823
2824
2825
2826
2827See NVGRE RFC at [RFC7637]",[ipfix-iana_at_cisco.com],0,2013-02-18
2828352,layer2OctetDeltaCount,unsigned64,deltaCounter,current,"The number of layer 2 octets since the previous report (if any) in
2829incoming packets for this Flow at the Observation Point. The
2830number of octets includes layer 2 header(s) and layer 2 payload.
2831# memo: layer 2 version of octetDeltaCount (field #1)",octets,,,[ipfix-iana_at_cisco.com],1,2014-05-02
2832353,layer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of layer 2 octets in incoming packets for this
2833Flow at the Observation Point since the Metering Process
2834(re-)initialization for this Observation Point. The number of
2835octets includes layer 2 header(s) and layer 2 payload.
2836# memo: layer 2 version of octetTotalCount (field #85)",octets,,,[ipfix-iana_at_cisco.com],1,2014-05-02
2837354,ingressUnicastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming unicast packets metered at the
2838Observation Point since the Metering Process (re-)initialization
2839for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2840355,ingressMulticastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming multicast packets metered at the
2841Observation Point since the Metering Process (re-)initialization
2842for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2843356,ingressBroadcastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming broadcast packets metered at the
2844Observation Point since the Metering Process (re-)initialization
2845for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2846357,egressUnicastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming unicast packets metered at the
2847Observation Point since the Metering Process (re-)initialization
2848for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2849358,egressBroadcastPacketTotalCount,unsigned64,totalCounter,current,"The total number of incoming broadcast packets metered at the
2850Observation Point since the Metering Process (re-)initialization
2851for this Observation Point.",packets,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2852359,monitoringIntervalStartMilliSeconds,dateTimeMilliseconds,default,current,"The absolute timestamp at which the monitoring interval
2853started.
2854A Monitoring interval is the period of time during which the Metering
2855Process is running.",milliseconds,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2856360,monitoringIntervalEndMilliSeconds,dateTimeMilliseconds,default,current,"The absolute timestamp at which the monitoring interval ended.
2857A Monitoring interval is the period of time during which the Metering
2858Process is running.",milliseconds,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2859361,portRangeStart,unsigned16,identifier,current,"The port number identifying the start of a range of ports. A value
2860of zero indicates that the range start is not specified, ie the
2861range is defined in some other way.
2862
2863
2864
2865
2866Additional information on defined TCP port numbers can be found at
2867[IANA registry service-names-port-numbers].",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2868362,portRangeEnd,unsigned16,identifier,current,"The port number identifying the end of a range of ports. A value
2869of zero indicates that the range end is not specified, ie the
2870range is defined in some other way.
2871
2872
2873
2874
2875Additional information on defined TCP port numbers can be found at
2876[IANA registry service-names-port-numbers].",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2877363,portRangeStepSize,unsigned16,identifier,current,"The step size in a port range. The default step size is 1,
2878which indicates contiguous ports. A value of zero indicates
2879that the step size is not specified, ie the range is defined
2880in some other way.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2881364,portRangeNumPorts,unsigned16,identifier,current,"The number of ports in a port range. A value of zero indicates
2882that the number of ports is not specified, ie the range is defined
2883in some other way.",,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2884365,staMacAddress,macAddress,default,current,The IEEE 802 MAC address of a wireless station (STA).,,,See section 1.4 of [RFC5415] for the definition of STA.,[ipfix-iana_at_cisco.com],1,2014-02-03
2885366,staIPv4Address,ipv4Address,default,current,The IPv4 address of a wireless station (STA).,,,See section 1.4 of [RFC5415] for the definition of STA.,[ipfix-iana_at_cisco.com],1,2014-02-03
2886367,wtpMacAddress,macAddress,default,current,The IEEE 802 MAC address of a wireless access point (WTP).,,,See section 1.4 of [RFC5415] for the definition of WTP.,[ipfix-iana_at_cisco.com],1,2014-02-03
2887368,ingressInterfaceType,unsigned32,identifier,current,"The type of interface where packets of this Flow are being received.
2888The value matches the value of managed object 'ifType' as defined in
2889[IANA registry ianaiftype-mib].",,,[IANA registry ianaiftype-mib],[ipfix-iana_at_cisco.com],0,2013-02-18
2890369,egressInterfaceType,unsigned32,identifier,current,"The type of interface where packets of this Flow are being sent.
2891The value matches the value of managed object 'ifType' as defined in
2892[IANA registry ianaiftype-mib].",,,[IANA registry ianaiftype-mib],[ipfix-iana_at_cisco.com],0,2013-02-18
2893370,rtpSequenceNumber,unsigned16,,current,The RTP sequence number per [RFC3550].,,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
2894371,userName,string,default,current,User name associated with the flow.,,,,[ipfix-iana_at_cisco.com],0,2013-02-18
2895372,applicationCategoryName,string,default,current,"An attribute that provides a first level categorization for
2896each Application ID.",,,,[RFC6759],0,2013-02-18
2897373,applicationSubCategoryName,string,default,current,"An attribute that provides a second level categorization
2898for each Application ID.",,,,[RFC6759],0,2013-02-18
2899374,applicationGroupName,string,default,current,"An attribute that groups multiple Application IDs that
2900belong to the same networking application.",,,,[RFC6759],0,2013-02-18
2901375,originalFlowsPresent,unsigned64,deltaCounter,current,"The non-conservative count of Original Flows
2902contributing to this Aggregated Flow. Non-conservative counts
2903need not sum to the original count on re-aggregation.",flows,,,[RFC7015],1,2013-06-25
2904376,originalFlowsInitiated,unsigned64,deltaCounter,current,"The conservative count of Original Flows whose first
2905packet is represented within this Aggregated Flow. Conservative
2906counts must sum to the original count on re-aggregation.",flows,,,[RFC7015],1,2013-06-25
2907377,originalFlowsCompleted,unsigned64,deltaCounter,current,"The conservative count of Original Flows whose last
2908packet is represented within this Aggregated Flow. Conservative
2909counts must sum to the original count on re-aggregation.",flows,,,[RFC7015],1,2013-06-25
2910378,distinctCountOfSourceIPAddress,unsigned64,totalCounter,current,"The count of distinct source IP address values for
2911Original Flows contributing to this Aggregated Flow, without
2912regard to IP version. This Information Element is preferred to
2913the IP-version-specific counters, unless it is important to
2914separate the counts by version.",,,,[RFC7015],0,2013-02-18
2915379,distinctCountOfDestinationIPAddress,unsigned64,totalCounter,current,"The count of distinct destination IP address values
2916for Original Flows contributing to this Aggregated Flow, without
2917regard to IP version. This Information Element is preferred to
2918the version-specific counters below, unless it is important to
2919separate the counts by version.",,,,[RFC7015],0,2013-02-18
2920380,distinctCountOfSourceIPv4Address,unsigned32,totalCounter,current,"The count of distinct source IPv4 address values for
2921Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
2922381,distinctCountOfDestinationIPv4Address,unsigned32,totalCounter,current,"The count of distinct destination IPv4 address values
2923for Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
2924382,distinctCountOfSourceIPv6Address,unsigned64,totalCounter,current,"The count of distinct source IPv6 address values for
2925Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
2926383,distinctCountOfDestinationIPv6Address,unsigned64,totalCounter,current,"The count of distinct destination IPv6 address values
2927for Original Flows contributing to this Aggregated Flow.",,,,[RFC7015],0,2013-02-18
2928384,valueDistributionMethod,unsigned8,,current,"A description of the method used to distribute the
2929counters from Contributing Flows into the Aggregated Flow records
2930described by an associated scope, generally a Template. The
2931method is deemed to apply to all the non-key Information Elements
2932in the referenced scope for which value distribution is a valid
2933operation; if the originalFlowsInitiated and/or
2934originalFlowsCompleted Information Elements appear in the
2935Template, they are not subject to this distribution method, as
2936they each infer their own distribution method. This is intended
2937to be a complete set of possible value distribution methods; it is
2938encoded as follows:
2939
2940
2941
2942+-------+-----------------------------------------------------------+
2943| Value | Description |
2944+-------+-----------------------------------------------------------+
2945| 0 | Unspecified: The counters for an Original Flow are |
2946| | explicitly not distributed according to any other method |
2947| | defined for this Information Element; use for arbitrary |
2948| | distribution, or distribution algorithms not described by |
2949| | any other codepoint. |
2950| | --------------------------------------------------------- |
2951| | |
2952| 1 | Start Interval: The counters for an Original Flow are |
2953| | added to the counters of the appropriate Aggregated Flow |
2954| | containing the start time of the Original Flow. This |
2955| | should be assumed the default if value distribution |
2956| | information is not available at a Collecting Process for |
2957| | an Aggregated Flow. |
2958| | --------------------------------------------------------- |
2959| | |
2960| 2 | End Interval: The counters for an Original Flow are added |
2961| | to the counters of the appropriate Aggregated Flow |
2962| | containing the end time of the Original Flow. |
2963| | --------------------------------------------------------- |
2964| | |
2965| 3 | Mid Interval: The counters for an Original Flow are added |
2966| | to the counters of a single appropriate Aggregated Flow |
2967| | containing some timestamp between start and end time of |
2968| | the Original Flow. |
2969| | --------------------------------------------------------- |
2970| | |
2971| 4 | Simple Uniform Distribution: Each counter for an Original |
2972| | Flow is divided by the number of time intervals the |
2973| | Original Flow covers (i.e., of appropriate Aggregated |
2974| | Flows sharing the same Flow Key), and this number is |
2975| | added to each corresponding counter in each Aggregated |
2976| | Flow. |
2977| | --------------------------------------------------------- |
2978| | |
2979| 5 | Proportional Uniform Distribution: Each counter for an |
2980| | Original Flow is divided by the number of time units the |
2981| | Original Flow covers, to derive a mean count rate. This |
2982| | mean count rate is then multiplied by the number of time |
2983| | units in the intersection of the duration of the Original |
2984| | Flow and the time interval of each Aggregated Flow. This |
2985| | is like simple uniform distribution, but accounts for the |
2986| | fractional portions of a time interval covered by an |
2987| | Original Flow in the first and last time interval. |
2988| | --------------------------------------------------------- |
2989| | |
2990| 6 | Simulated Process: Each counter of the Original Flow is |
2991| | distributed among the intervals of the Aggregated Flows |
2992| | according to some function the Intermediate Aggregation |
2993| | Process uses based upon properties of Flows presumed to |
2994| | be like the Original Flow. This is essentially an |
2995| | assertion that the Intermediate Aggregation Process has |
2996| | no direct packet timing information but is nevertheless |
2997| | not using one of the other simpler distribution methods. |
2998| | The Intermediate Aggregation Process specifically makes |
2999| | no assertion as to the correctness of the simulation. |
3000| | --------------------------------------------------------- |
3001| | |
3002| 7 | Direct: The Intermediate Aggregation Process has access |
3003| | to the original packet timings from the packets making up |
3004| | the Original Flow, and uses these to distribute or |
3005| | recalculate the counters. |
3006+-------+-----------------------------------------------------------+",,,,[RFC7015],0,2013-02-18
3007385,rfc3550JitterMilliseconds,unsigned32,quantity,current,"Interarrival jitter as defined in section 6.4.1 of [RFC3550],
3008measured in milliseconds.",milliseconds,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
3009386,rfc3550JitterMicroseconds,unsigned32,quantity,current,"Interarrival jitter as defined in section 6.4.1 of [RFC3550],
3010measured in microseconds.",microseconds,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
3011387,rfc3550JitterNanoseconds,unsigned32,quantity,current,"Interarrival jitter as defined in section 6.4.1 of [RFC3550],
3012measured in nanoseconds.",nanoseconds,,[RFC3550],[ipfix-iana_at_cisco.com],0,2013-02-18
3013388,dot1qDEI,boolean,default,current,"The value of the 1-bit Drop Eligible Indicator (DEI) field of the VLAN tag as
3014described in 802.1Q-2011 subclause 9.6. In case of a QinQ frame, it represents
3015the outer tag's DEI field and in case of an IEEE 802.1ad frame it represents
3016the DEI field of the S-TAG. Note: in earlier versions of 802.1Q the same bit
3017field in the incoming packet is occupied by the Canonical Format Indicator
3018(CFI) field, except for S-TAGs.",,,[802.1Q-2011 subclause 9.6],[Yaakov_J_Stein],1,2014-02-03
3019389,dot1qCustomerDEI,boolean,default,current,"In case of a QinQ frame, it represents the inner tag's Drop Eligible Indicator
3020 (DEI) field and in case of an IEEE 802.1ad frame it represents the DEI field of
3021 the C-TAG.",,,[802.1Q-2011 subclause 9.6],[Yaakov_J_Stein],1,2014-02-03
3022390,flowSelectorAlgorithm,unsigned16,identifier,current,"This Information Element identifies the Intermediate Flow
3023Selection Process technique (e.g., Filtering, Sampling) that is
3024applied by the Intermediate Flow Selection Process. Most of these
3025techniques have parameters. Its configuration parameter(s) MUST
3026be clearly specified. Further Information Elements are needed to
3027fully specify packet selection with these methods and all their
3028parameters. Further method identifiers may be added to the
3029flowSelectorAlgorithm registry. It might be necessary to define new Information Elements
3030to specify their parameters. The flowSelectorAlgorithm registry
3031is maintained by IANA. New assignments for the registry will be
3032administered by IANA, on a First Come First Served basis
3033[RFC8126], subject to Expert Review [RFC8126]. Please note that
3034the purpose of the flow selection techniques described in this
3035document is the improvement of measurement functions as defined in
3036the Scope (Section 1). Before adding new flow selector algorithms
3037it should be checked what is their intended purpose and especially
3038if those contradict with policies defined in [RFC2804]. The
3039designated expert(s) should consult with the community if a
3040request is received that runs counter to [RFC2804]. The registry
3041can be updated when specifications of the new method(s) and any
3042new Information Elements are provided. The group of experts must
3043double check the flowSelectorAlgorithm definitions and Information
3044Elements with already defined flowSelectorAlgorithm and
3045Information Elements for completeness, accuracy, and redundancy.
3046Those experts will initially be drawn from the Working Group
3047Chairs and document editors of the IPFIX and PSAMP Working Groups.
3048The Intermediate Flow Selection Process Techniques
3049identifiers are defined at [http://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-flowselectoralgorithm].",,,,[RFC7014],0,2013-06-07
3050391,flowSelectedOctetDeltaCount,unsigned64,deltaCounter,current,"This Information Element specifies the volume in octets of all
3051Flows that are selected in the Intermediate Flow Selection Process
3052since the previous report.",octets,,,[RFC7014],1,2014-08-13
3053392,flowSelectedPacketDeltaCount,unsigned64,deltaCounter,current,"This Information Element specifies the volume in packets of all
3054Flows that were selected in the Intermediate Flow Selection
3055Process since the previous report.",packets,,,[RFC7014],1,2014-08-13
3056393,flowSelectedFlowDeltaCount,unsigned64,deltaCounter,current,"This Information Element specifies the number of Flows that were
3057 selected in the Intermediate Flow Selection Process since the last
3058 report.",flows,,,[RFC7014],1,2014-08-13
3059394,selectorIDTotalFlowsObserved,unsigned64,,current,"This Information Element specifies the total number of Flows
3060observed by a Selector, for a specific value of SelectorId. This
3061Information Element should be used in an Options Template scoped
3062to the observation to which it refers. See Section 3.4.2.1 of the
3063IPFIX protocol document [RFC7011].",flows,,,[RFC7014],0,2013-06-07
3064395,selectorIDTotalFlowsSelected,unsigned64,,current,"This Information Element specifies the total number of Flows
3065selected by a Selector, for a specific value of SelectorId. This
3066Information Element should be used in an Options Template scoped
3067to the observation to which it refers. See Section 3.4.2.1 of the
3068IPFIX protocol document [RFC7011].",flows,,,[RFC7014],0,2013-06-07
3069396,samplingFlowInterval,unsigned64,,current,"This Information Element specifies the number of Flows that are
3070consecutively sampled. A value of 100 means that 100 consecutive
3071Flows are sampled. For example, this Information Element may be
3072used to describe the configuration of a systematic count-based
3073Sampling Selector.",flows,,,[RFC7014],0,2013-06-07
3074397,samplingFlowSpacing,unsigned64,,current,"This Information Element specifies the number of Flows between two
3075""samplingFlowInterval""s. A value of 100 means that the next
3076interval starts 100 Flows (which are not sampled) after the
3077current ""samplingFlowInterval"" is over. For example, this
3078Information Element may be used to describe the configuration of a
3079systematic count-based Sampling Selector.",flows,,,[RFC7014],0,2013-06-07
3080398,flowSamplingTimeInterval,unsigned64,,current,"This Information Element specifies the time interval in
3081microseconds during which all arriving Flows are sampled. For
3082example, this Information Element may be used to describe the
3083configuration of a systematic time-based Sampling Selector.",microseconds,,,[RFC7014],0,2013-06-07
3084399,flowSamplingTimeSpacing,unsigned64,,current,"This Information Element specifies the time interval in
3085microseconds between two ""flowSamplingTimeInterval""s. A value of
3086100 means that the next interval starts 100 microseconds (during
3087which no Flows are sampled) after the current
3088""flowsamplingTimeInterval"" is over. For example, this Information
3089Element may used to describe the configuration of a systematic
3090time-based Sampling Selector.",microseconds,,,[RFC7014],0,2013-06-07
3091400,hashFlowDomain,unsigned16,identifier,current,"This Information Element specifies the Information Elements that
3092are used by the Hash-based Flow Selector as the Hash Domain.",,,,[RFC7014],0,2013-06-07
3093401,transportOctetDeltaCount,unsigned64,deltaCounter,current,"The number of octets, excluding IP header(s) and Layer 4 transport
3094protocol header(s), observed for this Flow at the Observation Point
3095since the previous report (if any).",octets,,,[Brian_Trammell],0,2013-08-01
3096402,transportPacketDeltaCount,unsigned64,deltaCounter,current,"The number of packets containing at least one octet beyond the IP header(s) and
3097Layer 4 transport protocol header(s), observed for this Flow at the Observation
3098Point since the previous report (if any).",packets,,,[Brian_Trammell],0,2013-08-01
3099403,originalExporterIPv4Address,ipv4Address,,current,"The IPv4 address used by the Exporting Process on an
3100Original Exporter, as seen by the Collecting Process on an IPFIX
3101Mediator. Used to provide information about the Original
3102Observation Points to a downstream Collector.",,,,[RFC7119],0,2013-12-24
3103404,originalExporterIPv6Address,ipv6Address,,current,"The IPv6 address used by the Exporting Process on an
3104Original Exporter, as seen by the Collecting Process on an IPFIX
3105Mediator. Used to provide information about the Original
3106Observation Points to a downstream Collector.",,,,[RFC7119],0,2013-12-24
3107405,originalObservationDomainId,unsigned32,identifier,current,"The Observation Domain ID reported by the Exporting
3108Process on an Original Exporter, as seen by the Collecting Process
3109on an IPFIX Mediator. Used to provide information about the
3110Original Observation Domain to a downstream Collector. When
3111cascading through multiple Mediators, this identifies the initial
3112Observation Domain in the cascade.",,,,[RFC7119],0,2013-12-24
3113406,intermediateProcessId,unsigned32,identifier,current,"Description: An identifier of an Intermediate Process that is
3114unique per IPFIX Device. Typically, this Information Element is
3115used for limiting the scope of other Information Elements. Note
3116that process identifiers may be assigned dynamically; that is, an
3117Intermediate Process may be restarted with a different ID.",,,,[RFC7119],0,2013-12-24
3118407,ignoredDataRecordTotalCount,unsigned64,totalCounter,current,"Description: The total number of received Data Records that the
3119Intermediate Process did not process since the (re-)initialization
3120of the Intermediate Process; includes only Data Records not
3121examined or otherwise handled by the Intermediate Process due to
3122resource constraints, not Data Records that were examined or
3123otherwise handled by the Intermediate Process but those that
3124merely do not contribute to any exported Data Record due to the
3125operations performed by the Intermediate Process.",,,,[RFC7119],0,2013-12-24
3126408,dataLinkFrameType,unsigned16,flags,current,"This Information Element specifies the type of the selected data
3127link frame.
3128
3129
3130
3131
3132The following data link types are defined here:
3133
3134
3135
3136
3137- 0x01 IEEE802.3 ETHERNET [IEEE802.3]
3138
3139
3140
3141
3142- 0x02 IEEE802.11 MAC Frame format [IEEE802.11]
3143
3144
3145
3146
3147Further values may be assigned by IANA. Note that the assigned
3148values are bits so that multiple observations can be OR'd
3149together.
3150
3151
3152
3153
3154The data link layer is defined in [ISO/IEC.7498-1:1994].",,,[IEEE802.3][IEEE802.11][ISO/IEC.7498-1:1994],[RFC7133],0,2014-01-11
3155409,sectionOffset,unsigned16,quantity,current,"This Information Element specifies the offset of the packet
3156section (e.g., dataLinkFrameSection, ipHeaderPacketSection,
3157ipPayloadPacketSection, mplsLabelStackSection, and
3158mplsPayloadPacketSection). If this Information Element is
3159omitted, it defaults to zero (i.e., no offset).
3160
3161
3162
3163
3164If multiple sectionOffset Information Elements are specified
3165within a single Template, then they apply to the packet section
3166Information Elements in order: the first sectionOffset applies to
3167the first packet section, the second to the second, and so on.
3168Note that the ""closest"" sectionOffset and packet section
3169Information Elements within a given Template are not necessarily
3170related. If there are fewer sectionOffset Information Elements
3171than packet section Information Elements, then subsequent packet
3172section Information Elements have no offset, i.e., a sectionOffset
3173of zero applies to those packet section Information Elements. If
3174there are more sectionOffset Information Elements than the number
3175of packet section Information Elements, then the additional
3176sectionOffset Information Elements are meaningless.",,,,[RFC7133],0,2014-01-11
3177410,sectionExportedOctets,unsigned16,quantity,current,"This Information Element specifies the observed length of the
3178packet section (e.g., dataLinkFrameSection, ipHeaderPacketSection,
3179ipPayloadPacketSection, mplsLabelStackSection, and
3180mplsPayloadPacketSection) when padding is used.
3181
3182
3183
3184
3185The packet section may be of a fixed size larger than the
3186sectionExportedOctets. In this case, octets in the packet section
3187beyond the sectionExportedOctets MUST follow the [RFC7011] rules
3188for padding (i.e., be composed of zero (0) valued octets).",,,[RFC7011],[RFC7133],0,2014-01-11
3189411,dot1qServiceInstanceTag,octetArray,default,current,"This Information Element, which is 16 octets long, represents the
3190Backbone Service Instance Tag (I-TAG) Tag Control Information
3191(TCI) field of an Ethernet frame as described in [IEEE802.1Q]. It
3192encodes the Backbone Service Instance Priority Code Point (I-PCP),
3193Backbone Service Instance Drop Eligible Indicator (I-DEI), Use Customer Addresses (UCAs),
3194Backbone Service Instance Identifier (I-SID), Encapsulated
3195Customer Destination Address (C-DA), Encapsulated Customer Source
3196Address (C-SA), and reserved fields. The structure and semantics
3197within the Tag Control Information field are defined in
3198[IEEE802.1Q].",,,[IEEE802.1Q],[RFC7133],1,2014-05-02
3199412,dot1qServiceInstanceId,unsigned32,identifier,current,"The value of the 24-bit Backbone Service Instance Identifier
3200(I-SID) portion of the Backbone Service Instance Tag (I-TAG) Tag
3201Control Information (TCI) field of an Ethernet frame as described
3202in [IEEE802.1Q].",,"The valid range is 0 - 16777215 (i.e., 24 bits).",[IEEE802.1Q],[RFC7133],1,2014-05-02
3203413,dot1qServiceInstancePriority,unsigned8,identifier,current,"The value of the 3-bit Backbone Service Instance Priority Code
3204Point (I-PCP) portion of the Backbone Service Instance Tag (I-TAG)
3205Tag Control Information (TCI) field of an Ethernet frame as
3206described in [IEEE802.1Q].",,The valid range is 0-7.,[IEEE802.1Q],[RFC7133],1,2014-05-02
3207414,dot1qCustomerSourceMacAddress,macAddress,default,current,"The value of the Encapsulated Customer Source Address (C-SA)
3208portion of the Backbone Service Instance Tag (I-TAG) Tag Control
3209Information (TCI) field of an Ethernet frame as described in
3210[IEEE802.1Q].",,,[IEEE802.1Q],[RFC7133],1,2014-05-02
3211415,dot1qCustomerDestinationMacAddress,macAddress,default,current,"The value of the Encapsulated Customer Destination Address (C-DA)
3212portion of the Backbone Service Instance Tag (I-TAG) Tag Control
3213Information (TCI) field of an Ethernet frame as described in
3214[IEEE802.1Q].",,,[IEEE802.1Q],[RFC7133],1,2014-05-02
3215416,,,,deprecated,"Duplicate of Information Element ID 352, layer2OctetDeltaCount.",,,[RFC5477],,2,2014-05-13
3216417,postLayer2OctetDeltaCount,unsigned64,deltaCounter,current,"The definition of this Information Element is identical to the
3217definition of the layer2OctetDeltaCount Information Element,
3218except that it reports a potentially modified value caused by a
3219middlebox function after the packet passed the Observation Point.
3220
3221
3222
3223
3224This Information Element is the layer 2 version of
3225postOctetDeltaCount (ElementId #23).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3226418,postMCastLayer2OctetDeltaCount,unsigned64,deltaCounter,current,"The number of layer 2 octets since the previous report (if any) in
3227outgoing multicast packets sent for packets of this Flow by a
3228multicast daemon within the Observation Domain. This property
3229cannot necessarily be observed at the Observation Point but may
3230be retrieved by other means. The number of octets includes layer
32312 header(s) and layer 2 payload.
3232
3233
3234
3235
3236This Information Element is the layer 2 version of
3237postMCastOctetDeltaCount (ElementId #20).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3238419,,,,deprecated,"Duplicate of Information Element ID 353, layer2OctetTotalCount.",,,[RFC5477],,2,2014-05-13
3239420,postLayer2OctetTotalCount,unsigned64,totalCounter,current,"The definition of this Information Element is identical to the
3240definition of the layer2OctetTotalCount Information Element,
3241except that it reports a potentially modified value caused by a
3242middlebox function after the packet passed the Observation Point.
3243
3244
3245
3246
3247This Information Element is the layer 2 version of
3248postOctetTotalCount (ElementId #171).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3249421,postMCastLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of layer 2 octets in outgoing multicast packets
3250sent for packets of this Flow by a multicast daemon in the
3251Observation Domain since the Metering Process (re-)initialization.
3252This property cannot necessarily be observed at the Observation
3253Point but may be retrieved by other means. The number of octets
3254includes layer 2 header(s) and layer 2 payload.
3255
3256
3257
3258
3259This Information Element is the layer 2 version of
3260postMCastOctetTotalCount (ElementId #175).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3261422,minimumLayer2TotalLength,unsigned64,,current,"Layer 2 length of the smallest packet observed for this Flow. The
3262packet length includes the length of the layer 2 header(s) and the
3263length of the layer 2 payload.
3264
3265
3266
3267
3268This Information Element is the layer 2 version of
3269minimumIpTotalLength (ElementId #25).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3270423,maximumLayer2TotalLength,unsigned64,,current,"Layer 2 length of the largest packet observed for this Flow. The
3271packet length includes the length of the layer 2 header(s) and the length of the layer
32722 payload.
3273
3274
3275
3276
3277This Information Element is the layer 2 version of
3278maximumIpTotalLength (ElementId #26).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3279424,droppedLayer2OctetDeltaCount,unsigned64,deltaCounter,current,"The number of layer 2 octets since the previous report (if any) in
3280packets of this Flow dropped by packet treatment. The number of
3281octets includes layer 2 header(s) and layer 2 payload.
3282
3283
3284
3285
3286This Information Element is the layer 2 version of
3287droppedOctetDeltaCount (ElementId #132).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3288425,droppedLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed layer 2 packets (including
3289the layer 2 header) that were dropped by packet treatment since
3290the (re-)initialization of the Metering Process.
3291
3292
3293
3294
3295This Information Element is the layer 2 version of
3296droppedOctetTotalCount (ElementId #134).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3297426,ignoredLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed layer 2 packets (including
3298the layer 2 header) that the Metering Process did not process
3299since the (re-)initialization of the Metering Process.
3300
3301
3302
3303
3304This Information Element is the layer 2 version of
3305ignoredOctetTotalCount (ElementId #165).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3306427,notSentLayer2OctetTotalCount,unsigned64,totalCounter,current,"The total number of octets in observed layer 2 packets (including
3307the layer 2 header) that the Metering Process did not process
3308since the (re-)initialization of the Metering Process.
3309
3310
3311
3312
3313This Information Element is the layer 2 version of
3314notSentOctetTotalCount (ElementId #168).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3315428,layer2OctetDeltaSumOfSquares,unsigned64,deltaCounter,current,"The sum of the squared numbers of layer 2 octets per incoming
3316packet since the previous report (if any) for this Flow at the
3317Observation Point. The number of octets includes layer 2
3318header(s) and layer 2 payload.
3319
3320
3321
3322
3323This Information Element is the layer 2 version of
3324octetDeltaSumOfSquares (ElementId #198).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3325429,layer2OctetTotalSumOfSquares,unsigned64,totalCounter,current,"The total sum of the squared numbers of layer 2 octets in incoming
3326packets for this Flow at the Observation Point since the Metering
3327Process (re-)initialization for this Observation Point. The
3328number of octets includes layer 2 header(s) and layer 2 payload.
3329
3330
3331
3332
3333This Information Element is the layer 2 version of
3334octetTotalSumOfSquares (ElementId #199).",octets,,[RFC5477],[RFC7133],1,2014-05-02
3335430,layer2FrameDeltaCount,unsigned64,deltaCounter,current,"The number of incoming layer 2 frames since the
3336previous report (if any) for this Flow at the
3337Observation Point.",frames,,,[ipfix-iana_at_cisco.com],0,2014-05-02
3338431,layer2FrameTotalCount,unsigned64,totalCounter,current,"The total number of incoming layer 2 frames
3339for this Flow at the Observation Point since
3340the Metering Process (re-)initialization for
3341this Observation Point.",frames,,,[ipfix-iana_at_cisco.com],0,2014-05-02
3342432,pseudoWireDestinationIPv4Address,ipv4Address,default,current,The destination IPv4 address of the PSN tunnel carrying the pseudowire.,,,[RFC3985],[ipfix-iana_at_cisco.com],0,2014-05-28
3343433,ignoredLayer2FrameTotalCount,unsigned64,totalCounter,current,"The total number of observed layer 2 frames that the Metering Process
3344did not process since the (re-)initialization of the Metering Process.
3345This Information Element is the layer 2 version of ignoredPacketTotalCount (ElementId #164).",frames,,,[ipfix-iana_at_cisco.com],0,2014-06-27
3346434,mibObjectValueInteger,signed32,quantity,current,"An IPFIX Information Element that denotes that the
3347integer value of a MIB object will be exported. The MIB Object
3348Identifier (""mibObjectIdentifier"") for this field MUST be exported
3349in a MIB Field Option or via another means. This Information
3350Element is used for MIB objects with the Base syntax of Integer32
3351and INTEGER with IPFIX reduced-size encoding used as required.
3352The value is encoded as per the standard IPFIX Abstract Data Type
3353of signed32.",,,,[RFC8038],1,2017-04-30
3354435,mibObjectValueOctetString,octetArray,default,current,"An IPFIX Information Element that denotes that an
3355Octet String or Opaque value of a MIB object will be exported.
3356The MIB Object Identifier (""mibObjectIdentifier"") for this field
3357MUST be exported in a MIB Field Option or via another means. This
3358Information Element is used for MIB objects with the Base syntax
3359of OCTET STRING and Opaque. The value is encoded as per the
3360standard IPFIX Abstract Data Type of octetArray.",,,,[RFC8038],0,2015-12-13
3361436,mibObjectValueOID,octetArray,default,current,"An IPFIX Information Element that denotes that an
3362Object Identifier or OID value of a MIB object will be exported.
3363The MIB Object Identifier (""mibObjectIdentifier"") for this field
3364MUST be exported in a MIB Field Option or via another means. This
3365Information Element is used for MIB objects with the Base syntax
3366of OBJECT IDENTIFIER. Note: In this case, the
3367""mibObjectIdentifier"" defines which MIB object is being exported,
3368and the ""mibObjectValueOID"" field will contain the OID value of
3369that MIB object. The mibObjectValueOID Information Element is
3370encoded as ASN.1/BER [X.690] in an octetArray.",,,,[RFC8038],0,2015-12-13
3371437,mibObjectValueBits,octetArray,flags,current,"An IPFIX Information Element that denotes that a set
3372of Enumerated flags or bits from a MIB object will be exported.
3373The MIB Object Identifier (""mibObjectIdentifier"") for this field
3374MUST be exported in a MIB Field Option or via another means. This
3375Information Element is used for MIB objects with the Base syntax
3376of BITS. The flags or bits are encoded as per the standard IPFIX
3377Abstract Data Type of octetArray, with sufficient length to
3378accommodate the required number of bits. If the number of bits is
3379not an integer multiple of octets, then the most significant bits
3380at the end of the octetArray MUST be set to 0.",,,,[RFC8038],0,2015-12-13
3381438,mibObjectValueIPAddress,ipv4Address,default,current,"An IPFIX Information Element that denotes that the
3382IPv4 address value of a MIB object will be exported. The MIB
3383Object Identifier (""mibObjectIdentifier"") for this field MUST be
3384exported in a MIB Field Option or via another means. This
3385Information Element is used for MIB objects with the Base syntax
3386of IpAddress. The value is encoded as per the standard IPFIX
3387Abstract Data Type of ipv4Address.",,,,[RFC8038],0,2015-12-13
3388439,mibObjectValueCounter,unsigned64,snmpCounter,current,"An IPFIX Information Element that denotes that the
3389counter value of a MIB object will be exported. The MIB Object
3390Identifier (""mibObjectIdentifier"") for this field MUST be exported
3391in a MIB Field Option or via another means. This Information
3392Element is used for MIB objects with the Base syntax of Counter32
3393or Counter64 with IPFIX reduced-size encoding used as required.
3394The value is encoded as per the standard IPFIX Abstract Data Type
3395of unsigned64.",,,,[RFC8038],0,2015-12-13
3396440,mibObjectValueGauge,unsigned32,snmpGauge,current,"An IPFIX Information Element that denotes that the
3397Gauge value of a MIB object will be exported. The MIB Object
3398Identifier (""mibObjectIdentifier"") for this field MUST be exported
3399in a MIB Field Option or via another means. This Information
3400Element is used for MIB objects with the Base syntax of Gauge32.
3401The value is encoded as per the standard IPFIX Abstract Data Type
3402of unsigned32. This value represents a non-negative integer that
3403may increase or decrease but that shall never exceed a maximum
3404value or fall below a minimum value.",,,,[RFC8038],0,2015-12-13
3405441,mibObjectValueTimeTicks,unsigned32,quantity,current,"An IPFIX Information Element that denotes that the
3406TimeTicks value of a MIB object will be exported. The MIB Object
3407Identifier (""mibObjectIdentifier"") for this field MUST be exported
3408in a MIB Field Option or via another means. This Information
3409Element is used for MIB objects with the Base syntax of TimeTicks.
3410The value is encoded as per the standard IPFIX Abstract Data Type
3411of unsigned32.",,,,[RFC8038],1,2017-04-30
3412442,mibObjectValueUnsigned,unsigned32,quantity,current,"An IPFIX Information Element that denotes that an
3413unsigned integer value of a MIB object will be exported. The MIB
3414Object Identifier (""mibObjectIdentifier"") for this field MUST be
3415exported in a MIB Field Option or via another means. This
3416Information Element is used for MIB objects with the Base syntax
3417of unsigned32 with IPFIX reduced-size encoding used as required.
3418The value is encoded as per the standard IPFIX Abstract Data Type
3419of unsigned32.",,,,[RFC8038],1,2017-04-30
3420443,mibObjectValueTable,subTemplateList,list,current,"An IPFIX Information Element that denotes that a
3421complete or partial conceptual table will be exported. The MIB
3422Object Identifier (""mibObjectIdentifier"") for this field MUST be
3423exported in a MIB Field Option or via another means. This
3424Information Element is used for MIB objects with a syntax of
3425SEQUENCE OF. This is encoded as a subTemplateList of mibObjectValue
3426Information Elements. The Template specified in the
3427subTemplateList MUST be an Options Template and MUST include all
3428the objects listed in the INDEX clause as Scope Fields.",,,,[RFC8038],1,2017-04-30
3429444,mibObjectValueRow,subTemplateList,list,current,"An IPFIX Information Element that denotes that a
3430single row of a conceptual table will be exported. The MIB Object
3431Identifier (""mibObjectIdentifier"") for this field MUST be exported
3432in a MIB Field Option or via another means. This Information
3433Element is used for MIB objects with a syntax of SEQUENCE. This
3434is encoded as a subTemplateList of mibObjectValue Information
3435Elements. The subTemplateList exported MUST contain exactly one
3436row (i.e., one instance of the subTemplate). The Template
3437specified in the subTemplateList MUST be an Options Template and
3438MUST include all the objects listed in the INDEX clause as Scope
3439Fields.",,,,[RFC8038],0,2015-12-13
3440445,mibObjectIdentifier,octetArray,default,current,"An IPFIX Information Element that denotes that a MIB
3441Object Identifier (MIB OID) is exported in the (Options)
3442Template Record. The mibObjectIdentifier Information Element
3443contains the OID assigned to the MIB object type definition
3444encoded as ASN.1/BER [X.690].",,,,[RFC8038],0,2015-12-13
3445446,mibSubIdentifier,unsigned32,identifier,current,A non-negative sub-identifier of an Object Identifier (OID).,,,,[RFC8038],0,2015-12-13
3446447,mibIndexIndicator,unsigned64,flags,current,"A set of bit fields that is used for marking the
3447Information Elements of a Data Record that serve as INDEX MIB
3448objects for an indexed columnar MIB object. Each bit represents
3449an Information Element in the Data Record, with the n-th least
3450significant bit representing the n-th Information Element. A bit
3451set to 1 indicates that the corresponding Information Element is
3452an index of the columnar object represented by the mibObjectValue.
3453A bit set to 0 indicates that this is not the case.
3454
3455
3456
3457
3458If the Data Record contains more than 64 Information Elements, the
3459corresponding Template SHOULD be designed such that all index
3460fields are among the first 64 Information Elements, because the
3461mibIndexIndicator only contains 64 bits. If the Data Record
3462contains less than 64 Information Elements, then the extra bits in
3463the mibIndexIndicator for which no corresponding Information
3464Element exists MUST have the value 0 and must be disregarded by
3465the Collector. This Information Element may be exported with
3466IPFIX reduced-size encoding.",,,,[RFC8038],0,2015-12-13
3467448,mibCaptureTimeSemantics,unsigned8,identifier,current,"Indicates when in the lifetime of the Flow the MIB
3468value was retrieved from the MIB for a mibObjectIdentifier. This
3469is used to indicate if the value exported was collected from the
3470MIB closer to Flow creation or Flow export time and refers to the
3471Timestamp fields included in the same Data Record. This field
3472SHOULD be used when exporting a mibObjectValue that specifies
3473counters or statistics.
3474
3475
3476
3477
3478If the MIB value was sampled by SNMP prior to the IPFIX Metering
3479Process or Exporting Process retrieving the value (i.e., the data
3480is already stale) and it is important to know the exact sampling
3481time, then an additional observationTime* element should be paired
3482with the OID using IPFIX Structured Data [RFC6313]. Similarly, if
3483different MIB capture times apply to different mibObjectValue elements
3484within the Data Record, then individual mibCaptureTimeSemantics
3485Information Elements should be paired with each OID using IPFIX
3486Structured Data.
3487
3488
3489
3490
3491Values:
3492
3493
3494
3495
34960 undefined
3497
3498
3499
3500
35011 begin - The value for the MIB object is captured from the
3502MIB when the Flow is first observed
3503
3504
3505
3506
35072 end - The value for the MIB object is captured from the MIB
3508when the Flow ends
3509
3510
3511
3512
35133 export - The value for the MIB object is captured from the
3514MIB at export time
3515
3516
3517
3518
35194 average - The value for the MIB object is an average of
3520multiple captures from the MIB over the observed life of the
3521Flow",,,,[RFC8038],0,2015-12-13
3522449,mibContextEngineID,octetArray,default,current,"A mibContextEngineID that specifies the SNMP engine
3523ID for a MIB field being exported over IPFIX. Definition as per
3524[RFC3411], Section 3.3.",,,,[RFC8038],0,2015-12-13
3525450,mibContextName,string,default,current,"An Information Element that denotes that a MIB
3526context name is specified for a MIB field being exported over
3527IPFIX. Reference [RFC3411], Section 3.3.",,,,[RFC8038],0,2015-12-13
3528451,mibObjectName,string,default,current,"The name (called a descriptor in [RFC2578]
3529of an object type definition.",,,,[RFC8038],0,2015-12-13
3530452,mibObjectDescription,string,default,current,"The value of the DESCRIPTION clause of a MIB object
3531type definition.",,,,[RFC8038],0,2015-12-13
3532453,mibObjectSyntax,string,default,current,"The value of the SYNTAX clause of a MIB object type
3533definition, which may include a textual convention or sub-typing.
3534See [RFC2578].",,,,[RFC8038],0,2015-12-13
3535454,mibModuleName,string,default,current,"The textual name of the MIB module that defines a MIB
3536object.",,,,[RFC8038],0,2015-12-13
3537455,mobileIMSI,string,default,current,"The International Mobile Subscription Identity (IMSI). The
3538IMSI is a decimal digit string with up to a maximum of 15 ASCII/UTF-8
3539encoded digits (0x30 - 0x39).",,,[3GPP TS 23.003] Section 3 and [ITU-T E.164].,[ipfix-iana_at_cisco.com],0,2015-12-15
3540456,mobileMSISDN,string,default,current,"The Mobile Station International Subscriber Directory Number
3541(MSISDN). The MSISDN is a decimal digit string with up to a maximum of 15
3542ASCII/UTF-8 encoded digits (0x30 - 0x39).",,,[3GPP TS 23.003] Section 3 and [ITU-T E.164].,[ipfix-iana_at_cisco.com],0,2015-12-15
3543457,httpStatusCode,unsigned16,identifier,current,"The HTTP Response Status Code, as defined in
3544section 6 of [RFC7231],
3545associated with a flow. Implies that the flow
3546record represents a flow containing an HTTP
3547Response.",,0-999,[RFC7231],[Andrew_Feren],0,2016-04-28
3548458,sourceTransportPortsLimit,unsigned16,quantity,current,"This Information Element contains the maximum
3549number of IP source transport ports that can be used by an end
3550user when sending IP packets; each user is associated with one
3551or more (source) IPv4 or IPv6 addresses. This Information
3552Element is particularly useful in address-sharing deployments
3553that adhere to REQ-4 of [RFC6888]. Limiting the number of
3554ports assigned to each user ensures fairness among users and
3555mitigates the denial-of-service attack that a user could launch
3556against other users through the address-sharing device in order
3557to grab more ports.",ports,1-65535,,[RFC8045][RFC Errata 5009],1,2017-08-01
3558459,httpRequestMethod,string,,current,"The HTTP request method, as defined in section 4 of
3559[RFC7231], associated with a
3560flow. String with up to 8 UTF-8 characters.",,,,[Felix_Erlacher],0,2016-11-15
3561460,httpRequestHost,string,,current,"The HTTP request host, as defined in section 5.4 of
3562[RFC7230] or, in the case of
3563HTTP/2, the content of the :authority pseudo-header
3564field as defined in section 8.1.2.3 of
3565[RFC7240]. Encoded in UTF-8.",,,,[Felix_Erlacher],0,2016-11-15
3566461,httpRequestTarget,string,,current,"The HTTP request target, as defined in section 2 of
3567[RFC7231] and in section 5.3 of
3568[RFC7230], associated with a flow.
3569Or the HTTP/2 "":path"" pseudo-header field as defined in
3570section 8.1.2.3 of [RFC7240].
3571Encoded in UTF-8.",,,,[Felix_Erlacher],0,2016-11-15
3572462,httpMessageVersion,string,,current,"The version of an HTTP/1.1 message as indicated by the
3573HTTP-version field, defined in section 2.6 of
3574[RFC7230], or the version
3575identification of an HTTP/2 frame as defined in
3576[RFC7240] section 3.1. The length
3577of this field is limited to 10 characters, UTF-8 encoded.",,,,[Felix_Erlacher],0,2016-11-15
3578463,natInstanceID,unsigned32,identifier,current,"This Information Element uniquely identifies an Instance
3579 of the NAT that runs on a NAT middlebox function after the packet
3580 passes the Observation Point. natInstanceID is defined in
3581 [RFC7659]",,,"See [RFC791] for the definition of the IPv4
3582 source address field. See [RFC3022]
3583 for the definition of NAT. See [RFC3234]
3584 for the definition of middleboxes.",[RFC-ietf-behave-ipfix-nat-logging-13],0,2017-03-15
3585464,internalAddressRealm,octetArray,identifier,current,"This Information Element represents the internal address realm where
3586 the packet is originated from or destined to. By definition, a NAT
3587 mapping can be created from two address realms, one from internal and
3588 one from external. Realms are implementation dependent and can
3589 represent a Virtual Routing and Forwarding (VRF) ID, a VLAN ID, or
3590 some unique identifier. Realms are optional, and when left
3591 unspecified, would mean that the external and internal realms are the
3592 same.",,,"See [RFC791] for the definition of the IPv4
3593 source address field. See [RFC3022]
3594 for the definition of NAT. See [RFC3234]
3595 for the definition of middleboxes.",[RFC-ietf-behave-ipfix-nat-logging-13],0,2017-03-15
3596465,externalAddressRealm,octetArray,identifier,current,"This Information Element represents the external address
3597 realm where the packet is originated from or destined to. The
3598 detailed definition is in the internal address realm as specified
3599 above.",,,"See [RFC791] for the definition of the IPv4
3600 source address field. See [RFC3022]
3601 for the definition of NAT. See [RFC3234]
3602 for the definition of middleboxes.",[RFC-ietf-behave-ipfix-nat-logging-13],0,2017-03-15
3603466,natQuotaExceededEvent,unsigned32,identifier,current,"This Information Element identifies the type of a NAT
3604 Quota Exceeded event. Values for this Information Element are listed
3605 in the NAT Quota Exceeded Event Type registry, see [http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-quota-exceeded-event].
3606 New assignments of values will be administered by IANA and are subject to
3607 Expert Review [RFC8126]. Experts need to check definitions of new
3608 values for completeness, accuracy, and redundancy.",,,"See [RFC791] for the definition of the IPv4
3609 source address field. See [RFC3022]
3610 for the definition of NAT. See [RFC3234]
3611 for the definition of middleboxes.",[RFC-ietf-behave-ipfix-nat-logging-13],0,2017-03-15
3612467,natThresholdEvent,unsigned32,identifier,current,"This Information Element identifies a type of a NAT
3613 Threshold event. Values for this Information Element are listed in
3614 the NAT Threshold Event Type registry, see [http://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-nat-threshold-event].
3615 New
3616 assignments of values will be administered by IANA and are subject to
3617 Expert Review [RFC8126]. Experts need to check definitions of new
3618 values for completeness, accuracy, and redundancy.",,,"See [RFC791] for the definition of the IPv4
3619 source address field. See [RFC3022]
3620 for the definition of NAT. See [RFC3234]
3621 for the definition of middleboxes.",[RFC-ietf-behave-ipfix-nat-logging-13],0,2017-03-15
3622468,httpUserAgent,string,default,current,"The HTTP User-Agent header field as defined in section 5.5.3 of
3623 [RFC7231]. Encoded in UTF-8.",,,[RFC7231],[Andrew_Feren],0,2017-04-19
3624469,httpContentType,string,default,current,"The HTTP Content-Type header field as defined in section 3.1.1.5 of
3625 [RFC7231]. Encoded in UTF-8.",,,[RFC7231],[Andrew_Feren],0,2017-04-19
3626470,httpReasonPhrase,string,default,current,"The HTTP reason phrase as defined in section 6.1 of of
3627 [RFC7231].",,,[RFC7231],[Felix_Erlacher],0,2017-06-19